Information processing device, information processing system, information processing method, and computer readable medium

Abstract

The present invention provides an information processing device, an information processing system, an information processing method, and a computer-readable medium. The information processing device has: an authentication unit that authenticates a user; a sending unit that sends user identification information of a user authenticated by the authentication unit to a management device via a dedicated network for sending and receiving user restriction information and restriction information; a receiving unit that receives restriction information of the user corresponding to the sent user identification information from the management device via the dedicated network; and a control unit that controls the range of functions that the user can use based on the restriction information received by the receiving unit.

Description

Technical Field

[0001] The present disclosure relates to an information processing device, an information processing system, an information processing method, and a computer-readable medium. Background Art

[0002] Japanese Patent Application Laid-Open No. 2004-320617 discloses an information management system that authenticates information access from a portable terminal based on the terminal holder's ID and password and also dynamically determines access permission / denial based on access location information.

[0003] Summary of the invention

[0004] The purpose of the present disclosure is to provide an information processing device, an information processing system, an information processing method, and a computer-readable medium storing a program for such processing, which can obtain restriction information corresponding to user identification information without sending the user identification information of the user via a network used by unspecified users.

[0005] [Information processing device]

[0006] According to a first aspect of the present disclosure, there is provided an information processing device, comprising:

[0007] a sending unit that sends user identification information of a user authenticated by the authentication unit that authenticates the user to the management device via a dedicated network for sending and receiving user restriction information and restriction information;

[0008] a receiving unit that receives restriction information of the user corresponding to the transmitted user identification information from the management device via the dedicated network; and

[0009] A control unit controls the range of functions that can be used by the user based on the restriction information received by the receiving unit.

[0010] According to the second aspect of the present disclosure, the restriction information is access right information for restricting a range that an authenticated user can access.

[0011] According to the third aspect of the present disclosure, the access right information is information for specifying a function permitted to be used among the functions of the own device.

[0012] According to a fourth aspect of the present disclosure, the access right information is information on restrictions when accessing other devices via a network different from the dedicated network.

[0013] According to the fifth aspect of the present disclosure, when the authentication unit authenticates the user, the control unit disables part of the functions that can be used for the user or disables all the functions before receiving the restriction information from the management device.

[0014] According to a sixth aspect of the present disclosure, when the authentication unit authenticates the user, the control unit disables part of or all of the functions of the own device for the user before receiving restriction information from the management device.

[0015] According to the seventh scheme of the present disclosure, when the control unit authenticates the user through the authentication unit, before receiving restriction information from the management device, for the user, the control unit invalidates part of the function when accessing other devices via a network different from the dedicated network, or invalidates all the functions.

[0016] According to the eighth aspect of the present disclosure, the sending unit sends the device identification information of the device to the management device together with the user identification information of the user authenticated by the authentication unit.

[0017] The receiving unit receives restriction information of the user corresponding to the transmitted user identification information and device identification information from the management device.

[0018] According to a ninth aspect of the present disclosure, the sending unit sends the network identification information of a network different from the dedicated network to the management device together with the user identification information of the user authenticated by the authentication unit.

[0019] The receiving unit receives restriction information of the user corresponding to the transmitted user identification information and network identification information from the management device.

[0020] According to the tenth aspect of the present disclosure, the control unit deletes the restriction information received from the management device when communication with the authenticated user is interrupted for more than a preset time or when the distance between the authenticated user and the management device becomes greater than a preset distance.

[0021] According to the eleventh aspect of the present disclosure, the dedicated network is a wireless communication line that can be connected to the management device without requiring network settings.

[0022] According to a twelfth aspect of the present disclosure, the wireless communication line is a wireless communication line based on a wide area wireless communication network, and the wide area wireless communication network transmits and receives data at a communication speed lower than a communication speed in a network different from the dedicated network.

[0023] [Information Processing System]

[0024] According to a 13th aspect of the present disclosure, there is provided an information processing system comprising a management device and an information processing device.

[0025] The management device stores the user identification information of the user and the restriction information that restricts the range of functions that the user can use in association with each other.

[0026] The information processing device comprises:

[0027] an authentication unit, which authenticates the user;

[0028] a sending unit that sends the user identification information of the user authenticated by the authentication unit to the management device via a dedicated network for sending and receiving user restriction information and restriction information;

[0029] a receiving unit that receives restriction information of the user corresponding to the transmitted identification information from the management device via the dedicated network; and

[0030] A control unit controls the range of functions that can be used by the user based on the restriction information received by the receiving unit.

[0031] [Computer readable medium]

[0032] According to a 14th aspect of the present disclosure, there is provided a computer-readable medium storing a program for causing a computer to execute a process, the process comprising:

[0033] Authenticate the user;

[0034] Sending the user identification information of the authenticated user to the management device via a dedicated network for sending and receiving user restriction information and restriction information;

[0035] receiving restriction information of the user corresponding to the transmitted user identification information from the management device via the dedicated network; and

[0036] The range of functions that can be used by the user is controlled according to the received restriction information.

[0037] [Information processing method]

[0038] According to a fifteenth aspect of the present disclosure, there is provided an information processing method, comprising:

[0039] Authenticate the user;

[0040] Sending the user identification information of the authenticated user to the management device via a dedicated network for sending and receiving user restriction information and restriction information;

[0041] receiving restriction information of the user corresponding to the transmitted user identification information from the management device via the dedicated network; and

[0042] Based on the received restriction information, the range of functions that the user can use is controlled.

[0043] (Effect)

[0044] According to the first aspect, it is possible to provide an information processing device capable of acquiring restriction information corresponding to user identification information without transmitting the user identification information of the user via a network used by an unspecified user.

[0045] According to the second aspect, it is possible to provide an information processing device capable of acquiring access right information corresponding to user identification information without transmitting the user identification information of the user via a network used by an unspecified user.

[0046] According to the third aspect, it is possible to provide an information processing device capable of acquiring access right information corresponding to user identification information without transmitting the user identification information of the user via a network used by an unspecified user.

[0047] According to the fourth aspect, it is possible to provide an information processing device capable of acquiring access right information corresponding to user identification information without transmitting the user identification information of the user via a network used by an unspecified user.

[0048] According to the fifth aspect, it is possible to provide an information processing apparatus that can prevent the authenticated user from using a function that is not originally usable until the restriction information is received from the management apparatus.

[0049] According to the sixth aspect, it is possible to provide an information processing device that can prevent the authenticated user from using the function of the device that is not originally usable, during the period before receiving the restriction information from the management device.

[0050] According to the seventh aspect, it is possible to provide an information processing device that can prevent an authenticated user from using a function that is not normally usable when accessing another device via a network before receiving restriction information from the management device.

[0051] According to the eighth aspect, it is possible to provide an information processing device capable of acquiring restriction information corresponding to user identification information and device identification information without transmitting the user identification information of the user via a network used by an unspecified user.

[0052] According to the ninth aspect, it is possible to provide an information processing device capable of acquiring restriction information corresponding to user identification information and network identification information without transmitting the user identification information of the user via a network used by an unspecified user.

[0053] According to the tenth aspect, it is possible to provide an information processing device that can prevent unnecessary restriction information from remaining in the device.

[0054] According to the eleventh aspect, it is possible to provide an information processing device that can acquire restriction information corresponding to user identification information without requiring network settings for connecting to a management device and without transmitting the user identification information of the user via a network used by unspecified users.

[0055] According to the twelfth aspect, it is possible to provide an information processing device that can acquire restriction information corresponding to user identification information without requiring network settings for connecting to a management device and without transmitting the user identification information of the user via a network used by unspecified users.

[0056] According to the thirteenth aspect, it is possible to provide an information processing system capable of acquiring restriction information corresponding to user identification information without transmitting the user identification information of the user via a network used by an unspecified user.

[0057] According to the fourteenth aspect, it is possible to provide a computer-readable medium storing a program capable of acquiring restriction information corresponding to user identification information without transmitting the user identification information of the user via a network used by an unspecified user.

[0058] According to the fifteenth aspect, it is possible to provide an information processing method capable of acquiring access right information corresponding to user identification information without transmitting the user identification information of the user via a network used by an unspecified user. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 1 is a diagram showing a system configuration of an information processing system according to an embodiment of the present disclosure.

[0060] Figure 2 1 is a block diagram showing a hardware configuration of the image forming apparatus 10 according to one embodiment of the present disclosure.

[0061] Figure 3 1 is a block diagram showing a functional configuration of the image forming apparatus 10 according to one embodiment of the present disclosure.

[0062] Figure 4 Detailed description of the invention is a block diagram showing the hardware structure of the access rights management server 60 in one embodiment of the present disclosure.

[0063] Figure 5 Detailed Description of the Invention FIG. 6 is a block diagram showing a functional structure of the access rights management server 60 in one embodiment of the present disclosure.

[0064] Figure 6 2 is a diagram showing an example of an access right management table stored in the access right information storage unit 63 .

[0065] Figure 7 It is used to illustrate Figure 6 FIG. 1 is a diagram showing the types of interfaces in the access right information managed in the access right management table.

[0066] Figure 8 This is a sequence diagram for explaining the transmission and reception of data among the portable terminal device 80 , the image forming device 10 , and the access right management server 60 .

[0067] Fig. 9 2 is a diagram showing an example of an access right management table stored in the access right information storage unit 63 .

[0068] Fig.10 2 is a diagram showing an example of an access right management table stored in the access right information storage unit 63 .

[0069] Fig.11 This is a sequence diagram for explaining the transmission and reception of data among the portable terminal device 80 , the image forming device 10 , and the access right management server 60 when the access right information differs for each network ID or each device ID. DETAILED DESCRIPTION

[0070] Next, embodiments of the present disclosure will be described in detail with reference to the drawings.

[0071] Figure 1 The system configuration of an information processing system according to one embodiment of the present disclosure is shown.

[0072] The information processing system of the present embodiment is configured as follows: image forming apparatuses 10A and 10B, LPWA (abbreviation of Low Power Wide Area) communication modules 20A and 20B respectively connected to the image forming apparatuses 10A and 10B, and an access right management server 60 storing management information for managing setting information of a plurality of image forming apparatuses including the image forming apparatuses 10A and 10B are connected via a base station 40 and an LPWA communication network 50.

[0073] Furthermore, in the information processing system of the present embodiment, different in-house networks A and B are constructed for each base of a certain company, and each of the in-house networks A and B is connected to the Internet 30 via gateway devices 70A and 70B.

[0074] In addition, in the present embodiment, for the sake of simplicity of description, only two image forming apparatuses 10A and 10B are shown for description, but the same structure can be applied even when there are three or more image forming apparatuses. In addition, since the two image forming apparatuses 10A and 10B have the same structure, in the following description, when summarizing the structures of the two image forming apparatuses 10A and 10B, they are described as the image forming apparatus 10.

[0075] Furthermore, in the information processing system of the present embodiment, when a user belonging to a certain company uses the image forming apparatuses 10A and 10B, he cannot use the image forming apparatuses 10A and 10B unless user authentication is performed. Furthermore, in the information processing system of the present embodiment, access rights are set for each user, and the access rights are used to control which functions of the image forming apparatuses 10A and 10B can be used and which information can be sent and received through which interface.

[0076] The access rights are managed in the access rights management server 60. That is, the access rights management server 60 is a management device that stores the user ID as user identification information and the access rights information as restriction information that restricts the range of functions that the user can use in association with each other.

[0077] Here, in the information processing system of the present embodiment, a case will be described in which a user whose user identifier (hereinafter referred to as user ID) is 10001 uses the image forming apparatus 10A.

[0078] Furthermore, in the present embodiment, a user ID is stored in a portable terminal device 80 held by the user, and authentication is performed by bringing the portable terminal device 80 close to a specified portion of the image forming apparatus 10A, 10B, and reading the user ID via short-range wireless communications such as BLE (abbreviation for Bluetooth Low Energy (registered trademark) Low Energy) and NFC (abbreviation for Near Field Communication).

[0079] In addition, the image forming apparatus 10 uses a network identifier (hereinafter referred to as a network ID) as network identification information to identify the network to which the image forming apparatus 10 is connected.

[0080] Here, the network ID refers to information that can uniquely identify the network environment, and any information can be used as the network ID as long as it is information that can uniquely identify the network environment. In addition, in the present embodiment, as an example of a network ID, the case of using the MAC (abbreviation of Media Access Control) address of a gateway device is described. For example, the image forming device 10 determines that the network connected using the MAC address of the gateway device 70A called "9C:AE:D3:D7:AE:36" is network A, and determines that the network connected using the MAC address of the gateway device 70B called "AC:36:43:CA:AE:25" is network B.

[0081] In addition, Figure 1 In the information processing system of the present embodiment, only the image forming apparatus 10 is denoted by reference numerals and described, but other image forming apparatuses other than the image forming apparatus 10 are also connected to the networks A and B.

[0082] Furthermore, in the present embodiment, the image forming apparatuses 10A and 10B are configured to access the access right management server 60 via the LPWA communication network 50 and acquire the access right information of the authenticated user.

[0083] Here, such an access right management server 60 may be configured to be accessible via the Internet 30 .

[0084] However, if some kind of network failure occurs and image forming apparatus 10 cannot connect to Internet 30 , or if network settings in image forming apparatus 10 are inappropriate and cannot access Internet 30 , the functions of image forming apparatus 10 cannot be used at all.

[0085] Furthermore, in recent years, from the viewpoint of security, the network in which the image forming apparatus 10 is installed may be disconnected from the Internet 30 or a firewall may be installed in the middle to prevent the connection with the access right management server 60 .

[0086] Furthermore, there are cases where authentication information such as not only the user ID but also the password information is used when the user performs authentication processing in the image forming apparatus 10. When the user's personal information such as the user ID and the password information is transmitted and received via a network such as the Internet 30 used by unspecified users, there is a possibility that information leakage may occur in the middle, which may cause a security problem.

[0087] Therefore, in the information processing system of this embodiment, by configuring as follows, it is possible to obtain restriction information corresponding to user identification information without transmitting the user identification information of the user via a network such as the Internet 30 used by an unspecified user.

[0088] Therefore, in the information processing system of this embodiment, when a user attempts to use the image forming device 10 and is authenticated, the image forming device 10 connects to the access right management server 60 via LPWA, which is a power-saving wide area wireless communication line, and obtains the access right information of the user.

[0089] This LPWA is also called LPWAN (Low Power Wide Area Network), and is a wireless communication line that can transmit and receive data over a wide area with low power consumption, although it cannot perform high-speed communication.

[0090] The LPWA is a wireless communication line that can connect to the access right management server 60 without network settings. LPWA is a wireless communication line based on a wide area wireless communication network that transmits and receives data at a communication speed lower than the communication speed of the Internet 30 as an external network.

[0091] Furthermore, in recent years, commercial services of the LPWA wireless communication lines have been provided, and the services can be used at lower communication charges than line contracts of mobile phone line networks.

[0092] Next, Figure 2 The block diagram shows Figure 1 The hardware structure of the image forming apparatus 10 is shown.

[0093] like Figure 2 As shown in FIG. 1 , the image forming apparatus 10 includes a CPU 11, a memory 12, a storage device 13 such as a hard disk drive (abbreviation of HDD), a communication interface (abbreviation of IF) 14 for transmitting and receiving data with other image forming apparatuses 10 and the like via the Internet 30, a user interface (abbreviation of UI) device 15 including a touch panel or a liquid crystal display and a keyboard, a scanner 16, and a print engine 17. These components are connected to each other via a control bus 18. In addition, the LPWA communication module 20 is also connected to the above-mentioned components via the control bus 18.

[0094] The CPU 11 executes a predetermined process according to a control program stored in the memory 12 or the storage device 13 to control the operation of the image forming apparatus 10. In the present embodiment, the CPU 11 is described by assuming that it reads and executes a control program stored in the memory 12 or the storage device 13. However, the program may be stored in a storage medium such as a CD-ROM and provided to the CPU 11.

[0095] Figure 3 1 is a block diagram showing a functional configuration of the image forming apparatus 10 realized by executing the above-mentioned control program.

[0096] like Figure 3 As shown, the image forming apparatus 10 of the present embodiment includes an authentication section 31 , an operation input section 32 , a display section 33 , a data transceiver section 34 , a control section 35 , an image reader 36 , a data storage section 37 , and an image output section 38 .

[0097] The authentication unit 31 authenticates the user who wants to use the image forming apparatus 10. Specifically, the authentication unit 31 obtains authentication information such as a user ID and password information from the portable terminal device 80 held by the user, and performs authentication by identifying the user. Here, the user ID refers to user identification information for identifying the user who uses the image forming apparatus 10.

[0098] The operation input unit 32 inputs various operations by the user. The display unit 33 displays various information to the user.

[0099] The image reading section 36 reads an image from a placed document under the control of the control section 35. The image output section 38 outputs an image to a recording medium such as printing paper under the control of the control section 35.

[0100] The data transceiver 34 transmits and receives data to and from an external device via the Internet 30 .

[0101] The access right information storage unit 37 stores setting information for performing various controls by the control unit 35 or temporarily stores the acquired access right information of the user.

[0102] The control unit 35 controls the image reading unit 36 ​​and the image output unit 38 to execute various processes such as scanning, printing, and copying.

[0103] Then, the LPWA communication module 20 transmits the user ID of the user authenticated by the authentication unit 31 to the access right management server 60 via the LPWA communication network 50 .

[0104] Here, in normal operation, the image forming apparatus 10 transmits and receives data with other devices via the networks A and B, or transmits and receives data with external devices via the Internet 30 via the gateway devices 70A and 70B. That is, the Internet 30, the networks A and B, etc. are networks that the image forming apparatus 10 normally uses.

[0105] Furthermore, for the image forming device 10, the LPWA communication network 50 is not a network that is generally used, but a dedicated network for sending and receiving user IDs and access right information. In other words, the LPWA communication network 50 is a network that is used only when sending and receiving user IDs and access right information, and the image forming device 10 may send and receive only user IDs and access right information via the LPWA communication network 50, or may include other information.

[0106] Then, the LPWA communication module 20 receives access right information of the user corresponding to the transmitted user ID from the access right management server 60 via the LPWA communication network 50 .

[0107] Then, the control unit 35 controls the range of functions that the user can use based on the access right information received from the LPWA communication module 20 .

[0108] Here, the access right information is information for limiting the scope of access that the authenticated user can have. For example, the access right information is information for determining the functions that are permitted to be used among the functions of the present device. In addition, the access right information is information on restrictions when accessing other devices via a network different from the LPWA communication network 50 which is a dedicated network.

[0109] Furthermore, when the authentication unit 31 authenticates the user, the control unit 35 disables all functions that can be used by the user before receiving the access right information from the access right management server 60. Alternatively, when the authentication unit 31 authenticates the user, the control unit 35 may disable not all functions that can be used by the user but a part of the functions that can be used by the user before receiving the access right information from the access right management server 60.

[0110] Specifically, when the authentication unit 31 authenticates a user, the control unit 35 disables part of the functions of the own device or disables all the functions for the user before receiving the access right information from the access right management server 60 .

[0111] In addition, specifically, when the control unit 35 and the authentication unit 31 authenticate a user, before receiving the access right information from the access right management server 60, for the user, a part of the interface function when accessing other devices via a network different from the LPWA communication network 50 is disabled, or all the interface functions are disabled.

[0112] Furthermore, the control unit 35 deletes the access right information received from the access right management server 60 when communication with the authenticated user is interrupted for a preset time period or longer, for example, 30 seconds or longer, or when the distance between the authenticated user and the control unit 35 becomes longer than a preset distance.

[0113] Next, Figure 4 Show Figure 1 The hardware structure of the access right management server 60 is shown.

[0114] like Figure 4 As shown in FIG. 1 , the access right management server 60 includes a CPU 41, a memory 42, a storage device 43 such as a hard disk drive (abbreviation of HDD), a communication interface (abbreviation of IF) 44 for transmitting and receiving data with the image forming device 10 via the LPWA communication network 50, and a user interface (abbreviation of UI) device 45 including a touch panel, a liquid crystal display, and a keyboard. These components are connected to each other via a control bus 46.

[0115] The CPU 41 executes a predetermined process according to a control program stored in the memory 42 or the storage device 43, and controls the operation of the access right management server 60. In addition, in the present embodiment, the CPU 41 is described by assuming that it reads and executes a control program stored in the memory 42 or the storage device 43, but the program can also be stored in a storage medium such as a CD-ROM and provided to the CPU 41.

[0116] Figure 5 2 is a block diagram showing the functional structure of the access right management server 60 realized by executing the above-mentioned control program.

[0117] like Figure 5 As shown, the access right management server 60 includes a control unit 61 , a data transceiver unit 62 , and an access right information storage unit 63 .

[0118] The access right information storage unit 63 stores an access right management table in which the user IDs of users and access rights are associated with each other.

[0119] Figure 6 An example of the access rights management table is shown. Figure 7 , yes Figure 6The types of interfaces in the access right information managed in the access right management table shown in FIG.

[0120] Reference Figure 7 As can be seen, the interface using a short-range wireless line such as NFC or BLE between the portable terminal device 80 held by the user and the image forming device 10 is set as IF 1. In addition, the interface using the LPWA communication network 50 connecting the image forming device 10 and the access right management server 60 is set as IF 2.

[0121] An interface using a WiFi (registered trademark) line between the portable terminal device 80 and the image forming apparatus 10 is set as IF 3. Also, an interface using Ethernet (registered trademark) or the like to which the image forming apparatus 10A is connected is set as IF 4.

[0122] Furthermore, the term “local” means various functions of the image forming apparatus 10A such as copying and scanning that are utilized via the operation panel of the image forming apparatus 10A.

[0123] And, if Figure 6 As shown, in the access right management table, for each user ID, the range of functions that the user can use and access right information indicating which information is permitted to be sent and received via which network and which functions are permitted to be used are managed.

[0124] For example, for the user whose user ID is “10001”, it is indicated that only the functions of “black and white copy” and “scan” among the various functions of the image forming apparatus 10 are permitted for the image forming apparatus 10 which is the local apparatus.

[0125] Furthermore, for the user with user ID "10001", only transmission and reception of authentication information is permitted via IF 1, i.e., the short-distance wireless line. Similarly, only transmission and reception of authentication information is permitted via ID 2, i.e., the LPWA communication network 50.

[0126] In addition, for the user whose user ID is "10001", it is indicated that only the black and white printing and pull scan functions are permitted to be used via the IF 3, that is, the WiFi (registered trademark) line between the portable terminal device 80. And it is indicated that access to other devices via the IF 4, that is, the network A is prohibited. Here, the pull scan means a scan in which the image forming device 10 is instructed to execute a scan process according to an instruction from the portable terminal device 80.

[0127] When the data transceiver 62 receives the user ID from the image forming device 10 via the LPWA communication network 50 , the control unit 61 reads the access right information corresponding to the received user ID from the access right information storage unit 63 , and transmits the access right information to the image forming device 10 that transmitted the user ID via the LPWA communication network 50 .

[0128] Next, the operation of the image forming apparatus 10 according to the present embodiment will be described in detail with reference to the drawings.

[0129] Reference Figure 8 The timing chart of FIG. 1 will describe the transmission and reception of data between the image forming device 10 and the access right management server 60 when the user holding the portable terminal device 80 performs the authentication process in the image forming device 10.

[0130] First, in step S101 , the user transmits a user ID from the portable terminal device 80 to the image forming device 10 via a short-distance wireless link to perform an authentication process.

[0131] Then, in step S102 , the image forming apparatus 10 executes an authentication process for the user based on the received user ID.

[0132] Then, when the authentication process is completed, in step S103 , the image forming apparatus 10 restricts the use of all interfaces and functions for the user.

[0133] Then, in step S104, the image forming device 10 transmits the user ID to the access right management server 60. Then, in step S105, the access right management server 60 reads the access right information corresponding to the received user ID from the access right management table and returns the access right information to the image forming device 10.

[0134] In step S106 , the image forming apparatus 10 that has received the access right information permits the user to use the image forming apparatus 10 using the acquired access right information.

[0135] Then, when the user is away from the image forming apparatus 10 and communication with the portable terminal device 80 held by the user becomes impossible for a predetermined period of time or longer, the image forming apparatus 10 deletes the acquired access right information in step S107 .

[0136] In addition, Figure 6 The access right management table shown in the figure shows, as an example, a case where different access right information is stored in association with each user ID.

[0137] However, the access right information may be associated so as to be different for each combination of the user ID and the network ID. Fig. 9An example of such an access right management table is shown below.

[0138] exist Fig. 9 , an example of an access right management table is shown which stores different access right information in association with each combination of a user ID and a network ID.

[0139] That is, even if the user ID is the same, if the network ID is different, the content of the access right information will also be different.

[0140] Specifically, refer to Fig. 9 It can be seen from the access rights management table that when the user ID is "10001" and the network ID is "9C:AE:D3:D7:AE:36", the functions of "black and white copy" and "scan" are permitted as local functions. Conversely, when the user ID is "10001" and the network ID is "AC:36:43:CA:AE:25", the functions of "color copy" and "scan" are permitted as local functions.

[0141] That is, in Figure 1 In the information processing system having the structure shown, when a user with the user ID "10001" is authenticated and attempts to use the image forming apparatus 10A connected to the network A, the "monochrome copy" and "scan" functions can be used. On the other hand, when the user is authenticated and attempts to use the image forming apparatus 10B connected to the network B, the "color copy" and "scan" functions can be used.

[0142] That is, by setting access right information for each combination of a user ID and a network ID in this way, it is possible to change functions permitted to the same user and interfaces available for each network to which the image forming apparatus 10 is connected.

[0143] When such access right information is set, the LPWA communication module 20 of the image forming device 10 transmits the network ID of the network to which the device is connected together with the user ID of the user authenticated by the authentication unit 31 to the access right management server 60. Then, the LPWA communication module 20 of the image forming device 10 receives the access right information of the user corresponding to the transmitted user ID and network ID from the access right management server 60.

[0144] Alternatively, the access right information may be associated so as to differ for each combination of the user ID and the device ID. Fig.10 An example of such an access right management table is shown below.

[0145] Here, description will be given using a case where the device ID of the image forming apparatus 10A is set to “99901” and the device ID of the image forming apparatus 10B is set to “99902”.

[0146] exist Fig.10 , an example of an access right management table is shown which stores different access right information in association with each combination of a user ID and a device ID.

[0147] That is, even if the user ID is the same, if the device ID is different, the content of the access right information will also be different.

[0148] Specifically, refer to Fig.10 It can be seen from the access rights management table that when the user ID is "10001" and the device ID is "99901", the functions of "black and white copy" and "scan" are permitted as local functions. Conversely, when the user ID is "10001" and the device ID is "99902", the functions of "color copy" and "scan" are permitted as local functions.

[0149] That is, in Figure 1 In the information processing system having the structure shown, when a user with the user ID "10001" is authenticated in the image forming apparatus 10A and attempts to use the system, the "monochrome copy" and "scan" functions can be used. On the other hand, when the user is authenticated in the image forming apparatus 10B and attempts to use the system, the "color copy" and "scan" functions can be used.

[0150] That is, by setting the access right information for each combination of the user ID and the device ID in this way, the functions permitted to the same user and the usable interface can be changed for each image forming device 10 to be used.

[0151] When such access right information is set, the LPWA communication module 20 of the image forming device 10 transmits the device ID of the device 10 together with the user ID of the user authenticated by the authentication unit 31 to the access right management server 60. Then, the LPWA communication module 20 of the image forming device 10 receives the access right information of the user corresponding to the transmitted user ID and device ID from the access right management server 60.

[0152] Finally, refer to Fig.11 The timing diagram of FIG. 1 will be used to describe the transmission and reception of data between the portable terminal device 80, the image forming device 10, and the access right management server 60 when the access right information differs for each network ID or each device ID as described above.

[0153] In addition, Fig.11In the timing diagram, relative to Figure 8 In the sequence diagram shown, only the process of step S104 is replaced by step S104A, and therefore only the different processes will be described.

[0154] After the authentication process of the user who holds the portable terminal device 80 is completed and the use of all interfaces and functions by the user is restricted, in step S104A, the image forming device 10 sends the user ID and network ID, or the user ID and device ID to the access right management server 60. Then, in step S105, the access right management server 60 reads the access right information corresponding to the received user ID and network ID, or user ID and device ID from the access right management table, and returns the access right information to the image forming device 10.

[0155] Furthermore, the operation of the image forming apparatus 10 after receiving the access right information from the access right management server 60 is similar to that of Figure 8 The timing diagrams shown are the same.

[0156] [Modifications]

[0157] In the present embodiment, the case where access rights information in the image forming device 10 is obtained from the access rights management server 60 is described, but the present disclosure is not limited to this. Even when access rights information in other information processing devices other than the image forming device is obtained from the access rights management server 60, the present disclosure is also applicable.

Claims

1. An information processing device, wherein: The information processing device comprises: an authentication unit, which authenticates the user; a transceiver unit for transmitting and receiving data to and from an external device via a first network used by an unspecified user; a sending unit that sends user identification information of the user authenticated by the authentication unit to the management device via a second network different from the first network, the second network being a dedicated network for sending and receiving user identification information and restriction information; a receiving unit that receives restriction information of the user corresponding to the transmitted user identification information from the management device via the second network; as well as a control unit configured to control the range of functions that the user can use based on the restriction information received by the receiving unit, The second network is a wireless communication line based on a wide area wireless communication network that can be connected to the management device without network setting, and the wide area wireless communication network sends and receives data at a communication speed lower than the communication speed in the first network.

2. The information processing device according to claim 1, wherein: The restriction information is access right information for limiting the scope that an authenticated user can access.

3. The information processing device according to claim 2, wherein: The access right information is information for specifying a function permitted to be used among the functions of the own device.

4. The information processing device according to claim 2, wherein: The access right information is information regarding restrictions when accessing other devices via a network different from the second network.

5. The information processing device according to any one of claims 1 to 4, wherein: When the authentication unit authenticates the user, the control unit disables part of the functions that can be used for the user or disables all the functions before receiving the restriction information from the management device.

6. The information processing device according to claim 5, wherein: When the authentication unit authenticates the user, the control unit disables part of the functions of the own device or disables all the functions for the user before receiving the restriction information from the management device.

7. The information processing device according to claim 5, wherein: When the authentication unit authenticates the user, the control unit disables part of or all of the functions of the user accessing other devices via a network different from the second network before receiving restriction information from the management device.

8. The information processing device according to claim 1, wherein: The sending unit sends the device identification information of the device and the user identification information of the user authenticated by the authentication unit to the management device. The receiving unit receives restriction information of the user corresponding to the transmitted user identification information and device identification information from the management device.

9. The information processing device according to claim 1, wherein: The sending unit sends the network identification information of a network different from the second network to the management device together with the user identification information of the user authenticated by the authentication unit. The receiving unit receives restriction information of the user corresponding to the transmitted user identification information and network identification information from the management device.

10. The information processing device according to claim 1, wherein: The control unit deletes the restriction information received from the management device when communication with the authenticated user is interrupted for a predetermined time period or longer, or when the distance between the authenticated user and the management device becomes greater than a predetermined distance.

11. An information processing system, wherein: The information processing system comprises a management device and an information processing device. The management device stores the user identification information of the user and the restriction information that restricts the range of functions that the user can use in association with each other. The information processing device comprises: an authentication unit, which authenticates the user; a transceiver unit for transmitting and receiving data to and from an external device via a first network used by an unspecified user; a sending unit that sends user identification information of the user authenticated by the authentication unit to the management device via a second network different from the first network, the second network being a dedicated network for sending and receiving user identification information and restriction information; a receiving unit that receives restriction information of the user corresponding to the transmitted identification information from the management device via the second network; as well as a control unit configured to control the range of functions that the user can use based on the restriction information received by the receiving unit, The second network is a wireless communication line based on a wide area wireless communication network that can be connected to the management device without network setting, and the wide area wireless communication network sends and receives data at a communication speed lower than the communication speed in the first network.

12. A computer-readable medium storing a program for causing a computer to execute a process, wherein: The processing includes: Authenticate the user; Sending and receiving data with external devices via the first network used by unspecified users; sending the user identification information of the authenticated user to the management device via a second network different from the first network, the second network being a dedicated network for sending and receiving the user identification information and the restriction information; receiving restriction information of the user corresponding to the transmitted user identification information from the management device via the second network; as well as controlling the range of functions that the user can use based on the received restriction information, The second network is a wireless communication line based on a wide area wireless communication network that can be connected to the management device without network setting, and the wide area wireless communication network sends and receives data at a communication speed lower than the communication speed in the first network.

13. An information processing method, wherein: Include: Authenticate the user; Sending and receiving data with external devices via the first network used by unspecified users; sending the user identification information of the authenticated user to the management device via a second network different from the first network, the second network being a dedicated network for sending and receiving the user identification information and the restriction information; receiving restriction information of the user corresponding to the transmitted user identification information from the management device via the second network; as well as controlling the range of functions that the user can use based on the received restriction information, The second network is a wireless communication line based on a wide area wireless communication network that can be connected to the management device without network setting, and the wide area wireless communication network sends and receives data at a communication speed lower than the communication speed in the first network.

14. A program product comprising a program causing a computer to execute a process, wherein: The processing includes: Authenticate the user; Sending and receiving data with external devices via the first network used by unspecified users; sending the user identification information of the authenticated user to the management device via a second network different from the first network, the second network being a dedicated network for sending and receiving the user identification information and the restriction information; receiving restriction information of the user corresponding to the transmitted user identification information from the management device via the second network; as well as controlling the range of functions that the user can use based on the received restriction information, The second network is a wireless communication line based on a wide area wireless communication network that can be connected to the management device without network setting, and the wide area wireless communication network sends and receives data at a communication speed lower than the communication speed in the first network.

Images