JP2012158176A - Image forming device, information processing system, and processing method and program for the same - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a mechanism for obtaining authentification in a storage medium temporarily assigned to a user for obtaining the authentification.SOLUTION: In an image forming system with an authentication server 200 connected to a multifunction machine 300, the user information management section 252 of the authentication server 200 registers identification information on an IC card temporarily assigned to the user. When the temporarily assigned IC card has already been registered in the user information management section 252, the same is deleted prior to registration. The temporary card number management section 354 of the multifunction machine 300 manages the identification information list of the temporarily assigned IC card. The use limit management section 253 of the authentication server 200 manages the use limits of an ordinary IC card and the temporarily assigned IC card, and applies different use limits to the ordinary IC card from the temporarily assigned IC card.

Description

  The present invention relates to an image forming apparatus, an information processing system, a processing method thereof, and a program for enabling authentication using a storage medium temporarily provided to a user in authentication of the image forming apparatus using the storage medium.

  2. Description of the Related Art Conventionally, a so-called “pull print (accumulated printing)” printing system in which a user outputs print data from a printing device by making a printing request from the printing device to print data temporarily stored on a server It has been known. Accordingly, the user can output print data from a desired printing apparatus instead of outputting to a specific printing apparatus during printing from an application (for example, Patent Document 1).

An example of a printing procedure in such a printing system is as follows.
When the user holds the IC card over the IC card reader connected to the printing apparatus, the IC card reader detects the UID (unique ID) of the IC card. Then, in order to determine whether or not the user is a usable user, the printing apparatus refers to the authentication table stored in the authentication server and set to allow login based on the UID, and executes user authentication processing.
As a result of the authentication process, if the login is successful, the printing apparatus acquires and prints the print data of the user temporarily stored on the server.
In such a mechanism, when a new person who uses the printing apparatus or a person who stops using the printer occurs, the administrator requests the administrator to register the UID or delete the UID, and the administrator performs the processing. The problem that an administrator's trouble is required arises.

  Therefore, Patent Document 2 discloses a mechanism for registering the UID of the IC card in the authentication table if the UID is not registered at the time of IC card authentication.

JP 2006-99714 A JP 2008-181491 A

In the system of Patent Document 2 above, when a newly issued IC card is held and IC card authentication is executed, the card information (UID) of the held IC card is registered in the authentication table of the authentication server. Otherwise, the system registers the card information of the IC card.
On the other hand, companies that use IC cards often use temporary lending cards (temporary cards) when IC cards are lost or forgotten. Since the temporary card is lent to different users every day, when using the system of Patent Document 2, the temporary card information is linked to the first registered user, and the next lent user registers the card. The problem of not being able to do arises. In addition, there is a problem that the previous user logs in if the card is held as it is, and the system is practically impossible to use the temporary card.

  Accordingly, an object of the present invention is to provide a mechanism that makes it possible to appropriately obtain authentication even in a storage medium temporarily given to a user.

According to a first aspect of the present invention, there is provided user information storage means for storing user identification information for identifying a user in order to perform authentication using a storage medium held over the image forming apparatus. An image forming apparatus capable of communicating with an authentication server via a communication medium, the user identification information receiving means for receiving user identification information for identifying a user input from an operation unit, and the storage medium being held over When the storage medium identification information acquisition means for acquiring the storage medium identification information obtained by the above and the storage medium identification information is a storage medium temporarily given to a user, In order to store the storage medium identification information in the user information storage means corresponding to the user identification information received by the user identification information reception means, the storage medium identification An image forming apparatus comprising: the first storage medium identification information transmitting means for transmitting a registration request including multicast to the authentication server, the.
Further, when it is determined that the storage medium is not temporarily given to the user, the storage medium identification information corresponding to the user identification information received by the user identification information receiving means is used as a normally used storage medium. It is desirable to further include second storage medium identification information transmitting means for transmitting the storage medium identification information to the authentication server for storing in the user information storage means.

  The image forming apparatus according to the first invention makes it possible to store the storage medium identification information of the storage medium temporarily given in the user information storage means, and even in the storage medium temporarily given to the user Appropriate authentication can be obtained.

Further, when the storage medium identification information of the storage medium temporarily given to the user is stored in the user information storage means, the storage server identification information is deleted in the authentication server in order to delete the stored storage medium identification information. It is desirable to further include a deletion request means for requesting.
Thereby, after the user returns the storage medium temporarily provided, the storage medium identification information of the storage medium can be deleted from the user identification information.

In addition, a storage medium identification information list storage unit that stores a list of storage medium identification information of the storage medium temporarily given to the user, and a storage acquired by the storage medium identification information acquisition unit in the storage medium identification information list It is desirable to further comprise storage medium determination means for determining whether or not the storage medium identification information that matches the medium identification information exists.
As a result, the image forming apparatus can determine whether an arbitrary storage medium is a storage medium temporarily provided to the user.

Further, when logging in with a storage medium temporarily given to the user, function restriction information for restricting functions that can be used set corresponding to the storage medium identification information acquired by the storage medium identification information acquisition means It is desirable to further include a function restriction information obtaining unit for obtaining the function and a log-in means for performing function restriction and logging in according to the function restriction information obtained by the function restriction information obtaining unit.
The function restriction information is generated using authority information given when a storage medium temporarily given to the user is held over and authority information given when the normally used storage medium is held over Is done.
Thereby, it is possible to set the authority granted to the storage medium temporarily given to the user and the authority of the storage medium normally used.

  According to a second aspect of the present invention, there is provided an authentication server including user information storage means for storing user identification information for identifying a user, and performing authentication using a storage medium held over the image forming apparatus, and the authentication server and the communication medium An information processing system comprising an image forming apparatus capable of communicating via a user identification information receiving means for receiving user identification information for identifying a user, which is input from the operation unit And a storage medium identification information acquisition means for acquiring storage medium identification information obtained by holding the storage medium, and the storage medium identification information is determined to be a storage medium temporarily provided to a user. In this case, the storage medium identification information as the temporarily assigned storage medium corresponds to the user identification information received by the user identification information receiving means. A storage medium identification information transmitting means for transmitting a registration request including the storage medium identification information to the authentication server for storing in the user information storage means, wherein the authentication server is transmitted from the image forming apparatus. Storage medium identification information receiving means for receiving a registration request including storage medium identification information, and storage of the storage medium temporarily given the storage medium identification information included in the registration request received by the storage medium identification information receiving means An information processing system comprising: storage medium identification information storage means for storing the medium identification information corresponding to the user identification information received by the user identification information reception means.

  According to a third aspect of the present invention, there is provided an authentication server including a user information storage unit for storing user identification information for identifying a user and a communication medium for performing authentication using a storage medium held over the image forming apparatus. A processing method in an image forming apparatus capable of communication, a user identification information receiving step for receiving user identification information for identifying a user input from an operation unit, and a storage medium obtained by holding the storage medium A storage medium identification information acquisition step for acquiring identification information; and when the storage medium identification information is a storage medium temporarily given to a user, the storage medium identification information is used as a temporary storage medium In order to store in the user information storage unit corresponding to the user identification information received in the user identification information reception step, a registration requirement including the storage medium identification information is required. A processing method in an image forming apparatus, wherein a and a first storage medium identification information transmission step of transmitting to the authentication server.

  According to a fourth aspect of the present invention, there is provided an authentication server that includes a user information storage unit that stores user identification information for identifying a user and that performs authentication using a storage medium held over the image forming apparatus, and the authentication server and the communication medium. A processing method in an information processing system configured by an image forming apparatus communicable via a user identification, wherein the image forming apparatus receives user identification information for identifying a user input from the operation unit An information receiving step, a storage medium identification information acquisition step for acquiring storage medium identification information obtained by holding the storage medium, and the storage medium identification information being a storage medium temporarily provided to a user If determined, the user identification information received in the user identification information receiving step is used as the storage medium temporarily given as the storage medium identification information. And a storage medium identification information transmission step for transmitting a registration request including the storage medium identification information to the authentication server to be stored in the user information storage unit corresponding to the authentication information, the authentication server from the image forming apparatus The storage medium identification information receiving step for receiving the transmitted registration request including the storage medium identification information, and the storage medium identification information included in the registration request received in the storage medium identification information receiving step are temporarily given. A processing method in an information processing system comprising: a storage medium identification information storing step of storing corresponding to the user identification information received by the user identification information receiving means as the storage medium identification information of the storage medium.

  A fifth invention is a program for causing a computer to execute the processing method of the third invention or the fourth invention.

  According to the present invention, it is possible to provide an image forming apparatus, an information processing system, a processing method thereof, and a program capable of appropriately performing an authentication process even on a storage medium temporarily given to a user.

1 is a diagram showing a configuration of an image forming system according to an embodiment of the present invention. The figure which shows the hardware constitutions of the authentication server 200 and the client PC100 The figure which shows the hardware constitutions of the compound machine 300 1 is a diagram illustrating a functional configuration of an image forming system according to an embodiment. Flow chart showing the flow of IC card registration processing Flow chart showing the flow of IC card registration processing Flow chart showing the flow of IC card registration processing Flow chart showing the flow of IC card registration processing Flow chart showing the flow of card authentication processing Flow chart showing the flow of card authentication processing FIG. 5 is a diagram showing an example of a temporary card list managed in the multifunction machine 300 The figure which shows an example of the file for the authority setting of the temporary card managed in the authentication server 200 The figure which shows an example of the IC card authentication table managed in the authentication server 200 The figure which shows an example of the use restriction information which is the role information in the IC card authentication table managed in the authentication server 200 IC card authentication screen example User information management screen example User information management menu screen example User information confirmation error screen example Card information registration screen example Card information registration screen example (card information display) Card information registration screen example (registration success display) Card information registration screen example (registration processing error) Example of temporary card authentication screen Authentication error display screen example The figure which shows an example of the IC card authentication table managed in the authentication server 200

Hereinafter, a preferred embodiment of a screen forming system according to the present invention will be described in detail with reference to the drawings.
FIG. 1 is a system configuration diagram illustrating an example of an image forming system (information processing system) of the present embodiment.
As shown in FIG. 1, an image forming system (information processing system) includes, for example, one or a plurality of multifunction peripherals 300, one or two IC card authentication servers 200, and one or a plurality of client PCs 100 in a local area network (LAN). ) 400 (communication medium) connected.

  The multi-function device 300 transmits a card number read from a card held over a card reader 319, which will be described later, to the IC card authentication server 200 as an authentication request, and this is also input by the operation unit 308 of the multi-function device described later. The name and password are transmitted to the IC card authentication server 200 as an authentication request.

The IC card authentication server 200 stores an IC card authentication table (FIG. 9), which will be described later, in response to an authentication request using an IC card from the multifunction device 300 or an authentication request using a user name and password. Authentication processing is performed using the authentication table.
The IC card authentication server 200 is configured to be communicable with, for example, a directory server (not shown), and when there is an authentication request using a user name and password, the directory server is inquired and the user name is stored in the directory server. It is also possible to determine that the authentication is successful, and to transmit the authentication result from the IC card authentication server 200 to the multifunction device 300. That is, the IC card authentication server 200 is a device having a directory server function.
In addition, the client PC 100 performs print settings for the multifunction device 300.

Next, the hardware configuration of the client PC 100 and the IC card authentication server 200 shown in FIG. 1 will be described with reference to FIG.
FIG. 2 is a block diagram illustrating a hardware configuration example of an information processing apparatus applicable to the client PC 100 and the IC card authentication server 200.

  As shown in FIG. 2, the client PC 100 and the IC card authentication server 200 include a CPU (Central Processing Unit) 201, a RAM (Random Access Memory) 203, a ROM (Read Only Memory) 202, and an input controller 205 via a system bus 204. The video controller 206, the memory controller 207, the communication I / F controller 208, etc. are connected.

The CPU 201 comprehensively controls each device and controller connected to the system bus 204.
Further, the ROM 202 or the external memory 211 will be described later, which is necessary for realizing the functions executed by each server or each PC, such as BIOS (Basic Input / Output System) and OS (Operating Systems) which are control programs of the CPU 201. Various programs are stored.
The RAM 203 functions as a main memory, work area, and the like for the CPU 2001. The CPU 201 implements various operations by loading a program or the like necessary for executing the processing from the ROM 202 or the external memory 211 to the RAM 203 and executing the loaded program.

The input controller 205 controls input from a keyboard (KB) 209 or a pointing device such as a mouse (not shown).
The video controller 206 controls display on a display device such as a CRT display (Cathode Ray Tube) 210. In FIG. 2, although described as CRT 210, the display is not limited to the CRT, and may be another display such as a liquid crystal display. These are used by the administrator as needed.

The memory controller 207 is an external storage device (hard disk (HD)), flexible disk (FD), or PCMCIA (Personal Computer) that stores a boot program, various applications, font data, user files, editing files, various data, and the like. Controls access to an external memory 211 such as a Compact Flash (registered trademark) memory connected to a Memory Card International Association (Card Memory) card slot via an adapter.
The communication I / F controller 208 is connected to and communicates with an external device via a network (for example, the LAN 400 shown in FIG. 1), and executes communication control processing in the network. For example, communication using TCP / IP (Transmission Control Protocol / Internet Protocol) is possible.

  Note that the CPU 201 can display on the CRT 210 by executing an outline font rasterization process on a display information area in the RAM 203, for example. Further, the CPU 201 enables a user instruction using a mouse cursor (not shown) on the CRT 210 or the like.

  Various programs to be described later for realizing the present invention are recorded in the external memory 211 and executed by the CPU 201 by being loaded into the RAM 203 as necessary. Furthermore, a definition file and various information tables used when executing the program are also stored in the external memory 211, and a detailed description thereof will be described later.

Next, the hardware configuration of the controller unit that controls the multifunction peripheral 300 as the information processing apparatus of the present invention will be described with reference to FIG.
FIG. 3 is a block diagram illustrating a hardware configuration example of the controller unit 316 of the multifunction machine 300.

  In FIG. 3, a controller unit 316 is connected to a scanner 314 functioning as an image input device and a printer 312 functioning as an image output device, and is connected to a local area network such as the LAN 400 shown in FIG. By connecting to a public line (WAN) such as ISDN, image data and device information are input and output.

  As shown in FIG. 3, the controller unit 316 includes a CPU 301, a RAM 302, a ROM 303, an external storage device (hard disk drive (HDD)) 304, a network interface (Network I / F) 305, a modem (Modem) 306, an operation unit interface ( Operation unit I / F) 307, external interface (external I / F) 318, image bus interface (IMAGE BUS I / F) 320, raster image processor (RIP) 310, printer interface (printer I / F) 311, scanner interface (Scanner I / F) 313, an image processing unit 317, and the like.

The CPU 301 is a processor that controls the entire system.
A RAM 302 is a system work memory for the operation of the CPU 301, and is a program memory for recording a program and an image memory for temporarily storing image data.
The ROM 303 stores a system boot program and various control programs.
An external storage device (hard disk drive HDD) 304 stores various programs for controlling the system, image data, and the like.

  An operation unit interface (operation unit I / F) 307 is an interface unit with the operation unit (UI) 308, and outputs image data to be displayed on the operation unit 308 to the operation unit 308. The operation unit I / F 307 serves to transmit information (for example, user information) input by the system user from the operation unit 308 to the CPU 301. Note that the operation unit 308 includes a display unit having a touch panel, and various instructions can be given by a user pressing (touching with a finger or the like) a button displayed on the display unit.

A network interface (Network I / F) 305 is connected to a network (LAN) and inputs / outputs data.
A modem (MODEM) 306 is connected to a public line and inputs / outputs data such as FAX transmission / reception.

An external interface (external I / F) 318 is an interface unit that accepts external inputs such as USB, IEEE 1394, printer port, RS-232C, etc. In this embodiment, a card reader for reading an IC card required for authentication is used. 319 is connected.
The CPU 301 can control reading of information from the IC card by the card reader 319 via the external I / F 318, and can acquire information read from the IC card. Note that the storage medium is not limited to an IC card, and any storage medium that can identify a user may be used. In this case, identification information for identifying the user is stored in the storage medium. This identification information may be a production number of the storage medium or a user code given by the user within the company.
The above devices are arranged on the system bus 309.

On the other hand, an image bus interface (IMAGE BUS I / F) 320 is a bus bridge that connects a system bus 309 and an image bus 315 that transfers image data at high speed and converts a data structure.
The image bus 315 is configured by a PCI bus or IEEE1394. The following devices are arranged on the image bus 315.

A raster image processor (RIP) 310 develops vector data such as a PDL code into a bitmap image, for example.
A printer interface (printer I / F) 311 connects the printer 312 and the controller unit 316 to perform synchronous / asynchronous conversion of image data.
A scanner interface (scanner I / F) 313 connects the scanner 314 and the controller unit 316, and performs synchronous / asynchronous conversion of image data.

  An image processing unit 317 corrects, processes, and edits input image data, and performs printer correction, resolution conversion, and the like on print output image data. In addition to this, the image processing unit 317 performs image data rotation and compression / decompression processing such as JPEG for multi-valued image data and JBIG, MMR, MH for binary image data.

  A scanner 314 connected to the scanner I / F 313 illuminates an image on paper as a document and scans it with a CCD line sensor, thereby converting it into an electrical signal as raster image data. The original paper is set on the tray of the original feeder, and when the apparatus user gives a reading start instruction from the operation unit 308, the CPU 301 gives an instruction to the scanner, and the feeder feeds the original paper one by one to read the original image. I do.

  The printer 312 connected to the printer I / F 311 is a part that converts raster image data into an image on paper. The method is an electrophotographic method using a photosensitive drum or a photosensitive belt, and ink is supplied from a micro nozzle array. There is an ink jet method for ejecting and printing an image directly on a sheet, but any method may be used. The activation of the printing operation is started by an instruction from the CPU 301. The printer 312 has a plurality of paper feed stages so that different paper sizes or different paper orientations can be selected, and has a paper cassette corresponding thereto.

The operation unit 308 connected to the operation unit I / F 307 includes a liquid crystal display (LCD) display unit. A touch panel sheet is affixed on the LCD to display a system operation screen, and when a displayed key is pressed, the position information is transmitted to the CPU 301 via the operation unit I / F 307. The operation unit 308 includes, for example, a start key, a stop key, an ID key, a reset key, and the like as various operation keys.
Here, the start key of the operation unit 308 is used when starting a document image reading operation. There are green and red LEDs in the center of the start key, and indicates whether or not the start key can be used depending on the color. In addition, the stop key of the operation unit 308 functions to stop the operation being performed. The ID key of the operation unit 308 is used when inputting the user ID of the user. The reset key is used when initializing settings from the operation unit 308.

  A card reader 319 connected to the external I / F 318 reads information stored in an IC card (for example, Sony Felica (registered trademark)) under the control of the CPU 301, and reads the read information to the external I / F. The CPU 301 is notified via F318.

Next, functions of the client PC 100, the authentication server 200, and the multifunction peripheral 300 as the information processing apparatus according to the present invention will be described with reference to FIG.
FIG. 4 is a functional block diagram illustrating an example of functions of the client PC 100, the authentication server 200, and the multifunction peripheral 300.
The details of the processing of each function will be described with reference to the flowcharts of FIGS.

The client PC 100 has functions such as the Web browser 150.
The web browser 150 is used to access a web service of the MFP 300 (not shown). It is possible to create a temporary card list shown in FIG.
As a creation method, card information may be input to a list displayed on the browser, or a temporary card list created on the client PC 100 may be uploaded. The present invention includes a method for creating a temporary card list. Do not depend.

The authentication server 200 includes functions of a multifunction peripheral communication unit 250, an authentication unit 251, a user information management unit 252, a use restriction management unit 253, and the like.
The MFP communication unit 250 receives an authentication request / card information registration request from the authentication server communication unit 351 in the MFP 300 and returns an authentication result to the authentication server communication unit 351.
The authentication unit 251 acquires user information that matches the card information from an IC card authentication table shown in FIG. 13 (described later) held in the authentication server 200 in accordance with the authentication request received by the multifunction device communication unit 250. The authentication result is transmitted by the MFP communication unit 250.
The user information management unit 252 rewrites the IC card authentication table shown in FIG. 13 in accordance with a request related to user information management such as a card information registration request received by the multifunction device communication unit 250.
The use restriction management unit 253 compares the use restriction information illustrated in FIG. 14 and merges the restriction information. In the processing within the present invention, the use restriction information of the user is compared with the use restriction information specified at the time of logging in the temporary card and the use restriction information with low authority is adopted at the time of logging in the temporary card (temporary IC card).

The multifunction device 300 includes functions such as a card reader control unit 350, an authentication server communication unit 351, an authentication processing unit 352, a card information registration unit 353, and a temporary card number management unit 354.
The card reader control unit 350 communicates with the IC card reader 319 connected to the multifunction device 300 and controls the card reading state of the card reader 319. When the IC card is held over the card reader, the card information held in the IC card is acquired.
The authentication server communication unit 351 communicates with the multi-function device communication unit 250 in the authentication server 200 to transmit / receive an authentication request / card information registration request and the like.
The authentication processing unit 352 logs in to the multifunction device 300 according to the authentication result received from the authentication server 200 by the authentication server communication unit 351.
The card information registration unit 353 manages processing related to card information registration, and controls screen transition and the like according to each processing.
The temporary card number management unit 354 confirms whether or not the card information of the held IC card exists in a temporary card list shown in FIG.

Hereinafter, a flow of authentication information management processing of a temporary card without an administrator by the image forming system (information processing system) 1 according to the present embodiment will be described with reference to FIGS.
5 to 8 are flowcharts showing the flow of card registration processing of the multifunction machine 300 according to the present invention.

First, the CPU 301 of the multifunction machine 300 executes an application program activation process for executing a card registration process. In other words, the application program stored in the HDD 304 on the multifunction device 300 is loaded onto the RAM 302 and the application program is executed (step 101).
The multifunction device 300 includes the various functions shown in FIG. 4, that is, a card reader control unit 350, an authentication server communication unit 351, an authentication processing unit 352, a card information registration unit 353, and a temporary card number management unit 354.

  Next, the CPU 301 causes the card reader control unit 350 on the multifunction device 300 to start the connected card reader 319 in a reading start state (step 102). Thereby, an event from the card reader 319 such as card detection or card removal can be acquired. The event includes card information (manufacturing number) read from the card.

Next, the CPU 301 displays the IC card authentication screen shown in FIG. 15 by the authentication processing unit 352 on the multifunction machine 300 (step 200).
Next, the CPU 301 detects that the user information management button 1000 on the IC card authentication screen in FIG. 15 has been pressed by the card information registration unit 353 on the multifunction peripheral 300 (step 201). As a result, the user management mode is entered, and a temporary card can be registered when the card information registration button 1002 is pressed. In step 201, a card reading stop command is transmitted to the card reader 319. That is, a polling stop command is sent to the card reader 319 so that the card information cannot be read even if the IC card is held over the card reader.
Next, the CPU 301 displays the user information confirmation screen of FIG. 16 by the card information registration unit 353 on the multifunction machine 300 (step 202).

Then, the CPU 301 detects that the user confirmation button 1001 on the user information confirmation screen in FIG. 16 is pressed by the card information registration unit 353 (step 203), and is input on the user information confirmation screen in FIG. Information input in the columns of user name, password, and user confirmation destination (domain information managed by the authentication server 200) is acquired (step 204).
Next, the CPU 301 uses the user name, password, and user confirmation destination (domain information managed by the authentication server 200) acquired in step 208 to the authentication server 200 by the authentication server communication unit 351 on the MFP 300. Then, a user information confirmation request (authentication request) is transmitted (step 205).

  The CPU 201 of the authentication server 200 receives a user information confirmation request (authentication request) from the authentication server communication unit 351 on the multifunction device 300 by the multifunction device communication unit 250 on the authentication server 200 (step 206). The upper authentication unit 251 searches for the user from the IC card authentication table (FIG. 13) held in the authentication server 200 in accordance with the user information confirmation request (authentication request) from the multifunction device 300, and the user name, mail address Then, the user information of the user composed of usage restriction information or the like is acquired (step 207).

  FIG. 13 shows an example of user information stored in the authentication server 200. User information (user identification information), password, card information (storage medium identification information), e-mail address, affiliation group, etc. correspond to user information. Is remembered. As card information (storage identification information), IC card information (manufacturing number) (storage medium identification information) currently used and a temporary card flag indicating whether or not the card currently used is a temporary card are used by the user. Stored in correspondence with user information including a name (user identification information). In addition, a group name and a role name are associated with each other and stored, and associated with authority information having a structure as shown in FIG.

At this time, if the user information can be retrieved, the authentication is successful, and authentication result information including the user name is generated. On the other hand, if the user information cannot be searched, the authentication is unsuccessful, and an authentication result including the unsuccessful authentication information is generated.
Then, the CPU 201 of the authentication server 200 transmits the authentication result (confirmation result) acquired in step 207 to the multi-function device 300 by the multi-function device communication unit 250 on the authentication server 200 (step 208).

The CPU 301 of the MFP 300 receives the authentication result (confirmation result) by the authentication server communication unit 351 (step 209).
In the present embodiment, the user information confirmation process in steps 202 to 209 is executed when the user information management button 1000 is pressed in step 201. However, this process is not limited to this timing. You may comprise so that it may be performed when it is YES (after button pressing) in step 223 of FIG. 6 mentioned later. That is, the user information confirmation process may be executed at any timing before the authentication server 200 registers the card information.

  Next, the CPU 301 of the multifunction machine 300 analyzes the contents of the confirmation result received in step 209 by the card information registration unit 353 (step 210). If the authentication is successful (YES in step 210), the process proceeds to step 211. If the authentication is unsuccessful (NO in step 210), the process proceeds to step 220.

When the user information confirmation is unsuccessful in step 210 described above (NO in step 210), the CPU 301 displays a user information confirmation error screen shown in FIG. 18 by the card information registration unit 353 (step 220).
Then, the CPU 301 detects the depression of the OK button 1003 on the user information confirmation error screen in FIG. 18 by the card information registration unit 353 (step 221).
If pressing is detected in step 221 (YES in step 221), the user information confirmation error screen in FIG. 18 is subsequently deleted, and the process returns to step 200.

On the other hand, if it is determined in step 210 that the authentication is successful (YES in step 210), the CPU 301 of the multifunction machine 300 displays the user information management menu screen shown in FIG. 17 by the card information registration unit 353 (step 211). It is detected that the card information registration button 1002 has been pressed (step 212).
When the depression of the card information registration button 1002 is detected in step 212 (YES in step 212), the CPU 301 of the multifunction machine 300 displays the card information registration screen shown in FIG. 19 by the card information registration unit 353 (step 213). ), A card reading start command is transmitted to the card reader 319 (step 214 in FIG. 6). That is, a polling start command is sent to the card reader 319.

The card reader 319 starts polling by the processing of step 214 described above, and enters the card reading state (step 215).
The card reader 319 detects that the card is held over and issues a card detection event including the card information to the multi-function device 300 (step 216).

The CPU 301 of the MFP 300 receives the card detection event by the card reader control unit 350 (step 217), and acquires card information (manufacturing number and the like) of the IC card held over the card reader (step 218). Note that the card information of the IC card is included in the card detection event.
Next, the CPU 301 of the MFP 300 causes the card information registration unit 353 to display the card information acquired in step 218 on the card information registration screen displayed in step 213 as shown in FIG. 20 (step 219). .

  Next, the CPU 301 of the multifunction machine 300 detects that the button on the card information display screen of FIG. 20 is pressed by the card information registration unit 353 (step 223), and if the OK button 1004 is pressed, the CPU 301 If the return button 1005 is pressed in step 224, the process returns to step 211 in FIG. 5 to display the user information management menu screen.

On the other hand, when the OK button 1004 is pressed in step 223, the CPU 301 of the multi-function device 300 causes the temporary card number management unit 354 to generate a temporary card list (a list of temporarily assigned storage medium identification information) shown in FIG. It is confirmed whether or not it exists, that is, whether or not temporary card operation is performed (step 224). When the temporary card list does not exist, it is determined that the temporary card operation is not performed (NO in step 224), and the process proceeds to step 251 in FIG. 8, and the temporary card list exists and the temporary card operation is performed (YES in step 224). Proceeds to step 225.
Here, FIG. 11 is an example of a temporary card list, and card information (manufacturing numbers) of temporary cards that are temporarily lent to the user is stored as a list. In the present embodiment, a temporary card list is held in the external memory 211 of the multifunction machine 300.

If the temporary operation is not performed (NO in step 224), the process proceeds to step 251 in FIG. 8, but in this case, the processes in steps 227 to 250 described later are not performed, and additional registration in the IC card authentication table of the own user is performed. Processing is performed.
When the temporary card operation is performed (YES in step 224), the CPU 301 acquires the temporary card list shown in FIG. 11 by the temporary card number management unit 354 (step 225) and holds it over the card reader 319 acquired in step 218. It is determined whether or not the card information of the selected card exists in the temporary card list (list of storage medium identification information of the storage medium temporarily given to the user) (step 226). In other words, the process of step 226 is a storage medium determination process that determines whether or not the storage medium identification information that matches the storage medium identification information acquired in step 218 exists.
If the card information exists in the temporary card list, it is determined that the card information card is a temporary card (YES in step 226), and the process proceeds to step 227. If the card information does not exist, it is determined that the card is not a temporary card. Then (NO in step 226), the process proceeds to step 238 in FIG. 7 to perform overwriting registration processing on the IC card authentication table of the own user.

  In the above description of Step 224 to Step 226, the temporary card list is held in the external memory 211 of the multi-function device 300. However, the temporary card list may be held in the authentication server 200. In this case, the card information acquired in step 218 may be transmitted to the authentication server 200, and the authentication server 200 may determine whether the card of the card information is a temporary card.

Next, the CPU 301 of the MFP 300 determines whether the temporary card is already registered in the IC card authentication table shown in FIG. 13 by the authentication server communication unit 351, and deletes the temporary card if it is registered. (Step 227 to step 237).
That is, if the temporary card has been used by another user before, the temporary card is registered as the other user's card in the IC card authentication table, and a process of deleting the temporary card is performed.

First, the CPU 301 transmits a card information acquisition request for the card information acquired in step 218 to the authentication server 200 by the authentication server communication unit 351 (step 227). The card information acquisition request includes IC card information (manufacturing number).
Next, the CPU 201 of the authentication server 200 receives the card information acquisition request sent from the authentication server communication unit 351 of the multi-function device 300 by the multi-function device communication unit 250 (step 228), and then manages the user information of the authentication server 200. In accordance with the card information acquisition request sent from the MFP 300 by the unit 252, the IC card information (manufacturing number) acquired in step 218 is obtained from the IC card authentication table (FIG. 13) held in the authentication server 200. The associated user is searched and the user information (user name) is acquired (step 229).
At this time, if the temporary card has been previously registered, card information can be obtained, and if it has not been registered, card information cannot be obtained.
Then, the CPU 201 of the authentication server 200 transmits the user information (user name) obtained as a search result in step 229 to the multifunction device 300 as card information by the multifunction device communication unit 250 (step 230).

Next, the CPU 301 of the MFP 300 receives the card information including the user name acquired in Step 229 by the authentication server communication unit 351 (Step 231), and analyzes the card information (Step 232).
That is, if the card information (user information) can be acquired in step 231, the temporary card is already registered, and the process proceeds to step 233 to delete the registration. If the card information cannot be acquired, the temporary card is Since it is not registered, the process proceeds to step 239 to perform registration processing.
If the card information acquired in step 231 is registered with the user acquired in step 204, that is, if the temporary card has already been correctly registered by the same user before, it is already registered. May be displayed on the screen to terminate the process. In this case, when the card information acquired in step 231 is registered with a user other than the user acquired in step 204, the process proceeds to step 233, and processing for deleting the registration is performed.

If the temporary card has been registered in step 232, the CPU 301 of the multi-function peripheral 300 creates a card deletion request command from the card information acquired in step 231 by the authentication server communication unit 351, and performs authentication. It transmits to the server 200 (step 233).
The deletion request command includes a user name, IC card information (manufacturing number), and the like.
In order to prevent the same temporary card from being used by a plurality of users, this user information in the IC card authentication table held in the authentication server 200 when the temporary card is registered with another user. This is a process of deleting temporary card information from the card.

The CPU 201 of the authentication server 200 receives the card information deletion request sent from the authentication server communication unit 351 by the multi-function device communication unit 250 (step 234), and deletes the card information from the multi-function device 300 by the user information management unit 252. The user name and IC card information included in the request are acquired, the user name is searched from the IC card authentication table shown in FIG. 13, and the IC card information associated with the user name is deleted (step 235). Here, the data to be deleted is a card number table in the IC card authentication table (FIG. 13).
Then, the CPU 201 of the authentication server 200 transmits the deletion result of step 235 to the multifunction device 300 through the multifunction device communication unit 250 (step 236). The deletion result is information indicating whether the deletion is successful or unsuccessful.

  The CPU 301 of the MFP 300 receives the deletion result by the authentication server communication unit 351 (step 237), and analyzes the deletion result received by the card information registration unit 353 (step 238). If the deletion is successful (YES in step 238), the process proceeds to step 239 to register the temporary card information. If the deletion has failed (NO in step 238), error information is displayed. Then, the process proceeds to step 260 in FIG.

If the card information has been successfully deleted in step 238 (YES in step 238), and if the card held over the card reader 319 in step 226 in FIG. 6 is not a temporary card (NO in step 226). ) In step 239 to step 249, it is checked whether or not any IC card information is already registered in the user information of the IC card authentication table held in the authentication server 200. A process of deleting the IC card information is executed.
This is to operate 1 user 1 IC card, and forget to delete the temporary card information after returning the temporary card by deleting the IC card information already registered by the processing of step 245 to step 249. Even in such a case, the temporary card information can be deleted by newly registering his / her IC card information, and misuse by impersonation can be prevented.

First, the CPU 301 of the multifunction machine 300 transmits a card information acquisition request of the own user to the authentication server 200 through the authentication server communication unit 351 (step 239). The user name is included in the transmitted data.
Next, the CPU 201 of the authentication server 200 receives the card information acquisition request sent from the authentication server communication unit 351 by the multi-function device communication unit 250 (step 240), and receives the request from the multi-function device 300 by the user information management unit 252. A card information list is acquired in accordance with the card information acquisition request (step 241). That is, the user name acquired in step 240 is searched from the IC card authentication table shown in FIG. 13, and all the IC card information associated with the user name is acquired.
Then, the CPU 201 of the authentication server 200 transmits a card information list that is a list of IC card information registered to the user acquired in step 241 to the multi-function peripheral 300 by the multi-function peripheral communication unit 250 (step 242). .

  The CPU 301 of the MFP 300 receives the card information list by the authentication server communication unit 351 (step 243), and the card information registration unit 353 analyzes the card information list acquired in step 243 (step 244). If the card information is acquired (YES in step 244), that is, if the card information is registered, the process proceeds to step 245 to delete the registered IC card information, and the card information is not acquired. If it is determined that the card information has not been registered (NO in step 244), the process proceeds to step 251 in FIG. 8 to be described later in order to register the card information of the temporary card.

If the card information has been registered in step 244 (YES in step 244), processing for deleting the registered card information (steps 245 to 249) is executed.
That is, the CPU 301 of the multi-function apparatus 300 transmits a card information deletion request for the card information list acquired in step 243 to the authentication server 200 through the authentication server communication unit 351 (step 245). The transmission data includes a list of user names and IC card information (manufacturing numbers).

The CPU 201 of the authentication server 200 receives the card information deletion request sent from the authentication server communication unit 351 by the multi-function device communication unit 250 (step 246), and deletes the card information from the multi-function device 300 by the user information management unit 252. According to the request, the card information is deleted from the IC card authentication table shown in FIG. 13 (step 247).
That is, the user name acquired in step 245 is searched from the IC card authentication table (FIG. 13), and all the IC card information associated with the user name is deleted. Here, the user information is not deleted.
Then, the CPU 201 of the authentication server 200 transmits the deletion result of the card information deletion performed in step 247 to the multifunction device 300 by the multifunction device communication unit 250 (step 248). The deletion result is a result flag (success or failure) indicating the deletion result.

  The CPU 301 of the MFP 300 receives the deletion result by the authentication server communication unit 351 (step 249), and analyzes the card deletion result received by the card information registration unit 353 (step 250). If the deletion is successful (YES in step 250), the process proceeds to step 251 to register the card information of the temporary card. If the deletion is unsuccessful (NO in step 250), the error information is displayed in FIG. Proceed to step 260.

If it is determined in step 250 that the deletion is successful (YES in step 250), or if there is no temporary card setting in the MFP 300 in step 224 in FIG. 6 (NO in step 224), or FIG. If there is no registered card information in the IC card authentication table for the user in step 244 (NO in step 244), the IC card authentication table is actually held over the card reader 319 by the processing in steps 251 to 255. Card registration processing for registering the card information (manufacturing number) of the received card.
When the processing from step 239 to step 249 is performed, since the IC card information in the user information of the user has already been deleted, overwriting registration is performed.

First, the CPU 301 of the MFP 300 transmits a card information registration request for the card information of the IC card acquired in step 218 to the authentication server 200 by the authentication server communication unit 351 (step 251). This card information registration request includes a user name, IC card information, and a temporary card flag.
Here, the temporary card flag indicates that the card is a temporary card. In step 226 of FIG. 6, it is determined that the card is in the temporary card list shown in FIG. 11 and is a temporary card. If so (YES in step 226), the value “True” is entered in the temporary card flag of the temporary card registration request. On the other hand, if it is determined in step 226 that the card is not a temporary card (NO in step 226), and if the MFP 300 is not set for temporary card operation in step 224 in FIG. 6 (NO in step 224), A value of “False” is entered in the temporary card flag of the temporary card registration request.

Next, the CPU 201 of the authentication server 200 receives the card information registration request (user name, IC card information, temporary card flag) sent from the authentication server communication unit 351 by the multi-function device communication unit 250 (step 252). The user information management unit 252 adds the card information to the IC card authentication table (FIG. 13) in accordance with the card information registration request from the multifunction machine 300 (step 253). That is, the user name acquired in step 252 is searched from the IC card authentication table (FIG. 13), and the IC card information and temporary card flag acquired in step 252 are registered in the user information.
Then, the CPU 201 of the authentication server 200 transmits the registration result of step 253 (success or failure of registration) to the multifunction device 300 through the multifunction device communication unit 250 (step 254).

  The CPU 301 of the MFP 300 receives the registration result through the authentication server communication unit 351 (step 255), and analyzes the card registration result received at step 255 through the card information registration unit 353 (step 256). If the registration is successful (YES in step 256), the process proceeds to step 257 to display that the registration is successful, and if the registration is unsuccessful (NO in step 256), the process proceeds to step 260 to display error information. Proceed to

  When the registration is successful (YES in step 256), the CPU 301 of the multifunction machine 300 displays a card registration success screen shown in FIG. 21 by the card information registration unit 353 (step 257), and an OK button on the card registration success screen. After detecting the depression of 1006 (step 258) and deleting the card registration success screen of FIG. 21 (step 259), the process returns to step 200 of FIG.

On the other hand, if registration fails (NO in step 256), or if card information registered for the user cannot be deleted from the IC card authentication table in step 250 (NO in step 250), or FIG. 7, if the card information of the user who used the temporary card last time could not be deleted from the IC card authentication table (NO in step 238), the CPU 301 of the MFP 300 uses the card information registration unit 353 to execute FIG. A card registration processing error screen as shown in FIG. 6 is displayed (step 260). The wording displayed on the card registration processing error screen can be changed according to the error content.
Then, pressing of the OK button 1007 on the card registration processing error screen is detected (step 261), the card registration processing error screen in FIG. 22 is deleted (step 262), and the process returns to step 200 in FIG.

With the above processing, registration of the normal IC card or temporary card used by the user to the IC card authentication table is completed.
As a result, in addition to the user name and password, e-mail address, affiliation group, etc., card information is registered as information on the user in the IC card authentication table shown in FIG. The card information includes a card number (IC card manufacturing number) and a temporary card flag. If the card to be used is a temporary card, the temporary card flag is “True”, and if it is a normal card, the temporary card flag is “ False ".

  In the card information registration processing according to the flowcharts of FIGS. 5 to 8 described above, it is assumed that one IC card is used by one user, and another IC card has been registered in the IC card authentication table or used before. If the information on the temporary card thus registered is registered in the IC card authentication table, the IC card information is first deleted and then registered (overwrite registration).

  In addition to overwriting registration using the IC card authentication table of FIG. 13 as described above, for example, using the IC card authentication table of FIG. 25, an authentication table for an own card (IC card used normally) ( 2501) and a temporary card authentication table (2502) can be separately provided. If it is determined in step 226 that the card number of the IC card normally used (NO in step 226), the card number of the IC card normally used in step 253 is registered in 2501, and the card number of the temporary card is determined in step 226. If determined (YES in step 226), the card number of the temporary card is registered in 2502 in step 253. This form is particularly effective when, for example, a normally used IC card is used, a temporary card is borrowed when a normally used card is forgotten, and a temporary card number is registered. If authentication is performed using a card that is normally used on the next day when a temporary card is granted, the card number of the card that is normally used is not deleted, and the card that is normally used is registered again. It is possible to log in without any problem.

  When the card number of the temporary card is registered and then authenticated with the normally used IC card, since the card number of the normally used IC card is registered in 2501, it is determined that there is a user in step 306 described later. . If it is determined that the user is present (NO in step 306), it is determined whether or not the temporary card number is registered in 2502. If the temporary card number is registered, the temporary card number is deleted from 2502. Constitute.

Next, card authentication processing according to the present embodiment will be described with reference to FIGS.
9 and 10 are flowcharts showing the flow of the card authentication process.

  The IC card reader 319 connected to the multifunction device 300 detects that the IC card is held over (step 300). When the IC card is detected, the IC card reader 319 acquires IC card information (manufacturing number) and transmits a card detection event to the multi-function device 300 together with the acquired IC card information (manufacturing number) (step 301). .

The CPU 301 of the multifunction machine 300 receives the card detection event by the card reader control unit 350 and acquires the IC card information (manufacturing number) of the IC card held over (step 302).
Next, the CPU 301 of the MFP 300 transmits an authentication request including the IC card information acquired in step 302 to the authentication server 200 by the authentication server communication unit 351 (step 303).

The CPU 201 of the authentication server 200 receives the authentication request including the IC card information sent from the authentication server communication unit 351 by the MFP communication unit 250 (step 304), and the authentication unit 251 sends an authentication request from the MFP 300. Accordingly, the IC card information acquired in step 304 is searched from the IC card authentication table (FIG. 13) held in the authentication server (step 305).
That is, the IC card authentication table shown in FIG. 13 is searched to determine whether the IC card information exists. When the IC card is registered, the IC card information and the user information are stored in association with each other in the IC card authentication table. Therefore, if the IC card information exists in the IC card authentication table, the user information is stored. It is registered and authentication is successful.

  The CPU 201 of the authentication server 200 determines the authentication result of step 305 by the authentication unit 251 (step 306). That is, if the IC card information is present in the IC card authentication table, the user information is registered, the authentication is successful (YES in step 306), and the step for determining the right to use the MFP 300 of the user is determined. Proceed to 307. On the other hand, if the IC card information does not exist in the IC card authentication table, the user information is not registered, the authentication is failed (NO in step 306), and the process proceeds to step 312 in order to end the authentication process due to the failure.

  When the user information is registered in step 306 (YES in step 306), the CPU 201 of the authentication server 200 causes the authentication unit 251 to use the temporary card in the IC card authentication table of the IC card information card searched in step 305. Whether the flag is “True” or “False” is determined (step 307). If the temporary card flag is “True”, the IC card is a temporary card (True in Step 307), and the process proceeds to Step 308 to merge the user authority and the temporary card authority. On the other hand, if the temporary card flag is “False”, it is determined that the IC card is not a temporary card but an own card, and the process proceeds to step 312. In the case of your own card, your user authority is used as it is.

When step 307 is “True” and it is determined that the card is a temporary card, the CPU 201 of the authentication server 200 uses the use restriction management unit 253 to obtain the use restriction information about the user acquired in step 305 from the IC card authentication table (FIG. 13). Is acquired (step 308).
That is, from the IC card authentication table (FIG. 13), the user name obtained in step 305 is searched, the group name associated with the user information is obtained, and the role name associated with the group is further obtained. Use restriction information associated with the role name is acquired. Here, the reason why the user, group, and role are linked is to facilitate the use restriction management of the user. A user must belong to one or more groups. Further, it is assumed that one or more roles are set for the group. By adopting such a configuration, the user is always associated with one or more rolls. When the user is associated with one or more roles, the respective items of the usage restriction information as shown in FIG. 14 are compared, and the stronger authority (the weaker restriction) is acquired as the usage restriction information of the own user. . This use restriction information is function restriction information for restricting the function of the multifunction peripheral 300.
FIG. 14 is an example of the authority information structure stored in the authentication server 200, and defines restrictions on functions that can be used in the MFP 300.

Next, the CPU 201 of the authentication server 200 acquires the use restriction information of the role designated as the temporary roll (FIG. 12) held in the authentication server 200 by the use restriction management unit 253 (step 309).
FIG. 12 is an example of a setting file for determining the role (authority) of the temporary card stored in the authentication server 200, and the role name indicating the authority for the card number stored in the temporary card list of FIG. Is described.
That is, the use restriction management unit 253 obtains the role name designated for the temporary roll shown in FIG. 12, and obtains the use restriction information associated with the role name.

Next, the CPU 201 of the authentication server 200 compares the use restriction information of the own user acquired in step 308 with the use restriction information of the role specified in the temporary roll acquired in step 309 by the use restriction management unit 253, The lower authority (the more restrictive) is acquired as the use restriction information (step 310).
For example, it is assumed that the color copy is “no restriction” among the use restrictions of the role set by the user. On the other hand, it is assumed that the color copy is “only monochrome copy is possible” within the use restriction of the roll designated as the temporary roll. In this case, the merged use restriction of the temporary card reflects “only monochrome copy is possible” with low authority.
In step 308, when a plurality of roles are associated with the user, the stronger authority is applied, but in the merge process with the temporary roll, the lesser authority is applied.

  Next, the CPU 201 of the authentication server 200 is necessary for the authentication including the user information (user name, email address, temporary card flag) acquired in step 305 and the use restriction information acquired in step 310 by the use restriction management unit 253. User information (user name, mail address, temporary card flag, usage restriction information) is created (step 311).

After step 311 and when there is no user information in step 306 (NO in step 306), and in step 307, the temporary card flag is “False” (false in step 307), authentication server 200 The CPU 201 transmits the authentication result or the user information including the authentication result and the use restriction information to the multifunction device 300 by the multifunction device communication unit 250 (step 312).
At this time, if user information does not exist in step 306 (NO in step 306), information indicating that the IC card has not been registered (authentication unsuccessful) is sent to the multi-function device 300 as an authentication result.
If the temporary card is “False” in Step 307 (False in Step 307), although not shown, the usage restriction information associated with the user name obtained by the user search in Step 305 is acquired, and the user Information is sent to the multifunction device 300. In this case and the authentication result after step 311, the authentication is successful because the IC card is registered.

The CPU 301 of the MFP 300 receives the authentication result by the authentication server communication unit 351 (step 313), and the authentication processing unit 352 analyzes the authentication result acquired in step 313 (step 314).
If the authentication result is successful (YES in step 314), the process proceeds to step 315 to perform login processing, and if unsuccessful (NO in step 314), the process proceeds to step 320 to display an error screen. That is, the CPU 301 displays an authentication error screen as shown in FIG. 24 by the authentication processing unit 352 (step 320), detects the press of the OK button 1009 on the authentication error screen (step 321), and performs authentication after the detection. The error screen is deleted (step 322), and the process returns to step 300 in FIG. 9 to wait for a new IC card.

If the authentication result is successful in step 314 (YES in step 314), the CPU 301 of the multi-function peripheral 300 confirms the temporary card flag in the user information acquired in step 313 by the authentication processing unit 352 (step 315). .
If the temporary card flag is “True” (YES in step 315), the IC card is a temporary card, and the process proceeds to step 316 to display the temporary card authentication dialog screen. If it is “False” (NO in step 315). ) The IC card is its own IC card, and the process proceeds to step 319 to log in as it is.

  If the IC card is a temporary card in step 315 (YES in step 315), the CPU 301 of the multi-function peripheral 300 displays a temporary card authentication screen as shown in FIG. 23 by the authentication processing unit 352 (step 316). The pressing of the OK button 1008 on the temporary card authentication screen is detected (step 317). After the detection, the temporary card authentication screen shown in FIG. 23 is deleted (step 318).

After step 318 and when the card is not a temporary card in step 315 (NO in step 315), the CPU 301 of the multifunction device 300 uses the user information acquired in step 313 to the multifunction device 300 by the authentication processing unit 352. log in.
When logging in to the multifunction device 300, functions that cannot be used in the multifunction device 300 are restricted according to the authority information (function restriction information) included in the authentication result received in step 313, and the display of the operation unit 308 is controlled. In the case of a temporary card, the authority for the temporary card and the authority of the weaker authority of the own card are applied, and in the case of the own card, the authority of the own card is applied. In the case where a plurality of roles exist on the own card, the authority with the higher authority among the plurality of roles is applied.

As described above, in the image forming system (information processing system) according to the present invention, when the user's IC card cannot be used for some reason, an administrator who can operate the temporary card while maintaining safety is unnecessary. An image forming system (information processing system) can be constructed.
That is, when the MFP 300 holds the temporary card list, it can be identified that the card to be used is a temporary card. When the card is a temporary card, the card has already been registered with another user. The registration of other users can be forcibly deleted and the temporary card can be registered with the user.
If some card information is already registered for the user, the card information is deleted and a temporary card is registered. A temporary card flag is set to determine whether the card is a temporary card or a normal card.

  Further, the authentication server determines whether or not to log in with a temporary card. When logging in with a temporary card, the authority information registered for the temporary card and the authority information of a user who has already been authenticated are merged. It is possible to construct authentication information including authority information giving priority to the one with lower authority. That is, when a temporary card is used, it is possible to set the use authority of the multifunction device 300 to be lower than when using a normal own card.

The preferred embodiments of the image generation system, the image forming apparatus, the authentication server, and the like according to the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the above-described embodiment.
For example, although the present embodiment employs a configuration in which a temporary card list is registered in advance in the multifunction device 300, this list may be stored on the authentication server side. Further, when registering the temporary card list from the multi-function apparatus 300, the temporary card list may be specified on the user interface.
In this embodiment, the number of IC cards that can be registered in the IC card authentication table of the authentication server is one regardless of the type of card (temporary card or normal card). However, the temporary card is overwritten. However, the registration information of the normal card may not be deleted. In this case, when logging in with the normal card, the authentication server may authenticate the normal card and delete the registered temporary card information.
It is obvious for those skilled in the art that various modifications or modifications can be conceived within the scope of the technical idea described in the claims, and these are naturally within the technical scope of the present invention. It is understood that it belongs.

100: Client PC
150... Web browser 200... Authentication server 250... Multifunction device communication unit 251... Authentication unit 252... User information management unit 253 ... Use restriction management unit 300. ...... Card reader 350 ......... Card reader control unit 351 ......... Authentication server communication unit 352 ......... Authentication processing unit 353 ......... Card information registration unit 354 ......... Temporary card number management unit

Therefore, an object of the present invention is to temporarily give the user the storage medium identification information of the storage medium temporarily given to the user by deleting it from other users and registering it in association with the currently used user. It is to provide a mechanism that makes it possible to appropriately obtain authentication even in a storage medium to be used .

The first invention for achieving the above object, there is provided an image forming apparatus comprising a reading means for communicating with the user information storage means, reading the storage medium that stores user identification information for identifying the User chromatography THE a user identification information reception unit for receiving a user identification information for identifying the user chromatography tHE, a storage medium identification information acquiring means for acquiring the storage medium identification information obtained by reading a storage medium by said reading means, said storage Display means for displaying a registration instruction screen capable of instructing registration of the storage medium identification information acquired by the medium identification information acquisition means, and the storage medium identification information acquired by the storage medium identification information acquisition means to a user who is repeatedly used. A storage medium temporarily provided, and the storage medium identification information is received by the user information storage means by the user identification information receiving means. If the user identification information different from the user identification information is already stored, according to the registration instruction on the registration instruction screen, the user identification is prevented so that authentication using the storage medium by another user does not succeed. Deletion of the storage medium identification information of the storage medium temporarily given to the user acquired by the storage medium identification information acquisition means stored corresponding to the user identification information different from the user identification information received by the information reception means a deletion request means for outputting a request, the storage medium identification information as a temporary granted the storage medium to users, stored in the user information storage means in correspondence with the user identification information accepted by the user identification information reception unit as to the first storage medium identification information registration request hand outputs a registration request including said storage medium identification information and the user identification information Characterized in that it comprises a and.
The first storage medium identification information registration request means is determined as a storage medium to which the storage medium identification information is temporarily given to the user, and the user information storage means stores the storage medium identification information in another user. When it is determined that the user identification information is not already stored in correspondence with the user identification information, the deletion request means outputs the registration request without outputting the deletion request.

The storage medium identification information list storage means for storing a list of storage medium identification information of the storage medium temporarily given to the user, and the storage medium identification information acquired by the storage medium identification information acquisition means is the storage medium identification Storage medium determination means for determining whether the storage medium corresponding to the storage medium identification information acquired by the storage medium identification information acquisition means is a storage medium temporarily given to the user, depending on whether the information is in the information list; It is characterized by providing.

In addition, when the storage medium identification information is not determined as a storage medium temporarily given to the user, the user identification information received by the user identification information receiving unit as the storage medium normally used by the user And a second storage medium identification information registration request means for outputting the storage medium identification information and the user identification information so as to be stored in the user information storage means.

Further, when logging in with a storage medium temporarily given to the user, function restriction information for restricting functions that can be used set corresponding to the storage medium identification information acquired by the storage medium identification information acquisition means And a log-in means for logging in with function restriction according to the function restriction information obtained by the function restriction information obtaining means.
The function restriction information uses authority information given when a storage medium temporarily given to the user is held over and authority information given when the normally used storage medium is held over. It is characterized by being generated.
The user information storage means is provided in an authentication server.

The second invention includes an authentication server comprising user information storage means for storing user identification information for identifying a user, and an image forming apparatus comprising reading means for reading a storage medium that can communicate with the authentication server. In the information processing system, the image forming apparatus acquires user identification information receiving means for receiving user identification information for identifying a user, and storage medium identification information obtained by reading the storage medium with the reading means. Storage medium identification information acquisition means, display means for displaying a registration instruction screen capable of instructing registration of the storage medium identification information acquired by the storage medium identification information acquisition means, and the storage medium acquired by the storage medium identification information acquisition means The identification information is a storage medium temporarily given to a user who is repeatedly used, and the storage medium identification information is When the user information storage unit has already stored the information corresponding to the user identification information different from the user identification information received by the user identification information reception unit, the user information is stored by another user according to the registration instruction on the registration instruction screen. In order to prevent the authentication using the medium from succeeding, it is temporarily stored for the user acquired by the storage medium identification information acquisition unit that is stored corresponding to the user identification information different from the user identification information received by the user identification information reception unit. Delete request means for outputting a request to delete storage medium identification information of the storage medium that has been granted, and the user identification information acceptance means as a storage medium that is temporarily given to the user The storage medium identification information and the user identification information are stored so as to be stored in the user information storage means corresponding to the user identification information. And a first storage medium identification information registration request means for outputting a registration request, wherein the authentication server is stored in correspondence with the user identification information of the other user by the output of the image forming apparatus. A request for deleting the storage medium identification information of the storage medium temporarily given to the user, a request receiving means for receiving a registration request including the storage medium identification information and the user identification information, and a deletion received by the request receiving means The storage medium identification information of the storage medium temporarily given to the user acquired by the storage medium identification information acquisition means stored in correspondence with the user identification information of another user according to the request is stored in the user information. The storage medium identification information deleting means to be deleted from the means and the storage medium identification information included in the registration request received by the request receiving means are stored in the storage medium temporarily given to the user. Storage medium identification information registration means for registering the user identification information and the storage medium information in association with each other as the storage medium identification information is provided.

According to a third aspect of the present invention, there is provided a processing method in an image forming apparatus including a reading unit that reads a storage medium and communicates with a user information storage unit that stores user identification information for identifying a user. A user identification information receiving step for receiving user identification information, a storage medium identification information acquisition step for acquiring storage medium identification information obtained by reading the storage medium by the reading means, and a storage acquired in the storage medium identification information acquisition step A storage medium in which a display instruction screen capable of instructing registration of medium identification information is displayed, and the storage medium identification information acquired in the storage medium identification information acquisition process is temporarily given to a user who is repeatedly used Yes, the user identification information received in the user identification information receiving step by the user information storage means is the user identification information. The user identification information receiving step so that authentication using the storage medium by another user does not succeed in accordance with a registration instruction on the registration instruction screen when it is already stored corresponding to user identification information different from the information A request to delete the storage medium identification information of the storage medium temporarily stored to the user acquired in the storage medium identification information acquisition step stored in correspondence with the user identification information different from the user identification information received in A deletion request step to be performed, and the storage medium identification information as a storage medium to be temporarily given to the user, so as to be stored in the user information storage means corresponding to the user identification information received in the user identification information reception step. And a first storage medium identification information registration requesting step for outputting a registration request including the storage medium identification information and the user identification information. And wherein the door.

A fourth invention includes an authentication server comprising user information storage means for storing user identification information for identifying a user, and an image forming apparatus comprising reading means for reading a storage medium that can communicate with the authentication server. A processing method in an information processing system, wherein the image forming apparatus receives a user identification information for identifying a user, and a storage medium identification information obtained by reading the storage medium by the reading unit Acquired in the storage medium identification information acquisition step, a display step for displaying a registration instruction screen capable of instructing registration of the storage medium identification information acquired in the storage medium identification information acquisition step, and the storage medium identification information acquisition step. The storage medium identification information is a storage medium temporarily given to a user who is repeatedly used, and the storage medium When the identification information has already been stored in the user information storage means in correspondence with the user identification information different from the user identification information received in the user identification information reception step, other users follow the registration instruction on the registration instruction screen. Acquired in the storage medium identification information acquisition step stored corresponding to the user identification information different from the user identification information received in the user identification information reception step so that authentication using the storage medium does not succeed A deletion request step for outputting a deletion request for storage medium identification information of a storage medium temporarily given to the user, and the user identification information reception step as a storage medium for temporarily giving the storage medium identification information to the user The storage medium identification information and the user are stored in the user information storage means corresponding to the user identification information received in A first storage medium identification information registration request step for outputting a registration request including the identification information, and the authentication server responds to the user identification information of the other user by the output of the image forming apparatus. A request receiving step for receiving a stored request for deleting storage medium identification information of a storage medium temporarily given to a user, a registration request including the storage medium identification information and user identification information, and receiving the request The storage medium identification information of the storage medium temporarily given to the user acquired in the storage medium identification information acquisition step, which is stored corresponding to the user identification information of another user according to the deletion request received in the step The storage medium identification information deleting step for deleting the storage medium identification information from the user information storage means and the storage medium identification information included in the registration request received in the request reception step are temporarily given to the user. The storage medium identification information of the stored storage medium includes a storage medium identification information registration step of registering the user identification information and the storage medium information in association with each other in the user information storage unit.

According to a fifth aspect of the present invention, there is provided a program executable by an image forming apparatus including a reading unit that reads a storage medium and communicates with a user information storage unit that stores user identification information for identifying a user. User identification information receiving means for receiving user identification information for identifying a user, storage medium identification information acquiring means for acquiring storage medium identification information obtained by reading the storage medium by the reading means, and the storage medium Display means for displaying a registration instruction screen capable of instructing registration of the storage medium identification information acquired by the identification information acquisition means, and the storage medium identification information acquired by the storage medium identification information acquisition means are temporarily displayed to a user who is repeatedly used. The storage medium identification information is received by the user information storage means. If the user identification information different from the user identification information received by the means has already been stored, according to the registration instruction on the registration instruction screen, the authentication using the storage medium by other users will not succeed. Storage medium identification of the storage medium temporarily given to the user acquired by the storage medium identification information acquisition means stored corresponding to the user identification information different from the user identification information received by the user identification information reception means A deletion request means for outputting an information deletion request; and a storage medium for temporarily giving the storage medium identification information to a user, the user information storage corresponding to the user identification information received by the user identification information reception means A first storage medium identification for outputting a registration request including the storage medium identification information and the user identification information so as to be stored in the means; Characterized in that to function as multi-address registration request unit.

A sixth invention includes an authentication server comprising user information storage means for storing user identification information for identifying a user, and an image forming apparatus comprising reading means for reading a storage medium that can communicate with the authentication server. A program executable by an information processing system, the user identification information receiving means for receiving user identification information for identifying the user of the image forming apparatus, and the storage medium identification obtained by reading the storage medium by the reading means Storage medium identification information acquisition means for acquiring information, display means for displaying a registration instruction screen capable of instructing registration of the storage medium identification information acquired by the storage medium identification information acquisition means, and acquisition by the storage medium identification information acquisition means The storage medium identification information is a storage medium that is temporarily given to a user who is repeatedly used. When the medium identification information is already stored in the user information storage means corresponding to the user identification information different from the user identification information received by the user identification information reception means, Acquired by the storage medium identification information acquisition means stored corresponding to the user identification information different from the user identification information received by the user identification information reception means so that authentication by the user using the storage medium is not successful. A deletion request means for outputting a deletion request for the storage medium identification information of the storage medium temporarily given to the user, and the user identification information reception as a storage medium to which the storage medium identification information is temporarily given to the user The storage medium identification information and the previous information are stored in the user information storage means corresponding to the user identification information received by the means. And functioning as a first storage medium identification information registration request unit that outputs a registration request including user identification information, and the authentication server responds to the user identification information of the other user by the output of the image forming apparatus. A request receiving means for receiving a stored request for deleting storage medium identification information of a storage medium temporarily given to a user, a registration request including the storage medium identification information and user identification information, and the request reception The storage medium identification information of the storage medium temporarily given to the user acquired by the storage medium identification information acquisition means, which is stored corresponding to the user identification information of another user according to the deletion request received by the means Storage medium identification information deleting means for deleting the storage medium identification information included in the registration request received by the request receiving means. As the storage medium identification information of the assigned storage medium, the user identification information and the storage medium information are associated with each other and function as storage medium identification information registration means for registering in the user information storage means .

According to the present invention, the storage medium identification information of the storage medium temporarily given to the user is temporarily given to the user by deleting it from other users and registering it in association with the user currently used. It is possible to provide an image forming apparatus, an information processing system, a processing method therefor, and a program that enable appropriate authentication processing even in a storage medium .

Claims (10)

Image forming apparatus capable of communicating via a communication medium with an authentication server including user information storage means for storing user identification information for identifying a user in order to perform authentication using a storage medium held over the image forming apparatus Because
User identification information receiving means for receiving user identification information for identifying a user input from the operation unit;
Storage medium identification information acquisition means for acquiring storage medium identification information obtained by holding the storage medium;
When the storage medium identification information is a storage medium temporarily given to the user, the storage medium identification information is added to the user identification information received by the user identification information receiving means as the temporarily given storage medium. Correspondingly, first storage medium identification information transmitting means for transmitting a registration request including the storage medium identification information to the authentication server to be stored in the user information storage means;
An image forming apparatus comprising: When it is determined that the storage medium is not temporarily given to the user, the user information corresponding to the user identification information received by the user identification information receiving means as the storage medium normally used is stored as the user information. Second storage medium identification information transmitting means for transmitting the storage medium identification information to the authentication server for storing in the storage means;
The image forming apparatus according to claim 1, further comprising: When the storage medium identification information of the storage medium temporarily given to the user is stored in the user information storage means, a deletion request is made to the authentication server to delete the stored storage medium identification information Delete request means
The image forming apparatus according to claim 1, further comprising: Storage medium identification information list storage means for storing a list of storage medium identification information of the storage medium temporarily given to the user;
Storage medium determination means for determining whether or not the storage medium identification information that matches the storage medium identification information acquired by the storage medium identification information acquisition means exists in the storage medium identification information list. The image forming apparatus according to any one of claims 1 to 3. When logging in with a storage medium temporarily given to the user, the function restriction information for restricting the usable function set corresponding to the storage medium identification information acquired by the storage medium identification information acquisition means is acquired. Function restriction information acquisition means to perform,
In accordance with the function restriction information obtained by the function restriction information obtaining means, a login means for restricting functions and logging in,
The image forming apparatus according to claim 1, further comprising:   The function restriction information is generated using authority information given when a storage medium temporarily given to the user is held over and authority information given when the normally used storage medium is held over The image forming apparatus according to claim 5, wherein the image forming apparatus is an image forming apparatus. User information storage means for storing user identification information for identifying a user, an authentication server that performs authentication using a storage medium held over the image forming apparatus, and can communicate with the authentication server via a communication medium An information processing system including an image forming apparatus,
The image forming apparatus includes:
User identification information receiving means for receiving user identification information for identifying a user, which is input from the operation unit;
Storage medium identification information acquisition means for acquiring storage medium identification information obtained by holding the storage medium;
When it is determined that the storage medium identification information is a storage medium temporarily given to the user, the storage medium identification information is received by the user identification information receiving unit as the temporarily given storage medium. Storage medium identification information transmitting means for transmitting a registration request including the storage medium identification information to the authentication server in order to store the user identification information in correspondence with the user identification information.
The authentication server is
Storage medium identification information receiving means for receiving a registration request including the storage medium identification information transmitted from the image forming apparatus;
The storage medium identification information included in the registration request received by the storage medium identification information receiving means corresponds to the user identification information received by the user identification information receiving means as the storage medium identification information of the temporarily given storage medium. An information processing system comprising: storage medium identification information storage means for storing the information. Image forming apparatus capable of communicating via a communication medium with an authentication server including a user information storage unit for storing user identification information for identifying a user in order to perform authentication using a storage medium held over the image forming apparatus A processing method in which
A user identification information receiving step for receiving user identification information for identifying a user, which is input from the operation unit;
A storage medium identification information acquisition step of acquiring storage medium identification information obtained by holding the storage medium;
When the storage medium identification information is a storage medium temporarily given to the user, the storage medium identification information is added to the user identification information received in the user identification information reception step as the temporarily given storage medium. And a first storage medium identification information transmission step of transmitting a registration request including the storage medium identification information to the authentication server to be stored in the user information storage unit correspondingly. Processing method. An authentication server that includes a user information storage unit that stores user identification information for identifying a user and performs authentication using a storage medium held over the image forming apparatus, and is capable of communicating with the authentication server via the communication medium A processing method in an information processing system including image forming apparatuses,
The image forming apparatus includes:
A user identification information receiving step for receiving user identification information for identifying a user, which is input from the operation unit;
A storage medium identification information acquisition step of acquiring storage medium identification information obtained by holding the storage medium;
When it is determined that the storage medium identification information is a storage medium temporarily given to the user, the storage medium identification information is received in the user identification information reception step as the temporarily given storage medium. A storage medium identification information transmission step for transmitting a registration request including the storage medium identification information to the authentication server in order to store in the user information storage unit corresponding to the user identification information.
The authentication server is
A storage medium identification information receiving step for receiving a registration request including the storage medium identification information transmitted from the image forming apparatus;
Corresponding to the user identification information received by the user identification information receiving means as the storage medium identification information of the storage medium temporarily given as the storage medium identification information included in the registration request received in the storage medium identification information receiving step And a storage medium identification information storing step for storing the information.   A program for causing a computer to execute the processing method according to claim 8 or 9.

Images