JP2007048079A - Service providing apparatus, service providing method, and service providing program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a service providing apparatus, a service providing method, and a service providing program capable of flexibly setting authentication means according to a user's request.
A service providing apparatus (1) having one or more functions for providing a service to a user and providing a service using the function, including one or more security information (5) related to security, One or more authentication means 4 that can be added and authenticates the user, the service that can be used, the authentication means 4 that is used for the authentication, and the information associated with the policy are acquired for each user, and the user The above problem is solved by providing service providing means 2 that provides a function associated with the user when the authentication result using the authenticating means 4 associated with the user is normally terminated.
[Selection] Figure 1

Description

  The present invention relates to a service providing apparatus, a service providing method, and a service providing program, and more particularly to a service providing apparatus, a service providing method, and a service providing program for providing a service to a user.

  2. Description of the Related Art In recent years, an image processing apparatus (hereinafter referred to as a multi-function machine) has become known as an example of an information processing apparatus in which functions of apparatuses such as a printer, a copy, a facsimile, and a scanner are housed in a single casing. This multifunction device is provided with a display unit, a printing unit, an imaging unit, and the like in one casing, and four types of software corresponding to a printer, a copy, a facsimile, and a scanner, respectively. Operates as a copy, facsimile and scanner. Patent Document 1 describes an example of a multifunction machine as described above.

In such a multi-function device, when operating as a printer, copy, facsimile or scanner, the user is authorized to use the printer, copy, facsimile or scanner using an authentication means. . Patent Document 2 describes an example of an image processing system that can be used by a user when a card is set in a card reader.
JP 2002-84383 A JP 2002-288737 A

  Conventional multifunction devices have to set authentication means that may be used in advance for each multifunction device. However, since the security level required by the user or administrator for the multifunction device varies, there are also various combinations of authentication means mounted on the multifunction device. Also, the security level of the authentication means is often higher as a new method or a new version.

  However, the conventional multifunction peripheral needs to modify the program in order to add, change, or delete the authentication means, and cannot easily add, change, or delete the authentication means. For this reason, the conventional multifunction peripheral has a problem that the authentication means according to the user's request cannot be set flexibly.

  The present invention has been made in view of the above points, and an object thereof is to provide a service providing apparatus, a service providing method, and a service providing program capable of flexibly setting authentication means according to a user's request.

  Therefore, in order to solve the above-described problems, the present invention is a service providing apparatus that has one or more functions for providing a service to a user and provides a service using the functions. One or more security information that can be added and one or more authentication means for authenticating the user, information that can be used for each user, the service that can be used, the authentication means used for authentication, and the policy And a service providing unit that provides the function with the available service associated with the user when the authentication result using the authentication unit associated with the user is normally completed. It is characterized by that.

  Further, the present invention is a service providing method of a service providing apparatus that has one or more functions for providing a service to a user and provides a service using the functions, and the service providing apparatus includes: One or more security information relating to security and one or more authentication means that can be added and authenticate the user are provided, and available services, authentication means and policies used for authentication are provided for each user. Acquiring associated information and, when an authentication result using the authentication means associated with the user is successfully completed, causing the function to provide the available service associated with the user. And a step.

  The present invention also includes a service providing apparatus that has one or more functions for providing a service to a user and that provides the service using the function, and stores one or more security information related to security. One or more authentication means that can be added and that authenticates the user, available service, authentication means used for authentication, and information associated with the policy are acquired and used for each user Service providing program for causing the function to provide the available service associated with the user when the authentication result using the authentication unit associated with the user is normally terminated It is characterized by being.

  In the present invention, authentication means can be added. In the present invention, by acquiring information in which services, authentication means, and policies are associated with each user, and using the authentication means associated with the user, different authentication means can be flexibly set for each user. . In the present invention, when the result of authentication performed by different authentication means for each user is normally completed, the service associated with the user can be provided to the function.

  According to the present invention, it is possible to provide a service providing apparatus, a service providing method, and a service providing program capable of flexibly setting authentication means according to a user's request.

  Next, the best mode for carrying out the present invention will be described based on the following embodiments with reference to the drawings. In the present embodiment, a multifunction peripheral as an example of a service providing apparatus will be described as an example. However, any service providing apparatus that provides a service to a user may be used.

  FIG. 1 is a schematic diagram for explaining the principle of the present invention. A multi-function peripheral (MFP) 1 includes a framework 2 as a fixed unit and a variable unit 3. The changing unit 3 includes an authentication changing unit 4 made up of one or more authentication means 4 and a policy changing unit 5 made up of one or more security policies. 1 includes password authentication, IC card authentication, and fingerprint authentication as authentication means. The policy changing unit 5 in FIG. 1 includes security policies ISMS HIGH, ISMS LOW, and DEFAULT. Here, the security policy is information related to security and defines security measures.

  The framework 2 performs service use authority check, authentication, search of authority server and authentication server, and the like. For example, the framework 2 searches for the authority server, acquires the authority list 6 stored in the authority server, and performs a service use authority check. The authority list 6 is information in which a user ID is associated with a user available service identified by the user ID. Further, the framework 2 searches the authentication server, acquires the authentication list 7 stored in the authentication server, and performs authentication. The authentication list 7 is information in which a user ID, authentication means used for authenticating a user identified by the user ID, and registration data such as a password are associated with each other.

  An authentication means is added to the authentication changing section 4 of the changing section 3 by downloading from an external device capable of data communication or installing from a recording medium capable of reading data. The authentication means in the present embodiment is an authentication application that performs processing for authentication. The policy changing unit 5 of the changing unit 3 is represented by a policy list 8 of the framework 2. The policy list 8 is information that associates a policy with the setting contents of the policy.

  The multifunction device 1 is developed and provided with the authentication variation unit 4 and the policy variation unit 5 according to the user as the variation unit 3. That is, the multifunction device 1 can develop and provide the variable unit 3 to flexibly perform settings such as addition, change, and deletion of authentication means and security policy according to the user's request.

  FIG. 2 shows a configuration diagram of an embodiment of a multifunction machine according to the present invention. 2 is configured to have a hardware resource 10 and a software group 11. The hardware resource 10 includes a plotter 21, a scanner 22, and other hardware resources such as an IC card reader 23 and an SD card reader 24. The software group 11 includes an application and a platform that are executed on an operating system (hereinafter referred to as an OS) 25 such as UNIX (registered trademark).

  The applications include a copy application 27, a fax application 28, a scanner application 29, and a WSSC (Web service server component) 30. The platform has a control service 26.

  The control service 26 includes SCS (system control service), ECS (engine control service), MCS (memory control service), OCS (operation panel control service), FCS (fax control service), NCS (network control service), etc. It is configured to have one or more service modules. The platform is configured to have an API (Application Program Interface).

The WSSC 30 is configured to include the framework 2 shown in FIG. 1 and a variable unit including an authentication variable unit 4 and a policy variable unit 5. The framework 2 in FIG. 2 has a WSSC manager 31 and is connected to the control service 26 using the WSSC manager 31 as a common interface. The framework 2 is for adding an authentication unit and a security policy to the multifunction device 1, or changing or deleting the authentication unit and the security policy from the multifunction device 1. The authentication unit is connected to the control service 26 via the WSSC manager 31 of the framework 2. Details of the control service 26 and the like of the multifunction machine 1 shown in FIG. 2 are described in, for example, Japanese Patent Application Laid-Open No. 2002-84383. Hereinafter, a service providing method realized by the multifunction machine 1 will be described with reference to the drawings.
(Security policy setting)
A user or a third vendor of the multifunction device 1 sets a plurality of desired security policies in advance. The security policy is set on a PC or the like capable of executing MFP application creation software. The MFP application referred to here includes an authentication unit and a security policy.

  FIG. 3 is an image diagram showing security policy setting processing. The security policy is set by the GUI 35 displayed on the display device of the PC. The GUI 35 can change the setting contents for each policy. When the user addition button 36 on the GUI 35 is pressed, a user list 37 is displayed. A user, a third vendor, or the like can select a policy application target user from the user list 37.

When the OK button or the apply button of the GUI 35 is pressed, for example, the MFP application creation software automatically generates or hard-codes the security policy 38 from the setting contents of the GUI 35. In FIG. 3, the security policy ISMS LOW is set. FIG. 4 is a conceptual diagram showing another example of security policy setting processing. FIG. 4 shows an image when the security policy ISMS MID is set.
(MFP application creation and installation)
FIG. 5 is an image diagram showing creation and installation of the MFP application. The MFP application is created by the PC 51 that can execute the MFP application creation software. The PC 51 records the created one or more MFP applications on an SD card 52 as an example of media. The SD card 52 is an example of a recording medium that can record and read data.

  The SD card 52 in which the MFP application is recorded is inserted into an SD card slot of the MFP 53, for example. The MFP 53 can read the MFP application from the SD card 52 inserted into the SD card slot. The MFP 53 can add an authentication unit and a security policy by installing the MFP application recorded on the SD card 52.

  Further, the PC 51 may record the created one or more MFP applications in the MFP application distribution server 54. The MFP application distribution server 54 is an example of an external device capable of data communication. The MFP 56 can add an authentication unit and a security policy by applying to the MFP application distribution server 54 to install the MFP application and downloading the MFP application from the MFP application distribution server 54.

  FIG. 6 is a sequence diagram illustrating an example of a process for installing an authentication unit (authentication application) recorded on a medium. In step S1, a user who is a user inserts media into a predetermined slot. In step S2, the WSSC manager of the MFP checks a file (authentication means) in the medium.

  In step S3, the WSSC manager detects a file (authentication means) in the medium. In step S4, the OCS included in the control service displays the file (authentication means) in the medium detected in step S3 on the screen of the operation panel.

  In step S5, the user selects a file (authentication means) desired to be installed from the files (authentication means) displayed on the screen of the operation panel. In step S6, the OCS determines the file (authentication unit) selected on the operation panel screen. In step S7, the WSSC manager is notified from the OCS of the file (authentication means) selected on the operation panel screen.

  In step S8, the WSSC manager downloads the file (authentication means) selected on the screen of the operation panel from the medium. In step S 9, the WSSC manager installs the downloaded file (authentication unit) in the authentication variation unit 4. The WSSC manager ends the processing after displaying the installation completion on the operation panel screen.

  FIG. 7 is a transition diagram of screens displayed on the operation panel when the authentication means is installed by designating a medium or PC. First, the user inputs a user ID on the screen 71 and presses an OK button. Subsequently, the user inputs a password on the screen 72 and presses an OK button.

  When the authentication using the user ID and password input on the screen 71 and the screen 72 is normally completed, a screen 73 is displayed on the operation panel. When the user selects the maintenance mode on the screen 73, the screen 74 is displayed on the operation panel. On the screen 74, a new authentication addition setting for newly adding an authentication means can be selected.

  When the new authentication addition setting is selected on the screen 74, a screen 75 is displayed on the operation panel. On the screen 75, it is possible to select a medium or PC from which the authentication means is downloaded. Screen 75 represents an example in which an SD card is selected. When the SD card is selected, a screen 76 is displayed on the operation panel.

  On the screen 76, one or more authentication means recorded on the SD card are displayed. On the screen 76, the authentication means to be installed can be selected. When an authentication unit is selected on the screen 76 and the install button is pressed, the authentication unit is installed in the authentication variation unit 4 as described above. When the installation of the authentication means is completed, a screen 77 that is an installation completion display is displayed on the operation panel.

  FIG. 8 is a schematic diagram showing changes in the header file of the security policy before and after adding the security policy. The header file 81 of the security policy before adding the security policy includes a structure of the security policies ISMS HIGH, ISMS LOW, and DEFAULT.

  Thereafter, when the security policy ISMS MID is added to the MFP, the security policy ISMS MID structure is added to the header file 82 of the security policy.

  FIG. 9 is a transition diagram showing changes in the screen displayed on the operation panel before and after adding the security policy. The screen 91 is a screen image before the security policy ISMS MID is added to the multi-function peripheral, and is displayed on the operation panel based on the header file 81 of the security policy.

  The screen 92 is a screen image after the security policy ISMS MID is added to the multi-function peripheral, and is displayed on the operation panel based on the header file 82 of the security policy.

  The security policy installed in the multifunction device 1 can be selected from the operation panel as shown on the screen 91 or 92. When the multifunction device 1 is activated, the multifunction device 1 generates a policy class corresponding to the security policy selected by the user, and authentication is performed using the security policy desired by the user.

  FIG. 10 is a class diagram illustrating an example of a WSSC of a multifunction machine. WSSC is represented by the class of the internal structure shown in FIG. 10 and the relationship between the classes. WSSC includes service class 101, service user list class 102, usage right class 103, user class 104, collation data class 105, policy list class 106, policy class 107, authentication means class 108, usage policy class 109, usage. It consists of an authentication means class 110, a registration data class 111, and a registration location class 112.

  The service class 101, the service user list class 102, the usage right class 103, the user class 104, the verification data class 105, the policy list class 106, the registration data class 111, and the registration location class 112 constitute the framework 2. To do. The policy class 107, the authentication means class 108, the usage policy class 109, and the usage authentication means class 110 constitute the changing unit 3.

  The external authority server stores the authority list 6. The service user list class 102 uses the authority list 6 of the authority server to perform service use authority examination. An external authentication server stores an authentication list 7. The registration location class 112 performs authentication means search using the authentication list 7 of the authentication server. The collation data class 105 represents input data such as a password input by the user. The registration data class 111 represents registration data such as a password read from the authentication list 7.

  Hereinafter, each class in FIG. 10 will be described separately for password authentication and IC card authentication. First, password authentication will be described.

  FIG. 11 is a sequence diagram illustrating an example of the procedure of the authentication unit and the security policy search process. In step S21, a login screen is displayed on the display device of the operation panel. In step S <b> 22, the user inputs a user ID (hereinafter simply referred to as “ID”) to the login screen, and makes an authentication means search request to the user class 104.

  In step S23, the user class 104 requests the registration place class 112 to search for an authentication means. The registration location class 112 performs an authentication means search using the authentication list 7 of the authentication server, and searches for an authentication means associated with the ID. In step S24, the registration place class 112 generates the authentication means class 108 of the searched authentication means. In step S25, the registration location class 112 searches the authentication list 7 for registration data associated with the ID, and generates a registration data class 111 of the searched registration data. In step S26, the registration place class 112 notifies the user class 104 of the authentication means associated with the ID.

  In step S27, the user class 104 makes a policy search request to the policy list class 106. In step S28, the policy list class 106 requests the policy class 107 to search for a policy. The policy class 107 refers to the usage policy class 109 and searches for a security policy associated with the ID. In step S29, the policy list class 106 notifies the user class 104 of the security policy associated with the ID.

  FIG. 12 is a sequence diagram illustrating an example of authentication and service use authority check processing procedures. In step S31, a password input screen is displayed on the display device of the operation panel. In step S32, the user makes an authentication request to the user class 104 by inputting the password on the password input screen.

  In step S33, the user class 104 requests the authentication means class 108 to input collation data. In step S34, the authentication means class 108 generates a collation data class 105 according to the password input by the user. In step S35, the authentication unit class 108 requests the policy class 107 to refer to the security policy and refers to the security policy.

  In step S36, the authentication means class 108 uses the verification data class 105 and the registration data class 111 to check whether the verification data matches the registration data. In step S37, the authentication means class 108 notifies the user class 104 of the authentication result.

  In step S38, the user class 104 requests the usage right class 103 for an authority check. In step S39, the usage right class 103 makes a service usage authority examination request to the service user list class 102. The service user list class 102 performs a use authority check using the authority list 6 of the authority server, and searches for an available service associated with the ID. In step S40, the service user list class 102 generates the service class 101 of the searched available service.

  In step S 41, the service user list class 102 issues a usage right issuance request to the usage right class 103 in accordance with the generated service class 101. In step S42, the usage right class 103 notifies the user class 104 of the usage right acquisition result for notifying the service that issued the usage right. In step S43, the user class 104 displays an authentication result screen on the display device of the operation panel.

  FIG. 13 is a transition diagram of a partial screen displayed on the operation panel during password authentication. A screen 1301 is an example of a login screen. A screen 1302 is an example of a password input screen. A screen 1303 is an example of an authentication result screen when authentication ends abnormally. A screen 1304 is an example of an authentication result screen when authentication is normally completed. Available services are displayed on the authentication result screen when authentication is normally completed.

  Next, the time of IC card authentication will be described. FIG. 14 is a sequence diagram illustrating an example of the procedure of the authentication unit and the security policy search process. In step S51, a login screen is displayed on the display device of the operation panel. In step S52, the user passes the IC card through the IC card reader. Here, passing the IC card through the IC card reader is an example of an action for enabling data to be read from the IC card, and may be another action. In step S53, the IC card reader reads the ID from the IC card and makes an authentication means search request to the user class 104.

  In step S54, the user class 104 requests the registration place class 112 to search for an authentication means. The registration location class 112 performs an authentication means search using the authentication list 7 of the authentication server, and searches for an authentication means associated with the ID. In step S55, the registration place class 112 generates the authentication means class 108 of the searched authentication means. In step S56, the registration location class 112 searches the authentication list 7 for registration data associated with the ID, and generates a registration data class 111 of the searched registration data. In step S57, the registration location class 112 notifies the user class 104 of the authentication means associated with the ID.

  In step S58, the user class 104 sends a policy search request to the policy list class 106. In step S59, the policy list class 106 requests the policy class 107 to search for a policy. The policy class 107 refers to the usage policy class 109 and searches for a security policy associated with the ID. In step S60, the policy list class 106 notifies the user class 104 of the security policy associated with the ID.

  FIG. 15 is a sequence diagram illustrating an example of authentication and service use authority check processing procedures. In step S61, a password input screen including a message to pass the IC card through the IC card reader is displayed on the display device of the operation panel. In step S62, the user makes an authentication request to the user class 104 by passing the IC card through the IC card reader.

  In step S62, the user class 104 requests the authentication means class 108 to input collation data. In step S63, the authentication means class 108 generates a verification data class 105 according to the password read from the IC card. In step S64, the authentication unit class 108 requests the policy class 107 to refer to the security policy and refers to the security policy.

  In step S65, the authentication means class 108 uses the verification data class 105 and the registration data class 111 to check whether the verification data matches the registration data. In step S66, the authentication means class 108 notifies the user class 104 of the authentication result.

  In step S 67, the user class 104 requests the usage right class 103 for an authority check. In step S68, the usage right class 103 makes a service usage authority examination request to the service user list class 102. The service user list class 102 performs a use authority check using the authority list 6 of the authority server, and searches for an available service associated with the ID. In step S69, the service user list class 102 generates the service class 101 of the searched available service.

  In step S 70, the service user list class 102 sends a usage right issuance request to the usage right class 103 in accordance with the generated service class 101. In step S71, the usage right class 103 notifies the user class 104 of the usage right acquisition result for notifying the service that issued the usage right. In step S72, the user class 104 displays an authentication result screen on the display device of the operation panel.

  FIG. 16 is a transition diagram of a partial screen displayed on the operation panel at the time of IC card authentication. A screen 1601 is an example of a login screen. A screen 1602 is an example of a password input screen. A screen 1603 is an example of a screen when an ID or password is read from the IC card. A screen 1604 is an example of an authentication result screen when authentication is normally completed, and displays available services.

  FIG. 17 and FIG. 18 are examples of object diagrams showing the WSSC of the multifunction machine. FIG. 17 is an object diagram before the authentication means C is added. FIG. 18 is an object diagram after the authentication means C is added.

  The present invention is not limited to the specifically disclosed embodiments, and various modifications and changes can be made without departing from the scope of the claims.

It is a schematic diagram for demonstrating the principle figure of this invention. 1 is a configuration diagram of an embodiment of a multifunction machine according to the present invention. FIG. It is an image figure showing the setting process of a security policy. It is an image figure of the other example showing the setting process of a security policy. It is an image figure showing creation and installation of MFP application. It is a sequence diagram showing an example of a process for installing an authentication unit (authentication application) recorded on a medium. FIG. 10 is a transition diagram of screens displayed on an operation panel when an authentication unit is installed by specifying a medium or a PC. It is the model showing the change of the header file of the security policy before and after adding a security policy. It is a transition diagram showing a change of a screen displayed on the operation panel before and after adding a security policy. FIG. 3 is a class diagram illustrating an example of a WSSC of a multifunction peripheral. It is a sequence diagram of an example showing the procedure of an authentication means and a security policy search process. It is a sequence diagram of an example showing the procedure of authentication and service use authority check processing. FIG. 10 is a transition diagram of a partial screen displayed on the operation panel during password authentication. It is a sequence diagram of an example showing the procedure of an authentication means and a security policy search process. It is a sequence diagram of an example showing the procedure of authentication and service use authority check processing. FIG. 10 is a transition diagram of a partial screen displayed on the operation panel at the time of IC card authentication. FIG. 3 is an object diagram illustrating an example of a WSSC of a multifunction peripheral. FIG. 3 is an object diagram illustrating an example of a WSSC of a multifunction peripheral.

Explanation of symbols

1 MFP (MFP)
2 Framework 3 Variable Unit 4 Authentication Variable Unit 5 Policy Variable Unit 6 Authorization List 7 Authentication List 8 Policy List 10 Hardware Resource 11 Software Group 21 Plotter 22 Scanner 23 IC Card Reader 24 SD Card Reader 25 OS
26 Control Service 27 Copy Application 28 Fax Application 29 Scanner Application 30 Web Service Server Component (WSSC)
31 WSSC Manager

Claims (19)

A service providing apparatus having one or more functions for providing a service to a user and providing a service using the function,
One or more security information related to security;
One or more authentication means that can be added and authenticate the user;
When a service that can be used, authentication means used for authentication, and information obtained by associating policies associated with each user are acquired and the authentication result using the authentication means associated with the user is successfully completed, the user A service providing device comprising: a service providing unit that provides the function with the available service associated with the service.   2. The service providing apparatus according to claim 1, wherein the authentication unit is added by installation from a recording medium capable of downloading or reading data from an external apparatus capable of data communication.   Claims further comprising display means for displaying one or more external devices serving as a download source of the authentication means or recording media serving as an installation source of the authentication means, and selecting either the external device or the recording medium. Item 3. The service providing apparatus according to Item 2.   The service providing apparatus according to claim 1, further comprising a display unit configured to display one or more of the available services associated with the user when an authentication result using the authentication unit ends normally.   The service providing apparatus according to claim 1, wherein the service providing unit acquires a user ID and searches for the authentication unit associated with the user ID.   The service providing means authenticates a user using the retrieved authentication means, and the usable information associated with the user ID when an authentication result using the authentication means ends normally. 6. The service providing apparatus according to claim 5, wherein the service is checked.   The service providing apparatus according to claim 1, wherein the authentication unit performs password authentication, IC card authentication, or fingerprint authentication. The service providing apparatus is an image processing apparatus having a printing unit or an imaging unit, and capable of mounting a plurality of applications related to image formation.
An operating system,
A program that operates on the operating system, is accessed by a plurality of the applications, and controls the image forming processing commonly used by the plurality of applications,
The service providing apparatus according to claim 1, wherein the security information, the authentication unit, and the service providing unit are included in the application.   The service according to any one of claims 1 to 8, characterized in that information associated with each user for an available service, an authentication means used for authentication, and a policy is acquired from an external device capable of data communication. Providing device. A service providing method of a service providing apparatus that has one or more functions for providing a service to a user and provides a service using the function,
The service providing apparatus includes one or more security information related to security,
One or more authentication means that can be added and authenticate the user,
Obtaining information related to available services, authentication means and policies used for authentication for each user;
And providing the function with the available service associated with the user when an authentication result using the authentication means associated with the user is normally completed.   11. The service providing method according to claim 10, further comprising the step of adding the authentication unit by installing from a recording medium capable of downloading or reading data from an external device capable of data communication.   The method further comprises the step of displaying one or more external devices that are the download source of the authentication unit or one or more recording media that are the installation source of the authentication unit and selecting any one of the external device and the recording medium. The service providing method according to claim 11.   11. The service providing method according to claim 10, further comprising a step of displaying one or more of the available services associated with a user when an authentication result using the authentication unit is normally completed. .   The service providing method according to claim 10, further comprising a step of acquiring a user ID and searching for the authentication means associated with the user ID. Authenticating a user using the retrieved authentication means;
15. The service providing method according to claim 14, further comprising a step of checking the available service associated with the user ID when an authentication result using the authentication unit is normally completed. .   The service providing method according to claim 10, wherein the authentication unit performs password authentication, IC card authentication, or fingerprint authentication. The service providing apparatus is a service providing method for an image processing apparatus having a printing unit or an imaging unit, and capable of mounting a plurality of applications related to image formation.
The image processing apparatus includes an operating system;
A program that operates on the operating system, is accessed by a plurality of the applications, and controls the image forming processing commonly used by the plurality of applications,
The service providing method according to claim 10, wherein the security information and the authentication unit are included in the application.   18. The method according to any one of claims 10 to 17, further comprising a step of acquiring, from an external device capable of data communication, information associated with an available service, an authentication means used for authentication, and a policy for each user. The service providing method according to the item. A service providing apparatus that has one or more functions for providing a service to a user and provides the service using the function,
Storage means for storing one or more security information relating to security;
One or more authentication means that can be added and authenticate the user;
When a service that can be used, authentication means used for authentication, and information obtained by associating policies associated with each user are acquired and the authentication result using the authentication means associated with the user is successfully completed, the user A service providing program for causing the function to provide the available service associated with the function as service providing means.

Images