Communication device, and computer program for communication device

Abstract

This provides technology for managing applications for the use of communication devices on a server. [Solution] The communication device includes a memory that stores a first token used to access a server on the Internet, an inquiry unit that, when the state of the communication device is in a first state in which use of the communication device is not permitted, receives application information from a user requesting use of the communication device, executes a query to the server using the application information and the first token, and a change unit that, when the server responds to the query using the application information and the first token with a predetermined response indicating that the application information is registered on the server, changes the state of the communication device from the first state to a second state in which use of the communication device is permitted.

Description

TECHNICAL FIELD

[0001] The present specification relates to a communication device.

BACKGROUND ART

[0002] Patent Document 1 discloses a multi-function peripheral. When the multi-function peripheral reads card identification information from a card, it executes user authentication. If the user authentication is successful, the multi-function peripheral displays personal information of the card owner.

PRIOR ART DOCUMENTS

PATENT DOCUMENTS

[0003]

PATENT DOCUMENT 1

SUMMARY OF THE INVENTION

PROBLEMS TO BE SOLVED BY THE INVENTION

[0004] The present specification provides a technique for managing an application for use of a communication device with a server.

MEANS FOR SOLVING THE PROBLEMS

[0005] A communication device disclosed in the present specification includes: a memory storing a first token that is used for accessing a server on the Internet; an inquiry unit that, in a situation where the state of the communication device is a first state in which use of the communication device is not permitted, when the communication device receives application information for applying for use of the communication device from a user, executes an inquiry to the server using the application information and the first token; and a change unit that, when a predetermined response indicating that the application information is registered in the server is received from the server in response to the inquiry to the server using the application information and the first token, changes the state of the communication device from the first state to a second state in which use of the communication device is permitted.

[0006] According to the above configuration, the first token can be used to request the server to use the communication device.

[0007] The computer program for realizing the above-mentioned communication device, and the computer-readable storage medium for storing the computer program, are both novel and useful. The control method for the above-mentioned communication device is also novel and useful. [Brief explanation of the drawing]

[0008] [Figure 1] Figure 1 is a block diagram of the communication system. [Figure 2] Figure 2 is a sequence diagram of the process for issuing tokens. [Figure 3] Figure 3 is a continuation of Figure 2. [Figure 4] Figure 4 is a sequence diagram of the registration process. [Figure 5] Figure 5 is a continuation of Figure 4, showing one possible configuration. [Figure 6] Figure 6 is a continuation of Figure 4. [Modes for carrying out the invention]

[0009] (Configuration of communication system 2; Figure 1) Communication system 2 comprises an MFP 10, an administrator terminal 100, a user terminal 200, and a server 300. The MFP 10 is a device with multiple functions, including printing and scanning functions. "MFP" is an abbreviation for Multifunction Peripheral. The administrator terminal 100 and user terminal 200 are laptop PCs, desktop PCs, tablet terminals, smartphones, etc.

[0010] The MFP10, administrator terminal 100, and user terminal 200 are used within a specific organization. This specific organization could be, for example, a corporation, an office, or a department within a company. The administrator terminal 100 is a terminal device used by administrators belonging to this specific organization. The user terminal 200 is a terminal device used by users belonging to this specific organization and managed by the administrator. Here, within this specific organization, there may be one or more users per administrator. Therefore, a specific organization may have multiple user terminals 200.

[0011] The MFP10, administrator terminal 100, and user terminal 200 are connected to LAN4. "LAN" stands for Local Area Network. LAN4 is either wireless or wired. The administrator terminal 100 and user terminal 200 can communicate with the MFP10 via LAN4.

[0012] LAN4 is connected to Internet 6. Server 300 is connected to Internet 6. A device connected to LAN4, such as MFP10, can communicate with Server 300 via Internet 6 and LAN4.

[0013] (Configuration of MFP10; Figure 2) The MFP10 comprises a display unit 12, an operation unit 14, a LAN interface 16, a print execution unit 18, a scan execution unit 20, a reading unit 22, and a control unit 30. Hereafter, "interface" may be written as "I / F".

[0014] The display unit 12 is a display or panel for displaying various information. The panel may or may not be a touch panel. The panel may be, for example, a liquid crystal panel or an organic EL panel. The operation unit 14 is a user interface that allows the user to input various information to the MFP 10. The operation unit 14 may include, for example, a touch panel for displaying software keys, i.e., operation objects, hardware keys, or both. Hardware keys may be, for example, buttons or switches.

[0015] The LAN I / F 16 is an interface for executing communication via the LAN 4. The LAN I / F 16 is connected to the LAN 4. The print execution unit 18 is hardware that executes printing on a print medium in accordance with print data. The print execution unit 18 is realized by, for example, an inkjet system or an electrophotographic system. The scan execution unit 20 is hardware that executes reading of a document. The scan execution unit 20 includes a scanner engine having an image sensor of a Charge-Coupled Device (CCD) system, a Contact Image Sensor (CIS) system, or the like.

[0016] The reading unit 22 is a device for reading information from the IC card 400. The reading unit 22 includes an antenna for communicating with the IC card 400. The reading unit 22 is a so-called card reader. Card information 410 is stored in the IC card 400. The card information 410 is, for example, an identifier assigned to the IC card 400.

[0017] The control unit 30 includes a CPU 32 and a memory 34. The memory 34 includes a main storage device and an auxiliary storage device. As an example, the main storage device includes a RAM and a cache memory. As an example, the auxiliary storage device may be a ROM, a flash memory, a Solid State Drive (SSD), a Hard Disk Drive (HDD), or a combination thereof. The CPU 32 implements various types of processing in accordance with a program 40 loaded from the auxiliary storage device to the main storage device.

[0018] The MFP 10 has a server function that provides a setting screen for changing settings of the MFP 10. The memory 34 stores login information 42 for logging in to the server function of the MFP 10. The login information 42 is, for example, a user name and a password.

[0019] (Configuration of Server 300; Figure 1) The server 300 provides a service for managing accounts of users belonging to an organization. The service is, for example, Microsoft Entra ID (registered trademark). The server 300 stores an account table 310 and a token table 320.

[0020] The account table 310 manages information related to users belonging to an organization. The account table 310 stores a tenant ID, a user ID, and an email address in association with one another. The tenant ID is an identifier for identifying an organization. The user ID is an identifier for identifying a user. The user ID is a so-called account name. Although not illustrated, a password is stored in association with each user ID. For example, as shown in Figure 1, four user IDs "ad01", "u01", "u02", and "u03" are stored in association with one tenant ID "t01". Here, the user ID "ad01" identifies an administrator belonging to a specific organization identified by the tenant ID "t01". Each of the user IDs "u01", "u02", and "u03" identifies a user other than the administrator who belongs to the specific organization identified by the tenant ID "t01". Hereinafter, the user ID that identifies the administrator is referred to as the administrator ID. Further, the user ID that identifies a user other than the administrator is referred to as an individual user ID.

[0021] In this embodiment, the administrator ID "ad01" is stored in association with administrative permission information indicating the administrator's authority. The administrative permission information indicates the authority to access information stored in association with the tenant ID "t01". This information is, for example, an email address stored in association with the tenant ID "t01". In addition, individual user IDs are stored in association with individual permission information indicating the authority of the user identified by the individual user ID. The individual permission information indicates the authority to access information stored in association with the corresponding individual user ID. On the other hand, the individual permission information does not indicate the authority to access information stored in association with other user IDs. In a modified example, the individual permission information may indicate the authority to access multiple email addresses. For example, the individual permission information corresponding to individual user ID "u01" may indicate the authority to access not only the email address stored in association with individual user ID "u01" but also an email address stored in association with another user ID "u02".

[0022] The token table 320 manages tokens. Tokens are authentication information issued by the server 300. The token table 320 stores the user ID, device code, refresh token, access token, and user code in association with each other. The device code is a code assigned to a device such as the MFP10. The user code is a code assigned to a user. The access token is a token with a predetermined expiration date. The refresh token is a token used to renew the access token. In the modified example, the access token does not need to have an expiration date.

[0023] (Process for issuing tokens; Figures 4 and 5) The process of issuing tokens will be explained with reference to Figures 4 and 5. In the following explanation, the processes performed by MFP10 are implemented by the CPU 32 of MPF10, which operates according to program 40. Communication between devices is performed via LAN4, the Internet 6, and LANI / F16. In the following explanation, when communication between devices is described, descriptions of LAN4, the Internet 6, and LANI / F16 will be omitted.

[0024] In T10, the administrator terminal 100 uses login information 42 to log in to the server function of MFP10. This establishes a login session between the administrator terminal 100 and MFP10. The following processes utilize this login session for communication between the administrator terminal 100 and MFP10.

[0025] In T12, the administrator terminal 100 sends a configuration screen request to the MFP 10 requesting configuration screen information. The configuration screen information corresponds to the configuration screen SC1 used to change the settings of the MFP 10.

[0026] In T14, the administrator terminal 100 receives configuration screen information from the MFP 10 as a response to the configuration screen request in T12. In T16, the administrator terminal 100 displays configuration screen SC1. Configuration screen SC1 includes multiple icons corresponding to various settings of the MFP 10. Configuration screen SC1 includes icon A1, which accepts instructions from the user to start communication with server 300.

[0027] When the administrator terminal 100 detects the selection of icon A1 in the settings screen SC1 at T20, it sends a linkage request to the MFP10 at T22. The linkage request is a signal requesting the start of linkage with the server 300.

[0028] When MFP10 receives a communication request from the administrator terminal 100 at T22, it sends a code request to the server 300 at T26. The code request is a signal requesting a device code and a user code.

[0029] When server 300 receives a code request from MFP10 at T26, it generates the device code "dv01" at T28. Furthermore, server 300 generates the user code "xxxx" at T30. Server 300 associates the user code "xxxx" with the device code "dv01" and stores it in the token table 320.

[0030] In T32, the server 300 sends a response to the code request to the MFP 10. This response includes the device code "dv01" generated in T28, the user code "xxxx" generated in T30, and the verification_URL. The verification_URL is a URL for accessing the input screen information corresponding to the input screen SC3 for entering the user code. Figure 5 shows an example of the input screen SC3.

[0031] When MFP10 receives a response from server 300 at T32, it begins repeatedly sending a polling signal to server 300 at T34. The polling signal is a signal to confirm that a token has been issued. The polling signal includes the device code "dv01" received at T32.

[0032] In T36, MFP10 sends code screen information corresponding to the code screen SC2 that displays the user code to the administrator terminal 100. The code screen information includes the user code "xxxx" and the verification_URL.

[0033] When the administrator terminal 100 receives code screen information from the MFP 10 at T36, it displays code screen SC2 at T40. Code screen SC2 includes a string representing the user code "xxxx" and icon A2. Icon A2 is an icon that accepts instructions from the user to sign in to server 300.

[0034] When the administrator terminal 100 detects the selection of icon A2 in the code screen SC2 at T42, it sends an input screen request to the server 300 at T44. The input screen request is a signal requesting input screen information and includes a verification_URL.

[0035] In Figure 5, at T50, the administrator terminal 100 receives input screen information as a response to the input screen request at T42. At T52, the administrator terminal 100 displays input screen SC3. Input screen SC3 includes an input field A3 for entering a user code.

[0036] In T52, the administrator terminal 100 detects the input of user code "xxxx" into input field A3. In T54, the administrator terminal 100 sends the user code "xxxx" entered in input field A3 to the server 300.

[0037] When server 300 receives user code "xxxx" from administrator terminal 100 at T56, it authenticates the user code "xxxx" received from administrator terminal 100. In this case, the user code "xxxx" received from administrator terminal 100 matches the user code "xxxx" stored in token table 320. Therefore, authentication of user code "xxxx" is successful at T58.

[0038] When server 300 successfully authenticates user code "xxxx", it sends account screen information to administrator terminal 100 via T58. The account screen information corresponds to account screen SC4, which is used to select the account name for which a token should be issued.

[0039] When administrator terminal 100 receives account screen information from server 300 at T60, it displays account screen SC4 at T62. Account screen SC4 includes icon A4 for selecting the target account name from the account names stored in administrator terminal 100. In this case, administrator ID "ad01" is stored as the account name in administrator terminal 100. Therefore, administrator ID "ad01" is displayed on icon A4. If multiple account names are stored in administrator terminal 100, multiple icons A4 will be displayed on account screen SC4. Account screen SC4 may also include an icon for creating a new account, and input fields for entering a new account name and password. In this case, the administrator selects icon A4 on account screen SC4.

[0040] When administrator terminal 100 detects the selection of icon A4 in the account screen SC4 at T64, it proceeds to T66. At T66, administrator terminal 100 sends the administrator ID "ad01" and password corresponding to icon A4 to server 300.

[0041] When server 300 receives the administrator ID "ad01" and password from administrator terminal 100 at T66, it authenticates the administrator ID "ad01" and password. In this case, the administrator ID "ad01" and password are stored in account table 310. Therefore, authentication of administrator ID "ad01" and password is successful at T68. The authenticated administrator ID "ad01" is stored in token table 320, associated with user code "xxxx" and device code "dv01".

[0042] If the server 300 successfully authenticates the administrator ID "ad01" and password in T68, it proceeds to T70. In T70, the server 300 sends a success notification to the administrator terminal 100 indicating that the authentication was successful. Furthermore, in T72, the server 300 generates a refresh token RT1. In the following T74, the server 300 generates an access token AT1 based on the refresh token RT1. The server 300 then stores tokens RT1 and AT1 in the token table 320, associating them with the administrator ID "ad01" and device code "dv01".

[0043] Between T36 in Figure 4 and T74 in Figure 5, the MFP10 repeatedly sends a polling signal containing the device code "dv01" to the server 300. At T76, the server 300 receives the polling signal from the MFP10 after tokens RT1 and AT1 have been generated. At T78, the server 300 sends tokens RT1 and AT1, which are stored in association with the device code "dv01" included in the polling signal, to the MFP10.

[0044] When MFP10 receives tokens RT1 and AT1 from server 300 at T78, it stores tokens RT1 and AT1 in memory 34 at T80.

[0045] In the subsequent T82, MFP10 sends a tenant ID request to server 300 requesting the tenant ID. The tenant ID request includes access token AT1.

[0046] When server 300 receives a tenant ID request from administrator terminal 100 in T82, it proceeds to T84. In T84, server 300 identifies the management identifier "ad01" stored in the token table 320 in association with the access token AT1 in the tenant ID request. Then, server 300 sends the tenant ID "t01" stored in the account table 310 in association with the identified management identifier "ad01" to administrator terminal 100.

[0047] When MFP10 receives tenant ID "t01" from server 300 at T84, it stores tenant ID "t01" in memory 34 at T86.

[0048] (Registration and authentication processes; Figures 4 and 5) Figures 4 and 5 are sequence diagrams showing the registration process for registering card information 410 with the server 300 and the application process for requesting the use of the MFP 10. The processes in Figures 4 and 5 can be executed after the processes in Figures 2 and 3.

[0049] The user inputs a registration command to the operation panel 14 of the MFP10 on the T200. The registration command is an instruction to start the registration of card information 410.

[0050] When MFP10 detects the input of a registration instruction at T200, it proceeds to T202. At T202, MFP10 sends a code request to server 300 that includes the tenant ID "t01" stored in memory 34. The code request at T202 is the same as the code request at T26 in Figure 2, except that it includes the tenant ID "t01".

[0051] The processing of T204 and T206 is the same as that of T28 and T30 in Figure 2, except that the device code "dv99" and user code "zzzz" are generated. The processing of T208 and T210 is the same as that of T32 and T34 in Figure 2, except that the device code "dv99" and user code "zzzz" are used.

[0052] In the subsequent T212, the MFP10 displays a two-dimensional code on the display unit 12. This two-dimensional code is an image that encodes the verification_URL and user code "zzzz" received from the server 300.

[0053] At T214, the user operates the user terminal 200 to capture an image of the QR code displayed at T212. As a result, at T216, the user terminal 200 decodes the QR code and obtains the verification_URL and the user code "zzzz".

[0054] In T218, user terminal 200 uses verification_URL to send the user code "zzzz" to server 300.

[0055] When server 300 receives the user code "zzzz" from user terminal 200 at T218, it authenticates the user code "zzzz" received from user terminal 200. In this case, the user code "zzzz" received from user terminal 200 matches the user code "zzzz" stored in token table 320. Therefore, authentication of user code "zzzz" is successful at T220.

[0056] When server 300 successfully authenticates user code "zzzz", T222 sends account screen information to user terminal 200.

[0057] When user terminal 200 receives account screen information from server 300 at T222, it displays account screen SC4 at T224. In this case, the individual user ID "u01" is stored as the account name in user terminal 200. Account screen SC4 includes icon A5 displaying the individual user ID "u01".

[0058] When user terminal 200 detects the selection of icon A5 in the account screen SC4 at T226, it proceeds to T228. At T228, user terminal 200 sends the individual user ID "u01" and password corresponding to icon A5 to server 300.

[0059] When server 300 receives the individual user ID "u01" and password from user terminal 200 at T228, it authenticates the individual user ID "u01" and password. In this case, authentication of the individual user ID "u01" and password is successful at T230. The authenticated individual user ID "u01" is stored in token table 320 in association with device code "dv99". Subsequently, server 300 generates access token AT2 and stores access token AT2 in token table 320 in association with device code "dv99".

[0060] Access token AT2 has the authority to access information stored in association with the individual user ID "u01". However, access token AT2 does not have the authority to access information other than that stored in association with the individual user ID "u01". On the other hand, access token AT1, generated in T74 in Figure 3, has the authority to access information stored in association with the tenant ID "t01". Access token AT1 has the authority to access not only the information associated with the individual user ID "u01", but also information associated with other individual user IDs. This is because access token AT1 is associated with administrative authority information that has broad authority.

[0061] In T234, the server 300 receives a polling signal from the MFP 10 after the access token AT2 has been generated. In T236, the server 300 sends the access token AT2, which is stored in association with the device code "dv99" included in the polling signal, to the MFP 10.

[0062] In Figure 5, at T240, server 300 sends a user management request requesting user management information. User management information is information that server 300 uses to manage users and is issued by server 300. The user management request includes the access token AT2.

[0063] When server 300 receives a user management request at T240, it proceeds to T242. At T242, server 300 generates user management information UM1. Server 300 stores user management information UM1 in association with access token AT2 and individual user ID "u01". At the subsequent T244, server 300 sends user management information UM1 to MFP10.

[0064] When MFP10 receives user management information UM1 from server 300 at T244, it proceeds to T246. At T246, MFP10 displays a guidance screen on display unit 12. The guidance screen instructs the user to bring the IC card 400 close to the reader unit 22. The user looks at the guidance screen and brings the IC card 400 close to the reader unit 22.

[0065] At T250, the MFP10 obtains card information 410 from the IC card 400 via the reader 22. At T252, the MFP10 stores the user management information UM1 received at T242 in memory 34. At T254, the MFP10 sends a registration request to the server 300 requesting registration of the card information 410. The registration request includes the user management information UM1 and the card information 410.

[0066] When server 300 receives a registration instruction from MFP10 in T254, it proceeds to T256. In T256, server 300 stores the card information 410 included in the registration instruction, associating it with the user management information UM1 included in the registration instruction. As a result, the card information 410 is registered in association with the individual user ID "u01".

[0067] In this embodiment, the user applies to use the MFP10 using the IC card 400. Upon successful application using the IC card 400, the user is granted permission to use the MFP10. If the use of the MFP10 is not permitted, the MFP10 displays an application screen on the display unit 12. The application screen is the screen for applying using the IC card 400. While the application screen is displayed, the user cannot use the MFP10.

[0068] With the application screen displayed, the user brings the IC card 400 close to the reader unit 22 of the MFP10. In the T260, the MFP10 obtains card information 410 from the IC card 400 via the reader unit 22.

[0069] In T264, MFP10 sends a query signal to server 300. The query signal is a signal that requests information from server 300 to authorize the user to use MFP10. The query signal includes card information 410 obtained in T260 and access token AT1.

[0070] When server 300 receives a query signal from MFP10 in T264, it proceeds to T266. In T266, server 300 uses access token AT1 to identify user management information UM1, which is stored in association with card information 410 in the query signal. As mentioned above, access token AT1 has the authority to access the information stored in association with the individual user ID "u01".

[0071] In T268, server 300 sends user management information UM1, identified in T266, to MFP10.

[0072] When MFP10 receives user management information UM1 from server 300 at T268, it proceeds to T270. At T270, MFP10 authenticates the user management information UM1 received at T268. In this case, at T252, user management information UM1 is stored in memory 34. Since the user management information UM1 received at T268 matches the user management information UM1 in memory 34, authentication of the user management information UM1 received at T268 is successful. If authentication at T270 is successful, MFP10 proceeds to T272. If authentication at T270 fails, the process at T272 is not executed, and the process shown in Figure 5 ends.

[0073] In the T272, the MFP10 displays an operation screen on the display unit 12 instead of an application screen. The operation screen is the screen for using the MFP10. For example, the operation screen includes icons for using the print function and the scan function. In other words, the display of the operation screen authorizes the use of the MFP10.

[0074] (Effects of this embodiment) According to this embodiment, a request to use the MFP10 can be made to the server 300 by an inquiry signal including an access token AT1. Furthermore, the inquiry signal includes card information 410 read from the IC card 400. By registering the card information 410 with the server 300, a request to use the MFP10 can be made using the IC card 400.

[0075] Furthermore, it is conceivable that the access token AT1 may have expired at the time the query signal is received in T264. In this case, the server 300 uses the refresh token RT1 to update the access token AT1. This allows the processing from T268 onwards to be executed even if the access token AT1 has expired. In the modified example, the access token AT1 may be updated at a time other than when the query signal is received in T264.

[0076] Furthermore, the registration process is triggered by a code request containing the tenant ID "t01". The tenant ID "t01" is obtained using the access token AT1 corresponding to the administrator ID "ad01" (T84 in Figure 2). In other words, the registration process in Figures 4 and 5 is executed on the condition that both authentication using the administrator ID and authentication using the individual user ID are performed.

[0077] (Correspondence) MFP10, reader 22, and memory 34 are examples of "communication device," "reader," and "memory," respectively. Server 300, access token AT1, and access token AT2 are examples of "server," "first token," and "second token," respectively. Card information 410 is an example of "application information." The state where the application screen is displayed and the state where the operation screen is displayed are examples of "first state" and "second state," respectively. User management information UM1 in T268 of Figure 5 is an example of "prescribed response." The processes in Figures 2 and 3, and administrator ID "ad01," are examples of "first user authentication" and "first user identifier," respectively. The processes in Figures T204 to T236, and individual user ID "u01," are examples of "second user authentication" and "second user identifier," respectively. The code request in Figure 4, T202, and tenant ID "t01," are examples of "start instruction" and "organization identifier," respectively. T256 in Figure 5 is an example of the "registration process." User management information UM1 is an example of "specific information."

[0078] T264 and T272 in Figure 5 are examples of processes implemented by the "inquiry unit" and "modification unit," respectively.

[0079] (Second example) In this embodiment, a PIN code arbitrarily set by the user is used instead of the IC card 400. This embodiment has the same configuration as the first embodiment, except that the contents of the registration process and application process are different. In this embodiment, the MFP 10 does not need to be equipped with a reading unit 22.

[0080] (Registration and application processing; Figure 6) Figure 6 is a continuation of Figure 4. T340 to T344 are the same as T240 to T244 in Figure 5. At T346, the MFP10 displays a guidance screen on the display unit 12 that guides the user to enter a PIN code. This guidance screen includes an input field for entering the PIN code. In this case, the user manually enters the PIN code PC1 into the input field on the guidance screen.

[0081] When MFP10 detects the input of PIN code PC1 at T350, it proceeds to T352. T352 is the same process as T252 in Figure 5. T354 is the same process as T254 in Figure 5, except that the registration instruction includes PIN code PC1 instead of card information 410. T356 is the same process as T256 in Figure 5, except that PIN code PC1 is registered instead of card information 410.

[0082] In this embodiment, the user applies to use the MFP10 using the PIN code PC1. The user enters the PIN code PC1 and individual user information "u01" according to the application screen. When the MFP10 detects the input of the PIN code PC1 and individual user information "u01" at T360, it proceeds to T364.

[0083] In T364, MFP10 sends a query signal to server 300 that includes the PIN code PC1, individual user information "u01", and access token AT1.

[0084] When server 300 receives a query signal from MFP10 in T364, it proceeds to T365. In T365, server 300 uses access token AT1 to identify the list of user IDs stored in association with tenant ID "t01". Server 300 then determines whether the individual user ID "u01" included in the query signal exists in the identified list. If the individual user ID "u01" included in the query signal exists in the identified user IDs, authentication of the individual user ID "u01" in the query signal is successful.

[0085] In this case, authentication of the individual user ID "u01" in the query signal is successful, and server 300 proceeds to T366. If authentication of the individual user ID "u01" in the query signal fails, the processes after T366 are not executed, and the process shown in Figure 6 ends.

[0086] In T366, the server 300 uses the access token AT1 to identify the user management information UM1 stored in association with the PIN code PC1 in the query signal. T368 to T372 are the same as T268 to T272 in Figure 5.

[0087] (Effects of this embodiment) In this embodiment, by registering the PIN code PC1 with the server 300, applications for using the MFP10 can be made using the PIN code PC1.

[0088] Furthermore, in this embodiment, in addition to the PIN code PC1, authentication is performed using the individual user ID "u01" (T365 in Figure 6). This makes the application for using MFP10 more secure.

[0089] (Correspondence) The PIN code PC1 and individual user ID "u01" are examples of "Application Information" and "User Identifier," respectively.

[0090] Although specific examples of the present invention have been described in detail above, these are merely illustrative and do not limit the scope of the claims. The technology described in the claims includes various modifications and changes to the specific examples illustrated above. Variations of the above embodiments are listed below.

[0091] (Modification 1) In the first embodiment, the query signal may include card information 410 and user management information UM1. The server 300 may perform authentication of the card information 410 and user management information UM1. The server 300 may then send a response to the MFP 10 indicating the result of the authentication of the card information 410 and user management information UM1. In this modification, the response indicating the result of the authentication of the card information 410 and user management information UM1 is an example of a "predetermined response".

[0092] (Modification 2) In the second embodiment, the query signal does not need to include the individual user ID "u01", and the T365 processing does not need to be executed. In this modification, the "query unit" does not need to use the "user identifier".

[0093] (Modification 3) In the second embodiment, the query signal does not have to include the individual user ID "u01". In this modification, the MFP10 may receive from the server 300 a list of user IDs stored in association with the tenant ID "t01". The MFP10 may then use the list received from the server 300 to perform authentication of the individual user ID "u01" entered in T360.

[0094] (Modification 4) In T212 of Figure 4, the user code "zzzz" may be displayed, or the user code "zzzz" may be transmitted using wireless communication such as NFC. In this modification, the display or transmission of the user code "zzzz" is an example of "outputting the user code".

[0095] (Variation 5) The "communication device" is not limited to the MFP10, but may also be a scanner, printer, other terminal device, sewing machine, etc.

[0096] (Modification 6) In the above embodiment, the CPU 32 executes the program 40 to realize each of the processes shown in Figures 2 to 6. Alternatively, any of these processes may be realized by hardware such as a logic circuit.

[0097] Furthermore, the technical elements described herein or in the drawings demonstrate technical usefulness individually or in various combinations, and are not limited to the combinations described in the claims at the time of filing. In addition, the technologies illustrated herein or in the drawings achieve multiple objectives simultaneously, and achieving even one of these objectives constitutes technical usefulness in itself.

[0098] Even if, in the claims of this patent application, each claim depends on only some of the claims, it is not limited to the claim being dependent only on those specific claims. To the extent that it is not technically contradictory, each claim may be dependent on other claims that were not dependent at the time of application. That is, the technologies of each claim can be combined in various ways as follows: The following are the features of the technology disclosed herein. (Item 1) A communication device, A memory that stores a first token used to access servers on the internet, In a situation where the state of the communication device is in a first state where use of the communication device is not permitted, if the communication device receives application information from a user requesting use of the communication device, the inquiry unit executes a query to the server using the application information and the first token. A modification unit that, in response to the query to the server using the application information and the first token, receives a predetermined response from the server indicating that the application information is registered on the server, changes the state of the communication device from the first state to a second state that permits the use of the communication device, A communication device equipped with the following features. (Item 2) The aforementioned communication device further, It is equipped with a reader unit that reads the information stored in the tag, The communication device is the communication device described in item 1, wherein the reading unit reads the application information from the tag and receives the application information from the user. (Item 3) The application information is manually entered into the communication device by the user, as described in item 1. (Item 4) The communication device according to any one of items 1 to 3, wherein the inquiry unit executes the inquiry to the server using the application information and the first token, as well as a user identifier that identifies the user. (Item 5) The aforementioned communication device further, A communication device according to any one of items 1 to 4, comprising a first token receiving unit that receives the first token from the server when the first user authentication is successful at the server, wherein the first token is generated by the server in response to the success of the first user authentication and stored in the server in association with the first user identifier used for the first user authentication. (Item 6) The server stores one or more user identifiers associated with the first user identifier. The aforementioned communication device further, A second token receiving unit receives a second token from the server, which is different from the first token, when the server successfully performs a second user authentication after the first token has been received, wherein the second user authentication uses a second user identifier from the one or more user identifiers, and the second token is generated by the server in response to the success of the second user authentication and stored in the server in association with the second user identifier. A processing execution unit that uses the second token received from the server to perform a registration process to register the application information with the server, A communication device as described in item 5, comprising the features described in item 5. (Item 7) The aforementioned registration process is: Sending an information request including the second token received from the server to the server, The server receives specific information stored in the server in association with the second user identifier as a response to the information request, Sending a registration instruction to the server, which is an instruction to register the application information in association with the specified information; Communication devices as described in item 6, including those listed in item 6. (Item 8) The aforementioned predetermined response is a communication device as described in item 7, including the aforementioned specific information. (Item 9) The server stores a user identified by the first user identifier, and an organization identifier that identifies the organization to which one or more users identified by the one or more user identifiers belong. The aforementioned communication device further, A first request transmission unit that, upon receiving the first token from the server, sends an identifier request to the server requesting the organization identifier, wherein the identifier request includes the first token, An identifier receiving unit receives from the server the organization identifier stored in association with the first token included in the identifier request, An instruction transmission unit that transmits a start instruction to the server instructing the start of the second user authentication, wherein the start instruction includes the organization identifier received from the server, A communication device comprising any one of items 6 to 8. (Item 10) The aforementioned first token is a communication device as described in any one of items 1 to 9, having an expiration date. (Item 11) The memory stores the first token, which is an access token, and a refresh token. The aforementioned communication device further, The communication device according to item 10, further comprising an update unit that updates the first token using the refresh token when the first token's expiration date has expired. (Item 12) The update unit updates the first token using the refresh token when the expiration date of the first token has expired at the time a query to the server using the first token is executed, as described in item 11. (Item 13) A computer program for a communication device, The aforementioned communication device is Computers and, A memory that stores a first token used to access servers on the internet, Equipped with, The aforementioned computer program comprises the following components of the computer, namely: In a situation where the state of the communication device is in a first state where use of the communication device is not permitted, if the communication device receives application information from a user requesting use of the communication device, the inquiry unit executes a query to the server using the application information and the first token. A modification unit that, in response to the query to the server using the application information and the first token, receives a predetermined response from the server indicating that the application information is registered on the server, changes the state of the communication device from the first state to a second state that permits the use of the communication device, A computer program that functions as such. [Explanation of Symbols]

[0099] 2: Communication system, 4: LAN, 6: Internet, 10: MFP, 12: Display unit, 14: Operation unit, 16: LAN I / F, 18: Print execution unit, 20: Scan execution unit, 22: Reading unit, 30: Control unit, 32: CPU, 34: Memory, 40: Program, 42: Login information, 100: Administrator terminal, 200: User terminal, 300: Server, 310: Account table, 320: Token table, 400: IC card, 410: Card information, A1, A2, A4, A5: Icon, A3: Input field, AT1, AT2: Access token, RT1: Refresh token, PC1: PIN code, SC1: Settings screen, SC2: Code screen, SC3: Input screen, SC4: Account screen, UM1: User management information

Claims

1. A communication device, A memory that stores a first token used to access a server on the internet, In a situation where the state of the communication device is in a first state where use of the communication device is not permitted, if the communication device receives application information from a user requesting use of the communication device, the inquiry unit executes a query to the server using the application information and the first token. A modification unit that, in response to the query to the server using the application information and the first token, receives a predetermined response from the server indicating that the application information is registered on the server, changes the state of the communication device from the first state to a second state that permits the use of the communication device, A communication device equipped with the following features.

2. The aforementioned communication device further, It is equipped with a reader unit that reads the information stored in the tag, The communication device according to claim 1, wherein the reading unit reads the application information from the tag and receives the application information from the user.

3. The communication device according to claim 1, wherein the application information is manually entered into the communication device by the user.

4. The communication device according to claim 1, wherein the inquiry unit executes the inquiry to the server using the application information and the first token, as well as a user identifier that identifies the user.

5. The aforementioned communication device further, A communication device according to any one of claims 1 to 4, comprising a first token receiving unit that receives a first token from the server when first user authentication is successful at the server, wherein the first token is generated by the server in response to the success of the first user authentication and stored in the server in association with a first user identifier used for the first user authentication.

6. The server stores one or more user identifiers associated with the first user identifier. The aforementioned communication device further, A second token receiving unit receives a second token from the server, which is different from the first token, when the second user authentication is successful in the server after the first token has been received, wherein the second user identifier from the one or more user identifiers is used for the second user authentication, and the second token is generated by the server in response to the success of the second user authentication and stored in the server in association with the second user identifier, A processing execution unit that uses the second token received from the server to perform a registration process to register the application information with the server, The communication device according to claim 5, comprising:

7. The aforementioned registration process is: Sending an information request including the second token received from the server to the server, The server receives specific information stored in the server in association with the second user identifier as a response to the information request, Sending a registration instruction to the server, which is an instruction to register the application information in association with the specified information; The communication device according to claim 6, including the following:

8. The communication device according to claim 7, wherein the predetermined response includes the specified information.

9. The server stores a user identified by the first user identifier, and an organization identifier that identifies the organization to which one or more users identified by the one or more user identifiers belong. The aforementioned communication device further, A first request transmission unit that, upon receiving the first token from the server, transmits an identifier request to the server requesting the organization identifier, wherein the identifier request includes the first token, An identifier receiving unit receives from the server the organization identifier stored in association with the first token included in the identifier request, An instruction transmission unit that transmits a start instruction to the server instructing the start of the second user authentication, wherein the start instruction includes the organization identifier received from the server, The communication device according to claim 6, comprising:

10. The communication device according to any one of claims 1 to 4, wherein the first token has an expiration date.

11. The memory stores the first token, which is an access token, and a refresh token. The aforementioned communication device further, The communication device according to claim 10, further comprising an update unit that updates the first token using the refresh token when the first token's expiration date has expired.

12. The communication device according to claim 11, wherein the update unit updates the first token using the refresh token if the expiration date of the first token has expired at the time a query to the server using the first token is executed.

13. A computer program for a communication device, The aforementioned communication device is Computers and, A memory that stores a first token used to access a server on the internet, Equipped with, The aforementioned computer program comprises the following components of the computer, namely: In a situation where the state of the communication device is in a first state where use of the communication device is not permitted, if the communication device receives application information from a user requesting use of the communication device, the inquiry unit executes a query to the server using the application information and the first token. A modification unit that, in response to the query to the server using the application information and the first token, receives a predetermined response from the server indicating that the application information is registered on the server, changes the state of the communication device from the first state to a second state that permits the use of the communication device, A computer program that functions as such.

Images