JP2011123898A - Device, method, program and system for managing use restriction - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To facilitate the use restrictions of a plurality of image forming apparatuses without charging cost. <P>SOLUTION: An authentication management part 24 receives an inquiry result from an external authentication server 30A through a second interface 27, and reads restriction information of a user A from a restriction information storing part 23 to transmit the restriction information to a compound machine 10A through a first interface 21 when the user A is valid. In addition, the authentication management part 24 transmits an error showing an authentication failure to the compound machine 10A through the first interface 21 when the user A is not valid. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a use restriction management apparatus, method, program, and system for restricting use of a plurality of image forming apparatuses.

  Currently, in offices, OA devices such as personal computers (hereinafter referred to as PCs), printers, copiers, facsimiles, and multi-function machines integrating these are commonly used via a network. For example, when a printer is shared by a plurality of personal computers, it can also be used by a printer managed by another department connected to the network.

  However, it is not preferable from the viewpoint of security that all users can use all functions such as a printer, a copy, a scanner, and a facsimile without limitation in such a multifunction machine. For example, depending on the department to which the user belongs and the job title of the user, it may be necessary to limit the use of the multifunction device itself or to limit available functions.

  Therefore, a technique that can easily enhance the security function has been proposed (see, for example, Patent Document 1). In Patent Document 1, the image forming apparatus previously registers a user code for identifying a user. User service related to image formation processing by the user based on the user database, the operation panel for inputting the user code when the image forming apparatus is used, and the user code of the user database and the input user code A secure application that determines whether or not to provide an SCS, and an SCS that transmits a key event acquired from the operation panel to the secure application.

  As a result, the image forming apparatus can be used by the secure application based on the user code registered in the user database and based on the usage authority registered in the user database. Restrict functions.

  In addition, an information device network system has been proposed in which user information is confirmed by each device on a server, thereby reducing time loss in user information management (see, for example, Patent Document 2).

  In Patent Document 2, when using a complex office device, a message prompting the user name is displayed on the LCD, and the operator waits until a card containing the user name is inserted. When the user name is input by the card, a message prompting the operator to input a password is displayed on the LCD. Then wait until the password is entered. When a password is entered, user data is created by adding the machine name to the user name and password, and the user data is transmitted to the multi-function office device registered as a server via the network. When the response is received from the server and the access permission data is received, the operator performs an operation desired by the operator using the LCD and Keys.

Japanese Patent No. 3655303 JP 2000-20471 A

  However, in the case of Patent Document 1, it is necessary to set a user for each image forming apparatus. When a plurality of image forming apparatuses are targeted, it is necessary to maintain user restriction information for each image forming apparatus. It becomes a problem in terms of information management.

  In the case of Patent Document 2, there is the following problem when user information is managed by a plurality of different external authentication services. When the restriction information is complicated including the upper limit information, the information holding structure is different for each external authentication service. Therefore, it is necessary to support a plurality of external authentication services for each device, and there are problems in terms of development man-hours and costs.

  The present invention has been proposed to solve the above-described problems, and provides a use restriction management apparatus, method, program, and system that can easily restrict use of a plurality of image forming apparatuses without incurring costs. The purpose is to provide.

  The use restriction management apparatus according to the present invention includes a restriction information storage unit that stores restriction information that represents a use restriction of a service providing apparatus for each user, a receiving unit that receives user information input in the service providing apparatus, Authentication that determines which of the plurality of authentication devices connected via the network is inquired as to whether or not the user has a legitimate authority based on the user information received by the receiving means. An inquiry unit that transmits user information received by the reception unit to the authentication device determined by the authentication device determination unit and inquires whether the user has a legitimate authority; When there is a response from the authentication device that the user has a legitimate authority, Reads the restriction information of the user, and information based on the read restriction information and a transmitting means for transmitting to said service providing apparatus.

  The service providing apparatus refers to a device that provides various processes (services) such as document data processing such as copying, scanning, facsimile transmission / reception, image processing, and printing. The restriction information stored in the restriction information storage means represents the use restriction of the service providing apparatus for each user. An available service providing device refers to a service providing device that can be used by a predetermined user. The use restriction of the service providing device refers to use restriction of a part or all of the functions of the service providing device.

  The accepting means accepts user information input in the service providing apparatus. Based on the user information received by the reception unit, the authentication device determination unit determines which of the plurality of authentication devices connected via the network has a valid authority to the user. Decide whether to inquire. The inquiry unit transmits the user information received by the reception unit to the authentication apparatus, and inquires whether the user has a valid authority. The authentication device responds to this inquiry.

  The transmitting means reads out the restriction information of the user from the restriction information storage means when there is a response from the authentication device that the user has a legitimate authority, and provides information based on the read restriction information. Send to the provider.

  Thereby, the use restriction management device can easily manage the use restriction of the service providing device. The present invention is also applicable to a usage restriction management method and program.

  In addition, the use restriction management system according to the present invention includes a service providing apparatus including an input unit for inputting user information, and a restriction information storage unit that stores restriction information that represents the use restriction of the service providing apparatus for each user. A receiving unit that receives user information input in the service providing device, and a user who is connected to any of the plurality of authentication devices connected via a network based on the user information received by the receiving unit. Transmitting the user information accepted by the accepting means to the authenticating device determined by the authenticating device determining means and the authenticating device determined by the authenticating device determining means; Inquiry means for inquiring whether or not the user has a legitimate authority; A transmission unit that reads the user restriction information from the restriction information storage unit and transmits information based on the read restriction information to the service providing device when a response indicating that the user has an authority is received; The service providing device provides a service according to the usage restriction indicated by the restriction information transmitted from the usage restriction management device.

  Therefore, according to the above invention, the use restriction management apparatus can easily manage use restrictions of a plurality of service providing apparatuses.

  The present invention can easily manage use restrictions of a plurality of service providing apparatuses.

It is a block diagram which shows the structure of the use restriction management system which concerns on embodiment of this invention. 1 is a block diagram illustrating a configuration of a multifunction machine. It is a figure which shows the restriction | limiting information memorize | stored in the restriction | limiting information storage part. It is a flowchart which shows the process sequence of the authentication management part of a use restriction management apparatus.

  Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings.

[First Embodiment]
FIG. 1 is a block diagram showing a configuration of a usage restriction management system according to an embodiment of the present invention. The usage restriction management system includes a plurality of multifunction machines 10A, 10B, and 10C having copy, facsimile, and scanning functions, a usage restriction management apparatus 20 that manages usage restrictions of each multifunction machine, and a plurality of users that perform user authentication. External authentication servers 30A and 30B. Hereinafter, when any one of the multifunction peripherals 10A, 10B, and 10C is indicated, it is simply referred to as “multifunction peripheral 10”. Similarly, when any one of the external authentication servers 30A and 30B is indicated, it is simply referred to as “external authentication server 30”.

  FIG. 2 is a block diagram illustrating a configuration of the multifunction machine 10. The multifunction device 10 scans an image recorded on a document, records an electrostatic latent image on a photoconductor, develops the electrostatic latent image using monochrome toner or color toner, and records the developed image. A printer unit 12 that transfers and outputs a facsimile message and a facsimile (hereinafter referred to as “FAX”) unit 13 that transmits and receives a facsimile message are provided.

  The multi-function device 10 further includes a controller 14 that controls the whole, a memory 15 that stores image data read by the scanner unit 11, image data received via a network, data of a FAX reception message, and the like, and an icon. A control panel 16 that displays an operation screen and inputs operation information in response to contact with an icon, an input / output port 17 for inputting / outputting data, and a communication control unit 18 for communicating with devices connected to a network. And.

  The scanner unit 11, the printer unit 12, the FAX unit 13, the controller 14, the memory 15, the control panel 16, and the input / output port 17 are connected to each other via a bus. The input / output port 17 is connected to the network via the communication control unit 18.

  In addition to the above, the memory 15 stores restriction information for restricting the functions of the multifunction machine 10. For example, when the restriction information is stored in the memory 15, the controller 14 controls the scanner unit 11, the printer unit 12, and the FAX unit 13 according to the restriction information.

  The user's account name and password are input to the control panel 16 when logging in. These pieces of information are transmitted to the usage restriction management apparatus 20 via the input / output port 17 and the communication control unit 18.

  The usage restriction management device 20 transmits the user ID and password transmitted from the multifunction device 10 to the external authentication server 30, and transmits restriction information regarding the user authenticated by the external authentication server 30 to the multifunction device 10.

  Specifically, the usage restriction management device 20 includes a first interface 21 that is an interface for connecting to each MFP 10 via a network, a restriction information setting unit 22 that sets restriction information, and restriction information. A restriction information storage unit 23 for storing, an authentication management unit 24 for performing overall control of the apparatus, an internal user information setting unit 25 for setting internal user information, an internal user information storage unit 26 for storing internal user information, And a second interface 27 for connecting to each external authentication server via a network.

  The restriction information setting unit 22 stores, in the restriction information storage unit 23, restriction information indicating a multifunction device that can be used for each user and a function that can be used by the multifunction device.

  FIG. 3 is a diagram illustrating the restriction information stored in the restriction information storage unit 23. According to FIG. 3, the user A can use color copying, black and white copying, and scanning for the multifunction peripherals 10A and 10B, but cannot use fax millimeters. Note that the actual copy value of the user A so far is 500 sheets, and the user A can copy up to 1000 sheets of the copy upper limit value. User B can use monochrome copying and facsimile for the multifunction peripherals 10A and 10C, but cannot use scanning. Note that the actual copy value of the user B so far is 100, and the user B has no copy upper limit value.

  The authentication management unit 24 makes an inquiry to the external authentication server 30 about the validity of the user, and performs control to transmit restriction information about the user who is authenticated as valid to the multifunction device 10. The authentication management unit 24 also performs authentication for a user (for example, a temporary user) that cannot be authenticated by the external authentication server 30.

  The internal user information setting unit 25 sets user information (for example, an account name and password) of a user who cannot be authenticated by the external authentication server 30 (hereinafter referred to as “internal user”) in the internal user information storage unit 26. Therefore, the internal user information storage unit 26 stores user information for each internal user.

  The external authentication server 30 authenticates whether or not the user who has logged into the multifunction machine 10 is valid. The external authentication server 30 has a user information storage unit (not shown) that stores user information (for example, account name and password) for each user. The external authentication server 30 determines whether the user information exists in the user information storage unit when the user restriction is transmitted from the use restriction management device 20 and the user is inquired. If it is valid and does not exist, it is determined that the user is not valid.

  The usage restriction management system configured as described above manages usage restrictions for each user as follows.

  For example, when the user A inputs user information (account name and password) to the control panel 16 of the multifunction device 10 </ b> A, the multifunction device 10 </ b> A transmits the user information to the use restriction management apparatus 20.

  FIG. 4 is a flowchart illustrating a processing procedure of the authentication management unit 24 of the usage restriction management device 20. The authentication management unit 24 restricts the use of the multifunction peripheral 10 by performing the following processing.

  In step S1, the authentication management unit 24 of the usage restriction management apparatus 20 stands by until user information is input to the first interface 21, and when detecting that user information has been input, proceeds to step S2.

  In step S2, the authentication management unit 24 determines which of the external authentication servers 30A and 30B is to be inquired based on the input user information or whether to authenticate with the internal user information without making an inquiry to the external authentication server. (In this case, the external authentication server 30A is determined). For example, as a determination method, the authentication server to be inquired may be determined from the input account name format such as “Last name-Name”, “Last name.Name”, “Employee number”, or the like. Then, the authentication management unit 24 transmits user information to the external authentication server 30A via the second interface 27, inquires about the validity of the user A indicated by the user information, and proceeds to step S3. Here, both external authentication servers 30A and 30B may be inquired.

  In step S3, the authentication management unit 24 receives an inquiry result from the external authentication server 30A via the second interface 27, determines whether or not the user A is valid, and if so, step S4. If it is not valid, go to step S5.

  For internal users who are not authenticated by the external authentication server 30, the authentication management unit 24 performs the following processing instead of steps S2 and S3 described above.

  In other words, the authentication management unit 24 determines whether or not the same internal information as the user information input in step S1 is stored in the internal user information storage unit 26. If the determination is affirmative, the user A is valid. The process proceeds to step S4. If the determination is negative, it is determined that the user A is not valid and the process proceeds to step S5.

  In step S <b> 4, the authentication management unit 24 reads the restriction information of the user A from the restriction information storage unit 23, transmits this restriction information to the MFP 10 </ b> A via the first interface 21, and ends the process.

  At this time, the restriction information of the user A transmitted from the use restriction management apparatus 20 is input to the memory 15 via the communication control unit 18 of the multifunction machine 10A. Then, the controller 14 controls as follows according to the restriction information stored in the memory 15.

  For example, when there is a user A instruction from the control panel 16, the controller 14 can control the scanner unit 11 or control the color copy by the printer unit 12 according to the instruction, but does not control the FAX unit 13. That is, the MFP 10A can perform scanning and color copying, but cannot perform facsimile. Further, when the copy performance value of the user A reaches the copy upper limit value, the multifunction machine 10A controls the copy so that it cannot be used.

  On the other hand, in step S <b> 5, the authentication management unit 24 transmits an error indicating an authentication failure to the multifunction peripheral 10 </ b> A via the first interface 21 and ends the process. As a result, the multifunction device 10A cannot be used by the user A.

  As described above, the usage restriction management device 20 stores the usage restrictions for each user in advance, and transmits the restriction information to the MFP 10 used by the authenticated user after user authentication. The user's use of the multifunction device 10 can be managed.

  In addition, even if there are a large number of multifunction machines 10, the operator only needs to set restriction information only in the use restriction management apparatus 20. As a result, even when the multifunction device 10 is added, it is possible to reduce the man-hours and costs for setting usage restrictions on the multifunction device 10.

  In addition, since the usage restriction management device 20 can register temporary users who do not want to be registered in the external authentication server 30 as internal users, the usage restrictions are set for temporary users as well. A plurality of multifunction peripherals 10 can be shared.

[Second Embodiment]
Next, a second embodiment of the present invention will be described. In addition, the same code | symbol is attached | subjected to the site | part same as 1st Embodiment, and the detailed description is abbreviate | omitted. The use restriction management system according to the second embodiment is obtained by adding a biometric information input unit (not shown) to the multifunction machine 10 according to the first embodiment.

  In the present embodiment, the user inputs an account name, a password, and biometric information (for example, a fingerprint in the present embodiment) to the multifunction device 10 at the first login. The multifunction device 10 stores the input account name, password, and fingerprint combination in the storage unit, and transmits only the account name and password to the usage restriction management apparatus 20.

  When the account name and password are transmitted from the multifunction device 10, the usage restriction management device 20 transmits the restriction information to the multifunction device 10 by executing the processing from step S 1 to step S 5 shown in FIG. 4 described above. As a result, usage restrictions are set in the multifunction machine 10.

  In the second and subsequent logins, the user inputs only the fingerprint through the biometric information input unit of the multifunction machine 10. The multifunction device 10 transmits the account name and password corresponding to the input fingerprint to the usage restriction management device 20. Note that the multifunction device 10 deletes the combination of the account name, password, and biometric information after a certain period.

  As described above, in the second embodiment, the multifunction machine 10 stores the account name, password, and biometric information input at the first login, and the biometric information is input at the second and subsequent logins. Then, the account name and password corresponding to the biometric information are transmitted to the use restriction management device 20. Thereby, the multifunction machine 10 can omit the input of the account name and the password while ensuring the security in the second and subsequent logins, so that the convenience of the user can be improved.

  It should be noted that the present invention is not limited to the first and second embodiments, but can be applied to those modified in design within the scope described in the claims. Of course. For example, in the second embodiment, the biological information is not particularly limited as long as it is user-specific information obtained from the user's human body, and may be, for example, a palm vein or an iris in addition to the fingerprint.

10, 10A, 10B, 10C MFP 20 Usage restriction management device 21 First interface 22 Restriction information setting unit 23 Restriction information storage unit 24 Authentication management unit 25 Internal user information setting unit 26 Internal user information storage unit 27 Second interface 30, 30A, 30B External authentication server

Claims (6)

A restriction information storage means for storing restriction information indicating usage restriction of a service providing device for each user,
Accepting means for accepting user information input in the service providing device;
Based on the user information received by the receiving means, it is determined which of the plurality of authentication devices connected via the network is inquired about whether the user has a legitimate authority. Authentication device determination means;
To the authentication device and the authentication device determined by the determination means, and transmits the user information received by the receiving unit, a query unit combining have questions about the whether the user has authorized,
When there is a response from the authentication device that the user has a legitimate authority, the restriction information storage unit reads the restriction information of the user, and provides the service with information based on the read restriction information. Transmitting means for transmitting to the device;
Use restriction management device. The usage restriction management device according to claim 1, wherein the authentication device determination unit determines which of the plurality of authentication devices is to be inquired based on a format of user information received by the reception unit. A reception process for receiving user information input in the service providing device;
Authentication device determination for determining which of the plurality of authentication devices connected via the network is inquired as to whether or not the user has a legitimate authority based on the received user information Process,
To the determined the authentication device, and transmitting the user information received, a query step of bringing have questions about the whether the user has authorized,
When the user from the authentication device there is a response to have official rights, from the restriction information storage section for storing control information representing a use limit of the service providing device for each user, the user A first transmission step of reading the restriction information and transmitting information based on the read restriction information to the service providing device;
A usage restriction management method. On the computer,
A reception process for receiving user information input in the service providing device;
Authentication device determination for determining which of the plurality of authentication devices connected via the network is inquired as to whether or not the user has a legitimate authority based on the received user information Process,
To the determined the authentication device, and transmitting the user information received, a query step of bringing have questions about the whether the user has authorized,
When the user from the authentication device there is a response to have official rights, from the restriction information storage section for storing control information representing a use limit of the service providing device for each user, the user A first transmission step of reading the restriction information and transmitting information based on the read restriction information to the service providing device;
Use restriction management program to execute. A service providing apparatus comprising an input means for inputting user information ;
Based on restriction information storage means for storing restriction information representing the use restriction of the service providing apparatus for each user, receiving means for receiving user information input in the service providing apparatus, and user information received by the receiving means Authentication apparatus determining means for determining which of the plurality of authentication apparatuses connected via the network is inquired as to whether or not the user has a legitimate authority, and the authentication apparatus determination to the authentication device that has been determined by means transmits the user information received by the receiving unit, a query unit combining have questions about the whether the user has the proper authorization, the user from the authentication device Reads the restriction information of the user from the restriction information storage means when there is a response that the user has a legitimate authority Has a transmitting means for transmitting the information based on the read restriction information to the service providing apparatus, a use restriction management apparatus having a, a,
The service provision management system according to claim 1, wherein the service provision device provides a service in accordance with a use restriction indicated by restriction information transmitted from the use restriction management device. The service providing apparatus includes a storage unit that stores biometric information together with user information, a biometric information input unit that inputs biometric information, and a transmission unit that transmits user information corresponding to the biometric information input by the biometric information input unit. And comprising
The usage restriction management system according to claim 5 , wherein the authentication device authenticates a user based on user information transmitted from the service providing device.

Images