JP4532204B2 - Image forming apparatus and roll table management method - Google Patents

Description

  The present invention relates to an image forming apparatus and a roll table management method.

  In an image forming apparatus called a multifunction peripheral or a multifunction peripheral having a plurality of functions such as a copy, a printer, a scanner, and a FAX (facsimile), a plurality of services providing various services on an OS (Operating System) such as UNIX (registered trademark). Daemons (server programs) and applications are running.

  In addition, when a command is input when a user uses a function, each daemon checks whether or not the user should be allowed to use the function, so that authentication, billing, and user restriction called CCS (Certification Control Service) is performed. Role information including user authority is acquired from an external module having the above function.

  In addition, function authority information that is more detailed than role information is provided as a role table in each daemon or application, and it is confirmed whether or not the use should be permitted when a command is input when the user uses the function. Like to do.

  FIG. 1 is a diagram showing a relationship between daemons and applications and a roll table in a conventional image forming apparatus. Roll tables T11 to T14 are provided inside daemons D11 to D13 and an application A11 for performing various processes. .

  As described above, in the conventional image forming apparatus, since the role table which is the function authority information is provided in each daemon or application, if the information in the roll table (roll table information) is changed, The daemon or application role table had to be changed and the program had to be modified each time.

  In addition, when a new daemon or application is added, the role table of other daemons or applications that operate in association with these may need to be changed. In this case, the program must be corrected.

  The present invention has been proposed in view of the above-described conventional problems, and an object of the present invention is to provide an image forming apparatus and a roll table management method capable of easily managing a roll table holding function authority information. Is to provide.

In order to solve the above-described problems, in the present invention, as described in claim 1, when a command is input from a user, various types of determining whether or not the user can use it by checking the user authority of the user. Forming a common role table in which formats referred to by the various daemons and applications for processing the commands are shared, and the roles from the various daemons and applications. A role interface that is provided for each of the various daemons and applications that mediate the reference to the table, and a changing unit that changes the role table, and the role interface is the role changed by the changing unit. The table is referenced .

  According to a second aspect of the present invention, the roll table includes, for each user authority, permission / non-permission of printer function, permission / non-permission of copy function, permission / non-permission of FAX function, and network function. Permission / non-permission can be described.

  According to a third aspect of the present invention, the user authority may include an authority corresponding to a device administrator, a user administrator, a document administrator, a network administrator, a supervisor, and an authenticated user.

  According to a fourth aspect of the present invention, the role table includes a description of a field value of an ID corresponding to a user authority, a description of a field value indicating permission / non-permission for each function to be used. It can consist of.

  Further, as described in claim 5, the role table is composed of a description corresponding to the user authority and a continuous description indicating permission / non-permission for each function to be used. can do.

  According to a sixth aspect of the present invention, the roll table can be held in a storage medium on a network.

  According to a seventh aspect of the present invention, the roll table can be held on a flash memory.

  The roll table may be held on a hard disk in the image forming apparatus.

  Further, as described in claim 9, the roll table can be held on a USB storage.

  According to a tenth aspect of the present invention, the role interface can be incorporated into the various daemons or applications through a static link.

  In addition, as described in claim 11, the role interface can be dynamically incorporated into the various daemons or applications by a dynamic link.

  According to a twelfth aspect of the present invention, the role interface may be operated as a separate process, and data may be transmitted and received between the various daemons or applications and the role interface through inter-process communication. it can.

  In addition, as described in claim 13, the contents of the roll table can be changed by replacing the roll table setting file constituting the roll table.

  In addition, as described in claim 14, the contents of the roll table can be changed by a command described in XML.

  According to a fifteenth aspect of the present invention, the contents of the roll table can be changed by the operation panel of the image forming apparatus.

  According to a sixteenth aspect of the present invention, a digital signature is attached to a roll table setting file constituting the roll table, and the validity of the file is confirmed from the digital signature when the roll interface refers to the digital signature. can do.

  According to a seventeenth aspect of the present invention, the roll table setting file constituting the roll table can be encrypted and decrypted when the roll interface refers to it.

In addition, as described in claim 18, when a command is input from a user, the management method in the image forming apparatus having various daemons and applications that confirms the user authority of the user and determines whether or not the user can use the command. A step of changing means for changing a common role table in which formats referred to by the various daemons and applications for processing the commands are made common, and the various daemons and applications from the various daemons and applications. And a step of mediating a reference to the roll table changed by the changing means via a roll interface provided for each of the applications.

In the image forming apparatus and the roll table management method of the present invention, a common roll table referred to by various daemons and applications is provided, and the various daemons and applications are connected to the daemons and applications individually via the roll interface. Since the role table is referenced, it is not necessary to modify the program even if the role table information is changed or a daemon or application is added.

  Hereinafter, preferred embodiments of the present invention will be described.

  FIG. 2 is a diagram showing the relationship between the daemon and application and the roll table in the image forming apparatus of the present invention. In FIG. 2, the daemons D1 to D3 and the application A1 that perform various processes refer to the roll table setting file of the roll table T provided separately from the daemons D1 to D3 and the application A1 via the roll interfaces IF1 to IF4, respectively. The roll table information included in the roll table setting file can be acquired.

  FIG. 3 is a configuration diagram of the image forming apparatus 1 according to the embodiment of the present invention, and is common to an application 2 that provides a predetermined function (for example, an application that requires a network I / O (Input / Output)). NCS (Network Control Service, etc.) that provides services that can be used by the network, distributes the data received from the network side according to a predetermined protocol to the corresponding application, and mediates when the data is transmitted from the application to the network side), etc. Application 3, CCS 4 that provides authentication / billing / user restriction services and issues function restriction information associated with user login authentication, and a role table 5 that is commonly referred to by applications 2 and 3. . The image forming apparatus 1 includes hardware that realizes functions such as a copy, a printer, a scanner, and a FAX, and other software (programs).

  The application 2 includes a daemon 21 (for example, an ncs daemon) having a general function and daemons 22, 23, 24, and 26 (for example, a protocol daemon) that operate using the function of the daemon 21. The daemons 24 and 26 that need to refer to the roll table 5 are provided with roll interfaces 25 and 27.

  The application 3 is also provided with a roll interface 31.

  Role information 41 is held in the CCS 4. Note that the role information 41 does not necessarily exist in the CCS 4 and may be held on another device on the network.

  The roll table 5 holds a roll table setting file 51 including roll table information 52.

  On the other hand, the image forming apparatus 1 can receive commands from the client 7 via the network 6.

  FIG. 4 is a diagram illustrating an example of role information acquired from the CCS 4, and “user authority” is associated with “user name” and “password”. For example, “admin”, “supervisor”, “user-A”, and the like are set as “user name”, and “admin” and “supervisor” are separately managed on the OS for “password” and “(none)”. ) "Or" su (super user) ", and a predetermined password is set for" user-A ", which is the other user. As the “user authority”, “device administrator authority / user administrator authority / document administrator authority / network administrator authority”, etc. are set for the user name “admin”, and the user name “supervisor” is set. “Supervisor authority” or the like is set for the user name, and “authentication user authority” or the like is set for the user name “user-A”.

  FIG. 5 is a diagram showing an example of the role table information 52. The printer function is permitted / not permitted for each user authority (device manager limit, user manager, document manager, network manager, supervisor, authenticated user). Permission / non-permission of copy function, permission / non-permission of FAX function, permission / non-permission of network function, etc. are set. Note that “1” corresponds to permission (can be performed) and “0” corresponds to permission (cannot be performed).

  6 and 7 are diagrams showing examples of description of the roll table information 52, and have a structure that facilitates control by XML (eXtensible Markup Language).

  In FIG. 6, as shown in (a), the field value description “id = 1” of the ID corresponding to the user authority, and the field value indicating permission / non-permission for each function to be used are permitted. The description includes “1 = 1, 2 = 1, 3 = 1, 4 = 0” and the like. Here, “id” is “device manager”, “id = 2” is “user manager”, and “id = 4” is “document manager” as shown in (b). “Id = 8” corresponds to “network administrator”, “id = 16” corresponds to “supervisor”, and “id = 32” corresponds to “authenticated user”. Further, as shown in (c), the field identifiers of the functions to be used are “1” is “printer function”, “2” is “copy function”, “3” is “FAX function”, “ “4” corresponds to “network function”. Further, as shown in (d), the field value of the function that is subject to use permission corresponds to “0” (cannot be permitted) and “1” “can be (permitted)”.

  In FIG. 7, as shown in (a), it is composed of a description “1” corresponding to the user authority and a continuous description “1110” indicating permission / non-permission for each function to be used. ing. Here, as shown in (b), the description corresponding to the user authority is “1” for “device manager”, “2” for “user manager”, “4” for “document manager”, “8”. "Corresponds to" network administrator "," 16 "corresponds to" supervisor ", and" 32 "corresponds to" authenticated user ". In addition, as shown in (c), the position of each bit in the continuous description indicating permission / non-permission for each function is “1 << 3 (3-bit shift from right end)” is “printer function”, “1 “<< 2 (2 bit shift from right end)” is “copy function”, “1 << 1 (1 bit shift from right end)” is “FAX function”, “1 << 0 (0 bit shift from right end)” It corresponds to "Network function". Furthermore, as shown in (d), the value of each bit in the continuous description indicating permission / non-permission for each function is “cannot be (not permitted)” for “0” and “can be permitted (allowed)” for “1”. Is supported.

  Next, FIGS. 8-11 is a figure which shows the holding | maintenance form of a roll table.

  FIG. 8 shows a roll table setting file 51 held in a storage medium 81 such as an HDD (Hard Disk Drive) of devices such as other image forming apparatuses, servers, and personal computers on the network. The storage medium 81 on the network 6 is accessed from the roll interface IF from the D3 and the application A1, and the roll table setting file 51 is referred to.

  FIG. 9 shows that the roll table setting file 51 is held in a flash memory card 82 such as an SD card. The daemon D1 to D3 and the application A1 access the flash memory card 82 from the roll interface IF and set the roll table. The file 51 is referred to.

  In FIG. 10, the roll table setting file 51 is held in a storage medium 83 such as an HDD of its own image forming apparatus. The daemon D1 to D3 and the application A1 access the storage medium 83 from the roll interface IF. The roll table setting file 51 is referred to.

  FIG. 11 is a diagram in which the roll table setting file 51 is held in the USB storage 84 having a data storage function. The roll table IF is accessed by the daemons D1 to D3 and the application A1 from the roll interface IF. 51 is referred to.

  Next, FIG. 12 to FIG. 15 show a mounting method of the roll interface.

  FIG. 12 is a diagram showing an example of a program when linking a role interface as a library. In a daemon or application program that requires the role interface, a description 85 that includes the header file of the role interface, and role information And a description 86 for performing the acquisition process.

  FIG. 13 is a conceptual diagram when a role interface library is implemented by static linking. The daemon D and the role interface IF operate together as a program, and the daemon D needs to refer to the role table. Refers to the roll table setting file 51 via the roll interface IF.

  FIG. 14 is a conceptual diagram when a role interface library is implemented by dynamic linking. When it is necessary to refer to the role table by the daemon D, the role interface IF is dynamically linked, and the role interface IF is passed through the role interface IF. The roll table setting file 51 is referred to.

  When the roll interface IF is linked statically or dynamically, there are advantages that the implementation is simple and the overhead between the daemon D and the roll interface IF is small.

  FIG. 15 is a diagram showing an example of a program when the role interface is used as a separate process. In the daemon or application program that requires the role interface, writing (writing) and reading (reading) to the shared area are performed. Includes a description 87 for performing inter-task communication with the role interface process. When the role interface is used as a separate process, there is an advantage that a daemon or application is not recreated even if a change occurs in the internal program of the role interface.

  Next, FIG. 16 is a sequence diagram showing processing when the function of the embodiment shown in FIG. 3 is used.

  In FIG. 16, when the client 7 logs in to the daemon 24 (step S1), the daemon 24 requests role information from the CCS 4 on the condition of the user name and password input by the user (step S2). Information is acquired (step S3).

  Next, when a command for using the printer function is input from the client 7 to the daemon 24 (step S4), the daemon 24 uses the roll interface 25 via the roll interface 25 on the condition of the user authority already acquired from the CCS 4. Requesting the role table information (step S5) and obtaining the execution authority (step S6). Here, since the user is “admin”, “permission (◯)” is obtained as the execution authority for the printer function.

  Then, the role information is cached (step S7), and the requested printer function is executed (step S8). Thereafter, the user logs out from the client 7 (step S9).

  Next, FIG. 17 is a diagram showing a change of the roll table by replacing the roll table setting file having a common file format. That is, when it is desired to change the roll table information operated by the roll table setting file 51A, the authority can be easily changed by replacing the roll table setting file 51A with the roll table setting file 51B by the device administrator. . After the replacement with the roll table setting file 51B, when the authority D is inquired from the daemon D (step S11), the role interface IF refers to the replaced roll table setting file 51B (step S12), and the latest state is obtained. Is obtained (step S13), and the daemon D is notified (step S14).

  As a specific method of replacing the roll table setting file, when the roll table setting file 51A is held on a device on the network, the network is connected to the device holding the change destination roll table setting file 51B. It can be replaced by changing the address. In addition, there are changes in the drive of a flash memory card such as an SD card, replacement of a flash memory card, change of a file path in an HDD, change of a file name, replacement of a USB storage, and change by operation on the operation panel of the image forming apparatus. .

  FIG. 18 is a diagram showing an example of an operation panel screen for changing the role table. Each function for each user authority (device manager, user manager, document manager, network manager, supervisor, authenticated user) is shown. The permission (ON) / non-permission (OFF) of (Printer, Copy, Fax, Network) can be set.

  Next, FIG. 19 is a diagram showing a description example by XML for changing the roll table. In this example, permission / restriction for each function of “ID = 1” corresponding to “device manager” is described by the description 88. The non-permission value is changed to “0011”, and the description 89 changes the permission / non-permission value for each function of “ID = 4” corresponding to “document manager” to “1111”.

  Next, FIG. 20 is a diagram showing a check method for changing the roll table. That is, when changing the role table setting file 51 (step S21), the device administrator adds the digital signature 53 to the role table setting file 51. When the role interface refers to the roll table setting file 51 (step S22), it simultaneously reads the digital signature 53 (step S23), and checks the validity of the roll table setting file 51 from the contents of the digital signature 53 (step S24).

  Next, FIG. 21 is a diagram showing security improvement by encrypting the roll table setting file. That is, the device administrator encrypts the roll table setting file 51 when changing the roll table setting file 51 (step S31). The role interface performs decryption when referring to the role table setting file 51 (step S32). Thereby, the secrecy of the roll table setting file 51 can be improved and the security can be improved.

  The present invention has been described above by the preferred embodiments of the present invention. While the invention has been described with reference to specific embodiments, various modifications and changes may be made to the embodiments without departing from the broad spirit and scope of the invention as defined in the claims. Obviously you can. In other words, the present invention should not be construed as being limited by the details of the specific examples and the accompanying drawings.

FIG. 10 is a diagram illustrating a relationship between a daemon and an application and a roll table in a conventional image forming apparatus. FIG. 3 is a diagram illustrating a relationship between a daemon and an application and a roll table in the image forming apparatus of the present invention. 1 is a configuration diagram of an image forming apparatus according to an embodiment of the present invention. It is a figure which shows the example of the roll information acquired from CCS. It is a figure which shows the example of roll table information. FIG. 6 is a diagram (part 1) illustrating a description example of roll table information. FIG. 10 is a second diagram illustrating a description example of roll table information. It is a figure (the 1) which shows the holding | maintenance form of a roll table. It is a figure (the 2) which shows the holding | maintenance form of a roll table. It is a figure (the 3) which shows the holding | maintenance form of a roll table. It is a figure (the 4) which shows the holding | maintenance form of a roll table. It is a figure which shows the example of a program in the case of linking a role interface as a library. It is a conceptual diagram in the case of mounting the library of a role interface by a static link. It is a conceptual diagram in the case of mounting the library of a role interface by a dynamic link. It is a figure which shows the example of a program in the case of utilizing a role interface as another process. It is a sequence diagram which shows the process at the time of function utilization. It is a figure which shows the change of the roll table by replacement of a roll table setting file. It is a figure which shows the example of a screen of the operation panel for changing a roll table. It is a figure which shows the example of description by XML for changing a roll table. It is a figure which shows the check method of the change of a roll table. It is a figure which shows the security improvement by encryption of a roll table setting file.

Explanation of symbols

D1 to D3, D daemon A1 application IF1 to IF4, IF roll interface T roll table 1 image forming apparatus 2, 3 applications 21 to 24, 26 daemon 25, 27, 31 roll interface 4 CCS
41 Roll information 5 Roll table 51 Roll table setting file 52 Roll table information 53 Digital signature 6 Network 7 Client 81 Storage medium 82 Flash memory card 83 Storage medium 84 USB storage

Claims (18)

An image forming apparatus having various daemons and applications for confirming the user authority of a user when a command is input from the user and determining whether or not the user can use the command.
A common role table in which formats referred to by the various daemons and applications that process the command are shared ;
Role interfaces provided individually for the various daemons and applications that mediate references to the role table from the various daemons and applications ;
A changing means for changing the roll table , and
The image forming apparatus , wherein the roll interface refers to the roll table changed by the changing unit.   The role table describes permission / non-permission of printer function, permission / non-permission of copy function, permission / non-permission of FAX function, and permission / non-permission of network function for each user authority. The image forming apparatus according to claim 1.   3. The user authority according to claim 1, wherein the user authority includes an authority corresponding to a device administrator, a user administrator, a document administrator, a network administrator, a supervisor, and an authenticated user. Image forming apparatus.   2. The role table is composed of a description of a field value of an ID corresponding to a user authority and a description of a field value indicating permission / non-permission for each function that is permitted to be used. The image forming apparatus according to any one of claims 1 to 3.   4. The role table according to claim 1, wherein the role table is composed of a description corresponding to a user authority and a continuous description indicating permission / denial for each function to be used. The image forming apparatus described in the item.   The image forming apparatus according to claim 1, wherein the roll table is held in a storage medium on a network.   The image forming apparatus according to claim 1, wherein the roll table is held on a flash memory.   6. The image forming apparatus according to claim 1, wherein the roll table is held on a hard disk in the image forming apparatus.   The image forming apparatus according to claim 1, wherein the roll table is held on a USB storage.   The image forming apparatus according to claim 1, wherein the roll interface is incorporated in the various daemons or applications by a static link.   The image forming apparatus according to claim 1, wherein the roll interface is dynamically incorporated into the various daemons or applications by a dynamic link.   10. The role interface according to claim 1, wherein the role interface is operated as a separate process, and data is transmitted and received between the various daemons or applications and the role interface by inter-process communication. Image forming apparatus.   The image forming apparatus according to claim 1, wherein the contents of the roll table are changed by replacing a roll table setting file that constitutes the roll table.   The image forming apparatus according to claim 1, wherein the contents of the roll table are changed according to a command described in XML.   The image forming apparatus according to claim 1, wherein contents of the roll table are changed by an operation panel of the image forming apparatus.   16. The roll table setting file constituting the roll table is attached with a digital signature, and the legitimacy of the file is confirmed from the digital signature when the roll interface refers to the file. The image forming apparatus described in the item.   The image forming apparatus according to any one of claims 1 to 16, wherein a roll table setting file constituting the roll table is encrypted and decrypted when the roll interface refers to the file. A management method in an image forming apparatus having various daemons and applications that confirms user authority of a user when a command is input from the user and determines whether or not the user can use the command.
A step of changing means for changing a common role table in which formats referred to by the various daemons and applications for processing the command are made common;
A step of mediating reference from the various daemons and applications to the role table changed by the changing means via a role interface provided for each of the various daemons and applications ;
Roll table management method characterized by comprising a.

Images