JP4162554B2 - Image forming apparatus, usage authentication information issuing method, and usage authentication information issuing system - Google Patents

Description

  The present invention relates to an image forming apparatus, a usage authentication information issuing method, and a usage authentication information issuing system, and more particularly to an image forming apparatus, a usage authentication information issuing method, and usage authentication information that execute processing in response to a request from an external network device. Regarding the issuing system.

  In recent years, there has been known an image forming apparatus (hereinafter referred to as a multifunction peripheral) in which the functions of each apparatus such as a printer, a copy, a facsimile, and a scanner are housed in one casing. This multi-function apparatus is provided with a display unit, a printing unit, an imaging unit, and the like in one casing, and four types of software corresponding to a printer, a copy, a facsimile, and a scanner, respectively. Operates as a copy, facsimile and scanner.

  Such a compound machine is connected to a network device via a network, for example, and executes a predetermined process in accordance with an instruction from the network device. For example, a multi-function apparatus that stores document files as stored documents in a document management database (hereinafter referred to as document management DB) outputs the stored documents stored in the document management DB in response to an instruction from the network device. The multi-function peripheral outputs an accumulated document stored in the document management DB using an output function (printing function or the like). In order to cope with security problems, the multi-function apparatus often sets a password for each user who uses a stored document stored in the document management DB or a service provided to a network device.

  For example, when using a service provided by the multi-function peripheral, the network device transmits a user ID of a user who uses the desired service and a password that proves the right to use the service to the multi-function peripheral. The fusion machine provided services to network devices after password authentication.

When outputting the stored document stored in the document management DB of the multifunction machine, the network device transmits a document ID for identifying the desired stored document and a password certifying the authority to use the stored document to the multifunction machine. To do. After performing password authentication, the multi-function peripheral reads the stored document corresponding to the document ID from the document management DB and outputs the stored document. Patent Document 1 describes an example of a fusion machine as described above.
JP 2002-84383 A

  For example, if password authentication is required for each user who uses the service provided by the MFP, the same authentication process must be repeated when the same service is used repeatedly. There was a problem of duplication.

  If a password is set for each stored document stored in the document management DB of the multi-function peripheral, the same authentication process must be repeated when the same stored document is repeatedly output. There was a problem of overlapping.

  Furthermore, since highly confidential information such as a user ID, document ID, password, and usage authentication information is transmitted and received between the fusion machine and the network device via the network, there is a problem that network security must be strengthened. there were.

  The present invention has been made in view of the above points. An image forming apparatus, a usage authentication information issuing method, and a usage authentication information issuing system capable of reducing useless authentication processing and enhancing network security. The purpose is to provide.

Therefore, in order to solve the above problems, the present invention provides an image forming apparatus having hardware resources used in image forming processing, a program for performing processing relating to image forming, and a document storage unit for storing stored documents. And receiving a session establishment request including authentication information from an external network device, and performing authentication using session establishment means for establishing a session with the network device, and authentication information included in the session establishment request. Upon successful completion of authentication by the authentication unit and the authentication unit, the session identification information of the session established with the network device, the identification information of the network device that has transmitted the session establishment request, the authenticated stored document Session information generating means for generating session information including identification information, and the session information Session information storage means for storing the session identification request response means for transmitting the session identification information to the network device as a response to the session establishment request, the session identification information from the network device, the identification information of the stored document, Receiving a request for acquiring usage authentication information for the stored document including proof information for certifying use authority of the stored document, and acquiring the session information corresponding to the session identification information included in the request for acquiring the usage authentication information as the session A network device that has transmitted the session establishment request included in the session information if the session information corresponding to the session identification information is stored in the session information storage unit; To obtain the identification information of If the determination result by the first session validity determination unit and the first session validity determination unit are the same as the identification information of the network device that has transmitted the use authentication information acquisition request for the product document, the storage is performed. A first stored document authenticated determination unit for determining whether the identification information of the stored document included in the acquisition request for the usage authentication information for the document is included as the identification information of the authenticated stored document; and the first stored document authentication If it is determined that the identification information of the stored document is not included as the identification information of the authenticated stored document by the completion determination unit, the identification information of the stored document included in the use authentication information acquisition request for the stored document And authentication information that proves the authority to use the stored document, and if the authentication ends normally, The identification information of the stored document included in the authentication information acquisition request is added to the session information as the identification information of the authenticated stored document, and then usage authentication information for the stored document is generated and transmitted to the network device. A request for acquiring identification information of the stored document including the use identification information generation and transmission means and the session identification information and the usage authentication information for the stored document from the network device, and included in the acquisition request for the identification information of the stored document A second search unit that searches the session information storage unit for the session information corresponding to the session identification information, and the session information corresponding to the session identification information is stored in the session information storage unit, The network that sent the session establishment request included in the session information Second session validity determining means for acquiring identification information of a network device and determining whether the identification information of the network device that transmitted the identification information acquisition request of the stored document is the same, and determination by the second session validity determining means If the results are the same, the stored document identification information transmitting means for transmitting the stored document identification information included in the usage authentication information for the stored document to the network device, and the session identification information and the storage from the network device. Third search means for receiving a processing request for the stored document including document identification information and searching the session information storage means for the session information corresponding to the session identification information included in the processing request; and the session identification The session information corresponding to information is stored in the session information storage means. If there is, the identification information of the network device that has transmitted the session establishment request included in the session information is acquired, and it is determined whether the third session is the same as the identification information of the network device that has transmitted the processing request for the stored document. If the determination result by the determination unit and the third session validity determination unit are the same, whether the identification information of the stored document included in the processing request for the stored document is included as the identification information of the authenticated stored document When the second stored document authenticated determination unit and the second stored document authenticated determination unit determine that the identification information of the stored document is included as the identification information of the authenticated stored document, the storage And a process execution means for executing a process on the document .

  According to the present invention, session information of a session established with a network device and session identification information for identifying the session information are generated, and the session identification information is used as usage authentication information for a predetermined process. Therefore, it is possible to provide an image forming apparatus, a usage authentication information issuing method, and a usage authentication information issuing system that can reduce useless authentication processing and can enhance network security.

  As described above, according to the present invention, it is possible to provide an image forming apparatus, a usage authentication information issuing method, and a usage authentication information issuing system that can reduce useless authentication processing and can enhance network security.

  Next, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram of an embodiment of a compound machine according to the present invention. The multi-function machine 1 is configured to include a software group 2, a multi-function machine starting unit 3, and hardware resources 4.

  The compound machine starting unit 3 is executed first when the power of the compound machine 1 is turned on, and activates the application layer 5 and the platform 6. For example, the multi-function apparatus activation unit 3 reads the programs of the application layer 5 and the platform 6 from a hard disk device (hereinafter referred to as HDD) and transfers each read program to a memory area and activates it.

  The hardware resource 4 includes a plotter 11, a scanner 12, and other hardware resources 13 such as a facsimile. The software group 2 includes an application layer 5 and a platform 6 activated on an operating system (hereinafter referred to as OS) such as UNIX (registered trademark). The application layer 5 includes programs that perform processing unique to user services related to image formation such as printers, copies, faxes, and scanners.

  The application layer 5 includes a printer application 21 that is a printer application, a copy application 22 that is a copy application, a fax application 23 that is a fax application, a scanner application 24 that is a scanner application, and a web page application. WEB page application 25, a SOAP communication application 26 that is a simple object access protocol (hereinafter referred to as “SOAP”) communication application, and one or more shared functions (hereinafter referred to as “SF”) 28. 7 and a wrapping layer 8 comprising a WEB service function (hereinafter referred to as WSF) 27 provided between the WEB page application 25 and the SOAP communication application 26 and the SF 28. Including.

  The WSF 27 has an application program interface (hereinafter referred to as API) 51 that can receive a processing request from the WEB page application 25 or the SOAP communication application 26 by a predefined function. In addition, the SF 28 has an API 52 that makes it possible to receive a processing request from the WSF 27 using a predefined function.

  When the WSF 27 receives a processing request from the WEB page application 25 or the SOAP communication application 26 via the API 51, the WSF 27 selects the SF 28 according to the processing request. The WSF 27 transmits the processing request received via the API 51 via the API 52 to the SF 28 selected according to the processing request. When the SF 28 receives a processing request via the API 52, the SF 28 performs processing according to the processing request. For example, although the MFP 1 of FIG. 1 includes two SFs 28, one of the SFs 28 performs network service processing to be described later.

  Further, the platform 6 interprets a processing request from the application layer 5 and generates a hardware resource 4 acquisition request, and manages one or more hardware resources 4 to control the control service layer 9. A system resource manager (hereinafter referred to as SRM) 39 that arbitrates acquisition requests from the SRM 39 and a handler layer 10 that manages hardware resources 4 in response to the acquisition requests from the SRM 39. The platform 6 is configured to have an API 53 that can receive a processing request from the application layer 5 using a predefined function. The OS executes the software of the application layer 5 and the platform 6 in parallel as processes.

  The control service layer 9 includes a network control service (hereinafter referred to as NCS) 31, a delivery control service (hereinafter referred to as DCS) 32, an operation panel control service (hereinafter referred to as OCS) 33, a fax control service (hereinafter referred to as FCS) 34. , Engine control service (hereinafter referred to as ECS) 35, memory control service (hereinafter referred to as MCS) 36, user information control service (hereinafter referred to as UCS) 37, system control service (hereinafter referred to as SCS) 38, etc. The service module is configured to be included.

  The process of the NCS 31 provides a service that can be commonly used for applications that require network I / O. Data received from the network side according to each protocol is distributed to each application, or data from each application. Mediation when sending to the network side.

  For example, the NCS 31 controls data communication with a network device connected via a network by HTTP (HyperText Transfer Protocol Daemon) by HTTP (HyperText Transfer Protocol).

  The process of the DCS 32 performs control such as delivery of stored documents. The process of the OCS 33 controls an operation panel serving as information transmission means between the operator and the main body control. The FCS34 process provides APIs to perform fax transmission / reception using the PSTN or ISDN network from the application layer 5, registration / quotation of various fax data managed in the backup memory, fax reading, fax reception printing, etc. To do.

  The process of the ECS 35 controls engine units such as the plotter 11, the scanner 12, and the hardware resource 13. The process of the MCS 36 performs memory control such as acquisition and release of memory, use of the HDD, and compression and expansion of image data. The process of the UCS 37 manages user information. The process of the SCS 38 performs processing such as application management, operation unit control, system screen display, LED display, hardware resource management, interrupt application control.

  The SRM 39 process controls the system and manages the hardware resources 4 together with the SCS 38. For example, the process of the SRM 39 performs arbitration in accordance with an acquisition request from an upper layer that uses the hardware resources 4 such as the plotter 11 and the scanner 12, and performs execution control.

  Specifically, the process of the SRM 39 determines whether or not the requested hardware resource 4 is available (whether it is not used by another acquisition request). The higher layer is notified that the resource 4 is available. Further, the process of the SRM 39 performs scheduling for using the hardware resource 4 in response to an acquisition request from an upper layer, and the request contents (for example, paper conveyance and image forming operation by the printer engine, memory allocation, file generation, etc.) Has been implemented directly.

  The handler layer 10 includes a fax control unit handler (hereinafter referred to as FCUH) 40 that manages a fax control unit (hereinafter referred to as FCU), which will be described later, and an image that allocates memory to the process and manages the memory allocated to the process. A memory handler (hereinafter referred to as IMH) 41. The SRM 39, the FCUH 40, and the like make a processing request for the hardware resource 4 using the engine I / F 54 that transmits a processing request for the hardware resource 4 by a predefined function.

  With the configuration shown in FIG. 1, the multi-function apparatus 1 can centrally process processes commonly required for each application on the platform 6. Next, a hardware configuration of the multifunction machine 1 will be described.

  FIG. 2 is a hardware configuration diagram of an embodiment of the compound machine according to the present invention. The compound machine 1 has a controller 60, an operation panel 80, an FCU 81, and an engine unit 82. The controller 60 includes a CPU 61, a system memory 62, a north bridge (NB) 63, a south bridge (SB) 64, an ASIC 66, a local memory 67, an HDD 68, a network interface card (NIC) 69, a USB device 70, an IEEE 1394 device 71, and a Centronics 72. Have The operation panel 80 is connected to the ASIC 66 of the controller 60. Further, the FCU 81 and the engine unit 82 are connected to the ASIC 66 of the controller 60 via the PCI bus 83.

  In the controller 60, the local memory 67, the HDD 68, and the like are connected to the ASIC 66, and the CPU 61 and the ASIC 66 are connected via the NB 63 of the CPU chip set. The controller 60 corresponds to the case where the interface of the CPU 61 is not disclosed by connecting the CPU 61 and the ASIC 66 via the NB 63.

ASIC 66 and NB 63 are AGP (Accelerated
Graphics Port) 65 is connected. In this way, in order to control the execution of one or more processes forming the application 5 and the platform 6 in FIG. 1, the performance is degraded by connecting the ASIC 66 and the NB 63 via the AGP 65 instead of the low-speed PCI bus. It is preventing.

  The CPU 61 performs overall control of the compound machine 1. The CPU 61 activates and executes the NCS 31, DCS 32, OCS 33, FCS 34, ECS 35, MCS 36, UCS 37, and SCS 38 on the OS, and at the same time, the printer application 21 that forms the application 5, the copy application 22, the fax application 23, the scanner application 24, The web page application 25, WSF27, and SF28 are activated and executed.

  The NB 63 is a bridge for connecting the CPU 61, system memory 62, SB 64, ASIC 66, NIC 69, USB device 70, IEEE 1394 device 71, and Centronics 72. The SB 64, NIC 69, USB device 70, IEEE 1394 device 711, and Centronics 72 are connected to the NB 63 via the PCI bus 73. The SB 64 is a bridge for connecting the PCI bus 73 to the ROM, peripheral devices, and the like.

  The system memory 62 is a memory used as a drawing memory or the like of the multifunction machine 1. The local memory 67 is a memory used as a copy image buffer and a code buffer. The ASIC 66 is an IC for use in image processing having hardware elements for image processing. The HDD 68 is an example of a storage (auxiliary storage device) that stores image data, document data, programs, font data, forms, and the like.

  The NIC 69 is an interface device that connects the MFP 1 to a network. The USB device 70, the IEEE 1394 device 71, and the Centronics 72 are interfaces conforming to the respective standards. The operation panel 80 is an operation unit that accepts an input operation from an operator and performs display for the operator.

  The FCU 81 has a backup memory. The memory of the FCU 81 is used for temporarily storing facsimile data received when the power of the multi-function apparatus 1 is OFF, for example.

  Hereinafter, the usage authentication information issuing method realized by the multi-function apparatus 1 will be sequentially described with reference to the drawings. FIG. 3 is a functional configuration diagram of the multi-function apparatus for explaining the usage authentication information issuing method according to the first embodiment of the present invention. In the functional configuration diagram of FIG. 3, functional configurations that are not necessary for explanation are omitted.

  In FIG. 3, network devices 301a and 301b are connected to the multi-function apparatus 1 via a network 306 such as the Internet or a LAN. The multi-function device 1 provides various services to the network devices 301a and 301b. For example, when using a service provided by the MFP 1, the network devices 301a and 301b receive a session ID as service usage authentication information from the MFP 1, as described later, and provide the service using the usage authentication information. Receive.

  Further, the network devices 301a and 301b and the MFP 1 exchange data in, for example, an XML (eXtensible Markup Language) format. Note that the network devices 301a and 301b and the MFP 1 use a communication protocol standard called SOAP (Simple Object Access Protocol) as a data access protocol, for example.

  When the network device 301a uses the service provided by the MFP 1, the network device 301a proceeds to step S10. In step S10, the network device 301a issues a session establishment request between the network device 301a and the network service 303 to the network service 303 of the multi-function device 1 via the network 306 and the httpd 302 of the NCS 31. This session establishment request includes authentication information necessary for causing the network service 303 to issue use authentication information for a predetermined service. In step S10, the network device 301a can also specify the session expiration date.

  Progressing to step S11 following step S10, the network service 303 establishes a session between the network device 301a and the network service 303, and performs authentication using the authentication information included in the session establishment request. If the authentication ends normally, the network service 303 generates session information as shown in FIG. 4 and stores it in the session information DB 304. If the authentication does not end normally, the network service 303 does not generate session information. If the authentication does not end normally, the network service 303 may release the session established with the network device 301a.

  FIG. 4 is a configuration diagram of an example of session information. The session information in FIG. 4 includes a session ID, an IP address of the network device that has transmitted the request, an IP address of the multi-function peripheral that has received the request, and an expiration date.

  “Session ID” is an identifier for identifying session information. The “IP address of the network device that transmitted the request” is the IP address on the transmission side of the session establishment request. For example, in the case of FIG. 3, “IP address of the network device that transmitted the request” is the IP address of the network devices 301 a and 301 b that transmitted the session establishment request to the MFP 1. The “IP address of the MFP that has received the request” is the IP address on the receiving side of the session establishment request. For example, in the case of FIG. 3, “the IP address of the multi-function apparatus that has received the request” is the IP address of the multi-function apparatus 1 that has received the session establishment request from the network devices 301a and 301b.

  “Expiration date” is the expiration date of the session information. The “expiration date” may be updated each time a session ID is used, as will be described later. By updating the expiration date every time the session ID is used, the expiration date of the session information used before the expiration date can be extended.

  Then, the network service 303 transmits the session ID 305 to the network device 301a via the httpd 302 of the NCS 31 and the network 306 as a response to the session establishment request in step S11.

  Upon receiving the session ID 305 from the network service 303, the network device 301 a proceeds to step S 12, makes a desired processing request to the network service 303 of the multi-function device 1 via the network 306 and the httpd 302 of the NCS 31, and transmits the session ID 305.

  When the session ID 305 is received together with the processing request from the network device 301a, the network service 303 searches the session information DB 304 for session information corresponding to the received session ID 305. If session information corresponding to the session ID 305 is stored in the session information DB 304, the network service 303 considers that a session has been established between the network device 301a and the network service 303.

  Next, the network service 303 acquires “the IP address of the network device that transmitted the request” from the session information, and determines whether or not it is the same as the IP address of the network device 301 a that issued the processing request in step S12. If it is determined that the “IP address of the network device that transmitted the request” acquired from the session information is the same as the IP address of the network device 301a that has issued the processing request in step S12, the network device 301a indicates that the network device 301a Execute the processing request made.

  In step S 13, the network service 303 transmits the processing result and the session ID 305 to the network device 301 a via the httpd 302 and the network 306 of the NCS 31.

  If the session information corresponding to the session ID 305 is not stored in the session information DB 304, the network service 303 considers that no session has been established between the network device 301a and the network service 303, and the network device 301a has performed. Do not execute the processing request. If it is determined that the “IP address of the network device that transmitted the request” acquired from the session information is not the same as the IP address of the network device 301a that issued the processing request in step S12, the network service 303 determines that the network device 301a The processing request made by is not executed.

  As described above, the session information functions as use authentication information that proves the use authority of the service provided by the network service 303. By making the session information function as usage authentication information, the following effects are produced.

  For example, the other network device 301b refers to the session ID 305 acquired by the network device 301a by some method, makes a desired processing request to the network service 303 of the multi-function device 1 as in step S12 ′, and transmits the session ID 305. The case will be described.

  When the session ID 305 is received together with the processing request from the network device 301b, the network service 303 searches the session information DB 304 for session information corresponding to the received session ID 305. In this case, since the session information corresponding to the session ID 305 is stored in the session information DB 304, the network service 303 considers that a session has been established between the network device 301b and the network service 303.

  Next, the network service 303 acquires “the IP address of the network device that transmitted the request” from the session information, and determines whether or not it is the same as the IP address of the network device 301 b that issued the processing request in step S12 ′.

  In this case, since it is determined that the “IP address of the network device that sent the request” acquired from the session information is not the same as the IP address of the network device 301b that made the processing request in step S12, the network service 303 A processing request made by the device 301b can be rejected. Since the session information has an expiration date, the session information after the expiration date is deleted. As described above, the use authentication information issuing method of the present invention further enhances network security.

  FIG. 5 is a functional configuration diagram of the multi-function apparatus for explaining the usage authentication information issuing method according to the second embodiment of the present invention. In the functional configuration diagram of FIG. 5, functional configurations that are not necessary for explanation are omitted. FIG. 5 illustrates a service provided by the document management service to the network device 401 as an example of a service provided by the MFP 1.

  In FIG. 5, a network device 401 is connected to the multi-function apparatus 1 via a network (not shown) such as the Internet or a LAN. The multi-function device 1 provides the network device 401 with various services related to stored documents. For example, when using a service provided by the MFP 1, the network device 401 receives a session ID as usage authentication information for the service from the MFP 1 and receives a service using the usage authentication information, as will be described later. . Similarly to the network devices 301a and 301b described above, the network device 401 exchanges data with the MFP 1 in the XML format and uses SOAP as a communication protocol standard.

  When the network device 401 uses the service provided by the MFP 1, the network device 401 proceeds to step S20. In step S20, the network device 401 makes a session establishment request between the network device 401 and the document management service 403 to the document management service 403 of the multi-function peripheral 1 via the network and the httpd 402 of the NCS 31. This session establishment request includes authentication information necessary for causing the network service 303 to issue use authentication information for the service provided by the document management service 403. In step S20, the network device 401 can also specify the session expiration date.

  Progressing to step S21 following step S20, the document management service 403 establishes a session between the network device 401 and the document management service 403, and performs authentication using authentication information included in the session establishment request. If the authentication ends normally, the document management service 403 generates session information as shown in FIG. 6 and stores it in the session information DB 404. If the authentication does not end normally, the document management service 403 does not generate session information. If authentication does not end normally, the document management service 403 may release a session established with the network device 401.

  FIG. 6 is a configuration diagram of another example of session information. The session information in FIG. 6 includes a session ID, an IP address of the network device that has transmitted the request, an IP address of the multi-function peripheral that has received the request, an expiration date, and an array of password-authenticated document IDs.

  The “session ID”, “IP address of the network device that sent the request”, “IP address of the MFP that received the request”, and “expiration date” are the same as the session information in FIG. Is omitted. The “password-authenticated document ID array” is a list of stored document IDs of password-authenticated stored documents.

  Then, the document management service 403 transmits the session ID to the network device 401 via the httpd 402 of the NCS 31 and the network as a response to the session establishment request in step S20.

  When the session ID is received from the document management service 403, the network device 401 displays a list of stored documents stored in the MFP 1. It is assumed that the network device 401 has previously obtained a list of stored documents and a document ID stored in the MFP 1. A user who operates the network device 401 selects a stored document to be acquired from a list of stored documents displayed on the screen, and inputs a password if a password needs to be acquired to acquire the stored document.

  In step S22, the network device 401 transmits the document ID, password, and session ID of the stored document selected by the user to the document management service 403 of the MFP 1 via the httpd 402 of the NCS 31, thereby authenticating the use of the stored document. A request for obtaining a document ticket as information is made.

  When the document ID, password, and session ID of the stored document are received from the network device 401, the document management service 403 searches the session information DB 404 for session information corresponding to the received session ID. If session information corresponding to the session ID is stored in the session information DB 404, the document management service 403 considers that a session has been established between the network device 401 and the document management service 403.

  Next, the document management service 403 acquires “the IP address of the network device that sent the request” from the session information corresponding to the session ID, and is the same as the IP address of the network device 401 that made the document ticket acquisition request in step S22. It is determined whether it is. If it is determined that the “IP address of the network device that transmitted the request” acquired from the session information is the same as the IP address of the network device 401 that issued the document ticket acquisition request in step S22, the document management service 403 It is determined that the session established with the network device 401 is valid, and the “expiration date” of the session information corresponding to the session ID is updated.

  If the session information corresponding to the session ID is not stored in the session information DB 404, the document management service 403 considers that no session is established between the network device 401 and the document management service 403, and the network device 401 Do not execute the document ticket acquisition request.

  If it is determined that the “IP address of the network device that transmitted the request” acquired from the session information is not the same as the IP address of the network device 401 that issued the document ticket acquisition request in step S 22, the document management service 403. Does not execute the document ticket acquisition request made by the network device 401.

  When the document management service 403 determines that the session established with the network device 401 is valid, the document ID received from the network device 401 is already included in the “password-authenticated document ID array” of the session information. It is determined whether or not. Here, the description is continued assuming that the document ID received from the network device 401 is not included in the “array of password-authenticated document IDs” of the session information.

  In this case, the document management service 403 determines that the use authority of the stored document corresponding to the document ID received from the network device 401 is unapproved, and proceeds to step S23. In step S23, the document management service 403 transmits the document ID and password of the stored document received from the network device 401 to the MCS 36, and makes a password authentication request. The MCS 36 performs password authentication using the document ID and password received from the document management service 403.

  In step S24 following step S23, the MCS 36 transmits the password authentication result to the document management service 403. The password authentication result is transmitted from the MCS 36 to the document management service 403 as a response to the password authentication request. When the password authentication for the document ID ends normally, the document management service 403 adds the document ID received from the network device 401 in step S22 to the “array of password-authenticated document IDs” in the session information.

  Further, when the password authentication of the document ID ends normally, the document management service 403 generates a document ticket as shown in FIG. FIG. 7 is an explanatory diagram for explaining the document ticket.

  FIG. 7A shows a document ticket structure. The document ticket stores the ticket ID and the data size of the document ticket. FIG. 7B shows document ticket information 405 for collating document tickets. The document ticket information 405 is held by the document management service 403. The document ticket information 405 includes document ticket content information and document ticket management information. The document ticket content information in FIG. 7B includes, as information, an array of structures in which a ticket ID, an expiration date of the document ticket, the number of files, and a file ID as a document ID and a password are paired. Further, the document ticket management information includes the current ticket number and the number of issued tickets as information. The document ticket and the document ticket information 405 are associated with each other by a ticket ID.

  In step S25, the document management service 403 transmits the generated document ticket to the network device 401 via the httpd 402 of the NCS 31 and the network. For example, when it is desired to acquire the document ID included in the document ticket, the network device 401 proceeds to step S26, and the MFP 1 receives the session ID received in step S21 and the document ticket received in step S25 via the httpd 402 of the NCS 31. To obtain the document ID included in the document ticket.

  When the session ID and the document ticket are received from the network device 401, the document management service 403 searches the session information DB 404 for session information corresponding to the received session ID. If session information corresponding to the session ID is stored in the session information DB 404, the document management service 403 considers that a session has been established between the network device 401 and the document management service 403.

  Next, the document management service 403 acquires the “IP address of the network device that transmitted the request” from the session information corresponding to the session ID, and the network device 401 that has requested acquisition of the document ID included in the document ticket in step S26. It is determined whether it is the same as the IP address.

  If it is determined that the “IP address of the network device that transmitted the request” acquired from the session information is the same as the IP address of the network device 401 that has requested acquisition of the document ID included in the document ticket in step S26, The document management service 403 determines that the session established with the network device 401 is valid. If the document management service 403 determines that the session established with the network device 401 is valid, the process proceeds to step S27, and the document ID included in the document ticket is transmitted to the network device 401 via the httpd 402 of the NCS 31 and the network. To do. If the document management service 403 determines that the session established with the network device 401 is valid, the document management service 403 updates the “expiration date” of the session information corresponding to the session ID.

  If the session information corresponding to the session ID is not stored in the session information DB 404, the document management service 403 considers that no session is established between the network device 401 and the document management service 403, and the network device 401 The acquisition request for the document ID included in the performed document ticket is not executed. If it is determined that the “IP address of the network device that transmitted the request” acquired from the session information is not the same as the IP address of the network device 401 that has requested acquisition of the document ID included in the document ticket in step S26. The document management service 403 does not execute the acquisition request for the document ID included in the document ticket made by the network device 401.

  For example, if it is desired to acquire the properties of the stored document, the network device 401 proceeds to step S28, and the document ID received in step S21 and the document ID received in step S27 are managed by the document management of the MFP 1 via the httpd 402 of the NCS 31. By transmitting to the service 403, a property acquisition request for the stored document is made. When the session ID and the document ID are received from the network device 401, the document management service 403 determines the validity of the session established with the network device 401 as in step S26.

  When the document management service 403 determines that the session established with the network device 401 is valid, the document ID received from the network device 401 is already included in the “password-authenticated document ID array” of the session information. It is determined whether or not. Here, the description will be continued assuming that the document ID received from the network device 401 is already included in the “password authenticated document ID array” of the session information.

  In this case, the document management service 403 determines that the use authority of the stored document corresponding to the document ID received from the network device 401 has been approved, and proceeds to step S29. In step S29, the document management service 403 transmits the stored document property corresponding to the document ID to the network device 401 via the httpd 402 of the NCS 31 and the network.

  For example, when a request for obtaining a document ticket is desired again, the network device 401 proceeds to step S30, and the document ID of the stored document selected by the user, the session ID received from the document management service 403 in step S21, and the httpd 402 of the NCS 31 are used. To obtain the document ticket by transmitting it to the document management service 403 of the MFP 1.

  When the session ID and the document ID are received from the network device 401, the document management service 403 determines the validity of the session established with the network device 401 as in step S26. When the document management service 403 determines that the session established with the network device 401 is valid, the document ID received from the network device 401 is already included in the “password-authenticated document ID array” of the session information. It is determined whether or not. Here, the description will be continued assuming that the document ID received from the network device 401 is already included in the “password authenticated document ID array” of the session information.

  In this case, the document management service 403 determines that the authority to use the stored document corresponding to the document ID received from the network device 401 has been approved, and generates a document ticket as shown in FIG. In step S31 following step S30, the document management service 403 transmits the generated document ticket to the network device 401 via the httpd 402 of the NCS 31 and the network.

  In this way, by storing the document IDs of the authenticated accumulated documents in the “password-authenticated document ID array” of the session information, it is possible to issue a document ticket without performing password authentication.

  In addition, storing the “authenticated document ID array” in the session information has the following effects. For example, for a processing request relating to a stored document protected by a password, the password must be sent to the document management service 403 for password authentication. For this reason, when the processing request regarding the stored document protected by the password is repeatedly performed, the password authentication processing is duplicated.

  Therefore, once the network device 401 performs password authentication on the stored document, the authenticated document ID is stored as “authenticated document ID array” of the session information. Password authentication processing can be omitted the next time a processing request for a document is made. As described above, in the usage authentication information issuing method of the present invention, the duplicate password authentication processing is omitted, so that the processing speed can be increased.

  The present invention is not limited to the above-described embodiments, and various modifications and changes can be made within the scope of the present invention.

It is a block diagram of one Example of the compound machine by this invention. It is a hardware block diagram of one Example of the compound machine by this invention. It is a function block diagram of the multi-functional apparatus for demonstrating the utilization authentication information issuing method of 1st Example by this invention. It is a block diagram of an example of session information. It is a functional block diagram of the compound machine for demonstrating the utilization authentication information issuing method of 2nd Example by this invention. It is a block diagram of another example of session information. It is explanatory drawing for demonstrating a ticket.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Fusion machine 2 Software group 3 Fusion machine starting part 4 Hardware resource 5 Application layer 6 Platform 7 Shared function layer 8 Wrapping layer 9 Control service layer 10 Handler layer 11 Plotter 12 Scanner 13 Hardware resource 21 Printer application 22 Copy application 23 Fax Application 24 Scanner application 25 WEB page application 26 SOAP communication application 27 WEB service function (WSF)
28 Shared function (SF)
31 Network Control Service (NCS)
32 Delivery Control Service (DCS)
33 Operation Panel Control Service (OCS)
34 Fax Control Service (FCS)
35 Engine Control Service (ECS)
36 Memory Control Service (MCS)
37 User Information Control Service (UCS)
38 System Control Service (SCS)
39 System Resource Manager (SRM)
40 Fax Control Unit Handler (FCUH)
41 Image memory handler (IMH)
51-53 Application Program Interface (API)
54 Engine I / F
60 controller 61 CPU
62 System memory 63 North Bridge (NB)
64 South Bridge (SB)
65 AGP (Accelerated
Graphics Port)
66 ASIC
67 Local memory 68 Hard disk drive (HDD)
80 Operation panel 81 Fax control unit (FCU)
82 Engine unit 301a, 301b, 401 Network device 302, 402 httpd (HyperText
Transfer Protocol Daemon)
303 Network Service 304, 404 Session Information 306 Network 403 Document Management Service 405 Document Ticket Information

Claims (5)

An image forming apparatus having hardware resources used in image forming processing, a program for performing processing relating to image formation, and a document storage unit for storing stored documents,
Session establishment means for receiving a session establishment request including authentication information from an external network device and establishing a session with the network device;
Authentication means for performing authentication using authentication information included in the session establishment request;
When the authentication by the authentication unit is completed normally, it includes session identification information of the session established with the network device, identification information of the network device that has transmitted the session establishment request, and identification information of the authenticated stored document Session information generating means for generating session information;
Session information storage means for storing the session information;
Session establishment request response means for transmitting the session identification information to the network device as a response to the session establishment request;
Receiving a request for acquiring usage authentication information for the stored document including the session identification information, the identification information of the stored document, and certification information proving the authority to use the stored document from the network device; First search means for searching for the session information corresponding to the session identification information included in the session information storage means;
If the session information corresponding to the session identification information is stored in the session information storage means, the identification information of the network device that has transmitted the session establishment request included in the session information is acquired and used for the stored document First session validity determination means for determining whether or not the identification information of the network device that has transmitted the authentication information acquisition request is the same;
If the determination result by the first session validity determination unit is the same, whether the identification information of the stored document included in the usage authentication information acquisition request for the stored document is included as the identification information of the authenticated stored document A first stored document authenticated determination means for determining;
If the identification information of the stored document is determined not to be included as the identification information of the authenticated stored document by the first stored document authenticated determination means, it is included in the use authentication information acquisition request for the stored document. When the authentication is performed using the identification information of the stored document and the certification information that proves the right to use the stored document, and the authentication ends normally, the identification of the stored document included in the acquisition request for the usage authentication information for the stored document Usage authentication information generation and transmission means for generating usage authentication information for the stored document and transmitting it to the network device after adding information to the session information as identification information of an authenticated stored document;
A request for acquiring the identification information of the stored document including the session identification information and usage authentication information for the stored document is received from the network device, and the request corresponds to the session identification information included in the acquisition request for the identification information of the stored document. Second search means for searching the session information from the session information storage means;
If the session information corresponding to the session identification information is stored in the session information storage means, the identification information of the network device that has transmitted the session establishment request included in the session information is acquired, and the stored document identification Second session validity determining means for determining whether or not the identification information of the network device that has transmitted the information acquisition request is the same;
If the determination results by the second session validity determining means are the same, the stored document identification information transmitting means for transmitting the stored document identification information included in the usage authentication information for the stored document to the network device;
A processing request for the stored document including the session identification information and the stored document identification information is received from the network device, and the session information corresponding to the session identification information included in the processing request is received from the session information storage unit. A third search means for searching;
If the session information corresponding to the session identification information is stored in the session information storage means, the identification information of the network device that has transmitted the session establishment request included in the session information is acquired, and the processing for the stored document Third session validity determining means for determining whether the identification information of the network device that transmitted the request is the same;
If the determination result by the third session validity determination means is the same, a second determination is made as to whether the identification information of the stored document included in the processing request for the stored document is included as the identification information of the authenticated stored document Accumulated document authentication determination means,
A process execution unit configured to execute processing on the stored document when the second stored document authenticated determination unit determines that the identification information of the stored document is included as the identification information of the authenticated stored document;
An image forming apparatus comprising: The session information includes an expiration date. When a predetermined processing request using the session identification information is received, the expiration date of the session information corresponding to the session identification information is updated and the expiration date has passed. The image forming apparatus according to claim 1, wherein session information is deleted. 3. The image forming apparatus according to claim 1, wherein the hardware resource used in the image forming process includes at least a scanner unit that generates image data from an image and a plotter unit that forms an image from the image data. . A method of issuing authentication information for use of an image forming apparatus, comprising: hardware resources used in image forming processing; a program for performing processing relating to image formation; and a document storage unit for storing stored documents .
A session establishment step of receiving a session establishment request including authentication information from an external network device and establishing a session with the network device;
An authentication step of performing authentication using authentication information included in the session establishment request;
When the authentication of the authentication unit is completed normally, it includes session identification information of the session established with the network device, identification information of the network device that has transmitted the session establishment request, and identification information of the authenticated stored document A session information generation stage for generating session information;
A session information storage stage for storing the session information in a session information storage means;
A session establishment request response step of transmitting the session identification information to the network device as a response to the session establishment request;
Receiving a request for acquiring usage authentication information for the stored document including the session identification information, the identification information of the stored document, and certification information proving the authority to use the stored document from the network device; A first search step of searching the session information storage means for the session information corresponding to the session identification information included in
If the session information corresponding to the session identification information is stored in the session information storage means, the identification information of the network device that has transmitted the session establishment request included in the session information is acquired and used for the stored document A first session validity determination step for determining whether or not the identification information of the network device that has transmitted the authentication information acquisition request is the same;
If the determination result is the same in the first session validity determination step, whether the identification information of the stored document included in the usage authentication information acquisition request for the stored document is included as the identification information of the authenticated stored document A first stored document authenticated determination step for determining;
If it is determined that the identification information of the stored document is not included as the identification information of the authenticated stored document in the first stored document authenticated determination step, it is included in the usage authentication information acquisition request for the stored document. When the authentication is performed using the identification information of the stored document and the certification information that proves the right to use the stored document, and the authentication ends normally, the identification of the stored document included in the acquisition request for the usage authentication information for the stored document A usage authentication information generation and transmission step of generating usage authentication information for the stored document and transmitting it to the network device after adding information to the session information as identification information of the authenticated stored document;
A request for acquiring the identification information of the stored document including the session identification information and usage authentication information for the stored document is received from the network device, and the request corresponds to the session identification information included in the acquisition request for the identification information of the stored document. A second search stage for searching the session information from the session information storage means;
If the session information corresponding to the session identification information is stored in the session information storage means, the identification information of the network device that has transmitted the session establishment request included in the session information is acquired, and the stored document identification A second session validity determination step for determining whether the information is identical to the identification information of the network device that has transmitted the information acquisition request;
If the determination result is the same in the second session validity determination step, the stored document identification information transmission step of transmitting the stored document identification information included in the usage authentication information for the stored document to the network device;
A processing request for the stored document including the session identification information and the stored document identification information is received from the network device, and the session information corresponding to the session identification information included in the processing request is received from the session information storage unit. A third search stage for searching;
If the session information corresponding to the session identification information is stored in the session information storage means, the identification information of the network device that has transmitted the session establishment request included in the session information is acquired, and the processing for the stored document A third session validity determination step for determining whether the identification information is the same as the identification information of the network device that transmitted the request;
If the determination result is the same in the third session validity determination step, a second determination is made as to whether or not the identification information of the stored document included in the processing request for the stored document is included as the identification information of the authenticated stored document. Accumulated document authentication determination stage,
If it is determined in the second stored document authenticated determination step that the identification information of the stored document is included as identification information of the authenticated stored document, a processing execution step of executing a process on the stored document; A method of issuing usage authentication information, comprising: A usage authentication information issuing system that issues usage authentication information for predetermined processing using one or more external network devices and an image forming apparatus connected to the external network devices via a network,
The image forming apparatus includes:
Session establishment means for receiving a session establishment request including authentication information from an external network device and establishing a session with the network device;
Authentication means for performing authentication using authentication information included in the session establishment request;
When the authentication by the authentication unit is completed normally, it includes session identification information of the session established with the network device, identification information of the network device that has transmitted the session establishment request, and identification information of the authenticated stored document Session information generating means for generating session information;
Session information storage means for storing the session information;
Session establishment request response means for transmitting the session identification information to the network device as a response to the session establishment request;
Receiving a request for acquiring usage authentication information for the stored document including the session identification information, the identification information of the stored document, and certification information proving the authority to use the stored document from the network device; First search means for searching for the session information corresponding to the session identification information included in the session information storage means;
If the session information corresponding to the session identification information is stored in the session information storage means, the identification information of the network device that has transmitted the session establishment request included in the session information is acquired and used for the stored document First session validity determination means for determining whether or not the identification information of the network device that has transmitted the authentication information acquisition request is the same;
If the determination result by the first session validity determination unit is the same, whether the identification information of the stored document included in the usage authentication information acquisition request for the stored document is included as the identification information of the authenticated stored document A first stored document authenticated determination means for determining;
If the identification information of the stored document is determined not to be included as the identification information of the authenticated stored document by the first stored document authenticated determination means, it is included in the use authentication information acquisition request for the stored document. When the authentication is performed using the identification information of the stored document and the certification information that proves the right to use the stored document, and the authentication ends normally, the identification of the stored document included in the acquisition request for the usage authentication information for the stored document Usage authentication information generation and transmission means for generating usage authentication information for the stored document and transmitting it to the network device after adding information to the session information as identification information of an authenticated stored document;
A request for acquiring the identification information of the stored document including the session identification information and usage authentication information for the stored document is received from the network device, and the request corresponds to the session identification information included in the acquisition request for the identification information of the stored document. Second search means for searching the session information from the session information storage means;
If the session information corresponding to the session identification information is stored in the session information storage means, the identification information of the network device that has transmitted the session establishment request included in the session information is acquired, and the stored document identification Second session validity determining means for determining whether or not the identification information of the network device that has transmitted the information acquisition request is the same;
If the determination results by the second session validity determining means are the same, the stored document identification information transmitting means for transmitting the stored document identification information included in the usage authentication information for the stored document to the network device;
A processing request for the stored document including the session identification information and the stored document identification information is received from the network device, and the session information corresponding to the session identification information included in the processing request is received from the session information storage unit. A third search means for searching;
If the session information corresponding to the session identification information is stored in the session information storage means, the identification information of the network device that has transmitted the session establishment request included in the session information is acquired, and the processing for the stored document Third session validity determining means for determining whether the identification information of the network device that transmitted the request is the same;
If the determination result by the third session validity determination means is the same, a second determination is made as to whether the identification information of the stored document included in the processing request for the stored document is included as the identification information of the authenticated stored document Accumulated document authentication determination means,
A process execution unit configured to execute processing on the stored document when the second stored document authenticated determination unit determines that the identification information of the stored document is included as the identification information of the authenticated stored document;
Use authentication information issuing system, comprising a.

Images