Image forming apparatus, control method, and system

Abstract

To provide an image forming apparatus and the like capable of ensuring security even when authentication by a predetermined authentication method fails.SOLUTION: An image forming apparatus that communicates with a server, the image forming apparatus comprising: a communication unit that communicates with the server; and a control unit that counts a first current time and requests the server to perform authentication by a predetermined authentication method, wherein the communication unit receives a response packet including time information based on a second current time of the server and information indicating success or failure of the authentication, in a case where the information indicating success or failure of the authentication indicates failure of the authentication, the control unit determines whether or not a cause of the failure of the authentication is a difference between the first current time and the second current time on the basis of the information indicating the cause of the failure of the authentication included in the response packet, acquires the time information included in the response packet in a case where it is determined that the cause of the failure of the authentication is the difference, and requests the server to perform authentication again in the predetermined authentication scheme by using the time information.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present disclosure relates to an image forming apparatus, a control method, and a system. [Background technology]

[0002] For example, Kerberos authentication is used as a method for user authentication in multifunction peripherals and the like.

[0003] An information processing device is known that has a synchronization means that performs time synchronization processing with a time synchronization server and an authentication means that performs authentication using Kerberos authentication, and if authentication using Kerberos authentication fails and the time synchronization processing is not performed within a set time, the authentication means performs authentication using NTLM (NT LAN Manager) authentication (see, for example, Patent Document 1).

[0004] For example, Kerberos authentication when a user uses a specific server is processed as follows: The user sends their user ID and password to the authentication server (AS), which then queries the KDC (Key Distribution Center) to confirm the user information and server usage credentials, and if there are no problems, the authentication server issues a TGT (Ticket Granting Ticket). The user then sends the TGT to the TGS (Ticket Granting Server) to request a ticket for the specific server they wish to use, and if there are no problems, the TGS issues a ticket for the specific server they wish to use. The user then sends the issued ticket for the specific server to the specific server they wish to use, and if there are no problems with the ticket, they can use the specific server.

[0005] In this way, Kerberos authentication uses tickets instead of sending user IDs and passwords in communication with the server for authentication, which makes it possible to prevent spoofing through wiretapping. Furthermore, a time synchronization mechanism is used to prevent spoofing through wiretapping of the ticket itself, which also prevents ticket spoofing.

[0006] NTLM authentication also uses a challenge-response method, and authentication is performed without the user's secret information (such as a password) being transmitted directly over the network. Specifically, in NTLM authentication, the server sends a unique random number called a "challenge" to the client, and the client combines the password and challenge to calculate a hash value (response) and sends it to the server. The server then calculates a similar hash value from the correct password it has on hand and determines whether it matches the response received from the client to determine whether the client is legitimate. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] Japanese Patent Application Publication No. 2019-012465 Summary of the Invention [Problem to be solved by the invention]

[0008] The information processing device described in Patent Document 1 performs authentication using NTLM authentication if authentication using Kerberos authentication fails and time synchronization processing is not performed within a set time.

[0009] However, NTLM authentication has security issues because if the password is short, it is highly likely to be cracked in a short time. Therefore, using NTLM authentication instead of Kerberos authentication is not recommended from a security standpoint.

[0010] An object of one aspect of the present disclosure is to provide an image forming apparatus or the like that can ensure security even if authentication using a predetermined authentication method fails. [Means for solving the problem]

[0011] An image forming apparatus according to one embodiment of the present disclosure is an image forming apparatus that communicates with a server, and includes a communication unit that communicates with the server, and a control unit that counts a first current time and requests authentication from the server using a predetermined authentication method. The communication unit receives a response packet including time information based on a second current time of the server and information indicating the success or failure of the authentication. If the information indicating the success or failure of the authentication indicates a failure of the authentication, the control unit determines, based on the information indicating the cause of the authentication failure included in the response packet, whether the cause of the authentication failure is a difference between the first current time and the second current time. If it is determined that the cause of the authentication failure is the difference, the control unit acquires the time information included in the response packet and uses the time information to request authentication again from the server using the predetermined authentication method.

[0012] A control method according to one aspect of the present disclosure is a control method for an image forming device that communicates with a server, the control method comprising: counting a first current time; requesting authentication from the server using a predetermined authentication method; receiving a response packet including time information based on a second current time of the server, information indicating the success or failure of the authentication, and information indicating a cause of the authentication failure; if the authentication fails, determining based on the response packet whether the cause of the authentication failure is a difference between the first current time and the second current time; if it is determined that the cause of the authentication failure is the difference, acquiring the time information included in the response packet; and using the time information to request authentication again from the server using the predetermined authentication method.

[0013] A system according to one aspect of the present disclosure includes a server and an image forming device communicating with the server. The server includes a first communication unit communicating with the image forming device and a processing unit, and the processing unit counts a first current time, performs authentication using a predetermined authentication method in response to a request from the image forming device, and if the authentication fails, transmits a response packet to the image forming device that includes time information based on the first current time, information indicating whether the authentication was successful, and information indicating the cause of the authentication failure. The image forming device includes a second communication unit communicating with the server, and a control unit that counts a second current time and requests authentication from the server using the specified authentication method, wherein the communication unit receives the response packet from the server, and if the authentication fails, the control unit determines based on the response packet whether the cause of the authentication failure is a difference between the first current time and the second current time, and if it is determined that the cause of the authentication failure is the difference, obtains the time information included in the response packet and uses the time information to request authentication again from the server using the specified authentication method. [Effects of the Invention]

[0014] According to an image forming apparatus and the like according to an aspect of the present disclosure, security can be ensured even if authentication using a predetermined authentication method fails. [Brief explanation of the drawings]

[0015] [Figure 1] FIG. 1 is a configuration diagram of a system according to an embodiment. [Figure 2] FIG. 2 is a functional block diagram of an MFP according to an embodiment. [Figure 3] FIG. 2 is a functional block diagram of a server according to an embodiment. [Figure 4] FIG. 4 is a sequence diagram of a control method for a system according to an embodiment. [Figure 5A] 10 is a flowchart of a control method for an MFP according to an embodiment. [Figure 5B] 10 is a flowchart of a control method for an MFP according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0016] Hereinafter, embodiments will be described with reference to the drawings. In the drawings, the same or equivalent elements are designated by the same reference numerals, and redundant description will be omitted.

[0017] FIG. 1 is a configuration diagram of a system according to an embodiment.

[0018] The system 100 includes an MFP (Multifunction Peripheral) 101, a server 201, and a PC (Personal Computer) 301. The MFP 101, the server 201, and the PC 301 are connected via a network 401 such as a LAN (Local Area Network) and are capable of communicating with each other. The MFP 101 is an example of an image forming apparatus. The server 201 and the PC 301 are examples of an information processing apparatus.

[0019] The MFP 101 has multiple functions, such as scanning, printing, and copying documents. The MFP 101 receives a print job from the PC 301, which includes print data such as text and images to be printed and print setting information, and executes printing using the print data included in the print job. Furthermore, if the job includes information specifying the execution time of the job, the MFP 101 executes the job when the current time becomes the execution time. The MFP 101 performs Kerberos authentication with the server 201. Kerberos authentication is an example of a predetermined authentication method.

[0020] The server 201 communicates with the MFP 101, operates as an authentication server for Kerberos authentication, a KDC (Key Distribution Center) that centrally manages user information, and a TGS (Ticket Granting Server) that issues tickets, and performs Kerberos authentication with the MFP 101.

[0021] PC 301 creates print data including, for example, a document, a table, an image, and print setting information, and transmits a print job including the created print data to MFP 101. PC 301 may also include information specifying the execution time of the print job in the print job.

[0022] FIG. 2 is a functional block diagram of the MFP according to the embodiment.

[0023] The MFP 101 includes a control unit 111 , a reading unit 121 , a display operation unit 131 , a printing unit 141 , a communication unit 151 , and a storage unit 161 .

[0024] The control unit 111 controls the MFP 101 for scanning, printing, copying, etc. The control unit 111 includes an oscillator circuit (not shown) and a frequency divider circuit (not shown), and counts the current time. The control unit 111 performs Kerberos authentication with the server 201. The control unit 111 is realized, for example, by one or more processors such as CPUs (Central Processing Units), or one or more logic circuits (hardware) formed in an integrated circuit (IC (Integrated Circuit) chip), etc.

[0025] The reading unit 121 reads an original placed on a platen (not shown) of the MFP 101, and generates image data of the read original.

[0026] The display operation unit 131 displays various types of information and accepts operation inputs from the user. The display operation unit 131 is, for example, a touch panel. The display operation unit 131 has a display unit 132 and an input unit 133. The display unit 132 displays various types of information in accordance with a display control signal from the control unit 111. The display unit 132 is, for example, a liquid crystal display or an organic EL (Electro Luminescence) display. The input unit 133 is, for example, a position input device that detects the coordinates of a contact position on the input unit 133 with a finger, a touch pen, or the like, and outputs the detected coordinates to the control unit 111. The input unit 133 may also be a hardware key such as an operation button.

[0027] The printing unit 141 prints characters, images, etc. on a recording medium such as paper supplied from a paper feed unit (not shown) based on the print data contained in the print job received from the PC 301 via the communication unit 151 and the print data stored in the memory unit 161.

[0028] The communication unit 151 communicates with the server 201 and the PC 301 under the control of the control unit 111, and performs data conversion associated with the communication. The communication unit 151 receives a print job from the PC 301. The communication unit 151 is, for example, a wired communication interface or a wireless communication interface, and specifically, is, for example, a communication interface such as Ethernet (registered trademark) or Wi-Fi (registered trademark).

[0029] Storage unit 161 stores various programs and various data necessary for the operation of MFP 101. Storage unit 161 can be configured with one or more storage devices, such as a random access memory (RAM), a hard disk drive (HDD), a solid state drive (SSD), or a read only memory (ROM). Storage unit 161 stores print jobs received from PC 301. After executing a print job, control unit 111 deletes the executed print job from storage unit 161.

[0030] FIG. 3 is a functional block diagram of the server according to the embodiment.

[0031] The server 201 includes a processing unit 211 , a storage unit 221 , a display unit 231 , an input unit 241 , and a communication unit 251 .

[0032] The processing unit 211 controls the server 201. The processing unit 211 is realized by, for example, one or more processors such as CPUs. The processing unit 211 includes an oscillator circuit (not shown) and a frequency divider circuit (not shown), and counts the current time. The processing unit 211 performs Kerberos authentication with the MFP 101. Note that the processing unit 211 of the server 201 and the control unit 111 of the MFP 101 count the current time independently, and therefore the time set in the server 201 and the time set in the MFP 101 do not necessarily match.

[0033] The storage unit 221 stores various programs and data necessary for the operation of the server 201. The storage unit 221 stores a printer driver that can perform various settings of the MFP 101. The storage unit 221 can be configured with one or more storage devices, such as a RAM, HDD, SSD, or ROM. The storage unit 221 stores user information including a user ID and a password.

[0034] The display unit 231 performs various displays. The display unit 231 is, for example, a liquid crystal display or an organic EL display.

[0035] A user's operations and information are input to the input unit 241. The input unit 241 is, for example, a keyboard, a mouse, or a touchpad.

[0036] The communication unit 251 communicates with the MFP 101 and performs data conversion associated with the communication under the control of the processing unit 211. The communication unit 251 is, for example, a wired communication interface or a wireless communication interface, and specifically, for example, a communication interface such as Ethernet (registered trademark) or Wi-Fi (registered trademark).

[0037] FIG. 4 is a sequence diagram of a control method for a system according to an embodiment.

[0038] 4 illustrates a case where the initial Kerberos authentication fails due to a time difference between the MFP 101 and the server 201, so the time on the MFP 101 is corrected and Kerberos authentication is performed again. Also, assume that there is a difference of a certain amount of time between the time on the MFP 101 and the time on the server 201.

[0039] In step S401, the user inputs a user ID and password using input unit 133 and attempts to log in to MFP 101. It is assumed that the user inputs a valid user ID and password.

[0040] In step S402, control unit 111 makes a Kerberos authentication request to server 201. Specifically, control unit 111 generates a Kerberos request including the input user ID, the input password, and time information, and transmits the Kerberos request to server 201 via communication unit 151. Note that the time information is the current time set in MFP 101, that is, the current time counted by control unit 111.

[0041] In step S403, communication unit 251 receives the Kerberos request, and processing unit 211 performs Kerberos authentication based on the Kerberos request and generates a response packet based on the authentication result. Specifically, processing unit 211 determines whether the user ID and password included in the Kerberos request match the user ID and password included in the user information stored in storage unit 221. In this case, the user ID and password included in the Kerberos request are a legitimate user ID and password, and therefore match the user ID and password included in the user information stored in storage unit 221. Furthermore, processing unit 211 determines whether there is a difference between the time on MFP 101 and the time on server 201. Specifically, it determines whether the difference between the time information included in the Kerberos request and the current time counted by server 201 is equal to or greater than a certain time. If the difference between the time information included in the Kerberos request and the current time counted by server 201 is equal to or greater than a certain time, processing unit 211 determines that there is a difference between the time on MFP 101 and the time on server 201, and if the difference between the time information included in the Kerberos request and the current time counted by server 201 is less than the certain time, processing unit 211 determines that there is no difference between the time on MFP 101 and the time on server 201. In this case, the difference between the time information included in the Kerberos request and the current time counted by server 201 is equal to or greater than a certain time, and processing unit 211 determines that there is a difference between the time on MFP 101 and the time on server 201.

[0042] If processing unit 211 determines that there is a difference between the time on MFP 101 and the time on server 201, it determines that the authentication has failed and generates a response packet indicating that the authentication has failed. The response packet indicating that the authentication has failed includes information indicating the authentication failure, information indicating the cause of the authentication failure, and time information based on the current time on server 201. Here, the information indicating the cause of the authentication failure indicates that the cause of the authentication failure is a difference between the time on MFP 101 and the time on server 201. The time information based on the current time on server 201 indicates the current time measured by server 201, and is, for example, the current time on server 201 at the time the response packet was generated. The time information based on the current time on server 201 may also be the time when the Kerberos request was received, the time when Kerberos authentication was performed, or the like.

[0043] In step S404 , the processing unit 211 transmits the generated response packet to the MFP 101 via the communication unit 251 .

[0044] In step S405, communication unit 151 receives a response packet from server 201, and control unit 111 determines that authentication has failed based on the information indicating the authentication failure contained in the response packet, determines that the cause of the authentication failure is a difference between the time on MFP 101 and the time on server 201 based on the information indicating the cause of the authentication failure contained in the response packet, and acquires the time information contained in the response packet.

[0045] In step S406, control unit 111 generates a Kerberos request including the user ID input in step S401, the password input in step S401, and the time information acquired in step S405.

[0046] In step S407, the control unit 111 again makes a Kerberos authentication request to the server 201. Specifically, the control unit 111 transmits the Kerberos request generated in step S406 to the server 201 via the communication unit 151.

[0047] In step S408, communication unit 251 receives a Kerberos request from MFP 101, and processing unit 211 performs Kerberos authentication based on the Kerberos request and generates a response packet based on the authentication result. Specifically, processing unit 211 determines whether the user ID and password included in the Kerberos request match the user ID and password included in the user information stored in storage unit 221. In this case, the user ID and password included in the Kerberos request are a legitimate user ID and password, and therefore match the user ID and password included in the user information stored in storage unit 221. Furthermore, processing unit 211 determines whether there is a difference between the time on MFP 101 and the time on server 201. Specifically, it determines whether the difference between the time information included in the Kerberos request and the current time counted by server 201 is equal to or greater than a certain time. If the difference between the time information included in the Kerberos request and the current time counted by server 201 is equal to or greater than a certain time, processing unit 211 determines that there is a difference between the time on MFP 101 and the time on server 201, and if the difference between the time information included in the Kerberos request and the current time counted by server 201 is less than a certain time, processing unit 211 determines that there is no difference between the time on MFP 101 and the time on server 201. Here, the time information included in the Kerberos request is time information based on the current time on server 201 that was included in the response packet, and steps S403 to S408 are executed at high speed, so very little time has passed. Therefore, the difference between the time information included in the Kerberos request and the current time counted by server 201 is less than a certain time, and processing unit 211 determines that there is no difference between the time on MFP 101 and the time on server 201.

[0048] If processing unit 211 determines that the user ID and password included in the Kerberos request match the user ID and password included in the user information stored in storage unit 221 and that there is no difference between the time on MFP 101 and the time on server 201, processing unit 211 determines that authentication has been successful and generates a response packet indicating that authentication has been successful. The response packet indicating that authentication has been successful includes information indicating that authentication has been successful.

[0049] In step S409, the communication unit 151 receives a response packet including information indicating successful authentication.

[0050] In step S410, control unit 111 inquires of the user as to whether or not to reflect the time information acquired in step S405 in the time setting. For example, control unit 111 displays a query screen or the like on display unit 132, asking whether or not to reflect the time information acquired in step S405 in the time setting. Note that, if control unit 111 receives a response packet including information indicating successful authentication in step S409, it may reflect the time information acquired in step S405 in the time setting without inquiring of the user.

[0051] In step S411, the user inputs a response to the inquiry in step S410. For example, it is assumed that the user uses input unit 133 to input a response indicating that the time information acquired in step S405 is permitted to be reflected in the time setting.

[0052] In step S412, control unit 111 reflects the time information acquired in step S405 in the time setting of MFP 101. Specifically, control unit 111 reflects the time information acquired in step S405 in the current time of MFP 101. That is, control unit 111 corrects the current time of MFP 101 to the time information acquired in step S405. As a result, the current time of MFP 101 and the current time of server 201 become approximately the same, and the difference between the current time of MFP 101 and the current time of server 201 becomes less than a certain period of time. Note that in step S411, if the user uses input unit 133 to input a response indicating that they do not permit the time information acquired in step S405 to be reflected in the time setting of MFP 101, the current time of MFP 101 is not corrected, and the processing ends.

[0053] In step S413, control unit 111 executes a time-specified job for which an execution time is specified and stored in storage unit 161, if the current time corrected in step S412 exceeds (has passed) the execution time of the time-specified job. Specifically, control unit 111 refers to the execution time of the time-specified job stored in storage unit 161, determines whether the current time corrected in step S412 exceeds the execution time of the time-specified job, and executes the time-specified job if the current time corrected in step S412 exceeds the execution time of the time-specified job.

[0054] For example, suppose the execution time of a certain time-specified job is set to 11:20 AM, and the current time of MFP 101 is corrected from 11:00 AM to 11:30 AM in step S412. At this time, the corrected current time (11:30 AM) exceeds the execution time of the time-specified job (11:20 AM), so control unit 111 executes the time-specified job. In this way, even if the current time is corrected and exceeds the execution time of the time-specified job, it is possible to prevent the time-specified job from not being executed. Note that if control unit 111 determines in step S412 that the corrected current time does not exceed the execution time of the time-specified job, it ends the processing without executing the time-specified job.

[0055] In step S414, the control unit 111 notifies the user that the time-specified job has been executed. For example, the control unit 111 displays on the display unit 132 that the time-specified job has been executed.

[0056] 5A and 5B are flowcharts of a method for controlling an MFP according to an embodiment of the present invention, showing the processing of the MFP 101 when the Kerberos authentication fails in the first Kerberos authentication.

[0057] In step S501, control unit 111 accepts a user ID and password input by the user.

[0058] In step S502, control unit 111 makes a Kerberos authentication request to server 201. Specifically, control unit 111 generates a Kerberos request including the input user ID, the input password, and time information, and transmits the Kerberos request to server 201 via communication unit 151. Note that the time information is the current time set in MFP 101, that is, the current time counted by control unit 111.

[0059] In step S503, communication unit 151 receives a response packet from server 201. Here, Kerberos authentication has failed, and the response packet is an authentication failure response packet. The authentication failure response packet includes information indicating the authentication failure, information indicating the cause of the authentication failure, and time information based on the current time of server 201.

[0060] In step S504, control unit 111 determines that authentication has failed based on the information indicating the authentication failure contained in the response packet. Control unit 111 further determines whether the cause of the authentication failure is a difference between the time on MFP 101 and the time on server 201. Specifically, control unit 111 determines whether the cause of the authentication failure is a difference between the time on MFP 101 and the time on server 201 based on the information indicating the cause of the authentication failure contained in the response packet. If the information indicating the cause of the authentication failure contained in the response packet indicates that the cause of the authentication failure is a difference between the time on MFP 101 and the time on server 201, control unit 111 determines that the cause of the authentication failure is a difference between the time on MFP 101 and the time on server 201, and proceeds to step S505. If the information indicating the cause of the authentication failure contained in the response packet indicates that the cause of the authentication failure is other than a difference between the time on MFP 101 and the time on server 201 (for example, an error in the user ID or password), control unit 111 determines that the cause of the authentication failure is not a difference between the time on MFP 101 and the time on server 201, and proceeds to step S513.

[0061] In step S505, the control unit 111 acquires the time information contained in the response packet.

[0062] In step S506, control unit 111 generates a Kerberos request including the user ID input in step S501, the password input in step S501, and the time information acquired in step S505.

[0063] In step S507, the control unit 111 again makes a Kerberos authentication request to the server 201. Specifically, the control unit 111 transmits the Kerberos request generated in step S506 to the server 201 via the communication unit 151.

[0064] In step S508, the communication unit 151 receives a response packet from the server 201. The response packet includes information indicating whether the authentication was successful or not.

[0065] In step S509, control unit 111 determines whether authentication has been successful or not based on information indicating the success or failure of authentication, which is included in the response packet. If it is determined that authentication has been successful, control proceeds to step S510, and if it is determined that authentication has failed, control proceeds to step S513. Note that if the number of times it has been determined that authentication has failed in step S509 is equal to or less than a threshold value (for example, 2 or 3), control unit 111 may return control to S507 and make a Kerberos authentication request to server 201 again. If the number of times it has been determined that authentication has failed in step S509 exceeds the threshold value, control may proceed to step S513.

[0066] In step S510, control unit 111 inquires of the user as to whether or not to reflect the time information acquired in step S505 in the time setting, and determines, based on the user's response, whether to reflect the time information acquired in step S505 in the time setting. If the user's response is permission, control unit 111 determines that the time information acquired in step S505 should be reflected in the time setting, reflects the time information acquired in step S505 in the time setting, and proceeds to step S511. Specifically, control unit 111 reflects the time information acquired in step S505 in the current time of MFP 101, and proceeds to step S511. If the user's response is not permission, control unit 111 determines that the time information acquired in step S505 should not be reflected in the time setting of MFP 101, and ends the process.

[0067] In step S511, control unit 111 determines whether the current time corrected in step S510 exceeds the execution time of the time-specified job for a job with a specified execution time (time-specified job) stored in storage unit 161. If it is determined that the current time corrected in step S510 exceeds the execution time of the time-specified job, control proceeds to step S512, and if it is determined that the current time corrected in step S510 does not exceed the execution time of the time-specified job, the process ends.

[0068] In step S512, the control unit 111 executes the time-specified job whose execution time is later than the current time, and notifies the user that the time-specified job has been executed.

[0069] In step S513, control unit 111 notifies the user that the cause of the authentication failure is other than the difference between the time on MFP 101 and the time on server 201.

[0070] According to the system of the embodiment, if the cause of authentication failure is a difference between the time on MFP 101 and the time on server 201, the system requests Kerberos authentication again using the time information included in the response packet, thereby preventing the difference between the time on MFP 101 and the time on server 201 from being the cause of authentication failure. As a result, even if there is a difference between the time on MFP 101 and the time on server 201, authentication can be performed using Kerberos authentication without using NTLM authentication, which has weak security, and security can be ensured.

[0071] In the above embodiment, Kerberos authentication is used as the predetermined authentication method, but any protocol that includes time information in the response packet, such as SMB (Server Message Block) or HTTP (Hyper Text Transfer Protocol), may also be used.

[0072] It should be noted that the present disclosure is not limited to the above-described embodiments and can be modified, and the above configurations can be replaced with substantially the same configurations, configurations that achieve the same effects, or configurations that can achieve the same purpose. [Explanation of symbols]

[0073] 100 systems 101 MFP 111 Control Unit 121 Reading unit 131 Display operation section 141 Printing section 151 Communications Department 161 Storage section 201 Server 211 Processing section 221 Storage section 231 Display section 241 Input section 251 Communications Department 301 PC

Claims

1. An image forming apparatus that communicates with a server, a communication unit that communicates with the server; a control unit that counts a first current time and requests authentication from the server using a predetermined authentication method; the communication unit receives a response packet including time information based on a second current time of the server and information indicating success or failure of the authentication; When the information indicating the success or failure of the authentication indicates a failure of the authentication, determining whether the cause of the authentication failure is a difference between the first current time and the second current time based on information indicating the cause of the authentication failure included in the response packet; If it is determined that the authentication failure is caused by the difference, acquiring the time information included in the response packet; The image forming apparatus uses the time information to request authentication again from the server using the predetermined authentication method.

2. 2. The image forming apparatus according to claim 1, wherein the control unit, when the information indicating whether the authentication has been successful indicates that the authentication has been successful, reflects the time information in the first current time.

3. the image forming apparatus has a job with a specified execution time, The image forming apparatus according to claim 2 , wherein the control unit executes the job when the time information is reflected in the first current time and the first current time exceeds the execution time.

4. 2. The image forming apparatus according to claim 1, wherein the predetermined authentication method is Kerberos authentication.

5. A method for controlling an image forming apparatus that communicates with a server, comprising: Counting a first current time; requesting authentication from the server using a predetermined authentication method; receiving a response packet including time information based on a second current time of the server and information indicating whether the authentication was successful; if the information indicating the success or failure of the authentication indicates a failure of the authentication, determining whether or not the cause of the failure of the authentication is a difference between the first current time and the second current time, based on information indicating a cause of the failure of the authentication, which is included in the response packet; If it is determined that the authentication failure is caused by the difference, acquiring the time information included in the response packet; Using the time information, request authentication again from the server using the predetermined authentication method. A control method comprising the steps of:

6. A system including a server and an image forming device communicating with the server, The server a first communication unit that communicates with the image forming apparatus; a processing unit; The processing unit Counting a first current time; In response to a request from the image forming apparatus, authentication is performed using a predetermined authentication method; transmitting a response packet to the image forming apparatus, the response packet including time information based on the first current time and information indicating whether the authentication was successful; the image forming apparatus, a second communication unit that communicates with the server; a control unit that counts a second current time and requests authentication from the server using the predetermined authentication method; the communication unit receives the response packet from the server, When the information indicating the success or failure of the authentication indicates a failure of the authentication, determining whether the cause of the authentication failure is a difference between the first current time and the second current time based on information indicating the cause of the authentication failure included in the response packet; If it is determined that the authentication failure is caused by the difference, acquiring the time information included in the response packet; A system that uses the time information to request authentication again from the server using the predetermined authentication method.

Images