JP2012243044A - Image processing apparatus, user authentication method and user authentication program with the same - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an image processing apparatus and the like which allow reliable identification of a user who has executed operation even when lending a portable memory medium to another user and eliminate the necessity of an advanced registration of a user to allow use of the portable memory medium.SOLUTION: It is determined whether biological information of a second user read by biological information reading means 12 matches biological information of a first user associated with identification information read by identification information reading means 11. When these pieces of biological information do not match each other, it is determined whether the biological information of the second user has been registered as biological information of a user who is allowed to use an image processing apparatus 100. When it is determined that the biological information has been registered, the second user is allowed to log in within a use authority of the first user.

Description

  The present invention relates to an image processing apparatus such as an image forming apparatus that allows a user to log in using a portable storage medium such as an IC card, a user authentication method and a user authentication program using the apparatus.

  For example, when using an image processing apparatus such as an MFP (Multi Function Peripherals) which is a multifunction digital multi-function peripheral in a company or office, the user can store identification information (ID information) which is identification information. An image processing apparatus configured to log in when a medium, for example, an IC card is held over a predetermined detection part of the MFP and the read ID information matches the registered information registered in advance and authentication is successful, Conventionally known.

  In such an image processing apparatus, when a user lends his / her IC card to another person (another user) and entrusts a job such as printing, in the related art, the user simply lends the IC card to another person (agent). In this case, there is a security risk that the person who actually operated the device becomes unknown, and tracking based on the operation history becomes impossible.

  In order to solve this problem, identification information such as passwords of other users (agents) that lend IC cards is stored and registered in the IC card, and the password must be entered when logging into the MFP. Thus, it is known that the person who operates the system can be specified or the authority can be changed for each user.

  Conventionally, there has been known an image processing apparatus having a configuration in which the biometric information of the person and the agent is stored in the IC card and the login is permitted to the agent as well as the person using the IC card. (For example, refer to Patent Document 1).

JP 2001-202494 A

  However, when lending an IC card to another person and entrusting work such as printing, conventionally, identification information such as a password of a user who can use the IC card is registered in advance in the IC card or a system to log in with the IC card. It was necessary to keep. In addition, in the case of a password, if it is leaked to another person, there is a problem that the person cannot be identified.

  Further, in the technique described in Patent Document 1 in which the biometric information of the agent is stored in the IC card, the biometric information of the agent is stored in advance in the IC card, although the security risk such as a password is reduced. It was necessary to do it, and it was also troublesome.

  The present invention has been made in view of the above circumstances, and even if a portable storage medium is lent to another user, the user who can use the portable storage medium can be specified in advance and the user who can use the portable storage medium can be pre-registered. It is an object of the present invention to provide an image processing apparatus that is not required, a user authentication method that is executed by the image processing apparatus, and a user authentication program that causes the image processing apparatus to execute the user authentication method.

The above problem is solved by the following means.
(1) Identification information reading means for reading the identification information of the first user stored in the portable storage medium, biological information reading means for reading the biological information of the second user attempting to log in, and the biological information reading means The biometric information of the second user read by the identification information is judged whether or not it matches the biometric information of the first user associated with the identification information read by the identification information reading means. Are determined as not matching, the determination means for determining whether or not the biometric information of the second user is registered as the biometric information of the user who can use the image processing apparatus, and the determination means, In addition to the case where it is determined that the biological information of the second user matches the biological information of the first user, the biological information of the second user is Authentication means for permitting the second user to log in within the scope of the first user's use authority even when it is determined that the user is registered as biometric information of the user who can use An image processing apparatus.
(2) If it is determined that the biometric information of the second user is registered as biometric information of a user who can use the image processing apparatus, the authentication unit permits login as the second user. An image processing apparatus according to 1.
(3) When it is determined that the biometric information of the second user is registered as biometric information of a user who can use the image processing apparatus, the authentication unit permits login as the first user. The image processing apparatus according to item 1, wherein the second user is recorded as an operation executor in the operation log.
(4) The first user's biometric information is stored in the portable storage medium, and the determination means includes the first user's biometric information and the second user's biometric information performed in the portable storage medium. 4. The image processing device according to any one of items 1 to 3, wherein it is determined whether biometric information of the second user matches biometric information of the first user based on a result of collation with the biometric information of the user. .
(5) The image processing apparatus according to any one of the preceding items 1 to 4, wherein the biological information of the first user and / or the biological information of the second user is stored in the own apparatus or in an external apparatus.
(6) an identification information reading step for reading the identification information of the first user stored in the portable storage medium, and a biological information reading step for reading the biological information of the second user to log in by the biological information reading means; It is determined whether the biometric information of the second user read in the biometric information reading step matches the biometric information of the first user associated with the identification information read in the identification information reading step. In addition, when it is determined that the biometric information does not match, the determination step of determining whether the biometric information of the second user is registered as the biometric information of the user who can use the image processing apparatus; In the determining step, it is determined that the biometric information of the second user matches the biometric information of the first user. In addition to the case where it is determined that the biometric information of the second user is registered as the biometric information of the user who can use the image processing apparatus, An authentication step for permitting login within the range of use authority, and a user authentication method using an image processing apparatus.
(7) an identification information reading step for reading the identification information of the first user stored in the portable storage medium; a biological information reading step for reading the biological information of the second user who is going to log in by the biological information reading means; It is determined whether the biometric information of the second user read in the biometric information reading step matches the biometric information of the first user associated with the identification information read in the identification information reading step. In addition, when it is determined that the biometric information does not match, the determination step of determining whether the biometric information of the second user is registered as the biometric information of the user who can use the image processing apparatus; In the determining step, it is determined that the biometric information of the second user matches the biometric information of the first user. In addition to the case where it is determined that the biometric information of the second user is registered as the biometric information of the user who can use the image processing apparatus, A user authentication program for causing a computer of an image processing apparatus to execute an authentication step of permitting login within a range of use authority.

  According to the invention described in item (1) above, when the image processing apparatus logs in, the identification information of the first user stored in the portable storage medium is read, while the fingerprint information of the second user attempting to log in Or the like is read. It is determined whether or not the read biometric information matches the biometric information of the first user associated with the user information of the portable storage medium. If they match, the second user and the first user Because it is the same person, login is permitted. If they do not match, it is determined whether or not the biometric information of the second user is registered as the biometric information of the user of the image processing apparatus. If registered, the second user who is different from the first user is registered. On the other hand, login is permitted within the range of the use authority of the first user.

  That is, even if the second user is lent the portable storage medium from the first user who owns the portable storage medium, the biological information of the user who can use the image processing apparatus as the biological information of the second user. If the user has been registered as information in the image processing apparatus or the like, the user can be reliably identified, so the second user can use the image within the scope of the first user's authority to use the portable storage medium. A processing device can be used. In addition, since biometric information is used, there is no risk of leakage as in the case of using only a password. In addition, the troublesome operation of previously registering the identification information and biometric information of the user who can use the portable storage medium in the portable storage medium or the like becomes unnecessary.

  According to the invention described in (2) above, when it is determined that the biological information of the second user is registered as the biological information of the user who can use the image processing apparatus, login is permitted as the second user. Therefore, an operation display for the second user is displayed on the operation panel or the like.

  According to the invention described in (3) above, when it is determined that the biological information of the second user is registered as the biological information of the user who can use the image processing apparatus, login is permitted as the first user. However, since the second user is recorded as the operation executor in the operation log, the actual operation executor can be accurately identified and security can be ensured.

  According to the invention described in (4), the first user's biometric information is stored in the portable storage medium, and the first user's biometric information and the first user's biometric information performed in the portable storage medium are stored in the portable storage medium. Since it is determined whether or not the second user's biometric information matches the first user's biometric information based on the collation result with the second user's biometric information, the image processing apparatus is the first user. The biometric information of the second user and the biometric information of the second user need not be collated, and the processing of the image processing apparatus is simplified accordingly.

  According to the invention described in (5) above, the authentication process is executed even if the biometric information of the first user and / or the biometric information of the second user is stored in either the own device or the external device. can do.

  According to the invention described in item (6) above, even a user who has lent a portable storage medium from a user who owns the portable storage medium, the biometric information of the user can use the image processing apparatus. If registered as biometric information, the user can use the image processing device within the scope of the use authority of the first user who is the owner of the portable storage medium. There is no risk of such leakage, and a troublesome operation of previously registering identification information and biometric information of a user who can use the portable storage medium in the portable storage medium becomes unnecessary.

  According to the invention described in (7) above, even if the second user is lent the portable storage medium from the first user who owns the portable storage medium, the biological information of the second user is not stored. If registered as biometric information of a user who can use the image processing apparatus, a process for permitting the user to use the image processing apparatus within the scope of the first user's use authority is performed. Can be executed.

1 is a schematic configuration diagram of an image processing apparatus according to an embodiment of the present invention. It is a block diagram which similarly shows the electrical structure of an image processing apparatus. 6 is a flowchart showing an authentication process when logging in to the image processing apparatus. It is explanatory drawing of user authentication when the principal who is an owner of an IC card logs in. It is explanatory drawing of user authentication when the principal lends the IC card which is a portable storage medium to another user. It is a schematic block diagram in the case of registering user identification information and biometric information in an external authentication server.

  Embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 is a schematic configuration diagram of an image processing apparatus according to an embodiment of the present invention.

  In this embodiment, the MFP, which is the above-described multifunction digital multi-function peripheral, is used as the image processing apparatus.

  In FIG. 1, the MFP 100 includes an apparatus main body 101 including a printing unit 7 (FIG. 2) and a paper feed cassette unit 102, and an automatic document feeder (ADF) 103 provided on the apparatus main body 101. In addition, for example, an identification information reading unit 11 that reads the identification information from an IC card M, which is a portable storage medium in which identification information (also referred to as ID information) of the user who uses the MFP is stored. It has a biological information reading unit 12 and the like for reading.

  In this embodiment, the fingerprint of the user's finger is exemplified as the biometric information. However, the present invention is not limited to this, and information such as a vein of the user's hand may be used. There may be. Further, as the user identification information, information composed of numbers, characters, symbols and the like such as passwords other than the biometric information can be listed.

  Further, the portable storage medium is not limited to the IC card M, and may be various memory elements, and the reading means may be either a contact type or a non-contact type.

  FIG. 2 is a block diagram showing an electrical configuration of MFP 100 shown in FIG.

  In FIG. 2, the MFP 100 includes a CPU 1, a ROM 2, a RAM 3, a scanner unit 4, an operation panel unit 5, a storage unit 6, a print unit 7, an external interface unit (external I / F unit) 8, and the like. It has.

  The CPU 1 is a central processing unit that performs overall control of the overall operation of the MFP 100. In particular, in this embodiment, the CPU 1 performs the following control. That is, when the user logs in, the ID information recorded on the IC card M is read via the identification information reading unit 11 and the biometric information (fingerprint) of the user is read via the biometric information reading unit 12. It is determined whether or not the read biometric information matches the biometric information associated with the ID information of the IC card M. If the biometric information matches, the log-in is permitted as the card owner. If they do not match, it is determined whether or not the read biometric information has been registered as biometric information of a user who can use the MFP. If registered, login is permitted, and use of the MFP is permitted within the authority of the owner of the IC card M. In addition, when the logged-in user operates the MFP 100, the CPU 1 executes processing such as recording the user in the operation log as an operation executor.

  The ROM 2 is a memory in which an operation program for the CPU 1 is stored.

  The RAM 3 is a memory that provides a work area when the CPU 1 executes a program.

  The scanner unit 4 reads a document image and outputs image data.

  The operation panel unit 5 includes a key unit having various keys (not shown) and a display unit including an LCD or the like.

  In addition, when the user holds the IC card M over or near the operation panel unit 5, the identification information reading unit 11 that reads ID information from the card M or the living body that reads the user's biological information (fingerprint). An information reading unit 12 is provided.

  The storage unit 6 includes, for example, a hard disk device (HDD), and stores various data, various programs, and the like. In this embodiment, ID information and biometric information of a user who can use MFP 100 are stored and registered in advance in a state where they are associated with each other. For example, as shown in FIG. 4 and FIG. 5, when there is a user A who is the owner of the IC card M and a user B who is lent an IC card from the user A, the ID information of each of the users A and B Biometric information is registered in association with each other.

  The print unit 7 prints image data of a document read by the scanner unit 4, print data transmitted from an external terminal device, document data stored in the storage unit 6, and the like on a sheet, and outputs an image output product. Has the engine function to create.

  The external I / F unit 8 has a function of managing communication with various external devices.

  FIG. 3 is a flowchart showing authentication processing when a user logs in to MFP 100. This process is executed by the CPU 1 of the MFP 100 operating according to an operation program recorded in the ROM 2 or the like.

  When a user who wants to log in to MFP 100 (second user) holds IC card M over a predetermined detection location of MFP 100 and holds a finger over a predetermined detection location for biometric authentication, identification information reading unit 11 is set in step S1. The ID information is read from the IC card through the biometric information reader, and the biometric information of the user is read through the biometric information reading unit 12.

  In step S <b> 2, it is determined whether or not the read ID information is registered in MFP 100. If registered (YES in step S2), the process proceeds to step S3. If not registered (NO in step S2), the process ends without permitting login as an authentication failure in step S6.

  In step S3, whether the biometric information (fingerprint) read from the user's finger matches the biometric information associated with the read ID information, that is, the biometric information of the owner (first user) of the IC card. Judge whether or not. If they match (YES in step S3), the user who is attempting to log in is the owner of the IC card. Therefore, after permitting login (successful authentication) in step S4, the process is terminated.

  In this embodiment, the biometric information of the owner of the IC card M is registered in the storage unit 6 in association with the ID information, and stored in the storage unit 6 with the biometric information of the user who wants to log in. The cardholder's biometric information was compared and verified. However, the cardholder's biometric information may be stored in the IC card M in advance, and the biometric information may be acquired by the MFP 100 and compared. Further, MFP 100 transmits the biometric information of the user who is logging in to IC card M, and IC card M transmits the biometric information of the cardholder stored in the IC card by the OS mounted on the card and the transmission. The biometric information may be compared and collated to determine whether or not they match, and the MFP 100 may obtain the determination result from the IC card and determine whether or not they match based on this result. When the biometric information matches or does not match in the IC card M, the MFP 100 does not need to collate the biometric information, and the processing is simplified accordingly.

  If the biometric information of the user who is logging in does not match the biometric information of the IC card owner (NO in step S3), the process proceeds to step S5, and the biometric information of the user who is logging in is stored. It is determined whether it is registered in the unit 6 in advance.

  If registered (YES in step S5), since the user can use MFP 100, the process advances to step S4 to permit login, and the process ends. If not registered (NO in step S5), the process is terminated without permitting login in step S6 as an authentication failure.

  The above processing will be described more specifically. As shown in FIG. 4, when the user A who is the owner of the IC card M logs into the MFP 100, the biometric information read by the biometric information reading unit 12 is Since it belongs to the user, it matches the biometric information registered in the MFP 100 in association with the ID information read by the identification information reading unit 11 or the biometric information stored in the IC card. Login is permitted when the biometric information matches.

  In this case, the user A has the authority to access his / her own documents 1, 2, 3 and his / her print job stored in the storage unit 6 and print them.

  On the other hand, as shown in FIG. 5, when user B who has been lent an IC card from user A who is the owner of the IC card accesses MFP 100, the biometric information of user B read by biometric information reading unit 12 is Although it does not match that of the user A himself / herself, login is permitted because biometric information of a user who is authorized to use the MFP 100 is registered in advance. In this case, the user A may be permitted to log in, or the user B may be permitted to log in. However, the user A's account is used for the use authority and the number of printed sheets. In other words, the user B who is lent the IC card M from the user A can access and print the user A's documents 1, 2, 3 and the print job, but can access the user B's own document and print job. Can not do it.

  Note that when login as the user B is permitted, an operation message or the like displayed on the operation panel unit 5 is displayed as a message for the user B. Even if login is permitted as user B or login is permitted as user A, the user B who actually performed the operation is recorded as the operation executor as the operation log. Will be. Thereby, when the past operation content is traced based on the operation log, an actual operation executor can be accurately identified and security can be ensured.

  As described above, in this embodiment, even if a user is lent the IC card M from the owner of the IC card M, the user's biometric information is registered as the biometric information of the user who can use the MFP 100. Since the user can be reliably identified, the use of the user who has been lent the card within the range of the use authority of the cardholder is permitted. In addition, since biometric information is used, there is no risk of leakage as in the case of using only a password. Moreover, the troublesome operation of previously registering the ID information and biometric information of the user who can use the IC card M in the IC card M becomes unnecessary.

  FIG. 6 is a schematic configuration diagram showing another embodiment of the present invention. In this embodiment, user ID information and biometric information are registered in the external authentication server 300.

  In FIG. 6, an authentication server 300 is connected to the MFP 100 via the network 200, and ID information and biometric information of a plurality of users including the owner of the IC card M are mutually connected to the authentication server 300. It is stored and registered in association.

  Then, the ID information read from the IC card via the identification information reading unit 11 and the user biometric information read via the biometric information reading unit 12 are transmitted from the MFP 100 to the authentication server 300 via the network 200. The authentication server 300 determines whether or not the user's biometric information matches the cardholder's biometric information and, if not, whether the user's biometric information is registered.

  Based on the authentication result received from authentication server 300, MFP 100 determines whether the user's biometric information matches the cardholder's biometric information, and if not, whether the user's biometric information is registered. It is determined whether or not the user is allowed to log in.

  The MFP 100 acquires the biometric information and the like registered in the server from the authentication server 300, and based on the acquired information, the MFP 100 determines whether the user's biometric information matches the cardholder's biometric information, If they do not match, it may be determined whether or not the user's biometric information is registered, and it may be determined whether or not to allow the user to log in.

  In this way, by registering the user ID information and biometric information in the external authentication server 300, the burden of the memory capacity of the IC card M and the storage capacity of the storage unit 6 of the MFP 100 can be reduced.

  Note that user ID information and biometric information may be stored separately in the external device and the MFP 100.

1 CPU
6 Storage Unit 11 Identification Information Reading Unit 12 Biometric Information Reading Unit 100 MFP
200 Network 300 Authentication server A, B User M IC card

Claims (7)

Identification information reading means for reading the identification information of the first user stored in the portable storage medium;
Biometric information reading means for reading biometric information of a second user who intends to log in;
It is determined whether or not the second user's biometric information read by the biometric information reading means matches the first user's biometric information associated with the identification information read by the identification information reading means. And determining means for determining whether or not the second user's biometric information is registered as the biometric information of the user who can use the image processing device when the biometric information is determined not to match,
In addition to the case where the determination means determines that the biological information of the second user matches the biological information of the first user, the biological information of the second user is not Even if it is determined that it is registered as biometric information, an authentication unit that allows a second user to log in within the range of use authority of the first user;
An image processing apparatus comprising:   The authentication unit permits login as a second user when it is determined that the biological information of the second user is registered as biological information of a user who can use the image processing apparatus. Image processing apparatus.   When it is determined that the biometric information of the second user is registered as biometric information of a user who can use the image processing apparatus, the authentication unit permits login as the first user, but the operation log The image processing apparatus according to claim 1, wherein the second user is recorded as an operation executor. The biometric information of the first user is stored in the portable storage medium,
The determination means determines whether the second user's biometric information is the first user's biometric information based on a result of collation between the first user's biometric information and the second user's biometric information performed in the portable storage medium. The image processing apparatus according to claim 1, wherein the image processing apparatus determines whether the user biometric information matches.   The image processing apparatus according to claim 1, wherein the first user's biometric information and / or the second user's biometric information is stored in an own apparatus or an external apparatus. An identification information reading step of reading the identification information of the first user stored in the portable storage medium;
A biometric information reading step of reading biometric information of a second user who wants to log in by biometric information reading means;
It is determined whether the biometric information of the second user read in the biometric information reading step matches the biometric information of the first user associated with the identification information read in the identification information reading step. In addition, when it is determined that the biometric information does not match, the determination step of determining whether the biometric information of the second user is registered as the biometric information of the user who can use the image processing apparatus;
In the determination step, in addition to the case where it is determined that the biometric information of the second user matches the biometric information of the first user, the biometric information of the second user is the information of the user who can use the image processing apparatus. Even when it is determined that the biometric information is registered, an authentication step for permitting the second user to log in within the range of the authority of the first user;
A user authentication method using an image processing apparatus. An identification information reading step of reading the identification information of the first user stored in the portable storage medium;
A biometric information reading step of reading biometric information of a second user who wants to log in by biometric information reading means;
It is determined whether the biometric information of the second user read in the biometric information reading step matches the biometric information of the first user associated with the identification information read in the identification information reading step. In addition, when it is determined that the biometric information does not match, the determination step of determining whether the biometric information of the second user is registered as the biometric information of the user who can use the image processing apparatus;
In the determination step, in addition to the case where it is determined that the biometric information of the second user matches the biometric information of the first user, the biometric information of the second user is the information of the user who can use the image processing apparatus. An authentication step for permitting the second user to log in within the scope of the first user's use authority even when it is determined that the biometric information is registered;
Is a user authentication program for causing the computer of the image processing apparatus to execute.

Images