JP2015166944A - Method of cooperation between image forming apparatus and mobile information terminal - Google Patents

Abstract

PROBLEM TO BE SOLVED: To give the same right as a user who is logged in to an MFP, to a mobile information terminal, without requiring a complicated operation on the mobile terminal device.SOLUTION: An authentication system includes authentication means for logging in to an MFP, and means for acquiring a right of a user who is authenticated by the authentication means. Authentication information is transmitted to a mobile information terminal by means of a two-dimensional bar-code. The mobile information terminal transmits the received authentication information to the MFP over a network. The MFP allocates the acquired right of the user to the mobile information terminal when the authentication information acquired by the authentication means coincides with the authentication information transmitted from the mobile information terminal.

Description

  The present invention relates to an authentication process when an image forming apparatus and a portable information terminal are linked.

  A portable information terminal such as an iPhone or Android terminal can be linked to an image forming apparatus, and a document scanner, PDF generation function, or printer of the image forming apparatus can be used to scan and print the document from the portable information terminal. Yes.

  These applications use a device search protocol such as Apple's Rendezvous or Microsoft's UPnP to search for and connect to an image forming apparatus on the network.

  Further, the digital multi-function peripheral can be controlled by using WebService API provided by the image forming apparatus.

  In an environment where only an authenticated user can perform scanning or printing on the image forming apparatus, it is necessary to authenticate the connected portable information terminal. There is a method such as Patent Document 1 in which session information generated by one device is shared with the other device and transmitted to the authentication server from both sides, and when the session information sent from both devices is equal, the authentication is considered successful.

Japanese Patent No. 4334515

  However, since a portable information terminal that is a general-purpose device does not always have an IC card reader, the user must enter a user ID and password using the UI of the portable information terminal. It will be a burden for you.

  In addition, connecting a portable information terminal directly to a LAN may cause a security problem, and the use of Rendezvous and UPnP is limited because the connection is made via the Internet instead of the LAN.

  On the other hand, in Patent Document 1, since a device that generates a session is not assumed to be a device shared by a user such as an MFP, it cannot be used in an image forming apparatus having an authentication unit such as an IC card reader.

The configuration of the present invention is as follows:
Authentication means (403), authority grant means (403) for granting authority to a user authenticated by the authentication means, authentication information acquisition means (405) for obtaining authentication information authenticated by the authentication means, and firstly connected to the terminal Connection information acquisition means (407) for acquiring connection information for connection, and connection / authentication information transmission means (406) for transmitting the authentication information and first connection information for connection to the terminal
A first terminal comprising: connection / authentication information receiving means (414) for receiving authentication information and connection information; and authentication information transmitting means (411) for transmitting authentication information to the first terminal using the connection information.
An authentication information receiving means (404) for receiving authentication information from the second terminal, the first terminal comprising: a second terminal comprising:
Means for comparing authentication information received by said authentication information receiving means with authentication information acquired by said authentication information acquiring means (405);
An authentication system comprising: permission means (405) for permitting the second terminal to grant the authority granted by the authority granting means at the first terminal if the comparison by the comparing means is successful.

  According to the present invention, the user can connect to and use the image forming apparatus from the portable information terminal with the user authority by the authentication by the MFP by using the MFP authentication device by performing a simple operation. Furthermore, it is possible to prevent other users from using the MFP with their authority.

The figure which shows the apparatus which comprises this invention The figure which shows the hardware constitutions of an image processing apparatus The figure which shows the hardware constitutions of a portable information processing apparatus Block diagram showing the software configuration of the first embodiment Process flowchart of the first embodiment A diagram showing an address, login information, and a two-dimensional barcode displayed on the image processing apparatus Flow chart of processing of the second embodiment The figure which shows UI of the connection management part of the portable information terminal of a 1st Example. The figure which shows UI of the connection management part of the portable information terminal of a 2nd Example. The figure which shows UI of the apparatus operation part of the portable information terminal of a 1st and 2nd Example. Block diagram showing the software configuration of the second embodiment The figure which shows the portable information terminal identifier information displayed on the image processing apparatus of a 2nd Example.

  The best mode for carrying out the present invention will be described below with reference to the drawings.

  The following embodiments do not limit the invention according to the scope of claims, and all combinations of features described in the embodiments are not necessarily essential to the solution means of the invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  First, the first embodiment will be described.

  FIG. 1 is a diagram showing devices constituting a first embodiment of the present invention. The present invention includes an image forming apparatus 102, a portable information terminal 103, and a network 101 connecting them.

  FIG. 2 is a block diagram illustrating a hardware configuration of the image forming apparatus 101 in FIG. The CPU 201 executes a software program for the image forming apparatus and controls the entire apparatus. A ROM 202 is a read-only memory, and stores a boot program and fixed parameters of the apparatus. A RAM 203 is a random access memory, and is used for temporary data storage when the CPU 201 controls the apparatus. The external storage device 204 is used to store various data such as an installed application, application data, and print data. The USBH I / F control unit 205 is for controlling the USB host interface, and controls communication with various USB devices. The scanner I / F control unit 206 is a device that controls the scanner 211. The printer I / F control unit 207 is a device that controls the printer 212. The NVRAM 208 is a non-volatile memory and stores various setting values of the image forming apparatus. A panel control unit 209 controls the operation panel 213 to display various information and input instructions from the user. The network I / F control unit 210 controls data transmission / reception with the network 101. The bus 214 includes a CPU 201, ROM 202, RAM 203, external storage device 204, USBH I / F control unit 205, scanner I / F control unit 206, printer I / F control unit 207, NVRAM 208, panel control unit 209, network I / F. The F control unit 210 is connected. The bus 214 is a system bus through which control signals from the CPU 201 and data signals between the devices are transmitted and received. The IC card reader 216 is a USB device for performing authentication.

  FIG. 3 is a block diagram showing a hardware configuration of the portable information terminal 103 in FIG.

  The CPU 201 executes a software program for the image forming apparatus and controls the entire apparatus. A RAM 302 is a random access memory, and is used for temporary data storage when the CPU 201 controls the apparatus. A ROM 303 is a read-only memory, and stores a boot program of the apparatus, fixed parameters, and the like. An operation panel 304 is used for displaying a UI and inputting a user. The photographing unit 305 is for photographing an image. The network I / F control unit 306 controls data transmission / reception with the network 101. The bus 307 is connected to the CPU 301, RAM 302, ROM 303, operation panel 304, photographing unit 305, and network I / F control unit 306. A bus 307 is a system bus through which control signals from the CPU 301 and data signals between devices are transmitted and received.

  FIG. 4 is a block diagram showing the configuration of the software of the present invention.

  The image processing apparatus 102 includes the following software blocks.

  A device control unit 401 that controls a printer and a scanner.

  A device control command receiving unit 402 that receives a device control command from the outside and requests device control of the device control unit 401.

  A login management unit 403 that manages login to the image processing apparatus and user authority.

  An external connection control unit 405 that acquires login information from the login management unit 403 and manages connection from the portable information terminal 103 when login is performed by the user.

  A host information acquisition unit 407 that acquires a network identifier such as a host name or an IP address of the image processing apparatus 102.

  A two-dimensional barcode generation unit 408 that generates a two-dimensional barcode from the network identifier and login information acquired by the host information acquisition unit 407.

  A two-dimensional barcode display unit 406 that displays the two-dimensional barcode generated by the two-dimensional barcode generation unit 408 on the operation panel 213.

  A connection permission transmission unit 415 that notifies the portable information terminal 103 of connection permission information.

  Furthermore, the portable information terminal 103 includes the following software blocks.

  A program management unit 413 operating on the portable information terminal.

  A connection management unit 412 that is activated from the program management unit and connects to the image processing apparatus 102.

  The connection management unit has a UI as shown in FIG.

  An imaging unit 414 that captures the two-dimensional barcode displayed by the two-dimensional barcode display unit 406 on the operation panel 213 of the image processing apparatus 102 in accordance with an instruction from the connection management unit 412 and passes it to the connection management unit.

  A two-dimensional barcode decoding unit 415 that acquires the network identifier and login information of the image processing apparatus 102 from the two-dimensional barcode captured by the imaging unit 414.

  A connection information transmission unit 411 that connects to the image processing apparatus 102 using the network identifier decoded by the two-dimensional barcode decoding unit 415 and transmits login information decoded by the two-dimensional barcode decoding unit 415.

  A connection permission receiving unit 416 that acquires connection permission information from the image processing apparatus 102.

  A device operation unit 410 that is activated by the program management unit 413 when a connection permission is received by the connection permission receiving unit 416 and is operated by a user.

  The device operation unit is an application having a UI as shown in FIG.

  A device control command transmission unit 409 that transmits operation information input to the device operation unit 410 to the image processing apparatus 102.

  FIG. 5 is a flowchart of the first embodiment.

  When the image forming apparatus 102 starts processing (step 501), the login management unit 403 displays a login screen on the operation panel 213 and waits for login from the user (step 502).

  When the login 523 from the user is performed, the external connection management unit 405 acquires login information 602 indicating the login status of the user from the login management unit 403 (step 503).

  Next, the external connection management unit 405 acquires authority information indicating the authority of the logged-in user from the login management unit 403 (step 504).

  Further, the external connection management unit 405 acquires host information such as the IP address 601 of the image processing apparatus 102 from the host information processing unit 407 (step 505).

  Further, the external connection management unit 405 uses the two-dimensional barcode generation unit 408 to generate and acquire the two-dimensional barcode 603 from the login information acquired in step 503 and the IP address of the image processing apparatus 102 acquired in step 505 (step 505). 506).

  At this time, the two-dimensional barcode 603 may be generated including a random number character string in order to ensure the one-time property in addition to the login information and the IP address.

  The external connection management unit 405 uses the two-dimensional barcode display unit 406 to display the two-dimensional barcode acquired at step 505 on the operation panel 213 of the image processing apparatus 102 as indicated by reference numeral 603 in FIG. 6 (step 507). Then, it waits for a connection until there is a connection request from the portable information terminal 103 (step 508).

  When the image processing apparatus 102 receives the connection request 524 from the portable information terminal 103 at the connection information receiving unit 406, the external connection management unit 405 uses the two-dimensional barcode display unit 406 to perform the two-dimensional operation on the operation panel 213 of the image processing apparatus 102. The bar code is erased (step 509).

  The connection request 524 includes login information. Moreover, a random number character string for ensuring one-time property may be included.

  The login information included in the connection request 525 received by the connection information receiving unit 406 is compared with the login information acquired in step 503 (step 510). If the random character string is included, the random character string included in the connection request is also compared with the random character string used in step 506.

  If the login information is equal in the comparison in step 510, the external connection management unit 405 activates the device control command receiving unit 402 and assigns the authority information acquired in step 504 to the device control command receiving unit 402 (step 511). Furthermore, the external connection management unit 405 transmits a connection permission 527 to the portable information terminal 103 using the connection permission transmission unit 415 (step 512). The device control command receiving unit 402 waits for reception of a scan or print command from the device control command transmitting unit 409 of the portable information terminal 103, and when the control command is received, it is executed by the device control unit (step 513).

  If the login information is not equal in the comparison in step 510, the external connection management unit 405 transmits a connection denial 528 to the portable information terminal 103 using the connection permission transmission unit 415 (step 514), and the process proceeds to step 506.

  On the other hand, when the portable information terminal 103 starts processing, the program management unit 413 activates the connection management unit 412 (step 515).

  The connection management unit 412 is an application having a UI as shown in FIG. 8, and when the user presses the login button 802, the two-dimensional barcode is photographed 524 using the photographing unit 414 as in 801 (step 516).

The connection management unit 412 acquires login information from the two-dimensional barcode captured in step 516 using the two-dimensional barcode decoding unit 415 (step 517).
Further, the IP address of the image processing apparatus is acquired from the two-dimensional barcode (step 518).

  The connection management unit 412 transmits the login information acquired in step 517 as the connection request 525 to the image processing apparatus 102 having the IP address acquired in step 518 using the connection information transmission unit 411 (step 519). If the two-dimensional barcode includes a random character string for ensuring one-time property, the random character string is also transmitted.

  After transmitting the login information, the connection management unit 412 waits for the connection disapproval 526 or the connection permission 527 using the connection permission receiving unit 412 (step 520).

  When the connection management unit 412 receives a message from the connection permission transmission unit 415 of the image processing apparatus 102 by the connection permission reception unit 412, the connection management unit 412 checks whether the connection is permitted or not permitted (step 521). If connection is not permitted, the connection management unit 412 transitions to step 516.

  If the connection is permitted, the connection management unit 412 requests the program management unit 413 to start the device operation unit 410 having a UI such as 1001 in FIG. 10, and the connection management unit 412 ends the processing (step 522).

  Next, a second embodiment of the present invention will be described.

  The hardware configuration of the apparatus and the image processing apparatus 102 constituting the present invention and the hardware configuration of the portable information terminal 103 are the same as those in the first embodiment.

  FIG. 11 is a diagram showing a software configuration of the second embodiment of the present invention.

  The image processing apparatus 102 includes the following software blocks in addition to FIG.

  A portable information terminal identifier display unit 1101 that displays the identifier of the portable information terminal transmitted from the portable information terminal 103 together with the login information on the operation panel 213.

  A connection permission input unit 1102 for inputting whether the identifier of the portable information terminal displayed on the operation panel 213 is valid.

  The portable information terminal 103 includes the following software blocks in addition to FIG.

  A portable information terminal identifier selection unit 1103 that selects an identifier of the portable information terminal to be transmitted to the image processing apparatus 102.

  FIG. 7 is a flowchart of the second embodiment.

  When the image forming apparatus 102 starts processing (step 701), the login management unit 403 displays a login screen on the operation panel 213 and waits for login from the user (step 702).

  When the login 728 from the user is performed, the external connection management unit 405 acquires login information 602 indicating the login status of the user from the login management unit 403 (step 703).

  Next, the external connection management unit 405 acquires authority information indicating the authority of the logged-in user from the login management unit 403 (step 704).

  Further, the external connection management unit 405 acquires host information such as the IP address 601 of the image processing apparatus 102 from the host information processing unit 407 (step 705).

  Further, the external connection management unit 405 generates and acquires a two-dimensional barcode 603 from the login information acquired in step 703 and the IP address of the image processing apparatus 102 acquired in step 705 using the two-dimensional barcode generation unit 408 (step 706).

  At this time, the two-dimensional barcode 603 may be generated including a random number character string in order to ensure the one-time property in addition to the login information and the IP address.

  The external connection management unit 405 uses the two-dimensional barcode display unit 406 to display the two-dimensional barcode acquired in step 505 on the operation panel 213 of the image processing apparatus 102 as indicated by reference numeral 603 in FIG. 6 (step 707). Then, it waits for connection until there is a connection request 730 from the portable information terminal 103 (step 708).

  When the image processing apparatus 102 receives the connection request 730 from the portable information terminal 103 at the connection information receiving unit 406, the external connection management unit 405 uses the two-dimensional barcode display unit 406 to perform the two-dimensional operation on the operation panel 213 of the image processing apparatus 102. The bar code is erased (step 709).

  The connection request 730 includes log-in information and image data as portable information terminal identification information selected by the user at the portable information terminal 103. The mobile information terminal identification information may be a character string input by the user or the serial number of the mobile information terminal 103 as long as the user can recognize that the connection is from the terminal. Moreover, a random number character string for ensuring one-time property may be included.

  The login information included in the connection request 730 received by the connection information receiving unit 406 is compared with the login information acquired in step 703 (step 710). If the connection request 730 includes a random character string, the included random character string is also compared with the random character string used in step 706.

  If the login information is equal in step 710, the external connection management unit 405 uses the portable information terminal identifier display unit 1101 to display the portable information terminal identification information acquired in step 708 on the operation panel 213 of the image processing apparatus 102 as shown in 1201 in FIG. (Step 711).

  Then, it waits for an input 732 as to whether the image data identifies the user's portable information terminal 103 as the band information terminal identification information displayed on the operation panel 213 of the image processing apparatus 102 (step 712).

  If the login information is not equal in step 710, the external connection management unit 405 transmits a connection non-permission 731 to the portable information terminal 103 using the connection permission transmission unit 415 (step 717), and transitions to step 706.

  If the user input is Yes in step 712, the device control command receiving unit 402 is activated and the authority information acquired in step 704 is given to the device control command receiving unit 402 (step 714). Further, the external connection management unit 405 transmits the connection permission 733 to the portable information terminal 103 using the connection permission transmission unit 415 (step 715). The device control command reception unit 402 waits for reception of a scan or print command from the device control command transmission unit 409 of the portable information terminal 103, and when the control command is received, the device control command is executed by the device control unit (step 7167).

  If the user input is No in step 712, the external connection management unit 405 uses the connection permission transmission unit 415 to transmit the connection disapproval 731 to the portable information terminal 103 (step 717), and transitions to step 706.

  On the other hand, when the portable information terminal 103 starts processing, the program management unit 413 activates the connection management unit 412 (step 718).

  The connection management unit 412 is an application having a UI as shown in FIG. 9, and the user can select a mobile information terminal identifier 729 using a mobile information terminal identifier selection unit 1103 such as 902. When the user presses the login button 802, the two-dimensional barcode is photographed 730 using the photographing unit 414 as in 801 (step 719).

  The connection management unit 412 acquires the image data selected by the portable information terminal identifier selection unit 1103 (step 720).

  The connection management unit 412 acquires login information from the two-dimensional barcode captured in step 719 using the two-dimensional barcode decoding unit 415 (step 721).

  Further, host information of the image processing apparatus 102 such as the IP address of the image processing apparatus is acquired from the two-dimensional bar code (step 722).

  The connection management unit 412 transmits the image data acquired in step 720 and the login information acquired in step 721 as a connection request 730 to the image processing apparatus 102 having the IP address acquired in step 722 using the connection information transmission unit 411. (Step 723). If the two-dimensional barcode includes a random character string for ensuring one-time performance, the random character string is also transmitted.

  After transmitting the login information, the connection management unit 412 uses the connection permission receiving unit 412 to wait for a connection permission 733 or a connection disapproval 731 (step 724).

  When the connection management unit 412 receives a message from the connection permission transmission unit 415 of the image processing apparatus 102 at the connection permission receiving unit 412, the connection management unit 412 checks whether the connection is permitted or not permitted (step 725). If connection is not permitted, the connection management unit 412 transitions to step 719.

  If the connection is permitted, the connection management unit 412 requests the program management unit 413 to start the device operation unit 410 having a UI such as 1001 in FIG. 10, and the connection management unit 412 ends the processing (step 726).

101 Network 102 Image Processing Device 103 Portable Information Terminal

Claims (6)

Authentication means (403);
Means (405, S504) for acquiring the authority of the user authenticated by the authentication means;
Authentication information acquisition means (405, S503) for acquiring authentication information authenticated by the authentication means;
First, connection information acquisition means (407, S505) for acquiring connection information for connecting to the terminal;
A connection / authentication information transmission means (406) for transmitting the authentication information and connection information for connecting to the terminal first;
Command reception execution means (402, 401) for receiving and executing a command from the second terminal
A first terminal consisting of
A connection / authentication information receiving means (414) for receiving authentication information and connection information;
Authentication information transmitting means (411) for transmitting authentication information to the first terminal using the connection information;
Command transmission means (410, 409) for transmitting a command to the first terminal
A second terminal consisting of
The first terminal is
Authentication information receiving means (404) for receiving authentication information from the second terminal;
Means (405, S501) for comparing the authentication information received by the authentication information receiving means with the authentication information acquired by the authentication information acquiring means;
If the comparison by the comparison means is successful, the authority given by the authority granting means at the first terminal is permitted to the command reception executing means (402, 401) that receives and executes the instruction from the second terminal. An authentication system comprising: permission means (405) for performing Terminal identifier acquisition means (1103, S720) for acquiring the terminal identifier of the second terminal;
The authentication information transmission means of the second terminal is a transmission means (411) for transmitting the terminal identifier acquired by the terminal identifier acquisition means together with the authentication information,
The authentication information receiving means (404) of the first terminal receives the authentication information and the terminal identifier of the second terminal from the second terminal,
The authentication system according to claim 1, wherein the first terminal has terminal identifier display means (1101, S711) for displaying the received terminal identifier of the second terminal. The authentication system according to claim 2, wherein the terminal identifier acquisition means (1103) allows the user to change the identifier. The identifier valid determination input means (1102, S712) capable of inputting whether the terminal identifier displayed on the terminal identifier display means (1101) is valid is provided. Authentication system. The first terminal has encoding means (408, S506) for encoding information to be transmitted by the connection / authentication information transmitting means, and the second terminal is decoding means (415) for decoding the information received by the connection / authentication information receiving means. , S517, S518), the authentication system according to any one of claims 1 to 3. 5. The authentication system according to claim 4, wherein the encoding means is a two-dimensional barcode encoding means (408, S506), and the decoding means is a two-dimensional barcode decoding means (415, S517, S518). .