A first communication device, a computer program for the first communication device, and a communication system comprising the first communication device.

Abstract

We provide technology for securely executing jobs. [Solution] The first communication device comprises: a first token receiving unit that receives a first token from a server on the Internet when first user authentication for a first user corresponding to first user information is successful, wherein the first token is stored in the server in association with first user information; an information receiving unit that sends a first information request to the server including the first token received from the server, and receives from the server the first user information stored in the server in association with the first token as a response to the first information request; and a job execution unit that executes a job according to the job information stored in memory because the first user information received from the server matches the first user information stored in memory in association with job information.

Description

Technical Field

[0001] The present specification relates to a first communication apparatus.

Background Art

[0002] Patent Document 1 discloses an MFP that stores print jobs including passwords. The MFP executes printing according to the print job when a password input to a touch panel matches the password included in the print job.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of Invention

Problems to be Solved by the Invention

[0004] The present specification provides a technique for securely executing a job.

Means for Solving the Problems

[0005] The first communication device disclosed herein includes: a memory that stores job information for causing the first communication device to execute a job, associated with first user information corresponding to a first user; a first token receiving unit that receives a first token from a server on the Internet when first user authentication for the first user corresponding to the first user information is successful, wherein the first token is generated by the server in response to the success of the first user authentication and stored in the server in association with the first user information; an information receiving unit that transmits a first information request including the first token received from the server to the server and receives the first user information stored in the server in association with the first token as a response to the first information request; and a job execution unit that executes the job according to the job information stored in the memory because the first user information received from the server matches the first user information stored in the memory in association with the job information.

[0006] According to the above configuration, a job is executed according to the job information upon successful first user authentication on the server on the internet. This allows for secure job execution.

[0007] The computer program for realizing the first communication device described above, and the computer-readable storage medium for storing the computer program, are both novel and useful. The control method for the communication device described above is also novel and useful.

[0008] The communication system disclosed herein comprises a first communication device and a second communication device capable of communicating with the first communication device, wherein the second communication device includes a storage instruction transmission unit that transmits a storage instruction to the first communication device instructing the first communication device to store job information for causing the first communication device to execute a job, the storage instruction including the job information and first user information corresponding to a first user, the first communication device includes a memory and a storage control unit that, upon receiving the storage instruction from the second communication device, stores the job information included in the storage instruction in the memory in association with the first user information included in the storage instruction, and in the case where first user authentication for the first user corresponding to the first user information is successful on a server on the Internet The system includes: a first token receiving unit that receives a first token from the server, wherein the first token is generated by the server in response to the success of the first user authentication and stored in the server in association with the first user information; an information receiving unit that sends a first information request to the server including the first token received from the server and receives from the server the first user information stored in the server in association with the first token as a response to the first information request; and a job execution unit that executes the job according to the job information stored in the memory because the first user information received from the server matches the first user information stored in the memory in association with the job information.

[0009] Even with the above configuration, jobs can be executed securely. [Brief explanation of the drawing]

[0010] [Figure 1] Figure 1 is a conceptual diagram of the communication system. [Figure 2] Figure 2 is a block diagram of the MFP. [Figure 3] Figure 3 is a block diagram of the user terminal. [Figure 4]Figure 4 is a sequence diagram of the process for issuing tokens. [Figure 5] Figure 5 is a continuation of Figure 2. [Figure 6] Figure 6 is a sequence diagram of the printing process. [Figure 7] Figure 7 is a continuation of Figure 6. [Modes for carrying out the invention]

[0011] (Configuration of communication system 2; Figures 1-3) Communication system 2 comprises an MFP 10, an administrator terminal 100, a user terminal 200, and a server 300. The MFP 10 is a device with multiple functions, including printing and scanning functions. "MFP" is an abbreviation for Multifunction Peripheral. The administrator terminal 100 and user terminal 200 are laptop PCs, desktop PCs, tablet terminals, smartphones, etc.

[0012] The MFP10, administrator terminal 100, and user terminal 200 are used within a specific organization. This specific organization could be, for example, a corporation, an office, or a department within a company. The administrator terminal 100 is a terminal device used by administrators belonging to this specific organization. The user terminal 200 is a terminal device used by users belonging to this specific organization and managed by the administrator. Here, within this specific organization, there may be one or more users per administrator. Therefore, a specific organization may have multiple user terminals 200.

[0013] The MFP10, administrator terminal 100, and user terminal 200 are connected to LAN4. "LAN" stands for Local Area Network. LAN4 is either wireless or wired. The administrator terminal 100 and user terminal 200 can communicate with the MFP10 via LAN4.

[0014] LAN4 is connected to Internet 6. Server 300 is connected to Internet 6. A device connected to LAN4, such as MFP10, can communicate with Server 300 via Internet 6 and LAN4.

[0015] (Configuration of MFP10; Figure 2) The MFP10 comprises a display unit 12, an operation unit 14, a LAN interface 16, a print execution unit 18, a scan execution unit 20, and a control unit 30. Hereafter, "interface" may be written as "I / F".

[0016] The display unit 12 is a display or panel for displaying various information. The panel may or may not be a touch panel. The panel may be, for example, a liquid crystal panel or an organic EL panel. The operation unit 14 is a user interface that allows the user to input various information to the MFP 10. The operation unit 14 may include, for example, a touch panel for displaying software keys, i.e., operation objects, hardware keys, or both. Hardware keys may be, for example, buttons or switches.

[0017] LANI / F16 is an interface for performing communication via LAN4. LANI / F16 is connected to LAN4. The print execution unit 18 is hardware that performs printing on a printing medium according to the print data. The print execution unit 18 is implemented, for example, by an inkjet method or an electrophotographic method. The scan execution unit 20 is hardware that performs document reading. The scan execution unit 20 is equipped with a scanner engine having an image sensor such as a Charge-Coupled Device (CCD) or Contact Image Sensor (CIS).

[0018] The control unit 30 includes a CPU 32 and a memory 34. The memory 34 includes a main storage device and an auxiliary storage device. As an example, the main storage device includes a RAM and a cache memory. As an example, the auxiliary storage device may be a ROM, a flash memory, a Solid State Drive (SSD), a Hard Disk Drive (HDD), or a combination thereof. The CPU 32 implements various processes in accordance with a program 40 loaded from the auxiliary storage device to the main storage device.

[0019] The MFP 10 has a server function that provides a setting screen for changing settings of the MFP 10. The memory 34 stores login information 42 for logging in to the server function of the MFP 10. The login information 42 is, for example, a user name and a password.

[0020] (Configuration of Server 300; Figure 1) The server 300 provides a service for managing accounts of users belonging to an organization. The service is, for example, Microsoft Entra ID (registered trademark). The server 300 stores an account table 310 and a token table 320.

[0021] The account table 310 manages information about users belonging to an organization. The account table 310 stores the tenant ID, user ID, and email address in association. The tenant ID is an identifier that identifies the organization. The user ID is an identifier that identifies the user. The user ID is the so-called account name. Although not shown in the diagram, each user ID is stored in association with a password. For example, as shown in Figure 1, one tenant ID "t01" is stored in association with four user IDs "ad01", "u01", "u02", and "u03". Here, user ID "ad01" identifies an administrator belonging to the specific organization identified by tenant ID "t01". Each user ID "u01", "u02", and "u03" identifies a user other than an administrator belonging to the specific organization identified by tenant ID "t01". Hereafter, the user ID that identifies an administrator will be referred to as the administrator ID. Also, the user ID that identifies a user other than an administrator will be referred to as the individual user ID.

[0022] In this embodiment, the administrator ID "ad01" is stored in association with administrative permission information indicating the administrator's authority. The administrative permission information indicates the authority to access all email addresses stored in association with the tenant ID "t01". In addition, individual user IDs are stored in association with individual permission information indicating the authority of the user identified by the individual user ID. The individual permission information indicates the authority to access the email address stored in association with the corresponding individual user ID. On the other hand, the individual permission information does not indicate the authority to access email addresses stored in association with other user IDs. In a modified example, the individual permission information may indicate the authority to access multiple email addresses. For example, the individual permission information corresponding to individual user ID "u01" may indicate the authority to access not only the email address stored in association with individual user ID "u01" but also the email address stored in association with another user ID "u02".

[0023] The token table 320 manages tokens. Tokens are authentication information issued by the server 300. The token table 320 stores the user ID, device code, refresh token, access token, and user code in association with each other. The device code is a code assigned to a device such as the MFP10. The user code is a code assigned to a user. The access token is authentication information for activating the authority indicated by the administrative authority information or individual authority information stored in association with the corresponding user ID. The access token also has a predetermined expiration date. The refresh token is a token for refreshing the access token. In the modified example, the access token does not need to have an expiration date.

[0024] (Configuration of user terminal 200; Figure 3) The user terminal 200 comprises a display unit 212, an operation unit 214, a LANI / F 216, and a control unit 230. The LANI / F 216 is connected to LAN 4. The control unit 130 comprises a CPU 132 and a memory 134. The CPU 132 performs various processes according to programs 140 and 142 loaded from the auxiliary storage device into the main memory.

[0025] The OS program 140 controls the basic operation of the user terminal 200. App 142 is an application program that generates print job information. Print job information is the information that causes the MFP 10 to execute a print job. Print job information includes, for example, image data and print settings. App 142 is provided, for example, by the MFP 10 vendor. App 142 is installed, for example, from a server on the Internet 6.

[0026] (Process for issuing tokens; Figures 4 and 5) The process of issuing tokens will be explained with reference to Figures 4 and 5. In the following explanation, the processes performed by MFP10 are implemented by the CPU 32 of MPF10, which operates according to program 40. Communication between devices is performed via LAN4, the Internet 6, and LANI / F16. In the following explanation, when communication between devices is described, descriptions of LAN4, the Internet 6, and LANI / F16 will be omitted.

[0027] In T10, the administrator terminal 100 uses login information 42 to log in to the server function of MFP10. This establishes a login session between the administrator terminal 100 and MFP10. The following processes utilize this login session for communication between the administrator terminal 100 and MFP10.

[0028] In T12, the administrator terminal 100 sends a configuration screen request to the MFP 10 requesting configuration screen information. The configuration screen information corresponds to the configuration screen SC1 used to change the settings of the MFP 10.

[0029] In T14, the administrator terminal 100 receives configuration screen information from the MFP 10 as a response to the configuration screen request in T12. In T16, the administrator terminal 100 displays configuration screen SC1. Configuration screen SC1 includes multiple icons corresponding to various settings of the MFP 10. Configuration screen SC1 includes icon A1, which accepts instructions from the user to start communication with server 300.

[0030] When the administrator terminal 100 detects the selection of icon A1 in the settings screen SC1 at T20, it sends a linkage request to the MFP10 at T22. The linkage request is a signal requesting the start of linkage with the server 300.

[0031] When MFP10 receives a communication request from the administrator terminal 100 at T22, it sends a code request to the server 300 at T26. The code request is a signal requesting a device code and a user code.

[0032] When server 300 receives a code request from MFP10 at T26, it generates the device code "dv01" at T28. Furthermore, server 300 generates the user code "xxxx" at T30. Server 300 associates the user code "xxxx" with the device code "dv01" and stores it in the token table 320.

[0033] In T32, the server 300 sends a response to the code request to the MFP 10. This response includes the device code "dv01" generated in T28, the user code "xxxx" generated in T30, and the verification_URL. The verification_URL is a URL for accessing the input screen information corresponding to the input screen SC3 for entering the user code. Figure 5 shows an example of the input screen SC3.

[0034] When MFP10 receives a response from server 300 at T32, it begins repeatedly sending a polling signal to server 300 at T34. The polling signal is a signal to confirm that a token has been issued. The polling signal includes the device code "dv01" received at T32.

[0035] In T36, MFP10 sends code screen information corresponding to the code screen SC2 that displays the user code to the administrator terminal 100. The code screen information includes the user code "xxxx" and the verification_URL.

[0036] When the administrator terminal 100 receives code screen information from the MFP 10 at T36, it displays code screen SC2 at T40. Code screen SC2 includes a string representing the user code "xxxx" and icon A2. Icon A2 is an icon that accepts instructions from the user to sign in to server 300.

[0037] When the administrator terminal 100 detects the selection of icon A2 in the code screen SC2 at T42, it sends an input screen request to the server 300 at T44. The input screen request is a signal requesting input screen information and includes a verification_URL.

[0038] In Figure 5, at T50, the administrator terminal 100 receives input screen information as a response to the input screen request at T42. At T52, the administrator terminal 100 displays input screen SC3. Input screen SC3 includes an input field A3 for entering a user code.

[0039] In T52, the administrator terminal 100 detects the input of user code "xxxx" into input field A3. In T54, the administrator terminal 100 sends the user code "xxxx" entered in input field A3 to the server 300.

[0040] When server 300 receives user code "xxxx" from administrator terminal 100 at T56, it authenticates the user code "xxxx" received from administrator terminal 100. In this case, the user code "xxxx" received from administrator terminal 100 matches the user code "xxxx" stored in token table 320. Therefore, authentication of user code "xxxx" is successful at T58.

[0041] When server 300 successfully authenticates user code "xxxx", it sends account screen information to administrator terminal 100 via T58. The account screen information corresponds to account screen SC4, which is used to select the account name for which a token should be issued.

[0042] When administrator terminal 100 receives account screen information from server 300 at T60, it displays account screen SC4 at T62. Account screen SC4 includes icon A4 for selecting the target account name from the account names stored in administrator terminal 100. In this case, administrator ID "ad01" is stored as the account name in administrator terminal 100. Therefore, administrator ID "ad01" is displayed on icon A4. If multiple account names are stored in administrator terminal 100, multiple icons A4 will be displayed on account screen SC4. Account screen SC4 may also include an icon for creating a new account, and input fields for entering a new account name and password. In this case, the administrator selects icon A4 on account screen SC4.

[0043] When administrator terminal 100 detects the selection of icon A4 in the account screen SC4 at T64, it proceeds to T66. At T66, administrator terminal 100 sends the administrator ID "ad01" and password corresponding to icon A4 to server 300.

[0044] When server 300 receives the administrator ID "ad01" and password from administrator terminal 100 at T66, it authenticates the administrator ID "ad01" and password. In this case, the administrator ID "ad01" and password are stored in account table 310. Therefore, authentication of administrator ID "ad01" and password is successful at T68. The authenticated administrator ID "ad01" is stored in token table 320, associated with user code "xxxx" and device code "dv01".

[0045] If the server 300 successfully authenticates the administrator ID "ad01" and password in T68, it proceeds to T70. In T70, the server 300 sends a success notification to the administrator terminal 100 indicating that the authentication was successful. Furthermore, in T72, the server 300 generates a refresh token RT1. In the following T74, the server 300 generates an access token AT1 based on the refresh token RT1. The server 300 then stores tokens RT1 and AT1 in the token table 320, associating them with the administrator ID "ad01" and device code "dv01".

[0046] Between T36 in Figure 4 and T74 in Figure 5, the MFP10 repeatedly sends a polling signal containing the device code "dv01" to the server 300. At T76, the server 300 receives the polling signal from the MFP10 after tokens RT1 and AT1 have been generated. At T78, the server 300 sends tokens RT1 and AT1, which are stored in association with the device code "dv01" included in the polling signal, to the MFP10.

[0047] When MFP10 receives tokens RT1 and AT1 from server 300 at T78, it stores tokens RT1 and AT1 in memory 34 at T80.

[0048] In the subsequent T82, MFP10 sends a tenant ID request to server 300 requesting the tenant ID. The tenant ID request includes access token AT1.

[0049] When server 300 receives a tenant ID request from administrator terminal 100 in T82, it proceeds to T84. In T84, server 300 identifies the management identifier "ad01" stored in the token table 320 in association with the access token AT1 in the tenant ID request. Then, server 300 sends the tenant ID "t01" stored in the account table 310 in association with the identified management identifier "ad01" to administrator terminal 100.

[0050] When MFP10 receives tenant ID "t01" from server 300 at T84, it stores tenant ID "t01" in memory 34 at T86.

[0051] (Printing process; Figures 6 and 7) The process shown in Figure 6 is for sending print job information to the MFP10. The process in Figure 6 can be executed after the processes shown in Figures 4 and 5.

[0052] User terminal 200 establishes a login session using the individual user ID "u01" at T100. The timing of the establishment of the login session varies. For example, the login session may be established during activation, which is performed when user terminal 200 is first started. In this case, user terminal 200 may use the login session to obtain the individual user ID "u01" from server 300. Alternatively, the login session may be established at any time when the user enters the individual user ID "u01" into user terminal 200. Furthermore, the process at T100 does not have to be executed every time the process in Figure 6 is started. For example, a situation is envisioned where the process in Figure 6 is executed multiple times consecutively. In this case, if the process at T100 is executed during the first execution of the process in Figure 6, the process at T100 can be omitted in subsequent executions of Figure 6, as long as the session is not disconnected. In a modified example, the process at T100 may not be executed at all. In this case, the user terminal 200 may store in memory 234 the individual user ID "u01" that was previously used in a login session with the server 300. Then, without establishing a login session, the user terminal 200 may send a storage instruction to the MFP 10 in T114, which will be described later, that includes the individual user ID "u01" in memory 234.

[0053] The user launches application 142 on T110 and inputs a job transmission instruction to the operation unit 214 of the user terminal 200. The job transmission instruction is an instruction to send print job information to the MFP 10. The processing of T112 and T114, which will be described later, is implemented by application 142.

[0054] When user terminal 200 detects the input of a job transmission instruction at T110, T112 generates print job information PJ1 in accordance with the job transmission instruction.

[0055] In T114, the user terminal 200 sends a storage instruction to the MFP 10 instructing it to store the print job information. The storage instruction includes the print job information PJ1 generated in T112 and the individual user ID "u01" used in the login session of T100.

[0056] When MFP10 receives a memory instruction from user terminal 200 at T114, it sends a list request to server 300 at T116. The list request is a signal requesting a list of user IDs that identify users belonging to a specific organization. The list request includes access token AT1.

[0057] When server 300 receives a list request from user terminal 200 at T116, it proceeds to T118. At T118, server 300 identifies the administrator ID "ad01" stored in association with the access token AT1 included in the list request. Along with the identified administrator ID "ad01", server 300 identifies all individual user IDs stored in association with tenant ID "t01". Then, server 300 sends all individual user IDs and administrator ID "ad01" as a list of user IDs to MFP10.

[0058] When MFP10 receives a list of user IDs from server 300 at T118, it proceeds to T120. At T120, MFP10 determines whether the list of user IDs received at T118 includes the individual user ID "u01" contained in the storage instruction at T114. The inclusion of the individual user ID "u01" in the list of user IDs means that the user corresponding to the individual user ID "u01" belongs to a specific organization. If MFP10 determines that the individual user ID "u01" in the storage instruction is included in the list of user IDs (YES at T120), it proceeds to T122.

[0059] In step T122, the MFP10 stores the print job information PJ1 from the storage instruction in T114 in memory 34. If the MFP10 determines that the individual user ID "u01" from the storage instruction is not included in the list of user IDs (NO in T120), it proceeds to T124. In T124, the MFP10 sends a failure notification to the user terminal 200 indicating that the storage of the print job information failed. This configuration prevents the MFP10 from storing print job information from users who do not belong to a specific organization. It also allows the user to be notified that the storage of the print job information failed.

[0060] Furthermore, the storage instruction of T114 includes the individual user ID "u01" used for the login session on the user terminal 200. The user corresponding to the individual user ID "u01" used for the login session is presumed to be the user using the user terminal 200. According to the above configuration, the print job information PJ1 can be stored in the MFP10 in association with the user using the user terminal 200. In a modified example, in T110, the user may input the individual user ID "u01" into the operation unit 14 in addition to the job transmission instruction. The individual user ID "u01" input by the user may then be included in the storage instruction.

[0061] The process in Figure 7 is a continuation of the process in Figure 6. The user inputs an authentication command to the operation panel 14 of the MFP10 in T200. The authentication command is an instruction to start authentication for the user who will be using the print job information stored in the MFP10.

[0062] When MFP10 detects the input of an authentication instruction at T200, it proceeds to T202. At T202, MFP10 sends a code request to server 300 that includes the tenant ID "t01" stored in memory 34. The code request at T202 is the same as the code request at T26 in Figure 4, except that it includes the tenant ID "t01".

[0063] The processing of T204 and T206 is the same as that of T28 and T30 in Figure 4, except that the device code "dv99" and user code "zzzz" are generated. The processing of T208 and T210 is the same as that of T32 and T34 in Figure 4, except that the device code "dv99" and user code "zzzz" are used.

[0064] In the subsequent T212, the MFP10 displays a two-dimensional code on the display unit 12. This two-dimensional code is an image that encodes the verification_URL and user code "zzzz" received from the server 300.

[0065] At T214, the user operates the user terminal 200 to capture an image of the QR code displayed at T212. As a result, at T216, the user terminal 200 decodes the QR code and obtains the verification_URL and the user code "zzzz".

[0066] In T218, user terminal 200 uses verification_URL to send the user code "zzzz" to server 300.

[0067] When server 300 receives the user code "zzzz" from user terminal 200 at T218, it authenticates the user code "zzzz" received from user terminal 200. In this case, the user code "zzzz" received from user terminal 200 matches the user code "zzzz" stored in token table 320. Therefore, authentication of user code "zzzz" is successful at T220.

[0068] When server 300 successfully authenticates user code "zzzz", T222 sends account screen information to user terminal 200.

[0069] When user terminal 200 receives account screen information from server 300 at T222, it displays account screen SC4 at T224. In this case, the individual user ID "u01" is stored as the account name in user terminal 200. Account screen SC4 includes icon A5 displaying the individual user ID "u01".

[0070] When user terminal 200 detects the selection of icon A5 in the account screen SC4 at T226, it proceeds to T228. At T228, user terminal 200 sends the individual user ID "u01" and password corresponding to icon A5 to server 300.

[0071] When server 300 receives the individual user ID "u01" and password from user terminal 200 at T228, it authenticates the individual user ID "u01" and password. In this case, authentication of the individual user ID "u01" and password is successful at T230. The authenticated individual user ID "u01" is stored in token table 320 in association with device code "dv99". Subsequently, server 300 generates access token AT2 and stores access token AT2 in token table 320 in association with device code "dv99".

[0072] In T234, the server 300 receives a polling signal from the MFP 10 after the access token AT2 has been generated. In T236, the server 300 sends the access token AT2, which is stored in association with the device code "dv99" included in the polling signal, to the MFP 10.

[0073] In the subsequent T240, server 300 sends an ID request to server 300 requesting a user ID. The ID request includes the access token AT2.

[0074] When server 300 receives an ID request from user terminal 200 at T240, it proceeds to T242. At T242, server 300 identifies the individual user ID "u01" stored in association with the access token AT2 in the ID request from the token table 320. Server 300 then sends the identified individual user ID "u01" to user terminal 200.

[0075] When MFP10 receives the individual user ID "u01" from server 300 at T242, it proceeds to T246. At T246, MFP10 identifies the print job information stored in memory 34 that matches the individual user ID "u01" received from the server. In this case, at T122 in Figure 6, print job information PJ1 is stored in memory 34 associated with individual user ID "u01". Therefore, at T246, MFP10 identifies print job information PJ1 from memory 34.

[0076] In T248, the MFP10 displays the print job indicated by the print job information PJ1 identified in T246 on the display unit 12. If multiple print job information entries are stored in memory 34 associated with the individual user ID "u01", the MFP10 displays a list of print jobs indicated by the multiple print job information entries on the display unit 12.

[0077] When the MFP10 detects that one of the jobs displayed on the display unit 12 has been selected in T250, it proceeds to T252. In T252, the MFP10 executes the print job selected in T250. Specifically, the MFP10 instructs the print execution unit 18 to print an image according to the print job information corresponding to the selected print job.

[0078] In this embodiment, the MFP10 receives an access token AT2 from the server 300 when authentication of the individual user ID "u01" by the user terminal 200 is successful (T236 in Figure 7). The MFP10 uses the access token AT2 to receive the individual user ID "u01" from the server 300 (T242). In this case, the individual user ID "u01" received from the server 300 matches the individual user ID "u01" stored in memory 34 in association with the print job information PJ1. The MFP10 executes a print job according to the print job information PJ1 stored in memory 34 in association with the individual user ID "u01" (T252). Thus, depending on the success of authentication of the individual user ID "u01" on the server 300 on the Internet 6, a print job according to the print job information PJ1 is executed. Print jobs can be executed securely.

[0079] Furthermore, authentication using individual user IDs, as shown in Figure 7, is triggered by a code request containing tenant ID "t01". Tenant ID "t01" is obtained using access token AT1, which corresponds to administrator ID "ad01" (T84 in Figure 2). In other words, the process in Figure 7 is executed based on both administrator ID authentication and individual user ID authentication.

[0080] Furthermore, it is assumed that multiple print job information entries are stored in memory 34, associated with the individual user ID "u01". In this situation, the processes T248 and T250 in Figure 7 are not executed, and all print jobs corresponding to the multiple print job information entries may be executed in T252. Since there is no need to select a print job, user convenience is improved.

[0081] (Correspondence) MFP10, display unit 12, and memory 34 are examples of the "first communication device," "display unit," and "memory," respectively. Server 300 is an example of a "server." Individual user ID "u01" and authentication of T230 in Figure 7 are examples of the "first user information" and "first user authentication," respectively. Access token AT2 and ID request of T240 are examples of the "first token" and "first information request," respectively. User code "zzzz," device code "dv99," and polling signal of T210 are examples of the "user code," "device code," and "signal," respectively. Administrator ID "ad01" and tenant ID "t01" are examples of the "second user information" and "organization identifier," respectively. Access token AT1 is an example of a "second token." Code request of T202 and user terminal 200 in Figure 7 are examples of the "start instruction" and "second communication device," respectively. List of T248 is an example of a "list." The list request (T116) and the failure notification (T124) in Figure 6 are examples of the "second information request" and the "prescribed notification," respectively. Communication system 2 is an example of a "communication system."

[0082] T236, T242, and T252 in Figure 7 are examples of processes implemented by the "first token receiving unit," "information receiving unit," and "job execution unit," respectively. T114 and T122 in Figure 6 are examples of processes implemented by the "storage instruction transmission unit" and "storage control unit," respectively.

[0083] Although specific examples of the present invention have been described in detail above, these are merely illustrative and do not limit the scope of the claims. The technology described in the claims includes various modifications and changes to the specific examples illustrated above. Variations of the above embodiments are listed below.

[0084] (Modification 1) In the memory instruction T114 of Figure 6, instead of the individual user ID "u01", an email address corresponding to the individual user ID "u01" may be included. The MFP10 may then store the print job information PJ1 in memory 34 in association with the said email address. Furthermore, in T242 of Figure 7, the MFP10 may receive the said email address from the server 300 instead of the individual user ID "u01". In this modification, the said email address is an example of "first user information".

[0085] (Modification 2) The "first communication device" is not limited to the MFP10, but may be a printer, scanner, fax machine, terminal device, sewing machine, etc. In other words, the "job" is not limited to a print job, but may be a scan job, fax job, embroidery job, other data generation job, etc. That is, the "job" only needs to represent the content of the processing to be performed by the "first communication device". Furthermore, the "first communication device" is not limited to the device described in each embodiment. The first communication device only needs to be a device that can obtain the content of the processing to be performed by the first communication device from a device that can communicate with the first communication device and execute the said processing.

[0086] (Modification 3) The processes T116 to T120 in Figure 6 may not be executed, and the process T122 may be executed instead. In this modification, the "second request transmission unit" is omitted. Also, in this modification, the processes in Figures 4 and 5 may not be executed. In this modification, the "second token" is omitted.

[0087] (Modification 4) The process at T124 in Figure 6 does not need to be executed. In this modification, the "prescribed notification" is omitted.

[0088] (Modification 5) In the above embodiment, the CPU 32 executes the program 40 to realize each of the processes shown in Figures 4 to 7. Alternatively, any of these processes may be realized by hardware such as logic circuits.

[0089] Furthermore, the technical elements described herein or in the drawings demonstrate technical usefulness individually or in various combinations, and are not limited to the combinations described in the claims at the time of filing. In addition, the technologies illustrated herein or in the drawings achieve multiple objectives simultaneously, and achieving even one of these objectives constitutes technical usefulness in itself.

[0090] Even if, in the claims of this patent application, each claim depends on only some of the claims, it is not limited to the claim being dependent only on those specific claims. To the extent that it is not technically contradictory, each claim may be dependent on other claims that were not dependent at the time of application. That is, the technologies of each claim can be combined in various ways as follows: The following are the features of the technology disclosed herein. (Item 1) A first communication device, A memory that stores job information for causing the first communication device to execute a job, associated with first user information corresponding to a first user, A first token receiving unit receives a first token from a server on the Internet when first user authentication for the first user corresponding to the first user information is successful, wherein the first token is generated by the server in response to the success of the first user authentication and stored on the server in association with the first user information. An information receiving unit transmits a first information request to the server, which includes the first token received from the server, and receives from the server the first user information stored in the server in association with the first token as a response to the first information request. A job execution unit executes the job according to the job information stored in the memory, due to the first user information received from the server matching the first user information stored in the memory in association with the job information. A first communication device equipped with the following: (Item 2) The server stores an organization identifier that identifies the organization to which the first user and the second user, which corresponds to second user information different from the first user information, belong. The first communication device further includes, A second token receiving unit receives a second token from the server, which is different from the first token, if the server successfully performs a second user authentication for the second user corresponding to the second user information before receiving the first token from the server, wherein the second token is generated by the server in response to the success of the second user authentication and stored in the server in association with the second user information. A first request transmission unit that, upon receiving the second token from the server, sends an identifier request to the server requesting the organization identifier, wherein the identifier request includes the second token, and the first request transmission unit An identifier receiving unit receives the organization identifier stored in the server in association with the second token included in the identifier request from the server, A start instruction sending unit that sends a start instruction to the server to initiate the first user authentication, wherein the start instruction includes the organization identifier received from the server, The first communication device described in item 1, comprising: (Item 3) The first communication device further includes, A code receiving unit that sends a code request to the server requesting a user code and receives the user code from the server, A code output unit that outputs the user code received from the server, Equipped with, The user code output from the first communication device is acquired by a second communication device different from the first communication device. The acquired user code, along with a first user identifier that identifies the first user, is transmitted to the server by the second communication device. The first user authentication described above is, The server authenticates the user code received from the second communication device, The server authenticates the first user identifier received from the second communication device, The first communication device described in item 1 or 2, including the following: (Item 4) The code receiving unit further receives a device code from the server that is different from the user code. The first communication device further includes, The system includes a polling start unit that starts polling a signal including the device code in response to receiving the device code from the server, The first communication device according to item 3, wherein the first token receiving unit receives the first token stored in the server in association with the device code included in the signal, from the server as a response to the signal when the signal is received by the server after the first user authentication is successful. (Item 5) The aforementioned first token is a first communication device as described in any one of items 1 to 4, having an expiration date. (Item 6) The job is a print job, according to the first communication device described in any one of items 1 to 5. (Item 7) The memory stores the job information in association with the first user information. The first communication device further includes, Display unit and A display control unit that, upon receiving the first user information from the server, causes the display unit to display a list of jobs indicated by the job information stored in the memory in association with the first user information, Equipped with, The job execution unit is a first communication device according to any one of items 1 to 6, which executes the job according to the job information selected by the first user in the list. (Item 8) The memory stores two or more pieces of the job information in association with the first user information. The job execution unit is a first communication device according to any one of items 1 to 6, which executes all jobs according to two or more job information stored in the memory. (Item 9) It is a communication system, The first communication device and A second communication device capable of communicating with the first communication device, Equipped with, The second communication device is A storage instruction transmission unit transmits a storage instruction to the first communication device that instructs the first communication device to store job information for executing a job, wherein the storage instruction includes the job information and first user information corresponding to a first user, the storage instruction transmission unit comprises The first communication device is, Memory and A storage control unit, upon receiving the storage instruction from the second communication device, stores the job information included in the storage instruction in the memory in association with the first user information included in the storage instruction. A first token receiving unit receives a first token from a server on the Internet when first user authentication for the first user corresponding to the first user information is successful, wherein the first token is generated by the server in response to the success of the first user authentication and stored on the server in association with the first user information. An information receiving unit transmits a first information request to the server, which includes the first token received from the server, and receives from the server the first user information stored in the server in association with the first token as a response to the first information request. A job execution unit executes the job according to the job information stored in the memory, due to the first user information received from the server matching the first user information stored in the memory in association with the job information. A communication system equipped with these features. (Item 10) The second communication device further includes, The system includes an establishment unit that establishes a login session with the server using the first user information, The communication system described in item 9, wherein the memory instruction includes the first user information used in the login session. (Item 11) The memory stores a second token that is different from the first token. The first communication device further includes, The system includes a second request transmission unit that, upon receiving the storage instruction from the second communication device, transmits a second information request to the server, which includes the second token stored in the memory. The memory control unit, due to the fact that the first user information is stored in the server in association with the second token, receives the first user information from the server as a response to the second information request, and stores the job information in the memory in association with the first user information. The communication system according to item 9 or 10, wherein if the first user information is not received from the server because the first user information is not stored in the server in association with the second token, the job information is not stored in the memory. (Item 12) The first communication device further includes, The communication system according to item 11, further comprising a notification transmission unit that transmits a predetermined notification to the second communication device when the first user information is not received from the server because the first user information is not stored in the server in association with the second token. (Item 13) A computer program for a first communication device, The first communication device is, Computers and, A memory that stores job information for causing the first communication device to execute a job, associated with first user information corresponding to a first user, Equipped with, The aforementioned computer program comprises the following components of the computer, namely: A first token receiving unit receives a first token from a server on the Internet when first user authentication for the first user corresponding to the first user information is successful, wherein the first token is generated by the server in response to the success of the first user authentication and stored on the server in association with the first user information. An information receiving unit transmits a first information request to the server, which includes the first token received from the server, and receives from the server the first user information stored in the server in association with the first token as a response to the first information request. A job execution unit executes the job according to the job information stored in the memory, due to the first user information received from the server matching the first user information stored in the memory in association with the job information. A computer program that functions as such. [Explanation of Symbols]

[0091] 2: Communication system, 4: LAN, 6: Internet, 10: MFP, 12: Display unit, 14: Operation unit, 16: LAN interface, 18: Print execution unit, 20: Scan execution unit, 30: Control unit, 32: CPU, 34: Memory, 40: Program, 42: Login information, 100: Administrator terminal, 130: Control unit, 132: CPU, 134: Memory, 140: OS program, 142: Application, 200: User terminal, 212: Display unit, 214: Operation unit, 216: LAN interface, 230: Control unit, 300: Server, 310: Account table, 320: Token table, A1, A2, A4, A5: Icons, A3: Input field, AT1, AT2: Access token, RT1: Refresh token, PJ1: Print job information, SC1: Settings screen, SC2: Code screen, SC3: Input screen, SC4: Account screen

Claims

1. A first communication device, A memory that stores job information for causing the first communication device to execute a job, associated with first user information corresponding to a first user, A first token receiving unit receives a first token from a server on the internet when first user authentication for the first user corresponding to the first user information is successful, wherein the first token is generated by the server in response to the success of the first user authentication and stored in the server in association with the first user information. An information receiving unit transmits a first information request, including the first token received from the server, to the server, and receives from the server the first user information stored in the server in association with the first token as a response to the first information request. A job execution unit executes the job according to the job information stored in the memory, due to the first user information received from the server matching the first user information stored in the memory in association with the job information. A first communication device comprising the following:

2. The server stores an organization identifier that identifies the organization to which the first user and the second user, which corresponds to second user information different from the first user information, belong. The first communication device further includes, A second token receiving unit receives a second token from the server, which is different from the first token, if the server successfully performs a second user authentication for the second user corresponding to the second user information before receiving the first token from the server, wherein the second token is generated by the server in response to the success of the second user authentication and stored in the server in association with the second user information. A first request transmission unit that, upon receiving the second token from the server, sends an identifier request to the server requesting the organization identifier, wherein the identifier request includes the second token, An identifier receiving unit receives the organization identifier stored in the server in association with the second token included in the identifier request from the server, A start instruction sending unit that sends a start instruction to the server to initiate the first user authentication, wherein the start instruction includes the organization identifier received from the server, The first communication device according to claim 1, comprising:

3. The first communication device further includes, A code receiving unit that sends a code request to the server requesting a user code and receives the user code from the server, A code output unit that outputs the user code received from the server, Equipped with, The user code output from the first communication device is acquired by a second communication device different from the first communication device. The acquired user code, along with a first user identifier that identifies the first user, is transmitted to the server by the second communication device. The first user authentication described above is The server authenticates the user code received from the second communication device, The server authenticates the first user identifier received from the second communication device, The first communication device according to claim 1 or 2, including the following:

4. The code receiving unit further receives a device code from the server that is different from the user code. The first communication device further includes, The system includes a polling start unit that starts polling a signal including the device code in response to receiving the device code from the server, The first communication device according to claim 3, wherein the first token receiving unit receives the first token stored in the server in association with the device code included in the signal, when the signal is received by the server after the first user authentication is successful, as a response to the signal.

5. The first communication device according to claim 1 or 2, wherein the first token has an expiration date.

6. The first communication device according to claim 1 or 2, wherein the job is a print job.

7. The memory stores the job information in association with the first user information. The first communication device further includes, Display unit and A display control unit that, upon receiving the first user information from the server, causes the display unit to display a list of jobs indicated by the job information stored in the memory in association with the first user information, Equipped with, The first communication device according to claim 1 or 2, wherein the job execution unit executes the job according to the job information selected by the first user in the list.

8. The memory stores two or more pieces of the job information in association with the first user information. The first communication device according to claim 1 or 2, wherein the job execution unit executes all jobs according to two or more job information stored in the memory.

9. It is a communication system, The first communication device and A second communication device capable of communicating with the first communication device, Equipped with, The second communication device is A storage instruction transmission unit transmits a storage instruction to the first communication device that instructs the first communication device to store job information for executing a job, wherein the storage instruction includes the job information and first user information corresponding to a first user, the storage instruction transmission unit comprises The first communication device is Memory and A storage control unit, upon receiving the storage instruction from the second communication device, stores the job information included in the storage instruction in the memory in association with the first user information included in the storage instruction, A first token receiving unit receives a first token from a server on the internet when first user authentication for the first user corresponding to the first user information is successful, wherein the first token is generated by the server in response to the success of the first user authentication and stored in the server in association with the first user information. An information receiving unit transmits a first information request, including the first token received from the server, to the server, and receives from the server the first user information stored in the server in association with the first token as a response to the first information request. A job execution unit executes the job according to the job information stored in the memory, due to the first user information received from the server matching the first user information stored in the memory in association with the job information. A communication system equipped with these features.

10. The second communication device further includes: The system includes an establishment unit that establishes a login session with the server using the first user information, The communication system according to claim 9, wherein the memory instruction includes the first user information used in the login session.

11. The memory stores a second token that is different from the first token. The first communication device further includes, The system includes a second request transmission unit that, upon receiving the storage instruction from the second communication device, transmits a second information request, including the second token stored in the memory, to the server. The memory control unit, due to the fact that the first user information is stored in the server in association with the second token, receives the first user information from the server as a response to the second information request, and stores the job information in the memory in association with the first user information. The communication system according to claim 9 or 10, wherein if the first user information is not received from the server because the first user information is not stored in the server in association with the second token, the job information is not stored in the memory.

12. The first communication device further includes, The communication system according to claim 11, further comprising a notification transmission unit that transmits a predetermined notification to the second communication device when the first user information is not received from the server because the first user information is not stored in the server in association with the second token.

13. A computer program for a first communication device, The first communication device is Computers and, A memory that stores job information for causing the first communication device to execute a job, associated with first user information corresponding to a first user, Equipped with, The aforementioned computer program comprises the following components of the computer, namely: A first token receiving unit receives a first token from a server on the internet when first user authentication for the first user corresponding to the first user information is successful, wherein the first token is generated by the server in response to the success of the first user authentication and stored in the server in association with the first user information. An information receiving unit transmits a first information request, including the first token received from the server, to the server, and receives from the server the first user information stored in the server in association with the first token as a response to the first information request. A job execution unit executes the job according to the job information stored in the memory, due to the first user information received from the server matching the first user information stored in the memory in association with the job information. A computer program that functions as such.

Images