JP5299787B2 - Information processing system, authentication server, processing method thereof, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce the burden of an administrator by associating authentication information (for example, a card number of an IC card, or the like) with a user (for example, a user name) to register them in an image forming apparatus which is difficult to input user information in. <P>SOLUTION: An authentication server including a storing means for associating read object identification information for identifying a read object with user identification information of a user owning the read object to store them receives the read object identification information from the image forming apparatus, authenticates the user by using the received read object identification information, generates a read object identification information registration key for registering the read object identification information when it is not determined that the user is authorized, and transmits the read object identification information registration key to the image forming apparatus. The read object identification information registration key and the user identification information are obtained from an information processing apparatus, and the read object identification information and the user identification information are associated and registered. <P>COPYRIGHT: (C)2011,JPO&amp;INPIT

Description

The present invention provides information that makes it easy to register and delete identification information of a new reading object in an authentication server using an apparatus that is difficult to input user information and has a function of reading authentication information from the reading object. The present invention relates to a processing system, an authentication server, a processing method thereof, and a program.

  In conventional printing, when print data is output to a printing device via a printer driver provided in a client terminal, the print data received by the printing apparatus is output in a timely manner.

  However, since the output paper medium is left unattended, it causes information leakage. In recent years, the print data output from the client terminal is temporarily stored on the server or in the printing apparatus, and the stored print data is stored. On the other hand, a so-called “pull print (accumulated printing)” printing system is known in which print data is output from a printing apparatus that has requested printing by making a printing request from the printing apparatus.

  Many pull print systems perform authentication using an IC card that identifies a user in order to make a print request for print data output by the user.

  By using an IC card, the user can easily pull-print the print data that he / she has output. On the other hand, the administrator who manages the IC card and user information can be used for newly joined employees, etc. The authentication server that authenticates the user of the card information (for example, the serial number) of the IC card that has been assigned by using the IC card has to be updated each time, resulting in a heavy administrative burden.

  In order to reduce such a load, when an IC card not registered in the authentication server is held over, a technology for newly registering card information (for example, a serial number) of the IC card from the printing apparatus to the authentication server is disclosed. (Patent Document 1).

JP 2008-181491 A

  However, in Patent Document 1, it is necessary to input user information (user name, password, etc.) of a user who uses the IC card from the operation unit (user interface) of the multifunction device in order to specify a registered user at the time of card information registration. It was.

  For this reason, a printer that does not have an operation unit (user interface) that can input user information using a touch panel or a numeric keypad such as a multi-function peripheral cannot input user information, so card information can be registered in the authentication server. There wasn't.

  In particular, when linking with a pull print system or the like, it is necessary to specify the user name from the card information in order to obtain the print data output by the user using a user name (login name to the network) such as an employee number. Therefore, it is necessary to manage the user name and card information in association with each other.

  Here, a mechanism may be conceived in which a card reader is connected to the client terminal used by each user and a registration request is transmitted to the authentication server. It didn't happen.

An object of the present invention, using an apparatus comprising a function for reading the authentication information from and read object is difficult to input Yu chromatography The information, card number, such as a new authentication information (e.g., IC card in the authentication server ) and user information (for example, is registered in association with the user name), also, it is to provide a mechanism that can already reduce the burden on the administrator to delete the authentication information registered in to Rukoto .

In order to achieve the above-described object, the information processing system of the present invention stores reading object identification information for identifying a reading object and user identification information of a user who owns the reading object in association with each other. An information processing system in which an authentication server including a user information storage unit, an apparatus including a reading unit that reads the object to be read, and an information processing apparatus are communicably connected, and the apparatus including the reading unit includes: The reading object identification information transmitting means for transmitting the reading object identification information of the reading object read by the reading means to the authentication server, and the reading object identification information is transmitted by the reading object identification information transmitting means. it is, the read object registration key information identification information for registering the user information storage unit or the read object identification information the user information storage The delete key information corresponding to the read object identification information for deleting from the unit, a key information receiving means for receiving from the authentication server, the registration key information or delete key information received by the key information receiving unit output Key information output means, and the authentication server receives read object identification information receiving means for receiving the read object identification information transmitted by the read object identification information transmitting means, and receives the read object identification information. Registration determination means for determining whether or not the reading object identification information received by the means is registered in the user information storage means, and the reading object identification information is registered in the user information storage means by the registration determination means. If it is determined not to be, the registration key information, and sends to the apparatus comprising the reading means, the registration determination means A key information transmitting means for transmitting said when the object to be read identification information is determined to be registered in the user information storage means, said delete key information, the apparatus comprising the reading means Te, the information processing apparatus Information acquisition means for acquiring the registration key information or deletion key information input from the user and user identification information of the user who owns the reading object, and reading corresponding to the registration key information acquired by the information acquisition means Registration means for registering the object identification information in association with the user identification information acquired by the information acquisition means in the user information storage means, and the reading target corresponding to the deletion key information acquired by the information acquisition means Deleting means for deleting the object identification information from the user information storage means .

The deletion unit deletes the read target object identification information corresponding to the deletion key information acquired by the information acquisition unit from the user information storage unit when the read target is read by the reading unit for a predetermined time. It is characterized by doing.

Further, the authentication server, the key information using the information of the validity period of the transmitted key information transmission means, the information validity determining means for registering the key information acquired by the acquisition means to determine whether it is valid further comprising the door, said registering means, the effective determination unit, when the registration key information acquired by the information acquisition means is determined to be valid, the registration key acquired by the information acquisition means The reading object identification information corresponding to the information and the user identification information acquired by the information acquisition unit are associated with each other and registered in the user information storage unit.

Further, the authentication server, in the validity determination unit, when the registration key information acquired by the information acquisition means is determined to be valid, it transmits a registration success result information indicating the registration success, the information The apparatus further comprises registration result information transmitting means for transmitting registration failure result information indicating registration failure when it is determined that the registration key information acquired by the acquiring means is not valid .

Further, the validity determination unit further deletes the key information acquired by the information acquiring means determines whether or not valid, the deletion means, in the validity determination unit, acquired by the information acquiring means When it is determined that the deleted key information is valid, the reading object identification information corresponding to the deleted key information acquired by the information acquiring unit is deleted from the user information storage unit.

Further, the authentication server, in the validity determination unit, when the delete key information acquired by the information acquisition means is determined to be valid, and transmits a deletion successful result information indicating deletion successful, the information And a deletion result information transmitting unit configured to transmit deletion failure result information indicating a deletion failure when it is determined that the deletion key information acquired by the acquiring unit is not valid .

The registration key information and the deletion key information are key information issued when the reading object identification information is received by the reading object identification information receiving means, and the registration means acquires the information acquisition The reading object identification information corresponding to the key information acquired by the means and the user identification information acquired by the information acquisition means are associated with each other and registered in the user information storage means, and the deletion means The reading object identification information corresponding to the key information acquired by the acquisition unit is deleted from the user information storage unit.

Further, the key information output means displays the registration key information or the deletion key information on a display means of the apparatus including the reading means, or the registration key information or the deletion key information by a printing means of the apparatus including the reading means. In addition, the information processing apparatus receives input of registration key information or deletion key information output by the key information output unit and user identification information of a user who owns the reading object. Input receiving means, and information transmitting means for transmitting registration key information or deletion key information received by the input receiving means and user identification information to the authentication server.

The information transmitting unit transmits user identification information received by the input receiving unit to the authentication server via an apparatus including the reading unit, and the user identification information transmitted to the authentication server. When the authentication is performed, the registration key information or the deletion key information is transmitted to the authentication server through an apparatus including the reading unit.

According to the present invention, by using a device having a function of reading the authentication information from and read object it is difficult to input Yu chromatography The information, and new authentication information in the authentication server (e.g., card number, etc. IC card) user information (for example, user name) is registered in association with each other and, also, it is possible to already reduce the burden on the administrator to delete the authentication information registered in to Rukoto.

1 is a system configuration diagram showing an example of a system configuration according to an embodiment of the present invention. It is a block diagram which shows the hardware constitutions of the information processing apparatus applicable to the client PC100 and IC card authentication server 200 concerning embodiment of this invention. 2 is a block diagram illustrating an example of a hardware configuration of a printer 300 according to an embodiment of the present invention. FIG. 3 is a block diagram illustrating an example of a hardware configuration of a NIC 600 provided in the printer 300 according to the embodiment of the present invention. FIG. 3 is a block diagram illustrating functions of a client PC 100, an IC card authentication server 200, and a printer 300 according to an embodiment of the present invention. FIG. It is a flowchart which shows an example of the card information authentication process of the information processing system concerning embodiment of this invention. It is a flowchart which shows an example of the card information registration process of the information processing system concerning embodiment of this invention. It is a flowchart which shows an example of the card information registration process of the information processing system concerning embodiment of this invention. It is a flowchart which shows an example of the card information registration process of the information processing system concerning embodiment of this invention. It is a flowchart which shows an example of the access key list deletion process of the information processing system concerning embodiment of this invention. 5 is a diagram showing an example of a registration mode setting file managed in an external memory 2011 of the IC card authentication server 200. FIG. 5 is a diagram showing an example of an access key list managed by an external memory 2011 of the IC card authentication server 200. FIG. It is a figure which shows an example of the user table used for the authentication managed in the external memory 2011 of the IC card authentication server 200. It is a figure which shows an example of the authentication page displayed on CRT2010 of client PC100. It is a figure which shows an example of the authentication error page displayed on CRT2010 of client PC100. 6 is a diagram illustrating an example of an access key input page displayed on the CRT 2010 of the client PC 100. FIG. It is a figure which shows an example of the registration success page displayed on CRT2010 of client PC100. It is a figure which shows an example of the registration failure page displayed on CRT2010 of client PC100. It is a flowchart which shows an example of the card information deletion process of the information processing system concerning Embodiment 2 of this invention. It is a flowchart which shows an example of the card information deletion process of the information processing system concerning Embodiment 2 of this invention. It is a flowchart which shows an example of the card information deletion process of the information processing system concerning Embodiment 2 of this invention. 6 is a diagram showing an example of a deletion mode setting file managed in the external memory 2011 of the IC card authentication server 200. FIG. 5 is a diagram showing an example of an access key list managed by an external memory 2011 of the IC card authentication server 200. FIG. 6 is a diagram illustrating an example of an access key input page displayed on the CRT 2010 of the client PC 100. FIG.

Embodiment 1
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a system configuration diagram showing an example of a configuration of a secure print system using a printer 300, a card reader 400, a client PC 100, and an IC card authentication server 200 of the present invention.

  Although not shown, various types of secure print systems (accumulation printing) can be used by installing a server that stores print jobs in this system and a mass storage that stores print jobs in the printer itself. Become.

  The printer 300 (image forming apparatus), card reader 400 (reading apparatus), client PC 100 (information processing apparatus), and IC card authentication server 200 are communicably connected via a LAN (Local Area Network) 500. Note that the client PC 100 and the printer 300 are configured to be connected to one or a plurality of LANs 500.

  The client PC 100 is an information processing apparatus that can register card information of an IC card from a Web browser stored in the client PC. Further, the information processing apparatus stores a printer driver and can store print data in a print server or mass storage (not shown).

  The IC card authentication server 200 holds user information used for authentication such as an IC card number (card information) used by the user and a user name, and can process the user name from the IC card number. Device.

  The printer 300 includes a NIC 600, and the NIC 600 is connected to the card reader 400. The printer 300 is a device capable of inquiring the IC card authentication server 200 for the IC card number read by the card reader 400 and performing authentication. Further, in response to being authenticated by the IC card authentication server 200, the print data corresponding to the authenticated user can be received from a print server or mass storage (not shown) and output on paper.

  Hereinafter, the hardware configuration of the information processing apparatus applicable to the client PC 100 and the IC card authentication server 200 shown in FIG. 1 will be described with reference to FIG.

  In FIG. 2, reference numeral 2001 denotes a CPU that comprehensively controls each device and controller connected to the system bus 2004. Further, the ROM 2003 or the external memory 2011 is necessary to realize a BIOS (Basic Input / Output System) or an operating system program (hereinafter referred to as an OS) which is a control program of the CPU 2001, and a function executed by each server or each PC. Various programs are stored.

  Reference numeral 2002 denotes a RAM that functions as a main memory, work area, and the like of the CPU 2001. The CPU 2001 implements various operations by loading a program or the like necessary for execution of processing from the ROM 2003 or the external memory 2011 to the RAM 2002 and executing the loaded program.

  An input controller 2005 controls input from a keyboard (KB) 2009 or a pointing device such as a mouse (not shown). A video controller 2006 controls display on a display device such as a CRT display (CRT) 2010. In FIG. 2, although described as CRT2010, the display may be not only a CRT but also other display such as a liquid crystal display. These are used by the user as needed.

  A memory controller 2007 is connected to the hard disk (HD), flexible disk (FD), or PCMCIA card slot for storing a boot program, various applications, font data, user files, editing files, various data, etc. via an adapter. The access to the external memory 2011 such as a compact flash (registered trademark) memory is controlled.

  A communication I / F controller 2008 is connected to and communicates with an external device via a network (for example, the LAN 500 shown in FIG. 1), and executes communication control processing in the network. For example, communication using TCP / IP is possible.

  Note that the CPU 2001 enables display on the CRT 2010 by executing outline font rasterization processing on a display information area in the RAM 2002, for example. Further, the CPU 2001 enables a user instruction with a mouse cursor (not shown) on the CRT 2010.

  Various programs that operate on the hardware are recorded in the external memory 2011, and are executed by the CPU 2001 by being loaded into the RAM 2002 as necessary. Furthermore, definition files and various information tables used when executing the program are also stored in the external memory 2011.

  Hereinafter, the hardware configuration of the information processing apparatus applicable to the printer 300 shown in FIG. 1 will be described with reference to FIG.

  The input unit 3000 connects the printer 300 and the NIC 600 and manages data communication with the NIC 600.

  A CPU 3001 governs overall control of the printer 300, and performs print control of the print processing unit 3003 and display control on the display unit 3007.

  The operation unit 3002 provides an I / F when the user directly touches the printing apparatus, and includes a hardware key that can be operated by the user, such as power ON / OFF and a cursor key.

  The print processing unit 3003 performs analysis of commands received by the input unit 3000, analysis of a print job (PDL), and the like.

  The storage unit 3004 includes a ROM (Read Only Memory) (not shown) for operating the printing apparatus, a RAM (Random Access Memory) (not shown), a secondary storage device (not shown), and the like. The RAM is an unrestricted data storage area, and is an area used for receiving data in the input unit 3000 or data expansion in the print processing unit 3003.

  The output unit 3005 transfers a print job received via the input unit 3000, which has been developed into image information printable by the print processing unit 3003, onto paper. The paper cassette 3006 supplies appropriate paper in accordance with the processing of the output unit 3005.

  A display unit 3007 is a liquid crystal display that displays an error message in the printer 300, a print job name at the time of printing, and the like. Unlike the multifunction machine, this display unit is a display unit that can display minimum information.

  The NIC 600 is a network interface card. The NIC 600 receives data received from other devices via the LAN 500 as a window and then passes it to a program inside the NIC (not shown) or to the input unit 3000 of the printer 300. The NIC OS 900 can control the transfer of received data.

  Hereinafter, the hardware configuration of the network interface device applicable to the NIC 600 shown in FIG. 3 will be described with reference to FIG.

  In FIG. 4, a CPU 4001 controls the NIC and controls devices connected inside. Further, the program stored in the ROM 4007 or the internal memory 4005 is read and executed. Alternatively, control such as communication with other devices is performed.

  A RAM 4002 functions as a main memory, work area, and the like for the CPU 4001. The CPU 4001 implements various operations by loading a program necessary for execution of processing from the ROM 4007 or the internal memory 4005 into the RAM 4002 and executing the loaded program.

  The communication I / F controller 4003 is connected to and communicates with an external device via a network (for example, the LAN 500 shown in FIG. 1), and executes communication control processing in the network. For example, communication using a communication protocol such as TCP / IP or UDP is possible.

  The USB I / F controller 4004 connects and communicates with a USB device such as the card reader 400 and the NIC 600, and executes USB communication control processing.

  The internal memory 4005 is an area in which a program (OS) for controlling the NIC 600 is mounted and an application program that operates on the OS and setting information thereof are stored.

  A memory controller 4006 controls access to the internal memory 4005 that stores various applications and various data.

  The ROM 4007 is a read-only semiconductor memory, and the contents are not lost even when the power is turned off.

  The device I / F controller 4008 connects and communicates the NIC 600 and the printer 300.

  Note that the network interface device applicable to the NIC 600 performs arithmetic processing using the CPU 4001, the RAM 4002, etc., and therefore operates as an information processing device (computer).

  Next, a functional configuration of the card information registration system according to the present embodiment will be described. FIG. 5 is a block diagram showing a functional configuration of the card information registration system according to the present embodiment.

  The system according to the embodiment of the present invention has a configuration in which the IC card authentication server 200, the client PC 100, and the NIC 600 connected to the printer 300 are connected via a predetermined LAN 500 (communication medium) capable of bidirectional communication. Yes. Further, the card reader 400 is connected to the NIC 600 via a predetermined LAN 500 capable of USB communication.

Since the operation flow between the respective functions will be described later, an explanation of functional block diagrams described in various terminals will be given here.

  First, the functional configuration of the client PC 100 will be described. The client PC 100 includes an access key input unit 150, a user information input unit 151, and a registration unit 152.

  The access key input unit 150 is a functional unit that receives an access key issued by the printer 300 input by the user via a Web browser provided in the client PC 100.

  The user information input unit 151 is a functional unit that receives a user name and password input by the user via a Web browser provided in the client PC 100.

The registration unit 152 is a functional unit that can register card information in the IC card authentication server 200 by transmitting the user name and access key received by the user information input unit 151 and the access key input unit 150 to the printer 300. .

  Next, the functional configuration of the IC card authentication server 200 will be described. The IC card authentication server 200 includes a printer communication unit 250, an authentication unit 251, and a user information management unit 252.

  The authentication unit 251 on the IC card authentication server receives an authentication request from the authentication server communication unit 351 of the printer 300, accesses the user table (FIG. 13) managed by the IC card authentication server, and sets the card number requested for authentication. This is a functional unit that searches the associated user name and returns it to the authentication server communication unit 351 of the printer 300 that has transmitted the authentication request.

  In addition, when the card information (manufacturing number) that has received the authentication request does not exist in the user table (FIG. 13) managed on the authentication server, the user information management unit 252 temporarily associates the card information with the card number. This is a functional unit that issues an access key and returns the authentication server communication unit 351 to the authentication server communication unit 351 of the printer 300 that has transmitted the authentication request.

  The access key is a unique random key managed in the IC card authentication server 200, and is stored and managed in the external memory 2011 of the IC card authentication server 200 together with the key issuing time (FIG. 12).

  Next, the functional configuration of the printer 300 will be described. The printer 300 includes a card reader control unit 350, an authentication server communication unit 351, a main body communication unit 352, a Web control unit 353, a USB control unit 354, and a print control unit 355.

  The card reader 400 control unit 350 of the printer 300 is a functional unit that acquires card information (manufacturing number) held over the card reader 400.

  The authentication server communication unit 351 transmits an authentication request to the IC card authentication server 200 using the card number, and receives an authentication result returned from the IC card authentication server 200 or an access key issued from the IC card authentication server 200. It is a functional part to do.

  In addition, the Web control unit 353 manages screen information (format such as HTML) transmitted to the client PC 100, generates a screen to be transmitted from the screen information in response to a request from the Web browser of the client PC 100, and the generated screen It is a function part which transmits (FIGS. 14-18).

  The main body communication unit 352 is a functional unit that displays an access key or an error message on the display unit of the printer 300. It is a functional unit that transmits and receives instructions to the USB device to the USB I / F controller.

  The USB control unit 354 is a functional unit that controls the USB device by communicating with the USB device connected to the NIC 600 connected via the USB I / F controller 4004 on the NIC 600. In this embodiment, the card reader 400 is controlled.

  The print control unit 355 is a functional unit that receives a print job from a print server (not shown) or a mass storage, and is a functional unit that outputs the received print job to the print processing unit.

  Next, card information registration processing in the embodiment of the present invention will be described with reference to FIG.

  FIG. 6 is a flowchart showing an example of the card information authentication process.

  First, in step S100, an application program stored in the internal memory 4005 on the NIC 600 is loaded onto the RAM, and the application program is executed. The CPU 4001 on the NIC 600 transmits a card reading start command to the USB control unit 354 on the NIC OS by the card reader control unit 350.

  The USB control unit 354 transmits this command to the card reader 400. That is, the card reader control unit 350 sends an instruction command for polling start processing to the card reader 400.

  In step S101, the card reader 400 starts polling according to the polling start processing instruction in step S100, and enters the card reading state.

  In step S <b> 102, the card reader 400 detects that the user has held an IC card (read object) and issues a card detection event including card information to the printer 300.

  In step S <b> 103, the CPU 4001 on the NIC 600 receives a card detection event by the card reader control unit 350.

  In step S104, the CPU 4001 on the NIC 600 uses the card reader controller 350 to provide card information (reading object identification information) of the IC card included in the card detection event acquired in step S103 (for example, the serial number of the card). To get.

  In this embodiment, a card is used. However, it is also possible to use a user's biometric information (fingerprint, finger vein, etc.) instead of the card.

  In step S105, the CPU 4001 on the NIC 600 transmits an authentication request command to the IC card authentication server by the authentication server communication unit 351 (reading object identification information transmission). The authentication request command includes the card information (reading object identification information) acquired in step S104.

  In step S106, the CPU 2001 of the IC card authentication server 200 receives the authentication request command sent from the printer 300 by the printer communication unit 250 (received object identification information reception).

  In step S107, the CPU 2001 of the IC card authentication server 200 uses the authentication unit 251 to manage the card information (manufacturing number) included in the authentication request acquired in step S106 on the IC card authentication server (FIG. 13). To find out if it exists.

  In step S108, the CPU 2001 of the IC card authentication server 200 determines the search (authentication) result in step S107 by the authentication unit 251. If the card information exists in the user table (FIG. 13) (if authentication is successful), that is, if the user corresponding to the IC card is registered in the user table (FIG. 13) of the IC card authentication server 200, step The process proceeds to S109, and if the card information does not exist in the user table (FIG. 13) (when authentication fails), the process proceeds to step S110.

  In step S109, the CPU 2001 of the IC card authentication server 200 acquires the user name 1301 corresponding to the card information searched in step S107 by the authentication unit 251.

  In the present embodiment, the user name 1301 is acquired, but an e-mail address may also be acquired.

  In step S110, the CPU 2001 of the IC card authentication server 200 reads the setting information from the registration mode setting file (FIG. 11) stored in the external memory 2011 of the IC card authentication server by the user information management unit 252.

In step S111, the CPU 2001 of the IC card authentication server 200 refers to the card registration 1101 from the printer among the setting information read out in step S110 by the user information management unit 252.
It is determined whether the card registration mode from the printer is ON / OFF. When the registration mode is ON, the process proceeds to step S112, and when it is OFF, the process proceeds to step S115.

  In step S112, the CPU 2001 of the IC card authentication server 200 reads the internal access key list (FIG. 12) stored in the external memory 2011 of the IC card authentication server by the user information management unit 252.

  In step S113, the CPU 2001 of the IC card authentication server 200 uses the user information management unit 252 to generate a unique access key that is a random value and does not exist in the access key list. When the card information is a card manufacturing number or the like, the card manufacturing number may be used as an access key, or a hash value may be acquired from the card manufacturing number and this hash value may be used as an access key. .

  Further, the access key generated in step S113 may have a configuration in which a plurality of unique access keys are prepared and an access key not used in the access key list is determined from the plurality of access keys described above. Good.

  That is, the access key is a registration key for specifying card information to be registered in order to register card information in association with a user name (user identification information).

  In step S114, the CPU 2001 of the IC card authentication server 200 is the time when the user information management unit 252 generates the access key generated in step S113, the card information (manufacturing number) acquired in step S106, and the access key. The access key issue date and time is additionally registered in the card information 1201, access key 1202, and key issue time 1203 in the access key list (FIG. 12) (generation time management).

  In step S115, the CPU 2001 of the IC card authentication server 200 transmits an authentication result command to the printer by the printer communication unit 250 (authentication result transmission). If authentication is successful, the authentication result command includes the authentication success flag and the user name acquired in step S109. If authentication fails and an access key is generated, authentication result command fails authentication. The flag and the access key generated in step S113 are included.

  If NO in step S111 (when the card registration mode is OFF), an access key is not generated, so the authentication result command does not include the access key and includes an authentication failure flag.

  In step S116, the CPU 4001 on the NIC 600 receives the authentication result command returned from the authentication server by the authentication server communication unit 351 (authentication result reception).

  In step S117, the CPU 4001 on the NIC 600 uses the authentication server communication unit 351 to analyze the authentication result command received in step 116, and when there is an authentication success flag, determines that the authentication is successful and executes the printing function of the printer 300. In order to do so, login to the printer 300 is performed. After logging in, the process proceeds to step S118. If there is an authentication failure flag, it is determined that the authentication has failed, and the process proceeds to step S119.

  In the analysis of the authentication result command, a valid user name is acquired when there is an authentication success flag, and a valid user name is not acquired when there is an authentication failure flag. That is, when it is determined that the user is an effective user according to the authentication result, the process proceeds to step S118, and when it is determined that the user is not an effective user, the process proceeds to step S119.

  In step S118, the CPU 4001 on the NIC 600 acquires a user name included in the authentication result command acquired in step 117 by a print server communication unit (not shown), and responds to the user name to the print server (not shown). The print request command for the print job to be transmitted is transmitted.

  When the print server receives the print request command and there is a print job corresponding to the user name, the print server performs LPR printing on the printer 300 that requested the print. Then, the CPU 4001 of the NIC 600 receives the print job at the print control unit 355 and outputs the print job to the print processing unit 3003.

  Here, a print server (not shown) has a function of accepting a print request from the client PC 100. When a print request is received from the client PC 100, the print job is stored in the hard disk of the print server. Also, it analyzes the internal data of the print job and manages bibliographic information data such as the name of the user who performed printing, the name of the document, and print job specifying information (for example, a file path) for specifying the print job.

  When the print request is received from the printer 300, the bibliographic information data is searched by the user name, the print job specifying information of the print job with the matching user name is acquired, the print job is acquired from the print job specifying information, and the printer 300 is acquired. Is subjected to LPR printing.

  In step S119, the CPU 4001 on the NIC 600 uses the authentication server communication unit 351 to analyze the authentication result command acquired in step S117, and determines whether the access key (reading object identification information registration key) is included in the command. To do. If the access key is included, that is, if the authentication server is operating in the card registration mode, the process proceeds to step S120. If the access key is not included, that is, if the authentication server is not operating in the card registration mode, step S121 is performed. Proceed to

  In step S120, the CPU 4001 on the NIC 600 uses the main body communication unit 352 to issue a display command including an access key character string to the printer main body. The printer body receives this display command and displays an access key character string on the display unit of the printer. Here, the access key acquired in step S119 is displayed on the display unit.

  In this embodiment, a method of displaying the access key on the display unit in order to notify the user of the access key is used. However, as another embodiment, a mechanism for outputting paper describing the access key may be used. In this case, print data including an access key is generated in the IC card authentication server 200, and a print job is transmitted to the printer 300 via a printer driver provided in the IC card authentication server 200. The printer 300 receives the transmitted print job, and outputs the paper on which the access key is printed by the output unit 3005 of the printer 300.

  In other words, any configuration may be used as long as the access key is output to the user by outputting the access key.

  In step S121, the CPU 4001 on the NIC 600 issues a display command to the printer main body through the main body communication unit 352. The printer main body receives this display command and displays characters on the display unit of the printer. Here, “Ninsha error” is displayed on the display unit.

Next, card information registration processing in the embodiment of the present invention will be described with reference to FIGS.

  7 to 9 are flowcharts showing an example of the card information registration process.

  In step S200 of FIG. 7, the CPU 2001 of the client PC 100 makes an access request to the Web control unit 353 of the NIC 600 of the printer 300 using HTTP communication by using a Web browser.

  In step S <b> 201, the CPU 4001 on the NIC 600 receives an access request from the client PC 100 by the Web control unit 353.

  In step S202, the CPU 4001 of the NIC 600 generates an authentication page (FIG. 14) from the Web control unit 353.

  In step S203, the CPU 4001 on the NIC 600 transmits the authentication page (FIG. 14) generated in step 202 to the client PC 100 by the Web control unit 353.

  In step S <b> 204, the CPU 2001 of the client PC 100 receives the authentication page transmitted from the printer 300 via the communication I / F controller 2008.

  In step S205, the CPU 2001 of the client PC 100 displays the authentication page (FIG. 14) received in step S204 using a web browser. This authentication page is displayed to accept input of user information including a user name and password from the user.

  In step S206, the CPU 2001 of the client PC 100 waits for the authentication button 1000 on the authentication page to be pressed by the Web browser. If it is detected that the authentication button 1000 has been pressed, the process proceeds to step S207.

  In step S207, the CPU 2001 of the client PC 100 accepts input of user information including the user name and password input by the user information input unit 151 on the Web browser when the authentication button 1000 is pressed by the user. Then, an authentication request command and an HTTP request for user information including a user name and a password are transmitted to the printer 300.

  In step S <b> 208, the CPU 4001 of the NIC 600 receives an HTTP request command from the client PC 100 through the Web control unit 353.

  In step S209, the CPU 4001 of the NIC 600 acquires the user name and password from the received HTTP request command in step S208 by the Web control unit 353.

  In step S <b> 210, the CPU 4001 of the NIC 600 transmits an authentication request command to the IC card authentication server 200 through the authentication server communication unit 351. The authentication request command includes the user name and password acquired in step S209.

  In step S211, the CPU 2001 of the IC card authentication server 200 receives the authentication request command including the user name and password sent from the printer by the printer communication unit 250.

  In step S212, the CPU 2001 of the IC card authentication server 200 stores and manages the user name included in the authentication request acquired in step S211 in the external memory 2011 of the IC card authentication server 200 by the authentication unit 251 (see FIG. 13) and whether the password acquired in step S211 matches the password in the user table is searched.

  In step S213, the CPU 2001 of the IC card authentication server 200 uses the authentication unit 251 to determine the authentication result in step S212. If the user name and password included in the authentication request are present in the user table (FIG. 13) as a result of the search in step S212, that is, if the user is registered in the server, the process proceeds to step S214, where the user name and password are entered. Does not exist in the user table, the process proceeds to step S216.

  In step S214, the CPU 2001 of the IC card authentication server 200 acquires the user name 1301 of the user that matched in step S213 by the authentication unit 251. In the present embodiment, the user name 1301 is acquired, but an e-mail address may also be acquired.

  In step S <b> 215, the CPU 2001 of the IC card authentication server 200 transmits an authentication result command to the printer 300 through the printer communication unit 250. The authentication result command includes an authentication result flag indicating successful authentication and user information including at least the user name acquired in step S214.

  In step S216, the CPU 2001 of the IC card authentication server 200 transmits an authentication result command to the printer through the printer communication unit 250. The authentication result command includes an authentication result flag indicating authentication failure.

  In step S217, the CPU 4001 on the NIC 600 receives the authentication result command returned from the IC card authentication server 200 by the authentication server communication unit 351.

  In step S218 of FIG. 8, the CPU 4001 on the NIC 600 analyzes the authentication result command received in step S217 by the authentication server communication unit 351. If the authentication result command includes a flag indicating successful authentication, it is determined that the authentication is successful, and the process proceeds to step S224. If the authentication result command includes a flag indicating authentication failure, the process proceeds to step S219 if the authentication fails. move on.

  In step S219, the CPU 4001 on the NIC 600 generates an authentication error page (FIG. 15) by the Web control unit 353.

  In step S220, the CPU 4001 on the NIC 600 causes the Web control unit 353 to transmit the authentication error page (FIG. 15) generated in step S219 to the client PC 100.

  In step S221, the CPU 2001 of the client PC 100 receives an authentication error page (FIG. 15) response command by HTTP communication returned from the printer 300 via the communication I / F controller 2008.

  In step S222, the CPU 2001 of the client PC 100 displays the authentication error page (FIG. 15) received in step S221 by the Web browser provided in the client PC 100.

  In step S223, it is detected whether or not the return button 1004 has been pressed by the user, and if it is pressed by the user, it is determined to re-authenticate, and the process proceeds to step S205, and the authentication page received in step S204 is displayed. Let If it is detected that the end button 1005 has been pressed, the process ends. In this embodiment, the process is terminated when the authentication error page is displayed.

  In step S224, the CPU 4001 on the NIC 600 uses the Web control unit 353 to generate an access key input page (FIG. 16).

  In step S225, the CPU 4001 on the NIC 600 transmits the access key input page (FIG. 16) to the client PC 100 by the HTTP communication generated in step S223 by the Web control unit 353.

  In step S <b> 226, the CPU 2001 of the client PC 100 receives an access key input page from the printer 300 by HTTP communication via the communication I / F controller 2008.

  In step S227, the CPU 2001 of the client PC 100 displays the access key input page (FIG. 16) received in step S225 on the CRT 2010 by the Web browser provided in the client PC 100.

  In step S228, the CPU 2001 of the client PC 100 waits for the registration button 1002 on the access key input page to be pressed by the Web browser. If it is detected that the registration button 1002 has been pressed, the process proceeds to step S229.

  In step S229, the CPU 2001 of the client PC 100 accepts an input of an access key input from the Web browser by the access key input unit 150 when the registration button 1002 is pressed by the user. Then, the registration unit 152 transmits an HTTP request command including the received access key to the printer 300.

  In step S230, the CPU 4001 on the NIC 600 receives an HTTP request command including an access key from the client PC 100 by the Web control unit.

  In step S231, the CPU 4001 on the NIC 600 causes the Web control unit 353 to analyze the HTTP request command acquired in step S230 and acquire an access key.

  In step S232, the CPU 4001 on the NIC 600 transmits a card information registration request command to the IC card authentication server 200 through the authentication server communication unit 351. The card information registration authentication request command includes the access key acquired in step 231.

  In step S233, the CPU 2001 of the IC card authentication server 200 receives a card information registration request command including an access key sent from the printer by the printer communication unit 250.

  In step S234, the CPU 2001 of the IC card authentication server 200 acquires the access key included in the card information registration request acquired in step 233 by the user information management unit 252. Also, the user name of the user acquired in step 214 is acquired (registered information acquisition).

  In the present embodiment, the user name acquired in step S214 is stored in the RAM 2002, and the user name is acquired in step S234 by continuing communication using this user name. However, in step S232, the user name is acquired. The card information registration authentication request command including the access key and the user name received in step S217 may be transmitted to acquire the user name included in the card information registration authentication request command.

  In step S235, the CPU 2001 of the IC card authentication server 200 obtains the access key list (FIG. 12) held in the external memory 2011 of the IC card authentication server 200 by the user information management unit 252.

  In step S236 of FIG. 9, the CPU 2001 of the IC card authentication server 200 includes the access key acquired in step S234 in the access key list (FIG. 12) acquired in step S235 by the user information management unit 252. Search for. If the access key is included, the process proceeds to step S237. If not included, the process proceeds to step S246.

  In step S237, the CPU 2001 of the IC card authentication server 200 searches the access key 1202 in step S236 by the user information management unit 252, and the corresponding access key corresponding to the access key that matches the access key acquired in step S234. The key issue time 1203 included in the list is acquired.

  In step S238, the CPU 2001 of the IC card authentication server 200 reads the registration mode setting file (FIG. 11) held in the external memory 2011 of the IC card authentication server 200 by the user information management unit 252.

  In step S239, the CPU 2001 of the IC card authentication server 200 acquires the access key validity period 1102 (predetermined time) described in the registration mode setting file read out in step S238 by the user information management unit 252.

  In step S240, the CPU 2001 of the IC card authentication server 200 uses the user information management unit 252 to obtain the key issuance time acquired in step S237 and the current time (year / month / day / hour / minute / second) of the system managed by the IC card authentication server 200. If the time difference is within the access key valid period (predetermined time) acquired in step S239, the process proceeds to step S241. If the time difference is outside the period (exceeds the period), the process proceeds to step S245. (Time judgment)

  In step S241, the CPU 2001 of the IC card authentication server 200 uses the user information management unit 252 to acquire card information 1201 (for example, a manufacturing number) associated with the access key acquired in step S236.

  In step S242, the CPU 2001 of the IC card authentication server 200 stores the card information 1302 corresponding to the user name acquired in step S214 (or step S234) of the user table (FIG. 13) by the user information management unit 252 in step S241. Register the acquired card information (manufacturing number).

  In step S243, the CPU 2001 of the IC card authentication server 200 completes registration of the card information in the user table (FIG. 13), so the user information management unit 252 records the access key record acquired in step S236 in the access key list (FIG. 12).

  In step S244, the CPU 2001 of the IC card authentication server 200 transmits a registration result command to the printer through the printer communication unit 250 (registration success result information transmission). The registration result command includes a registration result flag (OK) (registration success result information) indicating registration success.

  In step S245, since the CPU 2001 of the IC card authentication server 200 is information that has expired, the user information management unit 252 deletes the access key record acquired in step S236 from the access key list (FIG. 12). To do.

  In step S246, the CPU 2001 of the IC card authentication server 200 transmits a registration result command for displaying an error indicating that registration to the printer could not be performed by the printer communication unit 250 (transmission of registration failure result information). The registration result command includes a registration result flag (NG) (registration failure result information) indicating registration failure.

  In step S247, the CPU 4001 on the NIC 600 receives the registration result command returned from the IC card authentication server 200 by the authentication server communication unit 351.

  In step S248, the CPU 4001 on the NIC 600 uses the authentication server communication unit 351 to analyze the registration result command received in step 247. If registration has succeeded, the process proceeds to step S249, and if authentication has failed, the process proceeds to step S253.

  In step S249, the CPU 4001 on the NIC 600 causes the Web control unit 353 to generate a registration success page (FIG. 17).

  In step S250, the CPU 4001 on the NIC 600 causes the Web control unit 353 to transmit the registration success page (FIG. 17) generated in step S249 to the client PC 100 by HTTP communication.

  In step S251, the CPU 2001 of the client PC 100 receives an HTTP response command including a registration success page returned from the printer 300 from the registration unit 152.

  In step S252, the CPU 2001 of the client PC 100 displays the registration success page (FIG. 17) received in step S251 on the CRT 2010 by the Web browser.

  In step S253, the CPU 4001 on the NIC 600 causes the Web control unit 353 to generate a registration failure page (FIG. 18).

  In step S254, the CPU 4001 on the NIC 600 transmits an HTTP response command including the registration failure page (FIG. 18) generated in step S249 to the client PC 100 by the Web control unit 353.

  In step S <b> 255, the CPU 2001 of the client PC 100 receives the HTTP response command including the registration failure page returned from the printer 300 by the registration unit 152.

  In step S255, the CPU 2001 of the client PC 100 displays the registration failure page (FIG. 18) received in step S251 on the CRT 2010 by the Web browser.

  In the card information registration process in the present embodiment, a request for registration process is requested from the client PC 100 to the printer 300, and the card information can be registered by making a request from the printer 300 to the IC card authentication server 200. However, it can also be realized by making a request from the client PC 100 to the IC card authentication server 200.

  For example, the transmission of step S200, step S207, and step S229 is transmitted to the IC card authentication server 200. In this case, the processing corresponding to each step is configured to be executed by the IC card authentication server 200 instead of the printer 300.

  Next, card information registration processing in the embodiment of the present invention will be described with reference to FIG.

  FIG. 10 is a flowchart showing access key list deletion processing in the embodiment of the present invention. Further, this flowchart is a scheduled process performed when a predetermined time is reached (for example, once a day at 10:00 PM).

  In step S300, the CPU 2001 of the IC card authentication server 200 reads the registration mode setting file (FIG. 11) held in the external memory 2011 of the IC card authentication server 200 by the user information management unit 252.

  In step S301, the CPU 2001 of the IC card authentication server 200 acquires the access key validity period 1102 described in the registration mode setting file read in step S300 by the user information management unit 252.

  In step S302, the CPU 2001 of the IC card authentication server 200 acquires the access key list (FIG. 12) held in the external memory 2011 of the IC card authentication server 200 by the user information management unit 252.

  In step S303, the CPU 2001 of the IC card authentication server 200 uses the user information management unit 252 to perform access in which the processes in steps S304 to S307 described later are not executed in the access key 1202 of the access key list acquired in step S302. Determine if key exists. If there is an unexecuted access key, the process proceeds to step S304, and if not, the process ends.

  In step S304, the CPU 2001 of the IC card authentication server 200 acquires the access key determined not to be executed in step S303 by the user information management unit 252 from the access key 1202, and the access key issue time corresponding to the acquired access key. Is obtained from the key issuance time 1203.

  In step S <b> 305, the CPU 2001 of the IC card authentication server 200 acquires the current time (year / month / day / hour / minute / second) of the system managed by the IC card authentication server 200 by the user information management unit 252.

  In step S306, the CPU 2001 of the IC card authentication server 200 compares the key issuing time acquired in step S304 with the current time (year / month / day / hour / minute / second) of the system of the IC authentication server by the user information management unit 252; If the time difference is within the access key valid period 1102 acquired in step S301, the process proceeds to step S303. If the time difference is outside the period (exceeds the period), the process proceeds to step S307.

  In step S306, the CPU 2001 of the IC card authentication server 200 uses the user information management unit 252 to delete the record of the access key (access key that has expired) acquired in step S303 from the access key list (FIG. 12).

  Next, the registration mode setting file in the embodiment of the present invention will be described with reference to FIG.

  The registration mode setting file is stored in the external memory 2011 of the IC card authentication server 200 and is read by the CPU 2001.

  In the registration mode setting file, a card registration 1101 from the printer and an access key valid period 1102 are described. The card registration 1101 from the printer has a flag for determining whether or not the card can be registered from the printer. (Value) is set. When “ON” is set in the card registration 1101 from the printer, it is possible to register the card from the printer. Further, when “OFF” is set in the card registration 1101 from the printer, the card registration from the printer can be disabled.

  The access key validity period 1102 is set to a time that is valid after the access key generated by the IC card authentication server 200 and stored in FIG. The access key can be deleted according to the set time.

  Note that the card registration 1101 “ON / OFF” from the printer and the valid time set in the access key valid period 1102 can be arbitrarily set by the user managing the IC card authentication server 200.

  Next, the access key list in the embodiment of the present invention will be described with reference to FIG.

  The access key list is a table (or database) that is stored in the external memory 2011 of the IC card authentication server 200 and can be searched and registered by the CPU 2001.

  The access key list includes card information 1201, an access key 1202, and a key issuance time 1203. In the card information 1201, the card information (for example, the card manufacturing number) received from the printer 300 is stored in the access key 1202. Is generated by the IC card authentication server 200 to be a unique value, the access key transmitted to the printer 300 is stored, and the key issue time 1203 stores the time (year / month / day / hour / minute / second) when the access key was issued. Has been.

  Next, a user table in the embodiment of the present invention will be described with reference to FIG.

  The user table is a table (or database) that is stored in the external memory 2011 of the IC card authentication server 200 and can be searched (authenticated) and registered by the CPU 2001.

  The user table includes a user name 1301, a password 1303, card information 1302, and an e-mail address 1304. The user name 1301 and password 1303 are information used for authentication from the client PC 100. A login ID (employee number) and an arbitrarily set password for logging in are stored.

  The card information 1302 is information registered when an access key is input from the client PC 100 within the valid period, and stores an identification number read from the IC card.

  Further, the mail address 1304 stores a mail address to be used corresponding to the user name 1301.

  In the present embodiment, the user table is configured to be stored in the external memory 2011 of the IC card authentication server 200. However, for example, the user table may be configured to be stored in an LDAP server (Lightweight Directory Access Protocol server) or the like.

  In order to manage passwords in a confidential manner, the user name and password are stored in the LDAP server, and the user name, card information, and mail address are stored in the IC card authentication server 200. The IC authentication server and the LDAP server are It can also be a separate enclosure.

  According to the present embodiment, even in a printer (image forming apparatus) in which it is difficult to input user information, for example, a card number (authentication information) such as an IC card is associated with user information (user name and password, etc.) and registered. As a result, the management burden on the administrator can be reduced.

  In particular, in a storage-type security printing system that accumulates print data output from the client PC 100, receives the accumulated print data when authentication by the IC card is successful, and executes printing, a printer that cannot perform rich display Even when is installed, the IC card can be easily registered.

[Embodiment 2]
In the first embodiment, the identification number is for identifying a card number temporarily generated on the IC card authentication server 200 by holding an IC card not registered in the IC card authentication server 200 over the card reader 400. By generating an access key and inputting the access key on a Web browser, the card information of the user is registered in the IC card authentication server 200 even in a printer (image forming apparatus) in which it is difficult to input user information. Was possible.

  However, in the first embodiment, although the card information of the user can be registered in the IC card authentication server without intervention of the administrator, the user cannot delete the card information on the authentication server by himself / herself.

  Therefore, in the second embodiment, a mechanism for deleting the card information of the user registered in the IC card authentication server 200 is provided.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  First, the card information deletion process according to the second embodiment of the present invention will be described with reference to FIGS.

  The second embodiment can be realized by replacing FIG. 12 of the first embodiment with FIG. 23, replacing FIG. 6 with FIGS. 19 and 20, and replacing FIG. 9 with FIG.

  Regarding the other drawings, the first embodiment and the second embodiment are equivalent, and the description thereof is omitted.

  First, the card information deletion process in the embodiment of the present invention will be described with reference to FIG. Note that the same steps as those in the first embodiment are denoted by the same steps, and description thereof is omitted.

  In step S500, the card reader 400 detects that an IC card (read object) owned by the user is held over or removed by the user.

  In step S501, the card reader 400 determines the event that occurred in step S500. If the card is held over, the process proceeds to step S502, and if the card is removed, the process proceeds to step S503.

  In step S502, the card information of the card held by the card reader 400 is acquired.

  In step S <b> 503, the card reader 400 issues card event information to the printer 300. If the card event type is a card cover, the acquired card information is also issued to the printer 300.

  In step S <b> 504, the CPU 4001 on the NIC 600 receives a card detection event by the card reader control unit 350. In addition, the event reception time is also acquired. It is assumed that the event reception time is a system time managed in the printer 300.

  In step S505, the CPU 4001 on the NIC 600 determines the type of card event acquired in step S504. If it is a card removal event, the process proceeds to step S507, and if it is a card holding event, the process proceeds to step S506.

  In step S506, the CPU 4001 on the NIC 600 acquires card information (reading object identification information) (for example, a card manufacturing number) included in the card detection event acquired in step S504 and stores it in the RAM 4002. Let And it waits until it receives a card removal event. In addition, the event acquisition time when the card detection event is acquired is stored in the RAM 4002.

  In step S507, the CPU 4001 on the NIC 600 transmits an authentication request command to the IC card authentication server via the authentication server communication unit 351 (reading object identification information transmission). That is, in the second embodiment, an authentication request is not issued when a card is detected, but an authentication request is issued when a card is removed. The authentication request command includes the card information (read object identification information) acquired in step S506 and stored in the RAM 4001, the time when the card detection event is acquired and the time when the card removal event is acquired, acquired in step 504. .

  Steps S106 to S108 are the same as those in the first embodiment, and a description thereof will be omitted.

  Step S508 is processing when the card information does not exist in the user table (FIG. 13) (when authentication fails). Specifically, since the processing of steps S110 to 114 corresponds, the description is omitted.

  In step S509, the CPU 2001 of the IC card authentication server 200 reads the setting information from the deletion mode setting file (FIG. 22) stored in the external memory 2011 of the IC card authentication server by the user information management unit 252.

In step S510, the CPU 2001 of the IC card authentication server 200 refers to the card deletion 5000 from the printer in the setting information read in step S509 by the user information management unit 252;
Whether the card deletion mode from the printer is ON / OFF is determined. When the deletion mode is ON, the process proceeds to step S511, and when it is OFF, the process proceeds to step S109.

  In step S511, the CPU 2001 of the IC card authentication server 200 refers to the deletion mode transition time threshold 5001 in the setting information read out in step S509 by the user information management unit 252 and responds to the authentication request acquired in step S106. Compare the time when the included card detection event is acquired and the difference between the time when the card removal event is acquired. That is, when the card holding time is longer than the threshold value, the process proceeds to step S512, and when it is equal to or less than the threshold value, the process proceeds to step S109.

  In step S512, the CPU 2001 of the IC card authentication server 200 reads the access key list (FIG. 23) stored in the external memory 2011 of the IC card authentication server by the user information management unit 252.

  In step S513, the CPU 2001 of the IC card authentication server 200 uses the user information management unit 252 to generate a unique access key that is a random value and does not exist in the access key list. When the card information is a card manufacturing number or the like, the card manufacturing number may be used as an access key, or a hash value may be acquired from the card manufacturing number and this hash value may be used as an access key. .

  In addition, the access key generated in step S513 has a configuration in which a plurality of unique access keys are prepared, and an access key that is not used in the access key list is determined from the plurality of access keys described above. Good.

  That is, the access key is a registration / deletion key for managing the card information of the user to identify and manage the card information. The access key generated in step S513 is an access key for deleting the held IC card (making it unavailable). The access key generated in step S508 is an access key for registering the IC card (making it unavailable).

  In step S514, the CPU 2001 of the IC card authentication server 200 is the time when the user information management unit 252 generates the access key generated in step S513, the card information (manufacturing number) acquired in step S106, and the access key. The access key issue date and time is additionally registered in the card information 1201, access key 1202, and key issue time 1203 in the access key list (FIG. 23) (generation time management). In addition, “DELETE” indicating that the key status is a deletion key is registered.

  In step S515, the CPU 2001 of the IC card authentication server 200 transmits an authentication result command to the printer 300 by the printer communication unit 250 (authentication result transmission). If the authentication is successful (YES in step S108) and the user name is acquired in step S109, the authentication result flag includes the authentication success flag and the user name acquired in step S109. If the authentication is successful (YES in step S108) and the access key is generated in step S513, an authentication failure flag and the access key generated in step S513 are included in the authentication result command. Further, when the authentication fails (NO in step S108), the authentication failure flag and the access key generated in step S508 are included in the authentication result command.

  In addition, since the process of step S116-step S121 is the same process as Embodiment 1, description is abbreviate | omitted.

  Next, card information deletion processing in the embodiment of the present invention will be described with reference to FIG. As described above, FIG. 21 is described as processing subsequent to FIG. 8 of the first embodiment.

  In step S600, the CPU 2001 of the IC card authentication server 200 searches the access key 1202 in step S236 by the user information management unit 252, and the corresponding access key corresponding to the access key that matches the access key acquired in step S234. The key status 1204 included in the list is acquired, and it is determined whether the status is “DELETE”. If it is “DELETE”, the process proceeds to step S602, and if it is not “DELETE”, that is, if it is “ADD”, the process proceeds to step S601.

  That is, when the access key generated in step S513 described above is input via the access key input page of FIG. 24 displayed on the CRT 2010 of the client PC 100, the IC card is deleted (cannot be used). Then, the process proceeds to step S602. Further, when the access key generated in step S508 is input via the access key input page of FIG. 24 displayed on the CRT 2010 of the client PC 100, in order to register (make available) the IC card, The process proceeds to step S601.

  In step S601, control relating to card information registration is performed, and specifically, the processing in steps S237 to 244 is applicable, and thus description thereof is omitted.

  In step S602, the CPU 2001 of the IC card authentication server 200 searches the access key 1202 in step S236 by the user information management unit 252, and the corresponding access key corresponding to the access key acquired in step S234. The key issue time 1203 included in the list is acquired.

  In step S <b> 603, the CPU 2001 of the IC card authentication server 200 reads the deletion mode setting file (FIG. 22) held in the external memory 2011 of the IC card authentication server 200 by the user information management unit 252.

  In step S604, the CPU 2001 of the IC card authentication server 200 acquires the access key valid period 5002 (predetermined time) described in the deletion mode setting file read in step S603 by the user information management unit 252.

  In step S605, the CPU 2001 of the IC card authentication server 200 uses the user information management unit 252 to obtain the key issuance time acquired in step S602 and the current time (year / month / day / hour / minute / second) of the system managed by the IC card authentication server 200. If the time difference is within the access key validity period (predetermined time) acquired in step S604, the process proceeds to step S606. If the time difference is outside the period (exceeds the period), the process proceeds to step S245. (Time judgment)

  In step S606, the CPU 2001 of the IC card authentication server 200 uses the user information management unit 252 to obtain card information 1201 (for example, a manufacturing number) associated with the access key acquired in step S236.

  In step S607, the CPU 2001 of the IC card authentication server 200 deletes the card information 1302 corresponding to the user name acquired in step S214 (or step S234) from the user table (FIG. 13) by the user information management unit 252. Note that the card information corresponding to the access key may be specified from the access key list of FIG. 23, the card information 1302 that matches the specified card information may be searched, and the searched card information may be deleted. In other words, any method may be used as the method for specifying the card information to be deleted as long as the card information can be specified.

  In step S608, the CPU 2001 of the IC card authentication server 200 determines the card deletion result from the user table (FIG. 13) implemented in step S607. If the deletion has succeeded, the process proceeds to step S609, and if the deletion has failed (for example, if the card has not been registered), the process proceeds to step S246.

  In step S609, the CPU 2001 of the IC card authentication server 200 accesses the access key record acquired in step S236 by the user information management unit 252 because the card deletion from the user table (FIG. 13) executed in step S607 was successful. Delete from the key list (FIG. 23).

  In step S610, a registration result indicating that the card information has been deleted is transmitted to the printer 300. If a registration result indicating that the card information has been deleted is transmitted in step S610, the process proceeds to YES in step S248, and the process proceeds to step S249. In step S249, a deletion success page is created and transmitted to the client PC 100. Configure as follows.

  In addition, since the process after step S245 is the same process as Embodiment 1, description is abbreviate | omitted.

  With the above processing, an access key for a card deletion request is generated simply by performing processing for holding the IC card over a length longer than the threshold set in the authentication server. By inputting this access key from the browser, the user can delete any card information at any timing without bothering the administrator.

  It should be noted that the configuration and contents of the various data described above are not limited to this, and it goes without saying that the various data and configurations are configured according to the application and purpose.

  Although one embodiment has been described above, the present invention can take an embodiment as, for example, a system, apparatus, method, program, or recording medium, and specifically includes a plurality of devices. The present invention may be applied to a system including a single device.

  Further, the program according to the present invention is a program that allows a computer to execute the processing methods of FIGS. 6 to 10 and FIGS. 19 to 21, and the storage medium according to the present invention is illustrated in FIGS. 6 to 10 and FIGS. 19 to 21. A program that can be executed by a computer is stored. In addition, the program in this invention may be a program for every processing method of each apparatus of FIGS. 6-10 and 19-21.

As described above, a recording medium that records a program that implements the functions of the above-described embodiments is supplied to a system or apparatus, and a computer (or CPU or MPU) of the system or apparatus stores the program stored in the recording medium. It goes without saying that the object of the present invention can also be achieved by executing the reading.

  In this case, the program itself read from the recording medium realizes the novel function of the present invention, and the recording medium storing the program constitutes the present invention.

  As a recording medium for supplying the program, for example, a flexible disk, hard disk, optical disk, magneto-optical disk, CD-ROM, CD-R, DVD-ROM, magnetic tape, nonvolatile memory card, ROM, EEPROM, silicon A disk or the like can be used.

  Further, by executing the program read by the computer, not only the functions of the above-described embodiments are realized, but also an OS (operating system) operating on the computer based on an instruction of the program is actually It goes without saying that a case where the function of the above-described embodiment is realized by performing part or all of the processing and the processing is included.

  Furthermore, after the program read from the recording medium is written to the memory provided in the function expansion board inserted into the computer or the function expansion unit connected to the computer, the function expansion board is based on the instructions of the program code. It goes without saying that the case where the CPU or the like provided in the function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing.

  Further, the present invention may be applied to a system composed of a plurality of devices or an apparatus composed of a single device. Needless to say, the present invention can be applied to a case where the present invention is achieved by supplying a program to a system or apparatus. In this case, by reading a recording medium storing a program for achieving the present invention into the system or apparatus, the system or apparatus can enjoy the effects of the present invention.

  Furthermore, by downloading and reading a program for achieving the present invention from a server, database, etc. on a network by a communication program, the system or apparatus can enjoy the effects of the present invention.

  In addition, all the structures which combined each embodiment mentioned above and its modification are also included in this invention.

  In addition, each process realized by the above-described software can be realized as firmware or hardware configuration, and each process can be realized as each means. The technical scope of the present invention is realized by such firmware or hardware configuration. Is also included.

100 client PC
200 IC authentication server 300 Printer 400 Card reader 500 LAN
600 NIC

Claims (15)

An authentication server comprising user information storage means for storing the reading object identification information for identifying the reading object and the user identification information of the user who owns the reading object in association with each other, and reading the reading object An information processing system in which an apparatus including a reading unit and an information processing apparatus are communicably connected,
An apparatus comprising the reading means is
Reading object identification information transmitting means for transmitting reading object identification information of the reading object read by the reading means to the authentication server;
By transmitting the reading object identification information by the reading object identification information transmitting means,
Registration key information for registering the reading object identification information in the user information storage means or deletion key information corresponding to the reading object identification information for deleting the reading object identification information from the user information storage means and a key information receiving means for receiving from the authentication server,
Key information output means for outputting the registration key information or deletion key information received by the key information receiving means,
The authentication server is
Reading object identification information receiving means for receiving the reading object identification information transmitted by the reading object identification information transmitting means;
Registration determination means for determining whether or not the reading object identification information received by the reading object identification information receiving means is registered in the user information storage means;
When the registration determination unit determines that the reading object identification information is not registered in the user information storage unit, the registration key information is transmitted to an apparatus including the reading unit, and the registration determination unit Key information transmission means for transmitting the deletion key information to an apparatus comprising the reading means when it is determined that the reading object identification information is registered in the user information storage means ;
Information acquisition means for acquiring the registration key information or deletion key information input from the information processing apparatus and user identification information of a user who owns the reading object;
Registration means for associating the reading object identification information corresponding to the registration key information acquired by the information acquisition means with the user identification information acquired by the information acquisition means and registering it in the user information storage means ;
A deletion unit that deletes the reading object identification information corresponding to the deletion key information acquired by the information acquisition unit from the user information storage unit;
An information processing system comprising: The deletion means deletes the reading object identification information corresponding to the deletion key information acquired by the information acquisition means from the user information storage means when the reading object is read by the reading means for a predetermined time. The information processing system according to claim 1 . The authentication server is
Using the information of the validity period of the key information transmitted by the key information transmission means further includes a validity determining means for the registration key information acquired by the information acquisition means to determine whether it is valid,
Said registering means, in the validity determination unit, when the registration key information acquired by the information acquisition means is determined to be valid, the reading corresponding to the registered key information acquired by the information acquiring means 3. The information processing system according to claim 1, wherein the object identification information and the user identification information acquired by the information acquisition unit are registered in the user information storage unit in association with each other. The authentication server is
In the validity determination unit, when the registration key information acquired by the information acquisition means is determined to be valid, it transmits a registration success result information indicating the registration success, acquired by the information acquisition unit registration 4. The information processing system according to claim 3 , further comprising registration result information transmitting means for transmitting registration failure result information indicating a registration failure when it is determined that the key information is not valid . The validity determining unit further deletes the key information acquired by the information acquiring means determines whether or not valid,
Said deleting means is in the validity determination unit, when the delete key information acquired by the information acquisition means is determined to be valid, the reading corresponds to the delete key information acquired by the information acquisition means subject 5. The information processing system according to claim 3 , wherein the object identification information is deleted from the user information storage unit. The authentication server is
The effective determination unit, when the delete key information acquired by the information acquisition means is determined to be valid, and transmits a deletion successful result information indicating a successful deletion, deletion acquired by the information acquisition means 6. The information processing system according to claim 5 , further comprising a deletion result information transmitting unit that transmits deletion failure result information indicating a deletion failure when it is determined that the key information is not valid . The registration key information and the deletion key information are key information issued when the reading object identification information is received by the reading object identification information receiving unit,
  The registration unit registers the reading object identification information corresponding to the key information acquired by the information acquisition unit and the user identification information acquired by the information acquisition unit in association with each other in the user information storage unit. ,
  The said deletion means deletes the reading target object identification information corresponding to the said key information acquired by the said information acquisition means from the said user information storage means, The any one of Claim 1 thru | or 6 characterized by the above-mentioned. Information processing system. The key information output unit causes the display unit of the apparatus including the reading unit to display the registration key information or the deletion key information , or prints the registration key information or the deletion key information by a printing unit of the apparatus including the reading unit. The information processing system according to any one of claims 1 to 7 , wherein: The information processing apparatus includes:
Input acceptance means for accepting input of registration key information or deletion key information output by the key information output means, and user identification information of a user who owns the reading object;
To any one of claims 1 to 8, characterized in that it comprises an information transmitting unit that transmits the registration key information or delete key information and the user identification information input has been received by the input receiving means to the authentication server The information processing system described. The information transmitting unit transmits user identification information received by the input receiving unit to the authentication server via an apparatus including the reading unit, and authentication based on the user identification information transmitted to the authentication server. 10. The information processing system according to claim 9 , wherein the registration key information or the deletion key information is transmitted to the authentication server via an apparatus including the reading unit when the authentication is performed. An apparatus including a reading unit that reads a reading object; a reading object identification information that is communicably connected to the information processing apparatus and identifies the reading object; and user identification information of a user who owns the reading object An authentication server comprising user information storage means for storing
Reading object identification information receiving means for receiving reading object identification information transmitted from an apparatus comprising the reading means;
Registration determination means for determining whether or not the reading object identification information received by the reading object identification information receiving means is registered in the user information storage means;
The read object for registering the read object identification information in the user information storage means when the registration determination means determines that the read object identification information is not registered in the user information storage means when sending a registration key information corresponding to the identification information to the device with a pre-Symbol reading means, the read object identification information to the user information storage unit is determined to be registered by the registration determination unit, the Key information transmission means for transmitting deletion key information for deleting read object identification information from the user information storage means to an apparatus comprising the reading means ;
Information acquisition means for acquiring the registration key information or deletion key information input from the information processing apparatus and user identification information of a user who owns the reading object;
Registration means for associating the reading object identification information corresponding to the registration key information acquired by the information acquisition means with the user identification information acquired by the information acquisition means and registering it in the user information storage means ;
A deletion unit that deletes the reading object identification information corresponding to the deletion key information acquired by the information acquisition unit from the user information storage unit;
An authentication server comprising: An authentication server comprising user information storage means for storing the reading object identification information for identifying the reading object and the user identification information of the user who owns the reading object in association with each other, and reading the reading object A processing method in an information processing system in which an apparatus including a reading unit and an information processing apparatus are communicably connected,
A reading object identification information transmitting step in which a transmission unit of the apparatus including the reading unit transmits the reading object identification information of the reading object read by the reading unit to the authentication server;
The key information receiving means of the apparatus including the reading means transmits the reading object identification information in the reading object identification information transmitting step, thereby registering the reading object identification information in the user information storage means. Key information receiving step for receiving, from the authentication server , deletion key information corresponding to the reading object identification information for deleting the registration key information or the reading object identification information from the user information storage means ;
A key information output step of outputting the registration key information or the deletion key information received by the key information receiving step by a key information output unit of the apparatus comprising the reading unit;
A reading object identification information receiving unit for receiving the reading object identification information transmitted by the reading object identification information transmitting step;
A registration determination step for determining whether or not the read object identification information received by the read object identification information receiving step is registered in the user information storage means;
If the key information transmission unit of the authentication server determines that the reading object identification information is not registered in the user information storage unit by the registration determination step, the registration key information includes the reading unit. Key that is transmitted to the apparatus, and transmits the deletion key information to the apparatus having the reading means when the registration determining means determines that the reading object identification information is registered in the user information storage means An information transmission step;
An information acquisition step in which the information acquisition unit of the authentication server acquires the registration key information or deletion key information input from the information processing apparatus, and user identification information of a user who owns the reading object;
The registration means of the authentication server associates the reading object identification information corresponding to the registration key information acquired by the information acquisition step with the user identification information acquired by the information acquisition step, and the user information storage means A registration step to register with ,
A deletion step in which the deletion unit of the authentication server deletes the reading object identification information corresponding to the deletion key information acquired by the information acquisition step from the user information storage unit;
A processing method in an information processing system comprising : An apparatus including a reading unit that reads a reading object; a reading object identification information that is communicably connected to the information processing apparatus and identifies the reading object; and user identification information of a user who owns the reading object And a processing method of an authentication server comprising user information storage means for storing
A reading object identification information receiving unit that receives reading object identification information transmitted from an apparatus including the reading unit; and
A registration determination step for determining whether or not the reading object identification information received by the reading object identification information receiving step is registered in the user information storage unit;
When the key information transmission means determines that the reading object identification information is not registered in the user information storage means in the registration determination step, the reading object identification information is registered in the user information storage means. the reading sends a registration key information corresponding to the object identification information to the device with a pre-Symbol reading means, determines that the object to be read identification information to the user information storage means by said registration determination step is registered for A key information transmission step for transmitting deletion key information for deleting the reading object identification information from the user information storage means to an apparatus comprising the reading means ,
An information acquisition step in which the information acquisition means acquires the registration key information or deletion key information input from the information processing apparatus and user identification information of the user who owns the reading object;
Registration in which the registration unit associates the reading object identification information corresponding to the registration key information acquired in the information acquisition step with the user identification information acquired in the information acquisition step and registers the information in the user information storage unit. Steps ,
A deletion step in which the deletion unit deletes the reading object identification information corresponding to the deletion key information acquired by the information acquisition step from the user information storage unit;
A method for processing an authentication server, comprising: An authentication server comprising user information storage means for storing the reading object identification information for identifying the reading object and the user identification information of the user who owns the reading object in association with each other, and reading the reading object A program that can be executed by an information processing system in which an apparatus including a reading unit and an information processing apparatus are connected to be communicable,
An apparatus comprising the reading means;
Reading object identification information transmitting means for transmitting reading object identification information of the reading object read by the reading means to the authentication server;
By transmitting the reading object identification information by the reading object identification information transmitting means,
Registration key information for registering the reading object identification information in the user information storage means or deletion key information corresponding to the reading object identification information for deleting the reading object identification information from the user information storage means and a key information receiving means for receiving from the authentication server,
Function as key information output means for outputting the registration key information or deletion key information received by the key information receiving means,
The authentication server,
Reading object identification information receiving means for receiving the reading object identification information transmitted by the reading object identification information transmitting means;
Registration determination means for determining whether or not the reading object identification information received by the reading object identification information receiving means is registered in the user information storage means;
When the registration determination unit determines that the reading object identification information is not registered in the user information storage unit, the registration key information is transmitted to an apparatus including the reading unit, and the registration determination unit Key information transmission means for transmitting the deletion key information to an apparatus comprising the reading means when it is determined that the reading object identification information is registered in the user information storage means ;
Information acquisition means for acquiring the registration key information or deletion key information input from the information processing apparatus and user identification information of a user who owns the reading object;
Registration means for associating the reading object identification information corresponding to the registration key information acquired by the information acquisition means with the user identification information acquired by the information acquisition means and registering it in the user information storage means ;
Program for causing to function as a deleting means for deleting read object identification information corresponding to the delete key information acquired by the information acquiring means from the user information storage unit. An apparatus including a reading unit that reads a reading object; a reading object identification information that is communicably connected to the information processing apparatus and identifies the reading object; and user identification information of a user who owns the reading object A program that can be executed by an authentication server including user information storage means for storing
The authentication server,
Reading object identification information receiving means for receiving reading object identification information transmitted from an apparatus comprising the reading means;
Registration determination means for determining whether or not the reading object identification information received by the reading object identification information receiving means is registered in the user information storage means;
The read object for registering the read object identification information in the user information storage means when the registration determination means determines that the read object identification information is not registered in the user information storage means when sending a registration key information corresponding to the identification information to the device with a pre-Symbol reading means, the read object identification information to the user information storage unit is determined to be registered by the registration determination unit, the Key information transmission means for transmitting deletion key information for deleting read object identification information from the user information storage means to an apparatus comprising the reading means ;
Information acquisition means for acquiring the registration key information or deletion key information input from the information processing apparatus and user identification information of a user who owns the reading object;
Registration means for associating the reading object identification information corresponding to the registration key information acquired by the information acquisition means with the user identification information acquired by the information acquisition means and registering it in the user information storage means ;
A program that causes reading object identification information corresponding to deletion key information acquired by the information acquisition unit to function as a deletion unit that deletes from the user information storage unit .

Images