Information processing system and program

Abstract

To provide an information processing system that identifies a network available to a user in response to a request by the user to use the system, without increasing a workload required to change associations between a large number of users and networks.SOLUTION: An information processing system includes at least one processor, and the at least one processor identifies a group associated with a user in first association information in response to a request by the user to use the system. When the group is identified, the information processing system identifies a network associated with the group in second association information separated from the first association information among a plurality of networks connected to the system as a network available to the user.SELECTED DRAWING: Figure 8

Description

[Technical Field]

[0001] The present invention relates to an information processing system and a program. [Background technology]

[0002] Patent document 1 describes a communication control device that has a storage means for storing user information for each user, and a determination means for determining whether the communication line to be used is available based on the user information of the user who is trying to use it, and the user information is stored in such a way that user identification information set for each user and available communication lines for each user identification information are respectively associated with each other. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2019-22171 Summary of the Invention [Problem to be solved by the invention]

[0004] In some cases, a network available to a user may be identified in response to the user's request to use the system. In such cases, a configuration may be adopted in which a network associated with the user in the correspondence information is identified as an available network. However, adopting such a configuration increases the workload when changing the association between a large number of users and networks.

[0005] The object of the present invention is to enable a network available to a user to be identified in response to the user's request to use the system, without increasing the workload involved in changing the association between a large number of users and networks. [Means for solving the problem]

[0006] The invention described in claim 1 is an information processing system comprising one or more processors, which, in response to a user's request to use the system, identify a group associated with the user using first correspondence information, and when the group is identified, identify, from among multiple networks connected to the system, a network associated with the group using second correspondence information separate from the first correspondence information, as a network available to the user. A second aspect of the present invention is the information processing system according to the first aspect, wherein the first correspondence information is correspondence information that associates each of a plurality of users with each of a plurality of groups. A third aspect of the present invention is the information processing system according to the first aspect, wherein the second correspondence information is correspondence information that associates each of a plurality of groups with each of the plurality of networks. The invention described in claim 4 is the information processing system described in claim 1, wherein the group is a collection of users obtained by dividing multiple users according to the roles assigned to each of the multiple users. The invention described in claim 5 is an information processing system described in claim 1, wherein, in response to a request from the user to use the system, if none of the multiple networks is associated with the user, the one or more processors identify a group associated with the user in the first correspondence information, and identify a network associated with the group in the second correspondence information as a network available to the user. The invention described in claim 6 is an information processing system described in claim 1, wherein, in response to a request from the user to use the system, if none of the multiple networks is associated with the user, the one or more processors identify a predetermined network as a network available to the user. The invention described in claim 7 is an information processing system described in claim 5 or claim 6, in which, in response to a request from the user to use the system, if a specific network among the multiple networks is associated with the user, the one or more processors identify the specific network as a network available to the user. The invention described in claim 8 is the information processing system described in claim 1, wherein the first correspondence information is one correspondence information that corresponds each of a plurality of users with each of a plurality of groups using one correspondence method, and the second correspondence information is one correspondence information selected from multiple correspondence information that corresponds each of a plurality of groups with each of the plurality of networks using multiple correspondence methods. The invention described in claim 9 is an information processing system described in claim 8, in which the second correspondence information is one correspondence information selected from the multiple correspondence information depending on the information processing device that accepted the user's usage request. The invention described in claim 10 is an information processing system described in claim 1, wherein the one or more processors create second correspondence information that corresponds multiple groups with the multiple networks in response to a request to create the second correspondence information. The invention described in claim 11 is a program for enabling a computer to implement the following functions: in response to a user's request to use the system, identify a group associated with the user using first correspondence information; and, when the group is identified, identify, from among multiple networks connected to the system, a network associated with the group using second correspondence information that is separate from the first correspondence information, as a network available to the user. [Effects of the Invention]

[0007] According to the invention of claim 1, it is possible to identify networks available to a user in response to the user's request to use the system, without increasing the workload involved in changing the association between a large number of users and networks. According to the invention of claim 2, when a user identifies a network available to the user, the group associated with the user can be identified using correspondence information that associates each of a plurality of users with each of a plurality of groups. According to the invention of claim 3, when a user identifies a network available to the user, the user can identify a network associated with a group using correspondence information that associates each of a plurality of groups with each of the plurality of networks. According to the invention of claim 4, when identifying networks available to a user, it is possible to identify a set of users obtained by dividing multiple users according to the roles assigned to each of the multiple users. According to the invention of claim 5, even if no network is associated with a user, the network associated with the user's group can be identified as a network available to the user. According to the invention of claim 6, even if no network is associated with a user, a predetermined network can be identified as a network available to the user. According to the invention of claim 7, when a specific network is associated with a user, the specific network can be identified as a network available to the user. According to the invention of claim 8, when a user specifies a network available to the user, the user can specify a network associated with a group using one piece of correspondence information selected from a plurality of pieces of correspondence information that associates each of a plurality of groups with each of a plurality of networks using a plurality of association methods. According to the invention of claim 9, when a user specifies a network available for use, the user can specify a network associated with a group by one piece of correspondence information selected according to the information processing device. According to the invention of claim 10, the correspondence information between groups and networks can be created in response to a creation request. According to the invention of claim 11, it is possible to identify networks available to a user in response to the user's request to use the system, without increasing the workload involved in changing the association between a large number of users and networks. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a diagram illustrating an example of the overall configuration of an image processing system according to a first embodiment. [Figure 2] FIG. 1 illustrates an example of a hardware configuration of an image processing device according to a first embodiment. [Figure 3] FIG. 10 is a diagram schematically illustrating an example of a roll. [Figure 4] FIG. 4 is a diagram showing an example of user information when roles such as those shown in FIG. 3 are set. [Figure 5] FIG. 10 is a diagram illustrating an example of matching between roles and available networks. [Figure 6] FIG. 6 is a diagram showing an example of a matching table showing matching between roles and available networks as shown in FIG. 5. [Figure 7] FIG. 10 is a diagram illustrating an example of determining a network available to a user. [Figure 8] 1 is a block diagram showing an example of a functional configuration of an image processing device according to a first embodiment. [Figure 9] 10 is a flowchart showing an example of the operation of the image processing device of the first aspect. [Figure 10] 10 is a flowchart showing an example of the operation of the image processing device of the second aspect. [Figure 11] 10 is a flowchart showing an example of the operation of the image processing device of the third aspect. [Figure 12] FIG. 10 is a diagram illustrating an example of the overall configuration of an image processing system according to a second embodiment. [Figure 13] FIG. 10 is a diagram illustrating a specific example of an image processing system according to a second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, the present embodiment will be described in detail with reference to the accompanying drawings.

[0010] [Outline of this embodiment] This embodiment provides an information processing system that, in response to a user's request to use the system, identifies a group associated with the user using first correspondence information, and once the group is identified, identifies, from among multiple networks connected to the system, a network associated with the group using second correspondence information that is separate from the first correspondence information, as a network available to the user.

[0011] Here, the "system" may be composed of a single device or multiple devices. In the following, an information processing system composed of a single device will be taken as an example. The single device will be described as an image processing device.

[0012] [First embodiment] (Overall configuration of image processing system) 1 is a diagram showing an example of the overall configuration of an image processing system 1 according to a first embodiment. As shown in the figure, the image processing system 1 includes an image processing device 10 and storage servers 30a and 30b. The image processing device 10 and the storage servers 30a and 30b are connected via a communication line 80. As shown in the figure, the storage servers 30a and 30b are assumed to exist in networks A and B, respectively.

[0013] The image processing device 10 is a device that performs image processing. Image processing here includes image formation on a recording medium such as paper, and image reading from a recording medium such as paper. Image processing here also includes image transmission to a public line and image reception from a public line. The image processing device 10 is a printer from the perspective of only performing image formation. The image processing device 10 is a copier from the perspective of performing image reading and image formation. The image processing device 10 is a facsimile from the perspective of performing image reading and image transmission, or image reception and image formation. Here, the image processing device 10 has a so-called multi-interface configuration that includes multiple network interfaces. In the example shown in the figure, the multiple network interfaces are network interfaces for connecting to networks A and B. Although only one image processing device 10 is shown in the figure, multiple image processing devices may be present.

[0014] The storage servers 30a and 30b are server computers that store data uploaded by users. In particular, in this embodiment, the storage servers 30a and 30b store image data read by the image processing device 10. Although the storage servers 30a and 30b are shown in the figure, they may be referred to as storage server 30 when no distinction is made between them. Also, although only two storage servers 30 are shown in the figure, three or more may be present.

[0015] The communication line 80 is a line used for information communication between the image processing device 10 and the storage server 30. As the communication line 80, for example, the Internet or a LAN (Local Area Network) may be used.

[0016] (Hardware configuration of image processing device) FIG. 2 is a diagram illustrating an example of the hardware configuration of an image processing device 10 according to the first embodiment. As illustrated, the image processing device 10 includes a processor 11. The image processing device 10 further includes a RAM (Random Access Memory) 12, a ROM (Read Only Memory) 13, and an HDD (Hard Disk Drive) 14. The image processing device 10 further includes an operation panel 15. The image processing device 10 further includes an image reading unit 16 and an image forming unit 17. The image processing device 10 further includes a network interface (hereinafter referred to as "network I / F") 18.

[0017] The processor 11 loads various programs stored in the ROM 13 or the like into the RAM 12. The processor 11 then executes these programs to realize various functions, which will be described later. The RAM 12 is a memory used as a working memory for the processor 11, etc. The ROM 13 is a memory that stores various programs executed by the processor 11. The HDD 14 is, for example, a magnetic disk device that stores various data. The various data includes image data read by the image reading unit 16. The various data also includes image data used in image formation by the image forming unit 17.

[0018] The operation panel 15 is, for example, a touch panel that displays various information and accepts operation inputs from the user. In this case, the operation panel 15 is made up of a display and a position detection sheet. The display displays various information. The position detection sheet detects a position indicated by an indicating means such as a finger or a stylus pen. Alternatively, the operation panel 15 may be a display and a keyboard instead of a touch panel. The image reading unit 16 reads an image recorded on a recording medium such as paper. Here, the image reading unit 16 is, for example, a scanner, and it is preferable to use a CCD (Charge Coupled Device) type or a CIS (Contact Image Sensor) type. The CCD type is a type in which light is irradiated onto a document from a light source, and the reflected light is reduced by a lens and received by the CCD. The CIS type is a type in which light is sequentially irradiated onto a document from an LED light source, and the reflected light is received by the CIS. The image forming unit 17 forms an image on a recording medium such as paper. Here, the image forming unit 17 is, for example, a printer, and it is preferable to use an electrophotographic or inkjet printer. The electrophotographic printer is a printer that forms an image by transferring toner attached to a photosensitive member onto a recording medium. The inkjet printer is a printer that forms an image by ejecting ink onto a recording medium. The network I / F 18 transmits and receives various information to and from other devices, such as the storage server 30, via a communication line 80. Although only one network I / F 18 is shown here, it is assumed that there are multiple network I / Fs.

[0019] (Image processing device of the first and second aspects) As described above, the image processing device 10 has a so-called multi-interface configuration, which includes multiple network interfaces. This allows the image processing device 10 to connect to two networks, such as the Internet and an intranet. The image processing device 10 can then form images in response to requests from the two networks. Alternatively, the image processing device 10 can transmit scan data obtained by image reading to the two networks.

[0020] Thus, in a multi-interface configuration, two or more networks are used in combination. Therefore, a key security requirement is often ensuring that no data passes between these networks. Similarly, there are security requirements for when data is directed to be extracted or transferred from a particular network, such as a policy that allows data transfer only to the network that directed it. As an even stricter security requirement, there is a demand to distinguish data stored in the image processing device 10 for each network. Here, the data stored in the image processing device 10 includes information such as an address book and job history.

[0021] A technology has been proposed to satisfy the above security requirements. In this technology, networks available to a user (hereinafter referred to as "available networks") are preset in the user information. This limits the networks to which data can be transferred for each user.

[0022] Here, the available network information indicating available networks that can be assigned to a user is as follows: That is, the available network information is "No available networks" and specific network identification information. Examples of network identification information include Ethernet (registered trademark) 1, Ethernet (registered trademark) 2, and Wifi (registered trademark). Alternatively, Ethernet (registered trademark) 3, Wifi (registered trademark) 2, etc. may be added to the network identification information. However, when registering a new user, the available network information is "No available networks." This is to prevent erroneous transmission due to incorrect settings for the available networks.

[0023] As mentioned above, from a security perspective, only the machine administrator should be able to set or change the available networks. However, in this case, the following problems arise. Note that the machine administrator may also be the network administrator, but in the following explanation, the machine administrator will be used. First, when registering a new user, the system administrator must set available networks for each user. Secondly, consider a case where the multi-interface function is to be newly used in an environment where the image processing device 10 is already being used. In this case, it is necessary to set available networks for all existing users. Thirdly, consider a case where a change in the network environment or the image processing device 10 occurs, and the network settings are changed, in which case it is necessary to change the networks available to all users. As described above, the task of allocating available networks to users places a significant burden on the system administrator, and this burden increases in proportion to the number of users.

[0024] Therefore, in the first and second aspects, the image processing device 10 includes information about the group to which the user belongs in the user information used for authentication. Note that this group information may be any information that can identify a group to which multiple users belong. For example, the group information may be role information used for authentication. In the first and second aspects, the image processing device 10 has a matching table between group information and available networks. The group information is information about a group to which a user belongs, among the above-mentioned user information. The available networks are networks that can be used by the user. The image processing device 10 provides the machine administrator with a function for setting the matching table. As a result, the system administrator associates the group to which the user belongs with the available network and sets the association in the matching table. Thereafter, the user logs in to the image processing device 10. The operations thereafter differ between the image processing device 10 of the first and second aspects, and will therefore be explained separately.

[0025] In the first mode, the image processing device 10 refers to the matching table and information about the group to which the user belongs, and then uses this information to determine available networks.

[0026] In the second mode, the image processing device 10 operates in the first mode only when the available network information is the initial value. That is, the image processing device 10 operates in the first mode only when the available network information is "no available network." Therefore, the image processing device 10 first refers to the available network information set for the user. If the available network information does not indicate "no available network," the image processing device 10 uses the available network information to determine an available network. On the other hand, if the available network information indicates "no available network," the image processing device 10 refers to the matching table and the information on the group to which the user belongs. Then, the image processing device 10 uses this information to determine the available network.

[0027] (Image processing device of the third aspect) Consider the initial value when registering a new user. If any network is set as the initial value, there is a possibility that the system administrator may allow data transmission to an unintended network. As mentioned above, security requirements are required for a multi-interface configuration. Therefore, when a new user is registered, it is desirable to set the initial value to "No available networks." Also, from a security perspective, only the machine administrator can set or change the available networks. In other words, general users cannot change the available networks. Note that the machine administrator may also be referred to as the network administrator, but the following explanation will be given assuming that the machine administrator is the machine administrator.

[0028] As mentioned above, when a new user is registered, the available network information is set to "no available network." However, in this case, the following problem occurs. First, when registering a new user, the system administrator must set available networks for each user. Secondly, consider a case where the multi-interface function is to be newly used in an environment where the image processing device 10 is already being used. In this case, it is necessary to set available networks for all existing users. Thirdly, consider a case where a change in the network environment or the image processing device 10 occurs, and the network settings are changed, in which case it is necessary to change the networks available to all users. These tasks impose a huge burden on the machine administrator.

[0029] Therefore, in the third aspect, the image processing device 10 provides the machine administrator with a network setting function for when there is "no available network." This allows the system administrator to configure network settings for the case where there is "no available network." For example, the system administrator configures Ethernet1 as the network settings for the case where there is "no available network." Thereafter, the user logs in to the image processing device 10. The image processing device 10 then determines an available network based on the available network information and the network settings. For example, suppose the available network information for the user is "No available network." In this case, the image processing device 10 determines an available network in accordance with the network settings for "No available network." Also, suppose the available network information for the user is something other than "No available network." In this case, the image processing device 10 determines an available network in accordance with the available network information.

[0030] (Specific example of processing by image processing device) 3 to 7 are diagrams showing specific examples of processing by the image processing device 10 in the first embodiment. In the following, the description will be given taking roles as an example of groups, and Ethernet1, Ethernet2, and Wi-Fi as examples of available networks.

[0031] First, in the image processing device 10, a role is created to which usage authority is set. A role is a role. The usage authority may be related to an application, color, black and white, etc. Assigning a role to each user makes it easy to set usage authority.

[0032] FIG. 3 is a diagram showing a schematic example of roles. In the diagram, the roles are sales, development, and administration. The roles of users A and B are sales, users C and D are development, and users E and F are administration. The usage rights also include information on whether scanning is possible and whether copying is possible in black and white or color.

[0033] For example, the role information 51a is information relating to the role "sales." The role information 51a includes information indicating that scanning and black and white copying are permitted but color copying is not permitted as usage rights. Furthermore, role information 51b is information relating to the role “development.” Role information 51b includes information indicating that scanning, black and white copying, and color copying are all permitted as usage rights. Furthermore, role information 51c is information relating to the role "administrative work." Role information 51c includes, as usage authority, information indicating that scanning is permitted but neither black and white copying nor color copying is permitted.

[0034] Fig. 4 is a diagram showing an example of user information 210 when roles such as those shown in Fig. 3 are set. In the user information 210, a role is assigned to each user. Here, users A and B are assigned the role "sales." users C and D are assigned the role "development." users E and F are assigned the role "administration."

[0035] Next, roles are matched with available networks, and the matching is performed on a role-by-role basis, not on a user-by-user basis.

[0036] FIG. 5 is a diagram illustrating an example of matching between roles and available networks. In the figure, role information 51a and network information 52a are associated with each other by a connection line 53a, which indicates that the available network for users with the role "sales" is Ethernet1. Furthermore, role information 51b is associated with network information 52a and 52c by connection lines 53b and 53c, respectively, which indicates that the networks available to users with the role "development" are Ethernet1 and Wifi. Furthermore, the role information 51c and the network information 52b are associated with each other by a connection line 53d, which indicates that the available network for users with the role "administration" is Ethernet2.

[0037] Fig. 6 is a diagram showing an example of matching table 240 indicating matching between roles and available networks as shown in Fig. 5. What is important here is that matching between roles and available networks is stored in matching table 240, rather than being stored as one of the authorities in role information 51a to 51c. In other words, in this embodiment, the relationship between user information 210 in Fig. 4 and matching table 240 in Fig. 6 is loosely defined. This makes it possible to flexibly respond to changes in the network environment.

[0038] Thereafter, the available networks for the user are determined. Specifically, this determination is made by combining the user information 210 in FIG. 4 and the matching table 240 in FIG.

[0039] FIG. 7 is a diagram showing a schematic example of such a determination. For example, consider the role "Sales" associated with users A and B in the user information 210. The role "Sales" is associated with the role "Sales, Development" in the matching table 240 by connection lines 54a and 54b. In the matching table 240, this role "Sales, Development" is associated with the available network "Ethernet1." Therefore, the available network for users A and B is Ethernet1. Also, let us look at the role "Development" associated with users C and D in the user information 210. The role "Development" is associated with the role "Sales, Development" in the matching table 240 by connecting lines 54c and 54d. In the matching table 240, this role "Sales, Development" is associated with the available network "Ethernet1." The role "Development" is also associated with the role "Development" in the matching table 240 by connecting lines 54e and 54f. In the matching table 240, this role "Development" is associated with the available network "Wifi." Therefore, the available networks for users C and D are Ethernet1 and Wifi. Furthermore, let us consider the role "Administrative" associated with users E and F in the user information 210. The role "Administrative" is associated with the role "Administrative" in the matching table 240 by connection lines 54g and 54h. In the matching table 240, this role "Administrative" is associated with the available network "Ethernet2." Therefore, the available network for users E and F is Ethernet2.

[0040] When this configuration is adopted, if the network used by each role changes due to a change in the network environment, there is no need to change the settings of the role itself. In other words, it can be handled by simply modifying the matching table 240 between roles and available networks.

[0041] There may be cases where groups are not divided by authority, such as roles. For example, there may only be groups divided by identification information, such as "department name." In such cases, the matching table can be used to set available network information collectively.

[0042] (Functional configuration of image processing device) 8 is a block diagram showing an example of the functional configuration of the image processing device 10 according to the first embodiment. As shown in the figure, the image processing device 10 includes a user information storage unit 21, an authentication processing unit 22, and a group identification unit 23. The image processing device 10 further includes a matching table storage unit 24 and a network identification unit 25. The image processing device 10 further includes an authenticated user storage unit 26 and a matching table setting unit 27.

[0043] The user information storage unit 21 stores user information. As described above, the user information is information that associates multiple users with groups to which each user belongs. Here, a group is a set of users obtained by dividing the multiple users according to the roles assigned to each of the multiple users. The user information is an example of first association information that associates each of the multiple users with each of the multiple groups.

[0044] In the second and third aspects, the user information includes available network information. As described above, the available network information is either "no available network" or identification information of a specific network. However, the available network information is not shown in the user information 210 of FIGS. 4 and 7.

[0045] The authentication processing unit 22 authenticates a user who attempts to log in to the image processing device 10. The authentication processing unit 22 may authenticate the user using user information stored in the user information storage unit 21. Then, the authentication processing unit 22 stores information about the user who has been successfully authenticated in the authenticated user storage unit 26. Logging in to the image processing device 10 by a user is an example of a user's request to use the system.

[0046] In a second aspect, after authentication, the authentication processing unit 22 refers to available network information included in the user information. Then, the authentication processing unit 22 determines whether the available network information indicates "no available network." Here, it is assumed that it is determined that the available network information is not "no available network." Then, the authentication processing unit 22 identifies an available network using the available network information. Then, the authentication processing unit 22 stores the available network in the authenticated user storage unit 26. At that time, the authentication processing unit 22 stores the available network in association with information about the user whose authentication was successful. This processing by the authentication processing unit 22 is an example of identifying a specific network as a network available to the user when a specific network among multiple networks is associated with the user in response to the user's request to use the system.

[0047] Furthermore, in the third aspect, the authentication processing unit 22 also refers to the available network information included in the user information after authentication, and determines whether the available network information is "no available network." Here, suppose that it is determined that the available network information is not "no available network." Then, the authentication processing unit 22 identifies an available network using the available network information. Then, the authentication processing unit 22 stores the available network in the authenticated user storage unit 26. At this time, the authentication processing unit 22 stores the available network in association with information about the user who has been successfully authenticated. This processing by the authentication processing unit 22 is an example of identifying a specific network as a network available to the user when a specific network among multiple networks is associated with the user in response to the user's request to use the system.

[0048] On the other hand, suppose that the available network information is determined to be "no available network." Then, the authentication processing unit 22 determines whether or not there is a network setting for when the available network information is "no available network." For this network setting, identification information of a predetermined network may be stored in a storage unit (not shown). For example, a machine administrator may store the identification information of a predetermined network as a network setting. If there is a network setting, the authentication processing unit 22 uses this network setting to identify an available network. The authentication processing unit 22 then stores the available network in the authenticated user storage unit 26. At this time, the authentication processing unit 22 stores the available network in association with information about the user whose authentication was successful. The available network information being "no available network" is an example of a situation in which none of multiple networks is associated with the user. Furthermore, the network set in the network setting for when the available network information is "no available network" is an example of a predetermined network. Furthermore, this processing by the authentication processing unit 22 is an example of identifying a predetermined network as a network available to the user if none of the multiple networks is associated with the user in response to a user's request to use the system.

[0049] The group identification unit 23 identifies a group corresponding to a user. Here, a user is a user authenticated by the authentication processing unit 22. A group is a group associated with this user in the user information stored in the user information storage unit 21. This processing by the group identification unit 23 is an example of identifying a group associated with a user in the first association information in response to a user's request to use the system.

[0050] In a second aspect, the group identification unit 23 identifies a group corresponding to a user when a condition is satisfied. Here, the condition is that the available network information is "no available network." Whether or not this condition is satisfied is determined by the authentication processing unit 22. This processing by the group identification unit 23 is an example of identifying a group associated with a user in the first association information when none of a plurality of networks is associated with the user in response to a user's request to use the system.

[0051] Furthermore, in a third aspect, the group identification unit 23 identifies a group corresponding to a user when both of two conditions are satisfied. Here, one of the two conditions is that the available network information is "no available network." The other of the two conditions is that there is no network setting when the available network information is "no available network." Whether these conditions are satisfied is determined by the authentication processing unit 22.

[0052] The matching table storage unit 24 stores a matching table. As described above, the matching table is information that associates multiple groups with networks available to users belonging to each group. The matching table is stored as information separate from user information. The matching table is an example of second correspondence information that associates each of multiple groups with each of multiple networks. The matching table is also an example of second correspondence information that is separate from the first correspondence information.

[0053] The network identification unit 25 identifies an available network corresponding to the group. Here, the group is a group identified by the group identification unit 23. The available network is an available network associated with this group in the matching table. The network identification unit 25 then stores the available network in the authenticated user storage unit 26. At that time, the network identification unit 25 stores the available network in association with information about the user whose authentication has been successful. This processing by the network identification unit 25 is an example of, when a group is identified, identifying a network associated with the group in the second correspondence information from among multiple networks connected to the system as a network available to the user.

[0054] In a second aspect, the network identification unit 25 identifies an available network corresponding to a group when a condition is satisfied. Here, the condition is that the available network information indicates "no available network." Whether or not this condition is satisfied is determined by the authentication processing unit 22. Then, the network identification unit 25 stores the available network in the authenticated user storage unit 26. At that time, the network identification unit 25 stores the available network in association with information about the user whose authentication has been successful. This processing by the network identification unit 25 is an example of identifying a network associated with the group in the second association information as a network available to the user when none of the multiple networks is associated with the user in response to a user's request to use the system.

[0055] Furthermore, in a third aspect, the network identifying unit 25 identifies an available network corresponding to a group when both of two conditions are satisfied. Here, one of the two conditions is that the available network information is "no available network." The other of the two conditions is that there is no network setting when the available network information is "no available network." Whether or not these conditions are satisfied is determined by the authentication processing unit 22. Then, the network identifying unit 25 stores the available network in the authenticated user storage unit 26. At that time, the network identifying unit 25 stores the available network in association with information about the user who has been successfully authenticated.

[0056] The authenticated user storage unit 26 stores information about users who have been successfully authenticated. The authenticated user storage unit 26 also stores available networks for users who have been successfully authenticated. Here, the information about users who have been successfully authenticated is information obtained through authentication by the authentication processing unit 22. The available networks may be identified by the network identification unit 25.

[0057] In the second aspect, the available network may be specified by the authentication processing unit 22. Specifically, it is assumed that the authentication processing unit 22 determines that the available network information is not "no available network." In this case, the available network is specified by the authentication processing unit 22 using the available network information included in the user information.

[0058] Furthermore, in the third aspect as well, the available network may be identified by the authentication processing unit 22. Specifically, it is assumed that the authentication processing unit 22 determines that the available network information is not "no available network." In this case, the available network is identified by the authentication processing unit 22 using the available network information included in the user information. It is also assumed that the authentication processing unit 22 determines that the available network information is "no available network." Then, it is assumed that the authentication processing unit 22 determines that there is a network setting for when the available network information is "no available network." In this case, the available network is identified by the authentication processing unit 22 using that network setting.

[0059] The matching table setting unit 27 sets a matching table in the matching table storage unit 24. Specifically, suppose that the machine administrator makes a request to set a matching table specifying a group and an available network. Then, the matching table setting unit 27 sets a matching table that associates the specified group with the available network. The processing of the matching table setting unit 27 is an example of creating second correspondence information that associates multiple groups with the multiple networks in response to a request to create second correspondence information.

[0060] (Operation of image processing device) 9 is a flowchart showing an example of the operation of the image processing device 10 according to the first embodiment. The operation of this flowchart starts when a user attempts to log in to the image processing device 10.

[0061] First, the authentication processing unit 22 authenticates the user who is attempting to log in (step 221). As a result, information about the authenticated user is stored in the authenticated user storage unit 26. Note that this flowchart omits the operation when authentication by the authentication processing unit 22 fails.

[0062] Next, the group identification unit 23 determines whether or not it is possible to identify the group to which the user belongs (step 222). Specifically, the group identification unit 23 makes such a determination by referring to the user information stored in the user information storage unit 21.

[0063] Assume that it is determined in step 222 that the group to which the user belongs can be identified. Then, the network identification unit 25 determines whether or not the group is in the matching table (step 223). Specifically, the network identification unit 25 makes such a determination by referring to the matching table stored in the matching table storage unit 24.

[0064] If it is determined in step 223 that the group is in the matching table, the network identifying unit 25 then determines an available network corresponding to the group (step 224). Specifically, the network identifying unit 25 makes such a determination by referring to the matching table stored in the matching table storage unit 24.

[0065] Thereafter, the network identification unit 25 associates the authenticated user with an available network (step 225). Specifically, the network identification unit 25 associates the authenticated user with an available network in the authenticated user storage unit 26. Here, the authenticated user is the user authenticated in step 221. Also, the available network is the network determined as the available network in step 224. In this state, it is assumed that the user instructs the image reading unit 16 of the image processing device 10 to transmit data read. Then, the read data is transmitted to the available network associated with that user.

[0066] On the other hand, suppose that it is determined in step 222 that the group to which the user belongs cannot be identified. In this case, the group identification unit 23 associates "no available network" with the authenticated user (step 226). Alternatively, suppose that it is determined in step 223 that the group is not in the matching table. In this case, the network identification unit 25 associates "no available network" with the authenticated user (step 226). Here, the authenticated user is the user authenticated in step 221. In this state, suppose that the user instructs the image reading unit 16 of the image processing device 10 to transmit data read by the image reading unit 16. In this case, the read data is not transmitted to the network.

[0067] In the first aspect, the networks available to a user can be set for each group to which the user belongs, thereby reducing the load on setting available networks. In addition, in the first mode, available network information is not included in the authority or attributes of the group. Instead, a matching table between groups and available networks is included. This makes it easy to respond to changes in available networks due to machine replacement or changes in the network environment.

[0068] 10 is a flowchart showing an example of the operation of the image processing device 10 according to the second embodiment. The operation of this flowchart starts when a user attempts to log in to the image processing device 10.

[0069] First, the authentication processing unit 22 authenticates the user who is attempting to log in (step 241). As a result, information about the authenticated user is stored in the authenticated user storage unit 26. Note that, also in this flowchart, the operation when authentication by the authentication processing unit 22 fails is omitted.

[0070] Next, the authentication processing unit 22 determines whether the available network information is "no available network" (step 242). Here, the available network information is information stored in the user information storage unit 21.

[0071] If it is determined in step 242 that the available network information is not "no available network," the authentication processing unit 22 then uses the available network information to determine an available network (step 243).

[0072] On the other hand, suppose that it is determined in step 242 that the available network information is "no available network." In this case, the image processing device 10 performs the processes of steps 244 to 248. The processes of steps 244 to 248 are the same as the processes of steps 222 to 226 in Fig. 9, and therefore description thereof will be omitted.

[0073] In the second mode, data can be transmitted even if the user's available network information indicates "no available network." In other words, data can be transmitted even if the user's available network information is the initial value set at the time of user registration. The machine administrator can then manage the destination of the transmission. In the second mode, if an available network is set for a user, that available network is given priority. This creates the following flexibility in settings. Basically, available networks can be set for each group. However, for a specific user, it is possible to set a network that is different from the available network of the group to which the user belongs.

[0074] 11 is a flowchart showing an example of the operation of the image processing device 10 according to the third embodiment. The operation of this flowchart starts when a user attempts to log in to the image processing device 10.

[0075] First, the authentication processing unit 22 authenticates the user who is attempting to log in (step 261). As a result, information about the authenticated user is stored in the authenticated user storage unit 26. Note that, also in this flowchart, the operation when authentication by the authentication processing unit 22 fails is omitted.

[0076] Next, the authentication processing unit 22 determines whether the available network information is "no available network" (step 262). Here, the available network information is information stored in the user information storage unit 21.

[0077] Assume that it is determined in step 262 that the available network information is not "no available network." Then, the authentication processing unit 22 uses the available network information to determine an available network (step 263).

[0078] On the other hand, suppose that it is determined in step 262 that the available network information is "no available network." Then, the authentication processing unit 22 determines whether or not a network setting exists (step 264). Here, the network setting is the network setting when the available network information is "no available network."

[0079] If it is determined in step 264 that there is a network setting, the authentication processing unit 22 then uses the network setting to determine available networks (step 265).

[0080] On the other hand, suppose that it is determined in step 264 that there is no network setting. Then, the image processing device 10 performs the processes of steps 266 to 270. The processes of steps 266 to 270 are the same as the processes of steps 222 to 226 in Fig. 9, and therefore description thereof will be omitted.

[0081] In this operation example, if it is determined in step 264 that no network settings are present, the image processing device 10 performs the processes of steps 266 to 270. However, if it is determined in step 264 that no network settings are present, the authentication processing unit 22 may associate "no available network" with the authenticated user.

[0082] In the third aspect, data can be transmitted even if the available network information for the user indicates "no available network." The machine administrator can then manage the destination of the transmission. Furthermore, in the third aspect, it is not necessary to change the available network information for all users. For example, suppose the available network is Ethernet1 for 90% of users and Ethernet2 for 10% of users. In this case, the available network information for 90% of users can be set to "no available network." Then, the network setting when the available network information is "no available network" can be set to Ethernet1. In other words, "no available network" for 90% of users can be read as "no available network" and set to make Ethernet1 available. Meanwhile, the available network information for only the remaining 10% of users can be set to Ethernet2 individually. This reduces the number of available network information settings compared to setting available network information individually for all users.

[0083] [Second embodiment] (Overall configuration of image processing system) In the second embodiment, it is assumed that the user information 210 is stored in an external server, not within the image processing device 10. Even in this case, it is possible to set available networks without editing the contents of the user information. In particular, in the second embodiment, the matching table 240 can be edited to suit the environment of each image processing device 10. This makes it possible to set an appropriate available network according to the environment of each image processing device 10. For example, it is conceivable that multiple image processing devices 10 are located at different bases or on different floors. In such cases, it is possible to set available networks taking into account the physical network circumstances of each base or floor.

[0084] 12 is a diagram showing an example of the overall configuration of an image processing system 2 according to the second embodiment. As shown in the figure, the image processing system 2 includes image processing devices 10a and 10b and storage servers 30a and 30b. The image processing system 1 further includes a user information server 50. The image processing devices 10a and 10b, the storage servers 30a and 30b, and the user information server 50 are connected via a communication line 80. As shown in the figure, the storage servers 30a and 30b are assumed to exist in networks A and B, respectively.

[0085] Each of the image processing devices 10a and 10b is the same as the image processing device 10 described with reference to Fig. 1, and therefore a description thereof will be omitted. Although the figure shows image processing devices 10a and 10b, when there is no need to distinguish between them, they may be referred to as image processing device 10. Furthermore, the figure shows only two image processing devices 10, but there may be three or more. The storage servers 30a and 30b are the same as those described with reference to FIG. 1, and therefore a description thereof will be omitted.

[0086] The user information server 50 is an example of the external server described above. The user information server 50 externally provides user information to the image processing device 10. The user information server 50 may be, for example, an AD (Active Directory) server.

[0087] The communication line 80 is a line used for information communication between the image processing device 10, the storage server 30, and the user information server 50. As the communication line 80, for example, the Internet or a LAN (Local Area Network) may be used.

[0088] (Hardware configuration of image processing device) The image processing device 10 in the second embodiment has the same hardware configuration as that shown in FIG.

[0089] (Example of an image processing system) 13 is a diagram showing a specific example of an image processing system 2 according to the second embodiment. Note that the following description will also take roles as an example of groups, and Ethernet1, Ethernet2, and Wi-Fi as examples of available networks.

[0090] In the image processing system 2 according to the second embodiment, the image processing devices 10a and 10b refer to the same user information 210. That is, the image processing devices 10a and 10b refer to the user information 210 stored in the user information server 50. On the other hand, the image processing devices 10a and 10b refer to different matching tables 240a and 240b. Specifically, the image processing device 10a refers to the matching table 240a. The image processing device 10b refers to the matching table 240b. Here, the matching tables 240a and 240b have different available networks assigned to the roles "sales" and "development."

[0091] In the above example, roles are used as groups, but this is not limiting. Any information that can be used to separate multiple users can be used as a group. For example, any item that indicates a group among the items of user information held by the AD server can be used.

[0092] In this case, the user information 210 is an example of first association information, which is one association information in which each of the multiple users is associated with each of the multiple groups using one association method. Furthermore, the matching tables 240a and 240b are an example of a plurality of association information items in which a plurality of groups are associated with a plurality of networks using a plurality of association methods. Furthermore, each of the matching tables 240a and 240b is an example of second correspondence information, which is one piece of correspondence information selected from a plurality of pieces of correspondence information. Also, each of the matching tables 240a and 240b is an example of second correspondence information, which is one piece of correspondence information selected from a plurality of pieces of correspondence information according to the information processing device that has accepted the user's usage request.

[0093] (Functional configuration of image processing device) The image processing device 10 in the second embodiment has substantially the same functional configuration as that in Fig. 8. Specifically, the image processing device 10 in the second embodiment includes a user information acquisition unit instead of the user information storage unit 21. The user information acquisition unit acquires user information from a user information server 50.

[0094] (Operation of image processing device) The image processing device 10 in the second embodiment performs substantially the same operations as those in Figures 9 to 11. Specifically, the user information referred to by the image processing device 10 in the second embodiment is not stored in the user information storage unit 21. The user information referred to by the image processing device 10 in the second embodiment is acquired by a user information acquisition unit from a user information server 50.

[0095] In the second embodiment, the group information does not directly include available network information. Instead, a matching table between groups and available networks is included. This allows for the setting of available networks that are suited to the environment of each image processing device 10.

[0096] [Processor] In this embodiment, the term "processor" refers to a processor in a broad sense, and includes general-purpose processors (e.g., CPU: Central Processing Unit, etc.) and dedicated processors (e.g., GPU: Graphics Processing Unit, ASIC: Application Specific Integrated Circuit, FPGA: Field Programmable Gate Array, programmable logic device, etc.). Furthermore, the operations of the processor in this embodiment may not only be performed by one processor, but may also be performed by multiple processors located at physically separate locations working together. Furthermore, the order of the operations of the processor is not limited to the order described in this embodiment, and may be changed.

[0097] [program] The processing performed by the image processing device 10 in this embodiment is prepared as a program such as application software, for example. In this case, the program that realizes this embodiment can be seen as a program that causes a computer to realize the following functions: a function of identifying a group associated with a user using first correspondence information in response to a user's request to use the system; and a function of, once a group is identified, identifying, from among multiple networks connected to the system, a network associated with the group using second correspondence information that is separate from the first correspondence information, as a network available to the user. The program for realizing this embodiment can be provided not only by communication means but also by being stored on a recording medium such as a CD-ROM.

[0098] [Note] (((1))) one or more processors; the one or more processors: In response to a user's request to use the system, identify a group associated with the user in the first association information; When the group is identified, a network associated with the group in second correspondence information, which is separate from the first correspondence information, is identified as a network available to the user from among a plurality of networks connected to the system. Information processing system. (((2))) The information processing system according to (((1))), wherein the first correspondence information is correspondence information that associates each of a plurality of users with each of a plurality of groups. (((3))) The information processing system according to (((1))), wherein the second correspondence information is correspondence information that associates each of a plurality of groups with each of the plurality of networks. (((4))) The information processing system according to any one of ((1))) to ((3))), wherein the group is a set of users obtained by dividing a plurality of users according to roles assigned to each of the users. (((5))) the one or more processors: An information processing system according to any one of ((1))) to ((4))), wherein, in response to a request from the user to use the system, if none of the plurality of networks is associated with the user, a group associated with the user in the first correspondence information is identified, and a network associated with the group in the second correspondence information is identified as a network available to the user. (((6))) the one or more processors: An information processing system according to any one of ((1))) to ((4))), wherein, in response to a request from the user to use the system, if none of the plurality of networks is associated with the user, a predetermined network is identified as a network available to the user. (((7))) the one or more processors: The information processing system described in (((5))) or (((6))), wherein, in response to a request from the user to use the system, if a specific network from the plurality of networks is associated with the user, the specific network is identified as a network available to the user. (((8))) the first correspondence information is one correspondence information in which each of a plurality of users is associated with each of a plurality of groups by one correspondence method; An information processing system described in any of ((1))) to (((7))), wherein the second correspondence information is one correspondence information selected from a plurality of correspondence information that corresponds each of a plurality of groups with each of the plurality of networks using a plurality of correspondence methods. (((9))) The information processing system according to (((8))), wherein the second correspondence information is one correspondence information selected from the plurality of correspondence information according to the information processing device that has accepted the usage request from the user. (((10))) the one or more processors: An information processing system described in any of (((1))) to (((9))), which creates second correspondence information that associates multiple groups with the multiple networks in response to a request to create the second correspondence information. (((11))) On the computer, a function of identifying a group associated with a user in the first association information in response to a user's request to use the system; When the group is identified, a function of identifying, from among a plurality of networks connected to the system, a network associated with the group in second correspondence information separate from the first correspondence information, as a network available to the user; A program to achieve this.

[0099] According to the invention (((1))), it is possible to identify a network available to a user in response to the user's request to use the system, without increasing the workload involved in changing the association between a large number of users and networks. According to the invention (((2))), when a user specifies a network available to the user, the group associated with the user can be specified using correspondence information that associates each of a plurality of users with each of a plurality of groups. According to the invention (((3))), when a user specifies a network available to the user, the user can specify a network associated with a group using correspondence information that associates each of a plurality of groups with each of the plurality of networks. According to the invention of (((4))), when identifying a network available to a user, it is possible to identify a set of users obtained by dividing multiple users according to the roles assigned to each of the multiple users. According to the invention of (((5))), even if no network is associated with a user, the network associated with the user's group can be identified as a network available to the user. According to the invention (((6))), even if no network is associated with a user, a predetermined network can be identified as a network available to the user. According to the invention of (((7))), when a specific network is associated with a user, the specific network can be identified as a network available to the user. According to the invention (((8))), when a user specifies a network available to the user, the user can specify a network associated with a group using one piece of correspondence information selected from a plurality of pieces of correspondence information that associates each of a plurality of groups with each of a plurality of networks using a plurality of association methods. According to the invention (((9))), when a user specifies a network available to the user, the user can specify a network associated with a group using one piece of correspondence information selected according to the information processing device. According to the invention of (((10))), correspondence information between groups and networks can be created in response to a creation request. According to the invention (((11))), it is possible to identify a network available to a user in response to the user's request to use the system, without increasing the workload involved in changing the association between a large number of users and networks. [Explanation of symbols]

[0100] 1, 2... image processing system, 10, 10a, 10b... image processing device, 21... user information storage unit, 22... authentication processing unit, 23... group identification unit, 24... matching table storage unit, 25... network identification unit, 26... authenticated user storage unit, 27... matching table setting unit, 30a, 30b... storage server, 50... user information server

Claims

1. one or more processors; the one or more processors: In response to a user's request to use the system, a group associated with the user is identified in the first association information; When the group is identified, a network associated with the group in second correspondence information, which is separate from the first correspondence information, is identified as a network available to the user from among a plurality of networks connected to the system. Information processing system.

2. The information processing system according to claim 1 , wherein the first correspondence information is correspondence information that associates each of a plurality of users with each of a plurality of groups.

3. The information processing system according to claim 1 , wherein the second correspondence information is correspondence information that associates each of a plurality of groups with each of the plurality of networks.

4. The information processing system according to claim 1 , wherein the group is a set of users obtained by dividing a plurality of users according to roles assigned to each of the users.

5. the one or more processors:

2. The information processing system of claim 1, wherein, in response to a request from the user to use the system, if none of the plurality of networks is associated with the user, the system identifies a group associated with the user in the first correspondence information, and identifies a network associated with the group in the second correspondence information as a network available to the user.

6. the one or more processors:

2. The information processing system of claim 1, wherein, in response to a request from the user to use the system, if none of the plurality of networks is associated with the user, a predetermined network is identified as a network available to the user.

7. the one or more processors:

7. The information processing system of claim 5, wherein, in response to a request from the user to use the system, if a specific network among the plurality of networks is associated with the user, the specific network is identified as a network available to the user.

8. the first correspondence information is one correspondence information in which each of a plurality of users is associated with each of a plurality of groups by one correspondence method; 2. The information processing system according to claim 1, wherein the second correspondence information is one correspondence information selected from a plurality of correspondence information in which each of a plurality of groups and each of the plurality of networks are associated with each other using a plurality of association methods.

9. The information processing system according to claim 8 , wherein the second correspondence information is one piece of correspondence information selected from the plurality of pieces of correspondence information according to an information processing device that has accepted a usage request from the user.

10. the one or more processors:

2. The information processing system according to claim 1, wherein, in response to a request for creating said second correspondence information, said second correspondence information associating a plurality of groups with said plurality of networks is created.

11. On the computer, a function of identifying a group associated with a user in the first association information in response to a user's request to use the system; When the group is identified, a function of identifying, from among a plurality of networks connected to the system, a network associated with the group in second correspondence information separated from the first correspondence information, as a network available to the user; A program to achieve this.

Images