JP2009205659A - Authentication printing device, authentication printing system and method thereof - Google Patents

Abstract

A technology for facilitating successful authentication in a system for outputting an information recording medium via a network.
The present invention relates to an authentication print that is connected to a network, authenticates a user, acquires print data held in a server on the network, and performs printing. The user identification information is input to authenticate the user, and the user authentication history information is sent to another device connected to the network at a predetermined timing. Transfer to a device that uses. Therefore, even when an authentication device such as an authentication server cannot be authenticated due to some failure, the authentication can be performed by another device that has received the authentication history information.
[Selection] Figure 10

Description

  The present invention relates to an authentication printing apparatus, an authentication printing system, and a method for performing printing via a network by authenticating a user.

  In recent years, companies are increasingly interested in managing confidential information due to the enforcement of the Personal Information Protection Law and increasing momentum for strengthening internal controls. For example, in the printing of confidential information, when the distance between the terminal operated by the user and the printing apparatus is far, the time from when the user issues a printing instruction to the installation position of the printing apparatus, There was a problem that information could be leaked by others. As a means to solve this problem, authenticated printing is performed in which printing is stopped after the user issues a print instruction and printing is started after the printer server or printing device performs authentication processing on the printing device side. A system is disclosed (Patent Document 1).

  On the other hand, in the authentication process, as seen in, for example, the Windows (registered trademark) logon mechanism, when authentication is performed on the network, if the network is disconnected, the authentication held locally in the terminal Authentication can be performed using the information. Thereby, even if the network is disconnected, if there is a history of successful authentication in the past, the result of successful authentication can be obtained and the terminal can be used.

JP-A-2005-259012

  However, since such authentication can be performed only by a terminal that has successfully logged on, the user has been authenticated in the past at a terminal that should be logged on for authentication processing after a print instruction for authentication printing. Otherwise, there was a problem that authentication could not be performed.

  SUMMARY An advantage of some aspects of the invention is to provide a technique for improving the convenience of authentication in authentication printing performed via a network. Or it is realizable as an application example.

[Application Example 1]
An authentication printing apparatus that is connected to a network, authenticates a user, acquires print data held in a server on the network, and performs printing.
An authentication means for inputting information for identifying the user and authenticating the user;
An authentication printing apparatus comprising: an authentication information transfer unit configured to transfer the user authentication history information to a device that is connected to the network at a predetermined timing and that uses the history information.

  According to such an authentication printing apparatus, when authentication is performed by inputting information for identifying a user, the authentication history information of the user is transferred to the apparatus using the history information at a predetermined timing via the network. . The transfer may be performed from the authentication printing apparatus or may be performed in response to a request from another apparatus. Other apparatuses can use the authentication history information sent in this way, and can improve the convenience of the authentication printing apparatus.

[Application Example 2]
The authentication printing apparatus according to Application Example 1, wherein the authentication unit transmits the input information to an authentication server connected to the network, and performs the authentication using an authentication result in the authentication server.
The network can have an authentication server that specializes in authentication. Therefore, the authentication means can use this authentication server. If the server specializes in authentication, authentication processing can be performed reliably.

[Application Example 3]
An authentication printing apparatus according to Application Example 2,
An authentication printing apparatus that authenticates the user by using the authentication history information when the authentication unit cannot authenticate the user by using an authentication result of the authentication server.
In such an authentication printing apparatus, when authentication using the authentication server cannot be performed, user authentication is performed using authentication history information output to another apparatus. Therefore, even when authentication using the authentication server cannot be performed due to a network failure or a problem with the authentication server, the authentication processing can be performed using the history information of authentication so far. If a history of successful authentication of the user remains in the authentication history information, authentication may be successful and authentication printing may be performed, which can improve user convenience.

[Application Example 4]
An authentication printing apparatus according to Application Example 3,
An authentication printing apparatus, wherein the authentication means includes a storage means for storing the history information in the authentication printing apparatus, and authenticates the user using the history information stored in the storage means.
In such an authentication printing apparatus, authentication history information is stored in a built-in storage means, and if authentication by the authentication server cannot be performed, the authentication printing apparatus itself can authenticate the user, The convenience of authentication can be further enhanced. Such authentication is particularly useful when a temporary failure occurs in the network.

[Application Example 5]
An authentication printing apparatus according to Application Example 3,
An authentication printing apparatus, wherein the authentication unit authenticates the user by using the other apparatus to which the authentication history information has been transferred in order to authenticate the user by using the authentication history information.
In this authentication printing apparatus, user authentication using history information is performed by another apparatus, and the authentication printing apparatus uses only the result. In this case, the authentication printing apparatus is released from the authentication process. In addition, the load on the authentication printing apparatus is reduced, and more resources can be invested in the printing process, which is the original process, and high performance as a whole can be realized.

[Application Example 6]
Application Example 1 in which the other apparatus is one of another authentication printing apparatus connected to the network, an authentication print server that holds print data, or an authentication terminal that outputs print data to the authentication print server. Or the authentication printing apparatus according to any one of Application Example 5.

  Authentication may be performed by a dedicated device such as an authentication server, or may be performed by another authentication printing device or an authentication terminal connected to the network. Alternatively, it may be performed in a distributed manner by these plural devices.

[Application Example 7]
A device control device connected to the same network as the authentication printing device that performs printing by acquiring print data held in a server on the network after performing user authentication,
History information storage means for receiving and storing user authentication history information to be transferred when the authentication printing apparatus authenticates the user;
An authentication response means for referring to the stored history information and returning an authentication result to the inquired other device when receiving an inquiry about user authentication from the other device via the network; Device controller.

  Since this device control apparatus receives and stores user authentication history information from the authentication printing apparatus, it refers to the stored history information when receiving an inquiry about user authentication from another apparatus. Then, the authentication result can be returned. Therefore, an inquiry about user authentication can be made at any time from another device.

  Application as an authentication printing system including the above-described authentication printing apparatus and other apparatuses, application as an authentication printing method, or its program, and application as a recording medium in which the program is recorded so as to be readable by a computer, etc. You can also think about it.

Hereinafter, embodiments of the present invention will be described in the following order based on examples.
A. Schematic configuration of a printing system in the embodiment:
B. Overview of print processing in the embodiment:
C. Overview of print authentication processing in the first embodiment:
D. Authentication processing in the first embodiment:
E. Overview of the authentication printing process in the second embodiment:
F. Authentication printing process in the second embodiment:
G. Variations:

A. Schematic configuration of a printing system in the embodiment:
FIG. 1 is an explanatory diagram showing an example of the configuration of an authentication printing system 10 according to an embodiment of the present invention. The authentication printing system 10 includes a first network area Z1 connected by the local area network LAN1, a second network area Z2 connected by the local area network LAN2, and these network areas Z1 and Z2 through a firewall. And a router RT to be connected.

  In the first network area Z1, three terminals PC11, PC12, PC13, one printer PRT1, one printer server SVp1, and one authentication server SVa1 are connected by a local area network LAN1. ing. In the second network area Z2, three terminals PC21, PC22, PC23, one printer PRT2, one printer server SVp2, and one authentication server SVa2 are connected by a local area network LAN2. ing. The printers PRT1 and PRT2 are connected to authentication magnetic card readers PCR1 and PCR2, respectively. The printers PRT1, PRT2, etc. are well-known page printers, and explanation of the internal configuration is omitted, but a communication interface for connecting to the network, a control circuit for processing data received via the network, and data temporarily A memory device for storing data, a print engine for receiving data processed by the control circuit and printing on paper, a paper transport mechanism for storing and transporting paper, an operation panel and authentication magnetic card readers PCR1, PCR2, etc. A configuration necessary for printing, such as an I / O interface for exchanging data, is provided. The printers PRT1, PRT2, etc. are not limited to page printers such as laser printers and LED printers, and ink jet printers can also be employed. It can be used regardless of color or monochrome.

  FIG. 2 is an explanatory diagram illustrating a schematic configuration of the terminal PC 11 according to the embodiment. The terminal PC11 includes a display DP11, a main body BD11, a keyboard KB11, a mouse MS11, and a card reader CR11. The other five terminals PC12, PC13, PC21, PC22, and PC23 have the same configuration as the terminal PC11 in this embodiment.

  FIG. 3 is a functional block diagram of the terminal PC 11 according to the embodiment. The main body BD 11 includes a memory ROM 101, a RAM 102, a peripheral device interface circuit (I / F) 103, a network interface circuit 105, and a hard disk (HD) 106 in addition to the CPU 100 that controls the processing of the terminal PC 11. The CPU 100, the memory ROM 101, the RAM 102, the HD 106, and the interface circuits 103 and 105 are connected to each other via an internal bus 104. A display DP 11, a keyboard KB 11, a mouse MS 11, and a card reader CR 11 are connected to the interface circuit 103, and the CPU 100 can exchange data with these peripheral devices via the internal bus 104 and the interface circuit 103. it can. The network interface circuit 105 is connected to a cable of the local area network LAN1, and the CPU 100 can exchange packets with other terminals and servers via the local area network LAN1. Note that the terminal used in this embodiment is connected using a USB, but the BIOS function is restricted so that a mass storage device cannot be connected to the USB. Also, an interface for an external storage medium such as a flexible disk is not provided. Therefore, it is impossible to write data from the terminal to the flexible disk, or write data by connecting a USB-connected memory or the like. As a result, the information leakage on the terminal side hardly occurs. Of course, these terminals may be connected via a keyboard or mouse dedicated interface instead of USB connection.

B. Overview of print processing in the embodiment:
Several embodiments of the present invention will be described below. First, a schematic operation as an authentication printing system will be described. FIG. 4 is an explanatory diagram showing an outline of the authentication printing process in the embodiment of the present invention. FIG. 4 shows the operation of the entire system. A procedure required when authentication printing is performed will be described with reference to FIG. When performing authentication printing, a user who wants to print using a specific printer from a specific terminal first performs a login process (step S100). Specifically, the user starts one of the terminals PC11 to PC13 (or PC21 to PC23) connected to the authentication printing system 10 and performs a process of logging in to the authentication printing system 10. In the following description, it is assumed that the user logs in to the authentication printing system 10 using the terminal PC 11.

  When the user turns on the terminal PC 11 and starts up, the terminal PC 11 automatically executes a login processing program installed in advance and starts processing for logging in to the system. This process will be described with reference to FIG. When starting the login process, the terminal PC 11 first requests the user to pass his / her magnetic card MC through the magnetic card reader CR 11 on the screen of the terminal PC 11 and to input a password from the keyboard. A message is displayed (step S101). In response to this message, when the user passes the magnetic card MC through the card reader CR11, the authentication information recorded in advance on the magnetic card MC is read (step S102), and then the data input based on the operation of the keyboard KB11 by the user. Is entered as a password (step S103). In this embodiment, the authentication information is composed of alphabets representing the user's name and is treated as a user ID. On the other hand, a password consists of a 5-digit number and is used as a printer ID for identifying an authenticated printer on the network.

  Next, the terminal PC 11 transmits the authentication information (user ID) and password read from the magnetic card MC to the authentication server SVa1 via the network (step S104). The data registered in the magnetic card MC may be handled as a password, and authentication information (user ID) may be input from the keyboard KB11. Alternatively, in order to log in to the terminal PC 11, it is possible to perform user login processing by directly inputting authentication information (user ID) and password from the keyboard KB 11 without using the magnetic card reader CR 11. .

  Upon receiving the authentication information and password transmitted from the terminal PC 11, the authentication server SVa1 executes the processing in the right column of FIG. That is, the authentication server SVa1 first receives the authentication information and password from the terminal PC11 (step S110), and performs a process of authenticating it (step S120). The authentication server SVa1 stores in advance a user ID and password (used as a printer ID in this embodiment), which are identification information of an authentication printing user who permits login, in the form of a table. An example of this table is shown in FIG. This table is basically managed by the administrator of authenticated printing. The authentication server SVa1 uses this authentication information (user ID) and password received from the terminal PC 11 via the network and refers to this table to authenticate whether or not the user is permitted to log in to the authentication printing system 10. To do.

  When it is confirmed that the user ID and the authentication information are registered in advance (step S130), the authentication server SVa1 transmits a permission notice for permitting login to the terminal PC11 (step S135). The terminal PC11 receives the signal from the authentication server SVa1 (step S105), determines whether or not this is a permission notification (step S106), and if it is a permission notification, opens the use of the terminal PC11 to the user (step S106). Step S107). That is, after that, the user can freely handle the terminal PC 11 using the keyboard KB 11 and the mouse MS 11, and can perform browsing of data permitted by the user, creation of data, and the like on the terminal PC 11. If the permission notification is not received from the authentication server SVa1, the terminal PC11 repeats the reception process in step S105 and does not open the operation of the terminal PC11 to the user.

  This completes the user login process (FIG. 4, step S100) performed by the terminal PC 11 and the authentication server SVa1. The user uses the terminal PC 11 to create and view a document, and then performs a print command operation to print a desired document, sheet, or image (step S200). The print command operation is an operation for instructing print output to the printer PRT1 or the printer PRT2. When this operation is performed, the printing data transmitted from the terminal PC 11 together with the authentication information for specifying the user who has instructed printing is once spooled in the form of a print job in the printer server SVp1. Spooling is performed by encrypting print data and storing it in a hard disk provided in the printer server SVp1. At this time, the encrypted and spooled print data is stored as an authenticated print job list associated with the printer ID. An example of this job list is shown in FIG. The printer server SVp1 does not output spooled print data to the printers PRT1, PRT2, etc. until a print authentication process described later is performed. Therefore, even if the user issues a print instruction from the terminal PC 11, the print result is not immediately output from the printer.

  When the print instruction operation is completed, the user logs out from the terminal PC 11 and moves to the printer PCT 1 side from the viewpoint of ensuring security. In the present embodiment, since printing cannot be performed unless the user logs out from the terminal PC 11, the terminal is not inadvertently operated during printing, and the security of the entire authentication printing system is further enhanced. Of course, it is possible to improve the convenience by enabling printing without logging out. Even in such a case, if the terminal PC 11 is not operated for a certain period of time or longer, the user may be automatically logged out to achieve both convenience and safety.

  The user who has logged out from the terminal PC 11 carries the magnetic card MC, approaches the printer PRT1 or PRT2 that is to perform printing, and performs print authentication processing (step S300). The print authentication process is a process that enables printing only after authentication on the printer side, and is used when printing a highly confidential document or sharing a high-performance printer with a plurality of users. When the distance between the terminal used by the user and the printer is far, the printer side will prevent confidential documents from being viewed by a third party before arriving at the printer side after issuing a print instruction at the terminal. In this process, authentication is performed and printing processing is started. Although details of the print authentication process will be described later, the user performs the print authentication process using the magnetic card MC with the printer PRT1, and when the user is authenticated, the printer PRT1 executes the print process (FIG. 4, FIG. 4). Step S400). At this time, the user instructs printing from the terminal PC 11 first, and the encrypted print data spooled in the printer server SVp1 is decrypted. The decrypted print data is transmitted to the printer via the local area network LAN1 and printed. Decoding may be performed on the printer side.

C. Overview of print authentication processing in the first embodiment:
FIG. 8 is a flowchart showing a part of the print authentication process (process corresponding to FIG. 4, step S300) in the first embodiment of the present invention. The print authentication process includes a print process (steps S311 to 318) in the printer PRT1 having the magnetic card reader PCR1, and a print authentication process (process in step S312) in the authentication server SVa1 that performs the process in response to an authentication request from the printer PRT1. As described later, this is realized by the cooperation of the print data transmission processing (steps S351 to 357) of the printer server SVp1 that outputs the print data spooled in response to the print instruction to the printer PRT1. The outline of the print authentication process will be described below with reference to FIGS. 7 to 9 as appropriate.

  A user who has performed a print command operation on the terminal PC11 passes his / her magnetic card MC through the magnetic card reader PCR1 of the printer PRT1 in order to take out the print result from the printer PRT1. The printer PRT1 reads the contents of the magnetic card MC (step S311), and executes the authentication process for printing (step S312) using the authentication information (user ID) read from the magnetic card MC. An example of the input authentication information (user ID) is shown in FIG. The print authentication process (step S312) performed using the authentication information will be described in detail later. Basically, authentication is performed mainly by the authentication server SVa1, and the authentication server SVa1 is operating. If not, use another device. The apparatus that has performed authentication returns an authentication result and a printer ID to the printer PRT1 that has requested authentication.

  The printer PRT1 analyzes the authentication result and determines whether the authentication is successful (step S313). If the authentication has not succeeded, no processing is performed, the process returns to “NEXT”, and this routine is terminated. Accordingly, printing can be performed only by a user who is permitted to perform authentication printing. On the other hand, if the authentication result is analyzed and it is determined that the authentication is successful, the printer PRT1 performs a process of outputting a print data request AD to the printer server SVp1 using the printer ID (step S1). S315). The print data request may be made via the authentication server SVa1. However, as will be described later, in this embodiment, a mechanism capable of performing authentication even when the authentication server SVa1 is not operating for some reason. Therefore, the print data request is made directly from the printer PRT1 to the printer server SVp1 without going through the authentication server SVa1.

  The printer PRT1 transmits a signal AD requesting print data and a printer ID to the local area network LAN1 with a header indicating the printer server SVp1. Accordingly, the printer server SVp1 can recognize that the packet including the print data request AD and the printer ID is addressed to itself, and receives this data (step S351). The printer server SVp1 that has received the print data request AD and the printer ID performs a process of determining whether or not the requested print data is spooled in the hard disk (step S352). As shown in FIG. 7, since the printer server SVp1 stores the encrypted print data in association with the printer ID, the spooled print data is stored using the received printer ID as a clue. It identifies and decrypts it (step S354). Thereafter, the printer server SVp1 performs processing for transmitting the decrypted print data (indicated by the reference symbol PD) to the printer PRT1 (step S355).

  Since the printing data (PD) transmitted to the local area network LAN1 is divided into a plurality of packets with headers addressed to the printer PRT1, the printer PRT1 sequentially receives the packets from the local area network LAN1 (steps). S316) After reconstructing the image data, a printing process is performed (step S317). Such decoding, transmission, reception, and printing of the printing data are performed until transmission and printing of all the printing data are completed (steps S318 and S357). When the decoding / transmission / reception / printing of the printing data is completed, the printer PRT1 completes the printing process and enters the standby state again, and the printer server SVp1 returns to the initial state.

D. Authentication processing in the first embodiment:
Next, details of the printing authentication process shown as step S312 in FIG. 8 will be described. FIG. 10 is a flowchart showing details of the authentication process. When the printing authentication process is started, a process for searching for an authentication server is first performed (step S510). A response is called to the authentication server via the network. If the authentication server SVa1 responds to this call within a predetermined time, the printer PRT1 performs a process of transmitting the authentication information (user ID) to the responding authentication server (here, the authentication server SVa1) ( Step S530). If no authentication server responds within a predetermined time and a so-called timeout occurs, the printer PRT1 performs a distributed authentication process (step S600). This distributed authentication process will be described later with reference to FIG.

  The printer PRT1 transmits authentication information to the responding authentication server SVa1, waits for an authentication result to return, and determines whether or not the authentication result has returned (step S540). If the authentication result returns, it is determined that the authentication has succeeded (step S550), and if the authentication result does not return, it is determined that the authentication has failed (step S560). As illustrated in FIG. 11, the result of the authentication process corresponds to the authentication information received by the authentication server with the authentication result (OK or NG), and if the authentication result is “OK”, A printer ID is assigned as reply information. Therefore, for example, when “Suzuki” is transmitted to the authentication server SVa1 as authentication information (user ID) read from the magnetic card by the printer PRT1, the authentication server SVa1 refers to the authentication data table shown in FIG. A process for authenticating information is performed. Since “Suzuki” exists in the authentication data table, the authentication server SVa1 returns data “OK” as an authentication result to the printer PRT1 together with the printer ID “00111” as shown in FIG. come. On the other hand, if the authentication information transmitted from the printer PRT1 side is “Takahashi”, since this authentication information (user ID) is not registered in the table, the authentication server SVa1 returns “NG” as the authentication result.

  The printer PRT1 that has received this result performs a process of adding the authentication result received this time to the authentication history information stored in its own memory device and storing it (step S570). The authentication history information is information on the history of authentication so far, and consists of a set of authentication information (user ID), authentication result, and printer ID. The result of authentication from the authentication server SVa1 is transmitted to the printer PRT1 as information for each line shown in FIG. 11 as an example. A collection of the authentication result information is history information, and is stored as a list just as shown in FIG. This authentication history information may be stored in a state arranged in time series, or may be stored in a state sorted by authentication information (user ID) in consideration of later use. Or you may classify | categorize and memorize | store based on an authentication result. Only authentication results with “OK” may be stored. When storing in time series, the authentication history information after a certain period may be deleted in order. Since user authentication originally changes in real time, if it is deleted within a predetermined period, it is possible to improve security by avoiding obsolescence of history information. Further, if the authentication information (user ID) is used for sorting, authentication processing can be performed at high speed.

  Thus, after storing the result of authentication in the authentication server SVa1 so far as history information, processing for determining whether or not there is a device having a function of holding the authentication history among devices connected to the network is performed. (Step S580). The printer having the same function as the printer PRT1 performing the authentication process for printing, the authentication server SVa2, or the like, or the printer server SVp1 has a measure having the function of storing the authentication history information in the same manner as the printer PRT1. It is determined whether or not it is connected to the network. Such a determination is made by creating and storing a list of devices having equivalent functions in advance and determining whether or not the corresponding device exists on the network using a broadcast or the like. Can do. Of course, each device on the network may be inquired using a protocol such as SLP (Service Location Protocol), and the response from the device may be examined to make a determination.

  If there is an apparatus having an authentication history holding function on the network, the authentication history information is output (step S590). If not, nothing is done and the process is terminated. Through the above processing, once authentication is performed by the authentication server SVa1, information indicating that the authentication has succeeded can be held as authentication history information not only the printer PRT1 that has performed authentication printing, but also authentication history information on the network. Stored in the device. In the present embodiment, the following description is given on the assumption that the printer server SVp1 has a function of holding authentication history information.

  When the printer PRT1 starts the printing authentication process and searches for the authentication server (step S510), if the response from the authentication server is not obtained, the printer PRT1 executes the distributed authentication process (step S600). This distributed authentication process will be described with reference to FIG. When the distributed authentication process is started, the printer PRT1 first performs a process of searching for its own authentication history information to determine whether there is authentication information to be authenticated (step S610). The own authentication history information is information stored in the memory device in step S570 of FIG. For example, when authentication server (user ID) tries to authenticate “Suzuki” and the authentication server does not respond, it first searches the authentication history information of printer PRT1 itself. As a result, if “Suzuki” has been authenticated by the printer PRT1 in the past, since “Suzuki” exists in the authentication history information (see FIG. 11), the authentication history information is present (step S620). “Authentication success” is set (step S630), and this routine is temporarily ended, and the process returns to the print authentication process (FIG. 10). Since the process returns to the process of FIG. 10 with the information that there is an authentication result, the process after step S570 of FIG. 10 is performed, and the authentication printing is permitted as a successful authentication.

  On the other hand, although the printer PRT1 has searched for its own authentication history information, it is possible that no authentication information corresponding to the authentication information is found even if the authentication history information is searched. For example, “Sato” is used for authentication, but “Sato” has not been authenticated in the past, and “Sato” cannot be found in the authentication history information. In such a case, the printer PRT1 determines that there is no corresponding authentication information in its own authentication history information (step S620), and sends the authentication information (user ID) to another device on the network (here, the printer server SVp1). Processing for sending and inquiring is performed (step S650). This inquiry may be made by inquiring to all devices on the network using broadcast, or by preparing a list of devices holding authentication history information in advance and inquiring sequentially according to this list. Depending on the method you use.

  If there is a response to the inquiry from the printer server SVp1 within a predetermined time and there is a reply that the authentication history information has been found, the process proceeds to step S630 described above, and the routine ends with an authentication result being present (authentication successful). To do. On the other hand, when a reply that the authentication history information is not found is received from the printer server SVp1 or no response is received from any device within a predetermined time and a time-out occurs, the authentication result is “authentication failure” (step S670). ) With this result, this routine is temporarily terminated. In this case, the authentication printing is not performed because the processing after step S570 in FIG.

  After the authentication process for printing, the printer PRT1 requests print data from the printer server SVp1 using the printer ID according to the authentication result, and print data spooled in advance by the user by the process shown in FIG. Is received and printing is performed.

The results of executing the above processing (FIGS. 10 and 12) are as follows.
[1] If the authentication server SVa1 is operating normally, the authentication server SVa1 performs an authentication process for printing using the authentication information read from the magnetic card by the magnetic card reader PCR1 of the printer PRT1. If authentication information (user ID) is found, printing is permitted.
[2] When the authentication server has stopped operating or a part of the network has failed and cannot communicate with the authentication server, authentication is first performed by searching the authentication history information of the printer PRT1 itself. . If the printer PRT1 has previously authenticated a user of the same hot water server ID, the authentication history information is stored in the memory device, so that the authentication can be executed by searching this. If authentication information (user ID) is found, printing is permitted.
[3] If the authentication server does not respond and authentication information (user ID) is not found even after searching the authentication history information of the printer PRT1 itself, another device on the network (printer server SVp1 in this embodiment) ). When authentication has been performed before and the device stores the authentication history information by itself, or when the apparatus receives the transmission from the printer PRT1, the authentication history information is stored, and the authentication information (user ID) is If found, the authentication is successful and printing is permitted.

  Therefore, even if the authentication printing system 10 itself cannot be authenticated by the authentication server SVa1, authentication can be performed with reference to past authentication history information. Of course, if authentication by the authentication information (user ID) has not been successful once in the past, the authentication by the device other than the authentication server is not authenticated, and the reliability related to authentication does not decrease. Therefore, when the authentication server is stopped, the authentication printing itself cannot be performed by itself, and the convenience of the user can be improved while maintaining the reliability of the authentication printing.

  In this embodiment, the authentication history information is stored in the memory device of the printer PRT1 itself, but only the authentication history information may be stored in another device on the network. For example, an area for storing authentication history information can be secured on a network drive such as NAS, and the authentication history information can be stored here. In this embodiment, the authentication history information is uniformly stored. However, the authentication information (user ID) is classified for each reliability, and a user with low reliability is included in a part of the authentication history information. It may not be included and not stored. For example, users who have been temporarily given authentication information (user ID), such as seconded employees within a company, are not included in the authentication history information, but require authentication by an authentication server managed by the administrator It is. The authentication history information may be deleted every predetermined period. For example, the authentication history information is once deleted at the time of personnel change. By taking these measures, the reliability of the authentication printing system 10 can be increased.

E. Overview of the authentication printing process in the second embodiment:
Next, a second embodiment will be described. The authentication printing system according to the second embodiment has the same configuration as that of the first embodiment except that the terminal PC 11 is configured as a thin client terminal (Thin Client Terminal) that does not include the hard disk 106 or other nonvolatile storage medium. Is provided. The thin client terminal is a terminal configured to narrow down functions to only a function for connecting to the local area network LAN1 and a user interface function and to execute data processing on the server side. The authentication printing system 10 is configured as a thin client system (Thin Client System) having a plurality of thin client terminals.

  Since the thin client system does not require data input / output at the terminal PC 11, it is possible to suppress infection by viruses and leakage of confidential information by disabling hardware connection for data input / output. Has the advantage of being able to Furthermore, the system administrator only needs to manage the server, and the management burden is greatly reduced.

F. Authentication printing process in the second embodiment:
FIG. 13 is a flowchart showing an authentication print processing routine in the second embodiment. In step S1100, the authentication printing system 10 executes a client login process in response to a user input from the terminal PC11. The client login process is a process of confirming that the authentication server SVa1 is a user who is permitted to log in to the system in advance and determining the contents of the processes of the printer servers SVp1, SVa1, etc. according to the user.

  In the present embodiment, the client login process corresponds to “first authentication” in the claims. The authentication server SVa1 functions as a “reception control unit” in the claims. The authentication process may be performed separately from the client login process. In this case, this authentication process corresponds to “first authentication” in claim 10 of the claims.

  FIG. 14 is a flowchart showing a client login processing routine in the second embodiment. In step S1110, the authentication printing system 10 executes a magnetic card reader reading process. The magnetic card reader reading process is a process of reading data from a magnetic card (not shown) when the user passes the magnetic card (not shown) through the card reader CR11. In this example, a user ID for specifying a user is read from a magnetic card (not shown).

  In step S1120, the authentication printing system 10 executes read data authentication processing. The read data authentication process is a process for authenticating the user by the user ID read from the magnetic card and the password input from the keyboard KB11. If the user ID and password match the pre-registered data, the process proceeds to step S1140. If the user ID and password do not match, the process returns to step S1110 (step S1130).

  In step S1140, the authentication printing system 10 performs an authentication result cache process and advances the process to step S1200 (FIG. 13). In this embodiment, the authentication result cache process is a process in which the authentication server SVa1 that has performed the authentication process transmits authentication result information indicating the authentication result to the authentication server SVa2 and the two printers PRT1 and PRT2.

  FIG. 15 is a flowchart showing a print authentication processing routine in the second embodiment. In step S1310, the user inputs authentication information. The authentication information is input to the authentication magnetic card readers PCR1 and PCR2. For example, when a magnetic card (not shown) is passed through the authentication magnetic card reader PCR1, authentication printing is performed by the printer PRT1. On the other hand, when a magnetic card (not shown) is passed through the authentication magnetic card reader PCR2, authentication printing is performed by the printer PRT2. In this embodiment, the authentication information uses a user ID as shown in FIG.

  In step S1320, the printer PRT1 (or printer PRT2) attempts to access the authentication server SVa1 (or authentication server SVa2) in order to perform authentication processing. If the access is successful, the process proceeds to step S1330, and if the access fails, the process proceeds to step S1340.

  In step S1330, the authentication server SVa1 performs an authentication process. The authentication process is a process of returning predetermined data based on the result of the authentication process stored in the authentication server SVa1. As shown in FIG. 17, for example, when the user ID “Suzuki” is input as authentication information, the printer ID “00111” is returned based on the authentication result “OK”. Including. On the other hand, for example, when the user ID “Takahashi” is input as authentication information, the reply of the printer ID is rejected based on the authentication result “NG”.

  In step S1340, the printer PRT1 performs an authentication history search process. The authentication history search process is a process for searching the authentication history cached in the printer PRT2, the authentication server SVa1, the printer server PRT1, and the printer server PRT2 accessible from the printer PRT1. The cached authentication history is substantially the same data as the authentication result stored in the authentication server SVa1 (FIG. 17).

  In step S1350, the printer PRT1 branches the process according to the authentication result (or the authentication history search result). Specifically, in the case of authentication OK, the process proceeds to step S1400 (FIG. 13), and in the case of authentication NG, the process returns to step S1310.

  In step S1400, the printer server PRT1 executes print processing. The print process includes a process of determining a print job to be transmitted to the printer PRT1 according to the printer ID returned by the authentication process based on the print job list (FIG. 18) stored in the printer server PRT1. For example, when authenticated with the user ID “Suzuki”, based on the printer ID “00111”, print jobs “Test.txt” and “Document.txt” are transmitted to the printer server PRT1, and printing is executed. .

  As described above, in the present embodiment, even when the authentication server cannot be accessed, authentication can be performed based on the cached authentication result. For example, an authentication terminal or printing device may be connected to the authentication server for some reason. Even if access is not possible, authentication can be performed, and authentication success can be facilitated. The authentication information can also be input from a preset terminal. In this case, this terminal corresponds to an “authentication information input unit” in the claims.

G. Variations:
As mentioned above, although several embodiment of this invention was described, this invention is not limited to such embodiment at all, and implementation in a various aspect is possible within the range which does not deviate from the summary. It is. In particular, elements other than the elements described in the independent claims in the constituent elements in each of the embodiments described above are additional elements and can be omitted as appropriate. Furthermore, for example, the following modifications can be implemented.

G-1. In the above embodiment, a print medium on which information is printed is used as the information recording medium. However, the present invention can also be applied to output of a data recording medium such as a flexible disk, a CD-ROM, and a DVD-ROM.

G-2. In the above-described embodiment, a thin client system using a thin client terminal is used, but the present invention can also be applied to a rich client system. However, in the thin client system, all of the thin client terminals are treated as the same, but in the present invention, they are identified by address information used for identification in the network such as a MAC address or an IP address.

G-3. In the above-described embodiment, authentication processing and print control are performed by the authentication server, and print job data is spooled in the printer server. For example, each server may be configured to have both functions.

1 is an explanatory diagram illustrating an example of a configuration of an authentication printing system 10 according to an embodiment of the present invention. Explanatory drawing which shows schematic structure of terminal PC11 of an Example. The functional block diagram of terminal PC11 of an Example. 6 is a flowchart illustrating authentication printing processing according to the first embodiment. The flowchart which shows an example of the login process in 1st Example. Explanatory drawing which shows an example of the authentication data table on an authentication server. FIG. 5 is an explanatory diagram illustrating an example of an authentication print job list. 6 is a flowchart showing an overview of authentication printing processing in the first embodiment. Explanatory drawing which shows an example of authentication information (user ID). The flowchart which shows the content of the authentication process for printing. Explanatory drawing which illustrates the content of an authentication process. The flowchart which shows the content of a distributed authentication process. 9 is a flowchart showing authentication printing processing in the second embodiment. The flowchart which shows a client login process routine. 10 is a flowchart showing a print authentication processing routine in the second embodiment. Explanatory drawing shown with the table | surface which shows the example of the input authentication information (user ID). Explanatory drawing which illustrates the content (authentication server or cache) of an authentication process. FIG. 3 is an explanatory diagram illustrating a list of authentication print jobs (print server). FIG. 3 is an explanatory diagram illustrating an authentication print job that is selected and is a processing target.

Explanation of symbols

10: Authentication printing system 100 ... CPU
101 ... ROM
102 ... RAM
103, 105 ... interface circuit 104 ... internal bus 106 ... hard disk (HD)
LAN1, LAN2 ... Local area network PC11, PC12, PC13, PC21, PC22, PC23 ... Terminal PRT1, PRT2 ... Printer SVp1, SVp2 ... Printer server SVa1, SVa2 ... Authentication server PCR1 ... Magnetic card reader for authentication DP11 ... Display BD11 ... Main unit KB11 ... Keyboard MS11 ... Mouse MC ... Magnetic card CR11 ... Card reader RT ... Router

Claims (11)

An authentication printing apparatus that is connected to a network, authenticates a user, acquires print data held in a server on the network, and performs printing.
An authentication means for inputting information for identifying the user and authenticating the user;
An authentication printing apparatus comprising: authentication information transfer means for transferring the user authentication history information to another apparatus connected to the network at a predetermined timing and using the history information.   The authentication printing apparatus according to claim 1, wherein the authentication unit transmits the input information to an authentication server connected to the network, and performs the authentication using an authentication result in the authentication server. An authentication printing apparatus according to claim 2,
An authentication printing apparatus that authenticates the user by using the authentication history information when the authentication unit cannot authenticate the user by using an authentication result of the authentication server. An authentication printing apparatus according to claim 3, wherein
An authentication printing apparatus, wherein the authentication means includes a storage means for storing the history information in the authentication printing apparatus, and authenticates the user using the history information stored in the storage means. An authentication printing apparatus according to claim 3, wherein
An authentication printing apparatus, wherein the authentication unit authenticates the user by using the other apparatus to which the authentication history information has been transferred in order to authenticate the user by using the authentication history information.   2. The other device is any one of another authentication printing device connected to the network, an authentication print server that holds print data, or an authentication terminal that outputs print data to the authentication print server. The authentication printing apparatus according to claim 5. A device control device connected to the same network as the authentication printing device that performs printing by acquiring print data held in a server on the network after performing user authentication,
History information storage means for receiving and storing user authentication history information to be transferred when the authentication printing apparatus authenticates the user;
An authentication response means for referring to the stored history information and returning an authentication result to the inquired other device when receiving an inquiry about user authentication from the other device via the network; Device controller. An authenticated printing system that performs printing via a network according to an instruction of an authenticated user,
An authentication server connected to the network and authenticating a user;
An authenticated print server connected to the network and holding print data to be printed;
An authentication printing apparatus that acquires and prints print data held in the authentication print server, and
The authentication printing apparatus includes:
An authentication unit that inputs information for identifying a user, transmits the input information to the authentication server via the network, and authenticates the user by using an authentication result in the authentication server;
Authentication information transfer means for transferring the user authentication history information to another device connected to the network at a predetermined timing and using the history information;
An authentication printing system comprising: an authentication inquiry unit that inquires of the other device about the user authentication when the authentication unit cannot authenticate the user using an authentication result of the authentication server. . A device control apparatus including a plurality of servers connected to a plurality of terminals and at least one output device via a network,
A first authentication process is executed according to data input from an authentication information input unit associated with the output device, and when the first authentication is successful, authentication result information indicating the authentication result is obtained. An authentication result transmitting unit for distributing and transmitting to at least a part of the plurality of servers and the at least one output device;
A reception control unit for receiving an output of the information recording medium instructed based on the executed first authentication;
Output that performs second authentication based on the transmitted authentication result information, and causes the output device to output the information recording medium to any one of the at least one output device based on the executed second authentication A control unit;
A device control apparatus comprising: An authentication printing method for performing printing by acquiring print data held in a server on the network after being connected to a network and authenticating a user,
Enter information that identifies the user, authenticate the user,
An authentication printing method of transferring the history information of the user authentication to another device connected to the network and using the history information at a predetermined timing. An authentication printing method for performing printing via a network according to an instruction of an authenticated user,
An authentication print server connected to the network holds print data to be printed,
In an authentication printing apparatus that performs printing, information specifying a user is input, and the input information is transmitted to an authentication server that authenticates the user via the network,
The authentication server authenticates the user,
The history information of the user authentication is transferred at a predetermined timing to another device connected to the network and using the history information.
When the user cannot be authenticated by the authentication server, the authentication printing device inquires the other device for the user authentication,
When the user is successfully authenticated by the authentication server or the other device, the print data is transferred from the authentication print server to the authentication printing device, and printing is performed by the authentication printing device. Method.

Images