Source: https://patents.google.com/patent/ES2716938T3/en
Timestamp: 2020-02-18 22:48:12
Document Index: 417161395

Matched Legal Cases: ['art 112', 'art 112', 'art 113', 'art 112', 'art 113', 'art 112', 'art 112', 'art 112', 'art 112', 'art 112', 'art 112', 'art 112', 'art 112', 'art 112', 'art 112', 'art 112', 'art 112', 'art 112', 'art 112', 'art 112', 'art 112', 'art 112']

ES2716938T3 - User authentication program and method, and image forming apparatus - Google Patents
User authentication program and method, and image forming apparatus Download PDF
ES2716938T3
ES2716938T3 ES04254417T ES04254417T ES2716938T3 ES 2716938 T3 ES2716938 T3 ES 2716938T3 ES 04254417 T ES04254417 T ES 04254417T ES 04254417 T ES04254417 T ES 04254417T ES 2716938 T3 ES2716938 T3 ES 2716938T3
ES04254417T
2019-06-18 Publication of ES2716938T3 publication Critical patent/ES2716938T3/en
User authentication program and method, and image forming apparatus
The present invention relates to user authentication methods in image forming apparatuses, to imaging apparatuses that carry out user authentication methods and user authentication programs.
In recent times, an image forming apparatus (a multifunctional apparatus) is known which accommodates in a housing the function of each apparatus, such as a FAX machine, a printer, a copying machine and a scanner. The image forming apparatus includes in the housing a display part, a printing part and an imaging part, for example, and also includes four types of applications that correspond to a FAX machine, a printer, a copier machine and a scanner. By switching the applications, the image forming apparatus functions as a FAX machine, a printer, a copying machine or a scanner.
In the case of the image forming apparatus having a large number of functions as mentioned above, in some cases, a user logs into the image forming apparatus by using a username and password, and the image forming apparatus limits the functions available depending on who the user is.
Figure 1 shows a structure of an image forming apparatus of that type. Figure 1 shows an operation panel, a copy application, a FAX application and an authentication module. The operation panel is an operational part that receives an input from the user and displays information for the user. The copy application and the FAX application are applications to achieve a copy function and a FAX function, respectively. The authentication module carries out user authentication.
In addition to the structure mentioned above, an authentication database necessary for authentication and a database of information relating to the user storing information relating to the user are required.
By authenticating the user with the authentication module, it is possible for the copying application and the FAX application to determine whether the user can use the image forming apparatus.
However, there is a problem that, because the specification of the image forming apparatus is not very high and the image forming apparatus has to carry out an image forming process which is a process with a charge of heavy work, the assembly of the aforementioned databases and the authentication process in the image forming apparatus can hamper the process of image formation.
Therefore, in some cases, the databases are provided in an apparatus, such as a PC, which is connected to a plurality of imaging apparatuses through a network, and the authentication process for the apparatus of Image formation takes place on the PC. In this case, a user who is registered in the databases can be authenticated in any of the imaging devices that are connected to the PC and can use them.
On the other hand, in some cases, a specific user can only temporarily use a specific image-forming apparatus. In this case, information unrelated to the other image forming devices is stored in the databases. Therefore, there is a problem that the PC hardware resource is not used efficiently and an update operation of the databases is required.
US 5,774,551 discloses a plug-in account management interface with a unified session initiation and logoff and multiple user authentication services.
A general objective of the present invention is to provide a user authentication method, an image forming apparatus and an improved and useful user authentication program in which one or more of the aforementioned problems have been eliminated. Another, more specific, objective of the present invention is to provide a user authentication method, an image forming apparatus and a user authentication program that are preferably for an image forming apparatus.
In order to achieve the objects mentioned above, according to one aspect of the present invention, a user authentication method is provided for an image forming apparatus that can be connected through a network to an authentication apparatus that carries out the authentication of a user, said user authentication method comprising:
a step of obtaining user authentication information for obtaining a user authentication information to carry out user authentication;
an authentication entity determination step (S601) of determining whether to carry out authentication of the user in the authentication apparatus or in the image forming apparatus, based on the authentication establishment information set or stored in said apparatus of image formation and establishes whether to carry out authentication in said authentication apparatus or in said image formation apparatus;
an authentication step (S602) of carrying out user authentication in a given authentication entity in the authentication entity determination step (S601) by the use of the user authentication information;
a step of obtaining an authentication result (S107) for obtaining a result of the authentication of the user in the authentication step (S602); Y
a step of specifying the authentication result (S113) of specifying the authentication result obtained to the user.
Also, the user authentication method may further include a determination step of alternative authentication of determination, when the result of authentication in the authentication step is an authentication failure, of whether to carry out the authentication in another authentication entity based on in the authentication establishment information.
Likewise, the user authentication method may also include a step of obtaining information relative to the user obtaining information relative to the user which is information related to the user.
Also, the step of obtaining information relative to the user can obtain the information relating to the user of a storage device of information relative to the user that stores the information related to the user through a network.
Also, the information relating to the user may include information that represents an image formation function available to the user.
Also, the step of obtaining user authentication information can obtain the information relating to the user through a network.
Also, in accordance with another aspect of the present invention, there is provided an image forming apparatus that can be connected through a network to an authentication apparatus that carries out the authentication of a user, said apparatus comprising images:
means for obtaining user authentication information (S103) for obtaining user authentication information to carry out user authentication;
authentication entity determination means (S601) for determining whether to carry out authentication of the user in the authentication apparatus or in the image forming apparatus based on the authentication establishment information established or stored in the training apparatus images and establishes whether to carry out authentication in the authentication apparatus or in the image forming apparatus;
authentication means (S602) for carrying out authentication of the user in an authentication entity determined by the authentication entity determination means by the use of the user authentication information;
means for obtaining authentication result (S107) to obtain a result of user authentication by the authentication entity; Y
authentication result specification means (S113) for specifying the result obtained to the user. Also, when the result of the authentication is an authentication failure, the authentication party can determine whether to carry out the authentication in another authentication entity based on the information of the authentication. establishment of authentication.
Also, the image forming apparatus may also include a part for obtaining information relative to the user that is configured to obtain information relative to the user that is information related to the user.
Also, the information obtaining part can obtain the information related to the user of an information storage device relative to the user that stores the information related to the user through a network.
Also, the user authentication information obtaining part can obtain the information related to the user through a network.
Also, in accordance with another aspect of the present invention, a user authentication program is provided which results in a computer performing a user authentication method applicable to an image forming apparatus that can be connected through from a network to an authentication apparatus that carries out the authentication of a user, said user authentication program comprising program code means which, when executed, instruct a computer to carry out the following steps:
a step of obtaining user authentication information (S103) for obtaining user authentication information to carry out user authentication;
an authentication entity determination step (S601) of determining whether to carry out authentication of the user in the authentication apparatus or in the image forming apparatus based on the authentication establishment information set or stored in the device imaging and specifying whether to carry out authentication on the authentication apparatus or on the image forming apparatus;
As mentioned above, according to the present invention, it is possible to provide a user authentication method, an image forming apparatus and a user authentication program which are preferably for an image forming apparatus.
Other objects, features and advantages of the present invention will become more apparent from the following detailed description when read together with the following drawings.
Figure 1 is a block diagram showing the structure of a conventional image forming apparatus;
Figure 2 is a block diagram showing the structure of a multifunctional apparatus according to an embodiment of the present invention;
Figure 3 is a block diagram showing the configuration of the physical support of the multifunctional apparatus according to the embodiment of the present invention;
Figure 4 is a block diagram showing the entire structure according to the embodiment of the present invention;
Figure 5 is a table showing a B. D. of authentications;
Figure 6 is a table showing a B. D. of user directories;
Figure 7 is a schematic diagram showing user interfaces;
Figure 8 is a sequence diagram showing processes until a user signs in;
Figure 9 is a diagram showing a request function for obtaining authentication information; Figure 10 is a diagram showing a WS request transmission request function;
Figure 11 is a diagram showing the contents of a user authentication request;
Figure 12 is a diagram showing the contents of a response to the user authentication request;
Figure 13 is a sequence diagram showing some processes from the execution of the
Figure 15 is a schematic diagram showing user interfaces;
Figure 16 is a schematic diagram showing a destination list screen;
Figure 17 is a sequence diagram showing processes in the case where a FAX transmission is carried out;
Figure 18 is a sequence diagram showing processes in which a user initiates a session from a PC;
Fig. 19 is a diagram showing the contents of a user authentication request in a ticket authentication;
Figure 20 is a diagram showing the contents of a response to the user authentication request in a ticket authentication;
Figure 21 is a schematic diagram showing an authentication establishment screen;
Fig. 22 is a schematic diagram showing a bit field; Y
Figure 23 is a flow diagram showing processes of a user authentication.
Referring to Figure 2, a description is given of the programs installed in a multifunctional apparatus 1. Figure 2 shows a group of programs 2 of the multifunctional apparatus 1, a multifunction device activator 3 and hardware resources 4.
The group of programs 2 includes a layer of applications 5 and a layer of controller 6 activated in an operating system (hereinafter referred to as "SO") such as UNIX (registered trademark).
The hardware resources 4 include a graphics tracing unit 51, a scanner 52, an operation panel 53, and the other hardware resources 50 such as an ADF (Auto Document Feeder ). The operation panel 53 corresponds to means for obtaining user authentication information and an authentication result specification means.
The multifunction apparatus activator 3 is operated for the first time at the time when the power of the multifunction device 1 is turned ON, and activates the application layer 5 and the controller layer 6.
The application layer 5 includes a printer application 20, which is an application for a printer, a copy application 21, which is an application for making copies, a FAX application 22, which is an application for fax and an application for scanner 23, which is an application for a scanner.
In addition, the application layer 5 includes a WEB page application 24, a SOAP communication application 25, one or more shared functions (referred to hereinafter as "SF") 27 and 28 , a Web service function (referred to hereinafter as "WSF", WEB service function) 26 provided between the web page application 24 and the SOAP 25 communication application and the Sf 27 and 28. It should be noted that SOAP means Simple Object Access Protocol, Access Protocol to Simple Objects.
The WSF 26 includes a WS API 46 that receives a process request from the WEB page application 24 and the SOAP communication application 25 by means of a previously determined function. In addition, SF 27 and 28 include an SF 45 API that receives a process request from WSF 26 by means of a previously determined function.
Upon receipt of a process request from the WEB page application 24 or the SOAP 25 communication application via the Ws 46 API, the WSF 26 selects the SF 27 and / or the SF 28 depending on the request from process. The WSF 26 transmits through the SF 27 or SF 28, selected depending on the process request, the process request that is received through the WS 46 API. Upon receipt of the process request by means of the SF 45 API, the SF 27 or the SF 28 carry out a process that corresponds to the process request.
In addition, the WEB page application 24 carries out a process as a client of a WEB authentication service and the SOAP communication application 25 carries out the generation and interpretation of a SOAP message. The controller layer 6 includes: a control service layer 7 that interprets the process request from the application layer 5 and issues a request for obtaining the hardware resources 4; a system resource manager (referred to hereinafter as "the resource manager of system ") 40 that manages one or more of the resources of the hardware 4 and adjusts the obtaining request from the control service layer 7, and a selector layer 8 that manages the hardware resources 4 in accordance with the request for obtaining from SRM 40.
The control service layer 7 is configured to include one or more service modules, for example: a network control service (referred to hereinafter as "the NCS", network control service) 30; an operating panel control service (referred to hereinafter as "the OCS", operation panel control service) 32; a user information control service (referred to hereinafter as "the UCS", user infonmation control service) 36; a system control service (referred to hereinafter as "the SCS", system control service) 37; an authentication control service (referred to hereinafter as "the CCS", authentication control service) 38; and a registration control service (hereinafter referred to as "the LCS", logging control service) 39. The CCS 38 corresponds to the means of determining the authentication entity, the means of authentication and the means of obtaining authentication results.
In addition, the controller layer 6 is configured to include an API 43 that enables the reception of a process request from the application layer 5 by means of a previously determined function.
The NCS 30 process provides a service that can be used in common with respect to applications that require a network I / O, allocates the data that is received according to each protocol from a network to each application and media in the transmission of data from each application to the network.
In addition, the NCS 30 includes an HTTPD (HyperText Transfer Protocol Daemon, HyperText Transfer Protocol Demon) and an FTPD (File Transfer Protocol Daemon, File Transfer Protocol Demon) that control data communications with a network instrument. which is connected to the multifunction device 1 through a network.
The process of the OCS 32 carries out the control in relation to the display in the operation panel 53, which serves as a means of transmitting information between the control of the main body and a user or a service person who performs a maintenance and inspection.
The process of the UCS 36 carries out the management of the users, such as the management of user IDs and passwords. The CCS 38 controls the authentication, which is destined for a local authentication module. Also, the CCS 38 determines which one will be used for authentication: a local authentication module within the multifunction device 1 or an authentication Web service such as a user authentication Web service, which will be described later. The LCS 39 manages the registration of information used by a user.
The SCS 37 carries out processes such as application management, operation panel control, system screen display, LED screen, hardware resource management and interruption of application control.
The SRM 40 carries out the control and system management of the hardware resources 4 together with the SCS 37. For example, the SRM 40 process carries out an execution and adjustment control according to a request for obtaining from a top layer using the hardware resources 4 such as the graphics plotting unit 51 and the scanner 52.
The selector layer 8 includes a FAX control unit selector (referred to hereinafter as "the FCUH", FAX control unit handler) 41 which manages a FAX control unit (at the which is hereinafter referred to as "the FCU", FAX control unit), which is described below, and an image memory selector (referred to hereinafter as " the IMH ", image memory handler) that allocates memory to a process and manages the memory that is assigned to the process. Each of SRM 40 and FCUH 41 issues a process request with respect to hardware resources 4 using the engine I / F 44, which enables the transmission of a process request to hardware resources 4 through means of a previously determined function.
As mentioned above, it is possible for the multifunctional apparatus 1 to carry out in a unified manner the processes that are required in common for each application in the controller layer 6.
A description of the hardware configuration of the multifunctional device 1 is given below.
Fig. 3 is a block diagram showing the configuration of the hardware of the multifunction apparatus 1 according to an embodiment of the present invention. The multifunctional apparatus 1 includes a control board 60, the operation panel 53, an FCU 68, a motor 71 and a graphics plotting unit 72. In addition, the FCU 68 includes a unit corresponding to the standard G3, 69, and In addition, the controller board 60 includes a CPU 61, an ASIC 66, an HDD 65, a local memory (MEM-C) 64, a system memory (MEM-P) 63 , a north bridge (referred to hereinafter as "the NB") 62, a south bridge (hereinafter referred to as "the SB") 73, a NIC (Network Interface Card ) 74, a USB 75 device, an IEEE 139476 device and a Centronics 77 device.
The operation panel 53 is connected to the ASIC 66 of the controller board 60. Likewise, the SB 73, the NIC 74, the USB device 75, the IEEE 1394, 76 device, and the Centronics 77 device are connected to the NB 62 by means of a PCI bus.
In addition, the FCU 68, the engine 71 and the graphics plotting unit 51 are connected to the ASIC 66 of the controller board 60 by means of another PCI bus.
Further, on the controller board 60, the local memory 64 and the HDD 65, for example, are connected to the ASIC 66, and the CPU 61 is connected to the ASIC 66 via the NB 62, which is a part of a set of CPU chips. Also, ASIC 66 and NB 62 are connected to each other, not by means of a PCI bus but by means of an AGP (Accelerated Graphics Port ) 67.
The CPU 61 controls the multifunction device 1. The CPU 61 is activated as a process and executes each of the NCS 30, the OCS 32, the UCS 36, the SCS 37, the CCS 38, the LCS 39, the SRM 40, the FCUH 41 and the IMH 42 in the SO. In addition, the CPU 61 activates and executes the printer application 20, the copy application 21, the FAX application 22, the scanner application 23, the WEB page application 24 and the SOAP 25 communication application, which form the Application layer 5.
The NB 62 is a bridge for connecting the CPU 61, the system memory 63, the SB 73 and the ASIC 66 to each other. The system memory 63 is used, for example, as a memory for images of the multifunction device 1. The SB 73 is a bridge to connect the NB 62, the PCI bus and peripheral devices together. In addition, the local memory 64 is a memory used as an image buffer to make copies and / or as a code buffer.
ASIC 66 is an IC for image processing that includes a physical support element for image processing. The HDD 65 is a storage for the accumulation of image data, the accumulation of document data, the accumulation of programs, the accumulation of source data and the accumulation of forms. In addition, the operation panel 53 receives an input operation from a user and displays a screen for the user.
Next, referring to Figure 4, a description of the entire structure according to the present embodiment is given. Figure 4 shows the multifunctional devices 91 and 100, a PC 90, a user authentication Web service 92 corresponding to an authentication device, a user directory Web service 93 corresponding to an information storage device. relative to the user and a network 94, by means of which these devices and services are connected. In addition, the multifunction apparatus 100 includes the operation panel 53, the copy application 21, the FAX application 22, the LCS 39, the UCS 36, the CCS 38, the NCS 30, a WSC 83 and a Web server 85.
The WSC 83 converts a Web service execution request provided from the CCS 38 into a SOAP request message, and notifies the SOAP request message to a Web service formed by the user authentication Web service medium 92 or the Web user directory service 93. In addition, WSC 83 analyzes a SOAP response message transmitted from the Web service and returns the result to CCS 38, which is the requesting source.
In addition, the WSC 83 is built by means of the WEB page application 24, the communication application of SOAP 25, the SF 27 (or the SF 27 and the SF 28) and the WSF 26, which have been described above with reference to figure 2.
The Web server 85 carries out processes such as Web server of the PC 90. In particular, the Web server 85 interprets a request in a Web protocol of a Web browser of the PC 90, and provides the response in HTML language. In case the application operating as a client of the multifunction device 100 is installed on the PC 90, the Web server 85 interprets a request for the Web service (SOAP) and provides the response in the SOAP protocol.
The user authentication Web service 92 performs the authentication of a user at the request of the multifunction device 100. The user directory Web service 93 confirms the user's usage limitation on request of the multifunction device 100. The user's web service 100 user authentication 92 and the user directory Web service 93 may be functions of the same server.
The SOAP protocol (Simple Object Access Protocol ) is used for communications between the multifunction device 100 and the user authentication Web service 92 and communications between the multifunction device 100 and the directory service Web user 93.
Next, referring to Figure 5, a description of an authentication database (referred to hereinafter as "the authentication DB") that is mounted on the Web service is given. user authentication 92. The authentication database is a database that stores a user name, a password and a name for each user.The user name and password are used as a set for authentication. used to, for example, indicate a user, which is a transmission source, on a FAX paper that is printed at a transmission destination when the user transmits a FAX.
In the case of figure 5, the username is "A", the password is "1234" and the name is "AA".
Next, referring to Figure 6, a description of a directory database (hereinafter referred to as "the Directory DB") provided in the Directory Web Service is given. 93. The directory DB is a database that stores a user name, address book information, an email address, a FAX number and a copy for each user. The information that is stored in the B.D. of directories corresponds to information related to the user.
The address book information is information that includes an address information such as a transmission destination and a telephone number or an e-mail address of the same for each transmission destination. The email address is an email address of a user. The FAX number is a number that serves as the address of a transmission source when a user transmits a FAX. The copy is an image formation function that can be used by a user, and represents the type of copy. For example, when the use of the copy by the user is limited to only the color copy, "color" is written in the copy field. The types of copies include, for example, the black and white copy and the double-sided copy, as well as the color copy.
In the case of figure 6, the user name is "A". The address information is "a1, a2, a3". The "a *" represents the address information for a destination. Therefore, the user who has the username "A" registers three types of address information.
In addition, the type of copy that can be used by the user who has the user name "A" is only the color copy.
A description of processes in the structure mentioned above is given below with reference to user interfaces and sequence diagrams.
Referring to Figure 7, a description of the user interfaces is given. Figure 7 shows a screen transition that is displayed in a display part of the operation panel 53, transition caused by a user's operations, and the contents of a record that is recorded at that time. In particular, Figure 7 shows a screen transition displayed in the display part of the operation panel 53 in a case where the user of name A starts a session, performs a copy, and then closes the session.
First, those parts that are common between the operation panels 130, 131, 132, 133 and 134. are described below. Each of the operation panels 130, 131, 132, 133 and 134 includes a copy button 110. , a FAX button 111, a display part 112, a number key 117 and a start button 118. Likewise, the display part 112 is provided with a date and time display part 113.
The copy button 110 and the FAX button 111 are pressed at the time of copying and FAX transmission, respectively. When one of the copy button 110 and the FAX button 111 is pressed, the button pressed is indicated by shading. The display part 112 is a part that displays a screen for a user. The number keys 117 are used when a number such as the number of sheets to be copied is entered. The start button 118 is a button that is pressed when copying is started. The date and time display part 113 displays the date and time.
A description is given below of a sequential transition of the display part 112, starting with the operation panel 130.
The operation panel 130 is a login screen. In the display part 112, a user name entry field 114, a password entry field 115 and a confirmation button 116 are displayed. The user name and password correspond to user authentication information. In addition, the user authentication information may include an authentication ticket and an authentication type, which are described below, and information that may specify an authentication entity such as an authentication establishment information and the IP address of the user. an authentication Web service, which are described later.
The type of authentication represents the type of authentication such as password authentication and ticket authentication. As for authentication types, there is an internal authentication that performs authentication in a multifunction device that is established as authentication establishment information, described below, and an external authentication that carries out authentication by means of another authentication device. In addition, the authentication type can be a specific type of authentication such as NT authentication and LDAP authentication.
The user name entry field 114 is a field for entering a user's user name. The password entry field 115 is a field for entering the user's password. The confirmation button 116 is a button that is pressed after the introduction of the user name and password. In this case, the confirmation button 116 is a login button.
When the user presses the confirmation button 116 and the login is successful, the date and time, the user and the fact that the user logged in are recorded in a register as shown in register 121.
When the user logs in, the display part 112 of the operation panel 130 makes a transition to the display part 112 of the operation panel 131. In the display part 112 of the operation panel 131 the message "Copying available" is displayed. . User A is using it. "And a logout button 119. With the message, it is specified that the multifunctional device 100 can be used. The logout button 119 is a button to be pressed when the user A closes the session.
When copying is started in the aforementioned state, the date and time, the user name and the fact that the user initiated the copying are recorded in a register as shown in register 122. In addition, the part of display 112 of the operation panel 131 makes a transition to the display part 112 of the operation panel 132.
When the copying is complete, the display part 112 of the operation panel 132 makes a transition to the display part 112 of the operation panel 133. As shown in the record 123, the date and time, the user name, the fact that the copying has finished, the number of pages and the number of sets are recorded in a record. In this case, when color copying is performed, the fact that color copying is carried out is also displayed.
When the copying is completed and user A presses the logoff button 119, the date and time, the username, and the fact that the user logged out are recorded in a record as shown in record 124 Next, the display part 112 of the operation panel 133 makes a transition to the login screen as shown in the display part 112 of the operation panel 134.
In the login screen mentioned above, instead of entering the user name and password, a magnetic card reader or an IC card reader can be provided in the multifunction device 100, and can be carried out The login session by using a magnetic card or an IC card.
Next, a description of processes relating to the aforementioned login is given with reference to the sequence diagrams.
In the sequence diagrams described below, the characters that have been written above an arrow represent, for example, a message, an event or a call to a function represented by the arrow. Also, the characters that have been placed between square brackets and have been written below an arrow represent a parameter that will be passed. In addition, these characters are omitted when it is not necessary to specify them in particular. In addition, in the sequence diagrams, a Web service client is indicated as "WSC", Web service client, the user authentication Web service is indicated as "WS authentication", and the user directory Web service is indicated as "WS of user directory".
First, referring to the sequence diagram of Figure 8, a description of the processes is given below until a user logs in.
In step S101, from the operation panel 53 the copy application 21 is provided with a request for Copy application display. In step S102, the copy application 21 notifies the CCS 38 of a request for obtaining authentication information. The argument of the request for obtaining authentication information is described below.
In step S103, the CCS 38 notifies the operation panel 53 to display the login screen. Step S103 corresponds to a step of obtaining user authentication information.
When the user enters the username and password and presses the confirmation button 116, the operation panel 53 notifies the CCS 38 in step S104 of a session start request. In step S105, the CCS 38 notifies the WSC 83 of a request for WS request transmission. On this occasion, the WSC 83 is also provided with the user name and password that have been previously entered, the URL of the authentication WS 92 and a method name to be passed to the authentication WS 92.
In step S106, the WSC 83 notifies the authentication WS 92 of a user authentication request together with a user authentication information. Step S107, which corresponds to a step of obtaining authentication result, is the response to step S106. The contents of the SOAP messages in steps S106 and S107 are described below.
In step S108, the WSC 83, to which the response is notified, notifies the CCS 38 of the authentication information transmitted from the authentication WS 92. The CCS 38 generates an authentication ticket. The authentication ticket includes the user name and is intended to associate the user name with the user information stored in the CCS 38. The user information is information included in the information relating to the user, and may include, for example , a department, an employee number and a position in a company. In this case, for example, a database of user information that stores only information in relation to the users can be provided.
In step S109, the generated authentication ticket is provided to the copy application 21 together with the user information. Next, in step S110, the copy application 21 notifies the UCS 36 of a usage limitation confirmation request together with the user information. In step S111, the response to the use limitation confirmation request is provided. Step S110 corresponds to a step of obtaining information relative to the user. Furthermore, as can be seen from this process, the application of copy 21 corresponds to means of obtaining information relating to the user.
It should be noted that the use limitation confirmation request in step S110 is a request in the case where the use by a user is limited by the copy application 21. When the use is limited by the UCS 36, the name of the application is limited. application as well as the user name are provided from the copy application 21. The application name is, for example, the copy application 21.
The copy application 21 determines that the login has been completed from the response in step S111, and notifies the CCS 38 in step S112 of the completion of the login along with the user information. In addition, in step S113, the copy application 21 sends to the operation panel 53 a request to display the session start result. On this occasion, a copy screen display request is also sent. Step S113 corresponds to an authentication result specification step. In step S114, the CCS 38 notifies the LCS 39, together with the user information, that the user has logged in.
The processes relating to the start of the session are carried out in the manner mentioned above. Next, a description of the request for obtaining authentication information is given in step S102, the request for transmission of WS request in step S105, the user authentication request in step S106 and the response in the step S107 with respect to the user authentication request in step S106.
First, the request for obtaining authentication information in step S102 is carried out by means of a function function call shown in figure 9. The function shown in figure 9 is a function that is written in the language C or the C ++ language, and has the function name "getUserAuthenticatedInfo". The return value of the function is a process result code and the arguments of the function are the application name, the authentication ticket, the user information and the error information. The copy application 21 can obtain the authentication ticket and the user information by storing information in the authentication ticket and the user information through the CCS 38.
It should be noted that the return value and the error information are of the integer type, the application name is a pointer of character type, the authentication ticket is a double pointer of character type, the user information is a double pointer of a structure "UserInfo", and each of these is normally four bytes.
Next, a description of the WS request transmission request is given in step S105. The WS request transmission request is carried out by means of a function function call shown in FIG. 10. The function shown in FIG. 10 is a function that is written in the C language or the language C ++, and has the function name "callWebService". The return value of the function is a process result code and the arguments of the function are the URL of the authentication WS, a web service name, a method name, a method argument, response data and the error information. The copy application 21 can obtain the authentication information by storing information in the response data by means of the CCS 38.
It should be noted that the return value and the error information are of the integer type, the WS authentication URL, the web service name, the method name and the method argument are character type pointers, the response data and the error information is a double pointer of type character, and each of these is normally four bytes.
Next, a description of the user authentication request is given in step S106. As shown in Figure 11, user authentication is written in the XML language (Extensible Markup Language, Extensible Markup Language ).
As shown in the XML 140 statements, the fact that the user name is "A" is provided in the following format.
In addition, the password "12345!" Is provided in the following format.
Next, a description of the contents that are provided in step S107 is given as the response to the user authentication request. As shown in an XML 141 statement in Figure 12, the authentication information, which is the response, is indicated in the following format.
<returnValue xsi: type = "xsd: base64Binary">
ABCDEFG = </ returnValue>
The value "ABCDEFG =" is an example, which indicates whether the user authenticates or does not authenticate.
Next, referring to the sequence diagram of figure 13, a description is given of some processes in which the user who has logged in carries out a copying and closes the session.
In step S201, the operation panel 53 notifies the copy application 21 of a copy start request. In step S202, the copy application 21 notifies the LCS 39 of the start of copying. On this occasion, LCS 39 is also provided with user information, a job ID and print information set by the user. The establishment information is, for example, information in relation to printing such as color copying.
In step S203, the copy application 21 notifies the operation panel 53 of a request for on-screen display of the copy receipt. In this way, copying is carried out.
When the copying is finished, the copy application 21 notifies the LCS 39 in step S204 that the copying ends. On this occasion LCS 39 is provided with the user information, the job ID and the print information of the actual output. Also, in step S205, the copy application 21 notifies the operation panel 53 of a request for on-screen display of the end of copying.
Next, when the user presses the logoff button 119 (see Figure 7), the operation panel 53 notifies the copy application 21 in step S206 of a session closure request. In step S207, the copy application 21 notifies the CCS 38 of a ticket destruction request together with an authentication ticket. In step S208, the CCS 38 notifies the LCS 39 of a session closure notice together with the user information, and the process is terminated.
In the processes mentioned above, the user who has logged in carries out a copy and closes the session.
A description of processes is given below in the case where the user directory WS 93 is used in the processes mentioned above. The user directory WS 93 is used in the usage limitation confirmation request in step S110 of FIG. 8.
Referring to the sequence diagram of Figure 14, a specific description of the processes is given in the aforementioned case.
It should be noted that the sequence diagram of figure 14 only shows some processes that correspond to steps S110 and S111 of figure 8, because the sequence diagram of figure 14 shows the processes in the case where the request confirmation of use limitation in step S110 of FIG. 8 is carried out using the user directory WS 93.
The sequence diagram of Fig. 14 is described below. In step S301, the copy application 21 notifies the UCS 36 of the use limitation confirmation request. On this occasion, user information and application name are also provided to UCS 36.
In step S302, the UCS 36 notifies the WSC 83 of the application transmission request. On this occasion, in a case where the limitation of user use is carried out by means of the copy application 21 or the UCS 36, the user information, the URL of the directory WS are also provided to the WSC 83 user 93 and a method name of the WS. Also, in a case where the limitation of user use is carried out through the user directory WS 93, the user information, a machine name, the application name, the URL are provided to the WSC 83. of the WS of user directory 93 and a method name of the WS. In the present case, the machine name is information that specifies the multifunction device 100 and may be the IP address of the multifunction device 100, for example.
In step S303, the WSC 83 notifies the user directory WS 93 of the use limitation confirmation request. The use limitation confirmation request is provided in a SOAP message. In a case where the limitation of use of the user is carried out by means of the copy application 21 or the UCS 36, the information that is provided with the use limitation confirmation request is the user information. Also, in a case where the limitation of use of the user is carried out by means of the user directory WS 93, the information that is provided with the use limitation confirmation request are the user information, the name of machine and the name of application.
In step S304, the response to the usage limitation confirmation request in step S303 is provided to the WSC 83 in a SOAP message. In a case where the limitation of user use is carried out by means of the copy application 21 or the UCS 36, the information provided in step S304 is the user information. Also, in a case where the limitation of user use is carried out by means of the user directory WS 93, the information provided in step S304 is a permission for its execution by the user.
In step S305, the WSC 83 notifies the UCS 36 of the information transmitted from the user directory WS 93. In a case where the limitation of user use is carried out by means of the copy application 21 or the UCS 36, the information that is provided in step S305 is the user information. Also, in a case where the limitation of user use is carried out by means of the user directory WS 93, the information provided in step S305 is a permission for its execution by the user.
In step S306, the UCS 36 notifies the copy application 21 of the response to the usage limitation confirmation request in step S301. In a case where the limitation of user use is carried out by means of the copy application 21, the information provided in step S306 is the user information. Also, in a case where the limitation of user use is carried out by means of UCS 36 or WS of user directory 93, the information provided in step S306 is a permission for its execution by the user.
In the case where the user directory 93 is used, the processes are carried out in the manner mentioned above.
Next, a description of the processes is given in the case in which the user does not close session after carrying out the copying as previously mentioned and, later, he uses the FAX function. The description is given with reference to the interfaces (operation panels) 150 to 153 shown in Figure 15. In Figure 15, those parts that are the same as the corresponding parts in Figure 7 are designated by the same numbers reference, and its description is omitted.
First, the operation panel 150 is the login screen described above with reference to FIG. 7. When the user logs in, the login screen makes a transition to a screen allowing copying as described above. shows in the display part 112 of the operation panel 151. Therefore, the user can carry out a copying.
Next, when the user presses the FAX button 111, the display part 112 of the operation panel 151 makes a transition to the display part 112 of the operation panel 152. In the display part 112 of the operation panel 152, a destination list button 120 is displayed to display the destinations of a FAX by means of a list.
In the display part 112 of the operation panel 152, when the user sends a FAX and presses the session closure button 119, the screen shown in the display part 112 of the operation panel 152 makes a transition to the screen of login as shown in the display part 112 of the operation panel 153.
Figure 16 shows a destination list screen, which is displayed when the destination list button 120 is pressed. In the destination list screen, an address book name 161 and a group of radio buttons are displayed. destination 160. Address book name 161 represents in which address book the destination list displayed is based. The group of destination selection buttons 160 are displayed based on the address book information (see Figure 6). By selecting a destination selection button 160 to which the user wishes to send a FAX from among the group of destination selection buttons 160, the user can send a FAX to the corresponding destination.
Next, referring to the sequence diagram of figure 17, a description of the processes is given in the case where the user sends a FAX after copying as shown in figure 15.
In step S401, the operation panel 53 notifies the FAX application 22 of a request for displaying the FAX application. In step S402, the FAX application 22 notifies the CCS 38 of a request to display the login screen.
On this occasion, the CCS 38 generates an authentication ticket because the user is logging in. Next, in step S403, the CCS 38 notifies the FAX application 22 of the authentication ticket and user information.
When the user starts using the FAX function, the operation panel 53 notifies the FAX application 22 in step S407 of a request for FAX transmission. In step S408, the FAX application 22 notifies the LCS 39 that a FAX transmission is initiated. On this occasion, LCS 39 is also provided with user information, a job ID and a FAX transmission condition. The FAX transmission condition is a condition in relation to the transmission of a FAX, such as a destination.
In step S409, the FAX application 22 notifies the operation panel 53 of a request to display the FAX transmission reception screen. When the FAX transmission ends, the FAX application 22 notifies the LCS 39 in step S410 that the FAX transmission ends. On this occasion, user information, job ID, and FAX transmission condition are also provided to LCS 39.
In step S411, the FAX application 22 notifies the operation panel 53 of a request to display the FAX transmission end screen, and the process ends.
The login processes and the FAX transmission processes described above are all carried out in the multifunction apparatus 100. The login processes described below with reference to FIG. 18 are processes in those that the user logs in from a PC.
Figure 18 shows processes that are carried out between the PC 90, the Web server 85 (see Figure 4), the copy application 21 and the CCS 38.
In step S501, the PC 90 notifies the Web server 85 of a copy application display request. In step S502, the Web server 85 notifies the copy application 21 of the copy application display request. In step S503, the copy application 21 notifies the CCS 38 of a request to obtain authentication information.
In step S504, the CCS 38 notifies the web server 85 of a request to display the login screen. In step S505, the web server 85 notifies the PC 90 of the request for display of the login screen.
When the user enters the username and password, and press, for example, a confirmation button which is displayed on the PC 90, the PC 90 notifies the Web server 85 in step S506 of a request for logon. On this occasion, the username and password are also notified to the Web server 85.
Subsequently, the processes of steps S105 to S112 and the process of step S114, which have been described above with reference to FIG. 8, are carried out.
In step S508, the copy application 21 notifies the web server 85 of a request to display the login result. In step S509, the Web server 85 notifies the PC 90 of the request to display the logon result.
Authentication in the processes mentioned above is password authentication. It is also possible to carry out authentication by means of ticket authentication instead of password authentication. In a ticket authentication, a ticket is obtained for authentication by connecting a PC to an authentication WS, and the login in a multifunctional device is carried out by using the ticket.
A description of the contents that are provided to the PC and the multifunctional device in a ticket authentication is given below.
Figure 19 is a diagram showing the contents of a user authentication request in a ticket authentication. As represented by an XML 142 statement of FIG. 19, a ticket "XYZZZZZ =" is provided in the following format.
<ticket xsi: type = "xsd: base64Binary">
XYZZZZZ = </ ticket>
In addition, Figure 20 shows the contents of a user authentication response in a ticket authentication. As represented by an XML 143 statement of FIG. 20, an "ABCDEFG =" response is provided in the following format.
Next, a description of settings related to authentication is given.
The B. D. of authentications and the B. D. of directories that have been described above with reference to FIGS. 5 and 6 are not necessarily provided in the WS authentication and WS of the user directory, respectively, and may be provided in a multifunctional device.
By providing the B. D. of authentications and the B. D. of directories in a multifunctional device, it is possible to save in the BBs. DD. provided information related, for example, to a temporary user who uses the same multifunctional device only for a week. Therefore, it is possible to avoid an unnecessary update of the B.D. authentication that is provided in the WS authentication or the B.D. directory that is provided in the WS user directory, used by a large number of multifunctional devices.
In a case where the B. D. of authentications and the B. D. of directories are provided in a multifunctional device as mentioned above, it is possible to establish which B. D. will be used. Figure 21 shows an authentication establishment screen for establishing authentication. The authentication setup screen includes set items 170 and check boxes 171.
Set-up elements 170 include "prioritize external authentication", "prioritize internal authentication", "external authentication only" and "internal authentication only". The "external authentication" represents authentication in the authentication WS. "Internal authentication" represents an authentication through the use of the B.D. authentication provided in a multifunctional device used by a user. "Prioritize" means that authentication is carried out by means of a prioritized authentication, but when the prioritized authentication can not be used, the authentication is carried out by means of the other authentication. "Only" means that the authentication is carried out by means of only one of the internal authentication and the external authentication.
The user can carry out an establishment of the authentication by verifying that of the check boxes 171 which corresponds to the setting element that is selected from among the four setting elements 170.
In addition, when a user directory is established, an establishment screen obtained by replacing "authentication" with "user directory" is displayed on the screen of figure 21.
The contents of the authentication establishment thus established are stored in a bit field shown in Fig. 22. The bit field shown in Fig. 22 is an 8 bit bit sequence: from the lowest bit to the fourth bit they are used for the establishment of authentication, and from the fifth bit to the eighth bit they are used to save a user directory. Each bit corresponds to the eight establishment elements mentioned above, and the value of the bit corresponding to the establishment establishment element is "1".
By using the bit field, a multifunctional device determines which B.D will be used and carries out an authentication. This process is described hereinafter with reference to the flow chart of Figure 23.
It is assumed that the user authentication information, the type of authentication, the type of the authentication means and information specifying authentication means (authentication means specification information) have already been obtained before the processes shown in the flow diagram of Figure 23. Among these, the type of the authentication means represents the establishment of authentication that has been mentioned above and, in particular, can be specified, for example, NT authentication or authentication of LDAP.
In step S601, a confirmation of the user authentication means is performed, which is established by the use of the aforementioned bit field. Step S601 corresponds to a step of determining the authentication entity. In step S602, it is determined whether the user authentication succeeds. Step S602 corresponds to an authentication step. When it is determined that the user authentication succeeds (SUCCESS in step S602), the process ends. When it is determined that the user authentication fails (FAIL in step S602), in step S603 it is determined, by using the bit field, whether there is an alternative means. Step S603 corresponds to an alternative authentication determination step.
When the bit field setting is "external authentication only" or "internal authentication only", it is determined that there is no alternative means (NOT in step S603) and the process ends assuming that the authentication fails. When it is determined that there is an alternative means (YES in step S603), the established alternative user authentication means are confirmed in step S604. In step S605, it is determined whether the alternative user authentication succeeds or fails. When the alternative user authentication succeeds (SUCCESS in step S605), the process ends assuming that the user authentication succeeds. When the alternative user authentication fails (FAIL at step S605), the process ends assuming that the user authentication fails. In the present case, a description of the steps S602 and S605 is given. In addition to the case in which the user authentication fails, which is an original failure, the cases in which the authentication is determined to fail include, for example: the case in which the user identification information and / or the type of authentication can not be handled by an authentication entity; the case in which the authentication means are different from those specified in the authentication means specification information; and the case in which the system of an authentication entity is busy.
The present invention is not limited to the specifically disclosed embodiments and variations and modifications can be made without departing from the scope of the present invention.
A user authentication method for an image forming apparatus (100) that can be connected through a network to an authentication apparatus (92) that carries out the authentication of a user, said authentication method comprising of user:
an authentication entity determination step (S601) of determining whether to carry out authentication of the user in the authentication apparatus (92) or in the image forming apparatus (100), based on an authentication establishment information established or stored in said image formation apparatus, and establishes whether to perform authentication on said authentication apparatus or on said image formation apparatus;
2. The user authentication method according to claim 1, further comprising:
a determination step of alternative authentication (S603) of determination, when the authentication result in the authentication step (S602) is an authentication failure, of whether to carry out the authentication in another authentication entity based on the establishment information of authentication.
3. The user authentication method according to claim 1 or 2, further comprising: a step of obtaining information relative to the user (S111) of obtaining information relative to the user that is information relative to the user.
The user authentication method according to claim 3, wherein the step of obtaining information relative to the user (S111) obtains the information relating to the user of a storage device of information relating to the user (93) storing the information relative to the user through a network.
The user authentication method according to claim 3 or 4, wherein the information relating to the user includes information representing an imaging function available to the user.
The user authentication method according to claims 3, 4 or 5, wherein the step of obtaining user authentication information (S103) obtains the relative information to the user through a network.
7. An image forming apparatus (100) that can be connected through a network to an authentication apparatus (92) that performs the authentication of a user, said image forming apparatus comprising:
means for obtaining user authentication information (53; S103) for obtaining user authentication information to carry out user authentication;
authentication entity determination means (38; S601) for determining whether to carry out authentication of the user in the authentication apparatus (92) or in the image forming apparatus (100), based on the authentication establishment information established or stored in the image forming apparatus, and establishes whether to carry out authentication in the authentication apparatus or in the image forming apparatus;
authentication means (38; S602) for carrying out user authentication in an authentication entity that is determined by the authentication entity determination means (38) by the use of the user authentication information;
means for obtaining an authentication result (38; S107) for obtaining a result of the authentication of the user by the authentication entity; Y
authentication result specification means (52; S113) for specifying the result obtained to the user.
The image forming apparatus (100) according to claim 7, wherein, when the result of the authentication is an authentication failure, the authentication means (38) determine whether to carry out the authentication in another entity. of authentication based on the authentication establishment information.
The image forming apparatus (100) according to claims 7 or 8, further comprising: means for obtaining information relative to the user (21) to obtain information relative to the user that is a information relative to the user.
The image forming apparatus (100) according to claim 9, wherein the means for obtaining information relative to the user (21) obtains the information relating to the user of an information storage apparatus relating to the user (93). ) that stores information about the user through a network.
The image forming apparatus (100) according to claims 9 or 10, wherein the information relating to the user includes information representing an imaging function available to the user.
The image forming apparatus (100) according to claims 9, 10 or 11, wherein the means for obtaining user authentication information (21) obtains the relative information to the user through a network.
13. A user authentication program that results in a computer carrying out a user authentication method that can be applied to an image forming apparatus (100) that can be connected through a network to an apparatus of authentication (92) that carries out the authentication of a user, said user authentication program comprising program code means which, when executed, instruct a computer to carry out the following steps:
an authentication entity determination step (S601) of determining whether to carry out authentication of the user in the authentication apparatus (92) or in the image forming apparatus (100), based on established authentication establishment information or stored in the image forming apparatus, and it establishes whether to carry out authentication in the authentication apparatus or in the image forming apparatus;
an authentication step (S602) of carrying out user authentication in a given authentication entity in the authentication entity determination step (S601) by the use of user authentication information;
14. A computer program product comprising a computer readable medium that stores the user authentication program according to claim 13.
ES04254417T 2003-07-24 2004-07-23 User authentication program and method, and image forming apparatus Active ES2716938T3 (en)
ES2716938T3 true ES2716938T3 (en) 2019-06-18
ES04254417T Active ES2716938T3 (en) 2003-07-24 2004-07-23 User authentication program and method, and image forming apparatus
ES (1) ES2716938T3 (en)
DE60036532T2 (en) * 2000-01-28 2008-06-26 Safecom A/S System and method for secure transmission of a document between a client computer of a computer network and a printer