Abstract:
The place where a user performs personal authentication includes a room into which entry is authenticated, and an apparatus for use of which authentication input (login and logout) is performed. In such situation, it will take at least a moving time for a user to perform authentication input at a certain location and thereafter to perform authentication input at another apparatus of a different location. Therefore, the present invention provides an authentication-capable apparatus whereby the authentication input by the aforementioned user (the same user) at a different place is inhibited within the aforementioned moving time, thereby preventing “spoofing” by an unauthorized user.

Description:
BACKGROUND OF THE INVENTION  
       [0001]     1. Field of the Invention  
         [0002]     The present invention relates to an authentication-capable apparatus which can authenticate users.  
         [0003]     2. Description of the Related Art  
         [0004]     As this type of authentication-capable apparatus, Japanese Patent Laid-Open No, 11-174920 discloses a digital copying machine in which when a predetermined reference time is exceeded after a keycard is set, it is judged that the set keycard has been left standing for a long period of time, and the keycard is temporarily invalidated inhibiting the use thereof.  
         [0005]     In the Japanese Patent Laid-Open No. 11-174920, since not only the authenticated user, but also another person is allowed to use the apparatus within the reference time, unauthorized uses by an outsider may occur.  
         [0006]     In order to prevent such unauthorized uses, Japanese Patent Laid-Open No. 2006-71684 discloses an authentication-capable apparatus in which when a user, who is authenticated through ID input or card key setting, uses another external apparatus while desectioning from the authentication-capable apparatus, the use of the authentication-capable apparatus is restricted even within a reference time thereby reducing the time period during which unauthorized use or misuse may occur.  
         [0007]     On the other hand, while a user, who has performed authentication input at an authentication-capable apparatus of a certain location, is away from the apparatus, an unauthorized user may steal a user ID or a keycard and may pretend to be the authenticated user to use it without authorization at an apparatus of a different location.  
         [0008]     In such a case, the authentication-capable apparatus according to Japanese Patent Laid-Open No. 2006-71684 has a disadvantage in that an unauthorized user is allowed to use another apparatus, while an authorized user who has made an authentication input is restricted from using the authentication-capable apparatus.  
         [0009]     In view of the above described circumstances, it is an object of the present invention to provide an authentication-capable apparatus which can prevent “spoofing” by unauthorized users, and a security system thereof.  
       SUMMARY OF THE INVENTION  
       [0010]     Specifically, the place where a user performs personal authentication includes a room into which entry is authenticated, and an apparatus for use of which authentication input (login and logout) is performed. In such situation, it will take at least a moving time for a user to perform authentication input at a certain location and thereafter to perform authentication input at another apparatus of a different location. It is intended in the present invention that within this moving time, the authentication input by the aforementioned user (the same user) at another place is inhibited.  
         [0011]     That is, the present invention is characterized in that after authentication input for login of a user is performed at an authentication-capable apparatus based on user information, authentication by the same user at another apparatus is inhibited for a predetermined time.  
         [0012]     According to the above described configuration, it will take at least a moving time for a user to perform authentication input at a certain location and thereafter to perform authentication input at an apparatus of a different location. With the moving time set as a predetermined time period, authentication input at another place by the same user cannot occur. Therefore, if there is authentication input within the predetermined time, it can be judged to be “spoofing” by an unauthorized user and it is possible to inhibit the use of the apparatus, thereby improving security.  
         [0013]     In this case, the authentication-capable apparatus, for example, a digital composite machine, which is connectable with external apparatuses, is characterized by including an authentication section which authenticates a user based on user information to allow the use of the apparatus, a use state confirmation section which confirms the use state of a user at another apparatus, and a use restriction section which, after an authentication input by user at another apparatus is confirmed by the above described use state confirmation section, inhibits authentication input by the same user for a predetermined time period.  
         [0014]     According to the above described configuration, since the use state confirmation section receives the use state of the user at other apparatuses, it is possible to keep track of the use state of the other apparatuses. On account of this, when there is authentication input operation at the own apparatus by the same user, it is judged to be authentication input operation by an unauthorized user if it is within the predetermined time period. Thus, it is possible to inhibit the authentication input (login and logout), thereby restricting the use.  
         [0015]     In a security system in which an authentication-capable apparatus is installed in a room provided with an entry authentication section for authenticating the entry into the room, and in which an entry authentication notification by the entry authentication section can be notified to the authentication-capable apparatus; the time needed for a user, who has been authenticated for entry by the entry authentication section, to move to the apparatus from the entry is set as a predetermined time period, and after an entry authentication of the aforementioned user is input, the authentication at the aforementioned apparatus by the same user is inhibited for the predetermined time period, thereby restricting the use of an unauthorized user.  
         [0016]     The authentication-capable apparatus, which can communicate with the above described entry authentication section, comprises an authentication section which authenticates a user based on user information to allow the use of the apparatus, a receiver section which receives the authentication information at the entry authentication section, and a use restriction section which, after an entry authentication by the receiver section, inhibits the authentication by the same user for a predetermined time period, wherein within the predetermined time period after the user has entered the room and before he/she moves to the authentication-capable apparatus, when there is authentication input by the same user, it is judged to be “spoofing” by an unauthorized user, thereby inhibiting the authentication input. This will improve security.  
         [0017]     Moreover, the measurement of the predetermined time period can adopt various methods such as starting from (a) when a logout operation by a user is performed, (b) when a last input operation by a user is performed, (c) when an instruction operation of job start by a user is detected, and (d) when an operation of job end by a user is detected.  
         [0018]     Further, when the authentication by the same user within the predetermined time period is confirmed, it is possible to further improve security by notifying that to specific other apparatuses (for example, the terminal for the administrator).  
         [0019]     As so far described, according to the present invention, since after authentication input of a user is performed based on user information at an authentication-capable apparatus, the authentication at another apparatus by the same user is inhibited for a predetermined time period, when authentication input is performed within the predetermined time period, it can be judged to be “spoofing” by an unauthorized user so that the use of the apparatuses is inhibited, thereby improving security. 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0020]      FIG. 1  is a security system diagram made up of a composite machine and externally connected apparatuses according to an embodiment of the present invention;  
         [0021]      FIG. 2  shows a user administration table contained in an authentication server and the like;  
         [0022]      FIG. 3  shows a user administration table having room codes and apparatus authentication codes;  
         [0023]      FIG. 4  is a sketch drawing to show a case in which a plurality of authentication-capable apparatuses are installed in two rooms;  
         [0024]      FIG. 5 (A) shows a distance data table between the entrance of the room and each apparatus specified based on the sketch drawing shown in  FIG. 4 ; and  5 (B) shows a time data table to show the time to walk between the entrance of the room and each apparatus;  
         [0025]      FIG. 6  is a plan view to show the operation screen of each apparatus;  
         [0026]      FIG. 7  is a flowchart of authentication processing of the apparatus;  
         [0027]      FIG. 8  is a flowchart of the authentication processing of the apparatus to show from the unlocking to locking of the apparatus;  
         [0028]      FIG. 9  is a flowchart to show an example of the authentication processing in an authentication server;  
         [0029]      FIG. 10  is a flowchart to show an example of another authentication processing in the authentication server; and  
         [0030]      FIG. 11  is an administration table which shows that a different inhibition condition can be set for each user. 
     
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS  
       [0031]     Hereinafter, embodiments of the present invention will be described based on the drawings. The authentication-capable apparatus relating to the present invention will be described by way of an example of a digital composite machine having a plurality of functions; however, the present invention will be applicable to various image processing apparatuses such as, whether or not a digital image processing, a composite machine or a single function machine such as a printer, a copy machine, a scanner, a facsimile machine (FAX), and further to information processing apparatuses including computer, and any apparatus equipped with an authentication function, and a communication function with external apparatuses.  
         [0032]      FIG. 1  shows an example of a system configuration made up of a digital composite machine relating to an embodiment of the present invention, and external connection apparatuses connected to the digital composite machine via a network.  
         [0033]     In  FIG. 1 , reference numeral  1  denotes a digital composite machine as an example of image processing apparatuses,  2  a telephone network,  3  a facsimile machine for the administrator (administrator FAX),  4  a network,  5  an Internet network,  6  an Internet FAX,  7  an external personal computer (external PC),  8  and  9  terminal PCs,  8   a  a keyboard of PC 8 ,  8   b  a mouse of PC 8 ,  9   a  a keyboard of PC 9 ,  9   b  a mouse of PC 9 ,  11  an image reading section,  12  an operation section,  13  an image forming section,  14  an apparatus control section,  15  a FAX modem,  16  a communication section,  17  a hard disk (HD),  18  an erasure processing section,  19  an administration section, and  20  a timer.  
         [0034]     Moreover, the external personal computer (external PC)  8  has a function of an authentication server which manages the information of the user administration table shown in  FIGS. 2 and 3 , and gives an authentication permission of user.  FIG. 2  shows a user administration table in which authentication code information such as “3229”, notification destination information such as “IP address 192.168.XX.XXX”, user information such as “Administrator: Mr. A” and “Planning  1 : Mr. B”, apparatus use status such as “A” and “B”, and inhibition time such as “inhibited” and “non-inhibited” are recorded.  FIG. 3  shows an administration table in which in addition to the administration table of  FIG. 2 , room code information such as “113929” is recorded.  
         [0035]     Furthermore, for the inhibition condition according to the inhibition time of the administration table shown in  FIGS. 2 and 3 , a different condition may be set for each user. Configuration may be such that the inhibition condition can be set by a user and/or an administrator.  FIG. 11  shows an administration table in which the inhibition condition is varied for each user. In  FIG. 11 , the inhibition condition for “Administrator: Mr. A” is set to be, for example, “logout”, and the inhibition condition for “Planning  1 . Mr. B” is set to be, for example, “job end”; thus, the condition setting is varied for each user and/or administrator.  
         [0036]     Further, as shown in  FIG. 1 , the digital composite machine  1  is connected with, for example, the FAX  3  used by the administrator by way of the telephone network  2  and with a plurality of terminal PCs  8 ,  9 , . . . via the network  4  such as a LAN (Local Area Network) and WAN (Wide Area Network); and is further connected to the Internet FAX  6 , the external PC  7  etc. which are outside the network  4 , via the Internet network  5 .  
         [0037]     The digital composite machine  1  is made up of an image reading section  11  an operation section  12 , an image forming section  13 , an apparatus control section  14 , a FAX modem  1 S, a communication section  16 , a HD  17 , an erasure processing section  18 , an administration section  19 , a timer  20 , and the like.  
         [0038]     However, the configuration and the connection form with external apparatuses of the digital composite machine  1  relating to the present invention are not limited to this example, and may be any configuration which is connected with any external apparatus and comprises each section of the present invention described below. The each section described below is not necessarily made up of hardware and may be readily implemented by installing a program, which causes the authentication-capable apparatus such as the digital composite machine  1  to function as the section thereof, in a control section such as the apparatus control section  14  etc. so as to be executed by an arithmetic unit.  
         [0039]     The operation section  12  is made up of such as a touch panel which comprises a display section  12   b  for displaying an operation screen, and an input section  12   a  for allowing the user to input various settings based on the display.  
         [0040]     The image reading section  11  detects the presence and absence of a document by means of a document detection sensor l 1   b  based on the operation at the operation section  12 , and reads the document by means of a CCD (Charged-Coupled Device)  11   a  to output it as image data.  
         [0041]     The FAX modem  15  is a modem for performing facsimile communication with the administrator FAX  3 . The communication section  16  controls the communication of the digital composite machine  1  with external apparatuses connected via the network  4 .  
         [0042]     The image forming section  13  temporarily stores the image data read at an image reading section  11  and reception data received at the FAX modem  15  or the communication section  16 , and forms an image on the medium such as paper etc. from a printing section  13   a  equipped with a laser scanner unit (LSU).  
         [0043]     In the image forming section  13 , it is possible to encrypt data such as image data stored in a memory  13   b , at an encryption processing section  13   c  to store them in a HD  17 ; and conversely to decrypt the encrypted data stored in the HD  17  and outputs them to external apparatuses through the memory  13   b  via the network  4  or to print out them as medium at the printing section  13   a.    
         [0044]     The erasure processing section  18  performs the processing to erase the data stored in the HD  17  for maintaining security and securing a storage capacity.  
         [0045]     The apparatus control section  14 , which is a main control section connected to each section described above, centrally controls the operation of the digital composite machine  1  including the exchange of data between each section of the digital composite machine  1  while referring to the administration data from the administration section  19  and the timer time from the timer  20 .  
         [0046]     The administration section  19  may administer the user administration table of  FIGS. 2 and 3  and the IP address of the own machine  1 .  
         [0047]     The timer  20  clocks the time in a stand-by state of the digital composite machine  1 , and notify the time to the apparatus control section  14 . Taking an example of control in the apparatus control section  14 , the operation section  12  notifies a copy request instructed by the operation input of the user and various recording conditions to the apparatus control section  14 , and the apparatus control section  14  displays the operation state etc. of the digital composite machine  1  on the display screen of the display section  12   b  of the operation section  12  and gives instruction of printing processing etc. to the image forming section  13 .  
         [0048]     As so far described, the digital composite machine  1  is provided in the operation section  12 , with an input section  12   a  and a display section  12   b , and can perform ID input as well as function instruction operation of the digital composite machine  1 . In addition to the ID input, an ID card reader which is input with an ID card and reads the information thereof may be provided in the digital composite machine  1 .  
         [0049]      FIG. 6  is a plan view to show the operation section  12 . The operation section  12  is provided with an input section  12   a  and a display section  12   b . The input section  12   a  has a key, a user setting key, a ten-key, a clear key, a start key, an authentication key, etc. for setting a copy mode, a printer mode, a scanner mode, a facsimile mode, etc. Moreover, the input section  12   a  includes a transparent touch panel which is provided in superposition on the display section  12   b . By operating this touch panel, it is possible to selectively operate the key displayed on the display section  12   b . The input instructions through the operation of these keys are notified to the apparatus control section  14 . Further, the display content in the display section  12   b  in  FIG. 6  is that of an initial state.  
         [0050]     The digital composite machine  1  relating to the present invention is provided with any type of authentication section to be operated by means of an authentication key etc. The authentication section may be any one which authenticates the user based on user information to allow the use of the own machine  1 . The digital composite machine  1  first limits users by means of this authentication section. Further, in the digital composite machine  1 , two-way data communications is performed with external apparatuses (PC terminals etc.) by means of the communication section  16 . The digital composite machine  1  relating to the present invention is supposed to comprise any type of communication section such as described above.  
         [0051]     Further, the digital composite machine  1  comprises a use state confirmation section which confirms the use state by the user of an external apparatus connected to the digital composite machine  1 , and a use restriction section which restricts the use of the digital composite machine  1  when use of the external apparatus by this user is confirmed.  
         [0052]     Here, the term “restriction” may be predetermined appropriately depending on the use state of the present invention, such as to mean the cancellation of authentication and the use restriction of a specific function.  
         [0053]     Moreover, as a further embodiment of the present invention, the use state confirmation section preferably comprises an authentication notification section and a use state receiver section as described below. The authentication notification section notifies to external apparatuses (basically all of such external apparatuses) which are available for the user and are externally connected, of the authentication information which shows that the user authenticated by the authentication section has been authenticated. Upon notification, notification destination of external apparatuses which are available for the user and are externally connected, may be set in advance corresponding to the user information in the digital composite machine  1 .  
         [0054]     After the notification by the authentication notification section, the use state receiver section receives the information indicating that the external apparatus has been used by the user, as the information indicating the external apparatus uses.  
         [0055]     The method of reception may be to access the external apparatus to acquire information or to simply receive the information transmitted from the external apparatus.  
         [0056]     Further, the information indicating that the apparatus has been used may be judged from the state such as the driving state of the external apparatus. For example, when the external apparatus is a PC, judgment may be made from a serviceability ratio of CPU, an event that the screen saver being activated becomes deactivated, or a signal resulting from the actuation of various input devices such as a keyboard and a mouse.  
         [0057]     Further, in the digital composite machine  1 , after authentication input by a user at another apparatus is confirmed by the use state confirmation section, the use restriction section inhibits the authentication of the same user for a predetermined time period to prevent the spoofing by an unauthorized user.  
         [0058]     The measurement of the predetermined time may start at various timing such as starting from a) when a logout operation by a user is performed, b) when a last input operation of a user is performed, c) an instruction operation of job start by a user is detected, d) when an operation of job end by a user is detected, and so on.  
         [0059]     Further, the digital composite machine  1  is communicably connected with an entry authentication section for authenticating the entry into a room, it receives authentication information at the entry authentication section from the receiver section, and the use restriction section inhibits the authentication by the same user for the predetermined time period after the entry authentication. The predetermined time period in this case can be set corresponding to the moving time of the user from the entrance to the own apparatus.  
         [0060]      FIG. 4  is a sketch drawing to show a case in which a plurality of authentication-capable apparatuses are installed in two rooms. In a first room, four authentication-capable apparatuses A to D are sparsely disposed. In a second room, two authentication-capable apparatuses E and F are sparsely disposed. At the entrance of each room, an entry authentication sections G 1 , G 2  are provided. When authentication of a user by the entry authentication sections G 1 , G 2  is finished, the door at the entrance is automatically opened or the door lock is released.  
         [0061]      FIG. 5 (A) is a distance data table between the entrance of the room and each apparatus, which are specified based on the sketch drawing shown in  FIG. 4  and expressed in meters. For example, the distance from the entrance G 1  of the first room to the apparatus A is 25 m, the distance from the entrance G 1  to the apparatus B is 110 m, and the distance from the entrance G 1  to the apparatus D is 210 m. The distance between the apparatus A and the apparatus B is 100 m.  
         [0062]      FIG. 5 (B) is a time data table to show the moving times when walking from the entrance of the room to each apparatus Supposing the walking speed of a human to be 4 km per hour, since it is converted to 1.1 m/sec, the moving time can be calculated from the distance table of  FIG. 5 (A). For example, the time needed to move from the entrance G 1  to the apparatus A is 22.5 sec, and the time needed to move from the entrance G 1  to the apparatus B is 99 sec.  
         [0063]     Based on the administration table of  FIG. 5 (B), a predetermined time is specified. That is, at the apparatus A, authentication information is received from the entry authentication section G 1 , and even if there is authentication input by the same user within a predetermined time period (for example, 22.5 seconds) after the entry authentication is performed, this is invalidated, thereby preventing “spoofing” of an unauthorized user.  
         [0064]     Further, the security of the digital composite machine  1  can further be improved by providing a notification section which, when another authentication by the same user is confirmed within a predetermined time period, notifies that to other specific apparatuses (for example, the apparatus A, when the apparatus A is a PC for administrator).  
         [0065]     Next, the security system according to the above described authentication function will be described based on the flowchart shown in FIGS.  7  to  10 . First, the processing in an apparatus is to be stand-by, as shown in  FIG. 7 , until there is an authentication operation by a user such as authentication key input by a user. When there is an authentication operation by a user, the apparatus requests the confirmation of the user authentication to the authentication server. The authentication server verifies the user authentication against the user information stored and notifies the authentication result back to the apparatus. When the authentication result is a use permission notification, the process moves to  FIG. 8  and the apparatus is unlocked. And the authentication result is a use non-permission notification, the use of the apparatus is restricted.  
         [0066]      FIG. 8  is a flowchart to show from the unlocking of the apparatus to the locking of the apparatus. When the apparatus is unlocked, an image processing condition is input and an instruction of starting the image processing operation is performed to start the image processing operation. The use state at this moment is notified to the authentication server. After the start of image processing operation, when the image processing operation is finished, the process is on stand-by until an authentication key of a user is input, and when an authentication key of a user is input, the end of processing is notified to the authentication server and the apparatus is locked, thereby terminating the processing.  
         [0067]      FIG. 9  is a flowchart to show an example of the authentication processing in an authentication server. In this example, when there is an authentication inquiry of a user in the authentication server, it is searched whether or not the user is registered from the user code etc., and when the user is unregistered, that is notified to the administrator (PC), and a non-permission of use of the apparatus is notified to the apparatus.  
         [0068]     When the user is registered, it is searched whether or not the same user is using any other apparatus, and when using, that is notified to the terminals of the administrator and/or the user and non-permission of use of the apparatus is notified. When the same user is not using any other apparatus, it is judged whether or not it is within the inhibition time.  
         [0069]     The inhibition time is a predetermined time after authentication input for login of a user is performed at another apparatus. The measurement of the predetermined time may start at various timing such as starting from a) when a logout operation by a user is performed, b) when a last input operation of a user is performed, c) an instruction operation of job start by a user is detected, d) when an operation of job end by a user is detected, and so on.  
         [0070]     Further, as shown in  FIG. 8 , since the input operation of each user etc. is notified to the authentication server, this will allow the use state of the apparatus to be confirmed.  
         [0071]     When, in the digital composite machine  1 , a use by the same user at another apparatus within the predetermined time period (inhibition time) is confirmed, that is notified to the terminals of the administrator and/or the user, and notification of non-permission of use of the apparatus is performed. When the user is not using another apparatus within the predetermined time period, permission of use of the apparatus is notified.  
         [0072]      FIG. 10  is a processing flowchart of an authentication server in a security system which is communicably connected to an entry authentication section for authenticating the entry into a room. As shown in  FIG. 10 , the process is on stand-by until a notification of entry authentication of a user is received, and when the notification is received, the process is further on stand-by until there is an inquiry of the authentication of a user at an apparatus. When there is an inquiry of authentication of a user, it is confirmed whether or not the user is registered; and when unregistered, that is notified to the administrator PC and non-permission of use of the apparatus is notified.  
         [0073]     When the user is registered, then it is judged whether or not entry authentication has been performed. When the apparatus and the room into which entry authentication is performed are in the same place, it is judged whether the predetermined time period is exceeded by the time period from when the entry authentication is performed to when the inquiry of authentication is performed.  
         [0074]     When the predetermined time period is exceeded, permission of use of the apparatus is notified to allow the use of the apparatus. When the entry authentication has not been performed, and when the room into which entry authentication has been performed and the apparatus are not in the same place, and when the time needed to move to the apparatus from when entry authentication is performed is within an inhibition time, since it is highly likely to be spoofing by an unauthorized user, this is notified to the user and/or the administrator PC and the processing to inhibit the use of the apparatus is performed.  
         [0075]     In this way, since after the authentication input of login of a user is performed at the authentication-capable apparatus, the authentication by the same user at another apparatus is inhibited for a predetermined time period, if there is authentication input during the predetermined time period, it is judged to be “spoofing” by an unauthorized user, thereby inhibiting the use of the apparatus to improve the security.