WO2024047801A1

WO2024047801A1 - Image processing device and communication system

Info

Publication number: WO2024047801A1
Application number: PCT/JP2022/032789
Authority: WO
Inventors: 浩史岡; 博文鈴木; 茂樹高谷; 雅俊郷
Original assignee: 京セラ株式会社
Priority date: 2022-08-31
Filing date: 2022-08-31
Publication date: 2024-03-07
Also published as: JP7408027B1

Abstract

In an image processing device according to the present invention, a control unit controls cancelling of functional limitations relating to an image processing unit on the basis of the result of authentication in which second biometric information input to an input unit is compared with first biometric information saved in a memory. The image processing device can also control cancelling of functional limitations relating to the image processing unit on the basis of the result of authentication in which first biometric information of a first user, imported from another image processing device in response to an input of information identifying the first user, is compared with second biometric information of the first user. Alternatively or in addition, the image processing device can also export second biometric information of a first user to another image processing device, receive the result of authentication based on the second biometric information of the first user from the other image processing device, and control cancelling of functional limitations relating to the image processing unit on the basis of the received authentication result.

Description

Image processing device and communication system

The present disclosure relates to an image processing device having at least one of a printer and a scanner, and a communication system including the image processing device.

There is known an image processing device (or a communication system including the image processing device) that performs biometric authentication and limits and removes restrictions on functions available to the user according to the authentication result (for example, Patent Document 1 listed below). . Patent Document 1 generally discloses the following two types of communication systems.

In one communication system of Patent Document 1, an image processing device acquires biometric information of a user, transmits it to a server, and causes the server to register the biometric information as verification biometric information. When a user attempts to use the image processing device, the image processing device allows the user to input biometric information and transmits the input biometric information to the server. The server performs authentication by comparing the received biometric information with the above-mentioned verification biometric information, and returns the authentication result to the image processing device.

In another communication system disclosed in Patent Document 1, an image processing device acquires biometric information of a user and registers the biometric information as verification biometric information in a table held by the image processing device. When a user attempts to use an image processing device, the image processing device allows the user to input biometric information, compares the input biometric information with the verification biometric information registered in the table above, and performs authentication. conduct. The image processing apparatus periodically acquires update information of tables held by other image processing apparatuses and reflects the information in its own table.

Japanese Patent Application Publication No. 2008-21222

An image processing device according to one aspect of the present disclosure includes an image processing section, an input section, a memory, and a control section. The image processing section includes at least one of a printer and a scanner. The input unit receives the user's biometric information. The memory stores first biometric information for each user. The control unit controls functions related to the image processing unit based on an authentication result that compares the second biometric information input to the input unit and the first biometric information stored in the memory. Control the release of restrictions.

In one example, the image processing device stores first biometric information of the first user and second biometric information of the first user imported from another image processing device in response to input of information specifying the first user. It is also possible to control the release of restrictions on functions related to the image processing section based on the authentication results compared with the above.

In one example, the image processing device exports second biometric information of the first user to another image processing device, and receives an authentication result based on the second biometric information of the first user from the other image processing device. It is also possible to control the release of restrictions on functions related to the image processing unit based on the received authentication result.

A communication system according to one aspect of the present disclosure includes the image processing device and the other image processing device.

FIG. 1 is a schematic diagram for explaining an overview of an embodiment. FIG. 1 is a schematic diagram for explaining the configuration of an image processing device and a network according to an embodiment. FIG. 1 is a schematic diagram showing a hardware configuration related to a signal processing system of an image processing device according to an embodiment. 5 is a flowchart illustrating an example of a procedure of processing executed by the image processing apparatus according to the first embodiment. 5A, 5B, and 5C are schematic diagrams showing examples of images displayed on the screen of the image processing device according to the first embodiment. 6A and 6B are schematic diagrams showing other examples of images displayed on the screen of the image processing apparatus according to the first embodiment. 5 is a flowchart showing details of some procedures in FIG. 4. 8 is a flowchart showing details of some procedures in FIG. 7. 7 is a flowchart illustrating an example of a procedure of processing executed by the image processing apparatus according to the second embodiment. 10 is a flowchart showing details of some procedures in FIG. 9. FIG. 7 is a functional block diagram for explaining a communication system according to a third embodiment. FIGS. 12A and 12B are schematic diagrams for explaining a specific example of releasing restrictions based on authentication results. 5 is a flowchart for explaining the release of restrictions related to VPN connection.

An image processing apparatus according to this embodiment will be described below with reference to the drawings. Regarding aspects that will be described later, basically only differences from aspects that will be described relatively earlier will be described. Items that are not specifically mentioned may be the same as the aspects described earlier, or may be inferred from the aspects described earlier.

Note that some terms are generally ambiguous, as described below. Also in the description of the embodiments, the meanings of terms should be interpreted as appropriate in light of the context and the like.

For example, the term "biological information" refers to the information itself about the characteristics that actually appear on a person (from another point of view, information that does not depend on the detection method), and when it refers to the raw information obtained by detecting the above-mentioned characteristics. In some cases, it refers to feature information extracted from raw information, and in other cases, it refers to information that has been processed from raw information or feature information according to the purpose of use. Examples of the processed information include information obtained by encrypting feature amounts.

The word "authentication" sometimes refers to the act of confirming the legitimacy of an object, and sometimes refers to the fact that the legitimacy has been confirmed or has been confirmed through such an act. In this regard, the fact that the validity has been confirmed is sometimes expressed as a successful authentication, and the fact that the legitimacy cannot be confirmed is sometimes expressed as a failure in authentication. In the description of the embodiments, the "authentication state" refers to a state where authenticity has been confirmed, or a state where it is regarded as such.

The word "network" sometimes refers to a communication network, and sometimes refers to a combination of a communication network and devices connected to the communication network. The same holds true for the lower-level concept of network. Examples of the sub-concept terms of network are the Internet, public network, private network, LAN (Local Area Network), and VPN (Virtual Private Network).

The term "VPN" sometimes refers to a technology that virtually extends a private network to a public network, and sometimes refers to a network using this technology. Note that the term VPN may be appropriately used to refer to technical matters related to VPN. For example, a connection established for communication using a VPN is sometimes referred to as a VPN connection, and such a connection is sometimes referred to as a VPN connection.

The word "connection" can refer to a connection established through authentication (for example, a three-way handshake) (a connection in a narrow sense), or a connection that simply means that communication is possible (a connection in a broad sense). There is. Examples of connections that are different from the former and included in the latter include the following. A connection in which communication (e.g., broadcast and reply) is possible before the connection is established, but connection establishment is prohibited. Things that are electrically (physically from another point of view) connected to each other by cables, but in terms of software (logically from another point of view) any communication is prohibited.

(Summary of embodiment)
FIG. 1 is a schematic diagram for explaining an overview of a communication system 1 according to an embodiment.

The communication system 1 includes a plurality of (three illustrated in FIG. 1) image processing devices 3MA, 3MB, and 3MC that are communicably connected to each other via the network 10. Hereinafter, the image processing devices 3MA to 3MC (and 3A to 3C in FIG. 2) may be referred to as the image processing device 3 (numerals in FIG. 3, etc.) without distinguishing them from each other. Image processing device 3 includes at least one of a printer and a scanner.

Each image processing device 3 authenticates the user, and based on the authentication result, limits the functions available to the user or cancels the limits. For example, if the authentication is successful, the image processing device 3 allows the user to use a predetermined function (for example, printing) (removes the restriction on the function). Conversely, if the authentication fails, the image processing device 3 does not allow the user to use the predetermined function (restricts the function).

Note that terms such as "control for removing restrictions on functions" may be used for concepts that include both restricting functions and removing restrictions on functions. Similarly, a term such as "control of cancellation of authentication state" may be used for a concept that includes both maintaining an authentication state in which authentication has been successful and canceling the authentication state.

The image processing devices 3MA, 3MB, and 3MC each have management tables DT0A, DT0B, and DT0C to realize authentication. Hereinafter, these may be referred to as management table DT0 without distinguishing them from each other. The management table DT0, for example, holds various information in association with each user. In FIG. 1, "ID", "password", "biometric information 1", "biometric information 2", and "functional restriction" are illustrated as various pieces of information.

The combination of ID (identification) and password is sometimes referred to as account information. The management table DT0 may be able to store two or more types of biometric information for each user, and in FIG. Specifically, fingerprints and faces are illustrated. In the description of the embodiments, for convenience, explanations may be given that ignore the fact that two or more types of biometric information can be stored (descriptions based on the assumption that only one type of biometric information is stored). "Functional restriction" is, for example, information that directly or indirectly indicates a function whose restriction is lifted (a function which is restricted from another perspective).

When the image processing device 3 is used by the user, it requests the user to input biometric information. Then, when the biometric information (second biometric information) is input, the image processing device 3 registers biometric information (first biometric information) that matches the input biometric information in its own management table DT0. Determine whether or not. If it is registered, it is assumed that the authentication has been successful and the restriction on the function is canceled.

Note that the restriction cancellation at this time may or may not be different between users. In the former case, for example, information related to "functional limitations" associated with biometric information (first biometric information) that matches the input biometric information may be referred to. In the latter case, the management table DT0 does not need to have information regarding "functional limitations" for each user.

For example, at least some of the users in the management tables DT0A, DT0B, and DT0C are different from each other. For example, in the example of FIG. 1, as can be understood from the fact that the numbers illustrated in the "ID" column are all different from each other, the management tables DT0A, DT0B, and DT0C are created by different users (from another point of view). account), we hold information such as account information and biometric information.

Therefore, for example, when a user (referred to as user B) registered in the image processing device 3MB (management table DT0B) uses the image processing device 3MB, the image processing device 3MB is Authentication is successful by referring to its own management table DT0B. As a result, user B can use the predetermined function for which the restriction has been lifted.

On the other hand, for example, when user B attempts to use image processing device 3MA, authentication fails because user B is not registered in management table DT0A. As a result, for example, user B cannot use certain functions in image processing device 3MA.

Therefore, the image processing device 3MA authenticates the user B by performing one of the following two methods, for example. This allows user B to use predetermined functions on image processing device 3MA.

In the first method, the image processing device 3MA imports user B's biometric information (first biometric information) from the image processing device 3MB. Then, the image processing device 3MB performs authentication by comparing the biometric information of user B detected by itself (second biometric information) and the imported biometric information of user B.

In the second method, the image processing device 3MA exports user B's biometric information (second biometric information) detected by the image processing device 3MA to the image processing device 3MB. The image processing device 3MB then performs authentication by comparing the exported biometric information of the user B with the biometric information (first biometric information) of the user B that it has stored. Thereafter, the image processing device 3MB notifies the image processing device 3MA of the authentication result.

By performing the authentication as described above, as described above, user B can access not only the image processing device 3MB in which his or her biometric information (first biometric information) is registered, but also the image processing device 3MA (in other words, Then, the restriction on the predetermined function can be lifted in other image processing devices 3) as well. As a result, for example, user B's convenience is improved. Furthermore, for example, since each image processing device 3 does not need to hold biometric information for all users, the storage capacity of each image processing device 3 is saved. Furthermore, for example, biometric information may be imported (exported) as needed, so the burden on the network 10 is reduced compared to a mode in which biometric information is always exported to a server.

The above operation of the image processing device 3MA may or may not be possible in an image processing device 3 other than the image processing device 3MA. Similarly, the above operation of the image processing device 3MB may or may not be possible in an image processing device 3 other than the image processing device 3MB. Furthermore, the image processing device 3 may be configured to be able to execute only one of the first method and the second method, or may be configured to be able to selectively execute both.

The above is an overview of the embodiment. Below, an outline will be explained in the following order. In the following, a first embodiment corresponds to the first method described above, and a second embodiment corresponds to the second method described above. The third embodiment is a partially modified version of the first embodiment or the second embodiment.
1. Communication system 1 in general (Figure 2)
1.1. Information used by communication system 1 1.1.1. Biological information 1.1.2. Account information 1.1.3. Authentication information 1.2. Overall configuration of communication system 1 1.3. Overview of each communication device 1.4. Connection mode of communication equipment 2. Configuration of image processing device 3 (Figure 3)
2.1. Overall configuration of image processing device 3 2.2. Printer 2.3. Scanner 2.4. UI (User Interface) section 2.4.1. Operation unit 2.4.2. Display section 2.5. Input section (detection section) into which biological information is input
2.6. Communication Department 2.7. Control unit 2.8. Connector 2.9. Others 3. Information saved 3.1. Management table DT0
3.2. Preservation of biological information 4. First embodiment 4.1. Outline of operation in the first embodiment (Figure 4)
4.2. Examples of screens in the first embodiment (FIGS. 5A to 6B)
4.3. Details of some operations in the first embodiment 4.3.1. Example of restrictions related to imported biometric information (Figure 7)
4.3.2. Example of reusing imported biometric information (Figure 8)
5. Second embodiment 5.1. Outline of operation in the second embodiment (Figure 9)
5.2. Example of screen in second embodiment 5.3. Details of some operations in the second embodiment 5.3.1. Example of restrictions related to exported biometric information (Figure 10)
5.3.2. Example of reusing exported biometric information 6. Third embodiment (Figure 11)
7. Operations related to cancellation of functional restrictions 7.1. General operations related to canceling functional restrictions 7.1.1. Functions that control release of restrictions 7.1.2. Aspects of functional limitations 7.1.3. Cancellation of authentication status 7.2. Specific example of releasing restrictions on functions (Figure 1 and Figure 12A)
7.3. Menu screen related to functional restrictions (Figure 12B)
7.4. Lifting restrictions on VPN (Figure 13)
8. Summary of embodiments

Note that in the description of the embodiment, unless otherwise specified, a mode in which all the image processing devices 3 are capable of both the operation of the image processing device 3MA and the operation of the image processing device 3MB may be taken as an example. Also, for convenience, similar to the above explanation, assuming a situation where user B registered in image processing device 3MB uses image processing device 3MA, image processing devices 3MA and 3MB and user B's A symbol may be added. Further, the user registered in the image processing device 3MA may be referred to as user A (for convenience, the data of user A is given a reference numeral).

(1. General communication system)
(1.1. Information used by the communication system)
(1.1.1. Biological information)
The biometric information used by the image processing device 3 for authentication may be of various types, and may be information used in known biometric authentication, for example. For example, the biometric information may be information about the user's physical characteristics or may be information about the user's behavioral characteristics. Specific examples of physical characteristics include fingerprints, palm shapes, retinas (patterns of blood vessels, etc.), iris (distribution of shading values, etc.), faces, blood vessels (patterns of specific parts such as fingers), ear shapes, Sound (such as voice prints) and body odor may be mentioned. Examples of behavioral characteristics include handwriting.

(1.1.2. Account information)
The account information includes, for example, information for identifying a user (hereinafter sometimes abbreviated as "ID"). Additionally, the account information may include a password. In the description of the embodiments, a mode in which account information includes an ID and a password may be taken as an example unless otherwise specified. However, as long as there is no contradiction, the word account information may be replaced with the word ID (without a password) or the word ID and password.

(1.1.3. Authentication information)
In the description of the embodiments, information for indicating user validity may be referred to as authentication information. Biometric information and account information are types of authentication information. In the communication system 1 according to the embodiment, other authentication information may be used in addition to or in place of biometric information and account information. Note that in the description of the third embodiment, the term authentication information may refer to other authentication information other than the biometric information stored in the management table DT0.

Authentication information includes biometric information and account information, as well as static keys, common keys, private keys (or public keys), and electronic certificates. As can be understood from these examples, authentication information is the information itself that is transmitted from a communication device requesting authentication (for example, image processing device 3MA) to a communication device performing authentication (for example, image processing device 3MB). Alternatively, it may be used when generating information to be sent to a communication device that performs authentication. The former includes account information, static keys, electronic certificates, information obtained from security tokens, and biometric information. The latter includes a common key and a private key (or public key). Both the former and the latter may be used as authentication information.

Note that the term "information based on authentication information" is sometimes used as a general concept of authentication information as the transmitted information itself and information generated based on the authentication information and transmitted.

As can be understood from the previous explanation, the authentication information stored by the communication device requesting authentication and the authentication information stored by the communication device performing authentication do not have to be the same information. . Further, the authentication information stored in the communication device requesting authentication may be appropriately processed and sent to the communication device performing authentication. Challenge-response authentication may be performed as one such mode.

Note that in the description of the embodiments, the authentication information before processing and the authentication information after processing are expressed as the same thing, unless otherwise specified or unless there is a contradiction. In other words, differences in the format and/or accuracy of the information are ignored, and if the information content indicating the validity of the user is the same, it is expressed as the same information. Therefore, for example, when the authentication information stored in a first communication device and the authentication information stored in a second communication device match, in reality, the authentication information stored in the first communication device matches the authentication information stored in the second communication device. The authentication information is processed in the process of transmission to the second communication device, and the authentication information stored in the first communication device and the authentication information stored in the second communication device have different formats, etc. may be different.

In the description of the embodiment, account information will be mainly taken as an example of authentication information. Further, unless otherwise specified, explanations may be provided assuming that the authentication information is account information.

(1.2. Overall configuration of communication system)
As understood from the description of FIG. 1, the communication system 1 includes at least two image processing devices 3. The two image processing devices 3 may have various configurations, and the configuration of the network 10 connecting the two image processing devices 3 may also be arbitrary.

FIG. 2 is a diagram for explaining an example of the configuration of each image processing device 3 and the network 10.

In FIG. 2, three image processing devices 3A to 3C are illustrated. The three image processing devices 3A to 3C have different positions relative to the public network 11 and the

private networks

13A and 13B, for example. Each of the two image processing devices 3MA and 3MB included in the communication system 1 may be configured in any one of the image processing devices 3A to 3C shown in FIG. 2, for example.

For example, two image processing devices 3C may be provided, and these two image processing devices 3C may be image processing devices 3MA and 3MB. In other words, the network 10 may be the private network 13A. Further, for example, the

image processing devices

3A and 3C may be replaced by image processing devices 3MA and 3MB. In other words, network 10 may include private network 13A and public network 11. The configuration of the image processing devices 3MA and 3MB in relation to the network will be supplemented later in Section 1.4.

Note that, as understood from the fact that the

image processing devices

3A and 3C may be the image processing devices 3MA and 3MB, FIG. 2 may be taken as a diagram showing the communication system 1. Below, for convenience, the configuration shown in FIG. 2 may be referred to as a communication system 1.

The communication system 1 may include communication devices other than the image processing device 3 as appropriate. In FIG. 1,

servers

5 and 7 and

terminals

9A, 9B and 9C are illustrated. Hereinafter, the terminals 9A to 9C may be referred to as the terminal 9 (representatively, the terminal 9A is given the reference numeral) without distinguishing them.

Note that, as described above, the communication system 1 may be defined only by at least two image processing devices 3 (3MA and 3MB). Furthermore, the communication system 1 may be defined to include communication devices (for example,

servers

5 and 7 and terminal 9) other than the image processing device 3MB that can communicate with the image processing device 3MA. Furthermore, the communication system 1 may be defined to include a private network (13A or 13B) including two image processing devices 3MA and 3MB. However, in any case, the communication system 1 may be defined without the public network 11.

(1.3. Overview of each communication device)
The image processing device 3 includes at least one of a printer and a scanner, as described above. The following description will mainly take as an example a mode in which the image processing device 3 includes both a printer and a scanner. The image processing device 3 may or may not be a multi-function product/printer/peripheral (MFP). Note that in the drawings, the image processing device 3 may be referred to as "MFP" for convenience. The image processing device 3 may be capable of executing one or more of printing, scanning, copying, FAX transmission, and FAX reception (although these are not necessarily separable concepts), for example.

The method of operating the image processing device 3 (social positioning from another perspective) is arbitrary. For example, the image processing device 3A may be installed in a store such as a convenience store and used by an unspecified number of users. The image processing device 3B may be installed in a private home and used by a specific and small number of users (for example, one person). The image processing device 3C may be installed in a company and used by a specific number of users.

The server 5 may, for example, contribute to the authentication of the user who uses the image processing device 3, as described in the third embodiment (Section 6). Further, for example, the server 5 may function as a VPN server (Section 7.4). Further, for example, the server 5 may perform ECM (Enterprise Content Management) regarding the private network 13A. Further, unlike the example of FIG. 1, the server 5 may hold information regarding the restriction of functions for each user to assist in controlling the restriction of functions in the image processing device 3.

The server 7 may provide various services. For example, server 7 may be a file server, a mail server and/or a web server. When focusing on the operation related to the image processing device 3, the file server may store, for example, data of an image printed by the image processing device 3 or data scanned by the image processing device 3. The mail server may deliver mail printed by the image processing device 3 or mail containing an image scanned by the image processing device 3. The web server may execute web services performed through communication with the image processing device 3.

In FIG. 2, each of

servers

5 and 7 is represented by one computer. However, one server may be realized by a plurality of distributed computers. A plurality of computers making up one server may be directly connected, included in one LAN, or included in mutually different LANs. Note that the

servers

5 and 7 may be configured by one computer. Moreover, the

servers

5 and 7 may be regarded as one server, regardless of whether they are configured by one computer or not.

The terminal 9 may be of any appropriate type. In FIG. 2,

terminals

9A and 9B are depicted as laptop-type PCs (personal computers). Terminal 9C is depicted as a smartphone. In addition, the terminal 9 may be, for example, a desktop PC or a tablet PC. The terminal 9 can be operated in any manner. For example, the terminal 9 may be one that is used by one or more specific users, such as a terminal owned by a company or a terminal owned by an individual, or one that is unspecified and used by many users, such as a terminal at an Internet cafe. It may be used by several users.

(1.4. Connection mode of communication equipment)
The public network 11 is a network open to the outside (for example, an unspecified number of communication devices). The specific aspect may be determined as appropriate. For example, the public network 11 may include the Internet, a closed network provided by a telecommunications carrier, and/or a public telephone network.

The

private networks

13A and 13B are networks that are not disclosed to the outside. Private network 13A and/or 13B may be, for example, a LAN. The LAN may be, for example, a network within the same building. Examples of the LAN include those using Ethernet (registered trademark) and Wi-Fi (registered trademark). Further, the private network 13A and/or 13B may be an intranet.

Transmission and/or reception of signals by the communication device (for example, the image processing device 3) may be performed via a wire or wirelessly. Further, the communication device (for example, the image processing device 3) may communicate with the public network 11 without being included in the private network, or may be included in the private network. A communication device (for example, the image processing device 3) included in the private network may communicate only within the private network, or may communicate with the public network 11 via the private network.

As mentioned above, multiple communication devices may be connected to each other in various ways. In the example of FIG. 2, it is as follows.

The image processing device 3A has not constructed a private network. The image processing device 3A is capable of communicating with the public network 11 without going through a private network by including a router or the like (not shown) or by being connected to a router or the like. The image processing device 3A may be able to communicate with a terminal 9 (not shown in FIG. 1) that is directly connected to the image processing device 3A by wire. Further, the image processing device 3A may be capable of short-range wireless communication with a terminal 9 (not shown in FIG. 2) placed near the image processing device 3A.

The image processing device 3B and the terminal 9B are connected to each other by a private network 13B. More specifically, both are connected via the router 15 (its hub). The image processing device 3B and the terminal 9B can communicate with the public network 11 via the router 15 and the like.

The image processing device 3C, server 5, server 7, and terminal 9A are connected to each other by a private network 13A. The image processing device 3C, the server 7, and the terminal 9A can communicate with the public network 11 via the server 5, for example. The server 5 may include a router or the like, or a router (not shown) or the like may be provided between the server 5 and the public network 11.

The terminal 9C, for example, communicates wirelessly with the public telephone network. Furthermore, the terminal 9C communicates with the public network 11 including the public telephone network.

The two image processing devices 3MA and 3MB that perform authentication according to the embodiment may be, for example, two image processing devices 3C included in the same private network 13A. Further, the image processing devices 3MA and 3MB may be two image processing devices 3 included in the same VPN. In this case, each of the image processing devices 3MA and 3MB may be any of the image processing devices 3A to 3C. Further, the image processing devices 3MA and 3MB may be two image processing devices 3 connected via a public network 11 (not a VPN). Also in this case, each of the image processing devices 3MA and 3MB may be any of the image processing devices 3A to 3C.

Note that in an embodiment in which the two image processing devices 3MA and 3MB are included in the same VPN, for example, before biometric authentication according to the embodiment (before importing or exporting biometric information), authentication other than the above biometric information is performed. If the authentication using the information is successful, the image processing devices 3MA and 3MB may be connected to the VPN. For authentication for VPN connection, authentication information for individual users or authentication information assigned to the image processing device 3 may be used. Different from the above, the image processing apparatuses 3MA and 3MB connected via the public network 11 are connected via VPN by the biometric authentication according to the embodiment or by another authentication after the biometric authentication. It may be considered that the devices 3MA and 3MB are connected via the public network 11 (not a VPN).

As can be understood from the above description, when the image processing devices 3MA and 3MB communicate with each other (for example, importing and exporting biometric information), other communication devices such as the server 5 may intervene, No intervention is required. In the description of the embodiment, for convenience, expressions such as the image processing devices 3MA and 3MB communicating directly with each other may be used even when other communication devices such as the server 5 are involved.

The relationship between the connection mode of communication equipment and the operating method of communication equipment (from another perspective, social positioning) is arbitrary. For example, the image processing device 3A that is not included in the private network may be installed in a store and used by an unspecified number of users as described above, or it may be installed in a company and used by an unspecified number of users, as described above, or It may be installed and used by a specific user. Further, for example, the image processing device 3B included in the private network 13B may be installed in a private home and used by a specific and small number of users as described above, or the image processing device 3B included in the private network 13B may be used by a specific and small number of users. Alternatively, it may be installed in an Internet cafe and used by an unspecified number of users.

However, in the description of the embodiment (for example, the description of FIGS. 4 to 6B), for convenience, the image processing apparatuses 3MA and 3MB may be expressed assuming a situation where they are located in different departments of the same company. In this case, the image processing devices 3MA and 3MB may be included in the same private network 13A or the same VPN, or may be connected via the public network 11 (not a VPN). It doesn't matter if you stay there.

(2. Configuration of image processing device)
(2.1. Overall configuration of image processing device)
FIG. 3 is a schematic diagram showing the hardware configuration of the signal processing system of the image processing device 3. As shown in FIG.

As shown in FIGS. 2 and 3, the image processing device 3 includes, for example, the following components. A housing 17 (FIG. 2) constitutes the outer shape of the image processing device 3. A printer 19 that performs printing. A scanner 21 (image scanner) that performs scanning. A UI unit 23 that accepts user operations and/or presents information to the user. A detection unit 25 detects biometric information of the user. Communication unit 27 (FIG. 3) that performs communication. A control section 29 (FIG. 3) that controls each section (19, 21, 23, 25, and 27). A connector 37 (FIG. 3) for connecting an appropriate device to the image processing apparatus 3. Note that hereinafter, the printer 19 and/or the scanner 21 may be referred to as an image processing section 31 (reference numeral is shown in FIG. 3).

As in the illustrated example, some or all of the above components may be shared with each other (or may be perceived as such). For example, the housing 17 may be considered as part of the printer 19 or the scanner 21. In the description of this embodiment, the control unit 29 is conceptually one control unit that controls all operations (including printing and scanning, for example) of the image processing device 3 (in terms of hardware, it is distributed over multiple units). ). In this case, the objects (19, 21, 23, 25, and 27) controlled by the control section 29 may be conceptualized only in terms of mechanical parts that do not include the control section, or the objects (19, 21, 23, 25, and 27) controlled by the control section may be conceptualized as including some of them.

Components other than the housing 17 (19, 21, 23, 25, 27, and 29; hereinafter, in Section 2.1, the word component refers to such components other than the housing 17) , are provided in the housing 17. In another expression or perspective, the housing 17 holds or supports a plurality of components, or is mechanically connected to or coupled to a plurality of components. , it can be said. Moreover, since the plurality of components are provided in the housing 17, it can be said that they are provided integrally with each other. Note that, as understood from the above description, when it is said that a component is provided in the casing 17, the casing 17 may be regarded as a part of the component.

When it is said that the image processing device 3 has components, for example, typically, the components and the housing 17 are fixed to each other (of course, excluding movable parts). Furthermore, the components are also fixed to each other. Furthermore, unless the image processing device 3 is disassembled by, for example, removing screws, the components and the housing 17 cannot be separated from each other and placed in different locations. Furthermore, the constituent elements cannot be separated from each other and placed in different locations. However, unlike the above example, when it is said that the image processing device 3 has a component, the component may be detachable from the housing 17. In FIG. 3, while the detection section 25 provided in the housing 17 is shown, a detection section 25A that is a different example from the detection section 25 and that is attached to and detached from the connector 37 is indicated by a dotted line. has been done.

When it is said that the components are provided in the housing 17, the specific positional relationship is arbitrary. For example, the component may be housed within the casing 17, provided integrally with the wall of the casing 17, protruding from the wall of the casing 17, or mounted on the casing 17. The orientation and/or position relative to the body 17 may be variable. In the illustrated example, the printer 19, scanner 21, communication section 27, and control section 29 may be considered to be housed in the housing 17. Further, the UI section 23 and the detection section 25 may be considered to be integrally provided on the wall surface of the housing 17.

The size and shape of the image processing device 3 (from another perspective, the housing 17) are arbitrary. For example, the image processing device 3 may have a size (mass) that can be carried by one person, such as a home multifunction device or a printer (see illustration of the image processing device 3B), or may have a size (mass) that can be carried by one person, such as a home multifunction device or a printer (see illustration of the image processing device 3B), The image processing apparatus may have a size (mass) that cannot be carried by one person, such as a multifunction device or a printer (see illustrations of

image processing apparatuses

3A and 3C).

Unlike the illustrated example, the image processing device 3 may have a concept that is significantly different from a general multifunction peripheral or printer placed in a company (office) or a private home. For example, the printer 19 may print on roll paper. The image processing device 3 may include a robot, and may apply coating to a vehicle body or the like using an inkjet head. The image processing device 3 may be of a size that can be held in one hand, and the image processing device 3 itself may scan a medium to perform printing and/or scanning.

(2.2. Printer)
The printer 19 is configured, for example, to print on sheets of paper arranged within the housing 17 or on a tray protruding from the housing 17 to the outside, and to discharge the printed sheets. The specific configuration of the printer 19 may be various configurations, for example, it may be similar to a known configuration.

For example, the printer 19 may be an inkjet printer that prints by ejecting ink, a thermal printer that prints by heating thermal paper or an ink ribbon, or a photosensitive printer irradiated with light. It may also be an electrophotographic printer (for example, a laser printer) that transfers toner adhering to the body. The inkjet printer may be a piezo type that applies pressure to the ink using a piezoelectric body, or a thermal type that applies pressure to the ink using bubbles generated in the heated ink.

Further, for example, the printer 19 may be a line printer in which the head has a length spanning the width of the sheet (a direction that intersects the conveying direction of the sheet), or the printer 19 may have a head that extends in the width direction of the sheet. It may be a serial printer that moves to. The printer 19 may be a color printer or a monochrome printer. The printer 19 may be capable of forming any image, or may be capable of printing only characters.

(2.3. Scanner)
For example, the scanner 21 is arranged on the original glass using a plurality of image pickup elements (not shown) that move along the original glass under the original glass exposed from the top surface of the housing 17 (hidden by the lid in FIG. 2). image and scan the original. The scanner 21 may have various configurations, for example, may be similar to known configurations.

(2.4.UI part)
The configuration of the UI section 23 is arbitrary. For example, the UI unit 23 includes an operation unit 33 (reference numeral shown in FIG. 3) that receives user operations, and a display unit 35 (reference numeral shown in FIG. 3) that visually presents information to the user. Note that the UI section 23 may not be provided, or only one of the operation section 33 and the display section 35 may be provided. Further, the UI unit 23 may include an audio unit that presents information to the user by sound. The UI unit 23 may be defined to include the connector 37, unlike the description of the embodiment. This is because connecting a device to the connector 37 may be a type of inputting an instruction to the image processing device 3.

(2.4.1. Operation section)
The configuration of the operation section 33 is arbitrary. The operation unit 33 accepts, for example, a user's touch operation. Such an operation section 33 may include, for example, a touch panel and/or one or more buttons. In FIG. 2, a touch panel (reference numeral omitted) is illustrated as at least a part of the operation unit 33 of the

image processing devices

3A and 3C. Further, a button 33a is illustrated as at least a part of the operation unit 33 of the image processing device 3B. The button 33a may be a push button, a touch button, or another button. The touch button may be a capacitive touch button or another touch button. Of course, the

image processing devices

3A and 3C may have buttons, and the image processing device 3B may have a touch panel. Note that the operation unit 33 may accept other types of operations such as voice operations.

The operation unit 33 may be used for various purposes. Typically, the operation unit 33 is used to instruct the image processing device 3 to execute processing related to the image processing unit 31. For example, by operating the operation unit 33, printing, scanning, and copying are performed, and settings related to these operations (for example, settings for paper selection, magnification, density, and/or color, etc.) are performed. In addition, for example, by operating the operation unit 33, access to data, transmission and reception of data, and input of authentication information may be performed.

(2.4.2. Display section)
The configuration of the display section 35 is arbitrary. For example, the display unit 35 may include at least one of a display capable of displaying any image, a display capable of displaying only arbitrary characters, a display capable of displaying only specific characters and/or specific graphics, and an indicator light. May contain one. The image here is a concept that includes characters. Examples of displays that display arbitrary images or arbitrary characters include liquid crystal displays or organic EL (Electro Luminescence) displays that have a relatively large number of regularly arranged pixels. Furthermore, examples of displays that display specific characters and/or specific graphics include liquid crystal displays with a limited number and/or shape of pixels, or segment displays such as a 7-segment display. Segmented displays may take various forms, including liquid crystal displays. Examples of the indicator light include those including LEDs (Light Emitting Diodes). An appropriate number of indicator lights may be provided. In addition, in the following description, for convenience, expressions may be given on the premise that the display unit 35 can display any image.

(2.5. Input unit (detection unit) into which biological information is input)
As described above, the image processing device 3 includes the detection unit 25 that detects biological information. However, the image processing device 3 does not need to include the detection section 25. For example, a secure connection is established in short-range wireless communication between the image processing device 3 and the terminal 9. In this state, biometric information may be detected by the terminal 9 and the detected biometric information may be transmitted to the image processing device 3 . Thereby, the biometric information may be input to the communication unit 27 communicating with the terminal 9. As a superordinate concept for such communication unit 27 and detection unit 25, the term “input unit” into which biometric information is input is sometimes used. The input unit may be a unit into which biometric information is directly input (detection unit 25) or a unit into which biometric information is indirectly input (communication unit 27).

The description of the embodiment basically takes as an example a mode in which the input section is the detection section 25. The configuration of the detection unit 25 is, for example, as follows.

As mentioned above, various types of biometric information may be used for authentication. Therefore, the configuration of the detection section 25 may also be various. Furthermore, various detection units 25 may be used for the same type of biological information. The basic configuration of the detection unit 25 may be the same as a known one.

For example, the detection unit 25 may acquire an image related to biological information. Examples of biological information obtained by acquiring images include fingerprints, palm shapes, retinas, iris, faces, blood vessels, and ear shapes. A typical example of the detection unit 25 that acquires an image is an optical type. The optical detection unit 25 includes an image sensor that detects light. The light to be detected by the image sensor (in other words, the wavelength range) may be visible light or non-visible light (for example, infrared light). The detection unit 25 may or may not have an illumination unit that irradiates the living body with light in the wavelength range detected by the image sensor. The image may be a binary image, a grayscale image or a color image.

Furthermore, the detection unit 25 that acquires images may be of an ultrasonic type. The ultrasonic detection unit 25 includes an ultrasonic element that transmits and receives ultrasonic waves. As understood from a medical ultrasonic diagnostic apparatus, the detection unit 25 including an ultrasonic element can acquire an image of the surface and/or internal shape of a living body. More specifically, the detection unit 25 transmits ultrasonic waves toward the living body and receives the reflected waves. An image that reflects the distance from the ultrasound element (ie, the shape of the living body) is acquired based on the time from transmission to reception.

Furthermore, the detection unit 25 that acquires the image may be of a capacitance type. The capacitive detection unit 25 includes a panel with which a living body comes into contact, and a plurality of electrodes arranged behind the panel and along the panel. When a part of a living body (for example, a finger) is placed on the panel, the electric charge generated in the electrode at the position where it is in contact (the position of a convex part on the body surface) and the position where the living body is not in contact (the position of a concave part on the body surface) This is different from the charge generated at the electrode at the position of Based on this difference, an image of unevenness (for example, a fingerprint) on the body surface is acquired.

The detection unit 25 that acquires images may acquire a two-dimensional image by sequentially acquiring line-shaped images in the transverse direction of the line-shaped images (that is, scanning), A two-dimensional image may be acquired substantially in one time without performing such scanning. Scanning may be realized by the operation of the detection unit 25 or by moving the living body relative to the detection unit 25. The former includes, for example, a mode in which a carriage containing an image sensor or an ultrasonic device moves. The plurality of ultrasound elements can also perform electronic scanning without mechanical movement.

An example of the detection unit 25 other than the configuration that acquires images is one that includes a microphone that acquires audio. Thereby, voice (for example, voiceprint) information as biometric information is acquired. Further, for example, the other detection unit 25 may be a touch panel that accepts writing with a touch pen. As a result, handwriting information as biometric information is acquired.

The detection unit 25 may be used for purposes other than acquiring biological information. From another perspective, the detection unit 25 may be realized by a component provided in the image processing device 3 for a purpose other than acquiring biological information. Alternatively, the detection unit 25 may be structurally inseparably combined with other components.

For example, the detection unit 25 that acquires an image may be realized by the scanner 21, unlike the illustrated example. That is, when it is said that an image processing device has a scanner and a detection section, the two may be the same component. The same applies when other components are shared with the detection unit 25 (not limited to the one that acquires images).

Further, for example, the detection unit 25 may also be used as a button so that when a finger is placed on a button included in the operation unit 33, a fingerprint is detected. An example of such a button and detection section 25 is the capacitive detection section 25 described above. The button operation is detected by the sensor including the plurality of electrodes described above. Further, for example, the reception of handwriting may be realized by a touch panel included in the operation unit 33.

In the case where the detection unit 25 reads fingerprints, the detection surface on which the finger is placed may be subjected to anti-virus treatment. For example, the detection surface is constituted by a plate-shaped member, and the material of this plate-shaped member may include a component that produces an antiviral effect. Further, for example, the detection surface may be constituted by a film covering the above-mentioned plate-shaped member, etc., and the film may contain a component that produces an antiviral effect. Components that produce antiviral effects include, for example, monovalent copper compounds and silver. The type of virus to be targeted is arbitrary. The antiviral property of the detection surface may be such that the antiviral activity value is 2.0 or more in a test according to ISO (International Organization for Standardization) 21702, for example. The sensing surface may produce an antibacterial effect in addition to, or instead of, an antiviral effect.

The position, orientation, etc. of the detection unit 25 are arbitrary. For example, as understood from the description in Section 2.1 above, the detection unit 25 may be fixed to the housing 17, or may be connected to the housing 17 so that its position and/or orientation can be changed. Alternatively, it may be detachable from the housing 17. For example, the detection unit 25 (more precisely, a part directly involved in reading biometric information; for example, a detection surface on which a finger is placed when detecting a fingerprint; the same applies hereinafter in this paragraph) is a UI It may be located adjacent to the UI section 23 or may be located away from the UI section 23.

(2.6. Communication Department)
The communication unit 27 is, for example, a part of an interface for the image processing device 3 to communicate with other communication devices that is not included in the control unit 29. The communication unit 27 may include only hardware components, or may include a portion realized by software in addition to the hardware components. In the latter case, the communication section 27 may not be clearly distinguishable from the control section 29.

Specifically, for example, when the image processing device 3 is connected to the outside by wire, the communication section 27 may have a connector or a port to which a cable is connected. A port here is a concept that includes software elements in addition to a connector. For example, when the image processing device 3 is connected to the outside via wireless (for example, radio waves), the communication unit 27 includes an RF (Radio Frequency) circuit that converts a baseband signal into a high frequency signal, and an RF (Radio Frequency) circuit that converts a baseband signal into a high frequency signal. and an antenna for converting the signal into a wireless signal. Further, in both wired and wireless communication, the communication unit 27 may include, for example, an amplifier and/or a filter.

(2.7. Control unit)
The control unit 29 has, for example, a similar configuration to a computer. Specifically, for example, the control unit 29 includes a CPU (Central Processing Unit) 39, a ROM (Read Only Memory) 41, a RAM (Random Access Memory) 43, and an auxiliary storage device 45. The control unit 29 is constructed by the CPU 39 executing programs stored in the ROM 41 and/or the auxiliary storage device 45. In addition to the portion constructed as described above, the control section 29 may include a logic circuit configured to perform only certain operations.

(2.8. Connector)
The connector 37 is for connecting peripheral equipment to the image processing device 3, for example. The connector 37 may be of various standards, for example, USB (Universal Serial Bus). In FIG. 3, the detection unit 25A according to another example is illustrated as a peripheral device connected to the connector 37, as described above. Other peripheral devices connected to the connector 37 include a USB memory and a card reader.

(2.9. Others)
The various components mentioned above (19, 21, 25, 27, 33, 35, 37, 39, 41, 43 and 45) are connected, for example, by a bus 47 (FIG. 3). In FIG. 3, all the components are schematically connected to one bus 47. In an actual product, multiple buses may be connected in any suitable manner. For example, an address bus, a data bus and a control bus may be provided. Also, a crossbar switch and/or a link bus may be applied.

Figure 3 is just a schematic diagram. Therefore, for example, in reality, a plurality of various devices (for example, CPUs) may be distributed and provided. The illustrated CPU 39 may be a concept including a CPU included in the printer 19 or the scanner 21. An interface (not shown) may be interposed between the bus 47 and various devices (for example, the printer 19 or the scanner 21).

The block diagram in FIG. 3 has been described as showing the configuration of the image processing device 3. However, FIG. 3 can be used as a block diagram showing the configuration of the

servers

5 and 7 and the terminal 9 as appropriate. Further, the explanation of the components shown in FIG. 3 may also be applied to the components of the

servers

5 and 7 and the terminal 9, as long as there is no contradiction. For example, the block diagram showing the configuration of the

servers

5 and 7 and the terminal 9 may be obtained by omitting the printer 19 and scanner 21 from FIG. 3. Further, the block diagram showing the configuration of the

servers

5 and 7 may be obtained by omitting the detection unit 25, the operation unit 33, and/or the display unit 35 from FIG.

(3. Information to be saved)
(3.1. Management table)
Management table DT0 is stored in nonvolatile memory (for example, auxiliary storage device 45). The management table DT0 holds account information, biometric information, etc. for a plurality of users. However, the management table DT0 may be able to hold account information, biometric information, etc. only for one user. Even in such a mode, for convenience, it may be expressed that account information and biometric information are stored in association with each other "for each user." In the description of the embodiment, a mode in which the management table DT0 can store information of a plurality of users will be basically taken as an example, and the explanation will be based on such a mode unless otherwise specified.

An example of a usage mode in which the management table DT0 stores information for only one user is a mode in which the image processing device 3 is for home use (see the illustration of the image processing device 3B in FIG. 3). It will be done. It may be assumed that this image processing device 3 is basically used by only one user. Then, when another user uses it exceptionally, the other user's biometric information (first biometric information) is imported from the other image processing device 3, or the other user's biometric information is imported to the other image processing device 3. The biometric information (second biometric information) may be exported.

The management table DT0 may be able to store two or more pieces of biometric information in association with one piece of account information. However, in the description of the embodiments, for convenience, a mode in which one piece of biometric information is associated with one piece of account information may be taken as an example, unless otherwise specified.

The two or more pieces of biometric information may be different biometric information of one user, for example. Examples of such biometric information include fingerprints of different fingers or fingerprints of the same finger acquired at different times. In the former case, for example, when authentication with one finger fails due to injury, aging, etc., authentication can be performed with another finger. In the latter case, the probability that authentication will fail when biometric information changes due to aging or the like is reduced.

Furthermore, the two or more pieces of biometric information may be two or more types of biometric information, as illustrated in FIG. As the two or more types of biometric information, two or more of various biometric information (see Section 1.1.1) may be selected as appropriate. If two or more types of biometric information can be registered, for example, if authentication fails with one type of biometric information due to some reason other than fraud, it is possible to authenticate with other biometric information, as described above. This improves user convenience.

Note that fingerprints from different fingers can also be considered as different types of biometric information. However, regarding the fingerprints of different fingers, the configuration of the detection unit 25 and the method of processing the detected raw information are the same. Therefore, in the description of the embodiment, fingerprints of different fingers are treated as the same type of biometric information. In other words, different types of biological information differ in at least one of the configuration of the detection unit 25 and the method of processing the detected information, for example.

Two or more types of biological information may be used selectively, for example, as described above. That is, authentication may be performed for only one type of biometric information of two or more types. In this aspect, it is not necessary that all the biometric information of two or more types of biometric information be registered. However, all and/or at least two types of two or more types of biometric information may be required to be registered. Furthermore, all and/or at least two types of two or more types of biometric information may be required to be input at the time of authentication. In this case, security is improved.

Whether registration of two or more types of biometric information (or two or more) is optional or mandatory, and/or whether two or more types of biometric information (or two or more) are selectively used during authentication. Whether or not a function is required may be common to all users, or may differ depending on the user and/or authority (function for which restrictions are lifted). For example, it may be used selectively for general users, and two or more types (or more than one) of biometric information may be requested from administrators.

Furthermore, two or more pieces of biometric information associated with one account information may belong to different people. That is, a "user" is not limited to a "person" and may be a concept that includes an "account" (from another perspective, a user group).

(3.2. Storage of biological information)
In the image processing device 3MA, biometric information (second biometric information) detected by the detection unit 25 during use may be stored in a volatile memory (eg, RAM 43), for example. However, the second biological information may be stored in a nonvolatile memory (for example, the auxiliary storage device 45). This second biometric information may be deleted at an appropriate time (for example, upon completion of authentication).

The biometric information (first biometric information) that the image processing device 3MA imports from the image processing device 3MB during use may be stored, for example, in the volatile memory (eg, RAM 43) of the image processing device 3MA. However, the first biological information may be stored in the nonvolatile memory (for example, the auxiliary storage device 45) of the image processing device 3MA. This first biometric information may be deleted at an appropriate time (for example, upon completion of authentication).

The biometric information (second biometric information) that the image processing device 3MA exports to the image processing device 3MB during use may be stored, for example, in the volatile memory (eg, RAM 43) of the image processing device 3MB. However, the second biological information may be stored in the nonvolatile memory (for example, the auxiliary storage device 45) of the image processing device 3MB. This second biometric information may be deleted at an appropriate time (for example, upon completion of authentication).

The deletion of biometric information may involve overwriting the storage area where the biometric information was stored with other information or initializing the storage area. That is, erasing biometric information may make the biometric information unrecoverable. Furthermore, deleting the biometric information may be to delete information on an address of a storage area where the biometric information is stored. That is, the biometric information may be made inaccessible through normal processing in the image processing device 3, while leaving room for recovery of the biometric information by a specialized company.

(4. First embodiment)
As described above, the first embodiment is a mode in which the image processing device 3MA executes the first method of importing the first biometric information (registered biometric information) of the user B from the image processing device 3MB. Specifically, for example, it is as follows.

(4.1. Outline of operation in first embodiment)
FIG. 4 is a flowchart illustrating an example of an outline of a procedure related to authentication executed by the image processing device 3MA (control unit 29 from another perspective). Note that the various flowcharts, including FIG. 4, conceptually illustrate operational procedures for ease of understanding, and do not necessarily match the actual procedures, and may lack accuracy. Sometimes there are.

Through the process in FIG. 4, a user who attempts to use the image processing device 3 is authenticated, and depending on the authentication result, restrictions on a predetermined function are canceled (step ST6 or ST13), or restrictions on a predetermined function are (step ST7 or ST14). Steps ST2 to ST7 exemplify the processing procedure when user A registered in the image processing apparatus 3MA uses the image processing apparatus 3MA. Steps ST8 to ST14 exemplify the processing procedure when user B who is registered in an image processing device 3 (3MB in this case) other than the image processing device 3MA uses the image processing device 3MA.

The process in FIG. 4 may be started at any appropriate time. For example, the process in FIG. 4 may be started when the image processing device 3MA is powered on or transitioned from sleep mode to startup mode. Alternatively, the process in FIG. 4 may be initiated when the user attempts to perform a predetermined function (for example, printing) whose use is restricted. Note that in the description of the embodiments, the former may be taken as an example unless otherwise specified.

In step ST1, the image processing device 3MA displays an image on the display screen that prompts the user to input information (for example, an operation on the operation unit 33) that specifies the user's own department (and/or the image processing device 3 in which the user is registered). 35. Further, the image processing device 3MA accepts the above input.

In step ST2, the image processing apparatus 3MA determines whether the user who is attempting to use the image processing apparatus 3MA is registered with a user in another department (from another perspective, with another image processing apparatus 3) based on the information input in step ST1. ). Then, the image processing device 3MA proceeds to step ST3 when the determination is negative, and proceeds to step ST8 when the determination is affirmative.

In step ST3, the image processing device 3MA displays on the display unit 35 an image that prompts the user to input biometric information. In step ST4, the image processing device 3MA uses the detection unit 25 to detect the user's biometric information.

In step ST5, the image processing device 3MA performs biometric authentication based on the biometric information (second biometric information) detected in step ST4. Specifically, the image processing device 3MA determines whether biometric information (first biometric information) that matches the second biometric information is registered in its own management table DT0. Then, the image processing device 3MA proceeds to step ST6 when the determination is positive, and proceeds to step ST7 when the determination is negative.

In step ST6, the image processing device 3MA releases the restrictions on the predetermined functions. On the other hand, in step ST7, the image processing device 3MA maintains the predetermined function restriction. The functions restricted in step ST7 may be some or all of the various functions of the image processing device 3MA. In other words, the latter is a mode in which the use of the image processing device 3MA itself is prohibited. In FIG. 4, assuming the former, step ST7 is labeled as "restricted operation."

In step ST8, the image processing device 3MA accesses the image processing device 3MB of the department specified by the user in step ST1. From another perspective, the image processing device 3MA requests the image processing device 3MB to export the biometric information (first biometric information) of the user B registered in the image processing device 3MB. Then, in step ST9, the image processing device 3MB receives (imports) the first biometric information of the user B.

Steps ST10 to ST14 are similar to steps ST3 to ST7. However, the first biometric information (registered biometric information to be compared with the detected second biometric information) is not registered in the management table DT0 of the image processing device 3MA, but in step ST9. The imported one will be used. Further, in FIG. 4, for convenience, illustration of a step corresponding to step ST3 before step ST10 is omitted. Further, step ST11 (not shown before step ST5) is shown in which it is specified that authentication (comparison) is performed by the image processing device 3MA.

In the image processing device 3MA, only one type of function may require authentication, or two or more types may be required. Further, it may be possible to repeatedly execute one type of function or to execute two or more types of functions with one authentication. However, authentication may be requested each time a function is executed, authentication may be requested for each type of function, or authentication may be requested again when a function with a high security level is executed.

The biometric information acquired during use (the biometric information in step ST4 or ST10) may be deleted from the image processing device 3MA immediately after being compared with the registered biometric information. However, the biometric information acquired during use may be stored in the image processing device 3MA until an appropriate time thereafter (for example, when the authentication state is canceled) and used as appropriate. Furthermore, the biometric information acquired during use may be used to update the registered biometric information.

The description has been made assuming that step ST6 and step ST13 are the same. However, there may be differences between the two. For example, in step ST13, the restriction on a specific function that is removed in step ST6 may not be lifted. Similarly, although step ST7 and step ST14 have been described as being the same, there may be a difference between them. For example, in step ST14, use of a specific function that is not limited in step ST7 may be restricted.

As can be understood from the above description that the configuration of the network 10 connecting the image processing devices 3MA and 3MB may have various configurations, the communication in steps ST8 and ST9 may be performed as appropriate.

For example, the biometric information of user B may be imported (step ST9) within the private network 13A or via the public network 11. In the latter case, a VPN connection may or may not be utilized. Further, the connection for importing the biometric information of user B may be established at step ST8 or ST9, or may be established before that.

Further, for example, in a mode (or other mode) in which image processing devices 3MA and 3MB are included in the same LAN, unlike the above explanation, image processing device 3MA does not specify image processing device 3MB, and All communication devices within the LAN may be requested to export user B's first biometric information. Then, the corresponding communication device (the image processing device 3MB in which user B's biometric information is registered) may respond to the request.

The procedure shown in FIG. 4 may be modified as appropriate.

For example, the user may be required to input biometric information before inputting information that identifies his or her own department. Then, it may be determined whether or not the input biometric information is registered in the management table DT0 of the image processing device 3MA (from another point of view, authentication may be performed). Depending on the success or failure of this authentication, it may be determined whether the user is a user of the own department or a user of another department. If authentication fails, users in other departments are asked to input information identifying their own department (or not) and request another image processing device 3MB to import user B's biometric information. good.

(4.2. Example of screen in first embodiment)
When executing the process in FIG. 4, an appropriate image may be displayed on the display section 35. An example is shown below. Here, it is assumed that the display section 35 constitutes a touch panel. 5A to 6C are schematic diagrams showing examples of images displayed on the screen 35a of the display unit 35.

Image IG1 shown in FIG. 5A is displayed in step ST1, for example. Image IG1 prompts the user to input an ID and password (ie, account information) by displaying "Please enter your ID and password" at the top. For example, the user selects the input fields associated with "ID" and "password" by tapping, etc., and then inputs characters (a broad concept including numbers and symbols) by operating a mechanical switch or software keyboard. ) can be input.

Image IG1 also includes a button labeled "Other department user" or "Execute" at the bottom. The user can proceed to the next operation (next screen) by performing a predetermined operation (for example, tap) on these buttons. Also, by selecting one of the buttons above, you can check whether the user belongs to the department where the image processing device 3MA is located (in other words, whether the user is registered in the image processing device 3MA) or whether the user belongs to another department. Information about what is being done is entered.

If the "other department user" button is selected, an affirmative determination is made in step ST2, and the process proceeds to step ST8. On the other hand, if the "execute" button is selected, a negative determination is made in step ST2, and the process proceeds to step ST3. Note that in a mode where there is an image (screen) that is displayed before image IG1, a button for returning to that screen may be displayed on image IG1. Similarly, other screens to be described later may also have a button (not shown) for returning to the previous screen and/or a button (not shown) for returning to a specific screen.

Image IG3 shown in FIG. 5B is displayed, for example, when the "other department user" button is selected in image IG1. Further, the image IG3 is displayed, for example, at an appropriate time after an affirmative determination is made in step ST2 and before step ST8. In image IG3, the notation "other department user" in the upper row indicates that a screen for other department users is being displayed. In addition, in image IG3, similarly to image IG1, input fields for ID and password are displayed. Further, in image IG3, a "own department MFP selection" button is displayed at the bottom. The user can proceed to the next operation (next screen) by performing a predetermined operation (eg, tap) on the "own department MFP selection" button.

Image IG5 shown in FIG. 5C is displayed, for example, when the "select own department MFP" button is operated in image IG3. Further, image IG5 is displayed at an appropriate time, for example, after an affirmative determination is made in step ST2 and before step ST8. In image IG5, the notations "Other department user MFP selection" and "Please select your own department's MFP" in the upper row allow users from other departments to select the department to which they belong and/or the image to which they are registered. It is shown that a screen for selecting the processing device 3 is displayed. Further, in image IG5, a list of selectable image processing devices 3 is shown. The user can select the image processing device 3 in which the user is registered by performing an operation (for example, tapping) to select one of the image processing devices 3 displayed in the list. In a general concept, this selection is the input of information specifying the image processing device 3 in which the device itself is registered. Then, the user can proceed to the next operation (next screen) by performing a predetermined operation (eg, tap) on the "OK" button at the bottom.

In step ST8, for example, the image processing device 3MA requests the user's biometric information from the image processing device 3 (3MB) selected in the image IG5. At this time, the image processing device 3MA transmits the account information input in the image IG1 or IG3 to the image processing device 3MB. The information transmitted here may be only the ID, or may be a combination of the ID and password. The image processing device 3MB exports the biometric information of the account information that matches the account information included in the received request to the image processing device 3MA.

Image IG7 shown in FIG. 6A is displayed, for example, when the "OK" button is operated in image IG5. Further, the image IG7 is displayed, for example, at an appropriate time after an affirmative determination is made in step ST2 (for example, after step ST9) and before step ST10. In image IG7, in addition to an image similar to the upper half of image IG3, the image processing device 3 selected in image IG5 (in the illustrated example, "B department 1 section") is shown in the "MFP with registered biometric information" column. MFP “B01”) is shown. Additionally, the message ``Please let me read your fingerprint'' prompts you to enter your biometric information. Note that, as understood from the above, a mode in which a fingerprint is used as biometric information is assumed here. Of course, biometric information may be other than fingerprints. The user can have his or her fingerprint read by placing his or her finger on the detection unit 25. The finger at this time is naturally the finger whose fingerprint was read during registration. Note that in step ST3, an image similar to image IG7 may be displayed.

Image IG9 shown in FIG. 6B is generated, for example, when biometric information is detected by detection unit 25 (step ST10) and authentication is successful (when an affirmative determination is made in step ST12) while image IG7 is being displayed. will be displayed. In image IG9, in addition to an image similar to the upper half of image IG7, the notation ``authentication complete'' indicates that authentication has been successful. By performing a predetermined operation (for example, tapping) on the "Return to Menu" button, the user proceeds to a screen (so-called menu screen and/or home screen) for using the functions of the image processing device 3MA (or back) can be done.

Although not particularly shown, if authentication fails (including cases where biometric information cannot be detected for a predetermined period of time), for example, after a message indicating that authentication has failed is displayed, the previous screen or A specific screen (eg, image IG1) may be displayed. Alternatively, options such as re-entering the biometric information (retrying the same authentication method) and returning to a specific screen may be displayed along with a display indicating that the authentication has failed. In an embodiment where the image processing device 3MA is capable of using multiple types of authentication methods, the above options may include switching to other authentication methods (including authentication using other biometric information).

In the illustrated example, it is determined which of the image processing devices 3MA and 3MB the first biometric information is used based on the user's self-report. Further, as described above, some users may overlap in the management table DT0 of the image processing device 3MA and the management table DT0 of the image processing device 3MB. Therefore, for example, although the first biometric information of user B is registered in the image processing device 3MA, the first biometric information of user B is imported from the image processing device 3MB to the image processing device 3MA. It doesn't matter if the situation arises. In addition, even if the image processing device 3MA declares that the user B is a user in another department, before importing, the image processing device 3MA refers to its own management table DT0 and determines the presence or absence of the first biometric information of the user B. You may check.

The above screen example may be implemented or modified as appropriate.

For example, inputting account information in image IG1 (FIG. 5A) may or may not be a prerequisite for moving to the next screen (FIG. 5B, etc.). In the latter case, for example, account information may be inputtable on the next screen (for example, image IG3). In the former case, when "other department user" is selected in image IG1, FIG. 5B may be skipped and the process may proceed to FIG. 5C.

Regarding image IG1, if the user is user A registered in image processing device 3MA, input of account information may or may not be required. Regarding the latter, if biometric authentication is performed even if account information is not input, the image processing device 3MA can refer to its own management table DT0 and identify the account information from the biometric information. Further, if biometric information and information regarding functional limitations are directly linked as in the management table DT0 illustrated in FIG. 1, there is no need to specify user A's account information.

As described above, in the mode where user A's account information is not required, unlike the example in FIG. 5A, information prompting for input of account information is removed, and only a display prompting the user to declare whether or not the user is from another department is displayed. It's okay. If the user declares that he/she is the user of his/her own department (user A), an image prompting the user to input the biometric information may be displayed instead of an image prompting the user to input the account information. Further, if it is declared that the user is a user from another department (user B), an image (for example, an image similar to image IG3 in FIG. 5B) prompting the user to input account information may be displayed.

When the user is user A registered in the image processing device 3MA, in a mode where account information is required, for example, not only biometric authentication but also authentication using account information may be performed. In this case, security is improved.

Furthermore, in an embodiment where the image processing device 3MA is capable of using multiple types of authentication methods, an image for selecting an authentication method is displayed at an appropriate time (before step ST1 and/or before image IG1). Good too. Also, as mentioned in the explanation of Figure 4, an image that prompts the user to input biometric information is displayed first, and then, if necessary (if the user is a user from another department), the user is prompted to input account information. , the user may be prompted to input information specifying the image processing device 3 with which the user is registered.

When a user in another department inputs information that identifies the image processing device 3 in which he or she is registered, he or she does not select from a list (FIG. 5C), but directly inputs information that identifies the image processing device 3 (for example, an address). It may be something that does.

(4.3. Details of some operations in the first embodiment)
(4.3.1. Examples of restrictions related to imported biometric information)
FIG. 7 is a flowchart illustrating an example of details of a part of the procedure described in FIG. 4. More specifically, FIG. 7 shows details of the procedure (steps ST8 to ST14) when the user using the image processing device 3MA is the user B registered in the image processing device 3MB. Note that FIG. 7 may be interpreted as showing other processing similar to the processing in FIG. 4.

In the process of FIG. 7, the account information of user B is sent from the image processing device 3MA to the image processing device 3MB, and only if the authentication using this account information is successful, the image processing device 3MA sends the account information of the user B from the image processing device 3MB. Import of biometric information (first biometric information) is permitted. Further, the imported first biometric information is deleted when a predetermined condition is met. These operations reduce the possibility of unintended leakage of biological information. Specifically, it is as follows.

In FIG. 7, the procedure of "MFP-A" indicates the procedure executed by the image processing apparatus 3MA (its control unit 29). The "MFP-B" procedure indicates a procedure executed by the image processing device 3MB (its control unit 29).

In step ST41, the image processing device 3MA acquires user B's account information. It is assumed that the account information here includes a password (that can be used for authentication). In step ST42, the image processing device 3MA transmits the account information acquired in step ST41 to the image processing device 3MB. Note that this account information transmission may be, for example, a request for biometric information in step ST8 or a part thereof.

Note that, as understood from the previous explanation, acquisition of account information (step ST41), identification of the image processing device 3MB in which user B is registered (image IG5), and biometric information of user B (second The detection of biological information (step ST10) may be performed in any order. Here, it is assumed that the identification of the image processing device 3MB is performed at an appropriate time before sending the account information (step ST42), and illustration is omitted. Furthermore, as in FIG. 4, the detection of biometric information is performed after importing the biometric information of user B (first biometric information).

In step ST43, the image processing device 3MB determines whether account information matching the account information received in step ST42 is registered in its own management table DT0. That is, the image processing device 3MB performs authentication based on account information. Then, if the image processing device 3MB succeeds in authentication, the image processing device 3MB exports the biometric information stored in association with the matching account information (i.e., the first biometric information of user B) to the image processing device 3MA ( Step ST45). On the other hand, if the authentication fails, the image processing device 3MB transmits a notification indicating that the authentication has failed to the image processing device 3MA (step ST44).

Note that, as described above, the flowcharts illustrated in the embodiments are conceptual. Therefore, for example, in step ST45, in actual processing, a notification indicating that authentication has been successful may be transmitted from the image processing device 3MB to the image processing device 3MA, and then the biometric information may be transmitted from the former to the latter.

In step ST46, the image processing device 3MA determines whether or not the authentication in the image processing device 3MB is successful based on the notification from the image processing device 3MB (steps ST44 and ST45). Then, when the image processing device 3MA makes a positive determination (in other words, when the biometric information of user B could be imported), the process proceeds to step ST47, and when the negative determination is made, the process proceeds to step ST50. Steps ST47 to ST50 are the same as steps ST10 to ST14 in FIG. 4 (however, step ST11 is not shown).

In step ST51, the image processing device 3MA determines whether a predetermined erasure condition is satisfied. Then, in the case of a positive determination, the image processing apparatus 3MA erases the first biometric information of user B imported in step ST45 (step ST52), and in the case of a negative determination, repeats step ST51 (stands by). .

Note that in FIG. 7, for convenience, the route from step ST50 to step ST51 includes the case where the determination in step ST46 is negative (the case where import is not performed). Actually, if it has not been imported, steps ST51 and ST52 may not be performed. Further, unlike the illustrated example, the first biometric information may be deleted when the authentication is completed (immediately after step ST48).

The erasing conditions in step ST51 may be set as appropriate.

For example, the erasing condition may include that a predetermined time has elapsed. The timing at which the predetermined time starts is arbitrary. For example, the time measurement starts when the import of the first biometric information of user B is completed, when the authentication of user B is completed, and when the execution of a function whose restrictions are lifted based on the result of user B's authentication starts. This may be the point in time or completion point, the point in time when the authentication state is canceled, or the point in time when user B performs the last operation on the UI section 23.

The entity that sets the predetermined time and/or the timing start point may be any of the manufacturer of the image processing device 3MA, the administrator of the image processing device 3MA, and user B (the user whose biometric information is to be deleted). The specific length of the predetermined time is arbitrary, for example, 1 second or more, 10 seconds or more, 30 seconds or more, 1 minute or more, 10 minutes or more, 30 minutes or more, 1 hour or more, 1 day or more, 1 week or more. , may be more than 1 month, less than 1 month, less than 1 week, less than 1 day, less than 1 hour, less than 30 minutes, less than 10 minutes, less than 1 minute, less than 30 seconds, less than 10 seconds, or less than 1 second. The above lower limit and upper limit may be arbitrarily combined so as not to contradict each other.

Also, for example, the deletion condition may include completion of execution of a function whose restrictions have been lifted based on the authentication result. For example, in a mode where authentication is required for each execution of a function (for example, printing, scanning, copying, or sending or receiving data), when the execution of the function is completed (for example, not including interruptions due to abnormalities, etc.) User B's first biometric information may be deleted.

Further, for example, the deletion condition is that the user B (or another user) performs an operation (in other words, a predetermined operation) on the UI unit 23 to delete the imported first biometric information of the user B. May include what has been done.

If the first biometric information of user B imported by the image processing device 3MA is deleted due to the passage of a predetermined time or the completion of execution of a function, the biometric information is automatically deleted when the automatic deletion conditions are met. It can be understood as Conversely, the deletion by the predetermined operation in the previous paragraph is not automatic but intentional by the user. Note that the mode in which the erasure condition includes the passage of a predetermined time is a mode intended to automatically erase the first biometric information of User B, and unless otherwise specified, it is assumed that the time when the predetermined time starts to be counted. The time point at which the biometric information is obtained does not include the time point at which the first biometric information is deleted as described in the previous paragraph. In other words, when the predetermined operation described in the previous paragraph is performed, the first biometric information is basically deleted immediately.

The procedure shown in FIG. 7 may be modified as appropriate. For example, in steps ST41 to ST43, account information is used as authentication information indicating the validity of user B (and information based on the authentication information; the same applies hereinafter). However, the authentication information may be various types of authentication information different from the biometric information to be imported, and is not limited to account information. For example, various kinds of authentication information illustrated in Section 1.1.3 may be used.

Furthermore, in FIG. 7, the imported first biometric information is deleted in step ST52. In addition to or in place of the imported first biometric information, the second biometric information of user B detected in step ST47 (and/or the second biometric information of user A detected in step ST4) is May be deleted.

(4.3.2. Example of reusing imported biometric information)
The first biometric information of user B that the image processing device 3MA imported from the image processing device 3MB may or may not be reused before being deleted in step ST52. Reuse reduces the load on the network 10 due to import, for example. An example of a reused mode will be shown below.

FIG. 8 is a flowchart showing an example of a part of the procedure described in FIG. 7 in detail. More specifically, FIG. 8 shows details of the procedure (steps ST49 to ST52) after successful authentication. Note that when the authentication fails (when the process proceeds to step ST50 instead of step ST49), for example, steps ST55 and ST56, which will be described later, are not performed. Note that FIG. 8 may be interpreted as showing other processing similar to the processing in FIG. 7.

Step ST49 is as described in the explanation of FIG. After the authentication (step ST48) is successful, the image processing device 3MA determines whether re-authentication conditions are satisfied (step ST55). Note that the first determination of the re-authentication conditions may be performed after step ST48 and before step ST49. Then, when the image processing apparatus 3MA makes a positive determination, the process proceeds to step ST56, and when it makes a negative judgment, the image processing apparatus 3MA skips step ST56 and proceeds to step ST51.

In step ST56, similarly to steps ST47 to ST50, the image processing device 3MA displays a prompt to re-enter the biometric authentication, causes the detection unit 25 to re-detect the biometric information (second biometric information), and detects the biometric information (second biometric information) again. Authentication is performed by comparing the biometric information and the first biometric information. However, the first biometric information is not newly imported, but the one imported in step ST45 and held by the image processing device 3MA is used. Then, the image processing device 3 maintains the release of the function restriction (maintains the authentication state) or restricts the function (cancels the authentication state) according to the authentication result. When the authentication state is canceled, for example, execution of the restricted function is prohibited after the currently executed function (task) is completed (or without waiting for its completion).

After that, the image processing device 3 proceeds to step ST51. Steps ST51 and ST52 are as described in the explanation of FIG. However, if a negative determination is made in step ST51, the image processing device 3 does not repeat step ST51, but returns to step ST55, for example. As a result, for example, re-input of biometric information is repeatedly requested.

Note that if the re-authentication in step ST56 fails, the process may be as described above, or a process different from the above may be performed. For example, the image processing device 3 may prompt a retry of authentication and repeat step ST56 instead of proceeding to step ST51. Alternatively, the image processing device 3 may proceed to step ST51 and repeat step ST51 without returning to step ST55 if a negative determination is made in step ST51. In other words, the first biometric information may be deleted without performing re-authentication to reuse the first biometric information.

The re-authentication conditions may be set as appropriate. For example, the re-authentication condition may include that a predetermined period of time has elapsed since the detection unit 25 detected the biometric information of the user B most recently (from another point of view, the most recent authentication of the user B in the past). In this case, for example, the probability that someone other than user B will illegally use user B's authority is reduced. The detection (authentication) of the most recent past biometric information here is, for example, the detection in step ST47 (first authentication) or the detection in step ST56 (re-authentication). The predetermined time may be set by, for example, the manufacturer of the image processing device 3, the administrator of the image processing device 3, or an individual user (here, user B).

Further, for example, the re-authentication condition may include that an operation instructing the execution of a predetermined function has been performed on the UI unit 23. In this case as well, for example, the probability that someone other than user B will illegally use user B's authority is reduced. The above-mentioned predetermined function is, for example, a function related to at least one of the image processing section 31 and the communication section 27, and may be included in one or more functions whose restrictions have been lifted due to successful authentication. As the predetermined function, all functions may be selected from the one or more functions described above, or some functions (for example, a function requiring relatively high security) may be selected. The predetermined function may be selected by, for example, the manufacturer of the image processing device 3, the image processing device 3, or an individual user (here, user B).

The imported first biometric information may be reused before being deleted in a manner other than the above. For example, before erasing user B's first biometric information, the image processing device 3MA associates and holds user B's account information input in step ST41 with user B's first biometric information. good. When user B once finishes using the image processing device 3MA and executes step ST41 again, if the previous first biometric information has not been deleted yet, the account information matches the re-entered account information. The biometric authentication in steps ST47 and ST48 may be performed using the previous first biometric information stored in association with the account information (that is, without importing).

Steps ST55 and ST56 may also be performed after step ST6. That is, the request for re-authentication may also be made to the user A registered in the image processing device 3MA. However, in this case, the first biometric information to be compared with the detected second biometric information is what the image processing device 3MA holds in its own management table DT0. The first biometric information of user A registered in the management table DT0 is different from the first biometric information of user B, and is not imported or automatically deleted.

Unlike the above description, re-authentication may be performed by importing the first biometric information of user B.

Further, re-authentication differs from the above explanation in that the second biometric information detected in step ST4 or ST10 (ST47) is the first biometric information (registered in the image processing device 3MA or the image (imported from the processing device 3MB) may be used instead. In this case, the second biometric information detected in step ST4 or ST10 (ST47) is more likely to be in accordance with the user's current physical condition than the first biometric information. The probability that re-authentication will fail due to physical condition or the like is reduced.

(5. Second embodiment)
As described above, the second embodiment is a mode in which the image processing device 3MA executes the second method of exporting the second biometric information (detected biometric information) of the user B to the image processing device 3MB. Specifically, for example, it is as follows.

(5.1. Outline of operation in second embodiment)
FIG. 9 is a flowchart illustrating an example of an outline of a procedure related to authentication executed by the image processing device 3MA (control unit 29 from another perspective). This figure corresponds to FIG. 4 of the first embodiment. Steps ST1 to ST7 and ST12 to ST14 are similar to those in FIG. 4. Similar to steps ST8 to ST14 in FIG. 4, steps ST61 to ST64 and ST12 to ST14 are processes performed when the user using the image processing apparatus 3MA is a user in another department (here, user B).

In step ST61, the image processing device 3MA detects user B's biometric information (second biometric information) similarly to step ST4. In step ST62, the image processing device 3MA accesses the image processing device 3MB and requests user B's authentication, for example. In step ST63, the image processing device 3MA exports the second biometric information of the user B detected in step ST61 to the image processing device 3MB.

In step ST64, the image processing device 3MB determines whether biometric information (first biometric information) that matches the second biometric information exported in step ST63 exists in its own management table DT0. That is, the image processing device 3MB performs biometric authentication. Then, the authentication result is notified to the image processing device 3MA. Note that step ST64 can be called a step of receiving the authentication result from the image processing device 3MB as a process of the image processing device 3MA.

Steps ST12 to ST14 are as described in the explanation of FIG. 4. However, unlike in FIG. 4, the determination in step ST12 is based on a notification from the image processing device 3MB, and is not based on self-authentication.

In the image processing device 3MB, the second biometric information exported from the image processing device 3MA (step ST63) may be deleted from the image processing device 3MB immediately after the comparison with the registered biometric information is performed. However, the exported second biometric information may be stored in the image processing device 3MB until an appropriate time thereafter (for example, when the authentication state is canceled) and used as appropriate. Furthermore, the exported second biometric information may be used to update the registered first biometric information.

The description of the communication in steps ST8 and ST9 in FIG. 4 may be used for the communication in steps ST62 and ST63 as appropriate. For clarity, the export may be within the private network 13A or via the public network 11, for example. In the latter case, a VPN connection may or may not be utilized. Further, the connection for export may be established at step ST62 or ST63, or may be established before that.

Further, for example, in a mode (or other mode) in which image processing devices 3MA and 3MB are included in the same LAN, unlike the above explanation, image processing device 3MA does not specify image processing device 3MB, and All communication devices within the LAN may be inquired about the presence or absence of user B's first biometric information. The corresponding communication device (the image processing device 3MB that has registered the first biometric information of user B) may respond affirmatively to the inquiry. The image processing device 3MA may then export the second biometric information (detected) of the user B to the source of the positive reply.

The procedure shown in FIG. 9 may be modified as appropriate. For example, the order of steps ST61 and ST62 may be reversed.

(5.2. Example of screen in second embodiment)
When executing the process in FIG. 9, an appropriate image may be displayed on the display section 35. The screens (FIGS. 5A to 6B) illustrated in the description of the first embodiment (section 4.2) may be used in the second embodiment. For example, the screens shown in FIGS. 5A to 6B may be used as they are in the second embodiment. In other words, the user does not need to be able to distinguish between the first embodiment and the second embodiment. The various explanations regarding FIGS. 5A to 6B may be appropriately incorporated into the second embodiment by replacing specific terms (for example, symbols indicating steps), as long as there is no contradiction.

(5.3. Details of some operations in the second embodiment)
(5.3.1. Examples of restrictions related to exported biometric information)
FIG. 10 is a flowchart illustrating an example of details of a part of the procedure described in FIG. 9. More specifically, FIG. 10 shows details of the procedure (steps ST61 to ST64 and ST12 to ST14) when the user using the image processing device 3MA is the user B registered in the image processing device 3MB. . Note that FIG. 10 may be interpreted as showing other processing similar to the processing of FIG. 9.

In the process of FIG. 10, the account information of user B is sent from the image processing device 3MA to the image processing device 3MB, and only if the authentication using this account information is successful, the image processing device 3MA sends the account information of user B to the image processing device 3MB. Export of biometric information (second biometric information) is permitted. Furthermore, the exported second biometric information and the detected first biometric information are deleted when predetermined conditions are satisfied. These operations reduce the possibility of unintended leakage of biological information. Specifically, it is as follows.

Steps ST41 to ST44 are similar to those in FIG. 7, and the explanation of FIG. 7 may be used. Also, similar to FIG. 7, acquisition of account information (step ST41), identification of the image processing device 3MB in which user B is registered (image IG5), and detection of user B's biometric information (second biometric information) (Step ST61) may be performed in any order as long as no contradiction occurs. The illustration of the identification of the image processing device 3MB is omitted as in FIG. 7. Furthermore, it is assumed that the detection of biometric information is performed at an appropriate time before the export of the detected biometric information (step ST73), and illustration thereof is omitted.

In step ST43, when the authentication based on the account information received in step ST42 is successful, the image processing device 3MB transmits a notification indicating that the authentication was successful to the image processing device 3MA (step ST71). In step ST72, the image processing device 3MA determines whether or not the authentication based on the account information has been successful, based on the notification from the image processing device 3MB (steps ST44 and ST71).

Then, the image processing device 3MA proceeds to step ST73 when the determination is affirmative, and proceeds to step ST78 when the determination is negative. Step ST73 is the same as step ST63, and the image processing device 3MA exports the biometric information (second biometric information) of the user B detected by itself to the image processing device 3MB. Step ST78 is the same as step ST14, and the image processing device 3MA does not release the restriction on the function.

Steps ST74 and ST75 are the same as step ST64. That is, the image processing device 3MB determines whether or not the second biometric information of the user B exported from the image processing device 3MA matches the first biometric information of the user B that it holds. Authentication is performed (step ST74), and the authentication result is transmitted to the image processing device 3MA (step ST75).

Steps ST76, ST77, and ST78 are the same as steps ST12, ST13, and ST14, and their explanation will be omitted.

After the export (step ST73) is completed (in the illustrated example, after step ST77), the image processing device 3MA determines whether a predetermined deletion condition is satisfied (step ST79). Then, in the case of a positive determination, the image processing device 3MA erases the second biometric information of the user B detected in step ST61 (step ST80), and in the case of a negative determination, repeats step ST79 (stands by). . Note that, unlike the illustrated example, the second biometric information may be deleted when the export is completed (immediately after the export). In the illustrated example, when biometric authentication is successful (when an affirmative determination is made in step ST76), it is determined whether the erasure condition is satisfied. When biometric authentication fails, for example, the second biometric information of user B may be deleted immediately, or a determination is made as to whether the deletion conditions are met in the same way as when biometric authentication is successful. It's okay.

After the image processing device 3MB succeeds in biometric authentication (step ST74) (in the illustrated example, after step ST75), the image processing device 3MB determines whether a predetermined deletion condition is satisfied (step ST81). Then, in the case of a positive determination, the image processing device 3MB erases the second biometric information of the user B exported from the image processing device 3MA in step ST73 (step ST81), and in the case of a negative determination, the image processing device 3MB deletes the second biometric information of the user B exported from the image processing device 3MA in step ST73. Repeat (wait). Note that, unlike the illustrated example, the second biometric information may be deleted when biometric authentication is completed (immediately after biometric authentication). Furthermore, when biometric authentication fails, for example, the second biometric information of user B may be deleted immediately, or the second biometric information of user B may be deleted immediately, or a determination is made as to whether the deletion conditions are satisfied, in the same way as when biometric authentication is successful. may be done.

The erasing conditions in steps ST76 and ST81 may be set as appropriate.

For example, the erasing condition may include that a predetermined time has elapsed. For example, regarding the erasure condition in step ST76, the timing start time is the time when the export of the second biometric information of user B (step ST73) is completed, the time when the biometric authentication result is received from the image processing device 3MB (step ST75) ), at the start or completion of execution of a function for which restrictions have been lifted based on the result of user B's authentication, at the point at which the authentication state is canceled, or at the time when user B's last operation is performed on the UI unit 23. may be considered as the point in time. Further, for example, regarding the erasure condition in step ST81, the timing start time may be the time when biometric authentication (step ST74) is completed, or the time when the biometric authentication result is transmitted to the image processing device 3MB (step ST75). . The entity that sets the predetermined time and/or the timing start point is the manufacturer of the image processing device 3MA or 3MB, the administrator of the image processing device 3MA or 3MB, or User B (the user whose biometric information is to be deleted). It's okay.

Further, for example, the deletion condition in step ST79 may include completion of execution of a function whose restrictions have been canceled based on the authentication result. For example, in a mode where authentication is required for each execution of a function (for example, printing, scanning, copying, or sending or receiving data), when the execution of the function is completed (for example, not including interruptions due to abnormalities, etc.) User B's second biometric information may be deleted.

For example, the deletion condition in step ST79 is an operation (in other words, a predetermined This may be defined as the point in time when the operation) was performed.

Furthermore, for example, the deletion condition in step ST81 may be that the image processing device 3MB has received a request to delete the second biometric information of the user B from the image processing device 3MA. Regarding the conditions under which the image processing device 3MA transmits the above request to the image processing device 3MB, the explanation of the deletion conditions in step ST79 may be used. The conditions for transmitting the above-mentioned request and the deletion conditions in step ST79 may be the same or different.

The procedure shown in FIG. 10 may be modified as appropriate. For example, as described in the explanation of FIG. 7, the authentication information indicating the validity of user B used in step ST43 (and information based on the authentication information; the same applies hereinafter) is the biometric information to be exported. may be different types of authentication information, and is not limited to account information.

(5.3.2. Example of reusing exported biometric information)
The second biometric information (detected) of user B that is deleted in step ST80 or ST82 may or may not be reused.

In the case of reuse, for example, the procedure shown in FIG. 8 may be used to reuse the second biometric information deleted in step ST80 or ST82. In reference to step ST80, for example, steps ST49, ST51, and ST52 in FIG. 8 may be replaced with steps ST77, ST79, and ST80, respectively. In reference to step ST82, for example, the restriction release in step ST49 of FIG. 8 may be replaced with the authentication in step ST74, and steps ST51 and ST52 may be replaced with steps ST81 and ST82, respectively.

The specific contents of steps ST55 and ST56 in FIG. 8 may be different from the first embodiment. For example, as follows.

For example, in reusing the second biometric information deleted in step ST80, the image processing device 3MA exports the second biometric information to the image processing device 3MB and requests re-authentication in step ST56. Through such an operation, re-authentication by the image processing device 3MB can be realized, for example, without requiring the user B to re-enter biometric information. Note that when exporting the second biometric information for re-authentication, it may be assumed that the authentication using account information (step ST43) is successful, similar to the export for the first authentication (step ST73). , need not be assumed.

The re-authentication conditions (step ST55) when performing the operation related to reusing the second biometric information deleted in step ST80 as described above are arbitrary.

For example, after the initial authentication is performed and the restriction on functions is lifted (after step ST77), when requesting establishment of a connection (for example, VPN connection) from the image processing device 3MA to the image processing device 3MB, the image processing Authentication by the device 3MB may be required. In such aspects, the re-authentication condition may include the need to establish the connection described above. Note that the establishment of a connection may be a purpose in itself and may be instructed by User B, or may be necessary in conjunction with the use of some function (for example, sending or receiving data). There may be.

Further, for example, when a connection (for example, VPN connection) is established from the image processing device 3MA to the image processing device 3MB due to successful authentication in step ST74, or when a connection is established by re-authentication as described above, some The connection may be disconnected due to an abnormality (for example, a communication failure). In this case, re-authentication is required. Therefore, the re-authentication condition may be that a connection requiring authentication is unintentionally interrupted.

In addition, in reusing the second biometric information deleted in step ST82, for example, the re-authentication condition in step ST55 is that the image processing device 3MA requests the image processing device 3MB to authenticate the user B. good. In the re-authentication of step ST56, the image processing device 3MB uses the second biometric information of the user B newly exported from the image processing device 3MA and the second biometric information of the user B registered in its own management table DT0. Instead of comparing with the first biometric information, the newly exported second biometric information of user B may be compared with the second biometric information previously acquired and before being deleted in step ST82. . In this case, there is a high probability that the previously acquired second biometric information has content that is more appropriate to the current physical condition of user B than the registered first biometric information, and as a result, It is expected that the accuracy of authentication will improve.

In the case where the second biometric information erased in step ST82 is to be reused as described above, it is assumed that the authentication is successful in step ST74 and the validity of the second biometric information has been confirmed. It is. The request for authentication from the image processing device 3MA may be, for example, in a situation where user B is requesting new authentication from the image processing device 3MA to remove functional restrictions, or in a situation where functional restrictions are being removed. The situation may also be one in which authentication is required to establish a connection (for example, VPN) from the image processing device 3MA to the image processing device 3MB after the authentication is completed. Further, the second biological information newly exported from the image processing device 3MA may be newly detected information, or may be information that has been reused before being deleted in step ST80. .

(6. Third embodiment)
In the first and second embodiments, when biometric authentication is successful, functional restrictions are lifted. However, on the condition that the biometric authentication is successful, the authentication information may be transmitted to the server 5, and on the condition that the authentication based on the authentication information is successful, the restriction on the function may be lifted. In this case, security is improved because two-step authentication is required: authentication at the image processing device 3 (biometric authentication) and authentication at the server 5. It should be noted that this mode can also be said to be a mode in which restrictions on functionality are lifted based on biometric authentication, although other authentication is further performed after biometric authentication.

FIG. 11 is a block diagram showing the configuration of a communication system 1 according to the third embodiment.

The image processing device 3 has, for example, the configuration described with reference to FIGS. 1 to 3, and in FIG. 11, the detection unit 25, control unit 29, image processing unit 31, and auxiliary storage device 45 are extracted is shown. As described above, the auxiliary storage device 45 has the management table DT0, a part of which is shown as the comparison table DT1 in FIG. The comparison table DT1 holds account information (ID and password) and one or more pieces of biometric information in association with each other for each user.

The server 5 includes, for example, a verification unit 5a and a nonvolatile memory 5b. The verification unit 5a is constructed, for example, similarly to the control unit 29 of the image processing device 3, by the CPU executing a program stored in the ROM and/or the auxiliary storage device. The nonvolatile memory 5b is constituted by, for example, an auxiliary storage device, and stores the verification table DT2. The verification table DT2 holds account information (ID and password) for each user.

The image processing device 3 (3MA) performs biometric authentication of the user similarly to the first and second embodiments. When the biometric authentication is successful (if an affirmative determination is made in step ST5 or ST12 in FIG. 4 or FIG. 9), the image processing device 3 does not immediately release the restriction on the function, but requests the server 5 for authentication.

Specifically, for example, if an affirmative determination is made in step ST5, the image processing device 3MA associates the biometric information of the user A who has been successfully authenticated in the comparison table DT1 held by the image processing device 3MA. Send account information to server 5. Further, if an affirmative determination is made in step ST12, the image processing device 3MA transmits the account information of user B input in step ST41 of FIG. 7 or FIG. 9 to the server 5.

The server 5 that has received the account information determines whether account information that matches the received account information is registered in the verification table DT2. Authentication is thereby performed. That is, if account information that matches the received account information is registered, authentication is successful; otherwise, authentication is unsuccessful. Then, the server 5 transmits the authentication result (success or failure of authentication) to the image processing apparatus 3 (3MA) that is the source of the account information.

When the image processing device 3MA receives the authentication result, if the authentication result indicates that the authentication was successful, the image processing device 3MA releases the restriction on the function (step ST6 or ST13). If not, the image processing device 3MA limits the function (step ST7 or ST14). Note that if biometric authentication fails in step ST5 or step ST12, the account information is not transmitted to the server 5 and functions are restricted (step ST7 or ST14).

The third embodiment may be modified as appropriate. For example, the authentication information (and information based on the authentication information; the same applies hereinafter) used for authentication by the server 5 is not limited to account information. The authentication information may be various kinds of authentication information different from the biometric information to be imported or exported. For example, various kinds of authentication information illustrated in Section 1.1.3 may be used. However, the authentication information may be biometric information to be imported or exported.

In relation to the above, if the user who uses the image processing device 3MA is user B, the information input from the UI unit 23 (for example, account information) may not be used, or the information may be the first biometric information of user B. The information does not have to be input as information for identifying user B (for example, account information) for importing information. For example, when the image processing device 3MA imports the first biometric information of the user B from the image processing device 3MB, it also imports the authentication information stored in association with this first biometric information, and The imported authentication information may be sent to the server 5.

(7. Operations related to cancellation of functional restrictions)
Removal of functional restrictions based on the authentication result may be performed in various ways. An example is shown below.

(7.1. General operations related to cancellation of functional restrictions)
(7.1.1. Types of functions whose release of restrictions is controlled)
The function whose restriction is controlled to be lifted based on the authentication result may be, for example, a function related to at least one of the image processing section 31 (printer 19 and/or scanner 21) and the communication section 27. Examples of restricted functions include the following: One or more of the following functions may be appropriately selected and set as a restriction target. Note that the plurality of functions listed below may overlap with each other or may be inseparable from one another.

First, printing by the printer 19 can be cited as a function to be restricted. Printing may be restricted for each subdivided function. For example, printing may be based on scanning by the scanner 21, printing based on data received by the communication unit 27, or storing data in the image processing device 3 (auxiliary storage device 45) or a device connected to the connector 37 (for example, non-volatile memory). It may be subdivided into printing based on the data that has been created.

The printing restrictions based on the data received by the communication unit 27 may be further subdivided according to the transmission source communication device (for example, another image processing device 3, the

server

5 or 7, or the terminal 9). Note that such printing restrictions may be substantially implemented by restricting communication destinations. Furthermore, the printing restrictions based on the data received by the communication unit 27 may be further subdivided according to the mode of communication (normal data communication, email reception, or FAX reception).

The printing restrictions based on the data stored in the image processing device 3 may be further subdivided according to the type of box (folder or directory in another expression) in which the data is stored. Note that such printing restrictions may be substantially implemented by restricting access to a box in which highly confidential files (document files and/or image files) are expected to be stored.

The printing restrictions based on the data stored in the memory connected to the connector 37 may be further subdivided depending on the type or individual of the connected device. Note that such printing restrictions may be substantially realized by restricting the devices that can be connected to the connector 37 (so-called device control).

In addition, scanning by the scanner 21 is an example of a function that is subject to restriction. Similar to printing, scanning may be limited by granular features. For example, scanning is for copying (printing), for transmitting data (for example, image data), and for scanning data to the image processing device 3 (auxiliary storage device 45) or a device connected to the connector 37. may be subdivided into those for preservation and those for preservation.

Scanning for data transmission may be further subdivided depending on the destination communication device (for example, another image processing device 3,

server

5 or 7, or terminal 9). Note that such scanning restrictions may be substantially implemented by restricting destinations. Furthermore, scanning for data transmission may be further subdivided depending on the mode of communication (normal data communication, email transmission, or FAX transmission).

Scans for storage in the image processing device 3 may be further subdivided according to the type of storage destination box. Note that such scanning restrictions may be substantially implemented by restricting access to a box in which highly confidential files are expected to be stored.

Scans for storage in the device connected to the connector 37 may be further subdivided depending on the type or individual of the connected device. Note that such scanning limitations may be substantially implemented by limiting the devices that can be connected to the connector 37.

Further, the function to be restricted does not have to be a major function such as printing or scanning. For example, the restricted function may be a function that performs settings related to major functions, such as setting the size of the margins of printed paper. However, such a function may be regarded as a function of printing with arbitrary margin settings, and may even be regarded as a type of main function.

Furthermore, the function to be restricted may be a function used by the administrator of the image processing device 3. For example, the image processing device 3 may be set to uniformly (regardless of the user's authentication results) prohibit some of the above-mentioned main functions or to prohibit connection of a predetermined device to the image processing device 3. may be accepted. Then, such setting restrictions may be canceled for a specific user (the administrator of the image processing device 3).

(7.1.2. Aspects of functional limitations)
As described above, the image processing device 3 has various functions. The functions to be restricted may be all or some of the various functions excluding the authentication function. From another point of view, a user who fails authentication via biometric authentication may be substantially prevented from using the image processing device 3, or may be able to use some functions.

The manner in which functional restrictions are lifted when authentication is successful may be common to all users, or may be set individually for each user. To put the former in another perspective, there may be only two types of users: users for whom functional restrictions are not lifted without authentication and users for whom functional restrictions are lifted after authentication. There may be no difference in the functions that can be used between the users whose functions are lifted.

Furthermore, in an embodiment in which multiple types of authentication methods are possible, there may or may not be a difference in the functions for which restrictions are lifted for authenticated users depending on the authentication method. Let me give an example of the former. For example, in any of the first to third embodiments, the image processing device 3 registers input account information and the self, other image processing devices 3, and/or server 5 without performing biometric authentication. It may be possible to perform authentication by comparing account information with existing account information, and to control the release of restrictions on functions. In such an aspect, when focusing on the same user or all users, when authentication using account information is successful, the restriction on the first number of functions is lifted, and when authentication using biometric information is successful, the restriction on the first number of functions is lifted. The restriction may include a restriction on one number of functions, and a restriction on a second number of functions greater than the first number may be lifted.

An example is given in which the release of restrictions on functions when authentication is successful can be set individually for each user. Assume that a user who is not authenticated cannot use both the first function and the second function. At this time, the authenticated users include users who can use only the first function, users who can use only the second function, users who can use both the first function and the second function, and users who have been authenticated. However, there may be two or more types of users whose functions are restricted in the same way as users who are not authenticated.

(7.1.3. Cancellation of authentication status)
Naturally, the authentication state (state in which functional restrictions are removed) will be released at some point. For example, canceling the authentication state can be rephrased as returning to a non-authenticated state (a state before functional restrictions were released). Canceling the authentication state involves terminating functions that require authentication (e.g., VPN connection described below) and/or invalidating (e.g., erasing from memory) information acquired on the assumption of authentication (e.g., k described later). good. Therefore, cancellation of the authentication state may be recognized by the termination of these operations and/or the invalidation of information. Furthermore, for example, in a mode in which a flag is set to indicate that authentication has been successful, it may be recognized by an action of tossing down the flag. In this case, it is not necessary to terminate the operation based on the authentication and/or invalidate the information obtained based on the authentication.

The authentication state may be canceled using various events as triggers. Examples of such events include the following: The user has performed a predetermined operation on the operation unit 33. Processing related to a function that requires authentication (for example, a function to download and print predetermined image data) has been completed. A predetermined time has elapsed since a predetermined time (for example, the time when the last operation on the operation unit 33 was performed). The human sensor detects that the user has left the image processing device 3.

(7.2. Specific example of releasing restrictions on functions)
Various specific configurations are possible for realizing control of function restriction release. Below, we will mainly show specific examples of aspects in which there are differences in the functions whose restrictions are lifted between users when authentication is successful.

FIG. 12A is a schematic diagram showing the authority table DT3 used for controlling the release of function restrictions.

The authority table DT3 holds IDs and authority information D3 in association with each other. That is, the authority information D3 is information that specifies whether restrictions can be canceled for each function, and printing and scanning are illustrated in FIG. 12A.

The authority table DT3 may be held by the image processing device 3, for example. The image processing device 3 may have an authority table DT3 as a part of its own management table DT0 (FIG. 1). In FIG. 1, the authority level (described later) is illustrated as the "functional restriction" of the management table DT0, but the information held in the "functional restriction" is different from the example of FIG. 1, and is the authority information D3. It's good. The image processing device 3 holds user authority information D3 registered in its own management table DT0.

Then, if the user who has successfully authenticated is the user A registered in its own management table DT0, the image processing device 3MA refers to the authority information D3 linked to the ID of the user A. , controls the release of restrictions on functions. In addition, if the user who has been successfully authenticated is user B who is registered in the management table DT0 of the image processing device 3MB, the image processing device 3MA is linked to the ID of the user B from the image processing device 3MB. The authority information D3 is imported, and the release of restrictions on functions is controlled. This import may occur, for example, at any appropriate time before or after successful authentication. For example, in the first embodiment, it may be performed in ST45 or ST49 (ST14) in FIG. 7, and in the second embodiment, it may be performed in step ST75 or ST77 (ST14) in FIG.

Unlike the above, as illustrated in FIG. 1, the management table DT0 may hold information on authority levels linked to IDs. In this case, for example, the image processing device 3 has a table that links authority levels with information on restrictions for each function (see authority information D3). Then, the image processing device 3MA identifies the authority level of the user A who has been successfully authenticated by referring to its own management table DT0. Alternatively, the image processing device 3MA imports the authority level information of the user B who has been successfully authenticated from the image processing device 3MB. The timing of import is arbitrary, similar to the timing of importing authority information D3 above. Then, the image processing device 3MA refers to the authority information D3 linked to the specified authority level and controls the release of the restriction on the function. Note that this aspect can be regarded as an aspect in which the authority table DT3 is divided into a table that associates IDs and authority levels, and a table that associates authority levels and authority information D3.

The authority table DT3 may be stored in the server 5 in addition to or instead of the image processing device 3. Then, the image processing device 3MA may acquire the authority information D3 from the server 5 when the user who has been successfully authenticated is the user B (or regardless of whether it is the user A or the user B).

Further, in an embodiment in which the authority table DT3 is divided into a table that associates IDs and authority levels, and a table that associates authority levels and authority information D3, for example, in addition to the image processing device 3, or Alternatively, both tables may be stored on the server 5. The operation in this case is the same as above. Further, a table linking authority levels and authority information D3 may be stored in the image processing device 3. Then, if the user who has successfully been authenticated is user B (or in both cases of users A and B), the image processing device 3MA acquires the authority level from the server 5 and links the acquired authority level. With reference to the attached authority information D3, the release of restrictions on functions is controlled.

As understood from the above description, various tables may be divided or integrated as appropriate. In another aspect, the actual configuration of the table may differ from the conceptual configuration. Therefore, for example, a table that holds ID and function restriction information in association with each other may be one table that holds both information, or two tables that are divided based on authority level. There may be.

As described above, the functions for which restrictions are lifted may differ depending on the type of authentication information and/or authentication method. In this case, the content (or authority level) of the authority information D3 may differ depending on the type of authentication information and/or authentication method, for example. Moreover, since the image processing device 3MA can specify the type of authentication information and/or authentication method, unlike the above, the image processing device 3MA can specify the same authority information D3( or authority level), and in the image processing apparatus 3MA, restrictions may not be lifted for a specific function among the functions for which restrictions have been lifted according to the authority information D3. Alternatively, the image processing device 3MB and/or the server 5 may modify the authority information D3 according to the type of authentication information and/or authentication method.

For example, the processing procedure is as follows. When the image processing device 3 (control unit 29) is instructed to execute a predetermined function by operating the UI unit 23, etc., the image processing device 3 (control unit 29) determines whether the current user has the authority to execute the predetermined function. . In this determination, as described above, the image processing device 3 refers to the authority information that it owns or has previously acquired from the outside (another image processing device 3 or the server 5). When the image processing device 3 determines that the user has the authority, it executes the predetermined function, and otherwise does not execute the predetermined function. In the latter case, the display unit 35 may display that the user is not authorized (or that the user has not been authenticated).

In the operation described above, when the image processing device 3 becomes capable of executing a predetermined function according to the user's authority information due to the user's successful authentication, an example of the operation of canceling the restriction on the function is as follows. It can be considered that this has been done. Further, when the image processing device 3 becomes capable of executing a predetermined function according to the user's authority information, a predetermined flag is usually set internally in the image processing device 3. The setting of this flag may also be considered as an example of an operation in which a restriction on a function is lifted. Further, the operation of acquiring authority information from the outside (another image processing device 3 or server 5) may also be considered as an example of the operation of canceling the restriction on functions. Furthermore, the operation of determining whether the user has the authority for the specified function that has been instructed to execute and executing the above specified function if the user has the authority also lifts the restriction on the function. This can be taken as an example of an action to do.

(7.3. Menu screen related to functional restrictions)
When controlling the release of functional restrictions based on the authentication result, settings for the menu screen displayed on the display unit 35 may also be performed. This setting may be performed for each user. Specifically, it is as follows.

The menu screen is, for example, a screen (image) that includes one or more options on the GUI. When an option is selected by the pointing device, a process corresponding to the option is executed. For example, in an embodiment in which the operation unit 33 and the display unit 35 are configured by touch panels, when one or more options displayed on the display unit 35 is pressed with a finger or a touch pen, the corresponding process is executed. Ru.

The processes corresponding to the options shown on the menu screen of the image processing device 3 may be various processes. For example, the options may be processes that cause operations related to major functions such as printing, scanning, copying, FAX transmission, and FAX reception (although these are not necessarily separable concepts). And/or the option may be a process for making settings related to the above operation. Such settings include, for example, paper size selection, print magnification settings, and print darkness. In the previous explanation, it was stated that the main functions may be subdivided as appropriate and authorities may be set, but this explanation of subdivision may be used for subdivision of options as appropriate.

The menu screen for each user may, for example, reflect the preferences of each user and/or the authority of each user. The former includes, for example, adjusting the position, size, color, shape, etc. of a specific option within the screen 35a to suit the user's preference. Examples of the latter include, for example, a screen in which options for a given function are displayed in different ways depending on whether the user has authority for that function. More specifically, examples include a screen in which options have different colors depending on the presence or absence of authority, and a screen in which only options for which the user has authority are displayed (options for which he does not have authority are not displayed).

Note that in a mode where a menu screen is displayed in which only options for which the user has authority are displayed, the user can only instruct the process corresponding to the option for which he/she has authority. Therefore, controlling the display of the menu screen in this case may be regarded as an example of controlling the release of functional restrictions.

The menu screen settings for each user based on the authentication results may be set to only two types: a menu screen for users who have been successfully authenticated, and a menu screen for other users. Furthermore, for example, it may be possible to set different menu screens to different users who have successfully authenticated. The menu screen may not be displayed to users whose authentication is not successful. In an embodiment in which multiple types of authentication methods can be selected, the menu screens may or may not be different depending on the authentication method.

The image processing device 3 may be capable of displaying a main menu screen that is initially displayed and one or more submenu screens that are displayed by selecting an option on the main menu screen. In this case, the menu screen set for each user may be the main menu screen, at least one of one or more submenu screens, or both of the above two types. There may be. Further, depending on the menu screen settings for each user, whether or not a submenu screen can be displayed may be set, or the number of submenu screens that can be displayed among a plurality of submenu screens may be set.

The menu screen settings described above may be realized in various more specific ways. An example is shown below.

FIG. 12B is a schematic diagram showing the configuration of the menu table DT7 used for setting the menu screen.

The menu table DT7 stores an ID and menu information D7 that specifies the mode of the menu screen (in other words, the settings of the menu screen) in association with each other. In FIG. 12B, menu information D7 is expressed by a schematic diagram of the screen 35a of the display unit 35 (touch panel). For example, a plurality of buttons IGF are displayed on the screen 35a, and by selectively operating (for example, tapping) on the plurality of buttons IGF, processing related to the function corresponding to that button is performed. .

The image processing device 3 controls the menu screen displayed on the display unit 35 by referring to the menu information D7 associated with the user who has been successfully authenticated. Note that the description of the authority table DT3 (authority information D3) may be appropriately used in the menu table DT7 (menu information D7). For example, the menu table DT7 may be held by the image processing device 3 or by the server 5. Menu table DT7 may or may not be integrated with management table DT0 (and/or comparison table DT1).

(7.4. Lifting restrictions on VPN)
The function whose restrictions are lifted based on the authentication result may be a VPN connection. Specifically, it is as follows.

A VPN, for example, virtually extends a private network to the public network 11. From another perspective, a VPN logically divides a physically single network including the public network 11. Thereby, for example, communication via the public network 11 is performed in a secure environment.

Such virtual expansion or logical division is achieved, for example, by authentication, tunneling, and encryption. However, communication using a VPN may be performed through authentication and tunneling without being encrypted. Note that tunneling can also be considered a type of encryption.

In authentication, the validity of the connection being established is confirmed. Authentication methods include, for example, those that use account information (ID and password), those that use static keys, those that use a common key (shared key), those that use a combination of a private key and public key, and those that use electronic signatures. Examples include those that use electronic certificates, those that use security tokens, and those that combine two or more of the above (for example, multi-factor authentication).

In tunneling, an operation is performed to treat two points that are physically or logically separated via a network as if they were the same point. Tunneling is achieved, for example, by encapsulation. In encapsulation, for example, an entire packet is embedded in a payload of another protocol, a payload of another layer, or a payload of the same layer during communication. Tunneling may be performed at any appropriate layer, for example at layer 3 (network layer) or layer 2 (data link layer).

Encryption converts information sent and received into a format that cannot be read by third parties. Encryption may be performed only on the payload, or on both the header and the payload. In another aspect, encryption may be performed at any appropriate layer, eg, at the network layer, transport layer, and/or session layer. An appropriate encryption method may be used. For example, encryption methods include those that use a common key and those that use a combination of a private key and a public key.

The type of VPN may be selected as appropriate. For example, the VPN of the communication system 1 may be a remote access type VPN and/or a LAN type (intersite) VPN. In a remote access type VPN, for example, VPN client software is installed on a communication device such as the image processing device 3, and the communication device directly establishes a VPN connection to the server 5 as a VPN server. In a LAN type VPN, for example, a VPN gateway connects LANs (bases) to each other via VPN.

However, in the embodiment, the operation of the image processing device 3 that functions as a client of a remote access VPN will be taken as an example.

As mentioned above, the public network 11 may take various forms. From the viewpoint of VPN types, they are as follows. The VPN may be an Internet VPN in which the public network 11 includes the Internet. Further, the VPN may be an IP (Internet Protocol)-VPN, an entry VPN, or a wide area Ethernet, including a closed network provided by a communication carrier or the like to the public network 11.

The protocol for the VPN may be a known one, a new one, or one uniquely defined by the administrator of the server 5. Known protocols for remote access VPNs include, for example, a combination of L2TP (Layer 2 Tunneling Protocol) and IPsec (Security Architecture for Internet Protocol), and PPTP (Point to Point Tunneling Protocol).

FIG. 13 is a flowchart illustrating a specific example of the above operation.

In FIG. 13, as already mentioned, the image processing device 3 is a remote access VPN client that communicates with the server 5 as a VPN server (for example, the

image processing device

3A or 3B in FIG. 1). The data processing device 49 is a device that communicates with the image processing device 3 via a VPN (from another perspective, the server 5 as a VPN server). Examples of the data processing device 49 include another image processing device 3, the server 7, and the terminal 9. Although the data processing device 49 may be the server 5, FIG. 13 shows an example in which the two are separate. The data processing device 49 that is not the server 5 may be included in the private network 13A including the server 5 (3C, 7 or 9A) or may not be included (3A, 3B or 9B). good. In FIG. 13, the latter is taken as an example.

The process shown in FIG. 13 is started, for example, when the VPN connection start condition is satisfied in the image processing device 3. The start condition may be, for example, that a predetermined operation instructing a VPN connection is performed on the operation unit 33. Further, the start condition may be that a task that requires a VPN connection (for example, an operation of downloading and printing image data from the data processing device 49) is performed on the operation unit 33. When such a task is instructed, the start condition may be satisfied when the user is asked whether or not to make a VPN connection, and as a result, a predetermined operation instructing the VPN connection is performed. Further, the start condition may be that a predetermined signal is input from an external communication device (for example, the terminal 9).

When the VPN connection start conditions are met, the authentication process described in any of the first to third embodiments is executed. That is, the process in FIG. 4, the process in FIG. 9, or the process in FIG. 11 is executed. Although step ST5 for user A is illustrated in FIG. 13, the step shown as step ST5 may be step ST12 for user B. Alternatively, authentication by the server 5 of the third embodiment may be performed subsequently.

If the authentication is successful, the image processing device 3 requests the server 5 for authentication for VPN connection. In the illustrated example, the image processing device 3 transmits the account information of the user who has been successfully authenticated to the server 5 (step ST29). Then, the server 5 determines whether the received account information is registered in the table it holds (see verification table DT2 in FIG. 11). Authentication is thereby performed. Then, the server 5 transmits the authentication result (success or failure of authentication) to the image processing device 3 that is the source of the account information (step ST30).

In step ST29, similarly to the transmission of account information in FIG. 11, if an affirmative determination is made in step ST5, the image processing apparatus 3MA transmits the user A who has been successfully authenticated in the comparison table DT1 held by the image processing apparatus 3MA. The account information associated with the biometric information of is sent to the server 5. Further, if an affirmative determination is made in step ST12, the image processing device 3MA transmits the account information of user B input in step ST41 of FIG. 7 or FIG. 10 to the server 5. In the third embodiment, the authentication in steps ST29 and ST30 may be performed by the server 5 after the biometric authentication is successful and before the function restriction is lifted.

Note that in steps ST29 and ST30, similar to the authentication by the server 5 in FIG. 11, authentication may be performed based on authentication information other than account information, or authentication information imported from the image processing device 3MB may be used. may be used.

Unlike the above explanation, when the authentication described in the first to third embodiments is successful and the functional restrictions are lifted, and the VPN connection start condition is met, the process starts from step ST29. May be started. Alternatively, the VPN connection may be automatically established when the authentication described in the first to third embodiments is successful. In other words, successful authentication may be a condition for starting a VPN connection.

Alternatively, a VPN connection may be established between the image processing device 3 and the server 5 before the authentication described in the first to third embodiments is performed. From another perspective, instead of transmitting the authentication information input by individual users to the server 5 to perform authentication related to the VPN connection, the authentication information held by the image processing device 3 is transmitted to the server 5. Authentication related to the VPN connection may also be performed. Even in this case, by requiring the authentication described in the first to third embodiments to execute functions using a VPN connection, the probability that a third party will illegally use the VPN connection is reduced. be done.

If the authentication is successful and a VPN connection is established, the image processing device 3 performs communication using the VPN. FIG. 13 exemplifies the operation of downloading image data from the data processing device 49 and printing it. Specifically, it is as follows.

In step ST31, the image processing device 3 transmits a signal requesting download of image data to the server 5 via the VPN. Note that the image data here may be general image data or image data as a print job.

In step ST32, the server 5 transmits (transfers) a signal requesting image data to the destination (here, the data processing device 49) specified by the information included in the received signal. At this time, if the data processing device 49 is a communication device external to the private network 13A including the server 5, the transmission may be performed via a VPN (as shown in the example). In this case, the data processing device 49 is connected to the server 5 via VPN in advance before step ST32. When the data processing device 49 is a communication device included in the private network 13A, normal communication within the private network 13A may be performed.

In step ST33, the data processing device 49 transmits the requested image data to the server 5. At this time, similarly to step ST32, if the data processing device 49 is located outside the private network 13A, a VPN may be used (as shown in the example), and if the data processing device 49 is located inside the private network 13A, a VPN may be used. Communication may take place within the normal private network 13A.

In step ST34, the server 5 transmits (transfers) the received image data to the image processing device 3. Transmission at this time is performed via VPN.

In step ST35, the image processing device 3 executes printing based on the received image data.

The VPN server to which the image processing device 3 makes a VPN connection may or may not be selectable by the user using the image processing device 3. In the former case, the image processing device 3 may be able to select a connection destination only from two or more VPN servers that make up one VPN, or may be able to select a connection destination from two or more VPN servers that make up two or more different VPNs. It may also be possible to select a connection destination.

A VPN connection may be disconnected when appropriate disconnection conditions are met. For example, the cutting condition may be that a predetermined operation instructing cutting is performed on the operation unit 33. In an aspect where the VPN connection is made based on an instruction to execute a task that requires the VPN connection, the disconnection condition may be that the task is completed. Further, for example, the disconnection condition may be that the authentication state has been canceled. Note that examples of conditions for canceling the authentication state have already been described.

In the above description, the operation in which the image processing device 3 receives image data from the data processing device 49 and performs printing is taken as an example. However, various other operations using the VPN are possible. For example, information (eg, image data) acquired by the scanner 21 may be transmitted to the data processing device 49 via the VPN.

(8. Summary of embodiments)
As described above, the image processing device 3 according to the first embodiment (or the third embodiment) includes the image processing section 31, the input section (detection section 25), the memory (auxiliary storage device 45), and the control section 29. It has . The image processing section 31 includes at least one of a printer 19 and a scanner 21. The detection unit 25 receives input of the user's biometric information. The auxiliary storage device 45 stores first biometric information for each user. The control unit 29 performs functions related to the image processing unit 31 based on the result of authentication that compares the second biometric information input to the detection unit 25 and the first biometric information stored in the auxiliary storage device 45. (steps ST1 to ST7). The image processing device 3MA inputs the first biometric information of the user B imported from the other image processing device 3MB in response to the input of information identifying the first user (user B) (for example, the input of account information in step ST41). It is also possible to control the release of restrictions on functions related to the image processing unit 31 based on the result of authentication that compares with the second biometric information of user B (steps ST8 to ST14).

Therefore, for example, the effects described in the overview of the embodiment are achieved. For example, convenience for user B can be improved, storage capacity of image processing device 3MA can be saved, and/or load on network 10 can be reduced. Furthermore, since the image processing device 3 imports the first biometric information in response to the information identifying the user B (for example, ID) being input to the image processing device 3MA, the first biometric information necessary at that time (that is, the first biometric information of user B) can be requested to another image processing device 3 (for example, 3 MB). From another perspective, the image processing device 3 can delete the first biometric information of the user B after using the information. Therefore, compared to, for example, an image processing apparatus that periodically updates its own management table based on the management table DT0 of another image processing apparatus, storage capacity can be saved. Note that the information identifying the user B is not limited to the ID (or account information), and may be other authentication information (excluding the second biometric information), for example.

The image processing device 3 according to the first embodiment (or the third embodiment) may further include a UI section 23 into which account information is input. Account information may include an ID and password. When requesting the first biometric information of the first user (user B) from another image processing device 3MB, the image processing device 3MA transfers the account information of the user B input to the UI unit 23 to the image processing device 3MB. (step ST42 in FIG. 7).

In this case, for example, the image processing device 3MB can perform authentication based on the account information sent from the image processing device 3A, and export the first biometric information of the user B only when the authentication is successful. As a result, for example, the probability of unintended leakage of user B's first biometric information is reduced. Furthermore, since account information is used, the procedure for user B is simpler than in the case where other authentication information is used.

The image processing device 3MA according to the first embodiment (or the third embodiment) deletes the first user (user The first biometric information in B) may be deleted (step ST52 in FIG. 7).

In this case, for example, the imported biometric information is automatically deleted, reducing the possibility that the biometric information will be unintentionally leaked. Furthermore, by appropriately setting the predetermined time, it is possible to balance improved convenience by reusing imported biometric information and improved security by erasing imported biometric information.

The image processing device 3MA according to the first embodiment (or the third embodiment) is configured to satisfy erasure conditions including completion of execution of functions related to the image processing unit 31 whose restrictions have been lifted based on the authentication result. At this time, the first biometric information of the first user (user B) imported from another image processing device 3MB may be deleted (step ST52 in FIG. 7).

In this case, for example, the imported biometric information is deleted every time the execution of the function for which the restriction has been lifted is completed, which improves security.

The image processing device 3 according to the first embodiment (or the third embodiment) may further include a UI section 23 that receives user operations. The image processing device 3MA deletes the first biometric information of the first user (user B) imported from another image processing device 3MA when deletion conditions including a predetermined operation performed on the UI unit 23 are satisfied. may be deleted (step ST52 in FIG. 7).

In this case, for example, user B can delete the imported biometric information himself. As a result, for example, user B can avoid the possibility of unintended leakage of his or her biometric information, regardless of the presence or absence and/or setting of other conditions included in the deletion conditions (for example, deletion after a predetermined period of time has passed). can be reduced.

The image processing device 3MA according to the first embodiment (or the third embodiment) automatically deletes the first biometric information of the user B imported from another image processing device 3MB when a predetermined automatic deletion condition is met. (without accepting an operation for erasing the first biometric information) (step ST52 in FIG. 7). The image processing device 3MA compares the second biometric information of the user B with the first biometric information of the user B imported from the image processing device 3MB and succeeds in authentication (after the affirmative determination in step ST48). , and before the automatic deletion condition is satisfied (before the affirmative determination in step ST51), the second biometric information of user B that is re-entered into the input unit (detection unit 25) and the user imported from the image processing device 3MB. Re-authentication may be performed by comparing the first biometric information of B (step ST56 in FIG. 8).

In this case, for example, as described in the explanation of FIG. 8, the frequency with which user B's first biometric information is imported is reduced, and the burden on the network 10 is reduced. On the other hand, since the imported first biometric information is automatically deleted, the possibility of unintended leakage of the first biometric information is reduced.

The image processing device 3MA according to the first embodiment (or the third embodiment) retains the second biological information until a predetermined deletion condition is met, and retains the newly detected second biological information. Re-authentication may be performed to compare the biometric information with the second biometric information, and release of restrictions on functions may be controlled according to the result of the re-authentication (step ST56 in FIG. 8).

In this case, as described in the explanation of FIG. 8, the second biometric information corresponding to the user's current physical condition is used instead of the first biometric information, so re-authentication may fail depending on the user's physical condition etc. The probability is reduced. Furthermore, since the second biometric information will be erased eventually, the storage capacity of the image processing device 3MA is saved.

The image processing device 3 according to the second embodiment (or third embodiment) includes an image processing section 31, an input section (detection section 25), a memory (auxiliary storage device 45), and a control section 29. are doing. The image processing section 31 includes at least one of a printer 19 and a scanner 21. The detection unit 25 receives input of the user's biometric information. The auxiliary storage device 45 stores first biometric information for each user. The control unit 29 performs functions related to the image processing unit 31 based on the result of authentication that compares the second biometric information input to the detection unit 25 and the first biometric information stored in the auxiliary storage device 45. (steps ST1 to ST7). The image processing device 3MA exports the second biometric information of the first user (user B) to another image processing device 3MB (step ST63 in FIG. 9), and displays the image based on the authentication result received from the image processing device 3MB. It is also possible to control the release of restrictions on functions related to the processing unit 31 (step ST13).

Therefore, the effects described in the overview of the embodiment are also achieved in the second embodiment. For example, convenience for user B can be improved, storage capacity of image processing device 3MA can be saved, and/or load on network 10 can be reduced.

The image processing device 3 according to the second embodiment may further include a UI section 23 into which account information is input. Account information may include an ID and password. The image processing device 3MA may transmit the account information of the first user (user B) input to the UI unit 23 to the other image processing device 3MB (step ST42 in FIG. 10), and the If successful authentication based on account information is notified (if an affirmative determination is made in step ST72), the second biometric information of user B may be exported to the image processing device 3MB (step ST73).

In this case, for example, the probability that the image processing device 3MA exports the second biometric information of the user B to the wrong destination is reduced. That is, the probability that the second biological information will be unintentionally leaked is reduced. Furthermore, since account information is used, the procedure for user B is simpler than in the case where other authentication information is used.

The image processing device 3MA according to the second embodiment may retain the second biometric information of the first user (user B) until a predetermined deletion condition (step ST79 in FIG. When a predetermined re-authentication condition is satisfied before the re-authentication is performed, the second biometric information of the user B may be exported again to the image processing device 3MB (step ST56 in FIG. 8).

In this case, for example, as described in Section 5.3.2, when re-authentication by the image processing device 3MB is required, the need to request user B to re-enter biometric information is reduced, and the user The convenience of B is improved. Note that, from a security perspective, unlike the above explanation, user B may be requested to re-enter biometric information each time re-authentication is required.

The image processing device 3 according to the first to third embodiments may be capable of registering a plurality of types of first biometric information for each user in the memory (auxiliary storage device 45).

In this case, as described in Section 3.1, for example, when authentication using biometric information fails, authentication can be performed using other biometric information, improving convenience. And/or security can be increased by requesting two or more types of biometric information depending on the user or function.

The image processing device 3MA according to the first to third embodiments may further include a UI unit 23 that receives an input of information specifying information on another image processing device 3MB (import source or export destination) by the user. (See Figure 5C).

In this case, the image processing device 3MA does not need to inquire of the plurality of other image processing devices 3 whether they hold the first biometric information of the user B or not. As a result, for example, the burden on the communication system 1 is reduced. Particularly when the communication system 1 includes a large number of image processing devices 3, the burden on the image processing devices 3 and the burden on the network 10 is reduced.

The image processing device 3MA according to the first to third embodiments may further include a display unit 35 that displays a plurality of candidates for other image processing devices 3MB (import source or export destination) (see FIG. 5C). .

In this case, for example, user B only has to select the image processing device 3MB from a plurality of candidates, so the burden on user B is reduced. Further, as shown in FIG. 5C, in an embodiment in which the image processing device 3MB can be selected by operating a plurality of candidates or a button (software key or hardware key) associated with the plurality of candidates, the address of the image processing device 3MB is The burden on the user is further reduced compared to the mode of inputting the information.

In the third embodiment (FIG. 11), the memory (auxiliary storage device 45) may store first biometric information and authentication information (for example, account information) in association with each other for each user. The image processing device 3MA may transmit information based on authentication information stored in association with the first biometric information that matches the second biometric information to the external authentication device (server 5), and The authentication result based on the image processing unit 31 may be received from the server 5, and the release of restrictions on functions related to the image processing unit 31 may be controlled based on the received authentication result.

Note that the above is the operation when the user is user A. As mentioned above, when the user is User B, the authentication information input by User B or the authentication information imported from the image processing device 3MB is used instead of the authentication information stored in the image processing device 3MA. The information may be used to perform operations similar to those described above.

When the above operation is performed, for example, as described in the explanation of the third embodiment, the restriction on the function is lifted by two-step authentication of biometric authentication (local authentication) and authentication at the server 5. security is improved. In addition, from another point of view, when user A uses image processing device 3MA, user A can cancel functional restrictions without inputting account information, which improves convenience.

In the first to third embodiments, the memory (auxiliary storage device 45) may store first biometric information and authentication information (for example, account information) in association with each other for each user. When performing authentication for VPN connection with an external authentication device (server 5), the image processing device 3MA uses authentication information stored in association with the first biometric information that matches the second biometric information. The information based on the information may be transmitted to the server 5 (step ST29 in FIG. 13).

In this case, for example, the VPN connection will undergo two-step authentication, similar to the third embodiment. As a result, security is improved. In addition, from another point of view, when user A uses the image processing device 3MA, user A can make a VPN connection without inputting account information, which improves convenience.

The communication system 1 according to the first to third embodiments includes an image processing device 3MA as described above and another image processing device 3MB.

As a result, the various effects described above are achieved.

The communication system 1 according to the first embodiment (or the third embodiment) may include the image processing device 3MA of the first embodiment (or the third embodiment) and another image processing device 3MB. The image processing device 3MA may further include a UI unit 23 into which account information is input, and may transmit the account information of the first user (user B) input to the UI unit 23 to the image processing device 3MB. (Step ST42 in FIG. 7). Account information may include an ID and password. The image processing device 3MB may store the first biometric information in association with account information for each user, and the first biometric information stored in association with the account information that matches the account information received from the image processing device 3MA. The biometric information may be exported to the image processing device 3MA (step ST45 in FIG. 7). The image processing device 3MA may perform authentication by comparing the first biometric information of the user B exported from the image processing device 3MB and the second biometric information of the user B (step ST48).

In this case, the image processing device 3MB performs authentication based on the account information sent from the image processing device 3A, and exports the first biometric information of the user B only when the authentication is successful. As a result, for example, the probability of unintended leakage of user B's first biometric information is reduced. Furthermore, since account information is used, the procedure for user B is simpler than in the case where other authentication information is used.

The communication system 1 according to the second embodiment (or the third embodiment) includes an image processing device 3MA according to the second embodiment (or the third embodiment) and another image processing device 3MB. good. The image processing device 3MA may further include a UI unit 23 into which account information is input, and may transmit the account information of the first user (user B) input to the UI unit 23 to the image processing device 3MB. (Step ST42 in FIG. 10). Account information may include an ID and password. The image processing device 3MB may store the first biometric information and account information for each user in association with each other, and if account information that matches the account information received from the image processing device 3MA is stored, the image processing device 3MB performs authentication. The success may be notified to the image processing device 3MA (step ST71 in FIG. 10). When the image processing device 3MA is notified of successful authentication, the image processing device 3MA may export the second biometric information of the user B to the image processing device 3MB (step ST73). The image processing device 3MB may perform authentication by comparing the second biometric information of the user B exported from the image processing device 3MA with the first biometric information of the user B (step ST74). The result may be transmitted to the image processing device 3MA (step ST75).

In the second embodiment (or third embodiment), the other image processing device 3MB deletes the second living body exported from the image processing device 3MA when deletion conditions including that a predetermined time has elapsed are met. The information may be deleted (step ST82 in FIG. 10).

In this case, for example, the probability of unintended leakage of the exported second biological information is reduced. Furthermore, by appropriately setting the above predetermined time, it is possible to balance improved convenience by reusing the second biometric information and improved security by erasing the second biometric information.

In the second embodiment (or third embodiment), the other image processing device 3MB erases the second biometric information of the first user (user B), which includes receiving a request to erase the second biometric information of the first user (user B) from the image processing device 3MA. When the conditions are met, the image processing device 3MA may delete the exported second biometric information (step ST82 in FIG. 10).

In this case, for example, the probability of unintended leakage of the exported second biological information is reduced. Further, the second biometric information held by the image processing device 3MB is deleted depending on the status of the image processing device 3MA. As a result, for example, the user B can control the deletion of the second biometric information held by the image processing device 3MB, even though the user B is far from the image processing device 3MB. This can improve convenience and/or security, for example.

In the second embodiment (or third embodiment), the other image processing device 3MB may hold the second biometric information of the first user (user B) until a predetermined deletion condition is met; When the second biometric information of user B is exported again from the image processing device 3MA before the second biometric information of user B is satisfied, the second biometric information of user B that has been exported again and the second biometric information of user B held The authentication may be performed by comparing the biometric information with the biometric information, and the result of the authentication may be transmitted to the image processing device 3MA (see step ST56 in FIG. 5).

In this case, for example, as described in Section 5.3.2, the exported second biometric information can be used in place of the registered first biometric information to perform re-authentication. This reduces the probability that re-authentication will fail due to the user's physical condition or the like.

Note that in the above embodiment, the image processing device 3MA is an example of an image processing device, and the image processing device 3MB is an example of another image processing device. The detection unit 25 is an example of an input unit. The auxiliary storage device 45 is an example of memory. The server 5 is an example of an external authentication device. Account information is an example of authentication information.

The technology according to the present disclosure is not limited to the above embodiments, and may be implemented in various ways.

For example, the image processing device is not a multifunction device including a printer and a scanner, but may be one that has only a printing function (i.e., a printer in the narrow sense) or one that has only a scanner function (i.e., a scanner in the narrow sense). Note that the multifunction peripheral may be regarded as a printer (in a broad sense) or a scanner (in a broad sense).

From the present disclosure, it is possible to extract a concept that does not require importing the first biometric information (first embodiment) or exporting the second biometric information (second embodiment). For example, a configuration in which multiple types of biometric authentication can be registered may be extracted separately from import and export of biometric information.

1... Communication system, 3, 3A, 3B, 3C, 3MA and 3MB... Image processing device, 5... Server (external authentication device), 19... Printer, 21... Scanner, 23... UI section (input section), 25... Detection section (input section), 27... communication section, 29... control section, 31... image processing section, 33... operating section (input section), 37... connector (input section), 45... auxiliary storage device (memory).

Claims

an image processing unit including at least one of a printer and a scanner;
an input section into which the user's biometric information is input;
a memory that stores first biometric information for each user;
Controlling the release of restrictions on functions related to the image processing unit based on the result of authentication that compares the second biometric information input to the input unit and the first biometric information stored in the memory. , and authentication that compares first biometric information of the first user imported from another image processing device in response to input of information identifying the first user and second biometric information of the first user. a control unit that controls removal of restrictions on functions related to the image processing unit based on the results;
An image processing device comprising:
It further has a UI section where account information is input,
Account information includes ID and password,
When requesting the first user's first biometric information from the other image processing device, the first user's account information input to the UI unit is transmitted to the other image processing device. The image processing device described in .
The image processing device according to claim 1 or 2, wherein the first biometric information of the first user imported from the other image processing device is deleted when a deletion condition including that a predetermined time has elapsed is satisfied. .
When deletion conditions including completion of the execution of the function related to the image processing unit whose restriction has been lifted based on the authentication result, the first user's first image data imported from the other image processing device is The image processing device according to any one of claims 1 to 3, wherein the biological information of the first image is deleted.
It further has a UI section that accepts user operations,
Any one of claims 1 to 4, wherein the first biometric information of the first user imported from the other image processing device is deleted when a deletion condition including that a predetermined operation is performed on the UI section is satisfied. The image processing device according to item 1.
automatically deleting the first biometric information of the first user imported from the other image processing device when a predetermined automatic deletion condition is met;
After the authentication is successful by comparing the second biometric information of the first user and the first biometric information of the first user imported from the other image processing device, and the automatic deletion condition is satisfied. re-authentication is performed by comparing the second biometric information of the first user re-entered into the input unit with the first biometric information of the first user imported from the other image processing device. The image processing device according to any one of claims 1 to 5, wherein the image processing device is capable of performing the following steps.
The second biometric information is retained until a predetermined deletion condition is met, and re-authentication is performed by comparing the newly detected second biometric information with the retained second biometric information. The image processing device according to any one of claims 1 to 6, wherein release of restrictions on functions is controlled according to a result.
an image processing unit including at least one of a printer and a scanner;
an input section into which the user's biometric information is input;
a memory that stores first biometric information for each user;
Controlling the release of restrictions on functions related to the image processing unit based on the result of authentication that compares the second biometric information input to the input unit and the first biometric information stored in the memory; and a function related to the image processing unit based on the result of authentication based on the second biometric information of the first user exported and received from another image processing device. a control unit that controls restriction release;
An image processing device comprising:
It further has a UI section where account information is input,
Account information includes ID and password,
When the account information of the first user inputted in the UI section is transmitted to the other image processing apparatus, and the other image processing apparatus notifies successful authentication based on the account information of the first user; The image processing device according to claim 8, wherein the second biometric information of the first user is exported to the other image processing device.
The second biometric information of the first user is retained until a predetermined deletion condition is met, and when a predetermined re-authentication condition is met before the deletion condition is met, the first user retains the second biometric information. The image processing device according to claim 8 or 9, wherein the second biometric information of the second biological information is exported again to the other image processing device.
The image processing device according to any one of claims 1 to 10, wherein a plurality of types of first biometric information can be registered in the memory for each user.
The image processing apparatus according to any one of claims 1 to 11, further comprising a UI unit that receives input of information specifying the other image processing apparatus by a user.
The image processing device according to any one of claims 1 to 12, further comprising a display unit that displays a plurality of candidates for the other image processing device.
The memory stores first biometric information and authentication information in association with each other for each user,
transmitting information based on authentication information stored in association with first biometric information that matches second biometric information to an external authentication device; receiving an authentication result based on the transmitted information from the external authentication device; The image processing apparatus according to any one of claims 1 to 13, wherein the image processing apparatus controls release of restrictions on functions related to the image processing unit based on the received authentication result.
The memory stores first biometric information and authentication information in association with each other for each user,
When performing authentication for VPN connection with an external authentication device, transmit information based on authentication information stored in association with first biometric information that matches the second biometric information to the external authentication device Request. The image processing device according to any one of items 1 to 14.
An image processing device according to any one of claims 1 to 15,
The other image processing device;
A communication system that has
An image processing device according to any one of claims 1 to 7,
The other image processing device;
It has
The image processing device includes:
It further has a UI section where account information is input,
transmitting the account information of the first user input into the UI section to the other image processing device;
Account information includes ID and password,
The other image processing device is
First biometric information and account information are stored in association with each user,
exporting first biometric information stored in association with account information that matches account information received from the image processing device to the image processing device;
The image processing device performs authentication by comparing the first biometric information of the first user exported from the other image processing device and the second biometric information of the first user.
The image processing device according to any one of claims 7 to 9,
The other image processing device;
It has
The image processing device includes:
It further has a UI section where account information is input,
transmitting the account information of the first user input into the UI section to the other image processing device;
Account information includes ID and password,
The other image processing device is
First biometric information and account information are stored in association with each user,
Notifying the image processing device of successful authentication if account information matching the account information received from the image processing device is stored;
The image processing device exports the second biometric information of the first user to the other image processing device when notified of the success of the authentication,
The other image processing device performs authentication by comparing the second biometric information of the first user exported from the image processing device and the first biometric information of the first user, and performs the authentication. A communication system that transmits results to the image processing device.
The image processing device according to any one of claims 7 to 9,
The other image processing device;
It has
The other image processing device retains the second biometric information of the first user until a predetermined deletion condition is met, and before the deletion condition is met, the other image processing device stores the second biometric information of the first user from the image processing device. When the second biometric information of the second user is exported again, the second biometric information of the first user that has been exported again is compared with the second biometric information of the first user held for authentication. , a communication system that transmits the authentication result to the image processing device.