Data processing system, information processing device, control method, and program

Abstract

The system will allow users to register identification information necessary to identify the distance measurement target for distance measurement authentication using simple procedures and operations. [Solution] A data processing system having a portable communication device and an information processing device that can communicate with each other by wireless communication includes a first authentication means that performs authentication based on information different from distance information, a registration means that registers the identification information relating to the distance measurement target in an authentication server that manages identification information for identifying the distance measurement target when authentication by the first authentication means is performed, and a second authentication means that performs authentication based on distance information between the portable communication device and the information processing device obtained by distance measurement based on wireless communication using the registered identification information relating to the distance measurement target.

Description

Technical Field

[0001] The present invention relates to a data processing system, an information processing apparatus, a control method, and a program.

Background Art

[0002] There is known a data processing system that determines a state in which a user carries a portable information device (portable communication apparatus) such as a mobile terminal and approaches an information processing apparatus, so that the user is authenticated to receive services of the information processing apparatus, or the waiting time required for user authentication is reduced. As technologies capable of detecting position information, coordinate identification technologies such as GPS, and ranging and positioning technologies such as BLE and UWB are known. In such a data processing system, an authentication server is arranged to perform user authentication, so that information can be provided in response to a request for collating attribute information of a user to be authenticated from the information processing apparatus. Installation position information of the information processing apparatus is registered in advance, and the authentication server that has received coordinate information of a GPS function included in a terminal owned by a user notifies the information processing apparatus of an authentication result, whereby authentication can be performed.

[0003] In Patent Document 1, in an authentication procedure between an application installed on a mobile terminal side and an image forming apparatus, authentication can be performed by using position information as user information of the terminal, so that system login can be performed through simple and reliable user authentication. Patent Document 1 is one of application examples of a general "access control technology" that performs control according to positioning.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problem to be Solved by the Invention

[0005] Patent Document 1 states that location information, which is essential for access control technology, must be pre-configured on the authentication server. When using distance measurement and positioning technology for user authentication, given that the location information of the user's device is handled for authentication, it is conceivable that users would want to register information to identify the location target on the authentication server and manage it themselves from a privacy perspective. Generally, registering with an authentication server and managing that information requires specialized knowledge, complex operations, and security measures, so it is often configured and operated by system administrators. For users who want to introduce and utilize a new authentication function using distance measurement and positioning technology in addition to existing authentication methods, it is conceivable that they may not be able to perform individual settings themselves with simple operations. [Means for solving the problem]

[0006] The data processing system according to the present invention is a data processing system having a portable communication device and an information processing device that can communicate with each other by wireless communication, and is characterized by having a first authentication means that performs authentication based on information different from distance information, a registration means that registers the identification information relating to the distance measurement target in an authentication server that manages identification information for identifying the distance measurement target when authentication by the first authentication means is performed, and a second authentication means that performs authentication based on distance information between the portable communication device and the information processing device obtained by distance measurement based on wireless communication using the registered identification information relating to the distance measurement target. [Effects of the Invention]

[0007] According to the present invention, users can register identification information that identifies the distance measurement target necessary for distance measurement authentication using simple procedures and operations. [Brief explanation of the drawing]

[0008] [Figure 1] This figure shows an example of a data processing system configuration. [Figure 2] This diagram shows an example of a mobile device's hardware configuration. [Figure 3] This figure shows an example of the hardware configuration of an image forming apparatus. [Figure 4] This diagram illustrates the software configuration and data storage area of ​​a mobile device. [Figure 5] This diagram illustrates the software configuration and data area of ​​an image forming apparatus. [Figure 6] This diagram illustrates the software configuration and data area of ​​the authentication server. [Figure 7] This diagram illustrates an example of a distance measurement method using UWB (Universal Wavelength). [Figure 8] This figure illustrates an example of the operation of the data processing system in Embodiment 1. [Figure 9] This figure shows an example of a display screen in an image forming apparatus. [Figure 10] This figure shows an example of a display screen in an image forming apparatus. [Figure 11] This figure shows an example of a display screen in an image forming apparatus. [Figure 12] This figure shows an example of a display screen in an image forming apparatus. [Figure 13] This figure shows an example of a display screen on a mobile device. [Figure 14] This figure shows an example of a display screen on a mobile device. [Figure 15] This diagram illustrates the structure of BLE advertisement packets. [Figure 16] This diagram illustrates the specifications for communication capacity messages and communication configuration messages in CSML. [Figure 17] This diagram illustrates the packet specifications used in UWB ranging. [Figure 18] This figure illustrates an example of the operation of the data processing system in Embodiment 2. [Figure 19] This figure shows an example of a display screen on a mobile device. [Figure 20] This figure shows an example of a display screen on a mobile device. [Figure 21] This figure shows an example of a display screen on a mobile device. [Figure 22] This is a diagram illustrating an example of a display screen on a mobile terminal. [Mode for Carrying Out the Invention]

[0009] Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the following embodiments, an image forming apparatus is used as an example of an information processing apparatus for description, which is not intended to limit the present invention according to the claims, and not all combinations of features described in the embodiments are necessarily essential to the solving means of the invention.

[0010] The data processing system in the present embodiment includes a user interface for registering information for specifying a ranging target in an authentication server when a user performs a login authentication operation on an information processing apparatus. Based on this registered information, the information processing apparatus initiatively measures the distance to the ranging target. This makes it possible to determine whether the user has approached the information processing apparatus based on the information for specifying the mobile communication apparatus registered under the user's own information management.

[0011] (Embodiment 1) <System Configuration> Figure 1 is a diagram illustrating a configuration example of a data processing system 1 in the first embodiment. As shown in Figure 1, the data processing system 1 includes a mobile terminal 101, a wireless LAN terminal 102, a LAN 103, image forming apparatuses 104 to 107, and an authentication server 130.

[0012] A mobile terminal (mobile communication apparatus) 101 transmits a print job to any of the image forming apparatuses 104 to 107 via UWB (Ultra Wide Band) communication. The image forming apparatuses 104 to 107 have a printer function and a wireless communication function, and may also have a copy function, a scanner function, a fax transmission function, and the like.

[0013] The authentication server 130 manages user accounts for using applications on the mobile terminal 101 and image forming apparatuses 104-107. The authentication server 130 is capable of registering and managing user accounts, including usernames, passwords, email addresses, wireless communication settings, and other attributes used by the applications. The authentication server 130 has the function of returning information regarding the authentication result as a response to user authentication information requests from the mobile terminal 101 and image forming apparatuses 104-107.

[0014] The LAN (Local Area Network) 103 is a communication network that connects the mobile terminal 101, image forming apparatus 104-107, and authentication server via wired connections. Each device connected via wired connections in the data processing system 1 can exchange information through communication via LAN 103. Furthermore, LAN 103 is also connectable to the internet.

[0015] The wireless LAN terminal 102 is a wireless LAN access point with general network router functionality, providing wireless LAN access via Wi-Fi within homes, offices, and other locations. The mobile device 101 is assumed to be connected to LAN 103 via the wireless LAN terminal 102 by enabling its Wi-Fi function. When the mobile device 101 enters the wireless LAN area provided by the wireless LAN terminal 102, it can automatically join the LAN 103 network using pre-configured authentication information.

[0016] Signals 108-112 are wireless signals transmitted and received by the mobile terminal 101 and the image forming apparatus 104-107 using BLE (Bluetooth Low Energy). A wireless personal area network (WPAN) can be formed between the devices where signals 108-112 reach each other.

[0017] Signals 140 and 141 are wireless signals transmitted and received by the mobile terminal 101 and the image forming apparatus 104 via NFC (Near Field Communication). Communication can be performed between the mobile terminal 101 and the image forming apparatus at close range using NFC.

[0018] Signals 121-124 are UWB wireless signals transmitted and received by the mobile terminal 101 and the image forming apparatuses 104, 105, and 107 (information processing devices). A WPAN can be formed between the devices to which signals 121-124 reach each other. Note that image forming apparatus 106 is a device that does not have UWB. Also, image forming apparatus 107 and mobile terminal 101 are sufficiently far apart, and mobile terminal 101 cannot receive the UWB radio waves (signal 124) from image forming apparatus 107.

[0019] In data processing system 1, users can register wireless connection information with the authentication server, which is necessary for determining whether or not they have approached any of the image forming apparatuses 104, 105, or 107. It is also possible to register login methods and job execution details for each image forming apparatus 104, 105, and 107 with the authentication server. Furthermore, based on the wireless connection information provided by the authentication server, data processing system 1 performs access control (hereinafter referred to as "access control") to ensure that the image forming apparatus 104, 105, or 107 that the user has approached completes the authentication process. The device configuration and methods that embody these features will be explained below with diagrams.

[0020] <Hardware configuration of mobile devices> Figure 2 is a block diagram showing an example of the hardware configuration of a mobile terminal 101. The mobile terminal 101 is a user-portable device such as a smartphone or tablet, and may run an operating system (OS) for the terminal and programs that control calls and data communication. Note that the mobile terminal 101 may not be a device equipped with the microphone / speaker 214, GPS sensor 217, gyro sensor 221, accelerometer 222 and their control units (206, 210, 219, 220) or the mobile phone data communication unit 212, etc., as described later. Examples of such devices include portable personal computers such as notebook computers.

[0021] As shown in Figure 2, the mobile terminal 101 includes a CPU 202, ROM 203, RAM 204, network control unit 205, voice control unit 206, display control unit 207, input control unit 208, storage device 209, position detection control unit 210, and wireless LAN communication unit 211. The mobile terminal 101 also includes a mobile phone data communication unit 212, BLE communication unit 213, microphone / speaker 214, display 215, touch panel 216, GPS sensor 217, UWB communication unit 218, NFC communication unit 232, and direction detection control unit 219. Furthermore, the mobile terminal 101 includes an acceleration detection control unit 220, gyro sensor 221, acceleration sensor 222, camera 230, and image reading control unit 231. Each hardware component is directly or indirectly connected to the system bus 201.

[0022] The ROM (Read Only Memory) 203 stores the operating system (OS) and applications that control calls and data communication in the mobile terminal 101. The OS and applications stored in the ROM 203 are executed by the CPU (Central Processing Unit) 202. Applications that control data communication include the printing application 401, which will be described later in Figure 4, as well as email software (not shown).

[0023] RAM (Random Access Memory) 204 is the memory used to execute programs; it is the work memory area where applications run programs. RAM 204 also serves as temporary storage for data that applications must temporarily save during program execution.

[0024] The storage device 209 is a non-volatile storage device that stores various operating mode settings and operation logs that need to be retained even after the mobile terminal 101 is restarted.

[0025] The network control unit 205 controls communication between the wireless LAN communication unit 211, the mobile phone data communication unit 212, the BLE communication unit 213, the NFC communication unit 232, and the UWB communication unit 218. Here, the wireless LAN communication unit 211 is a communication unit that participates in the LAN 103 network via the wireless LAN terminal 102, and the mobile phone data communication unit 212 is a communication unit for participating in the network provided by the mobile carrier. The BLE communication unit 213 is a communication unit for forming a WPAN between surrounding computer devices where BLE wireless signals reach each other. The NFC communication unit 232 is a communication unit for short-range data communication between devices where NFC wireless signals reach each other. The UWB communication unit 218 is a communication unit for forming a WPAN for distance measurement and data communication between surrounding computer devices where UWB wireless signals reach each other.

[0026] Here, when the mobile terminal 101 is able to join the wireless LAN network, the network control unit 205 prioritizes the wireless LAN connection. If the mobile terminal 101 moves out of the wireless LAN network area, it is exclusively controlled to join the wireless communication network provided by the mobile carrier. In BLE communication, NFC communication, and UWB communication, the communication functions are controlled independently to achieve the purpose of communication.

[0027] The voice control unit 206 is used, for example, when a calling application is launched and the user is making a call. Specifically, when voice data is input and output through the microphone / speaker 214, the voice control unit 206 acts as an intermediary between the voice data and the voice data control program. The display control unit 207 controls the information output on the display 215 of the mobile terminal 101. The input control unit 208 controls the information instructed by the user via buttons (not shown) or the touch panel 216 provided on the mobile terminal 101. Using these voice control unit 206, display control unit 207, and input control unit 208, the application launched on the mobile terminal 101 provides the user with network communication information and various information about the mobile terminal 101.

[0028] The position detection control unit 210 acquires location information of the mobile terminal 101 from the GPS (Global Positioning System) sensor 217 and provides it to the OS. The direction detection control unit 219 acquires direction information of the mobile terminal 101 from the gyro sensor 221 and provides it to the OS. The acceleration detection control unit 220 acquires acceleration information of the mobile terminal 101 from the acceleration sensor 222 and provides it to the OS. These controls are managed by the OS running on the CPU 202. The image reading control unit 231 controls the camera 230, for example, controlling image reading by the camera 230.

[0029] The mobile terminal 101 is capable of performing distance measurement communication to measure the distance to the image forming apparatuses 104, 105, and 107 via the UWB communication unit 218. The UWB communication unit 218 supports at least TWR (Two-Way Range) as shown in Figure 7 as a method of distance measurement communication. The mobile terminal 101 transmits distance measurement request data via the UWB communication unit 218 and receives corresponding distance measurement response data. The mobile terminal 101 is capable of providing distance information generated by the CPU 202 processing data and calculating the distance, according to the timing requested by the application. In this way, the mobile terminal 101 can provide distance information not only to the image forming apparatuses 104, 105, and 107 in the system configuration shown in Figure 1, but also to peripheral devices that support UWB communication (not shown).

[0030] Furthermore, the mobile terminal 101 can also handle cases where distance measurement is requested from the image forming apparatus 104, 105, 107 or other peripheral devices. In this case, it can transmit distance measurement response data in response to the reception of distance measurement request data in the distance measurement communication method by TWR.

[0031] <Hardware configuration of image forming apparatus> Figure 3 is a block diagram showing an example of the hardware configuration of the image forming apparatus 104. Note that the image forming apparatuses 105 and 107 have similar configurations and therefore their descriptions are omitted. The image forming apparatus 104 includes an operation unit 140 for the user to perform various operations, a scanner unit 10 that reads image information according to instructions from the operation unit 140, a printer unit 20 that prints image data onto paper, and a controller 1200.

[0032] The scanner unit 10 includes a CPU for controlling the scanner unit 10, as well as illumination lamps and a scanning mirror (not shown) for scanning documents. The printer unit 20 includes a CPU for controlling the printer unit 20, as well as a photosensitive drum and a fuser (not shown) for image formation and fixing. The controller 1200 controls the scanner unit 10, the printer unit 20, and the operation unit 140. The controller 1200 also comprehensively controls communication with external information devices such as the mobile terminal 101, print server 150, and authentication server 130, which are connected via LAN 103 or wireless LAN.

[0033] The controller 1200 includes a Wi-Fi communication unit 1271, a BLE communication unit 1272, a UWB communication unit 1273, and an NFC communication unit 1274, which are capable of wireless communication with an external mobile terminal 101. These are connected to the system bus 1207, which will be described later.

[0034] Furthermore, the controller 1200 includes a raster image processor (RIP) 1260 that expands PDL codes included in print jobs received from the mobile terminal 101 or print server 150 via wired or wireless communication into bitmap images. The controller 1200 also includes a scanner image processing unit 1280 that performs correction, processing, editing, etc., on image data input from the scanner unit 10. The controller 1200 also includes a printer image processing unit 1290 that performs correction, resolution conversion, etc., on image data output (printed) by the printer unit 20, and an image rotation unit 1230 that rotates the image data.

[0035] Furthermore, the controller 1200 has an image compression unit 1240 that performs JPEG compression and decompression processing on multi-level image data and JBIG, MMR, or MH compression and decompression processing on binary image data. The controller 1200 also has a device I / F 1220 that connects the scanner unit 10 and the printer unit 20 to the controller 1200 and performs synchronous / asynchronous conversion of image data. In addition, the controller 1200 has an image bus 2008 that connects the RIP 1260, scanner image processing unit 1280, printer image processing unit 1290, image rotation unit 1230, image compression unit 1240, and device I / F 1220 to each other and transfer image data at high speed.

[0036] Furthermore, the controller 1200 has a CPU 1201 as a control unit that comprehensively controls the image forming apparatus 104. The controller 1200 also has a RAM 1202 which is a system work memory for the operation of the CPU 1201 and is also an image memory for temporarily storing image data.

[0037] The controller 1200 also includes an operation unit 140 and an operation unit interface 1206. Image data to be displayed on the operation unit 140 is output to the operation unit 140 via the operation unit interface 1206. The operation unit interface 1206 also has the role of transmitting information input by the user using the image forming apparatus 104 from the operation unit 140 to the CPU 1201.

[0038] Furthermore, the controller 1200 has a network unit 1210 connected to the LAN 103 that communicates (sends and receives) with other computer terminals on the LAN 103, such as the print server 150 and the authentication server 130 (not shown). The controller 1200 also has a modem unit 1211 connected to the public telephone line 3001 that communicates (sends and receives) data with an external facsimile device (not shown).

[0039] Furthermore, the controller 1200 has a Wi-Fi communication unit 1271 for participating in the network via Wi-Fi wireless communication. The controller 1200 also has a BLE communication unit 1272 for forming a WPAN between surrounding computer devices using a BLE wireless signal 109. The controller 1200 also has a UWB communication unit 1273 for forming a WPAN for distance measurement and data communication between surrounding computer devices using a UWB wireless signal 122. The controller 1200 also has an NFC communication unit 1274 for short-range data communication with information devices such as a mobile terminal 101 using an NFC wireless signal 141.

[0040] The controller 1200 also has a ROM 1203 that stores the boot program executed by the CPU 1201, and a storage device 1204 that stores system software, image data, software counter values, etc. The controller 1200 also has an internal communication I / F 1208 that communicates with the scanner unit 10 and the printer unit 20, respectively, and a timer unit 1209 used for timing during distance measurement using UWB, which will be described later.

[0041] Furthermore, the controller 1200 includes a system bus 1207. The system bus 1207 connects the CPU 1201, RAM 1202, operation interface 1206, timer unit 1209, network unit 1210, modem unit 1211, ROM 1203, storage device 1204, and internal communication interface 1208 to each other. The controller 1200 also has an ImageBus interface 1205 that functions as a bus bridge connecting the system bus 1207 and the image bus 2008 and converting the data structure.

[0042] The controller 1200 records and manages the history of print and copy jobs, including the user name, number of copies, color printing, and other output attribute information, as job log information in the storage device 1204 or RAM 1202.

[0043] Here, the mobile terminal 101 and the image forming apparatuses 104, 105, and 107 can communicate with the authentication server 130, and settings can be configured to cooperate with the services provided by the authentication server 130 for each application. The mobile terminal 101 and the image forming apparatuses 104, 105, and 107 can, for example, perform user account information verification, request attribute information, and register user attribute information with the authentication server 130 based on the user authentication function required by the application. The mobile terminal 101 can also directly access the authentication server 130 via the wireless LAN communication unit 211. In addition, the image forming apparatuses 104, 105, and 107 can indirectly send and receive information between themselves and the authentication server 130 via the BLE communication unit 1272, UWB communication unit 1273, NFC communication unit 1274, etc.

[0044] <Software configuration of mobile devices> Figure 4 is a block diagram illustrating the software configuration of the mobile terminal 101 and the data area managed by the software. The software shown in the figure is executed by the CPU 202, with the program deployed in RAM 204. As shown in Figure 4, the mobile terminal 101 has a printing application 401, other applications 408, and a platform 411.

[0045] The printing application 401 is one of the applications executed by the CPU 202 on the mobile terminal 101, and is installed in the ROM 203 as an application that runs on the OS.

[0046] Platform 411 can be configured using, for example, Google's Android® or Apple's iOS®. Platform 411 has a group of device drivers for controlling various hardware and provides APIs for applications running on Platform 411 to utilize various hardware. Here, for BLE communication and UWB communication, APIs compliant with the "CSML specification" standardized by the FiRa Consortium, an organization promoting the spread of UWB, are provided. Here, CSML stands for Common Service Management Layer. Alternatively, APIs compliant with Apple's "Neaby Interaction" may also be provided for BLE communication and UWB communication. Examples of the device drivers include a BLE communication control unit 405, a UWB communication control unit 406, a Wi-Fi communication control unit 410, and an NFC communication control unit 413. For example, the BLE communication control unit 405 is a device driver for controlling the BLE communication unit 213, and the UWB communication control unit 406 is a device driver for controlling the UWB communication unit 218. The Wi-Fi communication control unit 410 is a device driver for controlling the wireless LAN communication unit 211, and the NFC communication control unit 413 is a device driver for controlling the NFC communication unit 232.

[0047] As shown in Figure 4, the print application 401 includes a UI unit 402, an image forming apparatus search unit 403, a print control unit 404, a web browser 407, an encoded information reading unit 412, and a document 409.

[0048] Document 409 indicates the area of ​​data that the software stores and manages in RAM 204. UI section 402 provides a user interface for the user to configure functions specific to the printing application 401.

[0049] The image forming apparatus search unit 403 searches for network devices that the mobile terminal 101 supports mDNS (multicast Domain Name System) on the LAN 103 to which the mobile terminal 101 participates. It then provides a function to obtain detailed information via IPP and IPPS for image forming apparatuses that the mobile terminal 101 can print from among the network devices reachable from LAN 103 (i.e., those supported by the printing application 401). Here, IPP is an abbreviation for Internet Printing Protocol. The communication method is not limited to mDNS and IPP. Furthermore, the image forming apparatus search unit 403 also provides a function to search for image forming apparatuses that the mobile terminal 101 can print from within a WPAN where BLE transmission and reception are possible, via the BLE communication control unit 405. In addition, the image forming apparatus search unit 403 provides a function to obtain distance information by controlling communication for distance measurement between the searched image forming apparatus and the mobile terminal 101 via the UWB communication control unit 406. The following explanation will describe the case where the image forming apparatus found is image forming apparatus 104, but the same applies when image forming apparatuses 105 and 107 are found.

[0050] The print control unit 404 provides the function of generating print jobs for the image forming apparatus 104 and transmitting those print jobs as job data. The print application 401 is not limited to print instruction functions, but may also have functions such as issuing scan instructions to the image forming apparatus 104. Furthermore, when generating a print job, the print control unit 404 can incorporate terminal-specific distance measurement identification information into the job data via the UWB communication control unit 406.

[0051] The encoded information reading unit 412 provides the function of reading two-dimensional codes, including QR codes (registered trademark), and generating decoded information. For example, the encoded information reading unit 412 reads a QR code encoded with information including the URL of the authentication server 130, and provides the decoded information to the web browser 407. Based on this decoded information, the mobile terminal 101 can communicate with the web server application 1317 provided by the authentication server 130 via the web browser 407. The authentication server 130 can use this web server application 1317 as an interface to provide management information to the requested user account from the directory service 1312, which can input and output user account information. Furthermore, terminal-specific distance measurement identification information provided in the UWB communication control unit 406 on the platform 411 can be registered in association with the user account via the directory service 1312 of the authentication server 130.

[0052] The NFC communication control unit 413 on platform 411 provides applications with functions for reading and writing NFC tag information recorded on IC chips such as IC cards (not shown), authentication, and data communication with NFC-equipped devices at close range. The NFC communication control unit 413 is also configured to communicate bidirectionally via the NFC communication unit 1274 of the image forming apparatus 104 in various modes, including active mode, passive mode, and bidirectional mode. This NFC communication can be used as one authentication method when using applications of the image forming apparatus 104. Other applications, such as an authentication application (not shown), can be used to log in to and log out of user accounts.

[0053] After sending a print job to the image forming apparatus 104 located on platform 411, the UWB communication control unit 406 can respond to a distance measurement request from the image forming apparatus 104 with a distance measurement response without requiring the user to confirm or operate the UI unit 402.

[0054] Furthermore, the mobile terminal 101 may be configured to enable the creation of a single sign-on environment in which the printing application 401 and other applications 408 share and coordinate user authentication information using the authentication server 130 as a component. For example, when user authentication is performed on the mobile terminal 101, other authentication-related processes can be coordinated on the authentication server 130 to complete the authentication process. Examples include authentication for using an unillustrated cloud service (SaaS: Software as a Service) provided via a communication network, or authentication procedures required when using the printing application 401. In this case, applications whose authentication is coordinated can share information managed by the directory service 1312 provided by the authentication server 130, as well as input / output and registration management of that information.

[0055] In this embodiment, the mobile terminal 101 and its applications are configured to allow flexible access to the authentication server 130, and the information managed by the authentication server 130 can be utilized. For example, when user authentication is performed in the first authentication, which is performed by NFC communication, the image forming apparatus 104 requests unique identification information for UWB positioning and distance measurement from the authentication server 130. Based on the information obtained in response to this request, the image forming apparatus 104 can trace the user's movement process under the control of access control in order to perform a second authentication based on distance measurement on the mobile terminal 101.

[0056] In other words, it is possible to construct multi-factor authentication by starting with NFC authentication (first authentication) and obtaining the information necessary for UWB distance measurement authentication (second authentication) (terminal-specific distance measurement identification information) from the authentication server 130. Furthermore, the registration and use of distance measurement positioning information with the authentication server 130 as this second authentication can be arbitrarily configured by user operation, so security can be strengthened as an additional effect as needed. Note that the first authentication used as the starting point may be other authentication methods other than distance measurement authentication, such as authentication using an ID and password via keyboard input or biometric authentication.

[0057] <Software configuration of image forming apparatus> Figure 5 is a block diagram illustrating the software configuration of the image forming apparatus 104 and the data area managed by the software. The software configurations of image forming apparatuses 105 and 107 are similar, so their explanations are omitted. The software shown in the figure is executed by the CPU 1201, with the program loaded into RAM 1202. As shown in Figure 5, the image forming apparatus 104 includes a printing application 501, a login authentication service 507, and a platform 510.

[0058] The printing application 501 is one of the applications executed by the CPU 1201 on the image forming apparatus 104, and is installed in the ROM 1203 as an application that runs on the OS.

[0059] The job management area 508 and the document management area 511 within platform 510 represent areas of data that the software stores and manages in RAM 1202 and storage device 1204. Similarly, the user account management area 509 within login authentication service 507 also represents an area of ​​data that the software stores and manages in RAM 1202 and storage device 1204.

[0060] Platform 510 can be configured to include an operating system such as Linux®, a Java® virtual machine, the OSGi® framework, and a set of device drivers. Java is a registered trademark of Oracle Corporation. The OSGi framework is a Java-based service platform defined by the OSGi Alliance (a standardization organization).

[0061] Platform 510 has a set of device drivers for controlling various hardware and provides APIs for applications running on Platform 510 to utilize the hardware. Examples of these device drivers include the BLE communication control unit 505, the UWB communication control unit 506, the Wi-Fi communication control unit 512, and the NFC communication control unit 517. For example, the BLE communication control unit 505 is a device driver for controlling the BLE communication unit 1272, the UWB communication control unit 506 is a device driver for controlling the UWB communication unit 1273, the Wi-Fi communication control unit 512 is a device driver for controlling the Wi-Fi communication unit 1271, and the NFC communication control unit 517 is a device driver for controlling the NFC communication unit 1274. Regarding protocol control using BLE and UWB communication, APIs compliant with the "CSML specification" standardized by the FiRa Consortium are provided. Alternatively, APIs compliant with Apple's "Neaby Interaction" standard may be provided for BLE and UWB communication. In addition, although not shown in the diagram, a printer module for controlling the printer unit 20 and a scanner module for controlling the scanner unit 10 are also present on this platform 510. Furthermore, the platform 510 provides applications with APIs for reading and writing data in the job management area 508 and the user account management area 509.

[0062] The login authentication service 507 is an application that provides login functionality for users to use the image forming apparatus 104. It is also possible to share user accounts and authentication information with the authentication server 130, which is connected via a communication network. By linking user authentication performed using the mobile terminal 101 with the login authentication service 507 on the authentication server 130, a single sign-on authentication function can be established.

[0063] In this embodiment, the mobile terminal 101 and the image forming apparatus 104 can access attribute information registered with the authentication server 130 in association with the user account. For example, when a user who owns the mobile terminal 101 logs in to the image forming apparatus 104, the image forming apparatus 104 requests distance measurement identification information from the authentication server 130 to measure the distance to the mobile terminal 101 corresponding to the user account. Based on the information obtained in response to this request, the UWB communication control unit 506 can perform distance measurement.

[0064] As shown in Figure 5, the printing application 501 includes a UI unit 502, a copy unit 514, a TAG search unit 503, a printing unit 504, a reading unit 515, a transmission unit 513, and an encoded information generation unit 516.

[0065] The copy unit 514 controls the read unit 515 and the print unit 504 via the platform 510 to perform copying. The print unit 504 provides the function of printing document data stored in the document management area 511 and print jobs stored in the job management area 508. The output of copies and prints by the copy unit 514, read unit 515, print unit 504, etc., is performed via the API of the platform 510, and the platform 510 records the number of printed pages in a counter (not shown). The transmit unit 513 provides the function of transmitting document data acquired from the read unit 515 to an external source. The UI unit 502 provides a user interface such as a menu screen for selecting application-specific functions (e.g., copy, print, transmit) from the operation unit 140. For example, the home screen shown in Figure 9(C) is displayed on the operation unit 140.

[0066] The TAG search unit 503 searches for the UWB TAG to be measured in the LAN 103, to which the image forming apparatus 104 participates. The BLE communication control unit 505, UWB communication control unit 506, Wi-Fi communication control unit 512, etc. are used for this search. Then, the UWB communication control unit 506 performs TWR distance measurement on the searched UWB TAG to be measured, as described later. Access control is performed based on the distance measurement result between the target to be measured and the image forming apparatus 104 obtained by this TWR distance measurement.

[0067] At this time, user account and distance information are shared between the user account management area 509 managed by the login authentication service 507 and the job management area 508 recorded and updated by the UWB communication control unit 506. Based on this shared information, the login authentication service 507 performs authentication processing if it determines that the distance information meets predetermined conditions. In a single sign-on environment where the authentication process is shared by the authentication server 130, a notification function may be provided to notify the mobile terminal 101 of the authentication result.

[0068] As shown in Table 1, the user account management area 509 managed by the login authentication service 507 records and manages at least the following information: "User_name", "Pass_word", "IC_card", and "Mail_Address". "User_name" is the information that identifies the user (login ID), and "Pass_word" is the password associated with "User_name". "IC_card" is the IC card number of the IC card held by the user that can communicate with the NFC communication control unit 517, and "Mail_Address" is the user's email address.

[0069] Furthermore, in the image forming apparatus 104 of the data processing system 1, the UWB communication control unit 506 is capable of recording and managing one or more identification information "UWB_tag1 / 2 / 3 / ..." for the UWBTAG target for distance measurement.

[0070] Furthermore, the login authentication service 507 may also be directly or indirectly linked with the authentication server 130 via LDAP (Lightweight Directory Access Protocol). In this case, as shown in Table 2, it is possible to access user account information managed based on LDAP attributes. Thus, in this embodiment, authentication status and user account information can be linked and synchronized bidirectionally between the devices constituting the data processing system 1, such as the mobile terminal 101, the authentication server 130, and the image forming apparatus 104.

[0071] [Table 1]

[0072] [Table 2]

[0073] Furthermore, the job management area 508, which is the management area of ​​platform 510, records and manages data and content of jobs received from users at any time. Specifically, the job management area 508 records information of UWBTAGs such as mobile terminals 101 that perform access control, which are associated with the "User_name" of the user who issued the job, such as a print job or a copy job.

[0074] The job management area 508 contains at least the following information as shown in Table 3: "JOBID", "JOB_type", "JOB_Status", "User_name", "TAG_panid", "Tag_addr", and "Rang_Value". "JOBID" indicates a job-specific identification number, "JOB_type" indicates the job type, and "JOB_Status" indicates the job execution status. "User_name" indicates the user who issued the job, and "TAG_panid" indicates the personal area network ID included in the UWBTAG information to be measured. "Tag_addr" indicates the address of the UWBTAG to be measured, and "Rang_Value" indicates the measurement value for the UWBTAG to be measured.

[0075] In addition, the job management area 508 may include additional attributes such as "Rang_set(x)" and "terminal," which are access control parameters corresponding to print jobs received from the mobile terminal 101, as shown in Table 3. Here, "Rang_set(x)" indicates the distance condition for performing access control, and "terminal" indicates the type of terminal.

[0076] The login authentication service 507 and the UWB communication control unit 506 are linked by "User_name" in their respective management areas and share distance measurement information between the image forming apparatus 104 and the UWBTAG to be measured. The login authentication service 507 obtains this distance measurement information and performs access control.

[0077] Furthermore, as shown in Figure 20(A), a user interface (TAG setting screen) is provided that allows registration of any UWBTAG to be the target of access control (distance measurement target). Therefore, the UWBTAG information in the job management information shown in Table 3 does not need to be just one. For example, as shown in the information in the user account management area 509 shown in Table 1, for users who utilize multiple UWBTAGs, distance measurement may be performed on multiple UWBTAGs, and authentication processing by access control may be performed based on that distance measurement information. This can enhance the security level.

[0078] [Table 3]

[0079] In the case of a print job, once authentication is performed by the login authentication service 507, the printing unit 504 receives the print job (job data) temporarily stored in the print server 150 after the job data has been sent from the mobile terminal 101 and executes the printing process. The printing unit 504 may also provide a function to automatically perform printing based on the distance measurement information.

[0080] Furthermore, the login authentication service 507 may perform authentication processing by combining other login methods with the distance measurement information, depending on the settings in the UWB access control setting screen 1110 shown in Figure 11(A). This makes it possible to accommodate authentication methods such as reading IC cards managed in "IC_Card" in Table 1, or keyboard input of passwords managed in "Pass_word" in Table 1, according to the user's preferences.

[0081] In the example shown in Figure 11(A), access control by UWB distance measurement and IC card authentication are treated as AND conditions, while keyboard input is treated as an OR condition. In this case, authentication is performed when the user (distance measurement target) moves within the authentication distance and the image forming apparatus 104 successfully reads the predetermined IC card.

[0082] In this embodiment, the login authentication service 507 can provide a user interface to register the UWB_tagID with the authentication server 130 if the UWB_tag shown in Table 1 is not registered in the user account management area 509. Specifically, as shown in Figure 10(B), the encoded information generation unit 516 generates a URL for accessing the Web server application 1317 of the authentication server 130, and the generated QR code can be displayed on the screen of the operation unit 140. Figure 10(B) shows an example of a QR code generated by the encoded information generation unit 516 as QR code 1401. The encoded information generation unit 516 encodes information including the URL of the authentication server 130 to be accessed, "https: / / xxx.net.jp / 01235 / uwbtag", the logged-in user ID, and other information for accessing the authentication server and identifying the individual. It may also include information necessary for setting up a communication connection for communication using BLE or Wi-Fi.

[0083] <Authentication Server Software Configuration> Figure 6 is a block diagram illustrating the software configuration of the authentication server 130 and the data area managed by the software. As shown in Figure 6, the authentication server 130 includes a server application 1311 and a platform 1314.

[0084] Platform 1314 includes a communication control unit 1315 and an LDAP protocol control unit 1316. The communication control unit 1315 is for controlling wired or wireless communication with devices connected via a communication network. The LDAP protocol control unit 1316 is for performing standard LDAP access control as a communication protocol for accessing information managed by the directory service 1312.

[0085] The server application 1311 includes a directory service 1312 and a web server application 1317. The directory service 1312 has a user account storage area 1313 for managing device information connected to a communication network, user IDs, passwords, and the like. In the present embodiment, at least the LDAP attribute information shown in Table 2 is managed as the user account storage area 1313 managed by the directory service 1312, and information can be provided in response to requests from the mobile terminal 101 or the image forming apparatus 104.

[0086] Further, the web server application 1317 can be caused to function as an access unit for the directory service 1312. For example, as shown in Figure 10(B), the web browser 407 included in the mobile terminal 101 can be used to access the URL of this web server application 1317 and update the information managed by the directory service 1312. Further, the web server application 1317 may be configured to be capable of providing an authentication linkage function that shares information managed by the directory service 1312 and user authentication information between applications.

[0087] In this way, the authentication server 130 can perform information linkage with the mobile terminal 101 and the image forming apparatus 104. In addition, unique identification information (UWBTAGID) of a ranging target, which is necessary for the image forming apparatus 104 to perform access control based on distance information, can be registered and referenced as information provided by the directory service 1312 of the authentication server 130.

[0088] <UWB ranging method> Figure 7 illustrates an example of a UWB-based ranging method applied in data processing system 1. This ranging method is defined in the IEEE 802.15.4 group and measures the distance between a TAG and an Anchor. Specifically, the distance is measured by calculating the frame arrival time (ToA: Time Of Arrival) per unit distance based on the speed at which radio waves travel through space.

[0089] Figure 7 shows the distance measurement method of Two-Way Rangening (TWR), which transmits frames bidirectionally between the Anchor and the TAG. In TWR, the Anchor is primarily responsible for distance measurement, and the TAG is the object of measurement.

[0090] When measuring the distance to a TAG, the Anchor issues a POLL frame (distance measurement request data) to the TAG. Upon receiving the POLL frame, the TAG recognizes that it is addressed to it and, from the moment of receipt, begins a predetermined period of time (T reply After the specified time has elapsed, a RESP frame (distance response data) is sent to the Anchor. This RESP frame contains T reply A value has been assigned.

[0091] An Anchor that receives a RESP frame will record the time (T) between the issuance of the POLL frame and the receipt of the RESP frame. round ) and T included in the RESP frame reply Using the values, the ToA (Time to Arrow) required for the transmission of the POLL frame and RESP frame is calculated. Finally, using this ToA and the propagation speed of radio waves (speed of light), the Anchor performs a calculation to determine the distance to the TAG (Tag).

[0092] In the data processing system 1, the image forming apparatus 104 and the mobile terminal 101 each have a UWB communication control unit that can handle either the TAG or Anchor role in the TWR-based distance measurement method described above. Specifically, there is the UWB communication unit 218 in Figure 2, the UWB communication unit 1273 in Figure 3, the UWB communication control unit 406 in Figure 4, and the UWB communication control unit 506 in Figure 5. By transmitting and receiving the aforementioned frames and performing calculation processing according to the requirements of each application (for example, the printing applications 401 and 501 in Figures 4 and 5), distance measurement between the device and the object to be measured becomes mutually possible.

[0093] <Login Authentication Process> Figure 8 is a sequence diagram illustrating an example of the operation of the data processing system 1 in Embodiment 1. In this process, first, the image forming apparatus 104 accepts the user's ID and password input via keyboard input displayed on the operation unit 140 as a login operation. Upon receiving this login, the image forming apparatus 104 requests user authentication information from the authentication server 130. Based on this request for authentication information, the image forming apparatus 104, having confirmed authentication, accepts input for settings to perform distance measurement authentication using UWB. In these settings, the image forming apparatus 104 encodes information for accessing the authentication server 130 to register UWBTAG-specific information (UWBTAG) related to the user's mobile terminal 101 and displays it on the screen of the operation unit 140. The encoded information includes, for example, the URL of the web server application for accessing the authentication server 130 and the user ID. The mobile terminal 101 reads this displayed encoded information and accesses the authentication server 130 based on the information read. The mobile terminal 101 accepts operation input for registering the terminal's UWBTAG. The image forming apparatus 104 measures the distance to the mobile terminal 101 using the UWB TAG registered with the authentication server 130. The image forming apparatus 104 performs authentication based on the distance information obtained from this measurement. In this way, the setup procedures from the first authentication (keyboard input) to the second authentication (UWB distance measurement) are executed in a coordinated manner through mutual communication between the mobile terminal 101, the image forming apparatus 104, and the authentication server 130.

[0094] The operation flow shown in the sequence diagram of Figure 8 is realized by the hardware and software components that make up the mobile terminal 101, image forming apparatus 104, and authentication server 130 as described in Figures 2 to 6 above. Regarding the software components, the mobile terminal 101 operates by the CPU 202 executing a program loaded into RAM 204. The image forming apparatus 104 operates by the CPU 1201 executing a program loaded into RAM 1202. Similarly, the authentication server 130 operates by the CPU executing a program loaded into RAM.

[0095] <Login> First, the image forming apparatus 104 accepts a login operation from the user (step S801). Figure 9(A) shows an example of a login screen displayed on the operation unit 140 of the image forming apparatus 104 when this login operation is accepted. In the example shown in Figure 9(A), the operation unit screen 11 has input fields for username, password, and login destination, as well as buttons related to the login operation. The operation unit 140 also has a settings button 16 for transitioning to a screen for making various settings, a power saving button 15 for transitioning to power saving mode, a numeric keypad button 14, a reset button 18, a start button 12, a stop button 13, and so on.

[0096] The login process involves receiving input in the username input field 1407, password input field 1408, and login destination input field 1409 on the keyboard input login screen shown in Figure 9(A). Subsequently, the information is passed to the login authentication service 507 upon receiving a touch operation of the login execution button 1406. The login method can be changed to touch login mode, as shown in Figure 9(B), by receiving a touch of the login button 1406 using an IC card. In touch login mode, information can be read by bringing the IC card or NFC-compatible terminal within communication range of the NFC communication unit 1274.

[0097] Next, the image forming apparatus 104 requests authentication information from the authentication server 130 based on the input information in the login operation via the login authentication service 507 (step S802). The image forming apparatus 104 issues an authentication information request command to the authentication server 130 based on the LDAP communication protocol supported by the authentication server 130. Upon receiving the authentication information request command, the authentication server 130 searches for user account information managed in the user account management area 1313 of the directory service 1312 (step S803). The authentication server 130 then returns this search result to the login authentication service 507 of the image forming apparatus 104 (step S804).

[0098] The login authentication service 507 determines authentication based on the user account information received from the authentication server 130, and displays the home screen shown in Figure 9(C). Application icons such as "Copy", "Fax", and "Print" are arranged on the home screen. In addition, a login status display banner 17 indicating the username of the logged-in user is arranged. Furthermore, a logout icon 20 for performing logout is arranged.

[0099] <UWBTAGID registration> Next, the operation process until the image forming apparatus 104 receives an operation, displays a QR code for accessing the authentication server 130 on the screen of the operation unit 140, and registers the UWBTAG in the authentication server 130 using the mobile terminal 101 that has read the QR code will be described. First, the image forming apparatus 104 receives a press of the setting button 16 arranged on the operation unit 140, and causes the operation unit 140 of the image forming apparatus 104 to display a setting screen (not shown). The image forming apparatus 104 receives, on this setting screen, an operation to transition the screen through the hierarchy of "Setting Top", "Management Settings", and "User Management" by further touch operation, thereby transitioning to the authentication management screen shown in Figure 10(A). Various setting buttons for performing user authentication are arranged on the authentication management screen. Here, the image forming apparatus 104 receives a selection of the ranging authentication 1403 (step S805). When the selection of the ranging authentication 1403 is received, the screen displayed on the operation unit 140 of the image forming apparatus 104 transitions to the ranging authentication setting QR code display screen shown in Figure 10(B) (step S806).

[0100] The QR code 1401 displayed on this QR code display screen is generated by the encoded information generation unit 516 and contains information including the URL of the connection destination to the authentication server 130, which communicates with the image forming apparatus 104 according to an unshown setting item that connects the authentication server to the image forming apparatus 104. The QR code display screen also has an NFC setting switch icon 1405 that transitions to the registration screen shown in Figure 10(C) for registering the UWBTAG using NFC communication as another method of registering UWBTAG information. When registering the UWBTAG using NFC communication, the UWBTAG information can be read by bringing the mobile terminal 101 equipped with the UWBTAG close enough for the NFC communication unit 1274 to communicate.

[0101] Next, with the QR code display screen shown in Figure 10(B) displayed, the user operating the mobile terminal 101 reads the QR code 1401 using the camera application of the mobile terminal 101, as shown in Figure 13(A). In Figure 13(A), 900 is the display screen and 851 is the home button. The QR code is read by the image reading control unit 231 which controls the camera 230 of the mobile terminal 101 (step S807). The image data read by the mobile terminal 101 is decoded by the encoded information reading unit 412 of the mobile terminal 101 and passed to the web browser 407. The web browser 407 displays the UWBTAG registration screen 901 shown in Figure 13(B) as a user interface for registering UWBTAG information in the authentication application on the authentication server 130.

[0102] The UWBTAG registration screen 901 includes a user account information display field 902 for the currently logged-in user, a UWBTAG information registration icon 903, and other UWBTAG registration icons 904 as its components. The mobile terminal 101 accepts registration from the user via touch input to the UWBTAG information registration icon 903 (step S808). Based on this registration acceptance, the mobile terminal 101 generates an LDAP query to register UWBTAG information in the user account management area 1313 of the authentication server 130 and issues it to the authentication server 130. If another UWBTAG registration 904 is selected, the user is redirected to a settings screen (Figure 20(A)) for registering other UWBTAG information other than the mobile terminal. The settings screen shown in Figure 20(A) allows the user to arbitrarily set the UWBTAG information to be registered with the authentication server 130.

[0103] The directory service 1312 of the authentication server 130 receives an LDAP query from the mobile terminal 101 and updates the information in the user account management area 1313. For example, for the registration details executed on the UWBTAG registration screen in Figure 13(B), the "UWB macAddress1" attribute corresponding to the LDAP attribute user ID "r_takahashi" is updated to "AA99C04243104510" as shown in Table 2.

[0104] Next, the authentication server 130 notifies the image forming apparatus 104 that the user account information has been updated and the details of the update (step S810a). The authentication server 130 also simultaneously notifies the mobile terminal 101 (step S810b). As shown in Table 4, the image forming apparatus 104 records the UWBTAG information in the user account management area 509 of the login authentication service 507 based on this notification. The item UWB_Tag1 corresponding to the user "takahashi" is updated to "AA99C04243104510". In other words, the information of the authentication server 130 and the account information are synchronized at this point.

[0105] [Table 4]

[0106] Up to this point, the operation process for registering, to the authentication server, the identification information that specifies a ranging target required when performing ranging authentication that performs authentication based on ranging with a target object owned by a user has been described.

[0107] <UWB Communication Setting> Next, communication settings for performing UWB communication between the image forming apparatus 104 and the portable terminal 101 are performed. Here, as a typical communication interface for performing UWB communication settings, a communication setting process performed using BLE communication will be described.

[0108] Upon receiving the notification from the authentication server 130 in step S810b, the portable terminal 101 starts UWB communication setting. First, the CPU 202 of the portable terminal 101 receives advertisement packets transmitted by the image forming apparatuses 104, 105, and 107 in the data processing system 1 shown in Figure 1 (step S811). Next, the CPU 202 performs pairing for establishing an authenticated connection for performing data communication between the portable terminal 101 and each of the image forming apparatuses 104, 105, and 107 (step S812).

[0109] Next, information necessary for UWB communication and job execution is exchanged between the mobile terminal 101 and the image forming apparatuses 104, 105, and 107 via GATT communication (step S813). The information exchanged includes the data structure and operation method of the image forming apparatuses 104, 105, and 107 as BLE devices, and is defined as a profile. In this embodiment, the UWBTAG information specific to the UWB communication unit 1273 of each image forming apparatus 104, 105, and 107, and the UWBTAG information specific to the UWB communication unit 218 of the mobile terminal 101 are also exchanged in this GATT communication. In addition, in this embodiment, the communication capacity message 910, which will be described later with reference to Figure 16(A), is also exchanged between the mobile terminal 101 and each image forming apparatus 104, 105, and 107. The UWBTAG information and communication capacity message 910 of the image forming apparatus 104, 105, and 107 may also be added to the advertisement packet.

[0110] In other words, during the processing of steps S811 to S813, communication setting information for UWB communication is exchanged between the mobile terminal 101 and the image forming apparatuses 104, 105, and 107 using BLE communication. This exchanged UWB communication setting information includes at least the address information of the packet destination included in the UWBTAG information, and the information on the role of UWB communication and the distance measurement method included in the communication capacity message 910.

[0111] Here, it is assumed that the UWBTAG information in steps S811 to S813 is usually the same as the UWBTAG information registered in the authentication server 130. On the other hand, terminals with a UWBTAG independent of the mobile terminal 101 may also be registered in the authentication server 130.

[0112] Note that for UWB TAG terminals and the like that do not have a BLE communication function, the communication setup via BLE may be omitted. In this case, the content essential as communication settings is configured to be preset as fixed values, enabling UWB communication. Further, if the communication settings in steps S811 to S813 have been completed in advance, this process can be omitted.

[0113] <Ranging Target Identification> Next, in the image forming apparatus 104, the CPU 1201 refers to the UWB communication settings established so far and the updated user account information to identify the ranging target (step S814).

[0114] <Arbitration of UWB Device Role> Here, in the process up to identifying the ranging target, the CPU 1201 of the image forming apparatus 104 performs arbitration of the "Role" as the UWB device. The image forming apparatus 104 side is determined as "ANCHOR", and the ranging target is determined as "TAG". After that, the CPU 1201 proceeds to the loop processing of step S815 to start ranging between the image forming apparatus 104 and the ranging target. Note that the ranging target is the mobile terminal 101 in the example of FIG. 8, but may be an unillustrated UWB TAG registered using the application user interface as shown in FIG. 13(B), FIG. 20(A), and the like. Hereinafter, the case where the ranging target is the mobile terminal 101 will be described.

[0115] <UWB TAG Information> The UWB TAG information is information composed of at least a PAN ID, the source and destination addresses of packets, and a uniquely assigned IEEE 802-compliant address that can uniquely identify the wireless terminal. Here, PAN ID is an abbreviation for Personal Area Network ID, which is an ID defined in the IEEE 802.15.4z standard for identifying a UWB communication counterpart. It may also include information indicating UWB communication-compatible devices in a broad sense. Furthermore, communication capability information and communication setting information required for UWB communication as shown in FIGS. 16(A), 16(B), and FIG. 17 may be included in the GATT communication profile.

[0116] The communication protocol between the mobile terminal 101 and the image forming apparatus 104 is controlled here based on the FiRa Consortium's CSML, which is defined above the IEEE 802.15.4 standard. Alternatively, the communication protocol between the mobile terminal 101 and the image forming apparatus 104 may be controlled based on Apple's "NearbyInteractionProtocol." In these communication protocol specifications, UWBTAG information is used to identify the communication partner for UWB communication.

[0117] These standards recognize that UWB wireless chips consume more energy than other wireless technologies. Therefore, a common feature is the use of a secondary channel to detect nearby UWB devices before UWB communication begins, exchanging information necessary for UWB communication, such as UWB communication capabilities, settings, and data required between applications. In this embodiment, as well, BLE communication is often used as the secondary channel.

[0118] <BLEアドバタイズパケット> Figure 15 illustrates the configuration of BLE advertisement packets transmitted from each of the image forming apparatuses 104, 105, and 107 equipped with UWB in Figure 1. Although there are multiple formats for the BLE advertisement packets transmitted by the image forming apparatuses 104, 105, and 107, here we will show advertisement packets in the Apple AirPrint Bluetooth Beacon format. Furthermore, BLE advertisement packets are radio beacon data that are broadcast as so-called beacon signals and are transmitted at intervals of several milliseconds to several seconds.

[0119] First, the beginning of a BLE advertisement packet consists of a 1-byte Preamble 9001, which is used by the BLE radio element to determine the timing of signal reading. Next, there is a 4-byte Access Address 9002, which inserts a value to indicate that it is a BLE advertisement packet. Then, the actual data area consists of a Protocol Data Unit (PDU) 9005, which can be up to 39 bytes. However, since 2 bytes of the PDU 9005 are consumed as the Header 9003 and 6 bytes as the Advertiser's address 9004, the remaining 31 bytes are used to make up the actual data, the Advertiser's Data 9007.

[0120] As an example of Advertiser's Data 9007, the format of an AirPrint Bluetooth Beacon will be explained with reference to Figure 15. First, Header 9008, a value common to all AirPrint Bluetooth Beacons, consists of 9 bytes. Next, Connection Information 9009, which indicates the format of the IP address and whether the image forming device sending the advertisement packet is a printer or a print server, consists of 1 byte. Next, Server or Resource Path 9010, which indicates the printer ID information determined by the server, consists of 2 bytes. Next, Port number Port 9011 consists of 2 bytes. Next, IP address (IP v4 Address or IP v6 Address) 9012 consists of 16 bytes. Finally, TxPower 9013, which indicates the signal strength emitted by the beacon, consists of 1 byte. At the end of the BLE advertisement packet, CRC 9006 for error detection consists of 3 bytes, and the above constitutes the entire advertisement packet.

[0121] The foregoing describes an example of an advertisement packet. Note that, as described above, since BLE communication is used as a secondary channel for necessary information exchange prior to UWB communication, for example, UWB TAG information and UWB communication setting information may be included in the advertisement packet.

[0122] <BLE GATT communication> <UWB FiRa standard Capability message> FIG. 16(A) is a diagram for explaining the specifications of a communication capability message 910 in the FiRa-defined communication protocol definition (CSML) applicable to UWB ranging in the data processing system 1. Here, CSML is an abbreviation for Common Service Management Layer. The communication capability message 910 is a communication message at the network layer and the transport layer in the communication protocol stack. Information exchange related to compatibility and communication capability between FiRa devices is performed via a communication channel of another band such as BLE or NFC. In the present embodiment, the communication capability message 910 is exchanged through GATT communication in step S813.

[0123] The mobile terminal 101 and the image forming apparatus 104 have BLE communication control units 405 and 505, and implement a communication protocol stack that processes the communication capability message 910 as part of an API called by a higher-level application. As its interface, the communication capability message 910 includes a physical layer version "FiRa PHY version" and a MAC layer version "FiRa MAC version" defined by FiRa. Further, the communication capability message 910 includes "Device Roles" 911 and "UWB Parameter Support" 912.

[0124] The "Device Roles" 911 identifies whether the device supports the "ANCHOR" function, which is the primary side of UWB communication, or the "TAG" function, which is the target side of distance measurement. The "UWB Parameter Support" 912 includes settings related to supported distance measurement, such as the "Ranging Methods" range measurement method. The image forming apparatus 104 and the mobile terminal 101 support both "ANCHOR" and "TAG" modes as "DeviceRoles" 911. In addition, the image forming apparatus 104 and the mobile terminal 101 support at least TWR (TowWayRanging) as the "Ranging Methods" range measurement method.

[0125] <UWB FiRa standard Configuration メッセージ> Figure 16(B) illustrates the specifications of the communication configuration message 915 in the FiRa-defined communication protocol definition (CSML) applicable to UWB ranging in the data processing system 1. Based on the exchange of the aforementioned communication capacity message 910, the UWB communication settings in the communication configuration message 915 are determined. As part of the UWB communication settings, for example, the roles and ranging methods for the image forming apparatus 104 and the mobile terminal 101 when performing UWB communication are determined. The exchange of communication configuration messages 915 containing this setting information takes place between the image forming apparatus 104 and the mobile terminal 101.

[0126] In determining the UWB communication settings, the image forming apparatus 104 and the mobile terminal 101 perform negotiation (hereinafter referred to as "arbitration") between their respective FiRa devices, as shown in the sequence diagram in Figure 8. In the data processing system 1, arbitration is performed to determine the roles of "ANCHOR" and "TAG" as UWB devices based on the requests of the respective applications of the mobile terminal 101 and the image forming apparatus 104. The communication configuration message 915 is provided with a "Device Roles" field 920 that indicates the roles to be determined in this arbitration. Specifically, arbitration is performed when the login authentication service 507 of the image forming apparatus 104 receives notification of an update to the UWBTAG registration content from the authentication server 130 (step S810a). Based on the notification made in step S810b, arbitration of roles as UWB devices is performed between the authentication setting applications running in the web browser of the mobile terminal 101. In this case, the login authentication service 507 of the image forming apparatus 104 will proactively perform distance measurement using the notified UWBTAG information and will attempt to act as an "ANCHOR" itself.

[0127] Furthermore, in the data processing system 1, as another case where arbitration is performed, for example, in the mobile printing process, the roles can be switched by the arbitration so that bidirectional distance measurement can be performed. In the process from the mobile terminal 101 searching for a device, measuring the distance, and displaying the device list, the roles of the mobile terminal 101 and the image forming apparatus 104 are arbitrated to "ANCHOR" and "TAG". Subsequently, when the user issues a print job, the roles are arbitrated again, and the roles of the image forming apparatus 104 and the mobile terminal 101 are changed to "ANCHOR" and "TAG" and distance measurement can be started.

[0128] Furthermore, the communication configuration message 915 has a "SessionID" field 916 that holds a value for a session ID used to identify the target for UWB communication processing, for example, different print jobs issued to each user as a single unit. These fields, "DeviceRole" 920 and "SessionID" 916, enable the image forming apparatus 104 to individually identify each user when there are multiple users at the connection destination.

[0129] In this way, BLE communication is used to exchange communication setting information for UWB communication. The "SessionID" 916 may be associated with the "JOBID" in the job management information in Table 3 to enable communication between the printing applications 401 and 501 and the UWB communication control unit 406 and BLE communication control units 405 and 505. In this case, when the image forming apparatus 104 receives multiple jobs from each of the mobile terminals logged in (owned) by different users, the CPU 1201 can process these multiple jobs and control the associated communication processing simultaneously or in a time-sharing manner.

[0130] <IEEE802.15.4 standard> Figure 17 illustrates the packet specifications used for UWB ranging in data processing system 1. The packet specifications related to UWB ranging are defined as the structure of a UWB frame 900 in the physical layer and data link layer (MAC) of a typical communication protocol stack.

[0131] The UWB frame 900 consists of the following fields: "SYNC" which holds the preamble for synchronization between the transceiver and receiver, "SFD" which holds a value indicating the boundary between the preamble and the PHY header, "PHR" 901, and "PHY payload" 902. "PHR" 901 is the field that holds the PHY header, and "PHY payload" 902 is the field that holds the PHY payload.

[0132] The "PHR" 901 further includes a "Ranging" 903 field that holds a flag identifying whether or not the frame was issued for distance measurement. For example, in a distance measurement request packet transmitted by a mobile terminal 101 or an image forming apparatus 104 to perform distance measurement, the UWB communication control units 406 and 506 set the "Ranging" 903 flag of the frame structure to "1".

[0133] Furthermore, the "PHY payload" 902 consists of "MHR" 909, "MAC payload", and "MAC footer". "MHR" 909 is a field that holds the MAC header and includes fields 904-908, as shown in Figure 17.

[0134] Field 904 is the "FrameControl" field, which indicates the frame format used for frame control at the data link layer (MAC). Field 905 is the "Destination PAN Identifier" field, which indicates the packet destination PANID. Field 906 is the "DestinationAddress" field, which indicates the packet destination address. Field 907 is the "SourcePANIdentifier" field, which indicates the packet source PANID. Field 908 is the "SourceAddress" field, which indicates the packet source address. Device-specific information is set by the UWB communication control units 406 and 506 as PANID and address information held in these fields 904 to 908.

[0135] In the image forming apparatus 104 of the data processing system 1, PANID and address information are set in fields 905 and 906 based on the following information. For example, the information is set based on the UWBTAG information in the user account management area 509 of the login authentication service 507, and the information in the communication settings with the mobile terminal 101 in GATT communication in step S813 of the sequence in Figure 8.

[0136] At this time, the UWB communication control unit 406 on the mobile terminal 101 analyzes the "Ranging" field 903 of the frame that makes up the received distance measurement request packet, as well as fields 905-908 that indicate the PANID and address of the packet's source and destination. It then creates a frame with time information required for analyzing the frame and processing the response, and sends the distance measurement response packet to the image forming apparatus 104.

[0137] <Distance measurement request> Returning to Figure 8, in the image forming apparatus 104, the CPU 1201 sends a distance measurement request packet to the distance measurement target (in this embodiment, the mobile terminal 101) (step S815a). This distance measurement request packet is a packet for making a distance measurement request based on the UWBTAG information of the distance measurement target identified by the TAG search unit 503, and is generated by the CPU 1201 by calling the API of the UWB communication control unit 506. Furthermore, this distance measurement request packet is a distance measurement packet in the necessary format for performing TWR distance measurement as defined in the IEEE 802.15.4z standard shown in Figure 7, and only needs to include distance measurement request identification information, requester address information, and request destination address information.

[0138] <Distance measurement response> Next, when the CPU 202 of the mobile terminal 101 receives a distance measurement request packet from the image forming apparatus 104, it sends a distance measurement response packet to the image forming apparatus 104 after a predetermined time has elapsed (step S815b). When the CPU 1201 of the image forming apparatus 104 receives the distance measurement response packet from the mobile terminal 101, it performs a distance measurement to calculate the distance between the image forming apparatus 104 and the mobile terminal 101, which is the distance to be measured, based on the TWR distance measurement method shown in Figure 7 (step S815c). The distance information x obtained by this distance measurement is updated as a variable in the "Rang_Value" of the job management information list shown in Table 3, which is managed in the job management area 508.

[0139] <Distance determination> Next, the CPU 1201 of the image forming apparatus 104 performs distance measurement determination that compares the distance information x obtained by the distance measurement in step S815c with a threshold value X (step S815d). As a result of this distance measurement determination, if x<X (the distance measurement determination is true), the CPU 1201 determines that the user has approached the image forming apparatus 104. In this case, the CPU 1201 performs login authentication for the user who is logged in on the mobile terminal 101 at the image forming apparatus 104 (step S816). Note that the processing from the distance measurement request in step S815a to the distance measurement determination in step S815d (that is, the loop processing of step S815 shown in FIG. 8) is repeatedly executed (continuously performed) until x<X, which is the Break condition in step S815d, is satisfied. Here, the threshold value X may be, for example, a setting value in the authentication distance input field 823 on the authentication setting input screen of the mobile terminal 101 shown in FIG. 19(B). Alternatively, it may be a setting value in the authentication distance input field 1111 on the UWB access control setting screen 1110 of the image forming apparatus 104 shown in FIG. 11(A).

[0140] Note that the image forming apparatuses 104, 105, and 107 in the present embodiment may be a compatible apparatus group that shares the print server 150. In this case, a user interface or system for a "hold print function" may be constructed, which allows a user to select one of these apparatus group as a printing apparatus that executes job data stored in the print server 150.

[0141] The UWB access control setting screen 1110 shown in FIG. 11(A) is provided with an authentication distance input field 1111 and other setting toggle buttons 1112 to 1114. The authentication distance input field 1111 receives an input of the threshold value X for the distance measurement determination in step S815d. The toggle button 1112 is a toggle for selecting the inter-apparatus priority of the threshold value X, and this toggle allows the user to select whether to use the threshold value X set on the image forming apparatus 104 side or the mobile terminal 101 side.

[0142] Toggle buttons 1113 and 1114 are toggle buttons for selecting the combination logic between the login authentication method based on the distance measurement determination in step S815d (UWB authentication) and other login methods. Specifically, toggle button 1113 is a toggle for selecting the combination logic between authentication by "IC card" managed in the user account management area 509 and UWB authentication. Toggle button 1114 is a toggle for selecting the combination logic between authentication by "keyboard input" managed in the user account management area 509 and UWB authentication. For example, as shown in Figure 11(A), if the logical AND "AND" is selected with toggle button 1113, then during login authentication in step S816, not only UWB authentication but also card reading of a predetermined IC card by the image forming apparatus 104 becomes mandatory. On the other hand, since the toggle button 1114 is set to logical OR, login authentication is performed not only by the login authentication in step S816, but also by the user entering their user ID and password on the keyboard (operation unit 140) of the image forming apparatus 104. In this way, the image forming apparatus 104 is designed to flexibly respond to the needs and selections related to UWB distance measurement. Furthermore, as an additional element, when the distance measurement determination in step S815d becomes true for job data from multiple users simultaneously, a combination of other login methods may be used as an exclusive condition for login authentication.

[0143] Furthermore, the image forming apparatus 104 is equipped with a user interface having toggle buttons 1121 to 1124 that accept input for setting the distance measurement start condition and distance measurement end condition by UWB, as shown in the UWB access control setting screen 1120 in Figure 11(B). Toggle button 1121 is a toggle for selecting whether or not to use the receipt of job data from the Anchor mobile terminal 101 as the distance measurement start condition. Toggle button 1122 is a toggle for selecting whether or not to use the login operation as the distance measurement start condition. In this way, using toggle buttons 1121 and 1122, the image forming apparatus 104 selectively accepts distance measurement start conditions from the user from multiple conditions and combinations thereof. Toggle button 1123 is a toggle for selecting whether or not to use the user logging out as the distance measurement end condition. Toggle button 1124 is a toggle for selecting whether or not to use the distance setting as the distance measurement end condition. When the toggle button 1124 is turned ON and distance setting is selected as the distance measurement termination condition, the user is automatically logged out and the distance measurement is terminated when they move a predetermined distance away from the image forming apparatus 104.

[0144] <Login Authentication> Returning to Figure 8, the CPU 1201 of the image forming apparatus 104, if the distance measurement determination in step S815d is true, refers to the user account management area 509 to perform the authentication procedure and displays a distance measurement authentication notification screen as shown in Figure 11(C). The distance measurement authentication notification screen shown in Figure 11(C) displays that the distance measurement authentication was successful and also includes icons 1403 and 1404 that allow the user to select whether or not to set this as an authentication condition for the next login.

[0145] Furthermore, a time limit is set for the repeating loop processing in step S815, and if the distance measurement determination in step S815d does not become true for a predetermined time, for example, an exception handling is handled by displaying a guidance message as shown in Figure 12(A). After displaying the guidance message as shown in Figure 12(A), if the distance measurement determination between the image forming apparatus 104 and the mobile terminal 101 becomes true, the image forming apparatus 104 displays a distance measurement authentication notification screen as shown in Figure 12(B), for example, to notify that the distance measurement has been authenticated.

[0146] Note that if the toggle button 1113 in Figure 11(A) is ON and the toggle button 1114 is OFF, step S816 will not start until the user touches the designated IC card to the IC card reader of the image forming apparatus 104. In the user account management area 509, user account information is stored as a linked set of user accounts, such as login IDs and passwords, and arbitrary UWBTAG information for authentication, as shown in Table 1 (User Account List). User account information can be registered in the user account management area 509 by linking this information using a user interface on an operation screen (not shown).

[0147] Next, once authentication is complete, the authentication result is notified to the mobile terminal 101. Upon receiving this notification, the mobile terminal 101 displays a notification message as shown in Figure 14 (step S817). Next, the image forming apparatus 104 displays the home screen shown in Figure 9(C) and accepts operation input for the desired job (step S818). Then, the image forming apparatus 104 executes the job selected in step S818 (step S819). Subsequently, when the user touches the logout icon 20 on the home screen shown in Figure 9(C), the image forming apparatus 104 executes the logout process (step S820).

[0148] The operation example of the data processing system 1 in Embodiment 1 has been described above. In this embodiment, the operation process of registering UWBTAG information necessary for UWB distance measurement authentication with the authentication server 130 is performed while the first authentication is in progress. Furthermore, the configuration and operation sequence shown allows the user to extend the authentication means themselves by performing a second authentication that measures distance and performs access control based on the UWBTAG information.

[0149] Thus, in this embodiment, the authentication means is extended from one-factor authentication to a second-factor authentication means based on distance measurement. As the second-factor authentication means, the UWBTAG information necessary for distance measurement is performed based on the first authentication, thus ensuring security. Furthermore, in this embodiment, the method of registering UWBTAG information to the authentication server 130 is made easy by enabling an operation that guides the user on how to register by displaying and reading a QR code. In other words, the user can easily perform the operation of registering identification information that identifies the distance measurement target necessary when performing distance measurement authentication based on the distance measured with the user's mobile terminal 101 to the authentication server 130 using simple procedures and operations.

[0150] (Embodiment 2) Next, Embodiment 2 will be described. Note that the configuration (hardware configuration, software configuration) of the data processing system 1, mobile terminal 101, image forming apparatus 104, 105, 107, and authentication server 130 in Embodiment 2 is the same as in Embodiment 1, so a detailed explanation will be omitted.

[0151] <Mobile Printing Operation Process> Figure 18 is a sequence diagram illustrating an example of the operation of the data processing system 1 in Embodiment 2. In this process, first, a user logged into the mobile terminal 101 operates the mobile terminal 101 to launch the print application 401 and instructs the mobile terminal 101 to search for an image forming machine. Upon receiving this instruction, the mobile terminal 101 searches for an image forming machine that is sending an advertised packet and displays the found image forming machine on the printer search screen in Figure 20(B) for user selection. When the user selects image forming machine 104 from the image forming machines displayed on the printer search screen, the mobile terminal 101 sends a print job to image forming machine 104. Subsequently, the mobile terminal 101 and image forming machine 104 communicate with each other and operate in a coordinated manner until the printing operation is completed by image forming machine 104, which has received the print job. In this embodiment, if the user selects either image forming machine 105 or 107 from the image forming machines displayed on the printer search screen, the same operation as that of image forming machine 104, as described below, will be performed on the selected image forming machine.

[0152] Furthermore, Embodiment 2 differs from Embodiment 1 in that it extracts UWBTAG information for registration with the authentication server 130 in the data processing system 1 from information contained in the print job data for the image forming apparatus 104. In other words, the information transmission route for registration with the authentication server 130 is different. This is because this embodiment allows for the application of a typical information transmission route for receiving job data from an external source in an image forming apparatus with diverse functions.

[0153] In the explanation using the sequence diagram shown in Figure 18 below, explanations that overlap with those in Embodiment 1 will be omitted. The operation flow shown in the sequence diagram of Figure 18 is realized by the hardware and software components that make up the mobile terminal 101, image forming apparatus 104, and authentication server 130 as described in Figures 2 to 6 above. Regarding the software components, the mobile terminal 101 operates by the CPU 202 executing a program loaded into RAM 204. The image forming apparatus 104 operates by the CPU 1201 executing a program loaded into RAM 1202. Similarly, the authentication server 130 operates by the CPU executing a program loaded into RAM.

[0154] <Launch print application> First, when the mobile terminal 101 receives a predetermined operation from the user, the CPU 202 of the mobile terminal 101 starts the print application 401 (step S701). Figure 19(A) shows the top menu screen that is displayed immediately after the print application 401 is started.

[0155] The top menu screen shown in Figure 19(A) is a user interface that accepts various input operations from the user and has buttons 801 to 804. Button 801 is a button that transitions to a screen for selecting the image forming apparatus to be printed. If no image forming apparatus is selected, a message indicating that it is not selected is displayed as shown for button 801. Button 802 is a button that transitions to a screen for selecting and printing a photo stored in the mobile terminal 101. Button 802 is ineffective when pressed if no image forming apparatus is selected for printing. Button 803 is a button that transitions to a screen for selecting and printing a file such as a PDF stored in the mobile terminal 101. Similar to button 802, button 803 is ineffective when pressed if no image forming apparatus is selected for printing. Button 804 is used to access the UWB authentication settings screen (Figure 19(B)) for setting up UWB authentication necessary for measuring the distance from the image forming machine to be printed and for authentication based on that distance, or the TAG settings screen (Figure 20(A)) for registering arbitrary UWBTAG information.

[0156] As shown in Figure 19(B), the UWB authentication setting screen has toggle buttons 821, 822, and 827, an authentication distance input field 823, and a screen switching button 824. Toggle button 821 (distance measurement authentication UI) accepts the selection of whether or not to perform authentication by UWB distance measurement. Toggle button 822 accepts the selection of whether to automatically set or manually set the distance conditions when performing authentication by UWB distance measurement. The authentication distance input field 823 accepts the input of a threshold X to be used for distance measurement determination in step S717 described later, when manual setting is selected with toggle button 822. Thus, the mobile terminal 101 has a UWB authentication setting screen, which is a user interface that allows input of distance conditions. Therefore, in this embodiment, it is possible to perform practical access control according to the positional relationship between the installation location of the image forming apparatus 104 and the movement of the user carrying the UWBTAG (mobile terminal 101, etc.) that is the target of distance measurement. The toggle button 827 accepts the selection setting (job execution setting) for whether or not to automatically execute the pending jobs upon successful UWB authentication. The job execution setting may also be an item in the selection settings on the print instruction screen shown in Figure 22. The screen switching button 824, when pressed by the user, transitions the screen from the UWB authentication setting screen (Figure 19(B)) to the TAG setting screen (Figure 20(A)).

[0157] As shown in Figure 20(A), the TAG setting screen is an input reception screen for registering any UWBTAG as an authentication TAG, and has toggle buttons 825a to 825c and toggle button 826. Any UWBTAG is a device capable of wireless communication as a UWBTAG, such as Apple's AirTag®, and can generally be any communication device consisting of a power source such as a battery, a UWB communication unit, a BLE communication unit, a memory unit, and a control IC such as a microcontroller. In this embodiment, any number of UWBTAGs independent of the mobile terminal 101 can be registered. The method for registering any UWBTAG is a general method, specifically, registration is performed by receiving UWBTAG information via GATT communication after performing BLE pairing. In addition, an arbitrary name can be entered when registering. As shown in Figure 20(A), the TAG setting screen is provided with registration toggle buttons 825a to 825b that display the name of each discovered UWBTAG. In Figure 20(A), a UWBTAG named "TAG001" is registered as a TAG for authentication when its toggle button 825a is turned ON by the user. The toggle button 826 accepts combination settings (AND / OR) when multiple UWBTAGs are selected as authentication targets from among the UWBTAGs registered on the TAG setting screen. The image forming apparatus 104 can treat not only the mobile terminal 101 but also any UWBTAGs registered in this way as targets for distance measurement via UWB communication.

[0158] <Printer Search> Returning to Figure 18, when the user presses button 801 on the top menu screen (Figure 19(A)) of the mobile terminal 101, the CPU 202 starts searching for image forming machines that are candidates for the print instruction target (data transmission destination) (step S702). Simultaneously with the start of this search, the display switches from the top menu screen to the printer search screen (Figure 20(B)), which sequentially displays the image forming machines that have been found.

[0159] In this embodiment, all image forming apparatuses 104 to 107 in the data processing system 1 are searched. However, as mentioned above, image forming apparatus 106 does not have a UWB, so below we will only describe the communication between image forming apparatuses 104, 105, and 107 and the mobile terminal 101.

[0160] When the search in step S702 begins, the CPU 202 first receives advertisement packets transmitted by the image forming apparatuses 104, 105, and 107 in the data processing system 1 shown in Figure 1 (step S703). Next, the CPU 202 performs pairing to establish an authentication connection for data communication between the mobile terminal 101 and each of the image forming apparatuses 104, 105, and 107 (step S704).

[0161] Next, information necessary for the printing application is exchanged between the mobile terminal 101 and the image forming apparatuses 104, 105, and 107 via GATT communication (step S705). The information exchanged includes the data structure and operation method of the image forming apparatuses 104, 105, and 107 as BLE devices, and is defined as a profile. In this embodiment, the UWBTAG information specific to the UWB communication unit 1273 of each image forming apparatus 104, 105, and 107, and the UWBTAG information specific to the UWB communication unit 218 of the mobile terminal 101 are also exchanged in this GATT communication. In addition, in this embodiment, communication capacity messages 910 are also exchanged between the mobile terminal 101 and each image forming apparatus 104, 105, and 107 in this GATT communication. The UWBTAG information of the image forming apparatuses 104, 105, and 107 and the communication capacity messages 910 may be attached to the advertisement packet.

[0162] In other words, during the processing in steps S703 to S705, communication setting information for UWB communication is exchanged between the mobile terminal 101 and the image forming apparatuses 104, 105, and 107 using BLE communication. This exchanged UWB communication setting information includes at least the address information of the packet destination included in the UWBTAG information, and the information on the role of UWB communication and the distance measurement method included in the communication capacity message 910.

[0163] Furthermore, through the processing in steps S703 to S705, at least the "model name" is obtained as a profile component for the basic image forming apparatus, and the "IP address" information is obtained as a profile component for the WiFi or other network communication device. This information is displayed in step S708, described later, as the respective device information for the image forming apparatuses 104, 105, and 107 in the device list 811 of the printer search screen (Figure 20(B)).

[0164] <Distance measurement request, distance measurement response> Next, the CPU 202 in the mobile terminal 101 sends a distance measurement request packet to the image forming apparatus 104 (step S706). The transmission of the distance measurement request packet is based on the UWB communication settings determined through the exchange of BLE communication capacity messages 910 and communication configuration messages 915, and the UWBTAG information transmitted from the image forming apparatus 104. The distance measurement request packet is a packet in the necessary format for performing TWR distance measurement as defined in the IEEE 802.15.4z standard shown in Figure 7. The distance measurement request packet includes at least distance measurement request identification information, requester address information, request destination address information, and an IEEE 802 compliant address.

[0165] Next, the image forming apparatus 104, having received the distance measurement request packet from the mobile terminal 101, transmits a distance measurement response packet to the mobile terminal 101 after a predetermined time has elapsed (step S707). Upon receiving the distance measurement response packet, the mobile terminal 101 determines the distance based on the TWR distance measurement method shown in Figure 7.

[0166] <Display device list> Next, in the mobile terminal 101, the CPU 202 displays a list of device information for the discovered image forming apparatus in the device list 811 of the printer search screen (Figure 20(B)) (step S708). The device information displayed here also includes distance information calculated based on the distance measurement response packets received from each of the discovered image forming apparatuses. The printer search screen also has an update button 812, as shown in Figure 20(B), and when the update button 812 is pressed, the CPU 202 re-executes steps S703 to S707. This allows the user to check the status changes of the discovered image forming apparatuses. The mobile terminal 101 also has buttons 810a and 810b, which are user interface buttons for setting the search frequency when performing this update periodically, and it is also possible to automatically update the device list display screen. Specifically, the user can increase the search frequency by pressing button 810a, which has an upward-pointing triangle mark, and decrease the search frequency by pressing button 810b, which has a downward-pointing triangle mark.

[0167] The printer search screen (Figure 20(B)) shows an example of the contents of the device list 811, which displays the device information of the searched image forming apparatus group. For each of the searched image forming apparatuses, the device information such as the model name, IP address, calculated distance information, and communication interface type icon is displayed. For example, the top row of the device list 811 displays the device information for image forming apparatus 104. Specifically, the model name is "C iR-3300-01", the IP address is "192.168.0.25", and the calculated distance information is "5.3m". In addition, the communication interface type icons UWB, BLE, and Wi-Fi are displayed.

[0168] The printer search screen is not limited to the configuration shown in Figure 20(B), as long as it allows the user to identify the attributes necessary to select an image forming machine (a candidate data destination) from the device list 811 to submit a print job. Users can pre-configure the attributes necessary to select an image forming machine to submit a print job on the search condition setting screen (Figure 21(A): Search Condition UI).

[0169] As shown in Figure 21(A), the search condition setting screen includes a wireless communication standard selection item 831 and a display order selection item 832. The wireless communication standard selection item 831 displays the wireless communication standard supported by the device being searched, allowing the user to select it as a condition for displaying the search results on the device list display screen. This allows the user to narrow down the devices being searched. The display order selection item 832 displays settings related to the display order of the search results, allowing the user to select them. In the illustrated example, there is a "distance" item that allows the user to select the order in which the devices are displayed, either in order of proximity to the device or distance, and a "search frequency" item that allows the user to select whether the search frequency is automatic or manual. When the "search frequency" item is set to "automatic," the default search frequency is set, and the update button 812 and buttons 810a and 810b are displayed in a user-selectable state on the device list display screen. On the other hand, when the "search frequency" item is set to "manual," buttons 810a and 810b are not user-selectable on the device list display screen, but the update button 812 is displayed in a user-selectable state. The search condition setting screen shown in Figure 21(A) is just one example; the user interface may include other selection items, allowing users to refine and arrange the search results according to their intentions.

[0170] <Printer selection accepted> Returning to Figure 18, the CPU 202 in the mobile terminal 101 then accepts the user's selection to search for one of the image forming apparatuses displayed in the device list 811 on the printer search screen (Figure 20(B)) (step S709). If the selection is accepted, the display switches from the device list display screen to the top menu screen (Figure 21(B)). The top menu screen is updated from the button 301 (Figure 19(A)) indicating that no printer has been selected to the printer selection field 801a (Figure 21(B)) indicating the selected printer.

[0171] <Print Output Settings> Next, the CPU 202 in the mobile terminal 101 receives a print command from the user (step S710). For example, when the CPU 202 receives a selection of button 802 to select a photo as the document file to be printed on the top menu screen (Figure 21(B)), the CPU 202 switches the display to the print settings screen (Figure 22). After that, the CPU 202 receives a print command from the user on the print settings screen (Figure 22). The user can also select button 803 on the top menu screen (Figure 21(B)) to select a file in data format such as Word or PDF as the document file to be printed.

[0172] The print instruction screen is a user interface for setting print settings for a document file (in this case, a photograph) selected by the user and issuing a print command. As shown in Figure 22, the print instruction screen has a preview unit 840, a device information display unit 841, a print settings button 842, and a print button 843. The preview unit 840 displays a preview of the document file (in this case, a photograph) selected by the user. The device information display unit 841 displays the device information of the image forming apparatus (in this case, image forming apparatus 104) to which the print command is to be issued, selected on the printer search screen (Figure 20(B)). The print settings button 842 is a button that, when pressed by the user, switches the display to a print settings screen (not shown) and accepts the print settings. On this print settings screen, the user sets the paper size, color mode, paper tray, number of copies, etc., and returns to the print instruction screen in Figure 22.

[0173] <Sending data for print jobs> Returning to Figure 18, in the mobile terminal 101, when the CPU 202 receives a press of the print button 843 on the print instruction screen (Figure 22), it generates a print job for printing the original file displayed in the preview unit 840. Next, the CPU 202 sends the job data of the generated print job to the image forming apparatus (in this case, the image forming apparatus 104) whose device information is displayed in the device information display unit 841 (step S711). After that, when returning to the top menu screen (Figure 19(A)), this process on the mobile terminal 101 side ends. The job data sent in step S711 has information of the destination (distance measurement target) for the distance measurement request in step S714, which will be described later, added to it and is sent to the image forming apparatus 104. Here, the distance measurement target information includes the UWBTAG information of the distance measurement target and the settings entered by the user on the UWB authentication setting screen (Figure 19(B)) (UWB authentication setting information).

[0174] The method for adding UWBTAG information, etc., to the job data transmitted in step S711 is not particularly limited. For example, UWBTAG information, etc., may be added to the header portion (not shown) of the job data itself transmitted in step S711. Alternatively, UWBTAG information, etc., may be added to any field of the packet used to transmit the job data.

[0175] Furthermore, although this embodiment describes a case where the information of the distance measurement target itself is attached to the job data as information for identifying the distance measurement target, it is not limited to this as long as the distance measurement target can be identified in step S712, which will be described later. For example, in the processing of steps S704 to S711, the login ID of the user currently logged in to the mobile terminal 101 may be transmitted as information for identifying the distance measurement target. In this case, in step S712, the distance measurement target is identified by obtaining the identification information of the UWBTAG of the distance measurement target associated with the acquired login ID from the user account list (Table 1).

[0176] The information transmitted in this manner makes it possible to transmit information about the UWBTAG to be measured, which is carried by the user, to the image forming apparatus 104. Here, we have described the case where the UWBTAG to be measured, which is carried by the user, is a mobile terminal 101, but this is not the only case. For example, if the user arbitrarily sets the UWBTAG to be measured on the TAG setting screen in Figure 20(A), the UWBTAG information of the set UWBTAG is added to the header of the job data.

[0177] Furthermore, the image forming apparatus 104 can register information for identifying the distance measurement target, obtained by extracting UWBTAG information contained in print job data, etc., with the authentication server 130 (step S732).

[0178] Note that the transmission of job data in step S711 is usually performed by handing over to a communication method with higher bandwidth than Wi-Fi or Ethernet.

[0179] As described above, in the process of searching for an image forming apparatus performed by the mobile terminal 101, the opposing device is identified and distance measured using BLE communication and UWB communication, and the results are used to present the user with a list of selectable device candidates. This allows the user to easily specify the destination device for job data and send it. Furthermore, along with the transmission of job data, UWBTAG information is also transmitted to the destination device to identify the distance measurement target (the source (mobile terminal 101) or another UWBTAG set by the user). This enables the destination device to measure the distance and position the distance measurement target using UWB.

[0180] The operations from step S713 onward are the same as those from step S815 onward in Figure 8 of Embodiment 1, so their explanation will be omitted.

[0181] In this embodiment, the data processing system 1 includes UWBTAG information to be used as the distance measurement target for the image forming apparatus 104 in the print job received from the mobile terminal 101. The UWBTAG information included in this print job is extracted and registered with the authentication server 130. Based on this registered UWBTAG information, the image forming apparatus 104 becomes the entity that measures the distance between itself and the distance measurement target and starts access control. The image forming apparatus 104 also stores a user account management area 509 associated with the user's login ID, password, and arbitrary UWBTAG information for authentication. This user account management area 509 is synchronized with the user account information of the authentication server 130. Therefore, a user can authenticate themselves with the image forming apparatus 104 simply by moving in the direction of the image forming apparatus 104 while carrying the mobile terminal 101 (or other UWBTAG set by the user). In other words, when performing distance-based authentication, which involves authentication based on the distance measured to the user's mobile device 101, the user can register the identification information necessary to identify the distance measurement target to the authentication server 130 with simple procedures and operations.

[0182] (Other embodiments) In this embodiment, the functionality can also be achieved by supplying a program that implements one or more functions to a computer of a system or device via a network or storage medium, and having the system control unit of that system or device read and execute the program. The system control unit may have one or more processors or circuits and may include a plurality of separate system control units or a network of a plurality of separate processors or circuits for reading and executing executable instructions. The processor or circuit may include a central processing unit (CPU), a microprocessing unit (MPU), a graphics processing unit (GPU), an application-specific integrated circuit (ASIC), or a field-programmable gate array (FPGA). The processor or circuit may also include a digital signal processor (DSP), a dataflow processor (DFP), or a neural processing unit (NPU).

[0183] It should be noted that the embodiments described above are merely examples of how the present invention can be implemented, and the technical scope of the present invention should not be interpreted as being limited by them. In other words, the present invention can be implemented in various forms without departing from its technical concept or its main features.

[0184] The disclosure of this embodiment includes the following configurations and methods, etc. (Composition 1) A data processing system having a portable communication device and an information processing device that can communicate with each other via wireless communication, A first authentication method that performs authentication based on information different from distance information, When authentication is performed by the first authentication means, a registration means registers the identification information relating to the distance measurement target in an authentication server that manages identification information for identifying the distance measurement target, A data processing system characterized by having a second authentication means that performs authentication based on distance information between the portable communication device and the information processing device obtained by distance measurement based on wireless communication using identification information relating to the registered distance measurement target. (Configuration 2) The data processing system according to Configuration 1, characterized in that the wireless communication is UWB (Ultra Wide Band) of the IEEE 802.15.4z standard. (Composition 3) The data processing system according to configuration 1 or 2, characterized in that the aforementioned identification information is information for identifying the TAG of UWB in the IEEE 802.15.4z standard. (Composition 4) The data processing system according to configuration 3, characterized in that the identification information includes at least information about the role in the UWB communication, information about the distance measurement method, and address information of the packet destination. (Composition 5) A data processing system according to any one of configurations 1 to 4, characterized in that the distance measurement based on wireless communication is TWR (Two-Way Range) distance measurement according to the IEEE 802.15.4z standard. (Composition 6) The data processing system according to any one of configurations 1 to 5, characterized in that the registration means causes the mobile communication device to access the authentication server based on encoded information for accessing the authentication server provided from the information processing device, and obtains the identification information relating to the mobile communication device to be registered. (Composition 7) The data processing system according to any one of configurations 1 to 5, characterized in that the registration means acquires identification information relating to the distance measurement target to be registered based on data received by the information processing device, which has information of the distance measurement target added to the job data to be executed by the information processing device. (Composition 8) The data processing system according to any one of configurations 1 to 5, characterized in that the registration means acquires identification information relating to the distance measurement target to be registered based on information communicated when establishing wireless communication by BLE (Bluetooth Low Energy) between the mobile communication device and the information processing device. (Composition 9) The data processing system according to any one of configurations 1 to 5, characterized in that the registration means acquires identification information relating to the distance measurement target to be registered based on the information communicated to the information processing device when performing NFC (Near Field Communication) authentication as authentication by the first authentication means. (Composition 10) The data processing system according to any one of configurations 1 to 9, characterized in that the authentication method by the first authentication means is an authentication method that includes at least one of the following: authentication by keyboard input, IC card authentication, and authentication linkage method using a single sign-on environment. (Composition 11) An information processing device capable of communicating with a portable communication device via wireless communication, A first authentication method that performs authentication based on information different from distance information, When authentication is performed by the first authentication means, a registration means registers the identification information relating to the distance measurement target in an authentication server that manages identification information for identifying the distance measurement target, An information processing device characterized by having a second authentication means that performs authentication based on distance information between the portable communication device and the information processing device obtained by distance measurement based on wireless communication using identification information relating to the registered distance measurement target. (Method 1) A control method for a data processing system having a portable communication device and an information processing device that can communicate with each other via wireless communication, The first authentication process involves performing authentication based on information different from distance information, When authentication is performed by the first authentication step, a registration step is performed in which the identification information relating to the distance measurement target is registered in an authentication server that manages identification information for identifying the distance measurement target, A control method characterized by comprising a second authentication step of performing authentication based on distance information between the portable communication device and the information processing device obtained by distance measurement based on wireless communication using identification information relating to the registered distance measurement target. (Method 2) A control method for an information processing device that can communicate with a portable communication device via wireless communication, The first authentication process involves performing authentication based on information different from distance information, When authentication is performed by the first authentication step, a registration step is performed in which the identification information relating to the distance measurement target is registered in an authentication server that manages identification information for identifying the distance measurement target, A control method characterized by comprising a second authentication step of performing authentication based on distance information between the portable communication device and the information processing device obtained by distance measurement based on wireless communication using identification information relating to the registered distance measurement target. (Program 1) A computer in an information processing device that can communicate with a portable communication device via wireless communication, The first authentication step involves performing authentication based on information different from distance information, When authentication is performed by the first authentication step, a registration step is performed to register the identification information relating to the distance measurement target with an authentication server that manages identification information for identifying the distance measurement target, A program for performing a second authentication step, which involves performing authentication based on distance information between the portable communication device and the information processing device obtained by distance measurement based on wireless communication using identification information relating to the registered distance measurement target. [Explanation of Symbols]

[0185] 1: Data processing system 101: Mobile terminal 104, 105, 107: Image forming apparatus 130: Authentication server

Claims

1. A data processing system having a portable communication device and an information processing device that can communicate with each other via wireless communication, A first authentication means that performs authentication based on information different from distance information, When authentication is performed by the first authentication means, a registration means registers the identification information relating to the distance measurement target in an authentication server that manages identification information for identifying the distance measurement target, A data processing system characterized by having a second authentication means that performs authentication based on distance information between the portable communication device and the information processing device obtained by distance measurement based on wireless communication using identification information relating to the registered distance measurement target.

2. The data processing system according to claim 1, characterized in that the wireless communication is UWB (Ultra Wide Band) according to the IEEE 802.15.4z standard.

3. The data processing system according to claim 1, characterized in that the identification information is information for identifying the TAG of UWB in the IEEE 802.15.4z standard.

4. The data processing system according to claim 3, characterized in that the identification information includes at least information about the role in the UWB communication, information about the distance measurement method, and address information of the packet destination.

5. The data processing system according to claim 1, characterized in that the distance measurement based on wireless communication is TWR (Two-Way Ranging) distance measurement according to the IEEE 802.15.4z standard.

6. The data processing system according to claim 1, characterized in that the registration means causes the mobile communication device to access the authentication server based on encoded information for accessing the authentication server provided from the information processing device, and obtains the identification information relating to the mobile communication device to be registered.

7. The data processing system according to claim 1, characterized in that the registration means acquires identification information relating to the distance measurement target to be registered based on data received by the information processing device, in which information of the distance measurement target is added to job data to be executed by the information processing device.

8. The data processing system according to claim 1, characterized in that the registration means acquires identification information relating to the distance measurement target to be registered based on information communicated when establishing wireless communication by BLE (Bluetooth Low Energy) between the mobile communication device and the information processing device.

9. The data processing system according to claim 1, characterized in that the registration means acquires identification information relating to the distance measurement target to be registered based on information communicated to the information processing device as NFC (Near Field Communication) authentication by the first authentication means.

10. The data processing system according to claim 1, characterized in that the authentication method by the first authentication means is an authentication method that includes at least one of the following: authentication by keyboard input, IC card authentication, and authentication linkage method using a single sign-on environment.

11. An information processing device capable of communicating with a portable communication device via wireless communication, A first authentication means that performs authentication based on information different from distance information, When authentication is performed by the first authentication means, a registration means registers the identification information relating to the distance measurement target in an authentication server that manages identification information for identifying the distance measurement target, An information processing device characterized by having a second authentication means that performs authentication based on distance information between the portable communication device and the information processing device obtained by distance measurement based on wireless communication using identification information relating to the registered distance measurement target.

12. A control method for a data processing system having a portable communication device and an information processing device that can communicate with each other via wireless communication, The first authentication process involves performing authentication based on information different from distance information, When authentication is performed by the first authentication step, a registration step is performed in which the identification information relating to the distance measurement target is registered in an authentication server that manages identification information for identifying the distance measurement target, A control method characterized by comprising a second authentication step of performing authentication based on distance information between the portable communication device and the information processing device obtained by distance measurement based on wireless communication using identification information relating to the registered distance measurement target.

13. A control method for an information processing device that can communicate with a portable communication device via wireless communication, The first authentication process involves performing authentication based on information different from distance information, When authentication is performed by the first authentication step, a registration step is performed in which the identification information relating to the distance measurement target is registered in an authentication server that manages identification information for identifying the distance measurement target, A control method characterized by comprising a second authentication step of performing authentication based on distance information between the portable communication device and the information processing device obtained by distance measurement based on wireless communication using identification information relating to the registered distance measurement target.

14. A computer in an information processing device that can communicate with a portable communication device via wireless communication, The first authentication step involves performing authentication based on information different from distance information, When authentication is performed by the first authentication step, a registration step is performed to register the identification information relating to the distance measurement target with an authentication server that manages identification information for identifying the distance measurement target, A program for performing a second authentication step, which involves performing authentication based on distance information between the portable communication device and the information processing device obtained by distance measurement based on wireless communication using identification information relating to the registered distance measurement target.

Images