JP5637200B2 - Information processing apparatus, authentication system, control method, authentication method, and program thereof. - Google Patents

Description

  The present invention relates to a technique for controlling availability of an image forming apparatus based on a user's schedule.

  Specifically, an image forming apparatus that secures security and a control method thereof, an image forming apparatus, an authentication server, a schedule management server, and a user terminal are connected to each other via a network. More particularly, the present invention relates to a system for ensuring security linked with schedule management.

  In recent years, image forming apparatuses (digital multifunction peripherals) have become more sophisticated and multifunctional, and use and convenience in various applications are increasing. These image forming devices are often installed in the office of a company, and not only regular employees of the company, but also temporary staff or full-time employees in various positions with different authorities, such as managers and employees in different departments. There are also increasing opportunities for those who come and go and use the image forming apparatus. In such a situation, for example, an employee outside the jurisdiction increases the risk of unauthorized use of the image forming apparatus, such as taking out confidential documents or copying private documents. There is a need for a means for managing unauthorized use to prevent unauthorized use.

  As a measure for this, Japanese Patent Application Laid-Open No. 2004-133830 discusses a system that prevents unauthorized use of an image forming apparatus by setting a function that can be used by a user and a usable time zone for each image forming apparatus.

JP 2008-98928 A

  However, in the system described in Patent Document 1, it is possible to limit the functions and time zones that can be used by each user for each image forming apparatus. However, when the user is away from the office due to outing work In addition, there is a lack of measures to prevent another user from illegally using the image forming apparatus with the user's account (impersonation use). In addition, when the user's outing location is another site of the company, the convenience of enabling the image forming apparatus to be used at the outing location is not considered.

  It is an object of the present invention to provide a mechanism that can prevent unauthorized use while improving the convenience of using an image forming apparatus by a legitimate user.

  That is, according to the present invention, in an information processing apparatus that performs use authentication of a user's image forming apparatus, the schedule information storage unit that stores the user's schedule information in association with the user identification information of the user, and the image forming apparatus By using the authentication request receiving means for receiving the authentication request including the user identification information of the user and the base information where the image forming apparatus is installed, and the user identification information received by the authentication request receiving means, Schedule information acquisition means for acquiring the user's schedule information stored in the schedule information storage means associated with user identification information, and the user's schedule included in the schedule information acquired by the schedule information acquisition means is scheduled Received by the authentication request receiving means By using the serial location information, characterized by comprising a determining means for determining whether or not available an image forming apparatus wherein the user sends the authentication request.

  According to the present invention, according to the present invention, it is possible to prevent impersonation use of the image forming apparatus when a legitimate user is absent. In addition, it is possible to provide a mechanism that enables the use of an image forming apparatus at a location according to a valid user schedule. In addition, it is possible to determine whether or not the image forming apparatus can be used in consideration of the travel time between bases and the preparation time before the meeting. As a result, it is possible to increase the convenience of using the image forming apparatus by a legitimate user while preventing unauthorized use.

1 is a diagram illustrating an overall configuration example of an image forming system according to an embodiment of the present invention. It is a figure which shows the hardware structural example of the client terminal 105, the authentication server 300, and the print server 400 in embodiment of this invention. 2 is a diagram illustrating a hardware configuration example of an image forming apparatus 104 according to an embodiment of the present invention. FIG. It is a figure which shows the structural example of the user information table memorize | stored with the information processing apparatus in embodiment of this invention. It is a figure which shows the structural example of the base master memorize | stored with the information processing apparatus in embodiment of this invention. It is a figure which shows the structural example of the device master memorize | stored with the information processing apparatus in embodiment of this invention. It is a figure which shows the structural example of the device function master memorize | stored with the information processing apparatus in embodiment of this invention. It is a figure which shows the structural example of the available device function management table memorize | stored with the information processing apparatus in embodiment of this invention. It is a figure which shows the structural example of the business-hour management table memorize | stored with the information processing apparatus in embodiment of this invention. It is a figure which shows the structural example of the schedule management table memorize | stored with the information processing apparatus in embodiment of this invention. It is a figure which shows the structural example of the overtime / holiday attendance management table memorize | stored with the information processing apparatus in embodiment of this invention. 6 is a diagram illustrating a structure example of communication data transmitted from the image forming apparatus 104 to the authentication server 101 during user authentication in the embodiment of the present invention. FIG. 3 is a flowchart illustrating a first control method of the image forming system in the embodiment of the present invention. 6 is a flowchart illustrating a second control method of the image forming system in the embodiment of the present invention. 6 is a flowchart illustrating a second control method of the image forming system in the embodiment of the present invention. It is a display example of a screen displayed on the client terminal 105 in the embodiment of the present invention. It is a flowchart which shows the detailed process of step S1414 of FIG. 14B. It is an example of the database with which the preparation time used by step S1702 was registered. It is an example of the database with which the preparation time used by step S1702 was registered. It is an example of a database in which travel times between bases are registered It is an example of a database in which the shortest stay time used in steps S1706 and S1709 is registered.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram showing a configuration of an impersonation use prevention system according to an embodiment of the present invention.

  The configuration of various terminals connected on the network 106 in FIG. 1 is an example, and it goes without saying that there are various configuration examples depending on the application and purpose.

  Reference numeral 101 denotes an authentication server that performs an authentication process when a user uses an image forming apparatus (digital multifunction peripheral or device) and determines whether or not the device can be used. The authentication server 101 exists in a location such as a server center, and can exchange data with the schedule management server 102, the database 103, the image forming apparatus 104 and the client terminal 105 at each site via the network 106.

  A schedule management server 102 operates schedule management software in which a user registers a schedule through the client terminal 105. The schedule management server 102 exists at a location such as a server center, and can transmit and receive data to and from the database 103 and the client terminals 105 at each site via the network 106.

  Reference numeral 103 denotes a database in which data necessary for this system is registered. The authentication server 101 and the schedule management server 102 access as necessary to refer to and update data.

  Reference numeral 104 denotes an image forming apparatus (digital multifunction peripheral or device). An image forming apparatus 104 is used by a user and has a function of printing, scanning, copying, FAX transmission, and the like of a document. There are multiple units at each site. When used, authentication is required, and functions and time zones that can be used are limited by the user. In addition, it is restricted so that it can be used only by users who have applied for overtime / holiday work outside business hours. These restrictions are implemented by the authentication server 101 depending on whether authentication processing is possible.

  Reference numeral 105 denotes a terminal, which is used when the user controls the software of the schedule management server 102 to register a schedule or when printing is performed on the image forming apparatus 104. There are multiple units at each site.

  Reference numeral 106 denotes a network, which connects each company base including a server center and each equipment in the base so that they can communicate with each other.

  In FIG. 1, for the sake of convenience of explanation, the description has been made on the assumption that the authentication server 101, the schedule management server 102, and the database 103 are separate housings. However, this is an example, and these devices are identical. Of course, it can be configured in a housing. Further, in FIG. 1, the authentication server 101, the schedule management server 102, the database 103, and the image forming apparatus 104 are illustrated as separate cases for convenience of explanation. Since many of them have a storage area of capacity and applications can be resident, the authentication function of the authentication server, the schedule management function of the schedule management server, and the respective data tables stored in the database are imaged. By providing all the apparatuses, it is possible to realize the embodiment of the present invention as an all-in-one image forming apparatus.

  Hereinafter, the hardware configuration of the information processing apparatus applicable to the authentication server 101, the schedule management server 102, the database 103, and the client terminal 105 illustrated in FIG. 1 will be described with reference to FIG.

  In FIG. 2, reference numeral 201 denotes a CPU that comprehensively controls each device and controller connected to the system bus 204. Further, the ROM 202 or the external memory 211 is necessary to realize a BIOS (Basic Input / Output System) or an operating system program (hereinafter referred to as an OS), which is a control program of the CPU 201, or a function executed by each server or each PC. Stores various programs to be described later.

  A RAM 203 functions as a main memory, work area, and the like for the CPU 201. The CPU 201 implements various operations by loading a program or the like necessary for execution of processing from the ROM 202 or the external memory 211 into the RAM 203 and executing the loaded program.

  An input controller 205 controls input from a keyboard (KB) 209 or a pointing device such as a mouse (not shown). A video controller 206 controls display on a display device such as a CRT display (CRT) 210. In FIG. 2, although described as CRT 210, the display device is not limited to the CRT, but may be another display device such as a liquid crystal display. These are used by the administrator as needed.

  A main controller 207 is connected to an HDD, a flexible disk (FD), or a PCMCIA card slot via an adapter for storing a boot program, various applications, font data, user files, editing files, various data, and the like. The access to the external memory 211 such as a compact flash (registered trademark) memory is controlled.

  A communication I / F controller 208 connects and communicates with an external device via a network, and executes communication control processing on the network. For example, communication using TCP / IP is possible.

  Note that the CPU 201 enables display on the CRT 210 by executing, for example, outline font development (rasterization) processing on a display information area in the RAM 203. In addition, the CPU 201 enables a user instruction with a mouse cursor (not shown) on the CRT 210.

  Various programs to be described later for realizing the present invention are recorded in the external memory 211 and executed by the CPU 201 by being loaded into the RAM 203 as necessary. Furthermore, definition files and various information tables used when executing the program are also stored in the external memory 211, and a detailed description thereof will be described later.

  Next, the hardware configuration of the controller unit that controls the image forming apparatus 104 shown in FIG. 1 will be described with reference to FIG.

  In FIG. 3, reference numeral 316 denotes a controller unit which is connected to a scanner unit 314 functioning as an image input device and a printer unit 312 functioning as an image output device, and is connected to a LAN or a public line (WAN) (for example, PSTN or ISDN). To input / output image data and device information.

  In the controller unit 316, reference numeral 301 denotes a CPU, which is a processor that controls the entire system. Reference numeral 302 denotes a RAM, which is a system network memory for operating the CPU 301, and is also a program memory for recording a program and an image memory for temporarily recording image data.

  A ROM 303 stores a system boot program and various control programs. A hard disk drive (HDD) 304 stores various programs for controlling the system, image data, and the like.

  An operation unit interface (operation unit I / F) 307 is an interface unit with the operation unit (UI) 308 and outputs image data to be displayed on the operation unit 308 to the operation unit 308. The operation unit I / F 307 serves to transmit information (for example, user information) input by the system user from the operation unit 308 to the CPU 301. Note that the operation unit 308 includes a display unit having a touch panel, and various instructions can be given by a user pressing (touching with a finger or the like) a button displayed on the display unit.

  A network interface (Network I / F) 305 is connected to a network (LAN) and inputs / outputs data. A modem (MODEM) 306 is connected to a public line and inputs / outputs data such as FAX transmission / reception.

  Reference numeral 318 denotes an external interface (external I / F), which is an I / F unit that accepts external inputs such as USB, IEEE 1394, printer port, and RS-232C. In this embodiment, for reading an IC card required for authentication Card reader 319 is connected to the external I / F 318. The CPU 301 can control reading of information from the IC card by the card reader 319 via the external I / F 318, and can acquire information read from the IC card. The above devices are arranged on the system bus 309.

  Reference numeral 320 denotes an image bus interface (IMAGE BUS I / F), which is a bus bridge that connects the system bus 309 and an image bus 315 that transfers image data at high speed and converts the data structure.

  The image bus 315 is configured by a PCI bus or IEEE1394. The following devices are arranged on the image bus 315.

  A raster image processor (RIP) 310 develops vector data such as a PDL code into a bitmap image. A printer interface (printer I / F) 311 connects the printer unit 312 and the controller unit 316 and performs synchronous / asynchronous conversion of image data. A scanner interface (scanner I / F) 313 connects the scanner unit 314 and the controller unit 316 and performs synchronous / asynchronous conversion of image data.

  An image processing unit 317 performs correction, processing, and editing on input image data, and performs printer correction, resolution conversion, and the like on print output image data. In addition to this, the image processing unit 317 performs image data rotation and compression / decompression processing such as JPEG for multi-valued image data and JBIG, MMR, MH for binary image data.

  The scanner unit 314 illuminates an image on paper as a document and scans it with a CCD line sensor, thereby converting it into an electrical signal as raster image data. The original paper is set on the tray of the original feeder, and when the apparatus user gives a reading start instruction from the operation unit 308, the CPU 301 gives an instruction to the scanner unit 314, and the feeder feeds the original paper one by one to read the original image. Perform the action.

  The printer unit 312 is a part that converts raster image data into an image on paper. The method is an electrophotographic method using a photosensitive drum or a photosensitive belt, and ink is ejected from a micro nozzle array directly on the paper. There is an inkjet method for printing an image, but any method may be used. The activation of the printing operation is started by an instruction from the CPU 301. The printer unit 312 has a plurality of paper feed stages so that different paper sizes or different paper orientations can be selected, and has a paper cassette corresponding thereto.

  The operation unit 308 has an LCD display unit, and a touch panel sheet is pasted on the LCD. The operation unit 308 displays an operation screen of the system. When a displayed key is pressed, the position information is displayed on the operation unit I / F 307. To the CPU 301 via The operation unit 308 includes, for example, a start key, a stop key, an ID key, a reset key, and the like as various operation keys.

  Here, the start key of the operation unit 308 is used when starting a document image reading operation. At the center of the start key, there are two color LEDs, green and red, which indicate whether or not the start key can be used. Further, the stop key of the operation unit 308 functions to stop the operation in operation. The ID key of the operation unit 308 is used when inputting the user ID of the user. The reset key is used when initializing settings from the operation unit.

  The card reader 319 reads information stored in an IC card (for example, Sony FeliCa (registered trademark)) under the control of the CPU 301, and reads the read information via the external I / F 318. The CPU 301 is notified.

  With the above configuration, the image forming apparatus 104 can transmit the image data read from the scanner unit 314 to the LAN, and print out the print data received from the LAN by the printer unit 312.

  Further, the image data read from the scanner unit 314 can be fax-transmitted on the public line by the modem 306, and the image data received by FAX from the public line can be output by the printer unit 312.

  Next, each table existing on the database 103 and its contents will be described with reference to FIGS.

  FIG. 4 is a structural diagram of the user information table. The user information table is information of a user who uses the image forming apparatus 104 or the client terminal 105, and records information necessary for authentication to the image forming apparatus 104. The user ID 401 is an ID number uniquely assigned to each user in order to uniquely identify the user, and is a main key of this table.

  The user name 402 records the name of the user. The password 403 is security information that is stored by the user, kept secret to others, and input during authentication. The affiliation base ID 404 is ID information of a base where the user is working. Normally, the user can use the image forming apparatus 104 existing at the site indicated by the affiliated site ID 404, and only when the location of the site is recorded in the schedule management software. Control is performed so that only the image forming apparatus 104 can be used.

  FIG. 5 is a structural diagram of the site master. The site master is a table for defining a unique ID number for each site of the company so that the site can be identified on a program or database. The site ID 501 is an ID number uniquely assigned to each site and is the main key of this table. The site name 502 is the name of the site.

  FIG. 6 is a structural diagram of the device master. This is a table for assigning a unique ID number to each image forming apparatus 104 (device) and distinguishing and managing each image forming apparatus 104. A device ID 601 is a unique ID number assigned to each image forming apparatus 104 and is a primary key of this table. The installation base ID 602 is a base ID of a base where the image forming apparatus is installed.

  FIG. 7 is a structural diagram of the device function master. 4 is a table for assigning ID numbers to functions of the image forming apparatus 104 (device). Specifically, an ID number is assigned to 1 for the “print function” and 2 for the “copy function”. The function ID 701 is an ID number assigned for each function and is the main key of this table. A function name 702 is a name of a specific function such as printing, scanning, copying, and FAX transmission.

  FIG. 8 is an available device function management table. This is a table for registering which users can use the function and which functions can be used for each image forming apparatus. A device ID 801 is a device ID of a target device. A user ID 802 is a user ID of a user who is permitted to use the function for the device. A function ID 803 is a function ID of the function of the device permitted to the user. The combination of the three keys of device ID 801, user ID 802, and function ID 803 is unique.

  It is a business hours management table of FIG. It is a table for managing the business hours of the company by yearly dates and times, and is used as information for preventing the image forming apparatus 104 from being used outside business hours. Date 901 is the date of the business day and is the primary key of this table. Records must be registered for all business days of the year. The business start time 902 is the business start time on the date. The business end time 903 is the business end time on the date.

  FIG. 10 is a schedule management table. This is information on an outing schedule that the user controls and inputs software operating on the schedule management server 102 from the client terminal 105.

  The schedule ID 1001 is a unique ID and is an ID number assigned for each user schedule registration. This is the primary key of this table. The user ID 1002 is the user ID of the user who is the party who registered the schedule. A date 1003 is a date of the implementation date of the registered schedule. The start time 1004 is a time when the schedule is started. An end time 1005 is a time at which the execution of the schedule ends.

  The requirement 1006 is an area where the user freely inputs text regarding the contents of the schedule. The base ID 1007 is a base ID of a base where the schedule-registered business is executed, and represents the base where the user is located at the schedule execution time. When the place where the business is executed is a place outside the base, “0” meaning “outside the base” is input to this item. The destination name 1008 is an area where the user can freely enter the name of the place as text when the place where the business is performed is a place outside the base.

  FIG. 11 is an overtime / holiday attendance management table. A table that is recorded when a user applies for overtime / holiday work, and is a table that is used as information for enabling the user who applied for the image forming apparatus 104, which cannot be used outside business hours, to be used only during the application time. It is. The user ID 1101 is the user ID of the user who applied for overtime / holiday work. A date 1102 is a date for applying for overtime or holiday work. The start time 1103 is a scheduled time for starting an overtime / holiday work activity. The end time 1104 is a scheduled time at which the overtime / holiday work activity ends. The combination of the user ID 1101 and the date 1102 is unique.

  Next, the structure of communication data transmitted from the image forming apparatus 104 to the authentication server 101 during user authentication will be described with reference to FIG. FIG. 12 is a structure diagram of communication data transmitted from the image forming apparatus 104 to the authentication server 101 at the time of user authentication. This is to inform the authentication server 101 which user is making an authentication request to use which function to which image forming apparatus. The device ID 1201 is the device ID of the image forming apparatus that the user is attempting to log in with the device ID of the image forming apparatus itself that has transmitted this data.

  The function ID 1202 is a function ID of a device function that the user requests to use. A user ID 1203 is a user ID of a user who requests login to the image forming apparatus, and is specified by a method such as an input by the user himself / herself to an input device of the image forming apparatus. A password 1204 is a password of a user who requests login to the image forming apparatus, and is specified by a method such as input by the user himself / herself to an input device of the image forming apparatus.

  Next, the operation of a program that operates on the image forming apparatus 104 when the user makes an authentication request in the image forming apparatus 104 will be described with reference to FIG. FIG. 13 is a flowchart showing an example of a first control processing procedure in the image forming system of the present invention. This corresponds to the processing of the image forming apparatus 104 and the authentication server 101 shown in FIG. Note that the processing of this flowchart is realized by the CPU 301 of the image forming apparatus 104 executing a program read from the ROM 303 or a program read from the HDD 304 onto the RAM 302. In the figure, S1301 to S1308 indicate each step.

  First, when the program of the image forming apparatus 104 is activated, in step 1301, the user is always on standby for operation of the image forming apparatus 104. At this time, the user waits for user information to be input. Specifically, a storage medium (for example, an IC card) held by a user touches a card reader / writer connected to the image forming apparatus 104, or a display unit (operation panel) of the image forming apparatus 104. The user information (user ID, password, etc.) is received on the login screen displayed on ().

  When the user inputs a user ID or password to the operation panel of the image forming apparatus 104 by the user action shown in 1301, the process proceeds to step 1302. In step 1302, the CPU 301 of the image forming apparatus 104 displays a function selection screen on the display unit (operation panel) and prompts the user to select a function to be used. The user selects a function by operating the operation panel of the image forming apparatus 104 or the like. For example, buttons such as “print”, “scan”, “copy”, and “fax transmission” are displayed on the operation panel, and an operation such as an instruction to press “print” is performed. If an operation by the user is accepted, the process proceeds to step 1303. Depending on the type of image forming apparatus, the functions that can be used in the initial setting may be limited. Therefore, it is assumed that the function of default setting is set without receiving the use function selection reception in step 1302. The

  In step 1303, the CPU 301 of the image forming apparatus 104 generates the communication data shown in FIG. That is, the device ID 1201 is set with its own device ID (unique character string such as an individual identification number) recorded in the storage device (HDD 304) of the image forming apparatus 104, and the function ID 1202 is selected by the user in step 1302 The function ID of the entered function is set, the user ID received from the user in step 1301 is set in the user ID 1203, and the password accepted from the user in step 1301 is inserted in the password 1204. When user information is received by receiving a touch on the IC card, an individual identification number of the IC card may be transmitted. The communication data thus formed (FIG. 12) is transmitted to the authentication server 101 via the network 106.

  In step 1308, the CPU 201 of the authentication server 101 receives communication data transmitted from the image forming apparatus 104, determines whether the user can use the data, and returns the result to the image forming apparatus 104. Step S1308 will be described later with reference to FIG.

  In step 1304, the CPU 301 of the image forming apparatus 104 waits for a response as a result of the user authentication executed by the authentication server 101. When the authentication propriety information is returned from the authentication server 101, the process proceeds to the determination in step 1305.

  In step 1305, the CPU 301 of the image forming apparatus 104 confirms the authentication propriety information returned from the authentication server 101. If the authentication is determined to be unsuccessful (NG), the process proceeds to step 1307 where the authentication is successful (OK). If it is determined, the process proceeds to Step 1306.

  In step 1307, the fact that the authentication has failed is displayed on the operation panel or the like, and the process returns to step 1301 to wait for the next user to log in. As a notification method of the authentication error, there is a method of notifying by voice other than displaying an error on the operation panel.

  In step 1306, based on the successful authentication, the screen after login is displayed, and the function designated by the user can be used. Since the subsequent operation of the image forming apparatus is normal, the illustration of the flow is omitted.

  Next, the operation of the program (S1308 in FIG. 13) that operates on the authentication server 101 when the authentication server 101 receives an authentication request from the image forming apparatus 104 will be described with reference to FIG.

  14A and 14B are flowcharts showing an example of a second control processing procedure in the image forming system of the present invention. This corresponds to the processing of the authentication server 101 and the schedule management server 102 shown in FIG. Note that the processing of this flowchart is realized by the CPU 201 of the authentication server 101 and the schedule management server 102 executing a program read from the ROM 202 or a program read from the HDD 211 onto the RAM 203. In the figure, S1401 to S1418 indicate each step.

  In step 1401, the CPU 201 of the authentication server 101 enters a state of waiting for the communication data shown in FIG. 12 from the image forming apparatus 104. When the image forming apparatus 104 executes step 1303 in FIG. 13 (when the communication data is transmitted to the authentication server 101), the communication data in FIG. 12 is received.

  In step 1402, the user ID 1203 and password 1204 are extracted from the transmitted communication data (FIG. 12) and collated with the record stored in the user information table shown in FIG.

  The collation result is confirmed, and there is a record whose contents match between the user ID 1203 of the communication data and the user ID 401 of the user information table in FIG. If it does, authentication is successful. Otherwise, authentication fails.

  In step 1403, if the user authentication has failed (NO), the CPU 201 of the authentication server 101 proceeds to step 1405 and returns information indicating that the authentication has failed to the image forming apparatus 104. The image forming apparatus 104 receives the return in step 1304 in FIG. 13, and the subsequent operation is as described above. The flowchart of FIG. 14 returns to Step 1401, and again enters a state of waiting for an authentication request from the image forming apparatus 104.

  In step 1403, if the authentication is successful, the CPU 201 of the authentication server 101 proceeds to step 1404. Here, it is expressed that the authentication has succeeded in the sense of whether the user is valid or not, but the final authentication success requires judgment in the subsequent steps.

  In step 1404, the CPU 201 of the authentication server 101 confirms whether or not the user is permitted to use the function for which use is requested (the function accepted in S1302 in FIG. 13). That is, the available device function management table shown in FIG. 8 is collated, the device ID 1201 of the communication data matches the content of the device ID 801 of the available device function management table, and the user ID 1203 of the communication data matches the available device function. When the contents of the user ID 802 of the management table match and there is a record in which the function ID 1202 of the communication data and the function ID 803 of the available device function management table match, the function for which use is requested is permitted for the user. Can be judged.

  In step 1406, the CPU 201 of the authentication server 101 makes a determination. If it is determined that the user's function to be used is not permitted for the user, the process proceeds to step 1407, and information indicating that the authentication has failed is formed. Return to device 104. The image forming apparatus 104 receives the return in step 1304 in FIG. 13, and the subsequent operation is as described above. The program in FIG. 14 returns to Step 1401, and again enters a state of waiting for an authentication request from the image forming apparatus 104.

  In step 1406, the CPU 201 of the authentication server 101 makes a determination. If it is determined that the function for which use is requested is permitted for the user, the process proceeds to step 1408.

  In step 1408, for the purpose of confirming the location of the user, the installation base ID of the image forming apparatus 104 is acquired from the device master shown in FIG. 6, that is, the contents of the device ID 1201 of the communication data and the device ID 601 of the device master match. The record to be found is found, and the installation base ID 602 of the record is acquired.

  In step 1409, the CPU 201 of the authentication server 101 acquires the value of the current time from the time information of the authentication server 101 in order to compare the schedule with the current time later.

  In step 1410, it is confirmed whether or not the current time is within business hours in order to collate with the principle that the use of the image forming apparatus 104 is limited to business hours. That is, the business hours management table shown in FIG. 9 is collated. When the current time corresponds to the date 901 registered in the business hours management table and is between the business start time 902 and the business end time 903, it is determined that the current time is within business hours. It is judged that.

  In step 1411, if it is determined that it is within the business hours of the installation base of the device to be used, the process proceeds to step 1414, and if it is determined that it is outside business hours, the user applies for overtime / holiday work. The process proceeds to step 1412 to confirm whether the

  In step 1412, if the user has applied for overtime / holiday work, the use of the image forming apparatus 104 is permitted within the application time, so whether the application time is within the application time is confirmed. That is, in the overtime / holiday attendance management table shown in FIG. 11, the contents of the user ID 1203 of the communication data match the user ID 1101 of the overtime / holiday attendance management table, the date 1102 corresponds to the current time, and the current time is When it is between the start time 1103 and the end time 1104, it is determined that it is within the application time, and otherwise it is determined that it is outside the application time.

  If it is determined in step 1413 that it is outside the application time, the process proceeds to step 1417, and information indicating that the authentication has failed is returned to the image forming apparatus 104. The image forming apparatus 104 receives the return in step 1304 in FIG. 13, and the subsequent operation is as described above. The program in FIG. 14 returns to Step 1401, and again enters a state of waiting for an authentication request from the image forming apparatus 104. If it is determined that it is within the application time, the process proceeds to step 1414.

  In step 1414, the CPU 201 of the authentication server 101 acquires the base ID of the base where the user is located at the current time. Details of the processing in step S1414 will be described with reference to FIG.

  FIG. 16 is a flowchart showing an example of detailed processing in step S1414 in the image forming system of the present invention. This corresponds to the processing of the authentication server 101 and the schedule management server 102 shown in FIG.

  Note that the processing of this flowchart is realized by the CPU 201 of the authentication server 101 and the schedule management server 102 executing a program read from the ROM 202 or a program read from the HDD 211 onto the RAM 203. In the figure, S1701 to S1711 indicate steps.

  In step S1701, the CPU 201 of the authentication server 101 searches the schedule management table shown in FIG. 10 for the user ID and date, and acquires all the schedules for the user today.

  For example, if the user with the user ID 10001 is December 9, 2011, the schedule “Meeting with the base ID 102 from 14:00 to 16:00” is acquired.

  In step S1702, the CPU 201 of the authentication server 101

  In step S1702, the CPU 201 of the authentication server 101 determines whether the current time is included in any schedule based on the start time and end time of each schedule acquired in step S1701.

  Here, a case where the current time is included before a predetermined time (for example, a preparation time registered in advance in a table as shown in FIG. 17) from the schedule start time is also included in the schedule.

  For example, as shown in FIG. 17, when the preset time is “10 minutes” and the schedule start time is 14:00, the time after 13:50 is regarded as being in the schedule. If the current time is 13:55, it is actually before the start time, but is determined to be within the schedule.

  Accordingly, since the image forming apparatus can be used at the base of the schedule before the start time of the schedule, for example, the conference material can be printed at the base where the conference is held before the start of the meeting. .

  Further, as shown in FIG. 18, the preparation time may be set differently depending on the type of schedule.

  If it is determined in step S1702 that the current time is included in any of the schedules acquired in step S1701 (step S1702: YES), the process proceeds to step S1703.

  In step S1703, the CPU 201 of the authentication server 101 acquires the base ID of the schedule determined to include the current time in step S1702 as the base ID that the current user should be.

  Then, the process of this flowchart is terminated, and the process proceeds to step S1415.

  If it is determined in step S1702 that the current time is not included in any of the schedules acquired in step S1701 (step S1702: NO), the process proceeds to step S1704.

  In step S1704, the CPU 201 of the authentication server 101 determines whether the schedule ID immediately before the current time and the base ID of the schedule immediately after are the same.

  If the base IDs are the same (step S1704: YES), the process proceeds to step S1705.

  If the site IDs are different (step S1704: NO), the process proceeds to step S1708.

In step S1705, the CPU 201 of the authentication server 101 acquires the user's affiliated base from the user information management table. If the base ID of the schedule immediately before and immediately after determined in step S1704 is the same as the base ID of the user's affiliated base, the process proceeds to step S1707.
If not, the process proceeds to step S1706.

  In step S1706, the CPU 201 of the authentication server 101 acquires the time required for movement between the user's affiliated base and the base with the schedule from the inter-base movement time designation table (FIG. 19). And the time from the time when the travel time is added to the end time of the immediately preceding schedule to the time when the travel time is subtracted from the start time of the immediately following schedule is a predetermined time (for example, the shortest stay registered as shown in FIG. 20) Time) or more.

  FIG. 19 is a table that defines the time required to move from one base to another. It is a table in which the combination of the base of base ID-1 and the base of base ID-2 is unique. It is assumed that the administrator registers in advance the travel time between each base.

  For example, it is assumed that there is a meeting at the A site from 13:00 to 14:00 and 15:30 to 17:00, and the travel time from the A site to the affiliated site is 20 minutes. In this case, from 14:20 obtained by adding 20 minutes of travel time to 14:00, which is the end time of the immediately preceding schedule, to 15:10 obtained by subtracting 20 minutes of travel time from 15:30, which is the start time of the immediately following schedule. Is 50 minutes. If the predetermined time is 1 hour, the determination in step S1706 is NO, and the process proceeds to step S1707.

  On the other hand, it is assumed that there is a meeting at the A site from 13:00 to 14:00 and 16:30 to 18:00, and the travel time from the A site to the affiliated site is 20 minutes. In this case, from 14:20 obtained by adding 20 minutes of travel time to 14:00, which is the end time of the previous schedule, to 16:10 obtained by subtracting 20 minutes of travel time from 16:30, which is the start time of the immediately subsequent schedule. Is 1 hour 50 minutes. If the predetermined time is 1 hour, the determination in step S1706 is YES, and the process proceeds to step S1711.

  Thus, even when returning to the affiliated base, if the time required for entering the affiliated base is short (less than a predetermined time), it is considered that the person stays at the A base without returning to the affiliated base. Therefore, in such a case, the process proceeds to step S1707 so that the image forming apparatus at the base where the immediately preceding / immediate schedule is performed can be used.

  In step S1707, the CPU 201 of the authentication server 101 acquires the ID of the base where the immediately preceding / immediate schedule is performed as the base ID that the user should be present.

  In step S1708, the CPU 201 of the authentication server 101 acquires the user's affiliated base from the user information management table. Then, it is determined whether any of the preceding and following schedules are performed at a base other than the affiliated base.

  If any of the schedules before and after is performed at a base other than the affiliated base (step S1708: YES), the process proceeds to step S1709.

  If any of the preceding and following schedules is performed at the affiliated site (step S1708: NO), the process proceeds to step S1711.

  In step S1709, the CPU 201 of the authentication server 101 acquires the time required for movement between the affiliated base and the schedule base from the inter-base movement time designation table.

  Then, it is determined whether the time from the time obtained by adding the travel time to the end time of the immediately preceding schedule to the time obtained by subtracting the travel time from the start time of the immediately following schedule is equal to or greater than a predetermined time (FIG. 20).

  That is, it is determined whether or not the user can stay at the base for a predetermined time or more.

  If it is longer than the predetermined time (step S1709: YES), the process proceeds to step S1711.

  If it is not longer than the predetermined time (step S1709: NO), the process proceeds to step S1710.

  In step S1710, the CPU 201 of the authentication server 101 determines that the user is currently moving, and acquires 0 as the base ID that the user should be currently in. Then, the process of this flowchart is terminated, and the process proceeds to step S1415.

  In step S1711, the CPU 201 of the authentication server 101 determines whether the current time is moving.

  In the case of YES in step S1706 or YES in step S1709, the time zone being moved is the time from the end time of the previous schedule to the time the travel time from the base of the previous schedule to the affiliated base elapses, Also, it indicates the time from the time when the preparation time is subtracted from the start time of the immediately following schedule to the time before the travel time from the affiliated site to the immediately following schedule.

  That is, if the schedule at point A ends at 13:00 and the travel time from point A to the affiliated base is 20 minutes, the time zone from 13:00 to 13:20 is the travel time. Become.

  In addition, if the schedule starts at 16:00 at point B, and the travel time from your base to point B is 30 minutes and the preparation time is 10 minutes, it will move from 15:20 to 15:50 It will be time. In addition, it is preparation time from 15:50 to 16:00.

  That is, in this case, the time from 13:00 to 13:20 and the time from 15:20 to 15:50 are travel times.

In the case of YES in step S1708, the time from the end time of the immediately preceding schedule until the travel time from the immediately preceding schedule base to the affiliated site has elapsed, or the immediately following schedule start time immediately after the affiliated site. Time before the travel time to the base of the schedule.
That is,

  If it is determined that the user is moving (step S1711: YES), the process proceeds to step S1713.

  If it is determined that it is not moving (step S1711: NO), the process proceeds to step S1712.

  In step S <b> 1712, the CPU 201 of the authentication server 101 determines that the user is currently at the affiliated site, and acquires the site ID of the user's affiliated site as the site ID to which the user should be present.

  Then, the process shown in this flowchart is terminated, and the process proceeds to step S1415.

  In step S1713, since the user is currently moving, there is no base where the user should be present, and 0 is acquired as the base ID.

  Then, the process shown in this flowchart is terminated, and the process proceeds to step S1415.

  If there is no corresponding record, it can be determined that the user is located at the site to which the user belongs at the current time, so the user information table is checked to obtain the assigned site ID. In other words, the affiliated site ID 404 of the record in which the contents of the user ID 1203 of the communication data and the content of the user ID 401 of the user information table match is acquired and set as the current location ID.

  In step 1415, the CPU 201 of the authentication server 101 compares the installation base ID of the image forming apparatus 104 acquired in step 1409 with the current location base ID acquired in step 1416 to determine whether they are the same.

  If the CPU 201 of the authentication server 101 determines in step 1416 that the installation site ID of the image forming apparatus 104 is different from the current location site ID, printing impersonating the user is performed at the site where the user is absent. If the authentication is unsuccessful, the process advances to step 1417 to return information indicating that the authentication has failed to the image forming apparatus 104. The image forming apparatus 104 receives the return in step 1304 in FIG. 13, and the subsequent operation is as described above. The program in FIG. 14 returns to Step 1401, and again enters a state of waiting for an authentication request from the image forming apparatus 104. If the current location ID is 0, the user is out of the location and does not match the location ID of the image forming apparatus 104. In this case, authentication always fails.

  When the CPU 201 of the authentication server 101 determines that the installation base ID of the image forming apparatus 104 matches the current base ID, it is determined that an authentication request has actually been made at the location where the user is present, and the authentication is successful. It proceeds to step 1418.

  In step 1418, the CPU 201 of the authentication server 101 returns information indicating that the authentication is successful to the image forming apparatus 104. The image forming apparatus 104 receives the return in step 1304 in FIG. 13, and the subsequent operation is as described above. The program in FIG. 14 returns to Step 1401, and again enters a state of waiting for an authentication request from the image forming apparatus 104.

  Next, an operation screen of software operating on the schedule management server 102 displayed on the screen of the client terminal 105 will be described with reference to FIG. FIG. 15 is an image diagram of an operation screen of software operating on the schedule management server 102 and is displayed on the client terminal 105. This screen may be a web screen transmitted from the schedule management server 102 or a screen of application software installed in the client terminal 105.

  The schedule management software generally displays a calendar screen (not shown), and displays a screen for inputting a schedule when a specific date is selected. FIG. 15 is a screen for inputting a user's going-out schedule displayed at this time.

  Reference numeral 1501 denotes a date display, which is assumed to be selected from a calendar screen (not shown) before this screen is opened. Reference numeral 1502 denotes a field for inputting a text of a message when going out, and the user can freely input the contents. Reference numeral 1503 denotes a field for inputting a time when a business trip is started. Reference numeral 1504 denotes a field for inputting a time at which the business at the destination is completed.

  1505 and 1506 are mutually exclusive selection buttons, and only one of them can be selected. When going out to another site of the company, 1505 is selected, and a site name is selected from 1507. When going out of the base, 1506 is selected, and a destination name or the like is freely input in a text input field 1508.

  A cancel button 1509 invalidates the content input on this screen and closes the screen without reflecting it in the database 103.

  Reference numeral 1510 denotes an OK button, which reflects the contents input on this screen in the database 103 and ends. That is, in the schedule management table shown in FIG. 10 on the database 103, the ID of the user who operates the client terminal 105 is input to the user ID 1002, the date displayed in 1501 is input to the date 1003, and 1503 is input to the start time 1004. The time of 1504 is input to the end time 1005, the content of 1502 is input to the requirement 1006, and the base ID that matches the base name selected in 1507 is acquired from the base master and input to the base ID 1007 To do. However, if 1505 is not selected and 1506 is selected, 0 is entered in the base ID 1007 and the contents of 1508 are entered in the destination name 1008. Finally, a unique value is set in the schedule ID 1001 to complete the record.

  FIG. 17 is a diagram illustrating an example of a database in which the preparation time used in step S1702 is registered. As shown in FIG. 17, when “10 minutes” is registered, the image forming apparatus at the base with the schedule can be used from 10 minutes before the start time of the schedule.

  FIG. 18 is a diagram showing an example of a database in which the preparation time used in step S1702 is registered as in FIG. In FIG. 18, the preparation time is registered for each type of schedule.

  FIG. 19 is a table that defines the time required to move from one base to another. It is a table in which the combination of the base of base ID-1 and the base of base ID-2 is unique. It is assumed that the administrator registers in advance the travel time between each base.

  FIG. 20 is an example of a database in which the minimum stay time used in steps S1706 and S1709 is registered.

  According to the present invention described above, it is possible to prevent impersonation use of the image forming apparatus when a legitimate user is absent. In addition, it is possible to provide a mechanism that enables the use of an image forming apparatus at a location according to a valid user schedule. In addition, it is possible to determine whether or not the image forming apparatus can be used in consideration of the travel time between bases and the preparation time before the meeting. As a result, it is possible to increase the convenience of using the image forming apparatus by a legitimate user while preventing unauthorized use.

  That is, according to the present invention, in an information processing apparatus that performs use authentication of a user's image forming apparatus, the schedule information storage unit that stores the user's schedule information in association with the user identification information of the user, and the image forming apparatus By using the authentication request receiving means for receiving the authentication request including the user identification information of the user and the base information where the image forming apparatus is installed, and the user identification information received by the authentication request receiving means, Schedule information acquisition means for acquiring the user's schedule information stored in the schedule information storage means associated with user identification information, and the user's schedule included in the schedule information acquired by the schedule information acquisition means is scheduled Received by the authentication request receiving means By using the serial location information, characterized by comprising a determining means for determining whether or not available an image forming apparatus wherein the user sends the authentication request.

  As described above, a recording medium that records a program that implements the functions of the above-described embodiments is supplied to a system or apparatus, and a computer (or CPU or MPU) of the system or apparatus stores the program stored in the recording medium. It goes without saying that the object of the present invention can also be achieved by executing the reading.

  In this case, the program itself read from the recording medium realizes the novel function of the present invention, and the recording medium storing the program constitutes the present invention.

  As a recording medium for supplying the program, for example, a flexible disk, hard disk, optical disk, magneto-optical disk, CD-ROM, CD-R, DVD-ROM, magnetic tape, nonvolatile memory card, ROM, EEPROM, silicon A disk or the like can be used.

  Further, by executing the program read by the image forming apparatus 104, the authentication server 101, the schedule management server 102, and the database 103, not only the functions of the above-described embodiment are realized, but also based on the instructions of the program, It goes without saying that a case where an OS (operating system) or the like running on a computer performs part or all of actual processing and the functions of the above-described embodiments are realized by the processing is included.

  Furthermore, after the program read from the recording medium is written to the memory provided in the function expansion board inserted into the computer or the function expansion unit connected to the computer, the function expansion board is based on the instructions of the program code. It goes without saying that the case where the CPU or the like provided in the function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing.

  Further, the present invention may be applied to a system composed of a plurality of devices or an apparatus composed of a single device. Needless to say, the present invention can be applied to a case where the present invention is achieved by supplying a program to a system or apparatus. In this case, by reading a recording medium storing a program for achieving the present invention into the system or apparatus, the system or apparatus can enjoy the effects of the present invention.

  Furthermore, by downloading and reading a program for achieving the present invention from a server, database, etc. on a network using a communication program, the system or apparatus can enjoy the effects of the present invention. In addition, all the structures which combined each embodiment mentioned above and its modification are also included in this invention.

  In addition, each process realized by the above-described software can be realized as firmware or hardware configuration, and each process can be realized as each means. The technical scope of the present invention is realized by such firmware or hardware configuration. Is also included.

101 Authentication Server 102 Schedule Management Server 103 Database 104 Image Forming Apparatus (Digital Multifunction Machine, Device)
105 Client PC
401 Unique ID that uniquely represents a user
402 User name 403 User password 404 ID of the site to which the user belongs
501 Unique ID that uniquely represents the location
502 Base name 601 Unique ID that uniquely represents the image forming apparatus
602 ID of the base where the image forming apparatus is installed
701 Unique ID that uniquely represents the function of the image forming apparatus
702 ID of an image forming apparatus that can use 801 functions such as “print”, “scan”, “copy”, and “fax transmission”.
802 ID of the user who can use the function
803 ID of available function
901 Business day date 902 Business start time 903 Business end time 1001 Unique ID that uniquely represents the schedule
1002 ID of the user who registered the schedule
1003 Schedule date 1004 Schedule start time 1005 Schedule end time 1006 Schedule details 1007 ID of the base that executes the schedule
1008 Destination 1101 off-site ID of user who applied for overtime / holiday work
1102 Date of overtime / holiday work 1103 Overtime / holiday start time 1104 Overtime / holiday end time 1201 Device ID of the image forming apparatus that transmitted the data
1202 Function ID to use
1203 ID of the user who wants to use the function
1204 Password of the user who wants to use the function

Claims (11)

In an information processing apparatus that executes user authentication of an image forming apparatus,
Schedule information storage means for storing schedule information including schedule start time, end time and base information on which the schedule is performed in association with the user identification information of the user;
An authentication request receiving means for receiving an authentication request including the user identification information and base information where the image forming apparatus is installed from the image forming apparatus;
Time information acquisition means for acquiring the time when the authentication request is received by the authentication request receiving means;
Schedule information acquisition means for acquiring schedule information associated with the user identification information received by the authentication request reception means from the schedule information storage means;
By using the schedule information acquired by the schedule information acquisition unit, the base information included in the authentication request received by the authentication request reception unit, and the time acquired by the time information acquisition unit, the user makes the authentication request Determining means for determining whether or not the image forming apparatus that has transmitted
With
The schedule information storage means further stores a travel time between bases,
The determination means may further include, when the travel time to the base where the next schedule is scheduled or the user's affiliation has elapsed after the end time of the schedule, An information processing apparatus that determines that an image forming apparatus can be used.   When the time when the authentication request is received is included between the start time of the schedule and the end time of the schedule, the determination unit determines that the image forming apparatus at the base where the schedule is performed can be used. The information processing apparatus according to claim 1. The schedule information storage means further stores preparation time for preparation of the schedule,
When the time when the authentication request is received is included between the preparation time before the start time of the schedule and the end time of the schedule, the determination unit can use the image forming apparatus at the base where the schedule is performed. The information processing apparatus according to claim 1, wherein: The schedule information storage means further stores the shortest stay time used for determining whether to return to the affiliated base between schedules,
The determination means is a case where the base where the immediately preceding schedule is performed and the base where the immediately following schedule is performed are the same, and the travel time from the base to the user's base and the base to the base When the time obtained by removing the total time from the travel time up to and the preparation time from the time from the end time of the immediately preceding schedule to the start time of the immediately following schedule does not satisfy the shortest stay time, The information processing apparatus according to claim 3 , wherein it is determined that the image forming apparatus can be used at the base from the end time of the schedule to the start time of the schedule immediately after.   The determination unit determines that the user can use the image forming apparatus at the base to which the user belongs for a time period other than the time when the image forming apparatus at the base where the schedule is performed and the travel time are determined. The information processing apparatus according to claim 1, wherein the information processing apparatus is an information processing apparatus. Business hours storage means for storing the base information and the business hours of the base indicated by the base information in association with each other;
Business hours determination means for determining whether the base indicated by the base information received by the authentication request reception means is within business hours;
Further comprising
The determination unit can further use the image forming apparatus at the base when the base indicated by the base information received by the authentication request reception unit is within the business hours by the business time determination unit. The information processing apparatus according to any one of claims 1 to 5, wherein the information processing apparatus is determined. For each of the image forming apparatuses, the image forming apparatus further includes a use function storage unit that stores the user identification information and the function of the image forming apparatus that can be used by the user indicated by the user identification information.
The authentication request receiving means further receives information of a function desired by the user who has received a selection by the user in the image forming apparatus,
If the function that the user desires to use is a function that can be used by using the information on the function of the image forming apparatus that can be used by the user stored in the use function storage unit, The information processing apparatus according to claim 1, wherein the information processing apparatus determines that the forming apparatus can be used. The schedule information storage means further stores a schedule outside the business hours of the user,
The determination means further determines that the base indicated by the base information received by the authentication request receiving means by the business hours determination means is outside business hours, and stores the information outside the business hours of the user in the schedule information storage means. The information processing apparatus according to claim 6, wherein when the schedule is stored, it is determined that the user can use the image forming apparatus at the base.   9. The apparatus according to claim 1, further comprising an error transmission unit configured to transmit information indicating an approval error to the image forming apparatus when the determination unit determines that the image forming apparatus cannot be used. The information processing apparatus according to any one of claims. Start time of the schedule, the schedule information including the location information of the end time and the schedule is performed, and stores put user identification information and string Yu chromatography The, further comprising a storage means for storing the travel time between locations, the user An information processing method in an information processing apparatus that executes use authentication of an image forming apparatus,
An authentication request receiving step of receiving an authentication request including the user identification information and the base information where the image forming apparatus is installed, from the image forming apparatus;
A time information acquisition step in which the time information acquisition means of the information processing apparatus acquires the time when the authentication request is received in the authentication request reception step;
Schedule information acquisition unit of the information processing apparatus, and the schedule information acquiring step of acquiring a string attached schedule information to the user identification information received by the authentication request receiving step from the storage means,
The determination unit of the information processing apparatus uses the schedule information acquired in the schedule information acquisition step, the base information included in the authentication request received in the authentication request reception step, and the time acquired in the time information acquisition step. A determination step for determining whether the user can use the image forming apparatus that has transmitted the authentication request;
With
In the determination step, after the end time of the schedule, if the travel time to the base where the next schedule is scheduled or the user's affiliation has elapsed, the base or affiliation of the base where the next schedule is performed An information processing method for determining that an image forming apparatus can be used. Start time of the schedule, the schedule information including the location information of the end time and the schedule is performed, and stores put user identification information and string Yu chromatography The, further comprising a storage means for storing the travel time between locations, the user A program that can be executed in an information processing apparatus that performs use authentication of an image forming apparatus,
The information processing apparatus;
An authentication request receiving means for receiving an authentication request including the user identification information and base information where the image forming apparatus is installed from the image forming apparatus;
Time information acquisition means for acquiring the time when the authentication request is received by the authentication request receiving means;
Schedule information acquisition means for acquiring schedule information associated with the user identification information received by the authentication request reception means from the schedule information storage means;
By using the schedule information acquired by the schedule information acquisition unit, the base information included in the authentication request received by the authentication request reception unit, and the time acquired by the time information acquisition unit, the user makes the authentication request Function as a determination unit that determines whether the image forming apparatus that has transmitted
Further, after the end time of the schedule, when the travel time to the base where the next schedule is scheduled or the user's belonging base has passed, the determination means further includes an image of the base or the belonging base where the next schedule is performed. A program that causes a forming apparatus to function as a means for determining that it can be used.

Images