JP2007058546A - Authentication system having authentication means-categorized access control function - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To make an authentication information input means whose security is high and an authentication means whose security is low coexist, and to make a composite machine available even when performing authentication by using the authentication means whose security is low. <P>SOLUTION: An authentication information input means is provided with a security level, and a function which is made available by a user is limited corresponding to the security level. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  This patent relates to restrictions on the use of multifunction devices.

  In recent years, authentication using an IC card that stores personal authentication information in an IC card, extracts the authentication information from an IC card reader, and performs an authentication process has become widespread.

  An IC card is a device that maintains the same convenience as a magnetic card, is difficult to duplicate, and provides high security.

  Along with the progress of computerization due to the development of the information society, it is required to handle personal information strictly, while high convenience is also required.

  Since an IC card provides many benefits for handling such personal information, in recent years it has been increasingly used as an information storage device for personal authentication.

In Patent Document 1, application usage is restricted based on the authentication result.
JP 2004-129247 A

  Authentication using an IC card is more secure than authentication by manually entering a magnetic card or password. On the other hand, if you forget your IC card or do not have an IC card, you cannot perform the authentication process and provide the desired service. There is a problem that it cannot be used.

  Also, if you do not have an IC card, you can consider using a user ID and password by manually entering it, but the security is inferior compared to when using an IC card and IC is an authentication with high security. The use of the card and the authentication by manually entering the authentication information and the sharing of both results in a contradiction from the viewpoint of security.

  According to the method disclosed in Japanese Patent Laid-Open No. 2004-228620, use restriction is performed depending on the authentication result. However, the authentication result depends on information used for authentication and does not differ depending on the authentication information input means. As described above, when the same authentication information is used with the IC card and other authentication information input means and the authentication result is the same, the function cannot be restricted and the inconsistency as a problem cannot be solved.

  In order to solve the above problem, in this patent, authentication information input means that provides high security such as an IC card, and authentication information input that provides lower security than the authentication information input means compared to the authentication information input means Authentication is performed by two authentication information input means using the means, and a function that can be used even for a user who handles the same authentication information is limited by the security level associated with the authentication information input means.

  Even when the security of the authentication information input means is not high, it provides convenience that allows a specific function to be used.

  FIG. 2 is a network configuration diagram showing a connection relationship between the multifunction machine to which the present invention is applied and other information devices.

  p01 and p02 denote authentication servers and manage user information. p03 and p05 are PCs. p06 and p07 are MFPs embodying the present invention, and the above p01 to p07 are connected to each other by a network p04.

  From p05 or p03, p06 and p07 can be operated via the network. When p06 and p07 are set to perform personal authentication, p06 or p07 performs authentication processing via the authentication server p01 or p02.

  However, the authentication method in the present invention is not limited to the one through the authentication server.

  FIG. 3 shows the overall configuration of a multi-function peripheral equipped with an authentication system to which the present invention is applied.

  In FIG. 3, q01 is a controller for controlling the multifunction peripheral, and has a hardware configuration as shown in FIG.

  q02 is a communication interface for the controller q01 to communicate with the outside of the multifunction peripheral, and may be, for example, a USB interface, an Ethernet (registered trademark) interface, an IEEE1284 interface, or another communication interface.

  q03 is a scanner engine, which is controlled by a controller q01.

  q04 is a printer engine, which is controlled by a controller q01, and may be, for example, a laser beam printer, an inkjet printer, or other printers.

  q05 is a FAX board for realizing a FAX function such as communication control of image transmission / reception characters, and is controlled by a controller q01.

  q06 is a user interface, which is composed of an LCD display, a keyboard, and the like, displays information from the controller q01, and conveys support from the user to the controller q01. In q06, the LCD display has a touch panel function and can receive input from the user.

  The multi-function peripheral having the above-described configuration allows the print job to be issued by selecting the printer engine q04. The scanner engine q03 is selected, and a scan job can be issued. Further, the printer engine q04 and the scanner engine q03 are selected, and a copy job can be issued. In addition, the printer engine q04, the scanner engine q03, and the FAX board q05 are selected, and a FAX reception job and a FAX transmission job can be issued. Further, the controller q01 performs authentication processing by acquiring authentication information via the LCD and communicating with the authentication server of p01 or p02 via the communication interface q02. Further, an authentication information input device such as an IC card reader / writer or a fingerprint authentication device is connected to q02, and the controller q01 acquires authentication information from the authentication information input device and performs authentication processing.

  FIG. 4 is a schematic diagram showing a hardware configuration centering on the controller q1 of FIG. In the controller q01 in FIG. 3, the CPUr01, RAMr02, LCDr03, keyboard r04, ROMr05, communication interface r06, scanner engine r07, printer engine r08, FAX board r09, DISKr10, IC card in FIG. The reader r11 is connected to each other via the system bus R20.

  A program for controlling the controller q01 in FIG. 3 is stored in the ROMr05 or DISKr10, read to the RAMr02 as necessary, and executed by the CPUr01. In addition to the control program, ROMr05 and DISKr10 store the multifunction device and attribute information indicating the function and status of the job processed by the multifunction device, job data to be output, and the like. Further, the CPUr01 performs display through the LCDr03 and receives a user instruction from the LCD or the keyboard r04. The CPU r01 communicates with the outside through the communication interface r06.

  In the present embodiment, unless otherwise specified, in the MFP of FIG. 3, the CPU r01 receives user input from the keyboard r04 via the system bus r20, and RAMr02, LCDr03, ROMr05, communication interface r06, scanner The engine r07, printer engine r08, FAX board r09, DISKr10, and IC card reader / writer r11 are controlled.

  FIG. 5 is a system block diagram relating to authentication information input means determination means, authentication means, and access restriction control of the controller q01 in the multi-function peripheral embodying the present invention.

  s01 is an authentication information input unit discriminating unit that discriminates the authentication unit used in the authentication unit and discriminates the security level associated with the authentication unit.

  s02 is an authentication unit, which is an authentication unit that acquires authentication information from an authentication information input unit such as the IC card reader r11, the LCDr03, and the keyboard r04, and performs authentication.

  s02 can be authenticated by different authentication methods by the authentication means determined by s01. For example, in the authentication information input from the IC card reader, the authentication server p01 and the authentication information input by the keyboard are authenticated. Authentication processing is performed using server q02. Further, s02 can perform authentication by the same authentication method regardless of the authentication means determined by s01. In the authentication information input from the IC card reader and the authentication information input by the keyboard, the authentication server p01 can perform authentication based on the authentication information obtained by both input means.

  s03 is an access control control unit that performs access control regarding the functions of the multifunction device according to the authentication result of s01 and the security level of the authentication information input means in s02.

  In this chapter, the user's instructions by LCD and keyboard are defined as direct input below.

  FIG. 6 is a diagram showing an example of a screen on the LCD of the multifunction machine in which the present invention is implemented.

  ta is an authentication screen indicating authentication waiting. In order to use this MFP, it is necessary to directly enter the user ID and password, or insert an IC card for authentication. If the authentication is successful, the screen transitions from the authentication screen to a screen such as tb or tc.

  tb and tc are screens displayed after authentication.

  tb1 and tc1 are function selection menus for selecting a function. tb2 and tc2 indicate functions, and the functions can be switched by direct input. The selected function is displayed on the function display screen of tb3 and tc3 and can be operated by direct input.

  When authenticated, a menu usable by the access restriction control unit s03 is displayed in the function selection menu.

  tb is a screen displayed when authentication is performed using an IC card, and functions of COPY, SEND, BOX, and FAX can be used. COPY indicates a copy function, SEND indicates an e-mail transmission function, BOX indicates a function for storing scanned images or print data in the multifunction peripheral, and FAX indicates a FAX transmission and reception function.

  tc is a screen displayed when authentication is performed by directly entering a user ID and password. When the user ID and password are entered directly, the authentication information input discrimination means determines that the security level is lower than that of the IC card, so the SEND and FAX functions are not displayed on the menu screen and are used by the user. Function is limited.

  FIG. 1 is a flowchart showing a series of authentication and access restriction flows in a multi-function peripheral embodying the present invention.

  1-1 is an authentication information input step, in which authentication information is input by direct input of a user ID / password, or authentication information is input by an IC card.

  1-2 is an authentication information input means determination step, wherein an authentication information input means such as a direct input of a user ID / password or an IC card is determined by an authentication information input means determination section s01, and the authentication processing section s02 The authentication method is automatically selected according to the determination result, and the process proceeds to the authentication step 1-3 or 1-4.

  Reference numeral 1-3 denotes an authentication step for performing authentication using an IC card authentication method. In this embodiment, authentication using an IC card is performed by the authentication server p01. If the authentication is successful, authentication result information is sent from the authentication processing unit s02 to the access restriction control unit s03.

  1-4 is an authentication step in which authentication is performed by an authentication method by direct input of a user ID / password. In this embodiment, authentication by direct input of a user ID / password is performed by the authentication server p02. If the authentication is successful, authentication result information is sent from the authentication processing unit s02 to the access restriction control unit s03.

  If the authentication fails in 1-3 and 1-4, the process proceeds to the authentication waiting step 1-10, the ta screen is displayed again, and the authentication waiting state is entered. When the authentication information is input, the processing from the authentication information input step 1-1 is started.

  1-5 is a security level determination step, and transits when authentication is successful in 1-3 and 1-4. In the security level determination step, the authentication information input means determination section determines the security level of the authentication information input means, and the security level information is sent to the access restriction control section s03.

  Reference numeral 1-6 denotes an access restriction step. The access restriction control unit s03 performs access restriction processing based on the result of the authentication step and the result of the security level determination step.

  1-7 is an authentication completion step. According to the access restriction determined in the access restriction step, creation of a function screen, removal of the authentication screen, and display of the function screen are performed by the controller q01. Become.

  In the above embodiment, the operation and system for the authentication method selection means for performing authentication processing using different servers according to the authentication information input means have been described. However, in the embodiment of the present invention, different authentication methods are used. Instead, it is possible to use the same authentication method.

  In addition, regarding the method for realizing access restriction in the above embodiment, other display methods and restriction methods, and access restriction relating to remote connection are also possible.

FIG. 1 is a flowchart showing a series of authentication and access restriction flows in a multi-function peripheral embodying the present invention. FIG. 2 is a diagram showing the overall configuration of a multifunction machine embodying the present invention. FIG. 3 is a block diagram of an authentication system embodying the present invention. FIG. 4 is a schematic diagram showing the hardware configuration of a multi-function peripheral embodying the present invention. FIG. 5 is a system block diagram relating to authentication information input means determination means, authentication means, and access restriction control of the controller q01 in the multi-function peripheral embodying the present invention. FIG. 6 is a diagram showing an example of a screen on the LCD of the multifunction machine in which the present invention is implemented.

Claims (5)

  A plurality of authentication information input means; an authentication means for performing authentication by an authentication method associated with the authentication information input means; and an authentication information input means determination means for determining a security level associated with the authentication information input means. Authentication is performed in accordance with an authentication method associated with the authentication information input means, and a security level associated with the authentication information input means is determined by the authentication information input means determination means, and a user is determined according to the security level. An authentication system characterized by restricting the functions that can be used.   2. The authentication system according to claim 1, wherein the authentication information input unit is an IC card, and the previous period authentication unit performs authentication processing using authentication information stored in the IC card.   The authentication system includes a user interface for receiving an instruction from a user, and the authentication information input unit performs authentication by inputting an ID and a password to the user interface as an authentication information input unit. The authentication system according to claim 1, wherein:   The authentication system according to any one of claims 1 to 3, wherein the authentication system performs authentication by the same authentication method regardless of the authentication information input information means.   The authentication system is an authentication system for a multifunction device, and restricts the use of functions of the multifunction device such as copy, network connection, and FAX function according to the security level determined by the authentication information input unit determination unit. The authentication system according to claim 1.

Images