JP4899461B2 - Usage restriction management apparatus, method, program, and system - Google Patents

Description

  The present invention relates to a use restriction management apparatus, method, program, and system for restricting use of a plurality of image forming apparatuses.

  Currently, in offices, OA devices such as personal computers (hereinafter referred to as PCs), printers, copiers, facsimiles, and multi-function machines integrating these are commonly used via a network. For example, when a printer is shared by a plurality of personal computers, it can also be used by a printer managed by another department connected to the network.

  However, it is not preferable from the viewpoint of security that all users can use all functions such as a printer, a copy, a scanner, and a facsimile without limitation in such a multifunction machine. For example, depending on the department to which the user belongs and the job title of the user, it may be necessary to limit the use of the multifunction device itself or to limit available functions.

  Therefore, a technique that can easily enhance the security function has been proposed (see, for example, Patent Document 1). In Patent Document 1, the image forming apparatus previously registers a user code for identifying a user. User service related to image formation processing by the user based on the user database, the operation panel for inputting the user code when the image forming apparatus is used, and the user code of the user database and the input user code A secure application that determines whether or not to provide an SCS, and an SCS that transmits a key event acquired from the operation panel to the secure application.

  As a result, the image forming apparatus can be used by the secure application based on the user code registered in the user database and based on the usage authority registered in the user database. Restrict functions.

  In addition, an information device network system has been proposed in which user information is confirmed by each device on a server, thereby reducing time loss in user information management (see, for example, Patent Document 2).

In Patent Document 2, when using a complex office device, a message prompting the user name is displayed on the LCD, and the operator waits until a card containing the user name is inserted. When the user name is input by the card, a message prompting the operator to input a password is displayed on the LCD. Then wait until the password is entered. When a password is entered, user data is created by adding the machine name to the user name and password, and the user data is transmitted to the multi-function office device registered as a server via the network. When the response is received from the server and the access permission data is received, the operator performs an operation desired by the operator using the LCD and Keys.
Japanese Patent No. 3655303 JP 2000-20471 A

  However, in the case of Patent Document 1, it is necessary to set a user for each image forming apparatus. When a plurality of image forming apparatuses are targeted, it is necessary to maintain user restriction information for each image forming apparatus. It becomes a problem in terms of information management.

  In the case of Patent Document 2, there is the following problem when user information is managed by a plurality of different external authentication services. When the restriction information is complicated including the upper limit information, the information holding structure is different for each external authentication service. Therefore, it is necessary to support a plurality of external authentication services for each device, and there are problems in terms of development man-hours and costs.

  The present invention has been proposed to solve the above-described problems, and provides a use restriction management apparatus, method, program, and system that can easily restrict use of a plurality of image forming apparatuses without incurring costs. The purpose is to provide.

The use restriction management device according to the present invention includes a restriction information storage unit that stores restriction information that represents a use restriction of a service providing device for each user, a receiving unit that receives user information input in the service providing device, and a user The internal user information storage means for storing the internal user information of the internal user who is not authenticated by the authentication device, and the authentication based on the user information accepted by the accepting means A determination unit that determines whether to perform authentication by the device and whether to authenticate by the internal user information without performing authentication by the authentication device; and when the determination unit determines to perform authentication by the authentication device, The user information received by the receiving means is transmitted to the authentication device to determine whether the user has a legitimate authority. When there is a response from the inquiry means for making an inquiry and that the user has a legitimate authority from the authentication device, the restriction information of the user is read from the restriction information storage means and based on the read restriction information When it is determined by the first transmitting unit that transmits information to the service providing apparatus and the internal unit information is authenticated by the determining unit, the same user information as the user information received by the receiving unit is A determination unit that determines whether or not the internal user information storage unit stores the information, and when the determination unit makes an affirmative determination, the restriction information of the internal user is read out from the restriction information storage unit and read out. Second transmission means for transmitting information based on the restriction information to the service providing apparatus.

  The service providing apparatus refers to a device that provides various processes (services) such as document data processing such as copying, scanning, facsimile transmission / reception, image processing, and printing. The restriction information stored in the restriction information storage means represents available service providing apparatuses and usage restrictions on the service providing apparatuses for each user. An available service providing device refers to a service providing device that can be used by a predetermined user. The use restriction of the service providing device refers to use restriction of a part or all of the functions of the service providing device.

If the user information received by the receiving unit is user information to be authenticated by the authentication device , the inquiry unit transmits the user information received by the receiving unit to the authentication device, and whether the user has a legitimate authority Ask about whether or not. The authentication device responds to this inquiry.

The first transmission means reads the restriction information of the user from the restriction information storage means when there is a response from the authentication device that the user has a valid authority, and based on the read restriction information Information is transmitted to the service providing apparatus. When authentication is performed using the internal user information, the determination unit determines whether the same user information as the user information received by the reception unit is stored in the internal user information storage unit. When the determination unit makes an affirmative determination , the second transmission unit reads the restriction information of the internal user from the restriction information storage unit and transmits information based on the read restriction information to the service providing apparatus.

  Thereby, the use restriction management device can easily manage the use restriction of the service providing device. The present invention is also applicable to a usage restriction management method and program.

In addition, the use restriction management system according to the present invention includes a service providing apparatus including an input unit for inputting user information, and a restriction information storage unit that stores restriction information that represents the use restriction of the service providing apparatus for each user. Receiving means for receiving user information input in the service providing device, and internal user information for storing internal user information of an internal user who is not authenticated by the authentication device as to whether or not the user has a legitimate authority A determination unit that determines whether to perform authentication by the authentication device and whether to authenticate by the internal user information without performing authentication by the authentication device, based on user information received by the reception unit; when performing the authentication by the authentication device determined by the determining means, the user information accepted by the accepting means Is transmitted to the authentication device, and inquiry means for inquiring whether or not the user has a legitimate authority, and when there is a response from the authentication apparatus that the user has the legitimate authority The first restriction means for reading the restriction information of the user from the restriction information storage means, and transmitting information based on the read restriction information to the service providing apparatus, and authenticating with the internal user information by the determination means If it is determined, a determination unit for determining whether or not the same user information as the user information received by the reception unit is stored in the internal user information storage unit, and an affirmative determination is made by the determination unit. If the, said from the restriction information storage means reads restriction information of the internal users, said information based on the read restriction information service Hisage A use restriction management device comprising: a second transmission means for sending to the device, wherein the service providing device provides a service according to the use restriction indicated by the restriction information transmitted from the use restriction management device. It is characterized by that.

  Therefore, according to the above invention, the use restriction management apparatus can easily manage use restrictions of a plurality of service providing apparatuses.

  The present invention can easily manage use restrictions of a plurality of service providing apparatuses.

  Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings.

[First Embodiment]
FIG. 1 is a block diagram showing a configuration of a usage restriction management system according to an embodiment of the present invention. The usage restriction management system includes a plurality of multifunction peripherals 10A, 10B, and 10C having copy, facsimile, and scanning functions, a usage restriction management device 20 that manages usage restrictions of each multifunction peripheral, and a plurality of users that perform user authentication. External authentication servers 30A and 30B. Hereinafter, when any one of the multifunction peripherals 10A, 10B, and 10C is indicated, it is simply referred to as “multifunction peripheral 10”. Similarly, when any one of the external authentication servers 30A and 30B is indicated, it is simply referred to as “external authentication server 30”.

  FIG. 2 is a block diagram illustrating a configuration of the multifunction machine 10. The multifunction device 10 scans an image recorded on a document, records an electrostatic latent image on a photoconductor, develops the electrostatic latent image using monochrome toner or color toner, and records the developed image. A printer unit 12 that transfers and outputs a facsimile message and a facsimile (hereinafter referred to as “FAX”) unit 13 that transmits and receives a facsimile message are provided.

  The multi-function device 10 further includes a controller 14 that controls the whole, a memory 15 that stores image data read by the scanner unit 11, image data received via a network, data of a FAX reception message, and the like, and an icon. A control panel 16 that displays an operation screen and inputs operation information in response to contact with an icon, an input / output port 17 for inputting / outputting data, and a communication control unit 18 for communicating with devices connected to a network. And.

  The scanner unit 11, the printer unit 12, the FAX unit 13, the controller 14, the memory 15, the control panel 16, and the input / output port 17 are connected to each other via a bus. The input / output port 17 is connected to the network via the communication control unit 18.

  In addition to the above, the memory 15 stores restriction information for restricting the functions of the multifunction machine 10. For example, when the restriction information is stored in the memory 15, the controller 14 controls the scanner unit 11, the printer unit 12, and the FAX unit 13 according to the restriction information.

  The user's account name and password are input to the control panel 16 when logging in. These pieces of information are transmitted to the usage restriction management apparatus 20 via the input / output port 17 and the communication control unit 18.

  The usage restriction management device 20 transmits the user ID and password transmitted from the multifunction device 10 to the external authentication server 30, and transmits restriction information regarding the user authenticated by the external authentication server 30 to the multifunction device 10.

  Specifically, the usage restriction management device 20 includes a first interface 21 that is an interface for connecting to each MFP 10 via a network, a restriction information setting unit 22 that sets restriction information, and restriction information. A restriction information storage unit 23 for storing, an authentication management unit 24 for performing overall control of the apparatus, an internal user information setting unit 25 for setting internal user information, an internal user information storage unit 26 for storing internal user information, And a second interface 27 for connecting to each external authentication server via a network.

  The restriction information setting unit 22 stores, in the restriction information storage unit 23, restriction information indicating a multifunction device that can be used for each user and a function that can be used by the multifunction device.

  FIG. 3 is a diagram illustrating the restriction information stored in the restriction information storage unit 23. According to FIG. 3, the user A can use color copying, black and white copying, and scanning for the multifunction peripherals 10A and 10B, but cannot use fax millimeters. The copy value of user A so far is 500 sheets, and user A can copy up to 1000 sheets, the copy upper limit value. User B can use monochrome copying and facsimile for the multifunction peripherals 10A and 10C, but cannot use scanning. Note that the actual copy value of user B so far is 100, and user B has no copy upper limit.

  The authentication management unit 24 makes an inquiry to the external authentication server 30 about the validity of the user, and performs control to transmit restriction information about the user who is authenticated as valid to the multifunction device 10. The authentication management unit 24 also performs authentication for a user (for example, a temporary user) that cannot be authenticated by the external authentication server 30.

  The internal user information setting unit 25 sets user information (for example, an account name and password) of a user who cannot be authenticated by the external authentication server 30 (hereinafter referred to as “internal user”) in the internal user information storage unit 26. Therefore, the internal user information storage unit 26 stores user information for each internal user.

  The external authentication server 30 authenticates whether or not the user who has logged into the multifunction machine 10 is valid. The external authentication server 30 has a user information storage unit (not shown) that stores user information (for example, account name and password) for each user. The external authentication server 30 determines whether the user information exists in the user information storage unit when the user restriction is transmitted from the use restriction management device 20 and the user is inquired. If it is valid and does not exist, it is determined that the user is not valid.

  The usage restriction management system configured as described above manages usage restrictions for each user as follows.

  For example, when the user A inputs user information (account name and password) to the control panel 16 of the multifunction device 10 </ b> A, the multifunction device 10 </ b> A transmits the user information to the use restriction management apparatus 20.

  FIG. 4 is a flowchart illustrating a processing procedure of the authentication management unit 24 of the usage restriction management device 20. The authentication management unit 24 restricts the use of the multifunction peripheral 10 by performing the following processing.

  In step S1, the authentication management unit 24 of the usage restriction management apparatus 20 stands by until user information is input to the first interface 21, and when detecting that user information has been input, proceeds to step S2.

  In step S2, the authentication management unit 24 determines which of the external authentication servers 30A and 30B is to be inquired based on the input user information or whether to authenticate with the internal user information without making an inquiry to the external authentication server. (In this case, the external authentication server 30A is determined). For example, as a determination method, the authentication server to be inquired may be determined from the input account name format such as “Last name-Name”, “Last name.Name”, “Employee number”, or the like. Then, the authentication management unit 24 transmits user information to the external authentication server 30A via the second interface 27, inquires about the validity of the user A indicated by the user information, and proceeds to step S3. Here, both external authentication servers 30A and 30B may be inquired.

  In step S3, the authentication management unit 24 receives an inquiry result from the external authentication server 30A via the second interface 27, determines whether or not the user A is valid, and if so, step S4. If it is not valid, go to step S5.

  For internal users who are not authenticated by the external authentication server 30, the authentication management unit 24 performs the following processing instead of steps S2 and S3 described above.

  In other words, the authentication management unit 24 determines whether or not the same internal information as the user information input in step S1 is stored in the internal user information storage unit 26. If the determination is affirmative, the user A is valid. The process proceeds to step S4. If the determination is negative, it is determined that the user A is not valid and the process proceeds to step S5.

  In step S <b> 4, the authentication management unit 24 reads the restriction information of the user A from the restriction information storage unit 23, transmits this restriction information to the MFP 10 </ b> A via the first interface 21, and ends the process.

  At this time, the restriction information of the user A transmitted from the use restriction management apparatus 20 is input to the memory 15 via the communication control unit 18 of the multifunction machine 10A. Then, the controller 14 controls as follows according to the restriction information stored in the memory 15.

  For example, when there is a user A instruction from the control panel 16, the controller 14 can control the scanner unit 11 or control the color copy by the printer unit 12 according to the instruction, but does not control the FAX unit 13. That is, the MFP 10A can perform scanning and color copying, but cannot perform facsimile. Further, when the copy performance value of the user A reaches the copy upper limit value, the multifunction machine 10A controls the copy so that it cannot be used.

  On the other hand, in step S <b> 5, the authentication management unit 24 transmits an error indicating an authentication failure to the multifunction peripheral 10 </ b> A via the first interface 21 and ends the process. As a result, the multifunction device 10A cannot be used by the user A.

  As described above, the usage restriction management device 20 stores the usage restrictions for each user in advance, and transmits the restriction information to the MFP 10 used by the authenticated user after user authentication. The user's use of the multifunction device 10 can be managed.

  In addition, even if there are a large number of multifunction machines 10, the operator only needs to set restriction information only in the use restriction management apparatus 20. As a result, even when the multifunction device 10 is added, it is possible to reduce the man-hours and costs for setting usage restrictions on the multifunction device 10.

  In addition, since the usage restriction management device 20 can register temporary users who do not want to be registered in the external authentication server 30 as internal users, the usage restrictions are set for temporary users as well. A plurality of multifunction peripherals 10 can be shared.

[Second Embodiment]
Next, a second embodiment of the present invention will be described. In addition, the same code | symbol is attached | subjected to the site | part same as 1st Embodiment, and the detailed description is abbreviate | omitted. The use restriction management system according to the second embodiment is obtained by adding a biometric information input unit (not shown) to the multifunction machine 10 according to the first embodiment.

  In the present embodiment, the user inputs an account name, a password, and biometric information (for example, a fingerprint in the present embodiment) to the multifunction device 10 at the first login. The multifunction device 10 stores the input account name, password, and fingerprint combination in the storage unit, and transmits only the account name and password to the usage restriction management apparatus 20.

  When the account name and password are transmitted from the multifunction device 10, the usage restriction management device 20 transmits the restriction information to the multifunction device 10 by executing the processing from step S 1 to step S 5 shown in FIG. 4 described above. As a result, usage restrictions are set in the multifunction machine 10.

  In the second and subsequent logins, the user inputs only the fingerprint through the biometric information input unit of the multifunction machine 10. The multifunction device 10 transmits the account name and password corresponding to the input fingerprint to the usage restriction management device 20. Note that the multifunction device 10 deletes the combination of the account name, password, and biometric information after a certain period.

  As described above, in the second embodiment, the multifunction machine 10 stores the account name, password, and biometric information input at the first login, and the biometric information is input at the second and subsequent logins. Then, the account name and password corresponding to the biometric information are transmitted to the use restriction management device 20. Thereby, the multifunction machine 10 can omit the input of the account name and the password while ensuring the security in the second and subsequent logins, so that the convenience of the user can be improved.

  It should be noted that the present invention is not limited to the first and second embodiments, but can be applied to those modified in design within the scope described in the claims. Of course. For example, in the second embodiment, the biological information is not particularly limited as long as it is user-specific information obtained from the user's human body, and may be, for example, a palm vein or an iris in addition to the fingerprint.

It is a block diagram which shows the structure of the use restriction management system which concerns on embodiment of this invention. 1 is a block diagram illustrating a configuration of a multifunction machine. It is a figure which shows the restriction | limiting information memorize | stored in the restriction | limiting information storage part. It is a flowchart which shows the process sequence of the authentication management part of a use restriction management apparatus.

Explanation of symbols

10, 10A, 10B, 10C MFP 20 Usage restriction management device 21 First interface 22 Restriction information setting unit 23 Restriction information storage unit 24 Authentication management unit 25 Internal user information setting unit 26 Internal user information storage unit 27 Second interface 30, 30A, 30B External authentication server

Claims (8)

Restriction information storage means for storing restriction information representing the use restriction of the service providing apparatus for each user;
Accepting means for accepting user information input in the service providing device;
An internal user information storage means for storing internal user information of an internal user who is not authenticated by the authentication device as to whether or not the user has a legitimate authority;
A determination unit for determining whether to perform authentication by the authentication device based on user information received by the reception unit and whether to perform authentication by the internal user information without performing authentication by the authentication device;
When the determination unit determines to perform authentication by the authentication device, the user information received by the reception unit is transmitted to the authentication device to inquire whether the user has a valid authority. Inquiry means;
When there is a response from the authentication device that the user has a legitimate authority, the restriction information storage unit reads the restriction information of the user, and provides the service with information based on the read restriction information. First transmission means for transmitting to the device;
When it is determined by the determining means to authenticate with the internal user information, it is determined whether or not the same user information as the user information received by the receiving means is stored in the internal user information storage means. A determination means;
A second transmission unit that reads the restriction information of the internal user from the restriction information storage unit and transmits information based on the read restriction information to the service providing apparatus when an affirmative determination is made by the determination unit;
Use restriction management device comprising: The usage restriction according to claim 1 , wherein the first transmission unit transmits an error signal to the service providing apparatus when a response is received from the authentication apparatus that the user does not have a valid authority. Management device. A reception process for receiving user information input in the service providing device;
A determination step for determining whether to perform authentication by an authentication device based on the received user information and whether to perform authentication by the internal user information without performing authentication by the authentication device;
An inquiry step for transmitting the received user information to the authentication device and inquiring whether or not the user has a legitimate authority when it is determined to perform authentication by the authentication device ;
When there is a response from the authentication device that the user has a legitimate authority, from the restriction information storage unit that stores restriction information representing the use restriction of the service providing device for each user, the user A first transmission step of reading the restriction information and transmitting information based on the read restriction information to the service providing device;
Internal user information storage for storing internal user information of an internal user who is not authenticated by an authentication device as to whether or not the user has a legitimate authority when it is decided to authenticate with the internal user information A determination step of determining whether or not the same user information as the received user information is stored in the section;
A second transmission step of reading the restriction information of the internal user from the restriction information storage unit and transmitting information based on the read restriction information to the service providing apparatus when an affirmative determination is made in the determination step;
A usage restriction management method. The use according to claim 3 , further comprising a third transmission step of transmitting an error signal to the service providing apparatus when a response is received from the authentication apparatus that the user does not have proper authority. Limit management method. On the computer,
A reception process for receiving user information input in the service providing device;
A determination step for determining whether to perform authentication by an authentication device based on the received user information and whether to perform authentication by the internal user information without performing authentication by the authentication device;
An inquiry step for transmitting the received user information to the authentication device and inquiring whether or not the user has a legitimate authority when it is determined to perform authentication by the authentication device ;
When there is a response from the authentication device that the user has a legitimate authority, from the restriction information storage unit that stores restriction information representing the use restriction of the service providing device for each user, the user A first transmission step of reading the restriction information and transmitting information based on the read restriction information to the service providing device;
Internal user information storage for storing internal user information of an internal user who is not authenticated by an authentication device as to whether or not the user has a legitimate authority when it is decided to authenticate with the internal user information A determination step of determining whether or not the same user information as the received user information is stored in the section;
A second transmission step of reading the restriction information of the internal user from the restriction information storage unit and transmitting information based on the read restriction information to the service providing apparatus when an affirmative determination is made in the determination step;
Use restriction management program to execute. A service providing apparatus comprising an input means for inputting user information;
Restriction information storage means for storing restriction information representing the use restriction of the service providing apparatus for each user, accepting means for receiving user information input in the service providing apparatus, and whether the user has a valid authority Whether internal user information storage means for storing internal user information of internal users who are not authenticated by the authentication apparatus, and whether the authentication apparatus performs authentication based on the user information received by the reception means and the authentication A determination unit that determines whether to perform authentication with the internal user information without performing authentication by a device; and, when the determination unit determines to perform authentication by the authentication device , user information received by the reception unit Inquiry means for transmitting to the authentication apparatus and inquiring whether or not the user has a legitimate authority When the authentication device responds that the user has a legitimate authority, the user's restriction information is read from the restriction information storage means, and information based on the read restriction information is sent to the service. When it is determined by the first transmission unit that transmits to the providing device and the internal user information to be authenticated by the determination unit, the same user information as the user information received by the reception unit is the internal user information. A determination unit that determines whether or not the information is stored in the storage unit; and when the determination unit makes an affirmative determination, the restriction information of the internal user is read from the restriction information storage unit and is based on the read restriction information A second transmission means for transmitting information to the service providing device, and a use restriction management device comprising:
The service provision management system according to claim 1, wherein the service provision device provides a service in accordance with a use restriction indicated by restriction information transmitted from the use restriction management device. The usage restriction according to claim 6 , wherein the first transmission unit transmits an error signal to the service providing apparatus when there is a response from the authentication apparatus that the user does not have a valid authority. Management system. The service providing apparatus includes a storage unit that stores biometric information together with user information, a biometric information input unit that inputs biometric information, and a transmission unit that transmits user information corresponding to the biometric information input by the biometric information input unit. And comprising
The usage restriction management system according to claim 6 or 7 , wherein the authentication device authenticates a user based on user information transmitted from the service providing device.

Images