Image reading apparatus, control method, system, computer program product, and storage medium thereof

Abstract

The present disclosure provides an image reading apparatus and a control method thereof, a system, a computer program product, and a storage medium. The image reading apparatus accepts a user operation for designating a predetermined authentication scheme to be used when uploading scan data to a storage service via a cloud scan system, and transmits a request for designating the predetermined authentication scheme to the cloud scan system according to the user operation. The predetermined authentication scheme is an authentication scheme in which the cloud scan system performs a process for user authentication for an account identified when the scan data is received from the apparatus in the cloud scan system. The apparatus transmits the scan data, an access token that has been issued for the apparatus, and an identifier capable of identifying the account in the cloud scan system to the cloud scan system according to the setting of the predetermined authentication scheme.

Description

Technical Field

[0001] This disclosure relates to image reading devices and their control methods, systems, computer program products, and storage media. Background Technology

[0002] In recent years, cloud scanning services have become known, in which scan data generated by the scanning function of image reading devices such as multifunction peripherals (MFPs) and scanners is uploaded to cloud storage. User authentication is performed when using cloud scanning services. Cloud service accounts are primarily structured to be associated with individuals, and there are also cases where multiple services are used differently. In view of this, Japanese Patent Application Publication No. 2018-92564 proposes to improve convenience by registering the user's account information for cloud services with the device.

[0003] For example, as an authentication scheme used in the aforementioned cloud scanning service, there exists an authentication scheme that authenticates users based on authentication information (such as username and password) entered on the image reading device. In this scheme, there is a concern that the security level may be reduced because the authentication information used in user authentication is retained on the image reading device. Therefore, there are cases where an authentication scheme is used where user authentication is performed at an authentication site, eliminating the need to enter authentication information on the image reading device. However, if the authentication scheme settings between the image reading device and the cloud scanning service (cloud scanning system) are inconsistent, there is a possibility of a reduction in security level. Summary of the Invention

[0004] The present invention discloses the following technology: to prevent inconsistencies in the authentication scheme settings between the image reading device and the cloud scanning service (cloud scanning system) when the authentication scheme settings are changed.

[0005] According to one aspect of this disclosure, an image reading apparatus is provided, comprising a generation unit that reads an image on a sheet to generate scan data, the image reading apparatus comprising: a receiving unit configured to receive a user operation for specifying an authentication scheme to be used when the scan data is uploaded to a storage service via a cloud scanning system; a requesting unit configured to send a request to the cloud scanning system specifying a predetermined authentication scheme based on the user operation, the predetermined authentication scheme being an authentication scheme in which the cloud scanning system performs processing for user authentication against an account identified when the scan data is received from the image reading apparatus in the cloud scanning system; and a sending unit configured to send, according to the settings of the predetermined authentication scheme, the scan data, an access token already issued for the image reading apparatus, and an identifier capable of identifying the account in the cloud scanning system to the cloud scanning system.

[0006] According to another aspect of this disclosure, a control method for an image reading device is provided, the image reading device including a generation unit that reads an image on a sheet to generate scan data, the control method comprising: accepting a user operation for specifying an authentication scheme to be used when uploading scan data to a storage service via a cloud scanning system; sending a request to the cloud scanning system to specify a predetermined authentication scheme according to the user operation, the predetermined authentication scheme being an authentication scheme in which the cloud scanning system performs processing for user authentication against an account identified in the cloud scanning system when the scan data is received from the image reading device; and sending the scan data, an access token already issued for the image reading device, and an identifier capable of identifying the account in the cloud scanning system to the cloud scanning system according to the settings of the predetermined authentication scheme.

[0007] According to another aspect of this disclosure, a computer program product is provided for causing a computer of an image reading device to execute a control method of the image reading device, the image reading device including a generation unit that reads an image on a sheet to generate scan data, the control method comprising: accepting a user operation for specifying an authentication scheme to be used when uploading scan data to a storage service via a cloud scanning system; sending a request to the cloud scanning system to specify a predetermined authentication scheme according to the user operation, the predetermined authentication scheme being an authentication scheme in which the cloud scanning system performs processing for user authentication against an account identified in the cloud scanning system when receiving the scan data from the image reading device; and sending the scan data, an access token already issued for the image reading device, and an identifier capable of identifying the account in the cloud scanning system to the cloud scanning system according to the settings of the predetermined authentication scheme.

[0008] According to another aspect of this disclosure, a computer-readable storage medium is provided for storing a computer program for causing a computer of an image reading device to execute a control method of the image reading device, the image reading device including a generation unit for reading an image on a sheet to generate scan data, the control method comprising: accepting a user operation for specifying an authentication scheme to be used when uploading scan data to a storage service via a cloud scanning system; sending a request to the cloud scanning system, based on the user operation, to specify a predetermined authentication scheme, the predetermined authentication scheme being an authentication scheme in which the cloud scanning system performs processing for user authentication against an account identified in the cloud scanning system when receiving the scan data from the image reading device; and sending, according to the settings of the predetermined authentication scheme, the scan data, an access token already issued for the image reading device, and an identifier capable of identifying the account in the cloud scanning system to the cloud scanning system.

[0009] According to another aspect of this disclosure, a system including an image reading device and a cloud scanning system is provided. The image reading device includes a generation unit that reads an image on a sheet to generate scan data. The system includes: a receiving unit configured to receive a user operation in the image reading device, the user operation specifying an authentication scheme to be used when the scan data is uploaded to a storage service via the cloud scanning system; a requesting unit configured to send a request to the cloud scanning system specifying a predetermined authentication scheme based on the user operation in the image reading device, the predetermined authentication scheme being an authentication scheme in which the cloud scanning system performs processing for user authentication of an account identified when the scan data is received from the image reading device in the cloud scanning system; a management unit configured to manage settings of the predetermined authentication scheme, which are settings of the image reading device, in the cloud scanning system based on the request received from the image reading device; and a sending unit configured to send the scan data, an access token already issued for the image reading device, and an identifier capable of identifying the account in the cloud scanning system to the cloud scanning system according to the settings of the predetermined authentication scheme in the image reading device.

[0010] The features of this disclosure will become apparent from the following description of embodiments with reference to the accompanying drawings. The following description of embodiments is given by way of example. Attached Figure Description

[0011] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the embodiments.

[0012] Figure 1 An exemplary construction of a network is shown.

[0013] Figure 2 This is a block diagram illustrating an exemplary hardware configuration of an image reading device (MFP).

[0014] Figure 3 This shows an example of the UI screen of the cloud portal.

[0015] Figure 4 This is a sequence diagram illustrating an example of the process used to register an MFP with a cloud scanning system.

[0016] Figure 5 This is a sequence diagram illustrating an example of the processing used to perform a cloud scan.

[0017] Figure 6 This is a sequence diagram illustrating an example of the process used to switch authentication schemes.

[0018] Figure 7A This shows an example of a UI screen displayed on an MFP.

[0019] Figure 7B This shows an example of a UI screen displayed on an MFP.

[0020] Figure 8 This is a sequence diagram illustrating an example of the processing used to perform a cloud scan.

[0021] Figure 9 This is a flowchart illustrating an example of the initial setup process for an authentication scheme on an MFP.

[0022] Figure 10 This is a flowchart illustrating an example of the process for switching authentication schemes on an MFP.

[0023] Figure 11 This shows an example of a UI screen displayed on an MFP for switching authentication schemes. Detailed Implementation

[0024] In the following, embodiments will be described in detail with reference to the accompanying drawings. Note that the following embodiments are not intended to limit the scope of the claims. Several features are described in the embodiments, but not all of these features are necessary, and multiple features can be appropriately combined. Furthermore, in the drawings, the same reference numerals are given the same or similar constructions, and redundant descriptions are omitted.

[0025] In the following embodiments, a multifunction peripheral device (MFP) will be described as an example of an image reading device of this disclosure. Note that the image reading device can be, for example, a scanner (scanning device), a copier, a multifunction peripheral device (MFP), and a fax device.

[0026] <Authentication Scheme for Cloud Scanning Service> First, an authentication scheme for user authentication in a cloud scanning service (cloud scanning system) as envisioned in the embodiments of this disclosure will be described.

[0027] The first authentication scheme is one in which the authentication service of a cloud scanning service performs authentication processing after receiving authentication information such as user identification information (username) and password entered by the user on an image processing device such as an MFP and a scanner.

[0028] The second authentication scheme is one that does not require inputting authentication information on the image processing device. In this scheme, a cloud scanning service that has already uploaded scan data from the image processing device first distributes an authentication URL to, for example, the email address of the user who has already issued the upload instruction. The user accesses the authentication URL from a terminal (user terminal) used to input authentication information and performs user authentication at the authentication site indicated by the URL. Based on the successful user authentication at the authentication site, the cloud scanning service performs processing for the authenticated user based on the scan data previously uploaded from the image processing device. Hereinafter, this second authentication scheme may be referred to as "later authentication."

[0029] The aforementioned second authentication scheme (“later authentication”) is designed to mitigate concerns that authentication information (login information) entered by the user and used in user authentication is stored within a shared MFP located in a collaborative workspace or similar space. There may be situations where service providers wish to adopt a second authentication scheme (“later authentication”) on the MFP, which is a more secure user authentication scheme than the first. However, without proper configuration on the MFP, there is a possibility of inconsistencies arising between the MFP (image reading device) and the cloud scanning service regarding the authentication scheme settings. Therefore, this embodiment will describe a mechanism for preventing such inconsistencies on MFPs using cloud scanning systems.

[0030] <Network Construction> Figure 1 An exemplary configuration of a network according to an embodiment of the present disclosure is shown. The cloud scanning system 110 includes a cloud portal 111, a cloud scanning service 112, a cloud registration service 113, and a cloud storage 114, each connected to the network 100. In this embodiment, the cloud scanning system 110 (cloud scanning service 112) is an example of a cloud scanning system (cloud scanning service) for uploading scan data to a cloud storage.

[0031] Network 100 includes communication networks such as the Internet, wide area networks (WANs), and local area networks (LANs). Furthermore, network 100 may include mobile networks that support mobile communication standards such as Long Term Evolution (LTE) and 5G New Radio (NR).

[0032] MFP 101 is a multifunctional peripheral device with various functions such as printing, scanning (reading), and copying. In this embodiment, MFP 101 is an example of an image reading device that includes a reading unit that reads an image formed on a sheet to generate image data. Note that MFP 101 may be referred to as an image processing device, image forming device, information processing device, scanning device, etc. User terminal 102 is a terminal device, such as a smartphone or PC, held by a user of MFP 101. MFP 101 and user terminal 102 can communicate with cloud scanning system 110 (cloud scanning service 112) via network 100.

[0033] Cloud portal 111 is a management portal that performs authentication processing for cloud accounts using cloud storage 114. Users access cloud portal 111 via user terminal 102 and perform authentication operations on the website (authentication site) provided by cloud portal 111.

[0034] As an example, cloud scanning service 112 is a server that provides, for example, a general printing service and a scanning solution provided by Microsoft. In addition to the scanning solution, cloud scanning service 112 can also provide a printing solution. Cloud scanning service 112 has the capability to acquire image data (e.g., image data generated via scanning) from MFP 101. Cloud scanning service 112 includes device storage for temporarily storing image data to be transferred to a storage server (such as cloud storage 114).

[0035] The cloud registration service 113 is configured to perform the device (MFP) registration processing required to use the cloud portal 111, cloud scanning service 112, and cloud storage 114.

[0036] Cloud storage 114 is a storage service that can be used by users of cloud scanning service 112 by registering with a public or private account. Users can use cloud storage 114 by authenticating, for example, an account (cloud account). As a specific example, cloud storage 114 may be a storage server provided by, for example, Microsoft's OneDrive or Google Drive of Google LLC (Google LLC). Image data transmitted from cloud scanning service 112 is stored in cloud storage 114.

[0037] <Device Structure> Figure 2 This is a block diagram illustrating an example of the schematic hardware construction of the MFP 101. (As shown...) Figure 2As shown, the MFP 101 includes a CPU 201, a ROM 202, a RAM 203, a communication unit 204, a printing unit 205, a feeding unit 206, an operation unit 207, a display unit 208, and a reading unit (generating unit) 209.

[0038] CPU 201 controls the entire device. CPU 201 reads the control program stored in ROM 202 into RAM 203 and executes the control program; as a result, various types of functions that MFP 101 can perform are realized. Communication unit 204 includes a communication module that connects MFP 101 to other devices or recording devices and exchanges image data with these devices.

[0039] The printing unit 205 performs the operation of forming (printing) an image on the sheet material fed from the feeding unit 206 based on image data received from an external device or based on image data generated by the reading unit 209. The feeding unit 206, which supplies stacked sheets to the printing unit 205, provides these sheets. The operation unit 207 includes input devices such as buttons and a keyboard. Users can input various types of commands to the MFP 101 by operating the operation unit 207. Furthermore, the operation unit 207 may include a reading device capable of reading information from an IC card.

[0040] Display unit 208 includes a display and shows various types of information to the user. Note that display unit 208 may be, for example, a touch panel display, or it may be integrally constructed with operation unit 207. Reading unit 209 includes, for example, a color scanner using a CCD or CIS scheme, and reads the image formed on the sheet to generate image data. In this embodiment, reading unit 209 is an example of a generation unit that generates scanned data (image data) by reading the image formed on the sheet.

[0041] Next, an exemplary hardware configuration of devices other than MFP 101 will be described. Cloud portal 111, cloud scanning service 112, cloud registration service 113, and cloud storage 114 are, for example, computers. Each device includes: for example, a processor, such as a CPU; main memory, such as RAM or ROM; secondary memory, such as EPROM, hard disk drive, or removable media; input devices; and a communication module. Note that the removable media may be, for example, a USB storage device or a disc recording medium, such as a CD or DVD. The operating system (OS), various types of programs, various types of tables, etc., are stored in the secondary memory. The programs stored in the secondary memory are loaded into the working area of ​​the main memory, and the execution of the programs controls the various components, etc.; as a result, the various functions in the functions matching the predetermined purpose, described later, can be implemented.

[0042] Furthermore, as previously mentioned, user terminal 102 is a user-owned electronic device, such as a smartphone or PC. User terminal 102 includes, for example, a processor, such as a CPU; main memory, such as RAM or ROM; secondary memory, such as EPROM, hard disk drive, or removable media; input devices; a communication module; and a display device. Note that the removable media may be, for example, a USB storage device or a disc recording medium, such as a CD or DVD. The operating system (OS), various types of programs, various types of tables, etc., are stored in the secondary memory. The programs stored in the secondary memory are loaded into the working area of ​​the main memory, and the execution of the programs controls the various components, etc.; as a result, the various functions in the functions matched with the predetermined purpose, as described later, can be realized.

[0043] <Example of cloud scanning service settings screen> Figure 3 UI screen 300 is shown as an example of a UI screen for cloud portal 111. UI screen 300 is a settings screen for configuring the authentication scheme of cloud scanning service 112 relative to cloud portal 111, and is displayed as a WebUI screen on the display unit of user terminal 102. The WebUI client of user terminal 102 (e.g., a web browser) accesses the WebUI of cloud portal 111 via network 100; as a result, the WebUI screen is provided to user terminal 102 through the WebUI and displayed on user terminal 102.

[0044] UI screen 300 is configured as a settings screen for setting the authentication scheme of cloud scanning service 112 relative to cloud portal 111. Although UI screen 300 is configured such that "Authentication Settings" is placed under "General" among the configurable settings, the arrangement of "Authentication Settings" is not limited to this. Figure 3 The example shows that the user has already selected "Authentication Settings" on UI screen 300.

[0045] exist Figure 3 In the example, UI screen 300 includes drop-down list 301, radio buttons 302 and 303, and button 304. Drop-down list 301 is used to select the scope of application of the authentication scheme settings (authentication settings) constructed on UI screen 300. For example, drop-down list 301 is constructed to allow selection of the scope of application of authentication settings at the customer, organization, or MFP level. For example, the same authentication settings can be applied to all MFPs registered with cloud scanning service 112 at the customer or organization level, depending on the client's needs or security policies. Furthermore, by applying authentication settings at the MFP level, different settings can be applied to different MFPs.

[0046] Radio buttons 302 and 303 are configured to be selectable exclusively. Radio button 302 is used to select "Authentication Later" as the second authentication scheme. "Authentication Later" (the second authentication scheme) is an authentication scheme in which user authentication is performed using a URL distributed from cloud scanning service 112 when cloud scanning service 112 is used, instead of user authentication on MFP 101. Radio button 303 is used to select "Authentication on MFP (Printer)" as the first authentication scheme. "Authentication on MFP" (the first authentication scheme) is an authentication scheme in which user authentication is performed on MFP 101. As an example, UI screen 300 is configured such that radio button 302 is selected by default.

[0047] If radio button 302 or 303 has already been selected on UI screen 300, settings related to the relevant settings can be constructed in conjunction with that selection. For example, if "Authenticate on MFP" is set by selecting radio button 303, settings for enabling the cookie function, which is one of the functions of a web browser, can also be constructed in conjunction with that selection. The cookie function is a mechanism that stores information that the user has already entered on the web browser screen for a certain period of time and reuses the stored information on the next entry. Enabling the cookie function makes it possible, for example, to skip subsequent entries of authentication information used for using external cloud storage services (e.g., cloud storage 114).

[0048] Button 304 is used to issue a command to apply (reflect) the settings constructed using UI screen 300 to cloud scanning service 112. Users can issue a command to apply settings to cloud scanning service 112 by pressing button 304 after constructing settings (initial settings or changes to settings) on UI screen 300. When the press of button 304 on user terminal 102 is detected via WebUI, cloud portal 111 stores the settings on UI screen 300 as user settings in a data server (not shown) within cloud scanning system 110.

[0049] <Sequence during equipment registration> Figure 4 An example of a processing sequence for registering a device for use with cloud scanning system 110 (cloud scanning service 112) is shown. Note that in each device, this is achieved by the CPU reading a program stored in ROM and executing that program. Figure 4 The sequence includes various processes.

[0050] In this embodiment, the MFP 101 supports cloud scanning and a WebUI function for operating the MFP 101. The cloud scanning function executes scanning jobs and uploads the generated scan data (image data) to the cloud scanning service 112. The scan data uploaded to the cloud scanning service 112 is transmitted and stored in an external cloud storage service (e.g., cloud storage 114). The user retrieves the scan data from the cloud storage 114. The WebUI function generates a UI screen and publishes the UI screen on the network 100 (providing the UI screen to external devices via the network 100).

[0051] User terminal 102 supports cloud scanning client functionality and WebUI client functionality (e.g., a web browser) for operating the WebUI. The cloud scanning client functionality is the ability to obtain image data stored in cloud storage 114. Cloud registration service 113 is a service provided on the Internet and performs processing for registering devices (MFP 101) using cloud scanning system 110.

[0052] In step S401, user terminal 102 accesses cloud portal 111 based on user actions on the WebUI screen displayed by the WebUI client (a web browser in this example). The WebUI screen is a UI screen provided by the WebUI of cloud portal 111. In response to the access from user terminal 102, cloud portal 111 displays an authentication scheme settings screen on user terminal 102 in step S402 (in this example, ...). Figure 3 The UI screen shown (300) is used as the WebUI screen.

[0053] In step S403, cloud portal 111 accepts the setting of the authentication scheme for cloud scanning service 112 based on user operations on the settings screen (UI screen 300) displayed on user terminal 102. Cloud portal 111 accepts the selection of "Authenticate Later" (second authentication scheme) or "Authenticate on MFP" (first authentication scheme) based on the operation of selecting radio buttons 302 or 303 on the selection UI screen 300. In response to pressing button 304 on UI screen 300, cloud portal 111 sets the selected authentication scheme as the authentication scheme for cloud scanning service 112.

[0054] In step S404, the cloud portal 111 stores the authentication scheme settings information in a management server (not shown) within the cloud scanning system 110. Note that the authentication scheme settings information can be stored in the cloud portal 111's memory (not shown). Note that the default settings of the authentication scheme (e.g., corresponding to the settings described above) are... Figure 3The authentication scheme for the radio button 302 has been pre-configured in the cloud scanning system 110, and its settings are stored in the management server within the cloud scanning system 110. Therefore, for example, if the application scope in the dropdown list 301 on the UI screen 300 is already set to MFPs, steps S401 to S404 can be skipped. In this case, regarding the authentication scheme settings, the default settings (initial settings) are applied to the MFPs that are the device registration targets.

[0055] In step S405, the user uses the WebUI client of user terminal 102 to send a device registration request (MFP registration request) to MFP 101 for registering MFP 101 with cloud scanning service 112. User terminal 102 sends the device registration request to MFP 101 based on the user's operation on the WebUI screen provided by MFP 101.

[0056] In step S406, when MFP 101 receives a device registration request from user terminal 102, it performs processing according to the request. Specifically, MFP 101 sends a device code generation request to cloud registration service 113. Upon receiving the device code generation request from MFP 101, cloud registration service 113 generates a device code, a user code, and a URL for verification according to the request. The device code is a code issued to MFP 101, which is the target of device registration. The user code is a code issued to the user who has requested device registration. The URL for verification is used to provide the user with a WebUI screen, which allows the user to input the information required for device registration. In step S407, cloud registration service 113 sends a device code generation response, including the generated device code, user code, and URL for verification, to MFP 101 as a response to the device code generation request.

[0057] In step S408, upon receiving the device code generation response, MFP 101 sends a device registration response, which serves as a response to the device registration request, to user terminal 102. The device registration response includes a user code generated by cloud registration service 113 and a URL used for verification.

[0058] In step S409, when user terminal 102 receives the MFP registration response from MFP 101, it displays the user code and the URL for verification on the WebUI client screen. User terminal 102 accesses the URL for verification based on user actions displayed on the screen. As a result of accessing the URL for verification, the user enters the ID used to identify the cloud account and the user code included in the device registration response on the WebUI client screen already displayed on user terminal 102. Therefore, user terminal 102 sends a device registration authorization request to cloud registration service 113, which includes the user code entered by the user and the ID used to identify the cloud account.

[0059] Upon receiving a device registration authorization request from user terminal 102, cloud registration service 113 associates the administrator of the registration target MFP 101 with a cloud account and registers the administrator as authorized for the MFP 101. The registration target MFP 101 is identified based on the user code included in the device registration authorization request. Furthermore, the cloud account is identified based on the ID included in the device registration authorization request. Subsequently, in step S410, cloud registration service 113 sends a device registration authorization response to user terminal 102.

[0060] Here, a user with permissions to change settings related to cloud registration and security processing via MFP 101 will be referred to as an MFP 101 administrator (administrative user). MFP 101 administrator permissions are granted based on successful authentication with MFP101 itself or with an authentication system within the network environment where MFP 101 is installed. This authentication differs from authentication by the cloud scanning service or other cloud services.

[0061] In step S411, MFP 101 sends an access token request to cloud registration service 113 to request the issuance of an access token. The access token request includes a device code generated by and provided to MFP 101 by cloud registration service 113 in step S407. Cloud registration service 113 uses this device code to identify the registration target MFP 101. Upon receiving the access token request from MFP 101, cloud registration service 113 generates an access token based on the received request. This access token proves that the execution of the registration process is approved and is used in subsequent registration processes. The access token is an approval token for the device and an approval token for accessing cloud scanning system 110 (cloud scanning service 112). For example, the access token is an approval token for storing scan data (image data) in the device memory of cloud scanning service 112. Access tokens are managed internally by MFP 101. When an access token is generated, in step S412, cloud registration service 113 sends an access token response including the generated access token to MFP 101.

[0062] In this manner, MFP 101 obtains an access token from cloud scanning system 110 (cloud registration service 113) by requesting an access token to be issued by cloud registration service 113 before sending the registration request. Subsequently, in step S413, MFP 101 sends a registration request to cloud registration service 113, requesting registration of MFP 101 in cloud scanning system 110 (cloud registration service 112). The registration request includes information indicating the device name (MFP name) and device type. The device name is the device name set for MFP 101. Furthermore, the access token generated by cloud registration service 113 and obtained from the cloud registration service via the access token response is added to the HTTP header of the registration request.

[0063] Upon receiving a registration request from MFP 101, cloud registration service 113 determines whether the access token added to the HTTP header of the registration request is the same access token sent to MFP 101 via an access token response (step S412). In this way, cloud registration service 113 determines whether the registration request has been approved (whether the registration processing matching the registration request has been approved). If the access token added to the HTTP header of the registration request matches the access token sent to MFP 101 via an access token response, cloud registration service 113 determines that the registration request has been approved.

[0064] Upon determining that the received registration request is an approved registration request, in step S414, the cloud registration service 113 sends a registration response to the MFP 101. The registration response includes the result of the aforementioned determination regarding whether registration is possible, as well as the configuration information of the authentication scheme set in step S403. Here, the cloud portal 111 and the cloud registration service 113 are contained within the cloud scanning system 110 and are configured to access the configuration information stored in the management server (not shown) within the cloud scanning system 110. Therefore, the cloud registration service 113 obtains the configuration information from the management server, includes the obtained configuration information in the registration response, sends the registration response to the MFP 101, and begins the process for registering the MFP 101. Note that if no authentication scheme configuration is established in steps S401 to S404 (i.e., if the user has not established an authentication scheme configuration in the cloud scanning system 110), the initial configuration information of the authentication scheme (default authentication scheme) pre-configured in the cloud scanning service 112 is included in the registration response.

[0065] In step S415, when MFP 101 receives a registration response from cloud registration service 113, it stores the authentication scheme settings included in the received registration response in RAM 203, thereby applying the authentication scheme settings to MFP 101. Upon receiving initial settings information as authentication scheme settings, MFP 101 stores (applies) these initial settings.

[0066] <Time sequence of cloud scan execution> Figure 5 An example of a processing sequence for performing a cloud scan using the cloud scanning system 110 is shown. Note that in each device, this is achieved by the CPU in each device reading a program stored in ROM and executing that program. Figure 5 The sequence includes various processes. In this example, it is assumed that the "later authentication scheme" (second authentication scheme) has been set to the authentication scheme of cloud scanning service 112 at the beginning of this sequence.

[0067] In step S501, the user uses the UI screen displayed on the display unit 208 of the MFP 101 to perform an operation to start cloud scanning. Through this user operation, the MFP 101 accepts input of a user ID to identify the user who wants to use the cloud scanning service 112. As an example, UI screen 700, described later, ( Figure 7A The cloud scan button 701 is displayed on the display unit 208 of the MFP 101. When the cloud scan button 701 is pressed on the UI screen 700, the MFP 101 causes the display screen on the display unit 208 to switch from the UI screen 700 to the UI screen 710. Figure 7AThe user uses UI screen 710 to enter a user ID to identify the user who wants to use cloud scanning service 112. This user ID can be associated with the login ID used to log in to MFP 101. In this case, when user authentication has already been performed for the user logging in to MFP 101, MFP 101 can obtain the user ID associated with the login ID without requesting the user ID to be entered.

[0068] In step S501, the user ID entered by the user is a cloud authentication identifier used to check the user authentication registration of the cloud service (cloud scanning service). For example, attribute information based on the Internet standard RFC 822, called UserPrincipalName (UPN, User Principal Name), is used as this cloud authentication identifier. UPN is a user login name in Internet format. In this embodiment, the above-mentioned user ID is an example of an identifier that can identify the authentication registration of a user in the cloud scanning system 110.

[0069] In step S502, MFP 101 determines the already set authentication scheme based on the authentication scheme settings stored in step S415. Here, if MFP 101 has determined that the already set authentication scheme is "authenticate later" (second authentication scheme), after completing user authentication of cloud portal 111 based on the user ID entered using UI screen 710 (checking user authentication registration for cloud scanning service), it will change the display screen of display unit 208 from UI screen 710 to UI screen 730. Figure 7B ).

[0070] On the other hand, if MFP 101 determines that the configured authentication scheme is "authentication on MFP" (first authentication scheme), after completing user authentication of cloud portal 111 based on the user ID entered using UI screen 710, it will change the display screen of display unit 208 from UI screen 710 to UI screen 720. Figure 7A After the MFP 101 completes user authentication for the cloud service (cloud storage service) based on the authentication information (login information) entered using the UI screen 720, the display screen of the display unit 208 will change from UI screen 720 to UI screen 730. Figure 7B ).

[0071] In step S503, the user instructs the MFP 101 to perform a scanning job by pressing the execute button 731 on the UI screen 730. The MFP 101 (CPU 201) executes the scanning job upon receiving the instruction from the user. Once the MFP 101 has started executing the scanning job, it generates scan data (image data) by reading the image formed on the sheet using the read unit 209, and stores the generated scan data in RAM 203.

[0072] Upon completion of the scan job, in step S504, the MFP 101 generates scan job data for sending to the cloud scanning service 112 based on the executed scan job. The scan job data includes the user ID entered in step S501, the scan data read from RAM 203, authentication scheme settings, and an access token. This access token is used when the MFP 101 registers with the cloud scanning service 112. Figure 4 The access token obtained in step S412. Note that access tokens typically have an expiration date; however, it is possible that after an access token has already been obtained, an access token with an updated expiration date may be obtained from the cloud scanning service 112. In this case, the scan job data may include the access token with the updated expiration date.

[0073] In step S505, MFP 101 sends a request to cloud scanning service 112 to store scan job data. The request to store scan job data includes the scan job data generated in step S504. That is, the scan job data includes the user ID entered in step S501, the scan data read from RAM 203, authentication scheme settings, and an access token. In this way, according to the authentication scheme settings, MFP 101 (CPU 201) sends the scan data along with the access token and user ID (an identifier that identifies the user's authentication registration in cloud scanning system 110) to cloud scanning system 110 (cloud scanning service 112).

[0074] Upon receiving a request to store scan job data, cloud scanning service 112 verifies the access token included in the received scan job data. If the access token verification is successful, cloud scanning service 112 stores the scan job data (scan data) in its device memory. Subsequently, in step S506, cloud scanning service 112 sends a request to store the scan job data to cloud storage 114. This storage request includes a user ID and the scan data obtained from the storage request received from MFP 101 in step S505.

[0075] When cloud storage 114 receives a request to store scan job data from cloud scanning service 112, in step S507, it identifies the user (associated with the scan job) based on the user ID included in the received storage request. Cloud storage 114 stores the scan job data in the cloud storage 114 associated with the identified user.

[0076] Subsequently, in step S508, the cloud scanning service 112 generates a verification URL (authentication URL) for user authentication, and a unique user code corresponding to the user ID. In step S509, the cloud scanning service 112 sends a storage result response to the MFP 101, indicating the storage result of the scan job data (scan data) in the cloud storage 114. Furthermore, in step S510, the cloud scanning service 112 sends a scan job completion notification to the user terminal 102. In this way, the user (user terminal 102) is provided with a notification indicating that the execution of the scan job has been completed and the scan data has been stored in the cloud storage 114 associated with the user. This scan job completion notification includes the verification URL and user code generated in step S508. In this way, after the scan data has been sent to the cloud scanning system 110, the user identified based on the user ID is provided with information (verification URL) for accessing the authentication site (cloud portal 111) to obtain the scan data.

[0077] Upon receiving a scan job completion notification, user terminal 102 displays the user code and verification URL included in the notification on the WebUI client screen. In step S511, user terminal 102 accesses the verification URL based on user actions on the displayed screen. As a result of accessing the verification URL, in step S512, a WebUI screen (login screen) for user authentication provided by cloud portal 111 is displayed on user terminal 102. In other words, cloud portal 111 enables user terminal 102 to display a WebUI screen (login screen) for user authentication via the WebUI.

[0078] In step S513, the user uses the WebUI screen displayed on the user terminal 102 to perform the following operations: input authentication information (such as cloud account authentication information (user ID (authentication ID), password, etc.) and registered user code) into the cloud portal 111. The cloud portal 111 obtains the authentication information input on the user terminal 102 via the WebUI. In step S514, the cloud portal 111 uses the obtained authentication information to perform user authentication.

[0079] Once user authentication is successful, in step S515, cloud portal 111 sends a request to cloud storage 114 to obtain scan job data associated with the authenticated user. The request includes a user ID used to identify the authenticated user. Upon receiving the request, cloud storage 114 identifies the scan job data associated with the user ID included in the request from the scan job data stored in its storage area. In step S516, cloud storage 114 sends the identified scan job data to cloud portal 111. The user can import (download) scan job data from cloud portal 111 to user terminal 102, for example, by operating on the WebUI screen of cloud portal 111 displayed on user terminal 102.

[0080] <Sequence during authentication scheme switching> Figure 6 An example of a processing sequence for switching (changing) the authentication scheme of cloud scanning service 112 is shown. Note that in each device, this is achieved by the CPU in each device reading a program stored in ROM and executing that program. Figure 6 The sequence includes various processes.

[0081] MFP 101 passed Figure 4 The sequence is processed and registered with cloud portal 111. During MFP 101 registration, the initial settings of the authentication scheme for cloud scanning service 112 are stored in RAM 203 (step S415). In this embodiment, the user with permission to change security-related settings (including authentication scheme settings) on MFP 101 is limited to administrative users. Therefore, in this sequence, the authentication scheme settings of cloud scanning service 112 are switched (changed) according to the operation of the administrative user with permission to change security-related settings.

[0082] In step S601, the management user uses the operation unit 207 and display unit 208 of the MFP 101 to perform operations for switching (changing) the authentication scheme settings of the cloud scanning service 112. In this example, the management user can use... Figure 11 The operation is performed using UI screens 1100, 1110, and 1120, which will be described later.

[0083] When the MFP 101 (CPU 201) receives a user operation via the operation unit 207 and display unit 208 to switch (change) the authentication scheme settings of the cloud scanning service 112, it updates the authentication scheme settings stored in RAM 203 in step S602. Specifically, the CPU 201 updates the authentication scheme settings by updating the setting information stored in RAM 203 using setting information indicating the authentication scheme selected by the user.

[0084] Subsequently, in step S603, MFP 101 (CPU 201) sends a configuration change request to cloud scanning service 112. This configuration change request requests a change to the authentication scheme settings on the cloud scanning system 110 side based on the aforementioned user operation. This configuration change request includes the authentication scheme settings updated in step S602, as well as the settings from when MFP 101 registered with cloud scanning service 112. Figure 4 The access token obtained in step S412. Note that access tokens typically have an expiration date; however, it is possible that after obtaining an access token, an access token with an updated expiration date is obtained from the cloud scanning service 112. In this case, the settings change request can include an access token with the updated expiration date.

[0085] When cloud scanning service 112 receives a configuration change request from MFP 101, it performs processing for updating the authentication scheme settings in step S604. Specifically, cloud scanning service 112 identifies MFP 101 as the source of the received configuration change request by verifying the access token included in the configuration change request. Once the access token verification (MFP 101 identification) is successful, cloud scanning service 112 updates its authentication scheme settings information using the configuration information included in the configuration change request for the identified MFP 101. As mentioned above, the authentication scheme settings information is stored in a management server (not shown) included in cloud scanning system 110. Therefore, the authentication scheme settings information stored in the management server is updated by cloud scanning service 112.

[0086] Once the configuration information update is complete, in step S605, the cloud scanning service 112 notifies the MFP 101 (as the source of the configuration change request received in step S603) with a configuration change response including information indicating the processing result (configuration change result). Thus, since the authentication scheme settings have been changed on the MFP 101 side, as a result of the MFP 101's request to the cloud scanning service 112, the authentication scheme settings are also changed on the cloud scanning service 112 side.

[0087] <Example of the UI for the cloud scanning function> Reference Figure 7A and Figure 7B This describes an example of a UI screen (operation screen) displayed on display unit 208 of the MFP 101 for using the cloud scanning function.

[0088] UI screen 700 is the main screen of the MFP 101. UI screen 700 includes buttons for selecting the various functions included in the MFP 101. The Cloud Scan Service 112 authentication scheme has already been configured on only the MFP 101. Figure 4 The cloud scan button 701 is only displayed on the UI screen 700 when step S415 is completed. The cloud scan button 701 is not displayed if the authentication scheme has not yet been set up. Users can use the cloud scan function of the MFP 101 by selecting (pressing) the cloud scan button 701.

[0089] When the cloud scan button 701 is pressed on the UI screen 700, and the authentication scheme is already set to the second authentication scheme ("authenticate later"), the CPU 201 displays the UI screen 710 on the display unit 208. The UI screen 710 is used to input the user ID used to identify the user who wants to use the cloud scan service 112. In the above step S501 ( Figure 5 In the cloud portal 111, UI screen 710 can be used to input a user ID. The user ID input via UI screen 710 is used for user authentication (user authentication registration check). Upon completion of user authentication, CPU 201 causes the display screen of display unit 208 to switch from UI screen 710 to UI screen 730.

[0090] Furthermore, when the cloud scan button 701 is pressed on UI screen 700, if the authentication scheme is already set to the first authentication scheme ("authenticate on MFP"), after UI screen 710 is displayed, CPU 201 displays UI screen 720 on display unit 208. UI screen 720 is used to input authentication information (login information) for using external cloud storage services (e.g., cloud storage 114). User authentication is performed based on the authentication information input using UI screen 720, so that scan data (image data) obtained by performing a scan job can be sent to the external cloud storage service via cloud portal 111. Upon completion of user authentication, CPU 201 causes the display screen of display unit 208 to change from UI screen 720 to UI screen 730.

[0091] Note that button 721 on UI screen 720 is used to issue instructions for switching the authentication scheme used only for the job to be performed (scan job), such as... Figure 8As illustrated in the exemplary sequence described later, when the first authentication scheme (“authentication on the MFP”) is applied to MFP 101, there is a possibility that the user may be concerned about the authentication information entered for using external cloud storage services being stored in MFP 101. MFP 101 in this embodiment can be configured such that such a user can issue an instruction to temporarily switch from the first authentication scheme (“authentication on the MFP”) to the second authentication scheme (“authentication later”) by pressing button 721 on UI screen 720.

[0092] UI screen 730 is used to issue instructions for executing cloud scanning services (scanning jobs). On UI screen 730, settings for scan processing (scan settings) can be constructed; for example, settings such as the readout size of the scanned image can be constructed. The user can instruct the MFP 101 to execute a scan job by pressing the execute button 731. In response to the pressing of the execute button 731, the CPU 201 begins executing the scan job according to the input scan settings.

[0093] After the scanning job on MFP 101 has been completed and the scanned data (image data) has been sent to a cloud service (cloud storage service) such as cloud storage 114, CPU 201 displays UI screen 740 on display unit 208. In this example, UI screen 740 is overlaid on UI screen 730 when displayed. When the user presses button 741 on UI screen 740, CPU 201 causes the display screen on display unit 208 to return to UI screen 700.

[0094] <Sequence during cloud scans accompanying authentication scheme switching> Figure 8 An example of a processing sequence for performing a cloud scan using cloud scanning system 110 is shown. This example is related to... Figure 5 The difference from the example is that, before starting the scan job, the user performs the action of switching the authentication scheme of cloud scanning service 112 on MFP 101. Below, with... Figure 5 The same processing is assigned to the same processing as Figure 5 The same reference numerals are used in the accompanying drawings, and their descriptions are omitted.

[0095] When using an authentication scheme that authenticates an external cloud storage service on the MFP 101, there are concerns about reduced security because the authentication information entered by the user is stored on the MFP 101. Therefore, if the MFP 101 is set to "Authenticate on MFP" (first authentication scheme), there is a possibility that the user may want to temporarily change the authentication scheme to "Authenticate Later" (second authentication scheme) when executing a scan job. In this example, on the MFP 101, with "Authenticate on MFP" (first authentication scheme) set, the authentication scheme is temporarily changed (switched) for the scan job to be executed (target job).

[0096] Similar to Figure 5 The sequence of steps S501 and S502 is executed. In step S502, when it is determined that the established authentication scheme is "authenticate on MFP" (first authentication scheme), UI screens 710 and 720 are displayed on display unit 208, and user operation is performed. In step S801, MFP 101 (CPU 201) receives an instruction on UI screen 720 displayed on display unit 208 to switch (change) the authentication scheme used for the scan job (target job) to be performed. Specifically, by selecting button 721 on UI screen 720, an instruction is issued to switch the authentication scheme used for the scan job (target job) to be performed from the first authentication scheme ("authenticate on MFP") to the second authentication scheme ("authenticate later").

[0097] When a user has issued an instruction to switch (change) the authentication scheme, in step S802, MFP 101 changes the authentication scheme setting from the first authentication scheme ("authenticate on MFP") to the second authentication scheme ("authenticate later"). For example, CPU 201 sets a flag indicating the change of the authentication scheme to be used for the target job and stores the flag in RAM 203.

[0098] Subsequently, MFP 101 (CPU 201) executes a scan job in step S503 and stores the generated scan data in RAM 203, similar to... Figure 5 sequence.

[0099] When the scan job is completed, MFP 101 (CPU 201) generates scan job data for sending to cloud scan service 112 based on the executed scan job in step S803. The scan job data includes the user ID entered in step S501, the scan data read from RAM 203, authentication scheme settings, and access token.

[0100] When a value indicating a change in the authentication scheme is set in the flag stored in RAM 203, MFP 101 (CPU 201) includes the setting information indicating a second authentication scheme ("later authentication") in the scan job data. Therefore, cloud scanning service 112 applies the second authentication scheme as the authentication scheme for user authentication and performs the corresponding processing. Furthermore, the access token is used when MFP 101 registers with cloud scanning service 112. Figure 4 The access token obtained in step S412. Note that access tokens typically have an expiration date; however, it is possible that after an access token has already been obtained, an access token with an updated expiration date may be obtained from the cloud scanning service 112. In this case, the scan job data may include the access token with the updated expiration date.

[0101] After the scan job data has been generated, MFP 101 (CPU 201) sends a request to the cloud scanning service 112 to store the scan job data in step S505. The processing after step S505 is similar to... Figure 5 The processing in the sequence. After the processing in step S509, MFP 101 restores the authentication scheme settings in MFP 101 to their original settings. This prevents temporary changes to the authentication scheme settings in the target job from affecting subsequent jobs. In other words, it prevents inconsistencies in the authentication scheme settings between cloud scanning service 112 and MFP 101.

[0102] Note that in step S802, a setting change request can be sent to the cloud scanning service 112 to change the authentication scheme setting from the first authentication scheme to the second authentication scheme. In this case, after completing the processing in step S509, the MFP 101 sends a setting change request to the cloud scanning service 112 to change (restore) the authentication scheme setting from the second authentication scheme to the first authentication scheme. This prevents temporary changes to the authentication scheme setting in the target job from affecting the job to be executed subsequently. That is, it prevents inconsistencies in the authentication scheme settings between the cloud scanning service 112 and the MFP 101.

[0103] <Processing Procedure (Initial Setup of the Authentication Scheme)> Figure 9 This is a flowchart illustrating an example of the process for initially setting up the authentication scheme of cloud scanning service 112 on MFP 101. By reading and executing the control program stored in ROM 202 via CPU 201, the authentication scheme can be implemented on MFP 101 according to... Figure 9 The process of handling this. Note that the handling according to this process corresponds to... Figure 4 Processing of MFP 101 in the sequence.

[0104] When the CPU 201 receives a device registration request from the user terminal 102 via the communication unit 204 (step S405), it begins processing according to this procedure.

[0105] In step S901, CPU 201 sends a device code generation request to cloud registration service 113 via communication unit 204 (step S406) and waits for a response to the request. The device code generation response sent by cloud registration service 113 (step S407) includes a device code generated by cloud registration service 113, a user code, and a URL for verification. In step S902, when CPU 201 receives the device code generation response from cloud registration service 113 via communication unit 204 ("Yes" in step S902), it stores the device code in RAM 203 and proceeds to step S903.

[0106] In step S903, CPU 201 sends a device registration response to user terminal 102 via communication unit 204 (step S408) as a response to the device registration request from user terminal 102. The device registration response includes a user code generated by cloud registration service 113 and a URL for verification.

[0107] After sending the device registration response, in step S904, CPU 201 sends an access token request, including the device code generated by the cloud registration service 113, to the cloud registration service 113 via communication unit 204 (step S411). Thereafter, CPU 201 waits for a response to the access token request from the cloud registration service 113 (access token response (step S412)). The access token response includes the access token generated by the cloud registration service 113. In step S905, when CPU 201 receives the access token response from the cloud registration service 113 via communication unit 204 ("Yes" in step S905), it stores the access token in RAM 203 and proceeds to step S906.

[0108] In step S906, CPU 201 sends a registration request to cloud registration service 113 via communication unit 204 (step S413). The registration request includes information indicating the device name and device type of MFP 101. The device name is the device name set for MFP 101. The device type indicates the device type of MFP 101. Furthermore, an access token generated by cloud registration service 113 and obtained from cloud registration service 113 via an access token response is added to the HTTP header of the registration request. After sending the registration request, CPU 201 waits for a response to the registration request.

[0109] In step S907, when CPU 201 receives a registration response (step S414) from cloud registration service 113 via communication unit 204 as a response to the registration request ("Yes" in step S907), the process proceeds to step S908. The registration response includes the result of the registration process (a determination of whether registration is possible) and authentication scheme setting information. In step S908, CPU 201 stores the authentication scheme setting information in RAM 203 and terminates the processing according to this procedure.

[0110] <Processing Procedure (Changes to Authentication Scheme Settings)> Figure 10 This is a flowchart illustrating an example of the process for switching the authentication scheme of cloud scanning service 112 on MFP 101. By reading and executing the control program stored in ROM 202 via CPU 201, the authentication scheme can be implemented on MFP 101 according to... Figure 10 The process of handling this. Note that the handling according to this process corresponds to... Figure 6 Processing of MFP 101 in the sequence.

[0111] The CPU 201 begins processing according to this procedure upon receiving a user operation via the operation unit 207 to switch (change) the authentication scheme (step S601). Note that, generally, users with permission to change security-related settings (such as authentication schemes) are limited to administrative users. It is assumed that processing according to this procedure is performed in response to receiving input from an administrative user with permission to change security-related settings.

[0112] In step S1001, the CPU 201 displays a settings screen on the display unit 208 for accepting user input (changes to settings) for the authentication scheme. This settings screen is, for example, described later. Figure 11 The UI screen 1120 shown is shown. Subsequently, in step S1002, the CPU 201 waits for user input (change of settings) for the authentication scheme via the operation unit 207. When user input (change of settings) for the authentication scheme is received ("Yes" in step S1002), the CPU 201 proceeds to step S1003.

[0113] In step S1003, CPU 201 changes the authentication scheme settings based on user input via the settings screen. CPU 201 changes the settings by writing the changed settings information into RAM 203. Furthermore, in step S1004, CPU 201 sends a settings change request to cloud scanning service 112 via communication unit 204 (step S603). This settings change request includes the authentication scheme set in step S1002 and a device-unique access token, which is stored in RAM 203 when MFP 101 registers with cloud scanning service 112 (device registration).

[0114] When CPU 201 receives a setting change response (step S605) via communication unit 204 as a response to the setting change request ("Yes" in step S1005), it terminates the processing according to this procedure. The setting change response includes information indicating the processing result (the result of the setting change). Note that if no setting change response has been received, or if a predetermined timeout period has elapsed without a setting change response being received, CPU 201 resends the setting change request (step S1004).

[0115] <Example of the UI screen for switching authentication schemes> Reference Figure 11 An example of a UI screen (operation screen) for switching the authentication scheme of the cloud scanning service 112 on the MFP 101, displayed on the display unit 208 of the MFP 101, is now described.

[0116] UI screen 1100 is the main screen of MFP 101. UI screen 1100 includes buttons for selecting various functions of MFP 101. Buttons 1101 on UI screen 1100 are used to select menu functions. Users can issue commands to refer to and change the settings of MFP 101 by selecting buttons 1101.

[0117] If button 1101 has already been selected on UI screen 1100, UI screen 1110 is displayed on display unit 208. UI screen 1110 includes multiple list elements corresponding to multiple selectable settings. List element 1111 corresponds to the settings of the cloud scanning service. Note that, generally, users with permissions to change security-related settings (such as authentication schemes) are limited to administrative users. Therefore, CPU 201 can control the display of UI screen 1110 so that list element 1111 is displayed only when an administrative user with permissions to change security-related settings has logged into MFP 101, or when list element 1111 is selectable.

[0118] When list element 1111 is selected on UI screen 1110, UI screen 1120 is displayed on display unit 208. UI screen 1120 is configured such that buttons 1121 and 1122 are exclusively selectable. When the press of OK button 1123 is detected, CPU 201 stores the setting information ("authenticate later" or "authenticate on MFP (device)") corresponding to one of the selected buttons 1121 and 1122 in RAM 203.

[0119] As described above, the MFP 101 (image reading device) of this embodiment is configured to communicate with the cloud scanning system 110 via network 100, the cloud scanning system 110 being used to upload scan data to a cloud storage. The MFP 101 (CPU 201) accepts a user operation to change the authentication scheme of the cloud scanning system 110. Based on this user operation, the MFP 101 (CPU 201) sends a request to change to a predetermined authentication scheme (a second authentication scheme) (which does not require authentication information to be entered on the MFP 101, but rather user authentication is performed at an authentication site) along with an access token (an approval token for accessing the cloud scanning system 110) to the cloud scanning system 110. According to the changed authentication scheme settings, the MFP 101 (CPU 201) sends the scan data, the access token, and an identifier that identifies the user's authentication registration with the cloud scanning system 110 to the cloud scanning system 110.

[0120] In this way, in this embodiment, when a user operation changes the authentication scheme settings on MFP 101, a request to change the authentication scheme is sent from MFP 101 to cloud scanning system 110 (cloud scanning service 112). As a result, the changed authentication scheme settings are also applied to cloud scanning system 110 (cloud scanning service 112). This ensures consistency of authentication scheme settings between cloud scanning system 110 and MFP 101. That is, it prevents inconsistencies in authentication scheme settings between the image reading device (MFP 101) and cloud scanning service 112 (cloud scanning system 110) caused by changes in authentication scheme settings. Furthermore, it prevents security degradation due to such inconsistencies.

[0121] Furthermore, if the MFP 101 (CPU 201) receives a user operation to temporarily change the authentication scheme used for the scan job to be performed from the first authentication scheme to the second authentication scheme ("authenticate later") when the first authentication scheme is already set ("authenticate on the MFP"), it will change the authentication scheme setting (temporarily) according to this user operation. Afterwards, once the scan job is completed, the MFP 101 (CPU 201) will restore the authentication scheme setting from the second authentication scheme to the first authentication scheme. This alleviates user concerns about the first authentication scheme ("authenticate on the MFP") being applied to the MFP 101 (concerns about the input authentication information being stored in the MFP 101).

[0122] According to this disclosure, inconsistencies in the authentication scheme settings between the image reading device and the cloud scanning service (cloud scanning system) caused by changes in the authentication scheme settings can be prevented.

[0123] Other embodiments The embodiments disclosed herein can also be implemented by a computer of a system or apparatus and by a method executed by the computer of the system or apparatus, wherein the computer of the system or apparatus reads and executes computer-executable instructions (e.g., one or more programs) recorded on a storage medium (which may also be more fully referred to as a "non-transitory computer-readable storage medium") to perform one or more functions of the above embodiments, and / or the computer of the system or apparatus includes one or more circuits (e.g., application-specific integrated circuits (ASICs)) for performing one or more functions of the above embodiments, the method being performed by the computer of the system or apparatus, for example by reading and executing computer-executable instructions from the storage medium to perform one or more functions of the above embodiments, and / or controlling one or more circuits to perform one or more functions of the above embodiments. The computer may include one or more processors (e.g., a central processing unit (CPU), a microprocessor unit (MPU)) and may include a separate computer or a network of separate processors to read and execute the computer-executable instructions. The computer-executable instructions may be provided to the computer, for example, from a network or storage medium. The storage medium may include, for example, a hard disk, random access memory (RAM), read-only memory (ROM), storage devices for distributed computing systems, optical discs (such as optical discs (CD), digital versatile optical discs (DVD), or Blu-ray discs (BD)). TM One or more of the following: flash memory devices, memory cards, etc.

[0124] The embodiments of the present invention can also be implemented by the following method: providing software (including computer program products of computer programs) that performs the functions of the above embodiments to a system or device via a network or various storage media, and the computer (central processing unit) (CPU) or microprocessor unit (MPU) of the system or device reads out and executes the computer program.

[0125] Although this disclosure has been described with reference to exemplary embodiments, it should be understood that this disclosure is not limited to the disclosed exemplary embodiments. The scope of the appended claims should be given the broadest interpretation to cover all such modifications and equivalent structures and functions.

Claims

1. An image reading device, comprising a generation unit for reading an image on a sheet to generate scan data, the image reading device comprising: The receiving unit is configured to accept user operations that specify the authentication scheme to be used when uploading scanned data to the storage service via the cloud scanning system. The request unit is configured to send a request to the cloud scanning system specifying a predetermined authentication scheme based on the user operation. The predetermined authentication scheme is an authentication scheme in which the cloud scanning system performs user authentication processing for an account identified when the scanned data is received from the image reading device in the cloud scanning system. as well as The sending unit is configured to send the scan data, the access token already issued for the image reading device, and the identifier that can identify the account in the cloud scanning system to the cloud scanning system according to the settings of the predetermined authentication scheme.

2. The image reading device according to claim 1, wherein, If an authentication scheme different from the predetermined authentication scheme is set in the image reading device, after user authentication is performed in the image reading device, the sending unit sends the scan data, the access token, and the user information of the authenticated user to the cloud scanning system according to the setting of the other authentication scheme.

3. The image reading device according to claim 2, wherein, When the other authentication scheme is set in the image reading device, based on a user operation that temporarily changes the authentication scheme to be applied to the scan job to be performed to the predetermined authentication scheme, the sending unit sends the scan data, the access token and the identifier to the cloud scanning system for the scan job.

4. The image reading device according to any one of claims 1 to 3, wherein the image reading device further comprises: The registration request unit is configured to send a registration request to the cloud scanning system for the image reading device to register with the cloud scanning system. A receiving unit is configured to receive the access token from the cloud scanning system as part of a response to the registration request.

5. The image reading device according to any one of claims 1 to 3, wherein, Based on the successful user authentication of the account identified by the identifier, the user authentication is performed after the scan data is sent to the cloud scanning system, and the scan data is transferred from the cloud scanning system to the storage service identified by the identifier.

6. The image reading device according to any one of claims 1 to 3, wherein, For user authentication of accounts identified by identifiers, the cloud scanning system provides messages for user authentication to email addresses identified by identifiers.

7. The image reading device according to any one of claims 1 to 3, wherein, The identifier is the User Owner Name (UPN).

8. The image reading device according to any one of claims 1 to 3, wherein, The image reading device is a multifunctional peripheral device, which also includes a printing unit configured to print images on a sheet.

9. The image reading device according to any one of claims 1 to 3, wherein, The requesting unit includes the access token in the request specifying the predetermined authentication scheme and sends the request to the cloud scanning system.

10. A control method for an image reading device, the image reading device comprising a generation unit for reading an image on a sheet to generate scan data, the control method comprising: Accept user operations, which specify the authentication scheme to be used when uploading scanned data to the storage service via the cloud scanning system; The user sends a request to the cloud scanning system to specify a predetermined authentication scheme based on the user's operation. The predetermined authentication scheme is as follows: the cloud scanning system performs user authentication processing for an account identified when the scanned data is received from the image reading device in the cloud scanning system. as well as According to the predetermined authentication scheme settings, the scanning data, the access token already issued for the image reading device, and the identifier that can identify the account in the cloud scanning system are sent to the cloud scanning system.

11. A computer program product for causing a computer of an image reading device to execute a control method of the image reading device, the image reading device including a generation unit for reading an image on a sheet to generate scan data, the control method comprising: Accept user operations, which specify the authentication scheme to be used when uploading scanned data to the storage service via the cloud scanning system; The user sends a request to the cloud scanning system to specify a predetermined authentication scheme based on the user's operation. The predetermined authentication scheme is as follows: the cloud scanning system performs user authentication processing for an account identified when the scanned data is received from the image reading device in the cloud scanning system. as well as According to the predetermined authentication scheme settings, the scanning data, the access token already issued for the image reading device, and the identifier that can identify the account in the cloud scanning system are sent to the cloud scanning system.

12. A computer-readable storage medium storing a computer program for causing a computer of an image reading device to execute a control method of the image reading device, the image reading device including a generation unit for reading an image on a sheet to generate scan data, the control method comprising: Accept user operations, which specify the authentication scheme to be used when uploading scanned data to the storage service via the cloud scanning system; The user sends a request to the cloud scanning system to specify a predetermined authentication scheme based on the user's operation. The predetermined authentication scheme is as follows: the cloud scanning system performs user authentication processing for an account identified when the scanned data is received from the image reading device in the cloud scanning system. as well as According to the predetermined authentication scheme settings, the scanning data, the access token already issued for the image reading device, and the identifier that can identify the account in the cloud scanning system are sent to the cloud scanning system.

13. A system comprising an image reading device and a cloud scanning system, the image reading device comprising a generation unit for reading images on a sheet to generate scan data, the system comprising: A receiving unit is configured to accept user operations in the image reading device, the user operations being used to specify the authentication scheme to be used when uploading scanned data to the storage service via the cloud scanning system. The request unit is configured to send a request to the cloud scanning system specifying a predetermined authentication scheme based on a user operation in the image reading device. The predetermined authentication scheme is an authentication scheme in which the cloud scanning system performs user authentication processing for an account identified when the scanned data is received from the image reading device in the cloud scanning system. A management unit is configured in the cloud scanning system to manage the settings of the predetermined authentication scheme, which is a setting of the image reading device, based on the request received from the image reading device. as well as The sending unit is configured to send the scan data, an access token already issued for the image reading device, and an identifier capable of identifying the account in the cloud scanning system to the cloud scanning system according to the settings of the predetermined authentication scheme in the image reading device.

Images