JP2013033486A - Information processor, authentication control method, program, and recording medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an information processor, an authentication control method, a program, and a recording medium which can realize a flexible authentication function.SOLUTION: An information processor comprises: first connection means for connecting with an external device; user information storage means for storing user information; first authentication means for executing user authentication on the basis of user information stored by the user information storage means; second connection means for connecting with an authentication device via a network; second authentication means for executing user authentication using the authentication device by communicating with the authentication device via the network; reception means for receiving information from the external device; registration means for registering means to be used for executing user authentication among the reception means, the first authentication means, and the second authentication means; and authentication processing means for executing user authentication based on information acquired by acceptance means or the reception means by using the user information storage means or the authentication device, according to registration in the registration means.

Description

  The present invention relates to an information processing apparatus, an authentication control method, a program, and a recording medium.

  In recent years, it has become an era in which it is natural for companies to acquire standards and standards for information security. There are many voices that want to ensure security even in the usage form of OA equipment that is routinely used in companies. In view of such circumstances, there are some image forming apparatuses (OA devices having functions such as a copy, a printer, a scanner, and a FAX) that have a user authentication function (built in).

  User information entered during user authentication (typically, user names, passwords, etc.) is less visible to others than those entered directly by the user's hands from a security perspective. What is entered is desirable. Thus, a solution has been developed in which user information is input using an external device (typically, an IC card) during user authentication in the image forming apparatus (for example, Patent Document 1). ~ 3).

  On the other hand, in the user environment of the image forming apparatus, an authentication system using an original authentication server or the like is already often built.

  However, in the technology described in the above-mentioned patent document, the processing performed by the image forming apparatus and the IC card and other external authentication servers at the time of user authentication is fixed. Also, the external devices that can be used are fixedly limited. Therefore, there is a problem in that the authentication function (authentication system) in the image forming apparatus and the authentication system that already exists in the user environment exist independently, making the system configuration redundant and complicating maintenance work and the like. .

  SUMMARY An advantage of some aspects of the invention is that it provides an information processing apparatus, an authentication control method, a program, and a recording medium capable of realizing a flexible authentication function.

  Therefore, in order to solve the above-described problem, the information processing apparatus includes a first connection unit that connects to an external device, a user information storage unit that stores user information, and a user based on the user information stored in the user information storage unit. First authentication means for executing authentication, second connection means for connecting to an authentication device via a network, communication with the authentication device via the network, and user authentication using the authentication device are executed. Among the second authentication means, the reception means for receiving information from the external device, and the means used for executing user authentication among the reception means, the first authentication means, and the second authentication means are registered. A registration unit that performs user authentication based on the information obtained by the reception unit or the reception unit in response to registration by the registration unit. Others characterized in that it comprises an authentication processing unit that executes by using the authentication device.

  Such an information processing apparatus can realize a flexible authentication function.

  According to the present invention, it is possible to provide an information processing apparatus, an authentication control method, a program, and a recording medium that can realize a flexible authentication function.

1 is a diagram illustrating an example of a hardware configuration of an image forming apparatus according to an embodiment of the present invention. FIG. 3 is a diagram for explaining an example functional configuration of an image forming apparatus according to an embodiment of the present invention. It is a figure which shows notionally registration of the logic implementation module with respect to an authentication framework. It is a figure which shows the example of the registration information of a logic mounting module. It is a figure for demonstrating the process sequence at the time of acquiring user information using an authentication framework. It is a figure for demonstrating the process sequence at the time of performing external authentication using an authentication framework. It is a figure for demonstrating the process sequence at the time of performing main body authentication using an authentication framework. It is a figure for demonstrating the process sequence in the 1st specific example of the authentication process using an authentication framework. It is a figure for demonstrating the process sequence in the 2nd specific example of the authentication process using an authentication framework. It is a sequence diagram for demonstrating the control and management process of the login state by an authentication framework and an application. FIG. 10 is a sequence diagram for explaining a processing procedure when logout is requested in hardware.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In this embodiment, an image forming apparatus will be described as an example of an information processing apparatus. FIG. 1 is a diagram illustrating a hardware configuration example of an image forming apparatus according to an embodiment of the present invention. In FIG. 1, an image forming apparatus 10 is an example of a printer, a copier, a multifunction peripheral, or the like, and includes a CPU 101, a memory 102, a recording medium 103, a network I / F 104, an image output unit 105, an image processing unit 106, and an external device. An I / F 107, a display unit 108, an operation unit 109, and the like are included.

  A program that implements the functions of the image forming apparatus 10 is recorded (installed) in a non-volatile recording medium 103 such as an HDD (Hard Disk Drive). The recording medium 103 stores the installed program and stores necessary files and data. The memory 102 reads and stores the program from the recording medium 103 when there is an instruction to start the program. The CPU 101 realizes functions related to the image forming apparatus 10 in accordance with a program stored in the memory 102. The network I / F 104 is used as an interface for connecting to a network.

  The display unit 108 is configured by an LCD (Liquid Crystal Display) or the like, and displays an operation screen, a message, and the like. The operation unit 109 is configured by hardware buttons (keys), and receives an operation input by a user. The display unit 108 and the operation unit 109 may be integrally configured as an operation panel.

  The image processing unit 106 executes various types of image processing required when outputting (printing) image data. The image output unit 105 outputs (prints) image data.

  The external device I / F 107 is an interface for connecting to the external device 30 used for inputting user information for authentication, and includes, for example, a USB port or a serial boat. The external device 30 is a device for inputting user information, and is configured by, for example, an IC card reader that reads an IC card in which user information is recorded, a USB memory, or a keyboard.

  FIG. 2 is a diagram for explaining a functional configuration example of the image forming apparatus according to the embodiment of the present invention. 2, the image forming apparatus 10 includes a main body function unit 110, a main body authentication unit 120, a framework 130, an application 140, and the like. Each of these units is software realized by processing that the program causes the CPU 101 to execute.

  The main body authentication unit 120 includes a user list 121, a built-in authentication processing unit 122, and the like, and realizes an authentication function for a user built in the image forming apparatus. The built-in user authentication function refers to an authentication function that is built in the image forming apparatus 10 in advance, and refers to a function that authenticates a user who intends to operate the application 140 operating on the image forming apparatus 10. The built-in authentication processing unit 122 controls a built-in user authentication process. For example, the built-in authentication processing unit 122 causes the display unit 108 to display an authentication screen that prompts authentication. The user inputs user information (user name and password) on the authentication screen. The built-in authentication processing unit 122 permits the use of the application 140 only when the user is authenticated based on the user information.

  The user list 121 is information in which user information and usage authority information are recorded (registered) for each user. That is, the built-in authentication processing unit 122 performs user authentication by comparing user information input by the user with user information registered in the user list 121. Further, the built-in authentication processing unit 122 permits the use of the function within the range permitted in the use authority information registered in the user list 121 for the authenticated user.

  The image forming apparatus 10 has a built-in authentication function as described above (as a default).

  The framework 130 provides an execution environment for the application 140. In the image forming apparatus 10 according to the present embodiment, an application developed by a third vendor or the like after the shipment can be installed as the application 140. The framework 130 includes a class library (not shown) for operating such an application.

  In the drawing, only the functions related to the authentication function such as the external device control unit 131, the external device information acquisition unit 132, the external authentication processing unit 133, and the main body authentication control unit 134 are shown as the functions of the framework 130 for convenience. Yes. Hereinafter, the framework related to the authentication function is referred to as “authentication framework”. The authentication framework provides a mechanism for ensuring the flexibility and expandability of the authentication function in the image forming apparatus 10. In contrast to the “built-in authentication function”, the authentication function realized by the authentication framework is called an “extended authentication function”.

  The external device control unit 131 controls the external device 30 connected to the image forming apparatus 10 via a USB interface, a serial interface, or the like, and performs communication with the external device 30. The external device information acquisition unit 132 acquires user information from the external device 30 via the external device control unit 131. The external authentication processing unit 133 communicates with an external authentication device such as an authentication server via a network, and controls authentication processing using the authentication server, for example. Note that authentication performed by the external authentication processing unit 133 using an external authentication device is referred to as “external authentication”. The main body authentication control unit 134 realizes authentication processing in the image forming apparatus 10. Note that authentication performed in the image forming apparatus 10 by the main body authentication control unit 134 is referred to as “main body authentication”.

  An application 140 in the figure is an application developed by a third vendor or the like corresponding to an environment provided by the framework 130 in addition to an application (for example, a printing application) previously incorporated as a standard function of the image forming apparatus 10. Is also included. Therefore, although the application 140 is represented by one rectangle in the drawing, there are a plurality of entities.

  Incidentally, in FIG. 2, each unit constituting the authentication framework only provides the mechanism (framework), and the actual processing (logic) is performed by an application 140 (hereinafter referred to as “application 140a”) that uses the extended authentication function. This is realized by using each software module registered by the registration processing unit 145 (hereinafter referred to as “logic mounting module”).

  FIG. 3 is a diagram conceptually illustrating registration of a logic implementation module to the authentication framework. In FIG. 3, an application 140a includes an external device control mounting module 141, an external device information acquisition mounting module 142, an external authentication processing mounting module 143, a main body authentication control mounting module 144, and the like.

  The external device control mounting module 141 is a module in which communication processing at the interface level of the external device 30 is mounted, and is registered in the external device control unit 131. For example, the external device control mounting module 141 corresponds to a smart card reader driver program used by the user. As described above, the external device control mounting module 141 can be mounted to cope with any external device 30.

  The external device information acquisition mounting module 142 is a module in which an acquisition process of information (user information) from the external device 30 is mounted, and is registered in the external device information acquisition unit 132. For example, in order to acquire user information recorded in the user's smart card, there is a program that implements a process of transmitting a command according to the format of the smart card and receiving a response. As described above, by mounting the external device information acquisition mounting module 142, user information can be acquired from any external device 30.

  The external authentication processing mounting module 143 is a module in which processing related to user information authentication using an external authentication computer (such as an authentication server) is mounted, and is registered in the external authentication processing unit 133. For example, it corresponds to a program or the like in which a serial number acquired from a user's smart card is transmitted to an LDAP (Lightweight Directory Access Protocol) authentication server to acquire the user name of the user. As described above, by mounting the external authentication processing mounting module 143, it is possible to support an arbitrary authentication protocol.

  The main body authentication control mounting module 144 is a module in which processing for realizing main body authentication is mounted, and is registered in the main body authentication control unit 134. For example, it is a module that implements authentication screen transition and authentication information input processing when performing authentication using the built-in authentication function, and displays a message screen such as "Please insert a smart card" In response to the detection of the smart card, a process such as transitioning to the message screen “authenticating” and inputting user information acquired from the smart card to the built-in authentication processing unit 122 is implemented. Corresponds to the program. Therefore, it is possible to freely set an authentication screen for performing built-in user authentication by mounting the main body authentication control mounting module 144. In addition, a separate authentication function may be mounted in the main body authentication control mounting module 144 without using the built-in user authentication function. For example, a process may be implemented in which a user DB different from the user list 121 is built in the recording medium 103 and authentication is performed using the user DB.

  After the user information is input to the built-in authentication processing unit 122, the built-in user authentication unit 122 performs user authentication. When the authentication is successful, the screen lock is released. When the authentication fails, the authentication failure screen is displayed. Is displayed. By releasing the screen lock, the user can operate the application 140.

  Registration information of each logic implementation module with respect to the authentication framework is recorded and managed, for example, in the recording medium 103. FIG. 4 is a diagram illustrating an example of registration information of the logic mounting module. FIG. 4 shows an example in which registration information is associated with each logic mounting module. The registration information only needs to include information necessary for the authentication framework to dynamically use (call) the logic implementation module, such as a file name in which the entity of the logic implementation module is stored. When each process is requested, each part of the authentication framework refers to such registration information and determines a logic implementation module to be called. Each logic implementation module may be implemented so as to be dynamically callable based on an interface (specified in the authentication framework) required by the authentication framework (protocol for calling the logic implementation module). If it is desired to change the logic implementation module to be used for each application 140a, registration information as shown in FIG. 4 may be managed in association with the application 140a.

  By registering the logic implementation module as described above in each part of the authentication framework, it is possible to give diversity to user information input means for built-in user authentication. Hereinafter, a processing procedure of the image forming apparatus 10 in the present embodiment will be described. First, user information acquisition, external authentication, and main body authentication processing procedures using the authentication framework will be described with reference to FIGS. 5, 6, and 7.

  FIG. 5 is a diagram for explaining a processing procedure when user information is acquired using the authentication framework.

  The application 140a requests the external device information acquisition unit 132 to acquire user information (S101). The external device information acquisition unit 132 communicates with the external device control unit 131 at the recording format level of information in the external device 30, and requests the external device control unit 131 to acquire user information (S102). Subsequently, the external device control unit 131 communicates with the external device 30 at the interface specification level of the external device 30, and acquires user information from the external device 30 (S103). Thereafter, the user information is returned to the application 140a by tracing the calling order in reverse (S104, S105).

  Thus, the external device control unit 131 and the external device information acquisition unit 132 can be used alone from the application 140a. That is, there is no dependency between the external device control unit 131 and the external device information acquisition unit 132 and other functional units (external authentication processing unit 133, main body authentication control unit 134), and the acquired user information is stored in the application 140a. How to use it is arbitrary.

  Next, FIG. 6 is a diagram for explaining a processing procedure when external authentication is performed using the authentication framework.

  The application 140a makes an authentication request to the external authentication processing unit 133 with the user information (S111). Subsequently, the external authentication processing unit 133 communicates with an external authentication device via the network, thereby causing the external authentication device to execute authentication based on the user information, and receives the authentication result (S112). Subsequently, the external authentication processing unit 133 returns the authentication result to the application 140a (S113).

  Thus, the external authentication processing unit 133 can be used alone from the application 140a.

  Next, FIG. 7 is a diagram for explaining a processing procedure when performing main body authentication using the authentication framework.

  The application 140a makes an authentication request to the main body authentication control unit 134 with the user information (S121). Subsequently, when the main body authentication control unit 134 inputs user information to the built-in authentication processing unit 122, the built-in authentication processing unit 122 performs authentication based on the user information and the user list 121 (S122). The screen transition at this time can be controlled from the main body authentication control unit 134. When the authentication is successful, the main body authentication unit 120 unlocks the main body function unit 110 (S123). As a result, the user (application 140 a) can use the functions of the image forming apparatus 10 based on the usage authority recorded in the user list 121.

  Thus, the main body authentication control unit 134 can be used alone from the application 140a.

  Next, a processing procedure assuming a more specific scene (solution) will be described. FIG. 8 is a diagram for explaining a processing procedure in the first specific example of the authentication processing using the authentication framework. In FIG. 8, the same steps as those in FIG. 5 or FIG.

  In FIG. 8, a keyboard 31 as an external device 30 is connected to the image forming apparatus 10 via USB. In such a form, a logic implementation module for a keyboard is registered in the authentication framework as the external device control implementation module 141 and the external device information acquisition implementation module 142, and user information input from the keyboard is registered as the main body authentication control implementation module 144. This can be implemented by registering the logic implementation module to be input to the main body authentication unit 120 in the authentication framework.

  The application 140a acquires user information such as a user name and a password input via the keyboard 31 through the external device information acquisition unit 132 and the external device control unit 131 (S101 to S105).

  Subsequently, when the application 140a requests authentication to the main body authentication control unit 134 using the acquired user information, the main body authentication unit 120 performs authentication accordingly (S121 to S123).

  The configuration shown in FIG. 8 is effective as a solution for a low-spec image forming apparatus that does not include hardware such as a keyboard. Further, as the external device 30, a device that can acquire sufficient information as user information such as a USB memory may be used.

  Next, FIG. 9 is a diagram for explaining a processing procedure in the second specific example of the authentication processing using the authentication framework. In FIG. 9, the same step numbers are assigned to the same steps as those in FIG. 5, FIG. 6, or FIG.

  In FIG. 9, a smart card reader 32 is connected to the image forming apparatus 10 as an external device 30 by USB. The authentication server 50 is connected to the image forming apparatus 10 via a network. In such a form, as the external device control mounting module 141 and the external device information acquisition mounting module 142, a logic mounting module that acquires a card ID from the smart card 321 is registered in the authentication framework, and an authentication is performed as the external authentication processing mounting module 143. A logic implementation module that implements a process for requesting authentication by transmitting a card ID to the server 50 and acquiring user information corresponding to the card ID from the authentication server 50 is registered in the authentication framework, and a main body authentication control implementation module As 144, the logic implementation module for inputting the user information acquired as a result of authentication in the authentication server 50 to the main body authentication unit 120 can be registered in the authentication framework.

  In FIG. 9, the application 140a acquires the card ID stored in the smart card 321 via the external device information acquisition unit 132 and the external device control unit 131 (S101 to S105). Subsequently, when the application 140a transmits the acquired card ID to the authentication server 50, the authentication server 50 performs authentication based on the card ID, and user information (user name, password, etc.) corresponding to the card ID is authenticated. A reply is sent from the server 50 (S111 to S113).

  Subsequently, when the application 140a requests authentication to the main body authentication control unit 134 using the user information returned from the authentication server 50, the main body authentication unit 120 performs authentication accordingly (S121 to S123).

  In the example of FIG. 9, a password input screen is provided during screen transition of the main body authentication control implementation module 144 registered in the main body authentication control unit 134, and when the password input screen is displayed, a keyboard or the like as shown in FIG. A solution with higher security may be realized by incorporating a sequence that allows the user to input a password using.

  By the way, if the authentication is successful, the user can log in to the application 140a and use the application 140a within the scope of the usage authority. Alternatively, the application 140a can be appropriately controlled and managed. Here, since the implementation of the authentication framework can be arbitrarily incorporated by the logic implementation module, and the application 140a can also be arbitrarily incorporated, this (the login framework can be controlled by the authentication framework or the application 140a). "Being possible" means that the control method or management method of the login state can be freely (flexibly) incorporated in accordance with the operation of the user. Hereinafter, control and management of the login state using the authentication framework will be described. Examples of the login state control include automatic logout. Further, the management of the login state refers to, for example, detection of login, detection of logout, grasping of a logged-in user, and the like.

  FIG. 10 is a first sequence diagram for explaining the login state control and management processing by the authentication framework and the application. In FIG. 10, steps S201 to S218 describe the process in FIG. 9 in more detail.

  For example, when the user inputs a use request for the application 140a via the operation unit 109 (S201), a connection check is performed between the smart card reader 32 and the external device control unit 131 (S202), and a connection is established. (S203).

  Subsequently, the external device control unit 131 generates another thread for monitoring the state in the smart card reader 32 (hereinafter referred to as “state monitoring thread”) (S204). The processing by the state monitoring thread will be described after step S251. Subsequently, the external device control unit 131 notifies the user through the display unit 108 that authentication is possible (S205). For example, a message prompting insertion of the smart card 321 is displayed on the display unit 108.

  When the user inserts the smart card 321 into the smart card reader 32 (S206), the card ID stored in the smart card 321 is acquired by the external device control unit 131 (S207). The acquired card ID is notified to the application 140a via the external device information acquisition unit 132 (S208, S209). The application 140a requests the external authentication processing unit 133 for authentication by transmitting the card ID to the external authentication processing unit 133. The external authentication processing unit 133 transmits the card ID to the authentication server 50 via the network, and receives user information according to the authentication result in the authentication server 50.

  Subsequently, the external authentication processing unit 133 transmits the received user information to the application 140a (S211). The application 140a makes an authentication request (login request) to the main body authentication control unit 134 based on the user information (S212). In response to the login request, the main body authentication control unit 134 records the occurrence of user login in the recording medium 103 as an access log (S213). For example, the user name and time related to login are recorded.

  Subsequently, the main body authentication control unit 134 makes the main body authentication unit 120 execute a main body authentication (built-in authentication) by making a login request to the main body authentication unit 120 (inputs user information), and receives the result. (S215). Based on the result, the main body authentication control unit 134 can detect a successful login. Therefore, the main body authentication control unit 134 can manage the login status of the user (information indicating that the user is logged in). The login status is recorded on the recording medium 103 by the main body authentication control unit 134, for example.

  Subsequently, the main body authentication control unit 134 notifies the application 140a of the result of login (authentication) (S216). By the notification, the application 140a can detect that the login is successful.

  Subsequently, the application 140a displays the login result on the display unit 108 to notify the user of the login result (S217). If the login is successful, the application 140a provides a function according to the input by the user (S218).

  On the other hand, when activated, the external device control unit 131 related to the status monitoring thread continuously monitors the connection status of the smart card reader 32 (S251). For example, the card ID is periodically acquired from the smart card 321. Therefore, for example, when the connection with the smart card 321 is disconnected by removing the smart card 321 from the smart card reader 32 (S252), the user information cannot be acquired, and the state monitoring thread It is possible to detect that has been removed. In response to the detection, the state monitoring thread requests the main body authentication control unit 134 to acquire the login status (S253). The body authentication control unit 134 returns the managed login status (S254). Here, a plurality of login statuses may be returned for each user. This is because there may be a user who logs in to the application 140a via the network.

  The external device control unit 131 requests the main body authentication control unit 134 to log out the user who has logged in based on the acquired login status (restriction of use due to cancellation of the authentication state) (S255). Here, the users to be logged out may be limited to users who have logged in via the external device control unit 131 (that is, by the smart card 321), or may be all users who are currently logged in. Which one is to be used may be appropriately determined according to the usage form.

  In response to the logout request, the main body authentication control unit 134 records that the logout has occurred in the recording medium 103 as an access log (S256). For example, the user name and time related to logout are recorded.

  Subsequently, the main body authentication control unit 134 makes the main body authentication unit 120 perform logout by making a logout request (S257), and receives the result (S258). Based on the result, the main body authentication control unit 134 can detect the success of logout. Therefore, the main body authentication control unit 134 can update or delete the login status of the user.

  Subsequently, the main body authentication control unit 134 notifies the external device control unit 131 of the logout result (S259). If the logout is successful, the external device control unit 131 notifies the user that the application 140a cannot be used via the display unit 108 (S217).

  The example of FIG. 10 is an example of a usage mode in which logout is automatically executed when the connection with the external device 30 is disconnected. By implementing such an automatic logout function, unauthorized use due to forgetting to logout can be prevented. Further, it is possible to realize a usage mode in which a specific user is forcibly logged out.

  Note that the case where the connection to the external device 30 is disconnected includes the case where the USB memory is removed.

  Further, when using external authentication, the external authentication processing unit 133 may periodically request authentication from the authentication server 50 and execute logout when authentication fails.

  Further, in the case of performing billing management, billing may be performed in accordance with the use of the application 140a, and logout may be executed when the amount that has been input (or registered) in advance becomes zero.

  Further, at the time of the login request in step S212, the application 140a may set the logout time in the main body authentication control unit 134. In this case, the main body authentication control unit 134 logs out when the time set as the logout time elapses from the time of login or when the input (operation) by the user is not performed for the period set as the logout time. Run.

  Further, at the time of the login request in step S212, the application 140a may request the main body authentication control unit 134 to lock the login status. In this case, the main body authentication control unit 134 ignores a login request for a new user and a logout request for a logged-in user until the login status is requested to be unlocked. Therefore, when the administrator logs in and wants to occupy work (for example, backup work), it is possible to prevent a new user from logging in (including remote login). Further, when a logout button (hereinafter referred to as “logout key”) provided in the operation unit 109 is erroneously pressed, it is possible to prevent the user from being forcibly logged out.

  When the image forming apparatus 10 has the energy saving mode, the image forming apparatus 10 may be automatically returned from the energy saving state in response to the generation of the login request in step S212. By doing so, it is possible to log in to the application 140a without pressing the return button from the energy saving state in the operation unit 109.

  Further, at the time of the login request in step S212, the application 140a may set the use authority of the login user in the main body authentication control unit 134. In this case, the main body authentication control unit 134 prioritizes the set use authority over the use authority registered in the user list 121 and restricts the use. By doing so, it is possible to realize flexible management of usage authority according to the usage mode of the user. Further, in this case, the use restriction for the user can be realized without registering the use authority in the user list 121 in advance.

  By the way, although an example in which logout is executed in software has been described with reference to FIG. 10, a processing procedure when logout is requested by hardware (that is, when the logout key is pressed) will be described. FIG. 11 is a sequence diagram for explaining a processing procedure when logout is requested in hardware.

  When the user presses the logout key while already logged in to the application 140a (S301), the operation unit 109 notifies the main body authentication unit 120 of a logout request (S302). The main body authentication unit 120 performs logout processing and requests the display unit 108 to display the result (S303). The display unit 108 displays a screen indicating that the user has logged out (S304).

  On the other hand, after successful logout processing, the main body authentication unit 120 notifies the main body authentication control unit 134 that the user has been logged out (S304). In response to the notification, the main body authentication control unit 134 records the occurrence of user logout as an access log (S305). Subsequently, the main body authentication control unit 134 notifies the application 140a of logout (S306). Thereby, the application 140a can detect logout. Therefore, when there is a process that is desired to be executed in response to detection of logout in the application 140a as a process required in the usage mode, the process can be executed at this timing.

  As described above, according to the image forming apparatus 10 in the present embodiment, it is possible to flexibly select a user information acquisition destination, a server that executes authentication, and the like according to the operation by the authentication framework. Therefore, it is possible to restrict the use of the image forming apparatus 10 by using an authentication system that is already constructed in the user environment.

  In addition, by implementing a logic implementation module or application, it is possible to flexibly realize a form suitable for user operation with respect to control and management of a user login state and the like.

  As mentioned above, although the Example of this invention was explained in full detail, this invention is not limited to such specific embodiment, In the range of the summary of this invention described in the claim, various deformation | transformation・ Change is possible.

10 Image forming apparatus 30 External device 31 Keyboard 32 Smart card reader 50 Authentication server 101 CPU
102 Memory 103 Recording medium 104 Network I / F
105 Image output unit 106 Image processing unit 107 External device I / F
108 display unit 109 operation unit 110 main body function unit 120 main body authentication unit 121 user list 122 built-in authentication processing unit 130 framework 131 external device control unit 132 external device information acquisition unit 133 external authentication processing unit 134 and main body authentication control unit 140 application 141 External device control mounting module 142 External device information acquisition mounting module 143 External authentication processing mounting module 144 Main unit authentication control mounting module 145 Registration processing unit 321 Smart card

JP 2006-215770 A JP 2007-122384 A JP 2006-92437 A

Claims (9)

Accepting means for accepting information according to the operation input;
First connection means for connecting to an external device;
User information storage means for storing user information;
First authentication means for executing user authentication based on the user information stored in the user information storage means;
Second connection means for connecting to the authentication device via a network;
A second authentication means for performing communication with the authentication device via a network and executing user authentication using the authentication device;
Receiving means for receiving information from the external device;
Of the receiving means, the first authenticating means, and the second authenticating means, a registering means for registering means used for executing user authentication;
An authentication processing means for executing user authentication based on the information obtained by the receiving means or the receiving means using the user information storage means or the authentication device in response to registration by the registration means;
An information processing apparatus comprising: The information obtained by the accepting means is a password,
The external device is reading means for reading information recorded by a recording medium,
The information recorded by the recording medium obtained by the receiving means is recording medium identification information of the recording medium read from the recording medium by the reading means,
The authentication processing means executes user authentication based on the password obtained by the receiving means and the recording medium identification information obtained by the receiving means in response to registration by the registration means. The information processing apparatus according to 1.   The information processing apparatus according to claim 1, wherein the information obtained by the receiving unit is a user name and a password. The external device is reading means for reading information recorded by a recording medium,
2. The information processing apparatus according to claim 1, wherein the information recorded on the recording medium obtained by the receiving unit is recording medium identification information of the recording medium read from the recording medium by the reading unit. The external device is a keyboard that accepts operation inputs,
The information processing apparatus according to claim 1, wherein the information obtained by the receiving unit is a user name and a password received by the keyboard through an operation input. Monitoring means for monitoring a connection state with the external device;
Control means for logging out in response to the monitoring means detecting disconnection from the external device after successful login based on the result of user authentication by the authentication processing means;
The information processing apparatus according to any one of claims 1 to 4, further comprising: A reception procedure for receiving information according to an operation input;
A first connection procedure for connecting to an external device;
A first authentication procedure for executing user authentication based on user information stored in the user information storage means;
A second connection procedure for connecting to the authentication device via the network;
A second authentication procedure for communicating with the authentication device via a network and performing user authentication using the authentication device;
A receiving procedure for receiving information from the external device;
A registration unit for registering a procedure used for executing user authentication among the reception procedure, the first authentication procedure, and the second authentication procedure;
An authentication processing procedure for performing user authentication based on the information obtained by the reception procedure or the reception procedure, using the user information storage procedure or the authentication device, in accordance with the registration by the registration procedure;
An authentication control method in which a computer executes. A reception procedure for receiving information according to an operation input;
A first connection procedure for connecting to an external device;
A first authentication procedure for executing user authentication based on user information stored in the user information storage means;
A second connection procedure for connecting to the authentication device via the network;
A second authentication procedure for communicating with the authentication device via a network and performing user authentication using the authentication device;
A receiving procedure for receiving information from the external device;
A registration unit for registering a procedure used for executing user authentication among the reception procedure, the first authentication procedure, and the second authentication procedure;
An authentication processing procedure for performing user authentication based on the information obtained by the reception procedure or the reception procedure, using the user information storage procedure or the authentication device, in accordance with the registration by the registration procedure;
A program that causes a computer to execute.   A computer-readable recording medium on which the program according to claim 8 is recorded.

Images