JP2015028704A - Service provision system, service provision method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To detect overlapping of output requests.SOLUTION: There is provided a service provision system, including: management information storage means for storing service identification information on services, user identification information on users using services, and management information associated with device identification information on a service use device; authentication means for executing authentication processing by using, as authentication information, user authentication information that is acquired from the service use device and is used for user authentication or device authentication information that is used for device authentication; service specification means for specifying a service associated with the authentication information on the basis of the authenticated authentication information and the management information; and execution means for executing, when acquiring a request to use the specified service from the service use device, processing according to the request to use the service, where the execution means detects overlapping of an output request from the service use device instructed by a user and an output request that has been already received.

Description

  The present application relates to a service providing system, a service providing method, and a program.

  For example, there is a known method for detecting duplication of print jobs in order to prevent unnecessary print jobs from being printed by sending execution instructions for the same print job due to a print job transmission error by the user. (For example, refer to Patent Document 1).

  However, the method of Patent Document 1 described above assumes provision in a private network such as in an office environment. Therefore, for example, it is not assumed that the provision of the service is controlled in accordance with the service provision destination such as the user, the organization, or the company like the provision of the service from the cloud environment. For this reason, it is difficult to control service provision that detects duplication of print jobs as output requests from a service provider after managing the service and the service provider.

  In one aspect, the present invention is directed to detecting duplicate output requests.

  In one aspect, a service providing system configured to provide a service to a service using device configured by one or more information processing devices and connected via a network, the service identification information of the service, the user using the service Management information storage means for storing management information associated with user identification information and device identification information of the service using device, user authentication information used for user authentication acquired from the service using device, or used for device authentication A service specification that identifies the service associated with the authentication information based on the authentication means that performs authentication processing using the device authentication information to be used as authentication information, the authentication information authenticated by the authentication means, and the management information And a request for using the service specified by the service specifying means, An execution unit that executes processing according to the service use request when acquired from the service use device, and the execution unit has already accepted an output request from the service use device instructed by the user. Detects duplicate output requests.

  Duplicate output requests can be detected.

It is a lineblock diagram of an example of an information processing system concerning this embodiment. It is a hardware block diagram of an example of the computer system which concerns on this embodiment. It is a process block diagram of an example of the service provision system which concerns on this embodiment. It is a block diagram of an example of license information. It is a block diagram of an example of tenant information. It is a block diagram of an example of user information. It is a block diagram of an example of apparatus information. The block diagram of an example of external service information is shown. It is a flowchart of an example showing the process sequence from tenant registration to service registration. It is an image figure of an example of a usage agreement screen. It is a sequence of an example of user authentication and apparatus authentication processing. It is a figure for demonstrating an example of the data processing function of a service provision system. It is a flowchart of an example showing the process sequence of the data processing function with which a service provision system is provided. It is a figure for demonstrating the data processing which divides the processing content of one data processing into the processing content of several data processing. It is a flowchart of an example of the authorization setting with respect to online storage. It is a flowchart of an example of a cooperation process with online storage. It is a processing block diagram of an example of an image forming apparatus and a print service application. 6 is a sequence example of job output control processing; 10 is a sequence of another example of job output control processing.

  Next, embodiments of the present invention will be described in detail.

<System configuration>
FIG. 1 is a configuration diagram of an example of an information processing system according to the present embodiment. The information processing system 1 in FIG. 1 includes a private network N1 in the office, a network N2 of a service providing system 2 represented by a cloud service, and a network N3 such as the Internet. The networks N1 to N3 are an example of a network environment.

  A firewall FW is installed in the network N1 in the office. The firewall FW restricts access from unauthorized access sources. An access control device 21 is installed in the network N2 of the service providing system 2. The access control device 21 restricts access via the network N3.

  The network N1 in the office is a private network inside the firewall FW. A terminal device 11, an image forming device 12, an authentication device 13, and other devices 14 are connected to the network N1.

  The terminal device 11 is realized by an information processing device (computer system) on which a general OS (Operating System) or the like is mounted. The terminal device 11 is a device operable by the user, such as a PC (Personal Computer), a tablet PC, a notebook PC, a smartphone, or a mobile phone.

  The image forming apparatus 12 is an apparatus having an image forming function, such as a multifunction machine, a copier, a scanner, or a laser printer. The authentication device 13 is realized by an information processing device equipped with a general OS or the like. The authentication device 13 provides a user authentication function. The other device 14 is a device such as a projector or an electronic blackboard device.

  The terminal device 11, the image forming device 12, the authentication device 13, and the other device 14 have wireless communication means or wired communication means. FIG. 1 shows an example in which the terminal device 11, the image forming device 12, the authentication device 13, and the other devices 14 are each one, but a plurality of devices may be used.

  The service providing system 2 is a system constructed by a provider who provides a cloud service via the network N3. Note that the present embodiment has been described by taking a cloud service as an example, but may be applied to a service provided via the network N3, such as a service provided by an ASP (application service provider) or a Web service.

  The network N2 of the service providing system 2 is connected to the network N3 by the access control device 21. The network N2 includes an access control device 21, a print service providing device 22, a distribution service providing device 23, a portal service providing device 24, an authentication device 26, a data processing control device 27, a data processing execution control device 28, and a data processing device 29. It is connected.

  Details of the print service providing device 22, the distribution service providing device 23, the portal service providing device 24, the authentication device 26, the data processing control device 27, the data processing execution control device 28, and the data processing device 29 will be described later.

  Each device in the service providing system 2 such as the access control device 21 and the print service providing device 22 is realized by one or more information processing devices. That is, each device in the service providing system 2 may be realized by a single information processing device, or may be realized by being distributed to a plurality of information processing devices.

  Note that each device in the service providing system 2 may be realized by being integrated into one computer. In other words, the number of information processing devices constituting each device in the service providing system 2 does not limit the scope of application of the present invention.

  Also, some or all of the devices in the service providing system 2 may be realized in a private network such as the network N1 in the office. The information processing system 1 according to the present embodiment shows a preferable example. For example, the scope of the present invention is not limited by whether or not there is a firewall FW between the service providing system 2 and each device in the network N1 in the office that is accessed to use the service providing system 2.

  The service providing system 2 can be broadly classified into a device that realizes a service providing function for providing various services and a device that realizes a platform function that can be commonly used when providing various services. It is.

  The print service providing device 22, the distribution service providing device 23, and the portal service providing device 24 are examples of devices that realize a service providing function for providing various services. The authentication device 26, the data processing control device 27, the data processing execution control device 28, and the data processing device 29 are examples of devices that implement platform functions that can be commonly used when providing various services.

  The general method of the service providing system 2 as described above is a conceptual way of understanding the present invention in an easy-to-understand manner, and the service providing system 2 must be configured based on such a way of understanding. It's not that.

  A terminal device 11, a mail server 31, an online storage 32, and the like are connected to a network N3 such as the Internet. As shown in FIG. 1, the terminal device 11 may be connected to a network other than the network N1 in the office. The information processing system 1 in FIG. 1 shows an example in which a terminal device 11 is connected to a network N1 in an office and a network N3 such as the Internet.

  The mail server 31 performs processing related to electronic mail such as transmission and reception of the user's electronic mail. The online storage 32 performs processing related to a service that lends a storage area of the storage. The mail server 31 and the online storage 32 are realized by one or more information processing apparatuses.

<Hardware configuration>
The terminal device 11 and the authentication device 13 in FIG. 1 are realized by a computer system having a hardware configuration as shown in FIG. 2, for example. Similarly, each device in the service providing system 2 such as the access control device 21 and the print service providing device 22 in FIG. 1 is realized by a computer system having a hardware configuration as shown in FIG.

  The mail server 31 and online storage 32 in FIG. 1 are also realized by a computer system having a hardware configuration as shown in FIG. FIG. 2 is a hardware configuration diagram of an example of a computer system according to the present embodiment.

  The computer system 40 shown in FIG. 2 includes an input device 41, a display device 42, a RAM 43, a ROM 44, an HDD (Hard Disk Drive) 45, a CPU (Central Processing Unit) 46, a communication I / F 47, an external device I / Fs 48 are connected to each other via a bus B.

  The input device 41 includes a keyboard, a mouse, a touch panel, etc., and is used by a user to input each operation signal. The display device 42 includes a display and the like, and displays a processing result by the computer system 40.

  The RAM 43 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 44 is a nonvolatile semiconductor memory (storage device) that can retain programs and data even when the power is turned off. The ROM 44 stores programs and data such as BIOS (Basic Input / Output System), OS settings, and network settings that are executed when the computer system 40 is started.

  The HDD 45 is a non-volatile storage device that stores programs and data. The stored programs and data include, for example, an OS that is basic software for controlling the entire computer system 40, and application software that provides various functions on the OS.

  The HDD 45 manages stored programs and data by a predetermined file system and / or DB (database).

  The CPU 46 is an arithmetic unit that realizes control and functions of the entire computer system 40 by reading a program and data from a storage device such as the ROM 44 and the HDD 45 onto the RAM 43 and executing processing.

  The communication I / F 47 is an interface that connects the computer system 40 to the networks N1 to N3. Thereby, the computer system 40 performs data communication via the communication I / F 47.

  The external I / F 48 is an interface with an external device. The external device includes a recording medium 48A. Thereby, the computer system 40 can read and / or write the recording medium 48A via the external I / F 48.

  The recording medium 48A includes a flexible disk, a CD (Compact Disk), a DVD (Digital Versatile Disk), an SD memory card (SD Memory card), a USB memory (Universal Serial Bus memory), and the like.

  With the hardware configuration described above, the computer system 40 can implement various processes.

<Software configuration>
《Service provision system》
FIG. 3 is a processing block diagram of an example of the service providing system according to the present embodiment. The service providing system 2 of FIG. 3 realizes a service application 51, a platform 52, a management data storage unit 53, and a platform API (Application Programming Interface) 54 by executing a program.

  The service application 51 of FIG. 3 includes a portal service application 61, a print service application 62, and a distribution service application 63 as an example. The service application 51 is an application having a function for providing various services.

  For example, the portal service application 61 is implemented in the portal service providing apparatus 24 of FIG. The print service application 62 is implemented in the print service providing apparatus 22. The distribution service application 63 is implemented in the distribution service providing apparatus 23.

  The portal service application 61 is an application that provides a portal site for a user to use various services such as a print service and a distribution service. The portal service application 61 performs tenant registration processing, service registration processing, and various management information registration processing described later in cooperation with the platform 52 as processing for the user to use various services.

  The print service application 62 is an application that provides a print service that realizes printing by the image forming apparatus 12 by storing print data, for example, and transmitting the print data to the image forming apparatus 12, for example.

  The distribution service application 63 is an application that provides a distribution service that performs data processing on image data transmitted from various apparatuses such as the image forming apparatus 12 and distributes the processed data to the online storage 32 of FIG.

  The service application 51 is not limited to the example of FIG. 1, and may include an application that provides a service for transmitting stored image data (projection data) to another device 14 such as a projector. The service application 51 may include an application that provides a service for transmitting stored image data (projection data) to another device 14 such as an electronic blackboard device. As described above, the service application 51 includes an application that provides some service to each apparatus such as the image forming apparatus 12 used by the user.

  The platform API 54 is an interface for the service application 51 to use the platform 52. The platform API 54 is a predefined interface provided for the platform 52 to receive a request from the service application 51, and includes, for example, a function or a class.

  When the service providing system 2 is distributed and configured in a plurality of information processing apparatuses, for example, a Web API that can be used via a network can be used as the platform API 54.

  The platform 52 includes a communication unit 71, an access control unit 72, a mail transmission unit 73, a setting registration unit 74, an authorization setting processing unit 75, a license authentication unit 76, a user authentication unit 77, a user device authentication unit 78, and an in-house cooperation authentication unit 79. The external cooperation authentication unit 80, the data processing control unit 81, one or more processing queues 82, one or more data processing requesting units 83, and one or more data processing units 84.

  The communication unit 71 is a functional unit that executes communication with each device such as the image forming device 12, and is implemented in the access control device 21 of FIG. 1, for example. The access control unit 72 is a functional unit that executes access control in accordance with various accesses requested to the service providing system 2 from each device such as the image forming device 12, and is implemented in the access control device 21, for example. .

  The mail transmission unit 73 is a functional unit that transmits mail, and is implemented in, for example, the authentication device 26 of FIG. The setting registration unit 74 is a functional unit that sets and registers various types of management data stored in the management data storage unit 53, and is implemented in the authentication device 26, for example. The authorization setting processing unit 75 is a functional unit that executes processing for setting authorization for an external service such as the online storage 32, and is implemented in the authentication device 26, for example.

  The license authentication unit 76 is a functional unit that performs license-related authentication based on later-described license information and tenant information stored in the management data storage unit 53, and is implemented in the authentication device 26, for example. The user authentication unit 77 is a functional unit that performs user authentication based on a login request from a device that does not require device authentication, such as the terminal device 11, and is implemented in the authentication device 26, for example.

  The user device authentication unit 78 is a functional unit that performs user authentication based on a login request from a device that requires device authentication, such as the image forming device 12, and is implemented in the authentication device 26, for example.

  The in-house cooperation authentication unit 79 performs a user authentication when a user performs authentication by the authentication device 13 of FIG. 1 and logs in using a user ID acquired from the authentication device 13 in an apparatus such as the image forming apparatus 12. For example, the authentication device 26 is implemented. The external cooperation authentication unit 80 is a functional unit that executes an authentication process for logging in to the online storage 32 in FIG. 1, and is implemented in the authentication device 26, for example.

  The data processing control unit 81 is a functional unit that controls data processing to be executed based on a request from the service application 51, and is implemented in the data processing control device 27, for example. The one or more processing queues 82 are message queues corresponding to the type of data processing, and a request message related to data processing is registered from the data processing control unit 81. The processing queue 82 is implemented in the data processing control device 27, for example.

  The one or more data processing requesting units 83 monitor the processing queue 82 assigned to the one or more data processing requesting units 83 and receive a request message related to data processing from the processing queue 82. The data processing request unit 83 is a functional unit that requests the data processing unit 84 to execute data processing corresponding to the received message, and is implemented in the data processing execution control device 28, for example.

  The one or more data processing units 84 are functional units that execute data processing in response to a request from the data processing requesting unit 83, and are implemented in the data processing device 29, for example. Examples of the data processing executed by the data processing unit 84 include a request dividing process requested by the service application 51, a data format conversion process for converting the data format, an OCR process for executing the OCR, and the like. Furthermore, examples of data processing executed by the data processing unit 84 include upload processing for uploading data to the online storage 32.

  Depending on the type of data processing, the data processing requesting unit 83 and the data processing unit 84 may be mounted in the data processing execution control device 28, for example.

  The management data storage unit 53 includes a management information storage unit 91, a data processing information storage unit 92, and a data storage unit 93 as an example.

  The management information storage unit 91 stores management information such as license information, tenant information, user information, and device information. The management information storage unit 91 is implemented in the authentication device 26, for example. The data processing information storage unit 92 stores information related to requested data processing. The data processing information storage unit 92 is implemented in the data processing control device 27, for example. The data storage unit 93 stores other data such as application data and print data. The data storage unit 93 is implemented in the data processing control device 27, for example.

  The management data stored in the management data storage unit 53 in FIG. 3 is, for example, as follows. FIG. 4 is a configuration diagram of an example of license information. The license information includes a license type, an ID, a registration code, and a registration state as data items. The license type is information indicating the type of license.

  There are tenant, print service, distribution service, and the like as license types. The ID is an ID of each license and is information used for license authentication. The registration code is information used when registering a tenant. The registration status is information indicating whether or not the license registration (ID registration) by the user has been completed (whether registered or not registered).

  FIG. 5 shows a configuration diagram of an example of tenant information. The tenant information has tenant ID, name, service ID, service type, expiration date, external service, address information, usage area information, and the like as data items. The tenant ID is an ID whose license type is “tenant” in the license information, and is registered when the user performs tenant registration.

  The name is a name set by the user when performing tenant registration. For example, a company name or an organization name is set. The service ID is an ID of a service whose license type is “print service” or “distribution service” in the license information, and is registered when the user performs service registration after tenant registration.

  The service type is information indicating the license type (service type) corresponding to the service ID. The expiration date is the expiration date of the service ID. The expiration date of the service ID registered in a specific device is managed from the time of registration.

  The external service is information representing an external service used in cooperation with the service providing system 2. An example of the external service is the online storage 32 shown in FIG. The address information is an email address of an administrator registered at the time of tenant registration.

  Use area information is information about the country / region where the service is used. The online storage 32 is an example of an external service. Information such as an account, password, authorization token, and scope, which will be described later, is an example of information used when using an external service.

  The authorization is to set a use range (authority) in using the service such as which service is used and which resource is allowed to be accessed when the user uses the service. Authorization can be set using a standard API authorization technology called OAuth, for example. From the viewpoint of using an external service such as the online storage 32 from the service providing system 2, the external service serves as an OAuth service provider, and the service providing system 2 serves as an OAuth consumer.

  FIG. 6 shows a configuration diagram of an example of user information. User information includes, as an example, tenant ID, login user ID and password, in-house authentication user ID, online storage account, password, authorization token and scope, and address information as data items. Have.

  The user information manages information of each user in tenant ID units. The login user ID and password are authentication information used for user authentication when logging into the service providing system 2. The user ID for login may be a user name or the like, and may be information that can identify the user when logging in to the service providing system 2.

  The in-house authentication user ID is user identification information that identifies a user in the authentication device 13 of the network N1 in the office, and is used for user authentication when logging in using the user identification information acquired from the authentication device 13. Information. The user ID for in-house authentication may be user identification information that can identify the user in the authentication device 13 of the network N1 in the office, and may be a card ID of an IC card carried by the user, a terminal ID of a portable terminal, or the like.

  The account and password for online storage are authentication information used when logging into the online storage 32. The authorization token is information for using the online storage 32 within a specific authority range. The scope is information for specifying a use range set by authorization.

  The account may be a user ID, a user name, an online storage address, or the like, and may be authentication information used for authentication when the user logs in to the target online storage 32. The address information is a user's mail address.

  FIG. 7 shows a configuration diagram of an example of device information. The device information includes a tenant ID, device ID, service ID, service type, use start date, use end date, and the like as data items. The device information manages information of each device in units of tenant IDs.

  The device ID is information for identifying a device, and is information used for device authentication. An example of the device ID is a machine number of the device. The service ID and service type are the same information as the service ID and service type in the tenant information, and are registered when the user registers the service ID for a specific device.

  The use start date is information on the date when the service ID is registered. The use end date is information on the date when the expiration date of the registered service ID ends. The device registered in the device information can use the service of the registered service ID from the use start date to the use end date of the service ID.

  Depending on the type of service and the type of license, there may be an indefinite expiration date (substantially no expiration date limitation). In addition, even for a device for which device information is not registered, some of the functions provided by the service providing system 2 can be used except for services (functions) that cannot be used unless device authentication is performed.

  In the present embodiment, the terminal device 11 is shown as an example of a device that does not require registration of device information. In the present embodiment, the image forming apparatus 12 is shown as an example of an apparatus that requires registration of apparatus information.

  Examples of functions that can be used in the terminal device 11 include management data setting registration, print data input, and deletion. Examples of functions that can be used in the image forming apparatus include acquisition of print data, transmission of distribution data, and the like.

  It is up to the provider providing the service to determine what functions are required for device authentication and what functions are not required for device authentication. There may be no service.

  FIG. 8 shows a configuration diagram of an example of external service information. The external service information includes an external service ID, a service name, a client ID, a client secret, a product name, a scope, an authorization destination URL, a redirect destination URL, and the like as data items. The external service ID is information for specifying (identifying) an external service.

  The service name is the name of the external service. The client ID is information that identifies the service providing system 2 issued by an external service. The client secret is secret information for guaranteeing the identity of the client ID, and is information that plays a role like a password.

  The product name is information for specifying the service application 51. The scope is information for specifying the usage range of the external service. The authorization destination URL is the URL of the authorization system provided in the external service (for example, the URL of the authorization server provided in the external service). The redirect destination URL is a URL of the service providing system 2 redirected from an external service (for example, a URL of a function as an authorization client of the authorization setting processing unit 75).

  As described above, the tenant ID is associated with the service provided by the service providing system 2, the user using the service, and the device using the service, and information for managing the user, the device, and the service in the service providing system 2. It is. The tenant ID is information (use target specifying information) for specifying a use target such as which service, to which user, and further to which device among the services that the service providing system 2 can provide.

<Details of processing>
Below, the detail of the process of the information processing system 1 which concerns on this embodiment is demonstrated.

<Processing from tenant registration to service registration>
FIG. 9 is an example flowchart illustrating a processing procedure from tenant registration to service registration. First, a user who wants to perform tenant registration (for example, an administrator of a company or organization) acquires a tenant ID and a registration code from a service provider (for example, a person in charge of providing and selling services) of the service providing system 2.

  Examples of the method for acquiring the tenant ID and the registration code include a method of acquiring directly from the service provider, a method of acquiring and accessing the dedicated site operated by the service provider from the user terminal device 11, and the like. .

  In step S <b> 1, the user operates the input device 41 of the terminal device 11 so that the terminal device 11 accesses the portal site of the service providing system 2. The terminal device 11 accesses the portal site of the service providing system 2 based on a user operation.

  Since the access control unit 72 of the service providing system 2 is an access to the portal site, the access from the terminal device 11 is permitted and the portal service application 61 is accessed.

  The portal service application 61 displays a top screen on the display device 42 of the terminal device 11. The user can operate the input device 41 of the terminal device 11 and select whether to request login or new tenant registration from the top screen. Here, the description will be continued assuming that a new tenant registration request is selected.

  If the user is registered in the user information of the management information storage unit 91 (administrator or other user), the login request can be selected by entering the tenant ID, user ID, and password. is there.

  When a new tenant registration is requested, the portal service application 61 of the service providing system 2 displays an input screen for temporarily registering a tenant ID on the display device 42 of the terminal device 11 in step S2. The user operates the input device 41 of the terminal device 11 to input for tenant ID temporary registration, and then requests temporary registration. The terminal device 11 makes a temporary registration request to the portal site of the service providing system 2 based on a user operation.

  The information input for temporary registration of the tenant ID includes, for example, information on the country / region where the service is used (use area information) and the terms of use displayed according to the country / region where the service is used. And information indicating that you agree to the (Terms). The information input for the temporary registration of the tenant ID includes information such as a tenant ID, a registration code, an email address, and a language used.

  Therefore, the service providing system 2 holds information on terms of use (a contract) according to the country / region to be used. The portal service application 61 of the service providing system 2 performs display control to display the usage agreement according to the usage area information input for the temporary registration of the tenant ID by the user on the display device 42 of the terminal device 11 to be used. Let the user choose whether or not to agree to the terms.

  FIG. 10 is an image diagram of an example of the usage agreement screen. The usage agreement screen 1010 includes a selection column 1011 that allows the user to select a country / region where the service is to be used, a usage agreement column 1012 that displays a usage agreement corresponding to the selection column 1011, and whether or not to accept the usage agreement. And a check box 1013 to be selected.

  When provisional registration is requested from the terminal device 11 of the user, the portal service application 61 licenses a process for confirming the validity of the tenant ID and registration code included in the information input for provisional registration of the tenant ID. The authentication unit 76 is requested. Upon receiving the request, the license authentication unit 76 executes the license authentication process, and the license information in FIG. 4 stored in the management information storage unit 91 stores the tenant ID and the registration code requested for the validity confirmation process. Is checked (verified).

  If the tenant ID and registration code for which the validity confirmation process is requested are stored, the license authentication unit 76 determines whether the registration state associated with the tenant ID and registration code is “unregistered”. To do.

  If the registration status is “unregistered”, the license authentication unit 76 determines that the tenant ID and registration code for which the validity confirmation processing is requested are valid information, and authenticates the tenant ID (license). To do. The license authentication unit 76 notifies the portal service application 61 of the license authentication result.

  When the tenant ID and the registration code are valid information, the portal service application 61 registers the tenant ID, e-mail address, and usage area included in the information input to the setting registration unit 74 for temporary registration of the tenant ID. Request registration of information. The setting registration unit 74 registers the tenant ID, the mail address, and the usage area information in the tenant information in the management information storage unit 91 in response to a request from the portal service application 61.

  When registration by the setting registration unit 74 is performed, the portal service application 61 generates a main registration URL that is an access destination for displaying a main registration screen in step S3, and the main registration URL is described. Create an email. The portal service application 61 requests the mail transmission unit 73 to transmit the created mail.

  The mail transmission unit 73 transmits an e-mail addressed to the e-mail address included in the information input for the temporary registration of the tenant ID. When the mail is transmitted by the mail transmitting unit 73, the portal service application 61 displays a notification screen indicating that the mail has been transmitted on the display device 42 of the terminal device 11.

  The main registration URL is managed, for example, by an expiration date (for example, one hour) from the time of generation. In addition, it is assumed that the email transmitted from the email transmission unit 73 does not describe at least one of the tenant ID and the registration code from the viewpoint of enhancing security.

  Next, the user operates the input device 41 of the terminal device 11 so as to access the main registration URL described in the received mail. The terminal device 11 accesses the main registration URL based on a user operation.

  Note that the terminal device 11 that accesses the URL for main registration may not be the same as the terminal device 11 that has requested temporary registration. The access control unit 72 causes the terminal device 11 to access the portal service application 61.

  The portal service application 61 checks whether the access to the main registration URL is valid (whether the access is to the generated main registration URL and the access is within the expiration date). If it is valid, the portal service application 61 displays the main registration screen on the display device 42 of the terminal device 11.

  The user operates the input device 41 of the terminal device 11, inputs the tenant ID for main registration on the main registration screen, and then makes a main registration request. Information input on the registration screen is tenant information such as a tenant ID, name, and registration code, and user information such as a login user ID, password, and address information.

  Note that either the tenant ID or the registration code already input by the user in the temporary registration of the tenant ID may be displayed in a state of being input in advance. From the viewpoint of enhancing security, it is assumed that at least one of the information to be input by the user out of the tenant ID or the registration code is not described in the e-mail containing the main registration URL as described above.

  When the main registration is requested from the user terminal device 11, the portal service application 61 performs a license validation process (main registration process) based on the tenant ID and the registration code input on the main registration screen. To request.

  Upon receiving the request, the license authentication unit 76 executes a license authentication process, and determines whether the tenant ID and the registration code input on the main registration screen are stored in the license information stored in the management information storage unit 91. . The license authentication unit 76 stores the input tenant ID and registration code in the license information, and if the registration state associated with the tenant ID and registration code is “unregistered”, the input tenant ID It is determined that the registration code is valid information.

  If it is determined that the input tenant ID and registration code are valid information, the license authentication unit 76 requests the setting registration unit 74 to change the status of the license information. The setting registration unit 74 changes the value of the registration state associated with the valid tenant ID and registration code in the license information stored in the management information storage unit 91 to “registered”.

  When the license activation process is completed, the portal service application 61 requests the setting registration unit 74 to register the tenant information and user information input by the user on the main registration screen in the terminal device 11. The setting registration unit 74 registers the name input as part of the tenant information on the main registration screen in the tenant information stored in the management information storage unit 91. In addition, the setting registration unit 74 registers a tenant ID, a login user ID and password, address information, and the like in the user information stored in the management information storage unit 91.

  When the registration of various information settings by the setting registration unit 74 is completed, the portal service application 61 causes the display device 42 of the terminal device 11 to display a tenant registration completion screen. Further, the portal service application 61 creates an email in which a tenant registration completion notification is described, and requests the email transmission unit 73 to send an email. The mail transmission unit 73 transmits an e-mail in which a tenant registration completion notification is described to an e-mail address (address information registered in the tenant information) input by the user to temporarily register the tenant ID in the terminal device 11. .

  For example, the user checks the tenant registration completion screen displayed on the display device 42 of the terminal device 11. By completing the registration of the tenant ID, user ID, and password, the user can request login from the top screen of the portal site from the next time. By logging in from the top screen of the portal site, the user can perform registration processing of tenant information, user information, and device information associated with the tenant ID.

  In step S4, a user such as an administrator operates the input device 41 of the terminal device 11 to input a tenant ID, user ID, and password from the top screen of the portal site, and then requests login.

  Upon receiving the login request, the portal service application 61 requests the user authentication unit 77 for user authentication. The user authentication unit 77 determines (collates) whether the combination of the tenant ID, the user ID, and the password received from the terminal device 11 is stored in the user information stored in the management information storage unit 91.

  If the combination of the tenant ID, user ID, and password received from the terminal device 11 is stored, the user authentication unit 77 authenticates the user who made the login request. When the user is authenticated by the user authentication unit 77, the portal service application 61 permits login.

  A user who logs in to the portal service application 61 can register a service ID of a service to be used. The portal service application 61 displays a service registration screen for registering the service ID on the display device 42 of the terminal device 11. The user operates the input device 41 of the terminal device 11, inputs a service ID from the service registration screen displayed on the display device 42 of the terminal device 11, and then requests service registration. The terminal device 11 makes a service registration request to the portal service application 61 based on a user operation.

  When service registration is requested from the user's terminal device 11, the portal service application 61 refers to the license information stored in the management information storage unit 91, and selects an ID that matches the service ID entered on the service registration screen by the user. . The portal service application 61 acquires a license type (service type) associated with the selected ID.

  Further, the portal service application 61 refers to the tenant information stored in the management information storage unit 91 and acquires the use area information associated with the tenant ID of the logged-in user. The portal service application 61 causes the display device 42 of the terminal device 11 to display a usage rule corresponding to the acquired license type and usage area information, and allows the user to select whether or not to agree to the usage rule.

  The service providing system 2 holds usage agreement (conditions) information corresponding to the country / region used for each service type (license type). Whether the portal service application 61 performs display control to display the usage area information input for the temporary registration of the tenant ID by the user and the usage rule according to the service type for which the service registration is requested, and agrees to the usage rule. It is possible to let the user select whether or not.

  When the user operates the input device 41 of the terminal device 11 and selects to agree to the terms of use, the portal service application 61 performs service registration processing based on the tenant ID of the logged-in user and the service ID input on the service registration screen. Request to the license authentication unit 76.

  The license authentication unit 76 checks (checks) whether the service ID input on the service registration screen is stored as the ID in the license information stored in the management information storage unit 91. If the service ID input on the service registration screen is stored as an ID, the license authentication unit 76 determines that the service ID is a valid service ID (authenticates the service ID).

  If it is determined that the service ID is valid, the license authentication unit 76 requests the setting registration unit 74 to register the service ID. The setting registration unit 74 registers the service ID and service type in association with the tenant ID of the logged-in user for the tenant information stored in the management information storage unit 91.

  In step S5, a user such as an administrator performs device registration of a service ID. The user operates the input device 41 of the terminal device 11 to display a device registration screen on the display device 42 of the terminal device 11. The user operates the input device 41 of the terminal device 11 to input a service ID and a device ID of a device that can use the service by the service ID on the device registration screen, and request device registration of the service ID. To do.

  When the device registration of the service ID is requested from the terminal device 11, the portal service application 61 performs the device registration processing of the service ID based on the tenant ID of the logged-in user, the service ID input on the device registration screen, and the device ID. Request to the license authentication unit 76.

  The license authentication unit 76 determines (collates) whether the tenant information stored in the management information storage unit 91 stores the combination of the tenant ID of the logged-in user and the service ID input on the device registration screen.

  If the combination of the tenant ID of the logged-in user and the service ID input on the device registration screen is stored, the license authentication unit 76 refers to the license information stored in the management information storage unit 91. The license authentication unit 76 determines whether the registration state associated with the service ID input on the device registration screen is “unregistered”.

  If the registration state is “unregistered”, the license authentication unit 76 requests the setting registration unit 74 to register the service ID. A service ID whose registration status is “unregistered” is a service ID for which the device registration of the service ID is not performed. The setting registration unit 74 registers the tenant ID of the logged-in user, the service ID input on the device registration screen, and the device ID in the device information stored in the management information storage unit 91.

  Further, the setting registration unit 74 refers to the tenant information stored in the management information storage unit 91, and acquires the service type and expiration date specified from the tenant ID and the service ID. The setting registration unit 74 registers the service type, the use start date, and the use end date in the device information stored in the management information storage unit 91 based on the acquired service type and expiration date.

  As the use start date, the date of the day of device registration of the service ID is stored. In the use end date, the date of the final date calculated based on the expiration date (for example, one year) acquired from the tenant information and the use start date is stored.

  The use start date may be specified, for example, in the service registration request in step S4. When the use start date can be specified, the use start date specified in the service registration request is stored in the device information use start date. When the device registration of the service ID is completed, the setting registration unit 74 changes the value of the registration state associated with the service ID that has performed the device registration to “registered” in the license information stored in the management information storage unit 91. .

  As described above, through the processing from tenant registration to service registration, a user such as an administrator can perform tenant registration, service ID registration, and device registration of a service ID by accessing the service providing system 2 from the terminal device 11. is there. In this way, the user can easily complete the procedures necessary to receive the provision of the service. In addition, the service providing system 2 can manage the provided service, the user who uses the service, and the device which uses the service for each tenant ID for which the license validation process has been performed.

<< User authentication / equipment authentication function of service providing system 2 >>
FIG. 11 is an exemplary sequence of user authentication / device authentication processing. FIG. 11A illustrates user authentication from the terminal device 11 that does not require device authentication. FIG. 11B illustrates user device authentication from the image forming apparatus 12 that requires device authentication. FIG. 11C shows in-house cooperation authentication from the image forming apparatus 12 that requires device authentication.

  As shown in FIG. 11A, in the user authentication from the terminal device 11, the user inputs the tenant ID, the user ID, and the password as login information from the top screen or the like of the portal site. In step S11, the terminal device 11 accepts login information input by the user.

  In step S12, the terminal device 11 makes a login request to the service providing system 2 using the login information input by the user. The access control unit 72 of the service providing system 2 requests the user authentication unit 77 for user authentication.

  In step S <b> 13, the user authentication unit 77 confirms whether the login information received from the terminal device 11 exists in the user information stored in the management information storage unit 91. The user authentication unit 77 determines that the user authentication is successful if the user information stored in the management information storage unit 91 includes the login information received from the terminal device 11. If the login information received from the terminal device 11 does not exist, the user authentication unit 77 determines that user authentication has failed.

  When the user authentication is successful, the access control unit 72 permits login from the terminal device 11 to the service providing system 2 (login for using the service). In step S <b> 14, the access control unit 72 transmits a login response based on the result of user authentication by the user authentication unit 77 to the terminal device 11.

  In FIG. 11B and FIG. 11C, the image forming apparatus 12 uses a login user ID and password in user authentication for logging in to the service providing system 2, or for in-house authentication. Holds the setting of whether to use the user ID. Note that the setting of whether to use a login user ID and password or an in-house authentication user ID can be changed as appropriate. Further, it is assumed that the image forming apparatus 12 holds the tenant ID and the apparatus ID in its own storage area.

  In the case of setting to use a login user ID and password, in order to log in to the service providing system 2, the image forming apparatus 12 performs user apparatus authentication as shown in FIG.

  In step S21, the image forming apparatus 12 displays an input screen for allowing the user to input a login user ID and password. The user inputs a login user ID and password from the input screen displayed on the image forming apparatus 12. The image forming apparatus 12 receives the login user ID and password input by the user.

  In step S22, the image forming apparatus 12 transmits the login user ID and password input by the user and the tenant ID and apparatus ID held in its own storage area to the service providing system 2 as login information. Make a login request. The access control unit 72 of the service providing system 2 requests the user device authentication unit 78 for user device authentication.

  In step S <b> 23, the user device authentication unit 78 checks whether the combination of the tenant ID and the device ID included in the login information received from the image forming apparatus 12 exists in the device information stored in the management information storage unit 91. If the combination of the tenant ID and the device ID exists, the user device authentication unit 78 determines that the device authentication is successful. If the combination of the tenant ID and the device ID does not exist, the user device authentication unit 78 determines that the device authentication has failed.

  Further, the user device authentication unit 78 determines whether or not the user information stored in the management information storage unit 91 includes a combination of the tenant ID, the login user ID, and the password included in the login information received from the image forming device 12. Check.

  If the user information stored in the management information storage unit 91 includes a combination of a tenant ID, a login user ID, and a password included in the login information received from the image forming apparatus 12, the user device authentication unit 78 performs user authentication. Is determined to be successful. If the combination of the tenant ID, the login user ID, and the password included in the login information received from the image forming apparatus 12 does not exist, the user apparatus authentication unit 78 determines that the user authentication has failed.

  When the device authentication and the user authentication are successful, the access control unit 72 permits login (login for using the service) from the image forming apparatus 12 to the service providing system 2. In step S <b> 24, the access control unit 72 transmits a login response based on the results of device authentication and user authentication by the user device authentication unit 78 to the terminal device 11.

  In the case of setting to use a user ID for in-house authentication, the image forming apparatus 12 performs in-house cooperation authentication shown in FIG. 11C in order to log in to the service providing system 2. First, the user performs user authentication in the image forming apparatus 12. The user authentication executed in the image forming apparatus 12 is user authentication executed to use the image forming apparatus 12 or a specific function of the image forming apparatus 12. Here, an example in which the authentication apparatus 13 performs user authentication using a card ID stored in an IC card or the like carried by the user will be described.

  In step S <b> 31, the user performs user authentication by causing a card reader (not shown) connected to the image forming apparatus 12 to read the card ID. In step S <b> 32, the image forming apparatus 12 sends the card ID read by the card reader to the authentication apparatus 13 to make an authentication request.

  In step S <b> 33, the authentication device 13 makes an authentication determination using the card ID received from the image forming device 12. The authentication device 13 stores user authentication information in which a card ID and a user ID are associated with each other in a storage area. The authentication device 13 refers to the user authentication information in which the card ID and the user ID are associated with each other, and confirms whether the user ID associated with the card ID received from the image forming device 12 can be specified.

  The authentication device 13 determines that the user authentication is successful when the user ID associated with the card ID can be specified. In step S <b> 34, the authentication apparatus 13 transmits the specified user ID to the image forming apparatus 12 together with the authentication result indicating the successful authentication.

  Next, the user can request to log in to the service providing system 2 by selecting login to the service providing system 2 from the display screen of the image forming apparatus 12, for example. In step S <b> 35, the user requests login from the image forming apparatus 12 to the service providing system 2.

  When the user is requested to log in to the service providing system 2, the image forming apparatus 12 uses the identified user ID and the tenant ID and device ID stored in its own storage area as login information to the service providing system 2. Send and make a login request. The access control unit 72 of the service providing system 2 requests the in-house cooperation authentication unit 79 for in-house cooperation authentication.

  In step S <b> 36, the in-house cooperation authentication unit 79 confirms whether the combination of the tenant ID and the device ID included in the login information received from the image forming apparatus 12 exists in the device information stored in the management information storage unit 91.

  If the combination of the tenant ID and the device ID exists, the in-house cooperation authentication unit 79 determines that the device authentication is successful. If the combination of tenant ID and device ID does not exist, the in-house cooperation authentication unit 79 determines that device authentication has failed.

  Further, the in-house cooperation authentication unit 79 confirms whether the combination of the tenant ID and the user ID for in-house authentication included in the login information received from the image forming apparatus 12 exists in the user information stored in the management information storage unit 91. To do. If the combination of the tenant ID and the user ID for in-house authentication included in the login information received from the image forming apparatus 12 exists in the user information stored in the management information storage unit 91, the in-house cooperation authentication unit 79 performs user authentication. Judge that succeeded.

  If the combination of the tenant ID and the user ID for in-house authentication included in the login information received from the image forming apparatus 12 does not exist, the in-house cooperation authentication unit 79 determines that user authentication has failed.

  The access control unit 72 permits login (login for using the service) from the image forming apparatus 12 to the service providing system 2 when the device authentication and the user authentication are successful. In step S <b> 37, the access control unit 72 transmits a login response based on the results of device authentication and user authentication by the in-house cooperation authentication unit 79 to the terminal device 11.

  Note that if the apparatus authentication is successful by the in-house cooperation authentication unit 79 and the user authentication is not successful, the service providing system 2 displays an input screen for allowing the user to input a login user ID and password on the image forming apparatus 12. It may be displayed.

  In this case, the user can input a login user ID and password on the input screen and request login again. The image forming apparatus 12 transmits the login user ID and password input by the user and the tenant ID held in the storage area of the image forming apparatus 12 to the user apparatus authentication unit 78 of the service providing system 2 and makes a login request. .

  The user device authentication unit 78 checks whether the combination of the tenant ID, the login user ID, and the password received from the image forming device 12 exists in the user information stored in the management information storage unit 91.

  The user device authentication unit 78 determines that the user authentication is successful if the user information stored in the management information storage unit 91 includes the combination of the tenant ID, the login user ID, and the password received from the image forming device 12. To do. The access control unit 72 permits login to the service providing system 2.

  Further, the setting registration unit 74 is configured so that the management information storage unit 91 stores the in-house authentication user ID received from the image forming apparatus 12 in association with the tenant ID, login user ID, and password received from the image forming apparatus 12. Register in the stored user information. In this way, by registering the user ID for in-house authentication received from the image forming apparatus 12 in the user information in association with the tenant ID, login user ID and password, the user can use the user for in-house authentication from the next time. Login using ID is possible.

<< Data processing function of service providing system 2 >>
In the service providing system 2, the data processing control unit 81, the processing queue 82, the data processing requesting unit 83, and the data processing unit 84 of the platform 52 perform various data processing requested by the processing requesting unit 101 of the service application 51 as follows. Run like so.

  FIG. 12 is a diagram for explaining an example of the data processing function of the service providing system. The process request unit 101 of the service application 51 records data to be processed in the data storage unit 93 of the management data storage unit 53. Data to be processed is data to be processed such as application data and image data.

  Further, the processing request unit 101 transmits a data processing request (hereinafter referred to as a request) to the data processing control unit 81 of the platform 52. The request to be transmitted includes the processing contents of the data processing and information on the recording destination of the processing target data (for example, URI).

  The data processing control unit 81 analyzes the received request and registers a message in a processing queue (message queue) 82 corresponding to the processing content of the data processing. The processing queue 82 is provided for each processing content of data processing.

  Further, the data processing control unit 81 registers request information in the data processing information storage unit 92 of the management data storage unit 53. The request information is, for example, the recording destination of the processing target data, the processing contents of the data processing, the request status, and the like.

  The request status includes, for example, “reception”, “running”, and “completed”. The request status represents a status indicating the processing status of data processing. The status of the request becomes “accepted” when the data processing control unit 81 registers the request information.

  Each data processing request unit 83 monitors one or more processing queues 82 assigned to each data processing request unit 83. That is, each data processing request unit 83 monitors requests for processing contents of one or more data processing. Each data processing request unit 83 acquires a message registered in the monitored processing queue 82.

  For example, in FIG. 12, a “first data processing request unit” 83 monitors a “first processing queue” 82 and a “second processing queue” 82 having different data processing contents. The “second data processing request unit” 83 monitors “first processing queue” 82 to “third processing queue” 82 having different data processing contents. FIG. 12 illustrates an example in which the “first data processing request unit” 83 and the “second data processing request unit” 83 monitor the “first processing queue” 82 and the “second processing queue” 82 in an overlapping manner. Yes.

  Note that the assignment of the processing queue 82 monitored by each data processing requesting unit 83 can be set and changed as appropriate. For example, it is conceivable that the assignment of the processing queue 82 monitored by each data processing requesting unit 83 is appropriately set and changed according to the request frequency and processing time for each processing content of the data processing.

  The data processing request unit 83 acquires request information from the data processing information storage unit 92 based on the message acquired from the monitored processing queue 82. The data processing request unit 83 causes the data processing unit 84 to execute the data processing of the request based on the recording destination of the processing target data included in the acquired request information and the processing content of the data processing.

  Next, the data processing request unit 83 updates the request information from the execution result of the data processing executed by the data processing unit 84, and registers the updated request information in the data processing information storage unit 92. The update of the request information includes a process of deleting the processing contents of the data processing executed from the request, a process of changing the request state if there is a change, and the like. In addition, if the request information includes the processing content of the next data processing, the data processing request unit 83 registers the message in the processing queue 82 corresponding to the processing content of the data processing.

  The data processing request unit 83 records the processing target data after processing in the data storage unit 93 when the processing target data before and after the data processing is different by causing the data processing unit 84 to execute the data processing of the request. To do. In addition, the data processing request unit 83 updates the request information according to the information on the recording destination of the processed data after processing.

  FIG. 13 is a flowchart illustrating an example of a processing procedure of a data processing function included in the service providing system. In step S <b> 41, the processing request unit 101 of the service application 51 records the processing target data in the data storage unit 93 of the management data storage unit 53. Further, the processing request unit 101 transmits a request (data processing request) to the data processing control unit 81 of the platform 52.

  In step S42, the data processing control unit 81 analyzes the request and registers a message in the processing queue 82 according to the processing content of the data processing. Further, the data processing control unit 81 registers request information in the data processing information storage unit 92 of the management data storage unit 53.

  In step S <b> 43, each data processing request unit 83 acquires a message registered in the monitored processing queue 82 from the processing queue 82. In step S44, the data processing request unit 83 acquires request information from the data processing information storage unit 92 based on the acquired message. Then, the data processing request unit 83 causes the data processing unit 84 to perform data processing of the request based on the acquired request information.

  In step S45, the data processing request unit 83 updates the request information from the execution result of the data processing executed by the data processing unit 84, registers the updated request information in the data processing information storage unit 92, and then executes FIG. The process of the flowchart in FIG.

  If the request information includes the processing content of the next data processing, the data processing requesting unit 83 registers the message in the processing queue 82 corresponding to the processing content of the data processing and then performs the processing in the flowchart of FIG. Exit.

  Hereinafter, some specific examples of the processing contents of the data processing will be described, but the processing contents of the data processing are not limited to specific examples. As a specific example of the processing contents of data processing, firstly, there is data processing for converting the data format of processing target data.

  For example, data processing for converting image data into PDF (Portable Document Format) data is an example of data processing for converting the data format of processing target data. In the data processing for converting image data into PDF data, the processing content of the data processing is expressed as “image2pdf” or the like.

  Data processing for converting PDF data into PDL (Page Description Language) data is also an example of data processing for converting the data format of processing target data. In data processing for converting PDF data to PDL data, the processing content of the data processing is expressed as “pdf2pdl” or the like.

  Further, data processing for converting Microsoft (registered trademark) Office (registered trademark) document data into PDL data is an example of data processing for converting the data format of processing target data. In the data processing for converting Office document data into PDL data, the processing content of the data processing is expressed as “office2pdl” or the like.

  As a specific example of the processing content of the data processing, secondly, the processing content of one data processing is divided into a plurality of processing details of the data processing, and the request of each data processing unit 84 according to the processing content of the divided data processing There is data processing to convert to.

  For example, data processing for converting image data into PDL data can be realized by dividing into data processing for converting image data into PDF data and data processing for converting PDF data into PDL data. In the data processing for converting the image data into PDL data, the processing content of the data processing is expressed as “image2pdl” or the like.

  For example, the data processing unit 84 executes data processing that divides a data processing request of “image2pdl” into data processing requests of “image2pdf” and “pdf2pdl”. As described above, the data processing unit 84 includes a unit that performs data processing for dividing one data processing request into a plurality of data processing requests.

  As described above, for example, when there is no data processing unit 84 capable of executing the “image2pdl” data processing, the desired “image2pdl” data processing is executed by linking the “image2pdf” and “pdf2pdl” data processing. Is possible.

  FIG. 14 is a diagram for explaining data processing that divides the processing content of one data processing into processing details of a plurality of data processing. FIG. 14 illustrates a case where there is no data processing unit 84 that can execute the data processing of “image2pdl”.

  In such a case, FIG. 14 shows that data processing of “image2pdl” and “pdf2pdl” can be performed, and data processing of desired “image2pdl” can be executed.

  Since the service providing system 2 according to the present embodiment can perform data processing in which processing content of one data processing is divided into processing content of a plurality of data processing, it can flexibly cope with an increase in types of processing content of data processing. Is possible.

  Further, as a specific example of the processing contents of the data processing, thirdly, there is data processing for linking with the external storage. For example, the data processing for requesting the external cooperation authentication unit 80 to log in to the online storage 32 using the online storage account and password corresponding to the logged-in user is an example of data processing for cooperation with the external storage. is there.

  Data processing for storing data in the logged-in online storage 32 and data processing for acquiring data from the logged-in online storage 32 are also examples of data processing for linking with external storage.

<< Cooperation with online storage 32 >>
FIG. 15 is a flowchart of an example of authorization setting for online storage. A user such as an administrator operates the input device 41 of the terminal device 11 and inputs a tenant ID, user ID, and password from the top screen of the portal site, and then requests login. The portal service application 61 that has received the login request displays the external service registration screen on the display device 42 of the terminal device 11 after permitting the login.

  In step S51, the user selects an online storage (external service) 32 to be used from the list of external services stored in the external service information of the management information storage unit 91 on the external service registration screen, and requests registration. To do.

  The portal service application 61 that has received the registration request requests the setting registration unit 74 to register the online storage 32 selected by the user. The setting registration unit 74 registers the online storage 32 selected by the user in the tenant information in the management information storage unit 91 in association with the tenant ID of the logged-in user.

  In step S52, the user selects the user ID of the user to whom the authorization setting is to be applied, the external service ID (or service name of the external service) for which the authorization setting is to be performed, the scope to be set for the user, etc. on the portal site authorization setting screen Request registration of authorization settings. The portal service application 61 receives an authorization setting request.

  In step S53, the portal service application 61 that has received the authorization setting request requests the authorization setting processing unit 75 for the authorization setting. The authorization setting processing unit 75 acquires parameters necessary for authorization setting from the external service information in the management information storage unit 91. In addition to the external service ID and scope, the parameters necessary for the authorization setting include a client ID associated with the selected external service ID, a redirect destination URL, and an arbitrary session key for maintaining the session. It is.

  In step S54, the authorization setting processing unit 75 that has acquired the parameters necessary for the authorization setting acquires the authorization destination URL associated with the selected external service ID from the external service information in the management information storage unit 91. The authorization setting processing unit 75 redirects a request including a parameter necessary for authorization setting (a request having a parameter necessary for authorization setting as a GET request query) from the terminal device 11 to the authorization destination URL.

  By redirecting the request from the terminal device 11 to the authorization destination URL, authorization setting is performed between the terminal device 11 and the online storage 32. After the authorization setting, the session at the HTTP level is interrupted because the online storage 32 is redirected to the authorization setting processing unit 75. Therefore, the session key is used to maintain the same session.

  The redirected online storage 32 displays a login screen on the display device 42 of the terminal device 11. The user operates the input device 41 of the terminal device 11 to input an account and password from the login screen, and then requests login. The online storage 32 that has received the login request receives the login request.

  If the login is successful, the online storage 32 displays an authorization screen on the display device 42 of the terminal device 11. The user confirms the authorization screen. When performing authorization, the user operates the input device 41 of the terminal device 11 and requests authorization by pressing an authorization button displayed on the authorization screen, for example. The online storage 32 that has received the authorization request performs authorization registration.

  In step S55, the online storage 32 redirects the authorization code indicating that authorization has been granted and the session key from the terminal device 11 to the redirect destination URL.

  In step S56, the authorization setting processing unit 75 of the service providing system 2 receives the authorization code. If the user has already logged in when redirecting to the online storage 32, the display of the login screen is omitted.

  In step S <b> 56, the authorization setting processing unit 75 that has received the authorization code acquires parameters necessary for acquiring the authorization token from the external service information in the management information storage unit 91. In addition to the received authorization code, parameters necessary for obtaining the authorization token include a client ID and a client secret associated with the external service ID of the online storage 32 that has transmitted the authorization code.

  In step S57, the authorization setting processing unit 75 sends the acquired client ID and client secret and the received authorization code to the online storage 32 and requests acquisition of the authorization token. The online storage 32 verifies the received authorization code and sends an authorization token to the authorization setting processing unit 75 of the service providing system 2.

  In step S58, the authorization setting processing unit 75 that has received the authorization token requests the setting registration unit 74 to register the authorization token. The setting registration unit 74 registers, in association with the user information in the management information storage unit 91, the user who wants to apply the authorization setting selected on the authorization setting screen, the received authorization token, and the scope.

  When the registration of the authorization token is completed, the authorization setting processing unit 75 notifies the portal service application 61 of the completion of registration. The portal service application 61 displays a screen indicating the setting result of the authorization setting on the display device 42 of the terminal device 11.

  When the online storage 32 sends the authorization token to the service providing system 2, it sends the expiration date of the authorization token and a refresh token for reissuing the authorization token when the expiration date has expired. May be.

  FIG. 16 is a flowchart of an example of the linkage process with the online storage. In step S <b> 61, the user who has logged in to the service providing system 2 requests processing to cooperate with the online storage 32 from the terminal device 11, the image forming device 12, or the like.

  When a process to cooperate with the online storage 32 is requested, the external cooperation authentication unit 80 of the service providing system 2 performs a login process to the online storage 32 in step S62.

  For example, the external cooperation authentication unit 80 receives a login request to the online storage 32 from the data processing unit 84. The external cooperation authentication unit 80 acquires, from the user information in the management information storage unit 91, information required for the login process associated with the user who has logged into the service providing system 2 and the online storage 32 that performs the login process.

  Specifically, the external cooperation authentication unit 80 acquires information required for the login process of the online storage 32 associated with the tenant ID of the user who has logged in the service providing system 2, the login user ID, and the password.

  For example, in the case of the user information in FIG. 6, when receiving a login request to “online storage A”, the external cooperation authentication unit 80 acquires an account and a password as information necessary for the login processing to “online storage A”. .

  In the case of the user information in FIG. 6, when receiving a login request to “online storage B”, the external cooperation authentication unit 80 uses an account and an authorization token as information required for login processing to “online storage B”. get.

  If the online storage 32 to be linked is not set as an authorization like “online storage A” and is an external service that performs login processing, the external linkage authentication unit 80 uses the account and password to set “online storage A”. Request login. The account and password are an example of authentication information for an external service.

  The “online storage A” requested to log in executes authentication for the received account and password. If the authentication is successful, “online storage A” transmits a response to permit login to the external cooperation authentication unit 80. If the authentication fails, “online storage A” transmits a response not permitting login to the external cooperation authentication unit 80.

  The external cooperation authentication unit 80 receives a response indicating that login is permitted from “online storage A”. As a result, the service providing system 2 can upload (save) data to “online storage A” and download (acquire) data from “online storage A”.

  As described above, when the external cooperation authentication unit 80 receives the response indicating that the login is permitted from the online storage 32, the service providing system 2 can execute the processing in cooperation with the online storage 32 in step S63. It is.

  If the online storage 32 to be linked is an external service that is authorized such as “online storage B”, the external linkage authentication unit 80 requests login to “online storage B” using the account and the authorization token. To do.

  The account and the authorization token are an example of authorization information for the external service. The “online storage B” requested to log in confirms the validity of the received account and authorization token. If the validity can be confirmed, “online storage B” transmits a response to the effect that login is permitted to the external cooperation authentication unit 80. If the authentication fails, “online storage B” transmits a response not permitting login to the external cooperation authentication unit 80.

  The external cooperation authentication unit 80 receives a response indicating that login is permitted from “online storage B”. As a result, the service providing system 2 can realize processing linked to the online storage 32 within the usage range set by the scope in step S63.

<Data output control: processing block>
Next, an example of job data output control in the information processing system 1 according to the present embodiment will be described. In the following description, for example, data output control when duplicate detection is set for a job (output request) output by the image forming apparatus 12 in the office of the information processing system 1 will be described.

  FIG. 17 is a processing block diagram of an example of the image forming apparatus and the print service application. FIG. 17A is a processing block diagram of an example of the image forming apparatus 12 described above. As illustrated in FIG. 17A, the image forming apparatus 12 implements an input receiving unit 121, an output unit 122, a print service using application 123, and a setting information holding unit 124 by executing a program.

  The input receiving unit 121 receives various input operations such as a login instruction from the user. The output unit 122 outputs (for example, prints) the received data.

  The print service use application 123 includes a login request unit 125 and a service use request unit 126, and provides a function for executing a job. The login request unit 125 provides a function for logging in to the service providing system 2 from the image forming apparatus 12. The login request unit 125 receives a job list of the logged-in user from the service providing system 2.

  For example, when the service use request unit 126 receives a selection of a job desired to be printed out from the job list displayed on the operation panel of the image forming apparatus 12 via the input reception unit 121, the service use request unit 126 corresponds to the received job. The service providing system 2 is requested to acquire data. The setting information holding unit 124 holds various setting information.

  FIG. 17B is a processing block diagram of an example of the print service application 62 described above. As illustrated in FIG. 17B, the print service application 62 includes a job output control unit 131, a duplication detection unit 132, and a duplication setting storage unit 133.

  When the job output control unit 131 receives an acquisition request for data corresponding to a job, the job output control unit 131 determines whether duplicate detection is set for the job. When the job output control unit 131 determines that duplication detection is set for the job, for example, the duplication detection target range and duplication detection conditions stored in the duplication setting storage unit 133 are set as conditions set in advance by the user. The duplication detection unit 132 is requested to detect job duplication.

  The job output control unit 131 controls job output in accordance with the job duplication detection result acquired from the duplication detection unit 132. When job duplication is detected, for example, the job output control unit 131 notifies the user of job output cancellation or deletes the job.

  The duplication detection unit 132 performs duplication detection between a job for which duplication detection is requested and a job that has already been received based on the duplication detection target range and duplication detection conditions acquired from the job output control unit 131. For example, the duplication detection unit 132 performs job duplication detection with reference to information on processing target data stored in the data processing information storage unit 92 and history information already output. Note that the duplication detection unit 132 can also detect duplication of jobs based only on duplication detection conditions without setting a target range for duplication detection, for example.

  The duplication setting storage unit 133 stores, for example, a duplication detection target range and duplication detection conditions set for each user. The overlap detection target range is set, for example, based on the job reception time or output time, to which time the job traced back is compared (for example, within the past one hour from the present time). Further, the overlap detection target range may include not only a job of a specific user but also a job of a group or the like to which the user belongs.

  The duplicate detection condition is set, for example, job information such as a user name, a file name, and a file size as information used for job comparison.

  FIG. 17C is a processing block diagram of another example of the print service application 62 described above. Note that the same components as those in FIG. 17B are denoted by the same reference numerals, and description thereof is omitted here.

  As illustrated in FIG. 17C, the print print service application 62 ′ includes a job output control unit 131, a duplication detection unit 132, a duplication setting storage unit 133, and a comparison target range determination unit 134. That is, the example of FIG. 17C has a comparison target range determination unit 134 in addition to the configuration of FIG.

  The comparison target range determination unit 134 receives a request from the job output control unit 131 and determines a comparison target range of jobs whose duplication is detected by the duplication detection unit 132. The comparison target range determination unit 134 acquires the processing target data and the history information that has already been output from the data processing information storage unit 92, and based on the overlap detection target range of the duplication setting storage unit 133 referred to by the job output control unit 131. Determine the comparison range of jobs. When the comparison target range determination unit 134 determines the job comparison target range, the comparison target range determination unit 134 notifies the job output control unit 131 of the determination.

<Data output control processing>
Next, data output control when the duplication detection of the job executed by the processing block of the image forming apparatus 12 shown in FIG. 17A and the print service application 62 shown in FIG. 17B is set. The processing will be specifically described. FIG. 18 is a sequence example of job output control processing.

  In the example of FIG. 18, first, it is assumed that a job uploaded by the user from the terminal device 11 to the service providing system 2 is spooled in the data storage unit 93 by the print service application 62.

  Since the image forming apparatus 12 prints out the data uploaded to the service providing system 2 using the print service application 62, for example, according to the user's operation on the login screen displayed on the operation panel, the print service application 62 is accessed.

  The print service application 62 displays a user job list screen on the operation panel of the image forming apparatus 12. When a job is selected from the job list screen, the print service application 62 displays a duplicate detection detection setting screen for setting duplicate detection of the selected job on the operation panel of the image forming apparatus 12.

  In the duplicate detection setting screen, the above-described duplicate detection target range and duplicate detection conditions can be set for each job, and set for each user in advance and stored in the duplicate setting storage unit 133 or the like. Also good. Further, on the job list screen displayed on the operation panel of the image forming apparatus 12, the job and the duplicate detection setting may be selected together.

  As shown in FIG. 18, the service use request unit 126 of the image forming apparatus 12 accepts that a job has been selected by the user on the job list screen in step S71. In step S72, when the service use request unit 126 accepts that duplication detection is set for the job selected on the duplication detection setting screen, in step S73, the service usage request unit 126 acquires job data from the print service application 62. Make a request.

  In step S74, the job output control unit 131 of the print service application 62 determines whether or not duplication detection is set for the job received from the image forming apparatus 12. If the job output control unit 131 determines that duplication detection is set for the job, the job output control unit 131 refers to the duplication detection target range and duplication detection conditions stored in the duplication setting storage unit 133 in step S75.

  In step S76, the job output control unit 131 requests the duplication detection unit 132 to detect job duplication. In step S77, the duplication detection unit 132 obtains the processing target data information in the data processing information storage unit 92 and the history information that has already been output based on the duplication detection target range and duplication detection conditions acquired from the job output control unit 131. Refer to and detect duplicates.

  In step S75, the job output control unit 131 refers to the duplication detection target range of the duplication setting storage unit 133, and then acquires the processing target data and the already output history information from the data processing information storage unit 92. The comparison target range may be determined. Here, the job output control unit 131 excludes the processing target data and the already output history information other than the job determined as the comparison target range from the comparison target.

  As a result, the duplication detection unit 132 acquires the job determined as the comparison target range from the job output control unit 131 in step S76, and executes duplication detection between the job determined as the comparison target range in step S77. It becomes possible.

  Upon receiving the duplicate detection notification from the duplicate detection unit 132 in step S78, the job output control unit 131 controls job output based on the result of the duplicate detection notification in step S79.

  Here, a case where duplication is detected as a result of the duplication detection notification and a case where duplication is not detected will be described separately. If duplication is detected, the job output control unit 131 executes processing for notifying the user who operates the image forming apparatus 12 of job output cancellation in step S80, and the output is canceled in step S81. Delete the job.

  On the other hand, if no duplication is detected, the job output control unit 131 outputs the print data of the job to the image forming apparatus 12 in step S82. In step S83, the image forming apparatus 12 prints out the print data.

  Even when an acquisition request for the same job is executed by the data output control process described above, it is possible to prevent useless job output by detecting duplication of jobs.

<Another example of data output control processing>
Next, data output control processing when job duplication detection executed by the terminal device 11 described above and the processing block of the print service application 62 ′ shown in FIG. 17C is set will be specifically described. . FIG. 19 is a sequence of another example of job output control processing.

  In the example of FIG. 19, the terminal device 11 accesses the portal site of the service providing system 2 by a user operation in order to upload data of a job to be printed using the print service application 62 ′ of the service providing system 2.

  Here, the access control unit 72 of the service providing system 2 causes the terminal device 11 to access the portal service application 61. The portal service application 61 displays, for example, a login screen on the operation panel of the terminal device 11.

  When the terminal device 11 logs in to the portal service application 61 in response to a user operation on the login screen, the terminal device 11 accesses the print service application 62 via the print service using application 123. The print service application 62 displays an upload screen on the operation panel of the terminal device 11.

  In step S91, the terminal device 11 accepts job data from the upload screen. In step S92, the terminal device 11 accepts that duplication detection is set for the job uploaded by the user on the upload screen.

  In step S93, when the terminal device 11 requests the job output control unit 131 of the print service application 62 to input a job, the job output control unit 131 sets duplicate detection for the job input from the terminal device 11. to decide.

  If the job output control unit 131 determines that duplication detection is set for the job, the job output control unit 131 refers to the duplication detection target range and duplication detection conditions stored in the duplication setting storage unit 133 in step S95.

  In step S96, the job output control unit 131 requests the comparison target range determination unit 134 to determine the job comparison target range based on the overlap detection target range referenced in step S95.

  In step S97, the comparison target range determination unit 134 acquires the processing target data and the already output history information from the data processing information storage unit 92, and determines the comparison target range of the job. Here, the comparison target range determination unit 134 excludes the processing target data and the history information already output from the comparison target range other than the job determined as the comparison target range.

  In step S98, the comparison target range determination unit 134 notifies the job output control unit 131 of the job comparison target range (for example, ID001 to ID200).

  In step S99, the job output control unit 131 requests the duplication detection unit 132 to detect job duplication. In step S100, the duplication detection unit 132 performs duplication detection based on the job comparison target range and duplication detection conditions acquired from the job output control unit 131.

  Upon receiving the duplicate detection notification from the duplicate detection unit 132 in step S101, the job output control unit 131 controls job output based on the result of the duplicate detection notification in step S102. For example, the job output control unit 131 controls the data storage unit 93 not to spool the job when duplication is detected, and spools the job into the data storage unit 93 when no duplication is detected. Control to do.

  Even when the same job is input by the above-described data output control process, it is possible to prevent spooling due to input of a useless job by detecting duplication of jobs. Note that, even when duplication is detected, spooling may be performed, and the job may be deleted in the output control process shown in FIG.

  In this way, duplication of jobs is detected at the timing when a job acquisition request for the service providing system 2 is received from the image forming apparatus 12 or when the job input to the service providing system 2 from the terminal apparatus 11 is received. This makes it possible to detect duplicate and useless jobs.

  According to the above-described embodiment, it is possible to detect duplication of output requests while managing services and service providing destinations.

  The present invention is not limited to the specifically disclosed embodiments, and various modifications and changes can be made without departing from the scope of the claims. Note that the service use device described in the claims corresponds to the terminal device 11, the image forming device 12, and the like. The authentication means corresponds to the user authentication unit 77, the user device authentication unit 78, and the like. The service specifying unit corresponds to the portal service application 61 and the like. The execution unit corresponds to the print service application 62, the data processing control unit 81, the processing queue 82, the data processing request unit 83, the data processing unit 84, and the like.

DESCRIPTION OF SYMBOLS 1 Information processing system 2 Service provision system 11 Terminal apparatus 12 Image forming apparatus 13 Authentication apparatus 14 Other apparatus 21 Access control apparatus 22 Print service provision apparatus 23 Distribution service provision apparatus 24 Portal service provision apparatus 26 Authentication apparatus 27 Data processing control apparatus 28 Data processing execution control device 29 Data processing device 31 Mail server 32 Online storage 40 Computer system 41 Input device 42 Display device 43 RAM
44 ROM
45 HDD
46 CPU
47 Communication I / F
48 External I / F
48A Recording medium 51 Service application 52 Platform 53 Management data storage 54 Platform API
61 Portal service application 62 Print service application 63 Distribution service application 71 Communication unit 72 Access control unit 73 Mail transmission unit 74 Setting registration unit 75 Authorization setting processing unit 76 License authentication unit 77 User authentication unit 78 User device authentication unit 79 Internal cooperation authentication unit 80 External Cooperation Authentication Unit 81 Data Processing Control Unit 82 Processing Queue 83 Data Processing Request Unit 84 Data Processing Unit 91 Management Information Storage Unit 92 Data Processing Information Storage Unit 93 Data Storage Unit 101 Processing Request Unit 121 Input Accepting Unit 122 Output Unit 123 Print Service use application 124 Setting information holding unit 125 Login request unit 126 Service use request unit 131 Job output control unit 132 Duplication detection unit 133 Duplication setting storage unit 134 Comparison target range determination unit B Bus FW Firewall N1 to N3 network

JP 2009-129265 A

Claims (11)

A service providing system configured to provide a service to a service using device configured by one or more information processing devices and connected via a network,
Management information storage means for storing service identification information of the service, user identification information of a user who uses the service, and management information associated with device identification information of the service using device;
User authentication information used for user authentication acquired from the service using device, or authentication means for executing authentication processing using device authentication information used for device authentication as authentication information;
Service identifying means for identifying the service associated with the authentication information based on the authentication information and the management information authenticated by the authentication means;
An execution unit that executes a process according to the use request of the service when the use request of the service specified by the service specifying unit is acquired from the service use device;
The execution means includes
A service providing system for detecting an overlap between an output request from the service utilization apparatus instructed by the user and an already received output request. The execution means includes
Duplication with the already received output request at the timing of receiving the data acquisition request corresponding to the output request from the service using device, or at the timing of receiving the data of the output request from the other service using device The service providing system according to claim 1, wherein the service providing system is detected. The execution means includes
The service providing system according to claim 1, wherein duplication with the already received output request is detected based on a preset duplication detection target range or duplication detection condition. The execution means includes
The output request from the service using apparatus is deleted or the output request from the service using apparatus is deleted when the output request received from the user is detected. Service provision system. Among the service identification information, for identifying a first service and registering the first service identification information that is a license of the first service and a service that provides the first service identification information License information storage means for storing license information associated with the information;
A license that accepts a registration request including the first service identification information and the registration information, and executes a license authentication process based on the accepted first service identification information and the registration information and the license information Authentication means;
The apparatus further comprises setting registration means for registering in the management information as a service for providing the received first service identification information when validity is confirmed by the license authentication means. The service providing system according to any one of 1 to 4. The management information storage means
First user identification information and second user identification information are stored as user identification information of a user who logs in to the service providing system,
The authentication means includes
User authentication processing based on the first user authentication information and the first user identification information is executed when first user authentication information is acquired as user authentication information used for user authentication from the service using device. The user authentication processing based on the second user authentication information and the second user identification information is executed when the second user authentication information is acquired. The service providing system according to Item. The management information storage means
Storing third user authentication information as user authentication information of a user who logs in to an external service connected to the service providing system via a network;
The execution means includes
When the process according to the service use request includes a process linked to the external service, the log-in process to the external service based on the third user authentication information of the user authenticated by the authentication unit The service providing system according to any one of claims 1 to 6, wherein the service providing system is executed. Execution request information storage means for storing execution request information of processing according to the service use request for each processing content;
Data processing control means for registering execution request information for executing specific data processing in the execution request information storage means for each processing content in response to a request to use the service;
A plurality of data processing means for executing data processing according to the processing content in accordance with the execution request information stored in the execution request information storage means;
The data processing means registers execution request information of the next data processing in the execution request information storage means for each processing content when there is next data processing after execution of the data processing. The service providing system according to any one of 1 to 7. The plurality of data processing means include at least
Data for registering the generated execution request information in the execution request information storage means as execution request information for the next data processing after executing data processing for generating a plurality of the execution request information according to the execution request information 9. The service providing system according to claim 8, further comprising processing means. A service providing method in a service providing system that provides a service to a service using device configured by one or more information processing devices and connected via a network,
Management information storage procedure for storing service identification information of the service, user identification information of a user who uses the service, and management information associated with device identification information of the service using device;
An authentication procedure for executing an authentication process using user authentication information used for user authentication acquired from the service use device or device authentication information used for device authentication as authentication information;
A service specifying procedure for specifying the service associated with the authentication information based on the authentication information and the management information authenticated by the authentication procedure;
An execution procedure for executing processing according to the use request for the service when the use request for the service specified by the service specifying procedure is acquired from the service using device;
The execution procedure is as follows:
A service providing method for detecting an overlap between an output request from the service utilization apparatus instructed by the user and an already received output request. Computer
The program for functioning as each means which the service provision system as described in any one of Claims 1 thru | or 9 has.

Images