JP2021128385A - Information processing system, system, and usage restriction method - Google Patents

Abstract

To provide an information processing system which can restrict usage of a common function.SOLUTION: An information processing system 50 permits usage of an application depending on license for using the application. The system includes a license management unit 55 which restricts the usage of a common function when it is not defined that the common function can be used, in license definition information in which the common function which becomes available by the license is defined, and permits the usage of the common function when it is defined that the common function can be used.SELECTED DRAWING: Figure 6

Description

The present invention relates to an information processing system, a system, and a usage restriction method.

For example, an information processing system that provides an information processing service to a client device such as a multifunction device or a general-purpose terminal device via a network such as the Internet is known. When receiving services from this information processing system, the customer (sometimes called a tenant) first purchases a license to use the application. Users within the customer can use the application within the scope of the license.

A technique for restricting or permitting the use of an application by a user has been devised (see, for example, Patent Document 1). In Patent Document 1, it is determined whether or not the requesting device can use the application, and if it is determined that the application cannot be used, the number of devices using the application is the maximum number of devices that can use the application. A system is disclosed that allows the requesting device to use the application if the maximum number is not reached.

However, in the prior art, there is a problem that the use of common functions cannot be restricted. It is a function that is commonly used by different applications. For example, the user management function for registering / acquiring / updating / deleting a user is a common function because it is a function used regardless of various applications. Common functions such as user management functions are provided as a common platform, and it is not necessary for the terminal device to implement the user management functions for each application.

Since such a user management function is an essential function, there is little need for the information processing system to restrict its use. However, convenient functions such as group management functions, which are not essential for each application, are also provided as common functions. For such convenient functions, it is appropriate for the service provider to allow the tenants to use the common functions uniformly, but to allow the use of the common functions according to the application permitted to use by purchasing the license. Is considered to be.

In view of the above problems, an object of the present invention is to provide an information processing system capable of restricting the use of common functions.

In view of the above problems, the present invention is an information processing system that permits the use of the application according to a license for using the application, and is provided with license definition information in which common functions that can be used by the license are defined. When it is not defined that the common function can be used, it is characterized by having a license management unit that restricts the use of the common function.

It is possible to provide an information processing system that can limit the use of common functions.

This is an example of a software configuration diagram of an information processing system. It is a figure which shows typically the correspondence with an application and a common function. It is a block diagram of an example of a service provision system. It is a hardware block diagram of an example of a computer. It is a hardware block diagram of an example of an image forming apparatus. This is an example of a functional block diagram for explaining the functions of the first terminal device, the second terminal device, the third terminal device, the electronic device, and the information processing system by dividing them into blocks. It is a figure which shows an example of the workflow setting screen displayed by the terminal device which a developer operates. It is a figure which shows an example of a home screen. It is a sequence diagram which shows the procedure which an information processing system accepts the creation of a license definition from a product designer. It is a figure which shows an example of the license definition creation screen. It is a figure which shows an example of the license purchase screen. This is an example of a sequence diagram for explaining the processing when using the application. This is an example of a flowchart showing a procedure for the information processing system to determine the presence or absence of a common function.

Hereinafter, as an example of the embodiment for carrying out the present invention, the information processing system and the function usage restriction method performed by the information processing system will be described with reference to the drawings.

<About common functions>
First, the relationship between common functions and applications will be described with reference to FIG. FIG. 1 shows an example of a software configuration diagram of the information processing system 50. The application group 101 is shown in the upper part of FIG. 1, and the common board 102 is shown in the lower part of FIG. The common infrastructure 102 refers to infrastructure, middleware, and the like that are commonly used by the information processing system 50 in providing services. The common function is included in the common board 102. The common function may be a function commonly used by a plurality of applications (hereinafter referred to as an application) or may be used independently of the application.

The common infrastructure 102 has an authentication infrastructure 131, a data infrastructure 132, an infrastructure service 133, and a business infrastructure 134.
-Authentication platform 131: A function related to authentication of users and devices.
-Data infrastructure 132: A function that aggregates data and processes big data.
-Infrastructure service 133: A function for managing settings related to infrastructure such as networks.
-Business platform 134: A function for managing settings related to contracts and billing.

Further, the common platform 102 has functions such as login 139, workplace 140, user management 135, my account 136, tenant management 137, application authority management 138, and UI framework 141 as common functions for using the authentication platform 131. doing.
-Login 139 ... Performs a process in which the user logs in to the information processing system 50.
Workplace 140: Provides user-specific apps and allows users to receive services as if they were on their own desktop.
-User management 135: Manages information about users such as user registration, acquisition, update, and deletion.
-My Account 136 ... Allows users to edit their profile.
-Tenant management 137: Allows the tenant administrator to manage users, login policies, etc. in the tenant.
-App authority management 138 ... It is possible to manage which user can use the application.
-UI framework 141: A framework for constructing a screen operated by a user.

Of the common infrastructure 102, login 139, workplace 140, user management 135, my account 136, tenant management 137, and application authority management 138 provide group management functions and external cooperation functions. These are called convenient functions 103 because they are convenient functions, although they are not essential. Convenient function 103 is a part of functions except essential functions.

The application group 101 includes a regional development application 111, a device-specific application 112, a print application 113, an A division application 114, a B division application 115, a partner application 116, a WF application development tool 119, and a device management basic application 120. Have.

Of these, the regional development application 111, the device-specific application 112, the print application 113, the A division application 114, the B division application 115, and the partner application 116 are applications arbitrarily developed by the tenant. The WF application development tool 119 is a tool that operates on the document processing platform 117. The document processing platform 117 is a platform used for document processing such as document scanning, OCR (Optical Character Reader), and folder transmission. The WF application development tool 119 is a tool for the user to set the workflow, and is used as an application. The device management basic application 120 is an application that operates on the device management processing platform 118. The device management processing board 118 is a board that communicates with devices such as multifunction devices to monitor abnormalities. The device management basic application 120 monitors devices by using the device management processing platform 118.

As described above, the information processing system 50 has a common board 102, and the common board 102 has a plurality of common functions. In the present embodiment, since the common functions that can be used by the license of this application are managed in association with the application, the tenant who purchased the license of the application can use the common functions.

FIG. 2 is a diagram schematically showing the correspondence between the application and the common function. For example, the application A is associated with "external storage X" as a common function, and a user who has the authority to use this application can use the external storage X. A user who does not have the right to use this application cannot use this common function unless the use of the external storage X is permitted by another application.

It is not appropriate for the information processing system 50 to independently allow users to use common functions regardless of the application. In other words, it is not appropriate for customers to purchase common functions directly. This is because the information processing system 50 cannot provide the service only by the common function. Therefore, in the present embodiment, the application is the target of the license, and the common functions required by the application can be used.

<Terminology>
A tenant is a customer who has a contract to use a service provided by an information processing system.

An application is a program executed by a terminal device and an information processing device in order for a user to receive a service. A program executed by a terminal device and an information processing device in cooperation with each other is also called a Web application. The application may be, for example, a workflow application that executes a series of processes in order. The app can be built by tenant managers, etc. by combining components.

The tenant manager is a person who manages the use of services by users, tenant managers, etc. in the customer environment within the scope of the contract between the company and the service provider. Mainly the person in charge on the tenant side. For example, registration of a general user to a tenant, management of the account status of a general user, registration of services that can be used by a general user, and the like are performed.

A general user is a user who can use the service when the usage authority is assigned. In this embodiment, it is simply referred to as a user.

A product designer is someone who sells an app to a tenant or defines a license. Mainly the person in charge on the service provider side.

The license means the authority, and in this embodiment, it is the authority to use the application. It may be called a permit, authority, etc.

Restricting the use means that users and tenant administrators cannot use all or part of the common functions. The use of apps is also restricted due to restrictions on the use of common functions. When the use of all common functions is restricted, it may be called prohibition.

<System configuration example>
FIG. 3 is a configuration diagram of an example of the service providing system 1 according to the present embodiment. In the service providing system 1 of FIG. 3, the customer environment 8 and the service provider environment 7 are connected to the information processing system 50 via a network N1 such as the Internet. The network N1 also includes a telephone line such as a mobile phone network. The service providing system 1 is an example of a system in the scope of claims.

The customer is a customer of the service provided by the information processing system 50, and includes an organization such as a company, an organization, an educational institution, an administrative agency, or a department. In cloud services, customers are sometimes referred to as tenants. Those who have some kind of employment relationship with these customers are called users. In the customer environment 8, one or more electronic devices 10, a first terminal device 20, a second terminal device 30, and a firewall 16 are connected to each other via a network N2 such as a LAN. Further, the information processing system 50 has one or more information processing devices 49 connected to the network N1. A service provider is a company that provides services to customers. A third terminal device 40 exists in the service provider environment 7.

The electronic device 10 is, for example, an image forming apparatus 10a, and the image forming apparatus 10a also includes a laser printer, a multifunction printer, an MFP (Multi-function Peripheral / Product / Printer), and the like. Further, as the electronic device 10, an electronic blackboard 10b can also be mentioned. In addition, the electronic device 10 includes, for example, an output device such as a PJ (Projector: projector), a digital signage, a HUD (Head Up Display) device, an industrial machine, an imaging device, a sound collecting device, a medical device, a network home appliance, and an automobile ( It may be a Connected Car), a notebook PC, a mobile phone, a smartphone, a tablet terminal, a game machine, a PDA (Personal Digital Assistant), a digital camera, a wearable PC, a desktop PC, or the like.

The electronic device 10 of the present embodiment is a terminal on which a user registered in the information processing system 50 uses the service. The user logs in to the information processing system 50 from the electronic device 10, selects an application for which the user has permission to use, and receives the service provided by the information processing system 50. In this way, the service is provided on an app-by-app basis.

The first terminal device 20 is an information processing device such as a smartphone, a mobile phone, a tablet PC, a desktop PC, or a notebook PC used by a tenant manager. The first terminal device 20 is equipped with a program having a screen display function such as a Web browser. This program is not limited to a Web browser as long as it has a function of displaying screen information received from the information processing system 50 as a screen. A program dedicated to the information processing system 50 may be used.

The second terminal device 30 is an information processing device such as a smartphone, a mobile phone, a tablet PC, a desktop PC, or a notebook PC used by a user (general user). The second terminal device 30 is equipped with a program having a screen display function such as a Web browser. This program is not limited to a Web browser as long as it has a function of displaying screen information received from the information processing system 50 as a screen. A program dedicated to the information processing system 50 may be used.

The third terminal device 40 is an information processing device such as a smartphone, a mobile phone, a tablet PC, a desktop PC, or a notebook PC used by a product designer. The third terminal device 40 is equipped with a program having a screen display function such as a Web browser. This program is not limited to a Web browser as long as it has a function of displaying screen information received from the information processing system 50 as a screen. A program dedicated to the information processing system 50 may be used.

The firewall 16 is a device for preventing intrusion from the outside into the customer environment 8, and all communications from the customer environment 8 are monitored by the firewall 16. However, this does not apply when the first terminal device 20, the second terminal device 30, or the third terminal device 40 communicates with the information processing system 50 via a telephone line such as a mobile phone network.

The information processing system 50 provides various services to the electronic device 10 and the second terminal device 30 and the like. The service varies depending on the type of the electronic device 10, but in the case of the image forming apparatus 10a, a service of uploading and saving the scanned document to the storage on the cloud, and downloading and printing the image data of the storage on the cloud. There are services, but they are not limited to these. In the case of the electronic blackboard 10b, for example, there are a service of recognizing voice in real time and creating minutes, a service of converting handwritten data into text, and the like. In the case of the second terminal device 30, for example, there is a real-time translation service for Web pages.

In the information processing system 50, the tenant and the user are associated with each other. The services (applications) that can be used are determined according to the role of the user, and the user uses the application assigned to him / her from the electronic device 10 or the second terminal device 30.

Since the user registered in the information processing system 50 belongs to one of the tenants, if the user is specified after registration, the tenant to which the user belongs is also specified.

The information processing system 50 creates screen information of a Web page to be displayed on the first terminal device 20, the second terminal device 30, the third terminal device 40, or the electronic device 10, and transmits the screen information to these. For example, the license definition creation screen, the license purchase screen, and the like, which will be described later, are displayed.

The screen information is created by HTML, XML, CSS (Cascade Style Sheet), JavaScript (registered trademark), and the like. The web page may be provided by a web application. A Web application refers to software or a mechanism thereof that operates by coordinating a program in a programming language (for example, JavaScript (registered trademark)) that operates on a Web browser and a program on the Web server side and is executed on the Web browser. .. A web page can be dynamically changed by a web application.

The information processing system 50 may be compatible with cloud computing. Cloud computing refers to a usage pattern in which resources on a network are used without being aware of specific hardware resources. The information processing system 50 that supports cloud computing may be referred to as a cloud system. The cloud system may be on the internet or on-premises.

Further, the configuration of the service providing system 1 shown in FIG. 3 is an example, and one or more server devices (proxy server, gateway server, etc.) may be interposed between the customer environment and the information processing device. .. Further, the first terminal device 20 and the second terminal device 30 may be in a environment other than the customer environment, and may be connected to, for example, the network N1. The third terminal device 40 may be in a environment other than the service provider environment, and may be connected to, for example, a network N1.

The information processing system 50 may be realized by one information processing device 49, or may be distributed and realized by a plurality of information processing devices 49. For example, there may be an information processing device 49 that provides this for each service, one information processing device 49 may provide a plurality of services, or a plurality of information processing devices 49 may provide one service. May be provided.

Further, in the service providing system 1 of FIG. 3, the information processing device is connected to a network N1 such as the Internet outside the customer environment. In other words, the service providing system 1 of FIG. 3 is an example in which the information processing system 50 is provided in a cloud environment. However, the information processing system 50 may be provided inside the customer environment (on-premises environment).

<Hardware configuration example>
<< Computer >>
The first terminal device 20, the second terminal device 30, the third terminal device 40, or the information processing system 50 of FIG. 3 is realized by, for example, a computer having a hardware configuration shown in FIG. FIG. 4 is a hardware configuration diagram of an example of a computer. The computer 500 of FIG. 4 is constructed by a computer, and as shown in FIG. 4, the CPU 501, ROM 502, RAM 503, HD 504, HDD controller 505 (Hard Disk Drive), display 506, external device connection I / F 508 ( Interface), network I / F 509, bus line 510, controller 511, pointing device 512, DVD-RW drive 514 (Digital Versatile Disk Rewritable), and media I / F 516.

Of these, the CPU 501 controls the operation of the entire computer. The ROM 502 stores a program used to drive the CPU 501 such as an IPL. The RAM 503 is used as a work area of the CPU 501. The HD504 stores various data such as programs. The HDD controller 505 controls reading or writing of various data to the HD 504 according to the control of the CPU 501. The display 506 displays various information such as cursors, menus, windows, characters, or images. The external device connection I / F 508 is an interface for connecting various external devices. The external device in this case is, for example, a USB (Universal Serial Bus) memory, a printer, or the like. The network I / F 509 is an interface for performing data communication using a communication network. The bus line 510 is an address bus, a data bus, or the like for electrically connecting each component such as the CPU 501 shown in FIG.

Further, the keyboard 511 is a kind of input means including a plurality of keys for inputting characters, numerical values, various instructions and the like. The pointing device 512 is a kind of input means for selecting and executing various instructions, selecting a processing target, moving a cursor, and the like. The DVD-RW drive 514 controls reading or writing of various data to the DVD-RW 513 as an example of the removable recording medium. In addition, it is not limited to DVD-RW, and may be DVD-R or the like. The media I / F 516 controls reading or writing (storage) of data to a recording medium 515 such as a flash memory.

<< Image forming device >>
FIG. 5 is a hardware configuration diagram of an example of the image forming apparatus 10a. As shown in FIG. 5, the image forming apparatus 10a includes a controller 910, a short-range communication circuit 920, an engine control unit 930, an operation panel 940, and a network I / F 950.

Of these, the controller 910 is a CPU 901, a system memory 902 (MEM-P), a north bridge 903 (NB), a south bridge 904 (SB), an ASIC906 (Application Specific Integrated Circuit), and a storage unit, which are the main parts of the computer. It has a local memory 907 (MEM-C), an HDD controller 908, and a storage unit HD909, and has a configuration in which the NB 903 and the ASIC 906 are connected by an AGP bus 921 (Accelerated Graphics Port).

Of these, the CPU 901 is a control unit that controls the entire image forming apparatus 10a. The NB903 is a bridge for connecting the CPU 901, the MEM-P902, the SB904, and the AGP bus 921, and includes a memory controller that controls reading and writing to the MEM-P902, a PCI (Peripheral Component Interconnect) master, and an AGP target. Has.

The MEM-P902 includes a ROM 902a that is a memory for storing programs and data that realizes each function of the controller 910, and a RAM 902b that is used as a memory for developing programs and data and a memory for drawing at the time of memory printing. The program stored in the RAM 902b is configured to be provided by recording a file in an installable format or an executable format on a computer-readable recording medium such as a CD-ROM, CD-R, or DVD. You may.

The SB904 is a bridge for connecting the NB903 to a PCI device and peripheral devices. The ASIC 906 is an IC (Integrated Circuit) for image processing applications having hardware elements for image processing, and has a role of a bridge connecting the AGP bus 921, the PCI bus 922, the HDD controller 908, and the MEM-C907, respectively. This ASIC906 is a PCI target and an AGP master, an arbiter (ARB) which is the core of the ASIC906, a memory controller which controls MEM-C907, and a plurality of DMACs (Direct Memory Access Controllers) which rotate image data by hardware logic and the like. , And a PCI unit that transfers data between the scanner unit 931 and the printer unit 932 via the PCI bus 922. A USB (Universal Serial Bus) interface or an IEEE 1394 (Institute of Electrical and Electronics Engineers 1394) interface may be connected to the ASIC 906.

The MEM-C907 is a local memory used as a copy image buffer and a code buffer. The HD909 is a storage for accumulating image data, accumulating font data used at the time of printing, and accumulating forms. The HD909 controls reading or writing of data to the HD909 according to the control of the CPU 901. The AGP bus 921 is a bus interface for a graphics accelerator card proposed for speeding up graphic processing, and the graphics accelerator card can be speeded up by directly accessing the MEM-P902 with high throughput. ..

Further, the short-range communication circuit 920 is provided with a short-range communication circuit antenna 920a. The short-range communication circuit 920 is a communication circuit such as NFC or Bluetooth (registered trademark).

Further, the engine control unit 930 is composed of a scanner unit 931 and a printer unit 932. Further, the operation panel 940 displays the current setting value, the selection screen, and the like, and displays the panel display unit 940a such as a touch panel that accepts the input from the operator, and the setting value of the condition related to image formation such as the density setting condition. It is provided with a hard key 940b including a numeric keypad for receiving and a start key for receiving a copy start instruction. The controller 910 controls the entire image forming apparatus 10a, and controls, for example, drawing, communication, input from the operation panel 940, and the like. The scanner unit 931 or the printer unit 932 includes an image processing portion such as error diffusion and gamma conversion.

The image forming apparatus 10a can sequentially switch and select the document box function, the copy function, the printer function, and the facsimile function by the application switching key of the operation panel 940. When the document box function is selected, the document box mode is set, when the copy function is selected, the copy mode is set, when the printer function is selected, the printer mode is set, and when the facsimile mode is selected, the facsimile mode is set.

Further, the network I / F950 is an interface for performing data communication using a communication network. The short-range communication circuit 920 and the network I / F 950 are electrically connected to the ASIC 906 via the PCI bus 922.

<About functions>
The function of each device of the information processing system 50 according to the present embodiment is realized by, for example, the processing block shown in FIG. FIG. 6 is an example of a functional block diagram for explaining the functions of the first terminal device 20, the second terminal device 30, the third terminal device 40, the electronic device 10, and the information processing system 50 by dividing them into blocks. Is.

<< First terminal device >>
The first terminal device 20 has a first communication unit 22, a display control unit 23, and an operation reception unit 24. The first terminal device 20 realizes a functional block as shown in FIG. 6 by executing a program (for example, a Web browser 21).

The first communication unit 22 communicates with the information processing system 50 and receives screen information for the first terminal device 20 to display a license purchase screen or the like. In addition, the information input by the tenant manager on the license purchase screen or the like is transmitted to the information processing system 50.

The display control unit 23 analyzes the screen information of the screen received from the information processing system 50 and displays, for example, a license purchase screen on the display 506. The operation reception unit 24 receives the operation of the tenant manager on the first terminal device 20.

<< Second terminal device >>
The second terminal device 30 has a second communication unit 32, a display control unit 33, and an operation reception unit 34. The second terminal device 30 realizes a functional block as shown in FIG. 6 by executing a program (for example, a Web browser 31).

The second communication unit 32 communicates with the information processing system 50 and receives screen information for the second terminal device 30 to display a login screen, a home screen, or the like. Further, the information input by the user on the login screen or the home screen is transmitted to the information processing system 50.

The display control unit 33 analyzes the screen information of the screen received from the information processing system 50 and displays, for example, a login screen or a home screen on the display 506. The operation reception unit 34 receives the user's operation on the second terminal device 30.

<< Third terminal device >>
The third terminal device 40 has a third communication unit 42, a display control unit 43, and an operation reception unit 44. The third terminal device 40 realizes a functional block as shown in FIG. 6 by executing a program (for example, a Web browser 31).

The third communication unit 42 communicates with the information processing system 50 and receives screen information for the third terminal device 40 to display the license definition creation screen and the like. In addition, the information input by the product designer on the license definition creation screen is transmitted to the information processing system 50.

The display control unit 43 analyzes the screen information of the screen received from the information processing system 50 and displays, for example, a license definition creation screen on the display 506. The operation reception unit 34 receives the operation of the product designer for the third terminal device 40.

<< Electronic equipment >>
The electronic device 10 has a fourth communication unit 12, a display control unit 13, and an operation reception unit 14. The electronic device 10 realizes a functional block as shown in FIG. 6 by executing a program (for example, a Web browser 11).

The fourth communication unit 12 communicates with the information processing system 50 to receive screen information for the electronic device 10 to display the standby screen, launcher screen, login screen, application screen, and the like. In addition, the information input by the user on the standby screen, launcher screen, login screen, and application screen is transmitted to the information processing system 50.

The display control unit 13 analyzes the screen information of the screen received from the information processing system 50 and displays, for example, the standby screen, the launcher screen, the login screen, and the application screen on the operation panel 940. The operation reception unit 14 receives user operations on the electronic device 10 (for example, activation of a launcher, input of authentication information, selection of an application, operation on an application, etc.).

<< Information processing system >>
The information processing system 50 includes a fifth communication unit 52, an authentication unit 53, a license definition management unit 54, a license management unit 55, a user information management unit 56, an application management unit 57, a tenant management unit 58, and an application execution unit 61. Have. These functions of the information processing system 50 are functions or means realized by the CPU 501 of the computer 500 shown in FIG. 4 executing a program developed from the HD 504 to the RAM 503.

The fifth communication unit 52 transmits and receives various information to and from the first terminal device 20, the second terminal device 30, the third terminal device 40, and the electronic device 10. For example, the screen information of the license purchase screen is transmitted to the first terminal device 20, the screen information of the login screen and the home screen is transmitted to the second terminal device 30, and the screen information of the license definition creation screen is transmitted to the third terminal. It is transmitted to the device 40, and screen information of the standby screen, the launcher screen, the login screen, and the application screen is transmitted to the electronic device 10. It also receives the information entered on these screens.

The authentication unit 53 authenticates the product designer, the tenant manager, and the user, and determines whether the authentication succeeds or fails. Authentication means determining whether or not the person who requested the authentication is a legitimate authorized person. In the case of this embodiment, it is possible to determine whether or not the user has the authority to use the information processing system 50, and further, the product designer, the user, or the tenant manager can also determine. Successful authentication means that the product designer, user, or tenant administrator is allowed to log in to the information processing system 50. Login is an authentication act to access system resources using pre-registered account information when using various services on a computer or the Internet. The account information is a user ID and password, an IC card number, biometric authentication information, or the like.

The license definition management unit 54 accepts the creation of the license definition and registers the license definition information in the license definition information storage unit 591 described later. In addition, the license definition information is acquired from the license definition information storage unit 591.

The license management unit 55 accepts the purchase of a license by a tenant manager or the like and registers it in the license information storage unit 592. One or more apps are associated with the license. In addition, the license management unit 55 determines whether or not the tenant manager or the user can use the common function.

The user information management unit 56 manages the user information, and registers the user information in the user information storage unit 593, which will be described later, and acquires (reads) the user information from the user information storage unit 593.

The application management unit 57 manages each application, manages the default setting of the application for each user, and reflects the default setting in the application.

The tenant management unit 58 manages tenant information related to the tenant, and stores and acquires the tenant information in the tenant information storage unit 595, which will be described later.

The application execution unit 61 executes the application. Since the application is a workflow (or processing flow) including one or more processes, each process possessed by the application is executed in the order of definition. Each process corresponds to one component, and the application execution unit 61 executes the application by calling each component. Common functions are also provided as components.

Further, the information processing system 50 has a storage unit 59 realized by the HD 504, the RAM 503, and the like shown in FIG. The storage unit 59 includes a license definition information storage unit 591, a license information storage unit 592, a user information storage unit 593, an application information storage unit 594, and a tenant information storage unit 595. The license definition information storage unit 591 will be described with reference to Table 1.

表１はライセンス定義情報記憶部５９１に記憶されているライセンス定義情報を示す。ライセンス定義情報は、ライセンス定義ＩＤ、アプリケーション、単価、及び、利用可能共通機能の項目を有している。ライセンス定義ＩＤはライセンス定義を識別するための識別情報である。アプリケーションはアプリの名称やアプリＩＤである。単価はライセンスの購入費、又は、サブスクリプションの費用である。利用可能共通機能は、このアプリの購入により利用可能となる共通機能である。共通機能の一例を説明する。
・外部ストレージＸ…外部ストレージＸへデータを登録する共通機能。
・外部ストレージＸユーザ同期…外部ストレージＸのユーザ管理機能とユーザ情報を同期するための共通機能（ユーザ同期機能）。つまり、情報処理システム５０は外部ストレージＸに登録されているユーザ情報をそのまま利用できる。
・グループ管理…ユーザをグループ化する共通機能。例えば、テナント管理者はグループごとにメールの送信先を設定できる。
・外部サービスＹ認証…外部サービスＹの認証機能を利用した認証を可能にする共通機能。つまり、情報処理システム５０は外部サービスＹに認証要求して、その結果によりユーザの認証成功、失敗を判断できる。このような仕組みとしてOpenID Connectが知られている。

Table 1 shows the license definition information stored in the license definition information storage unit 591. The license definition information includes items such as a license definition ID, an application, a unit price, and available common functions. The license definition ID is identification information for identifying the license definition. The application is the name of the application or the application ID. The unit price is the purchase cost of the license or the cost of the subscription. Available common functions are common functions that can be used by purchasing this app. An example of common functions will be described.
-External storage X: A common function for registering data in the external storage X.
-External storage X user synchronization: A common function (user synchronization function) for synchronizing user information with the user management function of external storage X. That is, the information processing system 50 can use the user information registered in the external storage X as it is.
-Group management: A common function for grouping users. For example, the tenant administrator can set the destination of the email for each group.
-External service Y authentication: A common function that enables authentication using the authentication function of external service Y. That is, the information processing system 50 requests the external service Y for authentication, and can determine the success or failure of the user's authentication based on the result. OpenID Connect is known as such a mechanism.

表２はライセンス情報記憶部５９２に記憶されているライセンス情報を示す。ライセンス情報は、ライセンスＩＤ、ライセンス定義ＩＤ、テナントＩＤ、及び、状態の項目を有している。ライセンスＩＤはライセンスを識別する識別情報である。ライセンス定義ＩＤは表１と同じものである。テナントＩＤはテナントを識別するための識別情報である。状態は、ライセンスが有効か否かを示す（例えば、期限の超過により無効となる）。表２によれば、テナントＩＤ＝「11111111」のテナントが、ライセンス定義ＩＤがLicenseDefinitionA1とLicenseDefinitionBのライセンスを購入した。テナントＩＤ＝「22222222」のテナントが、ライセンス定義ＩＤがLicenseDefinitionA2のライセンスを購入した。

Table 2 shows the license information stored in the license information storage unit 592. The license information has a license ID, a license definition ID, a tenant ID, and a status item. The license ID is identification information that identifies the license. The license definition ID is the same as in Table 1. The tenant ID is identification information for identifying the tenant. The status indicates whether the license is valid or not (for example, it becomes invalid due to overdue). According to Table 2, the tenant with the tenant ID = "11111111" purchased the licenses with the license definition IDs LicenseDefinitionA1 and LicenseDefinitionB. The tenant with tenant ID = "22222222" has purchased a license with license definition ID LicenseDefinitionA2.

表３はユーザ情報記憶部５９３に記憶されているユーザ情報を模式的に示す。ユーザ情報は、テナントＩＤ、ユーザＩＤ、メールアドレス、ロール、性、名、及び、利用可能なアプリ、の項目を有している。
・テナントＩＤ…ユーザが所属するテナントの識別情報である。
・ユーザＩＤ…ユーザの識別情報である。
・メールアドレス…ユーザのメールアドレスである。
・ロール…ユーザの権限である。例えば「テナント管理者又は一般ユーザ」がある。
・姓…ユーザの名字である。
・名…ユーザの名前である。
・利用可能なアプリ…このユーザが利用可能なアプリの情報である。以下の情報を有している。

Table 3 schematically shows the user information stored in the user information storage unit 593. The user information has items of tenant ID, user ID, e-mail address, role, gender, name, and available application.
-Tenant ID: Identification information of the tenant to which the user belongs.
-User ID: User identification information.
-Email address: The user's email address.
-Role: User's authority. For example, there is a "tenant administrator or general user".
-Last name: The surname of the user.
-Name: The name of the user.
-Available apps: Information on apps that can be used by this user. It has the following information.

-App ID: Identification information that identifies the app (common to all apps).

-License ID: Identification information that identifies the usage authority of the application given to the user (different for each user).

表４はアプリ情報記憶部５９４に記憶されているアプリ情報を模式的に示す。アプリ情報はテナントＩＤ、アプリＩＤ及びロールの項目を有している。アプリ情報はプロダクトデザイナーがサービスの契約状況に応じて登録する。サービスの契約によって自動的に登録されてもよい。
・テナントＩＤ…アプリが販売されたテナントの識別情報である。
・アプリＩＤ…アプリの識別情報である。
・ロール…アプリを利用できる権限である。例えば「テナント管理者又は一般ユーザ」がある。

Table 4 schematically shows the application information stored in the application information storage unit 594. The application information has items of tenant ID, application ID and role. The product designer registers the application information according to the contract status of the service. It may be automatically registered by the contract of service.
-Tenant ID: Identification information of the tenant to whom the application was sold.
-App ID: App identification information.
・ Role: The authority to use the application. For example, there is a "tenant administrator or general user".

表５はテナント情報記憶部５９５に記憶されているテナント情報を模式的に示す。テナント情報はテナントＩＤ、テナント名、及び、登録日の項目を有している。
・テナントＩＤ…テナントの識別情報である。
・テナント名…テナントの名称であり、社名や部署名である。
・登録日…テナントの登録日である。

Table 5 schematically shows the tenant information stored in the tenant information storage unit 595. Tenant information has items of tenant ID, tenant name, and registration date.
-Tenant ID: Tenant identification information.
-Tenant name: The name of the tenant, which is the company name or department name.
・ Registration date: The registration date of the tenant.

It should be noted that Tables 1 to 5 are shown only for the purpose of explaining the present embodiment, and information that is not the main information is omitted.

<Example of workflow>
The outline of the workflow setting performed by the developer will be described with reference to FIG. 7. FIG. 7 is an example of the workflow setting screen G800 displayed by the terminal device or the like operated by the developer. The developer may be a product designer, a tenant manager, or a user.

The first terminal device 20 or the second terminal device 30 is executing the WF application development tool 119 shown in FIG. In FIG. 7A, the following workflows are registered by three icons 210-212 arranged in the horizontal direction.
"OCR-> File upload (external storage X)-> Email transmission"
One icon 210-212 corresponds to one process (component). The electronic device 10 acquires an image by scanning, receiving a fax, receiving an e-mail, or the like. The processing below OCR is automatically executed in order for this image.

The administrator can set the workflow by dragging the desired icon from the menu 220 on the left side of the screen to the square on the right side. The processing is executed in order from left to right. Further, as shown in FIG. 7B, when the icons 213 are set in the upper and lower cells, the workflow processing branches and is executed in parallel. In this way, the developer can register the application 204 by visual operation.

<Home screen displayed by the first terminal device or the second terminal device>
The home screen will be described with reference to FIG. The home screen is the screen that is first displayed when the tenant administrator or user logs in. FIG. 8A is an example of the home screen 310 displayed by the first terminal device 20 operated by the tenant manager. If the login is successful, the first terminal device 20 displays the home screen 310. On the home screen 310, a list 311 of applications for which the tenant administrator has usage authority in the user information is displayed. The same applies to general users. Further, the home screen 310 has a setting button 312, and when the tenant administrator presses the setting button 312, user management 313, application usage authority management (user) 314, application usage authority management (device) 315, and tenant information. Each button of 316 is displayed. The user management 313 is a button for displaying a user management screen for the tenant administrator to manage the user. The application usage authority management (user) 314 is a button for displaying a screen in which the tenant administrator manages which user can use which application. The application usage authority management (device) 315 is a button for displaying a screen for managing which electronic device 10 can use the application. The tenant information 316 is a button for displaying a screen for displaying the contract details of the tenant.

FIG. 8B is a diagram showing an example of a home screen 460 displayed by the second terminal device 30 operated by the user. It has the same configuration as the home screen 310 for the administrator shown in FIG. 8A, but the setting button 312 is not displayed. This is because it is less necessary for the user to make settings for the tenant administrator. However, the setting button 312 may be displayed on the home screen 460 for the user. On the home screen 460, it is possible to execute and set the application 441 to which the logged-in user is given the usage right. Depending on the application, it may be possible to execute processing (image formation, etc.) using the electronic device 10 from the home screen.

<Creating a license definition and purchasing a license>
The process of accepting the license definition created by the product designer by the information processing system 50 will be described with reference to FIGS. 9 to 11. FIG. 9 is a sequence diagram showing a procedure in which the information processing system 50 accepts the creation of a license definition from a product designer.

S1: The product designer operates the third terminal device 40 to communicate the third terminal device 40 with the information processing system 50. Since the product designer performs the operation of displaying the license definition creation screen on the third terminal device 40, the display control unit 43 of the third terminal device 40 displays the license definition creation screen. The product designer enters the necessary information on the license definition creation screen. The operation reception unit 44 accepts the input. The third communication unit 42 of the third terminal device 40 transmits the information input to the license definition creation screen to the information processing system 50. An example of the license definition creation screen is shown in FIG.

The product designer has already logged in to the information processing system 50, and the role of product designer has been specified.

S2: The fifth communication unit 52 of the information processing system 50 receives the information input to the license definition creation screen. The license definition management unit 54 registers the license definition information in the license definition information storage unit 591. By registering the license definition information, the tenant can purchase the license.

S3: The tenant manager operates the first terminal device 20 to communicate the first terminal device 20 with the information processing system 50. Since the tenant manager performs an operation to display the license purchase screen on the first terminal device 20, the display control unit 23 of the first terminal device 20 displays the license purchase screen. The tenant administrator enters the necessary information on the license purchase screen. The operation reception unit 24 receives the input. The first communication unit 22 of the first terminal device 20 transmits the information input to the license purchase screen to the information processing system 50. An example of the license purchase screen is shown in FIG.

S4: The fifth communication unit 52 of the information processing system 50 receives the information input on the license purchase screen. The license management unit 55 registers the license information in the license information storage unit 592 (license issuance).

When the tenant administrator purchases a license that corresponds to the license definition, the tenant administrator assigns the user the right to use the app. As a result, users belonging to the tenant can use the license (execute the application).

S5: The tenant manager tried to open the group management screen on the first terminal device 20. The first communication unit 22 of the first terminal device 20 requests the information processing system 50 for a group management screen. The group management screen is, for example, a screen that displays a list of users belonging to the tenant and accepts registration to the group.

S6: The fifth communication unit 52 of the information processing system 50 receives the request on the group management screen, and the license management unit 55 or the like determines whether the group management function can be used by the tenant manager. The details of this determination will be described later.

S7: If available, the fifth communication unit 52 of the information processing system 50 transmits the screen information of the group management screen to the first terminal device 20. The first communication unit 22 of the first terminal device 20 receives the screen information of the group management screen, and the display control unit 23 displays it on the display 506.

S8: If it is not available, the fifth communication unit 52 of the information processing system 50 transmits to the first terminal device 20 that there is no usage authority. The first communication unit 22 of the first terminal device 20 receives that there is no usage authority, and the display control unit 23 displays it on the display 506.

In the process of FIG. 9, after the first terminal device 20 requests the group management screen from the information processing system 50, the information processing system 50 determines whether the tenant manager can use the group management function.

However, for example, when the common function is a function for linking with an external service, the tenant administrator needs to set the external service to be linked in advance from the tenant setting screen, so when the tenant administrator opens the tenant setting screen, , The information processing system 50 determines whether or not the tenant manager can use the function of linking with the external service. As a result, if it is available, the information processing system 50 displays a screen in which the tenant administrator sets the cooperation setting with the external service, and if it is not available, it does not display it. In this way, the determination as to whether or not to use the common function is performed not only when the common function is used but also when the common function is set.

Similarly, in FIG. 9, before the first terminal device 20 requests the information processing system 50 for the group management screen, the information processing system 50 determines whether the tenant manager can use the group management function and cannot use it. In that case, the tenant manager may hide the button or the like for requesting the group management screen.

In this way, since the tenant administrator can execute only the common function without executing the application, it is determined whether or not there is a right to use the common function when the common function is executed or set. In addition, like the user, the right to use the common function may be determined when the application is executed.

FIG. 10 shows an example of the license definition creation screen 330. The license definition creation screen 330 has a license definition ID column 331, an application column 332, a unit price column 333, and an available common function selection column 334. The license definition ID column 331, the application column 332, the unit price column 333, and the available common function selection column 334 correspond to the items of the license definition ID, the application, the unit price, and the available common function in Table 1, respectively.

A value may be automatically set in the license definition ID field 331, or an arbitrary value may be set by the product designer. If there are duplicates, you will be prompted to re-enter. A list of applications handled by the product designer can be displayed in the application column 332, and the product designer selects an application to be registered in the license definition from the list. You can select multiple apps. The product designer can set an arbitrary unit price in the unit price column 333. You may select from the list. A list of common functions is displayed in the available common function selection field 334. Since the common functions are fixed, a predetermined number of common functions are displayed regardless of the application selected in the application field. In FIG. 10, the common functions of "group management" and "external service Y" are selected from the four common functions.

In FIG. 10, the product designer defines a license that allows Application B to be used at a unit price of 2,000 yen / month, and when the tenant administrator purchases this license, the group management function and the external service Y are available as common functions. It is in the state where the authentication function can be used.

FIG. 11 shows an example of the license purchase screen 340. The license purchase screen 340 displays each item of the application 341, the unit price 342, and the available common function 343 in a table shape. The values in the table are the values registered in the license definition information in Table 1. In FIG. 11, Application A and Application B are selected (checkmarked).

Assuming that the tenant ID to which the tenant administrator who displayed the license purchase screen 340 on the first terminal device 20 belongs is "11111111", the tenant administrator purchases the application shown in FIG. 11 to obtain the license in Table 2. Information is available.

<User use of the app>
A process when the user uses the application will be described with reference to FIG. FIG. 12 is an example of a sequence diagram for explaining the processing when the application is used. The processing of steps S11 to S14 may be the same as that of steps S1 to S4 of FIG.

S15: The user operates the second terminal device 30 (or the electronic device 10 may be used) to communicate the second terminal device 30 with the information processing system 50. The icon of the application for which the user has the right to use is displayed on the home screen. When the user inputs the execution of the application, the operation reception unit 34 accepts the input.

S16: It is assumed that one of the processes of this application is uploading to the external storage X. Therefore, the second terminal device 30 requests the information processing system 50 to upload a file to the external storage X. In this way, the general user is determined whether or not he / she has the right to use the common function when the application is executed.

The user has already logged in to the information processing system 50, and the tenant ID and the like have been specified.

S17: The fifth communication unit 52 of the information processing system 50 receives a file upload request to the external storage X. Then, the license management unit 55 determines whether or not the user has a license for the common function to be uploaded to the external storage X. Details will be described later.

S18: When the common function is available, the application execution unit 61 of the information processing system 50 uploads the file to the external storage X.

S19: The fifth communication unit 52 of the information processing system 50 transmits the upload success to the second terminal device 30. The second communication unit 32 of the second terminal device 30 receives the upload success.

S20: When the common function is not available, the fifth communication unit 52 of the information processing system 50 transmits to the second terminal device 30 that there is no usage authority. The second communication unit 32 of the second terminal device 30 receives that there is no usage authority.

S21: When the common function is available, the display control unit 33 of the second terminal device 30 displays the upload success.

S22: When the common function is not available, the display control unit 33 of the second terminal device 30 displays that there is no usage authority.

In FIG. 12, it is assumed that the user can select the application to be uploaded to the external storage X, that is, the icon of the application is displayed. As a situation where the common function cannot be used even though the application can be used, there is a case where the application uploads to a plurality of external storages X and Y. The common function of the external storage Y is attached to the license of this application, but if the common function is not attached to the external storage X, the common function cannot be used even though the application can be used.

If the user does not have any common function for uploading to the external storage, it is possible to control that the information processing system 50 does not display the application on the home screen.

<Judgment of common functions in information processing systems>
FIG. 13 is an example of a flowchart showing a procedure in which the information processing system 50 determines the presence or absence of a common function.

The license management unit 55 acquires the tenant ID of the logged-in tenant administrator or user from the user information storage unit 593. Then, the license definition ID valid for this tenant ID is acquired from the license information storage unit 592 (S101).

Next, the license definition management unit 54 acquires the license definition of the license definition ID acquired in step S101 from the license definition information storage unit 591 (S102).

The license management unit 55 acquires the common function of the license definition acquired in step S102 (S103).

The license management unit 55 determines whether or not the common function (common function requested to be used) that the tenant administrator or the user intends to use is included in the common function acquired in step S103 (S104).

If it is included, the license management unit 55 determines that the common function can be used, and in this case, the application execution unit executes the common function (S105).

If it is not included, the license management unit 55 determines that the common function cannot be used and restricts the use of the common function (S106). For example, it is judged that it cannot be used.

As described above, in the present embodiment, it is possible to determine whether or not there is a license for the common function when the common function is used (in the case of the tenant administrator) or when the application is executed (in the case of the tenant administrator or the user).

<Main effect>
As described above, in the present embodiment, the information processing system 50 is common because the license definition information managed by the information processing system 50 is associated with the common functions that can be used by the license of this application. The use of common functions can be restricted depending on the presence or absence of functions.

<Other application examples>
Although the best mode for carrying out the present invention has been described above with reference to examples, the present invention is not limited to these examples, and various modifications are made without departing from the gist of the present invention. And substitutions can be made.

For example, in the present embodiment, the limitation of common functions has been described by taking a Web service related to the use of an application as an example, but it can also be applied to tenant management in a general Web service.

It is also possible to limit common functions in communication infrastructure such as video conferencing systems. The common function (convenient function) in this case is, for example, a function in which the user of each base changes the page of the material.

For example, the configuration example shown in FIG. 5 is for facilitating the understanding of processing by the first terminal device 20, the second terminal device 30, the third terminal device 40, the electronic device 10, and the information processing system 50. , It is divided according to the main functions. The present invention is not limited by the method of dividing the processing unit or the name. The processing of the first terminal device 20, the second terminal device 30, the third terminal device 40, the electronic device 10, and the information processing system 50 can be divided into more processing units according to the processing content. .. It is also possible to divide one processing unit so as to include more processing.

Also, the group of devices described in the examples merely represents one of a plurality of computing environments for implementing the embodiments disclosed herein. In certain embodiments, the information processing system 50 includes a plurality of computing devices, such as a server cluster. The plurality of computing devices are configured to communicate with each other via any type of communication link, including networks, shared memory, and the like, and perform the processes disclosed herein.

Further, the information processing system 50 can be configured to share the disclosed processing steps, such as FIGS. 9 and 12, in various combinations. For example, a process executed by a predetermined unit can be executed by a plurality of information processing devices included in the information processing system 50. Further, the information processing system 50 may be integrated into one server device or may be divided into a plurality of devices.

Each function of the embodiment described above can be realized by one or more processing circuits. Here, the "processing circuit" in the present specification is a processor programmed to execute each function by software such as a processor implemented by an electronic circuit, or a processor designed to execute each function described above. It shall include devices such as ASIC (Application Specific Integrated Circuit), DSP (Digital Signal Processor), FPGA (Field Programmable Gate Array) and conventional circuit modules.

1 Service provision system 10 Electronic equipment 20 First terminal device 30 Second terminal device 40 Third terminal device 49 Information processing device 50 Information processing system

Japanese Unexamined Patent Publication No. 2019-61383

Claims (12)

An information processing system that permits the use of the application according to the license for using the application.
When the license definition information that defines the common functions that can be used by the license does not define that the common functions are available, it is characterized by having a license management unit that restricts the use of the common functions. Information processing system. The information processing system according to claim 1, wherein when the license definition information defines that the common function can be used, the license management unit permits the use of the common function. The information processing system according to claim 1 or 2, wherein the common function is a function used by a plurality of the applications. The information processing system according to claim 1 or 2, wherein the common function is a function used independently of the application. The information processing system according to claim 3 or 4, wherein the common function is a part of all the common functions except an essential function. Any of claims 1 to 5, wherein the terminal device has a license definition management unit that transmits screen information for displaying the application and common functions that can be used by purchasing a license for the application to the terminal device. The information processing system according to item 1. The license definition information is associated with the common function available for the license.
When the execution of the application is requested, the license management unit determines whether or not the common function used in the application is registered in the license definition information.
The information according to claim 1 or 2, wherein when the execution of the common function is requested, the license management unit determines whether or not the common function is registered in the license definition information. Processing system. User information in which user identification information and tenant identification information are associated,
License information in which the tenant identification information and the license definition identification information are associated with each other,
It manages the identification information of the license definition and the license definition information associated with the common function.
The license management unit identifies the identification information of the tenant to which the logged-in user belongs from the user information.
The identification information of the license definition associated with the identification information of the specified tenant is specified from the license information, and the identification information is specified.
The common function associated with the identified identification information of the license definition is specified from the license definition information, and the common function is specified.
The information processing system according to claim 7, wherein it is determined whether or not the specified common function includes the common function requested by the user. The information processing system according to any one of claims 1 to 8, wherein the common function is a function of linking with an external storage or a function of linking with authentication by an external service. The information processing according to any one of claims 1 to 8, wherein the common function is a user synchronization function with user management by an external service, or a group management function for grouping a plurality of users. system. A system having an information processing system that permits the use of the application according to a license for using the application and a terminal device that communicates with the information processing system.
If the license definition information that defines the common functions that can be used by the license does not define that the common functions are available, it has a license management unit that restricts the use of the common functions.
The terminal device is
A system characterized in that the information processing system is required to use the application or the common function. It is a usage restriction method performed by an information processing system that permits the use of the application according to the license for using the application.
A usage restriction method characterized by restricting the use of the common function when the license definition information in which the common function that can be used by the license is defined does not define that the common function can be used. ..

Images