JP2023029480A - Image processing apparatus, control method thereof, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a mechanism for reducing user operations related to authentication, by suitably requesting setting of authorization information according to a setting state of the authorization information for user authorization and thereby enhancing security.

SOLUTION: There is provided an image processing apparatus which stores setting information per user on whether or not to force the user to set authorization information. Additionally, in the image processing apparatus, when receiving a login request from a user and in the case that the stored setting information indicates forced setting of authorization information, a setting screen for setting authorization information is displayed on a display part to cause the user to set authorization information. Further, the image processing apparatus executes login processing according to a setting state of the authorization information for the user.

SELECTED DRAWING: Figure 11

COPYRIGHT: (C)2023,JPO&INPIT

Description

The present invention relates to an image processing apparatus, its control method, and a program.

As an image processing device, an MFP (Multi Function Peripheral) is known which includes an image reading device, a printing device, and a communication device, and has image processing applications such as copying, printing, and transmission of scanned images. Such an MFP is generally used by a plurality of users, and is provided with a user authentication function for personalizing by restricting available functions for each authenticated user. That is, in the MFP, a password (personal identification number) is set for each user for the MFP, and user authentication is performed by requesting input of the password when the user logs in.

Also known is a simple login function, in which an icon of a registered user is displayed on the menu screen of the MFP or the like, and a login screen customized for the user is displayed when the icon is selected. . The simple login function does not require the input of a password, and the user can log in to the MFP only by pressing an icon associated with the user. Japanese Patent Application Laid-Open No. 2002-200003 discloses a method of automatically registering a user by using a job owner name added to a print job instructed to print from a PC as a user ID for identifying an MFP user, as one function of the simple login function. Proposed.

JP 2012-254618 A

However, the conventional technology described above has the following problems. In the conventional technology described above, in a login method in which a user is selected from a user selection screen and then logged in to an information processing device, control is assumed in which each user must uniformly enter a password in order to log in. do not have. On the other hand, if the password input is required, the password registration work for each user becomes essential, and it becomes necessary to require all users to perform a troublesome operation. Therefore, when the input of a password is required, it is an issue to provide a method for easily performing registration work and the like. In addition, in the above simple login function, a user who has a password set is requested to enter a password at the time of login, but a user who has not set a password is not requested to enter a password. to allow login. Therefore, there is room for improvement in security with the current simple login function.

SUMMARY OF THE INVENTION The present invention has been made in view of the above problems. An object is to provide a mechanism that reduces user operations.

The present invention relates to an image processing apparatus comprising storage means for storing setting information as to whether or not to force setting of authentication information for each user, acceptance means for accepting a login request from a user, and If the setting information stored in the storage means indicates that the setting of the authentication information is compulsory, a setting screen for setting the authentication information is displayed on the display unit to prompt the user to set the authentication information. and authentication means for executing login processing according to the setting status of the authentication information in the user.

According to the present invention, security can be improved and user operations related to authentication can be reduced by appropriately requesting the setting of authentication information in user authentication according to the setting status of the authentication information.

1 is a system configuration diagram related to an MFP 101 according to one embodiment; FIG. 2 is a block diagram showing the hardware configuration of the MFP 101 according to one embodiment; FIG. 2 is a block diagram showing the software configuration of the MFP 101 according to one embodiment; FIG. FIG. 4 is a diagram showing an example of user management in a user authentication unit 302 according to one embodiment; 4 is a flowchart of user authentication according to one embodiment; FIG. 4 is a diagram showing an example of a user authentication screen according to one embodiment; FIG. 4 is a diagram showing an example of a DB of personal identification number/password operation settings according to an embodiment; FIG. 4 is a diagram showing an example of a password setting UI according to an embodiment; A diagram showing the flow of automatic user creation by inputting a print job according to an embodiment. FIG. 10 is a diagram showing an example of a table for managing whether or not registration is permitted without setting a personal identification number for each registration entity according to an embodiment; 10 is a flow chart for checking whether a required item is checked for a personal identification number at the time of user registration according to an embodiment.

An embodiment of the present invention is shown below. The specific embodiments described below may be helpful in understanding various concepts such as broader, middle and narrower concepts of the present invention. Moreover, the technical scope of the present invention is established by the claims and is not limited by the following individual embodiments.

<System configuration>
An embodiment of the invention is described below. First, referring to FIG. 1, the system configuration of this embodiment will be described. The system includes an MFP (Multi Function Peripheral) 101, which is an example of an image processing device, and a PC (Personal Computer) 102, which is an external device. These devices are connected via LAN 100 so as to be able to communicate with each other. In this embodiment, the system configuration includes one MFP 101 and one PC 102, but this is merely an example and is not intended to limit the present invention. For example, multiple MFPs and PCs may be included, and other devices may be included.

The MFP 101 includes a printer, a scanner, and the like, and can print, copy, scan, and store and transmit scanned documents. The PC 102 can access the MFP 101 and transmits print jobs to the MFP 101 via corresponding drivers.

<Hardware configuration>
Next, the hardware configuration of the MFP 101 according to this embodiment will be described with reference to FIG. The MFP 101 includes a control unit 200 , an operation unit 209 , a printer 210 and a scanner 211 . The control unit 200 also includes a CPU 201 , a ROM 202 , a RAM 203 , an HDD 204 , an operation unit I/F 205 , a printer I/F 206 , a scanner I/F 207 and a network I/F 208 .

A control unit 200 including a CPU 201 controls the operation of the entire MFP 101 . The CPU 201 reads a control program stored in the ROM 202 and performs various controls such as document reading and image data transmission. A RAM 203 is used as a main memory of the CPU 201 and a temporary storage area such as a work area. The HDD 204 stores image data and various programs.

An operation unit I/F 205 connects an operation unit 209 functioning as a reception unit and the control unit 200 . A printer I/F 206 connects the printer 210 and the control unit 200 . Image data to be printed by the printer 210 is transferred from the control unit 200 via the printer I/F 206 and printed on a recording medium by the printer 210 . A scanner I/F 207 connects the scanner 211 and the control unit 200 . A scanner 211 reads an image on a document to generate image data, and inputs the data to the control unit 200 via the scanner I/F 207 . Network I/F 208 connects control unit 200 (MFP 101 ) to LAN 100 . A network I/F 208 transmits and receives various types of information to and from external devices on the LAN 100 (for example, receives print jobs from the PC 102).

<Software configuration>
Next, the software configuration of the MFP 101 according to this embodiment will be described with reference to FIG. The MFP 101 includes a screen display management unit 301 , a user authentication unit 302 , a copy 310 , a print 311 , and a scan and send 312 as a software configuration.

A screen display management unit 301 controls screens displayed on the operation unit 209 . A user authentication unit 302 manages a list of users who can use the MFP 101 and provides a UI for user authentication. User authentication unit 302 has a simple login function. The simple login function is to display an icon for each user on the operation unit 209 as shown in FIG. 6, which will be described later. screen) is displayed. If the selected user has set a password (personal identification number), the user is requested to enter the password. In other words, a user for whom no password is set is permitted to log in without requesting the input of a password. Therefore, the simple login function according to the present embodiment makes it possible to set whether to request the user to enter the password regardless of whether the user's password is set.

In addition, the simple login function includes an automatic registration function for automatically registering login users. The automatic registration function is a function of automatically registering a user corresponding to a user ID included in the job as a login user of the simple login function when a job is input to the image processing apparatus. Details of the automatic registration function will be described later with reference to FIGS.

According to this embodiment, when a user is newly registered by the automatic registration function, the user can be newly registered without setting a password even if the password (personal identification number) setting in the simple login function is ON. allow. Then, when the new user logs in, the user is requested to set a password (S505 in FIG. 5). In addition, even when the administrator newly registers a user, the user can be newly registered without setting a password. As with the auto-registration feature, when the new user logs in for the first time, the user is required to set a password. On the other hand, when a user who is not an administrator manually registers a new user, the user is requested to set a password together with the user registration. As described above, according to the present invention, when a new user registration method is registration by an administrator or automatic registration, password setting is not required at the timing of new user registration. Password setting is also required at the timing of user registration.

Copy 310 , print 311 , and scan and send 312 are examples of applications that operate on the MFP 101 . A copy 310 is an application that executes printing according to image data obtained by reading a document. The print 311 is an application that accepts and holds print jobs input from the PC 102, displays a list of jobs input by a logged-in user, prompts the user to confirm the contents, and prints the jobs. A scan and send 312 is an application for sending an image scanned by the scanner 211 to the outside by e-mail or the like.

<User table>
Next, a user table 400 managed by the user authentication unit 302 will be described with reference to FIG. The user table shown in FIG. 4 is an example and is not intended to limit the present invention.

The user table 400 defines information such as user ID (uid), password, password, authority, e-mail address (e-mail), and last login date and time for each registered user. "uid" is a user name for uniquely identifying a user. “PIN code” is a character string consisting of only numbers used for user authentication when using MFP 101 via operation unit 209 . "Password" is a character string used for user authentication when using MFP 101 via a network. Although different terms are used here from personal identification number and password, they are substantially the same and are authentication information for performing user authentication. The settings for the operation of personal identification numbers and passwords are managed in a setting DB as shown in FIG.
“Authority” is information for controlling whether or not a function that can be operated by a user is permitted. An administrator or general is registered in the information of "Authority". "e-mail" indicates an electronic mail address. "Last login date and time" indicates the date and time when the corresponding user last logged in.

As shown in FIG. 4, the user with the user ID "suzuki" does not have a password set and has not yet logged in, so the "last login date and time" is blank.

<Procedure for user authentication>
Next, a processing procedure for user authentication according to this embodiment will be described with reference to FIG. The processing described below is realized, for example, by the CPU 201 reading a control program stored in the ROM 202 or HDD 204 into the RAM 203 and executing it.

In step S<b>501 , upon receiving a login request to the MFP 101 from the user, the screen display management unit 301 displays an authentication screen provided by the user authentication unit 302 on the operation unit 209 . Note that this screen may be displayed on the display unit of the PC 102 when the user accesses the MFP 101 via the PC 102 which is an external device. FIG. 6 shows an example of an authentication screen displayed on the operation unit 209 of the MFP 101 according to this embodiment. On the user authentication screen 600, buttons displaying user IDs of users managed by the user authentication unit 302 are displayed in a selectable manner. The user authentication screen 600 is created based on the information in the user table 400 shown in FIG. Therefore, buttons 601 to 603 corresponding to user IDs registered in the user table 400 are displayed.

In step S 502 , the user authentication unit 302 accepts user selection of buttons 601 to 603 via the user authentication screen 600 displayed on the operation unit 209 . If the button is selected in S502, the process advances to S503, and the user authentication unit 302 determines whether or not the password has not been set. Specifically, if the user's personal identification number corresponding to the selected button is not defined in the user table 400, the user authentication unit 302 determines that the personal identification number has not been set. If the password has not been set, the process proceeds to S504, and if the password has been set, the process proceeds to S508.

In S504, the user authentication unit 302 determines whether or not to force a user who has not set a personal identification number to set a personal identification number. Specifically, the user authentication unit 302 refers to the setting table 700 shown in FIG. 7 in order to determine whether or not to force the setting of the personal identification number. In the setting table 700, values are set for each of a plurality of setting items 701-704. A setting item 701 is used to set whether or not to force setting of a personal identification number. A setting item 702 is used to set whether or not to allow the use of the default password. A setting item 703 sets the minimum number of characters for a password. In the example shown in FIG. 7, 8 characters are set. A setting item 704 is used to set the valid period of the password. Note that these setting information can be performed by, for example, an administrator, and may be performed in advance by displaying a screen for accepting these settings on the operation unit 209 . Although the setting screen is not shown, any screen may be used as long as it is possible to select whether or not to force the setting of the authentication information (personal identification number or password). Therefore, the operation unit 209 is an example of setting means. Moreover, it is desirable that these setting information are set in advance as default values when the product is shipped from the factory. In the example shown in FIG. 7, 90 days is set. The user authentication unit 302 refers to the setting item 701 and determines whether or not the setting is made to force the setting of the personal identification number. If the setting of the personal identification number is to be forced, the process proceeds to S505; otherwise, the process proceeds to S507.

In S507, the user authentication unit 302 determines whether or not the login is the first time. Specifically, if the last login date and time of the user is not defined in the user table 400, the user authentication unit 302 determines that it is the first login and proceeds to step S505. It is determined that it is not, and the process proceeds to S508.

In step S<b>505 , the screen display management unit 301 displays a password setting screen on the operation unit 209 . FIG. 8 shows a personal identification number setting screen 800 displayed on the operation unit 209 . The password setting screen 800 includes a password input area 801 , a cancel button 802 and an OK button 803 . A personal identification number is entered in the personal identification number input area 801 by user input via a hardware key (not shown) or the like.
When the cancel button 802 is operated with the password entered in the password input area 801 , the password is not registered and the screen of the operation unit 209 returns to the screen before displaying the password setting screen 800 . On the other hand, when the OK button 803 is operated with the password entered in the password input area 801, the entered password is confirmed. According to this embodiment, when logging in for the first time or the like, the personal identification number setting screen 800 is displayed in S505 to request setting of a personal identification number (password). As a result, even if the registrant omits the setting of the personal identification number and the like during user registration in the automatic registration with the simple login function described later, the setting of the personal identification number and the like can be requested at the time of subsequent login (S505). ).

Returning to the description of FIG. In S506, the user authentication unit 302 stores the personal identification number received via the personal identification number setting screen 800 in the user table 400, and the process proceeds to S508. If it is determined in S507 that the login is not the first time and the process proceeds to S508, the login process does not request the input of the password. In such a case, the personal identification number is not set at the first login, and the input of the personal identification number and password is not required at subsequent logins. It should be noted that the present invention is not limited to such control, and control may be performed to prohibit the user from setting a personal identification number or the like at the time of initial login.

When forcing the setting of a personal identification number (password), the personal identification number setting screen 800 is controlled so that the "OK" button 803 cannot be selected when the personal identification number is not entered in the personal identification number input area 801. You may

Finally, in S508, the user authentication unit 302 executes login processing according to the set personal identification number, and ends the processing. The user authentication unit 302 requests the user to input authentication information such as a set personal identification number during the login process. In the present embodiment, when the password setting is not forced, it is determined whether or not it is the first login (S507), and the process is branched, but the present invention is not limited to this. For example, setting and control may be provided so as to proceed directly to the login processing of S508 when the setting of the personal identification number is not compulsory. In this case, the user authentication unit 302 does not request entry of a personal identification number (password) during login processing. In addition, the user authentication unit 302 may perform control so as not to permit the user's login if a password or the like is not set even though it is essential to set the password during the login process. Note that such control may be switched according to setting information.

<User registration when submitting a print job>
Next, user registration at the time of inputting a print job according to the present embodiment will be described with reference to FIGS. 9 to 11. FIG. The user authentication unit 302 provides a plurality of methods for user registration. For example, the user authentication unit 302 provides a function of performing user registration via an interface displayed on the operation unit 209 or an interface provided via the Web (input from the operation unit UI/WebUI). As functions included in the simple login function, the user authentication unit 302 performs user registration by importing user data, and automatically logs in using user information included in a print job received from an external device such as the PC 102 or the like. provide the ability to register with

Below, the control and processing procedure of the automatic registration function in the simple login function will be described in detail. According to this embodiment, it is possible to change the subjects that can be registered for each registration method. For example, all users can register themselves by "input from the operation unit UI/WebUI". Also, a user having the authority of "administrator" can perform user registration by "input from the operation unit UI/WebUI" and "import of user data". “Automatic registration using user information included in the print job” is automatically performed by the user authentication unit 302 without the user performing an explicit registration operation. A registration procedure when a print job is submitted will be described later with reference to FIG.

Here, "automatic registration using user information included in a print job" will be described with reference to FIG. A print job submitted from the PC 102 to the MFP 101 is provided with submitter information. The printer 311 that has received the print job notifies the user authentication unit 302 of the submitter information before processing the held print. The user authentication unit 302 registers the user using the input person information received as a user ID. At the time of user registration, items (essential items) that do not allow duplication with other users are checked (for example, user ID).

In the setting table 700 shown in FIG. 7, when the password setting is set to be mandatory, the password is an essential item. However, the personal identification number should be set by the user. Therefore, according to the present embodiment, the user authentication unit 302 controls whether or not to require the provision of a personal identification number at the time of registration operation for each registration subject according to the table 1000 shown in FIG. As shown in FIG. 10, the types of registration subjects include "administrator", "general user", and "system". In FIG. 10, when the "administrator" and "system" are the registrants, automatic registration is permitted without setting a password, and when the "general user" is the registrant, Automatic registration is disabled. Note that these settings can be made by, for example, an administrator, and are made in advance by displaying a screen for accepting these settings on the operation unit 209 .

A processing procedure for automatic registration of the simple login function when a print job is received in this embodiment will be described with reference to FIG. The processing described below is realized, for example, by the CPU 201 reading a control program stored in the ROM 202 or HDD 204 into the RAM 203 and executing it.

In S1101, the user authentication unit 302 accepts a user registration request. Subsequently, in S1102, the user authentication unit 302 determines whether or not the registered subject requires setting of a personal identification number. For example, the user authentication unit 302 refers to the authority of the user and the setting tables 700 and 1000 to determine whether or not the user is required to set a personal identification number. If it is not necessary to set a personal identification number (if the registered subject is "administrator" or "system"), the process proceeds to S1103; if necessary (if the registered subject is "general user"), the process proceeds to S1104.

In step S1103, the user authentication unit 302 automatically registers the user in the user table 400 as a new registered user using the user information included in the print job without setting a password, and ends the process. do. On the other hand, in S1104, the user authentication unit 302 executes error processing without registering the user, and terminates the process. In error processing, the PC 102 may be notified that the user corresponding to the user information included in the print job cannot be registered.

As described above, the image processing apparatus according to the present embodiment stores setting information as to whether to force setting of authentication information for each user. Further, when receiving a login request from a user, the image processing apparatus displays a setting screen for setting authentication information on the display unit if the stored setting information indicates that the setting of authentication information is forced. to let users set their credentials. Further, the image processing apparatus executes login processing according to the setting status of authentication information of the user. Furthermore, when automatically registering the simple login function when receiving a print job, the image processing apparatus controls whether or not to automatically register the user according to the authority of the user who is the subject of registration. As described above, according to the present embodiment, in user authentication, it is possible to appropriately request the setting of authentication information according to the setting status of the authentication information, thereby improving security and reducing user operations related to authentication. can do. Further, according to the present embodiment, even in the case of the simple login function, it is possible to force all users to set authentication information.

<Other embodiments>
The present invention supplies a program that implements one or more functions of the above-described embodiments to a system or device via a network or a storage medium, and one or more processors in the computer of the system or device reads and executes the program. It can also be realized by processing to It can also be implemented by a circuit (for example, ASIC) that implements one or more functions.

100: LAN, 101: MFP, 102: PC, 200: Control unit, 201: CPU, 202: ROM, 203: RAM, 204: HDD, 205: Operation unit I/F, 206: Printer I/F, 207: Scanner I/F, 208: Network I/F, 209: Operation unit 209, 210: Printer, 211: Scanner

The present invention is an image processing apparatus comprising a receiving unit for receiving a user operation on the image processing apparatus, a setting unit for setting to force setting of authentication information, and a setting unit forcing the setting of the authentication information. and a control unit that performs control to display a setting screen for setting the authentication information when the user operation is accepted in a situation where the authentication information is set to be performed.

Claims (12)

An image processing device,
a storage means for storing setting information as to whether or not to force setting of authentication information for each user;
receiving means for receiving a login request from a user;
When the login request from the user is accepted by the acceptance means, and the setting information stored in the storage means indicates that the setting of the authentication information is forced, a setting screen for setting the authentication information is displayed on the display unit. a control means for displaying and allowing the user to set the authentication information;
and authentication means for executing a login process according to the setting status of the authentication information of the user. further comprising registration means for automatically registering a user according to user information included in the print job when a print job for printing in the image processing apparatus is received from an external device;
2. The image processing apparatus according to claim 1, wherein said registration means controls whether or not to register said user according to the authority of said user. The storage means further stores information as to whether or not automatic registration by the registration means is permitted for each user authority,
The registration means automatically registers the user with respect to authority of the user if the information stored in the storage means permits the automatic registration; 3. The image processing apparatus according to claim 2, wherein automatic registration is not performed. Even if the setting information stored in the storage means does not indicate that the setting of the authentication information is compulsory, the control means displays the setting screen when the user logs in for the first time. 4. The image processing apparatus according to claim 2, wherein the authentication information is displayed on a display unit to prompt the user to set the authentication information. 4. The image processing apparatus according to claim 3, wherein the authority of the user is set according to the type of user. 3. The receiving unit displays an icon for logging in for each registered user on the display unit, and receives a login request from a corresponding user when the icon is selected. 6. The image processing apparatus according to any one of 1 to 5. 7. The image processing according to any one of claims 1 to 6, wherein said authentication means requests a user to whom said authentication information is set to input said authentication information in said login processing. Device. 8. The image processing apparatus according to claim 7, wherein said authentication means allows a user for whom said authentication information is not set to log in without requesting input of said authentication information in said login processing. . The authentication means does not permit login to a user for whom the authentication information is not set when the setting information stored in the storage means indicates that the setting of the authentication information is compulsory. 8. The image processing apparatus according to claim 7. 10. The image processing apparatus according to any one of claims 1 to 9, further comprising setting means for setting whether or not to force setting of authentication information for each user. A control method for an image processing apparatus comprising storage means for storing setting information indicating whether or not to force setting of authentication information for each user, comprising:
a receiving step in which the receiving means receives a login request from a user;
When the control means receives the login request from the user in the receiving step, if the setting information stored in the storage means indicates that the setting of the authentication information is forced, a setting screen for setting the authentication information is displayed. is displayed on the display unit and the user sets the authentication information;
and an authentication step of executing a login process according to the setting status of the authentication information of the user. A program for causing a computer to execute each step in a control method for an image processing apparatus having storage means for storing setting information as to whether or not to force setting of authentication information for each user, the control method comprising:
a receiving step in which the receiving means receives a login request from a user;
When the control means receives the login request from the user in the receiving step, if the setting information stored in the storage means indicates that the setting of the authentication information is forced, a setting screen for setting the authentication information is displayed. is displayed on the display unit and the user sets the authentication information;
A program, wherein authentication means executes an authentication step of executing a login process according to the setting status of the authentication information of the user.

Images