Patent Publication Number: US-9892243-B2

Title: Information processing apparatus, information processing method and non-transitory computer readable medium

Description:
BACKGROUND OF THE INVENTION 
     1. Field of the Invention 
     The present invention relates to an information processing apparatus, an information processing method, and a non-transitory computer readable medium and, more particularly, to authentication of a user. 
     2. Description of the Related Art 
     When performing user authentication between information processing apparatuses connected to a network, a user password converted by a hash function is often used for authentication. As the hash function to be used, there exist hash functions of different security strengths such as MD4 (Massage Digest Algorithm 4), MD5, and SHA1 (Secure Hash Algorithm 1). The hash function to be used changes depending on the authentication protocol. For example, MD4 is used in NTLM (Windows NT LAN Manager) authentication, and SHA1 is used in SNMPv3 (Simple Network Management Protocol version 3). As the password storage method in an information processing apparatus, a hashed password is often stored. Japanese Patent Laid-Open No. 2011-199718 proposes a method of integrating two hash protocols. 
     However, if an unhashed password is stored, and hashing is performed in every authentication considering an increase in the number of usable hash functions, the user database need not be extended, and adding hash functions suffices. Note that an unhashed password is normally stored after encrypting a key managed by an information processing apparatus. 
     When user information including password information is commonly used in an environment where a plurality of information processing apparatuses exist, the user information needs to be synchronized. At this time, when user information is shifted from an information processing apparatus as a reference source that manages a hashed password to an information processing apparatus that manages an unhashed password, the password cannot be returned to the state before hashing because the hash function is a one-way function (irreversibility). As a result, a state in which the user information cannot be synchronized may occur between the information processing apparatuses using different password management methods. In this case, the user needs to shift the password in each information processing apparatus, resulting in heavy load. 
     SUMMARY OF THE INVENTION 
     According to one aspect of the present invention, there is provided an information processing apparatus comprising: storage unit configured to store a first converted value converted by a one-way function in association with user identification information; input unit configured to receive, from a user, input of the user identification information and authentication information; holding unit configured to hold the authentication information input by the user using the input unit; authentication unit configured to execute user authentication by converting, by the one-way function, the authentication information input by the user using the input unit into a second converted value and checking the second converted value against the first converted value stored in the storage unit in association with the user identification information input by the user using the input unit; and storage control unit configured, based on success of the user authentication by the authentication unit, to cause the storage unit to store the authentication information held by the holding unit in place of the first converted value stored in the storage unit. 
     According to another aspect of the present invention, there is provided an information processing method of an information processing apparatus including storage unit configured to store a first converted value converted by a one-way function in association with user identification information, comprising: a reception step of receiving, from a user, input of the user identification information and authentication information; a holding step of holding the input authentication information; an authentication step of executing user authentication by converting the input authentication information into a second converted value based on the one-way function and checking the second converted value against the first converted value stored in the storage unit in association with the input user identification information; and a step of, based on success of the user authentication in the authentication step, causing the storage unit to store the authentication information held in the holding step in place of the first converted value stored in the storage unit. 
     According to another aspect of the present invention, there is provided an non-transitory computer readable medium storing a program that causes an information processing apparatus including storage unit configured to store a first converted value converted based on a one-way function in association with user identification information to function as: input configured to receive, from a user, input of the user identification information and authentication information; holding configured to hold the authentication information input by the user using the input unit; authentication configured to execute user authentication by converting, by the one-way function, the authentication information input by the user using the input unit into a second converted value and checking the second converted value against the first converted value stored in the storage unit in association with the user identification information input by the user using the input unit; and storage control unit configured, based on success of the user authentication by the authentication unit, to cause the storage unit to store the authentication information held by the holding unit in place of the first converted value stored in the storage unit. 
     It is possible to minimize the labor of a user and synchronize user information between a plurality of information processing apparatuses using different password management methods. 
     Further features of the present invention will become apparent from the following description of exemplary embodiments (with reference to the attached drawings). 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram showing an example of a system arrangement according to the present invention; 
         FIG. 2  is a block diagram showing an example of the hardware arrangement of an MFP; 
         FIG. 3  is a block diagram showing an example of the software configuration of the MFP; 
         FIG. 4  is a view showing an example of a UI of user authentication provided by a user authentication processing unit; 
         FIG. 5  is a view showing an example of a password change screen provided by a user information editing unit; 
         FIG. 6  is a view showing an example of a user information management table that manages hashed passwords; 
         FIG. 7  is a view showing an example of a user information management table that manages unhashed passwords; 
         FIG. 8  is a view showing an example in which hashed user information is imported to the user information management table that manages unhashed passwords; 
         FIG. 9  is a view showing an example a user information management table when user authentication has succeeded; 
         FIG. 10  is a flowchart according to the first embodiment; 
         FIG. 11  is a flowchart according to the second embodiment; 
         FIG. 12  is a flowchart according to the third embodiment; 
         FIG. 13  is a flowchart according to the fourth embodiment; 
         FIG. 14  is a flowchart according to the fifth embodiment; 
         FIG. 15  is a view showing an example of user information according to the fourth embodiment; 
         FIG. 16  is a view showing an example of data according to the fourth and fifth embodiments; and 
         FIG. 17  is a view showing an example of data according to the fifth embodiment. 
     
    
    
     DESCRIPTION OF THE EMBODIMENTS 
     Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. It should be noted that the following embodiments are not intended to limit the scope of the appended claims, and that not all the combinations of features described in the embodiments are necessarily essential to the solving means of the present invention. 
     First Embodiment 
     The first embodiment of the present invention will be described. 
     [System Arrangement] 
       FIG. 1  is a block diagram showing an example of the arrangement of an entire system according to the present invention. Components to be described later are connected to a LAN  100 . MFPs  101 ,  102 ,  103 , and  110  are multi-function peripherals and include an image reading apparatus, a printing apparatus, and a communication apparatus. Each MFP has applications of copy, print, scanned image transmission, and the like. Each MFP also has a function of performing user authentication before use of the MFP so as to implement restriction of use of these applications on a user basis, customization on a user basis, and the like. 
     A PC  150  is a general PC (Personal Computer) in which a web browser (not shown) and the like are installed, and is used to manage each MFP. 
     [Hardware Arrangement] 
       FIG. 2  is a hardware block diagram showing the arrangement of each MFP. A description will be made here assuming that the MFPs shown in  FIG. 1  have the same hardware arrangement. However, the present invention is not limited to this. A control unit  200  including a CPU  201  controls the operation of the entire MFP. The CPU  201  reads out control programs stored in a ROM  202  and performs various kinds of control such as reading and transmission. A RAM  203  is a storage unit and is used as a temporary storage area such as the main memory or work area of the CPU  201 . 
     An HDD  204  stores image data and various programs. An operation unit I/F  205  connects an operation unit  209  and the control unit  200 . A network I/F  208  connects the control unit  200  (MFP) to the LAN  100 . The network I/F  208  transmits/receives various kinds of information to/from an external apparatus on the LAN  100 . 
     A printer I/F  206  connects a printer  210  and the control unit  200 . Image data to be printed by the printer  210  is transferred from the control unit  200  via the printer I/F  206  and printed by the printer  210  on a printing medium such as a paper sheet. A scanner I/F  207  connects a scanner  211  and the control unit  200 . The scanner  211  reads an image on an original, generates image data, and inputs it to the control unit  200  via the scanner I/F  207 . 
     [Software Configuration] 
       FIG. 3  is a block diagram showing a software configuration of each MFP according to the present invention. A description will be made here assuming that the MFPs shown in  FIG. 1  have the same software configuration. However, the present invention is not limited to this. 
     A user information management unit  301  manages information necessary for authentication of a user who uses the MFP and information necessary for limitation, customization, and the like of the functions of the MFP for each authenticated user. As a point regarding the present invention, the password management method changes depending on the MFP type, as described in Description of the Related Art above.  FIG. 6  shows an example of user information managed by the user information management unit  301 . Identification information (account) that identifies a user is stored in user_id  601 , a password hashed by MD5 is stored in password (MD5)  602 , and a user&#39;s e-mail address is stored in e-mail  603 . In the example of the user information management table shown in  FIG. 6 , each password is hashed by MD5 and managed in that state. 
     On the other hand, in the example of the user information management table shown in  FIG. 7 , each password is managed without hashing (password  702 ). That is, in the arrangement shown in  FIG. 7 , the identification information (user name) of a user, an unhashed password, a hashed password, and an e-mail address are managed in association with each other. When the user refers to the value of the password  702 , the password can be recognized. In the example shown in  FIG. 7 , passwords hashed using MD4 and MD5 as hash functions can be managed. However, the present invention is not limited to this, and the user information management table may cope with other hash functions. 
     For example, in a large-scale office environment, all MFPs existing in the office environment are rarely purchased at once. As a result, MFPs purchased at different times and using different user information management methods may coexist. In this embodiment, the following explanation will be made assuming such a situation. 
     A user authentication processing unit  302  performs authentication processing for each MFP use means or protocol. A local UI  310  provides a UI ( FIG. 4 ) for authentication to the user who uses the MFP from the operation unit  209 , and performs authentication processing by checking user information managed by the user information management unit  301  based on input information. 
     A remote UI  311  provides an authentication page and performs authentication processing when accessed using the web browser of a PC connected via the LAN  100  like the PC  150 . An NTLM  312  and an SNMPv3  313  respectively perform NTLM (Windows NT LAN Manager) authentication and authentication processing when accessed using an SNMPv3 (Simple Network Management Protocol version 3) protocol. A user information editing unit  303  provides a UI used by the user to edit the information managed by the user information management unit  301 .  FIG. 5  shows an example of a UI serving as a screen to change a password. 
     An export processing unit  304  performs UI providing and processing necessary to extract (export) user information managed by the user information management unit  301  out of the MFP as a file. An example of the file format at the time of export is CSV (Comma Separated Values). In the export processing, hashing processing is performed for an unhashed password. This aims at preventing the password from being grasped by hashing because the password is data that even the administrator who performs the export processing should not know from the viewpoint of security even if the exported file itself is readable. 
     An import processing unit  305  performs UI providing and processing necessary to receive a user information file exported from another device and apply (import) it to the user information management unit  301 . 
     Note that in this embodiment, a description will be made assuming the following management state. 
     MFPs  101 ,  102 , and  103 : manage a password without hashing ( FIG. 7 ) 
     MFP  110 : manage a password hashed by MD5 ( FIG. 6 ) 
     [Processing of Imported User Information] 
       FIG. 10  is a flowchart showing processing of imported user information using user authentication processing in the local UI  310  of the user authentication processing unit  302  of the MFP  101  as a trigger. This processing procedure is implemented by causing the CPU  201  of the MFP to read out a program stored in a storage unit such as the HDD  204  and execute it. A description will be made assuming that before the start of the flowchart, user information managed as shown in  FIG. 6  in the MFP  110  is imported to the user information management unit  301  that manages the user as shown in  FIG. 7 . As the result of import, the password of the imported user is stored in a hashed state (password (MD5)  804  in  FIG. 8 ). 
     In step S 1001 , the user authentication processing unit  302  acquires authentication information. More specifically, when the user inputs authentication information in an authentication screen ( FIG. 4 ) and presses a login button  404  by operating the MFP from the operation unit  209 , the authentication information is acquired. In step S 1002 , the user authentication processing unit  302  searches a table shown in  FIG. 8  for a record in which a user name input to a user name  401  matches a user_id  801  in the table. If there exists no record whose user name matches (NO in step S 1002 ), the user authentication processing unit  302  performs authentication failure processing in step S 1009 . After that, the processing procedure ends. 
     If there exists a record whose user name matches (YES in step S 1002 ), in step S 1003 , the user authentication processing unit  302  searches the table for a record in which a password input to a password  402  matches a password  802  (unhashed password). If there exists a record whose password matches (YES in step S 1003 ), the user authentication processing unit  302  performs processing of authentication success in step S 1004 . The processing of authentication success corresponds to processing of, for example, making the MFP usable for the user. As for the case where the passwords match in the example shown in  FIG. 8 , when “hasebe” and “haseb” are input to the user name  401  and the password  402 , respectively, they match the set of the user_id  801  and the password  802  of the record, and the authentication succeeds. 
     If there exists no record whose password matches (NO in step S 1003 ), in step S 1005 , the user authentication processing unit  302  hashes the input password by MD5. Note that MD5 is employed here because the method used by the MFP  110  is MD5. Hence, when importing an export file including a password converted using another hash function (one-way function), processing is performed in accordance with the function. In step S 1006 , the user authentication processing unit  302  searches the table for a record in which the password hashed in step S 1005  matches the password (MD5)  804 . If there exists no record whose hashed password matches (NO in step S 1006 ), the user authentication processing unit  302  performs authentication failure processing in step S 1009 . After that, the processing procedure ends. 
     If there exists a record whose hashed password matches, that is, the user authentication succeeded (YES in step S 1006 ), in step S 1007 , the user authentication processing unit  302  writes the password before hashing as the value of the password  802  of the detected record. In step S 1008 , the user authentication processing unit  302  deletes information (hashed password) written in the password (MD5)  804  of the detected record. After updating of the user information management unit  301  ends, the user authentication processing unit  302  performs processing of authentication success in step S 1004 . Then, the processing procedure ends. 
     This makes it possible to synchronize user information between a plurality of information processing apparatuses using different management methods for passwords under management. 
     Second Embodiment 
     The second embodiment of the present invention will be described. In the second embodiment, processing of imported user information is performed using user authentication when accessing from a web browser of a PC connected to a network to a web application of an MFP as a trigger. 
       FIG. 11  illustrates a procedure performed on a web browser (not shown) of a PC  150  and an MFP  101  according to this embodiment. This processing procedure is implemented by causing the CPU of each of the PC and the MFP to read out a program stored in a storage unit and execute it. 
     In step S 1101 , a remote UI  311  of a user authentication processing unit  302  of the MFP  101  transmits a web page for user authentication to the PC  150 . The contents of the user authentication page used here are the same as the contents of a screen ( FIG. 4 ) displayed on an operation unit  209  in the first embodiment. In step S 1102 , the web browser of the PC  150  displays the received user authentication page. After that, in step S 1103 , the web browser receives input of user authentication information. 
     In step S 1104 , the web browser hashes a password input by the user. Here, MD5 is used as the hashing method. In step S 1105 , the web browser sends, to the MFP  101 , an authentication request using the hashed password and the user name. 
     The remote UI  311  of the user authentication processing unit  302  of the MFP  101  performs authentication processing based on the authentication request from the web browser of the PC  150 . Note that in the above description, password hashing in the authentication processing is performed on the side of the PC  150 , and the hashed password is transmitted to the MFP  101 . Actually, two-way communication is performed by a protocol such as CRAM-MD5 to implement authentication. 
     In step S 1107 , the remote UI  311  of the user authentication processing unit  302  determines whether the authentication processing has succeeded. If the authentication processing has failed (NO in step S 1107 ), in step S 1108 , the remote UI  311  of the user authentication processing unit  302  performs authentication failure processing of, for example, transmitting a page indicating the authentication failure. Then, the processing procedure ends. 
     If the authentication processing has succeeded (YES in step S 1107 ), in step S 1109 , the remote UI  311  of the user authentication processing unit  302  transmits a password setting page ( FIG. 5 ) to the PC  150 . 
     In step S 1110 , the web browser of the PC  150  displays the password setting page ( FIG. 5 ) received from the MFP  101 . After that, in step S 1111 , the web browser receives input of a password from the user. Data input by the user here may be the same as that input at the time of authentication (step S 1103 ) or a new password (for the purpose of changing the password). In step S 1112 , the web browser transmits the password input by the user to the MFP  101  by encrypted communication (for example, SSL (Secure Sockets Layer) communication). Since the communication path is encrypted, the password is transmitted in an unhashed state. 
     In step S 1113 , the remote UI  311  of the user authentication processing unit  302  writes the unhashed password received from the PC  150  as the value of a password  802  of the record of the user for which authentication of a user information management unit  301  has succeeded. In step S 1114 , the remote UI  311  of the user authentication processing unit  302  deletes information (that is, hashed password) written in a password (MD5)  804  of the record. After updating of the password in the table, the remote UI  311  of the user authentication processing unit  302  performs processing at the time of authentication success in step S 1115 . After that, the processing procedure ends. 
     The same effect as in the first embodiment can thus be obtained even when the processing is triggered by input from the PC. 
     Third Embodiment 
     The third embodiment of the present invention will be described. In the third embodiment, the trigger to update user information managed as a hashed password after import is not an MFP where the user information exists but another MFP connected to a network. 
       FIG. 12  is a flowchart of updating a user information management unit  301  of an MFP  102  next to processing of updating the user information management unit  301  using authentication on an operation unit  209  of an MFP  101  as a trigger, as described in the first embodiment. That is, this is processing executed between the process of step S 1007  and that of step S 1008  in  FIG. 10 . 
     In step S 1007 , the user information management unit  301  of the MFP  101  updates the password of the record of a certain user. After that, in step S 1201 , the user information management unit  301  of the MFP  101  acquires, from a device management unit  320 , an MFP that should similarly update the password. The MFP that should update the password may be managed statically as a database or obtained by dynamically searching for an MFP on the network. A description will be made here assuming that the MFP of the synchronization target is the MFP  102 . The user information management unit  301  is assumed to transmit a password change request to the MFP  102  that should update the password. Note that the protocol of a web service is used between the MFP  101  and the MFP  102 . In step S 1202 , the user information management unit  301  of the MFP  101  queries the MFP  102  about an authentication type, for example, what kind of hashing type is necessary as authentication information. In response to this query, a user authentication processing unit  302  of the MFP  102  returns the authentication type to the MFP  101  in step S 1203 . 
     In step S 1204 , the user information management unit  301  of the MFP  101  sends an authentication request to the MFP  102  based on the returned authentication type. In step S 1205 , the user authentication processing unit  302  of the MFP  102  performs authentication processing. If the authentication has failed (NO in step S 1205 ), the user authentication processing unit  302  of the MFP  102  sends a processing end notification to the MFP  101  in step S 1210 . If the authentication has succeeded (YES in step S 1205 ), the user authentication processing unit  302  of the MFP  102  notifies the MFP  101  of authentication success in step S 1206 . 
     After receiving the authentication success notification, the user information management unit  301  of the MFP  101  encrypts the communication path (for example, SSL communication), and transmits the unhashed password to the MFP  102  in step S 1207 . 
     After receiving the unhashed password, the user information management unit  301  of the MFP  102  confirms in step S 1208  whether the password of the change target user is already managed without hashing. If the password is already managed (YES in step S 1208 ), password change processing is unnecessary. Hence, the MFP  101  is notified of the end of processing in step S 1210 . If the password is not managed yet (NO in step S 1208 ), the user information management unit  301  of the MFP  102  writes the received password as the value of a password  802  of the record of the corresponding user in step S 1209 . In addition, the user information management unit  301  of the MFP  102  deletes information (that is, hashed password) of a password (MD5)  804 . In step S 1210 , the user information management unit  301  of the MFP  102  sends a processing end notification to the MFP  101 . 
     Upon receiving the processing end notification from the MFP  102 , the user information management unit  301  of the MFP  101  deletes information (that is, hashed password) written in the password (MD5)  804  of the record in step S 1008 . 
     Password updating in a certain MFP can thus trigger password synchronization in another MFP as well. 
     Fourth Embodiment 
     The fourth embodiment of the present invention will be described. In the fourth embodiment, when performing user information export processing, processing for the password of the user in the user information is performed based on the authentication information of the user who performs the export. 
       FIG. 13  is a flowchart showing the procedure of processing when accessing from a PC  150  to an MFP  101  and exporting user information. This processing procedure is implemented by causing the CPU of each of the PC  150  and the MFP  101  to read out a program stored in a storage unit and execute it. 
     In step S 1301 , the PC  150  sends a user information export request to the MFP  101 . In step S 1302 , the MFP  101  sends an authentication request to the PC  150 . In step S 1303 , the PC  150  receives a user name and a password from the user via an authentication screen ( FIG. 4 ). The PC  150  encrypts the communication path (for example, SSL communication), and transmits the received password to the MFP  101  without hashing together with the user name. 
     In step S 1304 , the MFP  101  performs authentication processing using the received user name and the unhashed password. In step S 1305 , an export processing unit  304  of the MFP  101  creates export data from a user information management unit  301 . If there exists an unhashed password, the export processing unit  304  performs hashing processing for the password. The password of the record specified by the user name (user_id) used for the authentication is not hashed. A description will be made using an example in which the user information management unit  301  manages all users using unhashed passwords, as shown in  FIG. 15 . In this case, when performing export processing using the user name “endo”, the passwords other than “endo” are hashed in the export data, as shown in  FIG. 16 . 
     In step S 1306 , the MFP  101  transmits the created export data to the PC  150 . In step S 1307 , the PC  150  receives the export data exported by the MFP  101 . The processing procedure thus ends. 
     Fifth Embodiment 
     The fifth embodiment of the present invention will be described. In the fifth embodiment, when performing user information import processing, processing for the password of the user in the user information is performed on a PC based on the authentication information of the user who performs the import. 
       FIG. 14  is a flowchart showing the procedure of processing when accessing from a PC  150  to an MFP  101  and importing user information. This processing procedure is implemented by causing the CPU of each of the PC  150  and the MFP  101  to read out a program stored in a storage unit and execute it. 
     In step S 1401 , the PC  150  sends a user information import request to the MFP  101 . In step S 1402 , the MFP  101  transmits an authentication request to the PC  150  in response to the import request received from the PC  150 . In step S 1403 , the PC  150  receives a user name and a password from the user via an authentication screen ( FIG. 4 ). The PC  150  encrypts the communication path (for example, SSL communication), and transmits the received password to the MFP  101  without hashing together with the user name. 
     In step S 1404 , the MFP  101  performs authentication using the received password and user name. If the authentication has succeeded (YES in step S 1404 ), the MFP  101  sends an authentication success notification to the PC  150  in step S 1405 . 
     After receiving the authentication success notification, in step S 1406 , the PC  150  updates the password of the record corresponding to the user name (user_id) of the user used for the authentication to the unhashed password acquired by input of the user in step S 1403 . For example, in import data at the time of step S 1401 , the passwords of all users are hashed, as shown in  FIG. 17 . In this state, when performing import processing using the user name “endo”, the password of “endo” is updated to an unhashed state, as shown in  FIG. 16 . 
     In step S 1407 , the PC  150  transmits the updated import data to the MFP  101 . In step S 1408 , the MFP  101  performs import processing and termination processing using the received import data. 
     Other Embodiments 
     Embodiment(s) of the present invention can also be realized by a computer of a system or apparatus that reads out and executes computer executable instructions (e.g., one or more programs) recorded on a storage medium (which may also be referred to more fully as a ‘non-transitory computer-readable storage medium’) to perform the functions of one or more of the above-described embodiment(s) and/or that includes one or more circuits (e.g., application specific integrated circuit (ASIC)) for performing the functions of one or more of the above-described embodiment(s), and by a method performed by the computer of the system or apparatus by, for example, reading out and executing the computer executable instructions from the storage medium to perform the functions of one or more of the above-described embodiment(s) and/or controlling the one or more circuits to perform the functions of one or more of the above-described embodiment(s). The computer may comprise one or more processors (e.g., central processing unit (CPU), micro processing unit (MPU)) and may include a network of separate computers or separate processors to read out and execute the computer executable instructions. The computer executable instructions may be provided to the computer, for example, from a network or the storage medium. The storage medium may include, for example, one or more of a hard disk, a random-access memory (RAM), a read only memory (ROM), a storage of distributed computing systems, an optical disk (such as a compact disc (CD), digital versatile disc (DVD), or Blu-ray Disc (BD)™), a flash memory device, a memory card, and the like. 
     While the present invention has been described with reference to exemplary embodiments, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. The scope of the following claims is to be accorded the broadest interpretation so as to encompass all such modifications and equivalent structures and functions. 
     This application claims the benefit of Japanese Patent Application No. 2013-264506, filed Dec. 20, 2013, which is hereby incorporated by reference herein in its entirety.