Information processing device, information processing system, and information processing program

Abstract

To provide an information processing apparatus, an information processing system, and an information processing program with which even a device having no authentication function to authenticate a user is allowed to restrict execution of a plug-in to a regular user.SOLUTION: When execution of a plug-in 58 is requested to an image forming apparatus 12 from an application A66 having no authorization information 70, an authorization unit 52 determines that a user who uses the apparatus is not a regular user, and a plug-in execution unit 54 performs control of inhibiting the execution of the plug-in 58. Meanwhile, when the execution of the plug-in 58 is requested to the image forming apparatus 12 from an application B68 having the authorization information 70, the authorization unit 52 collates authorization information 62 with the authorization information 70, and when the authorization information 70 in the application B68 matches or corresponds to the authorization information 62, permits the request to execute the plug-in 58, and the plug-in execution unit 54 performs control of executing the plug-in 58.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present invention relates to an information processing device, an information processing system, and an information processing program. [Background technology]

[0002] Patent document 1 proposes that when printing to a desired device using a function added to a printer driver of an information processing device, it is determined whether or not the device has the function, and if it does not, it adds the function to the device using an installation package for printer installation of the function, and then deletes the function from the device after printing using the function is completed.

[0003] Patent Document 2 proposes a program for installing a driver plug-in for a printer driver corresponding to a function plug-in for executing a function of an image forming device, and expanding the function of the printer driver. In detail, the program causes a computer to execute the following steps when the driver plug-in is installed: a request step for making a request to the image forming device for sending plug-in identification information for identifying the function plug-in and user authentication information, an acquisition step for acquiring a result indicating whether the function plug-in indicated by the plug-in identification information can be used in the image forming device by the user indicated by the user authentication information, and an installation step for starting installation of the driver plug-in if the acquired result indicates that it can be used.

[0004] Patent Document 3 proposes an image forming device that installs a function plug-in. In detail, the image forming device includes a management means for managing availability information indicating whether or not a user can use the function plug-in, a receiving means for receiving plug-in identification information and user authentication information for identifying the function plug-in from a first information processing device, a determination means for determining, when authentication is successful using the received user authentication information, whether or not the function plug-in indicated by the plug-in identification information may be used for the successfully authenticated user using the availability information, a transmission means for transmitting the determination result that approval is required to the first information processing device, a creation means for creating an approval screen on the Web that allows approval when an approval request is received from the first information processing device, and a transmission means for transmitting the URL of the approval screen to the second information processing device.

[0005] Patent Document 4 proposes an application program that acquires authentication data from a plug-in, determines whether the acquired authentication data is registered in a data table, and if the acquired authentication data is registered in the data table, judges the plug-in to be valid and passes confidential data to the plug-in, and if the acquired authentication data is not registered in the data table, judges the plug-in to be invalid and does not pass confidential data to the plug-in. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] JP 2012-27823 A [Patent Document 2] JP 2011-154473 A [Patent Document 3] JP 2012-8736 A [Patent Document 4] JP 2007-122603 A Summary of the Invention [Problem to be solved by the invention]

[0007] Plugins are common to devices that have an authentication function for authenticating users and devices that do not. Therefore, if the plug-in is an API (Application Programming Interface) that allows external access, when the plug-in is installed on a device that does not have an authentication function for authenticating users, it becomes possible for a malicious person to execute the plug-in and manipulate the device. For example, there is a possibility that the device will be restarted multiple times.

[0008] Therefore, an object of the present invention is to provide an information processing device, an information processing system, and an information processing program that are capable of restricting the execution of plug-ins to authorized users even in a device that does not have an authentication function for authenticating users. [Means for solving the problem]

[0009] In order to achieve the above object, an information processing device according to a first aspect includes a processor, and when executing a plug-in that extends access from an external device, the processor: When the device does not have an authentication function for authenticating a user who uses the device, the target authorization information to be compared is The authorization information is received from a source of a request to execute the plug-in, and processing is performed to control whether or not the plug-in can be executed, using predetermined authorization information unique to the plug-in and the target authorization information. In addition, an information processing device according to a second aspect includes a processor, and when executing a plug-in that extends access from outside and that is installed in the device as a plug-in package including a setting function for setting whether to prioritize an authentication function for authenticating a user using the device, or to prioritize a process using predetermined authorization information unique to the plug-in and target authorization information that is to be compared by a source of an execution request for the plug-in, the processor receives the target authorization information, and controls whether or not to execute the plug-in using the authorization information and the target authorization information, and, if the authentication function is present, performs a process of controlling whether or not to execute the plug-in using the authentication function. In addition, an information processing device according to a third aspect includes: The apparatus includes a processor, and when the processor is a plug-in that extends access from the outside and has an authentication function that individually handles general users and administrators as an authentication function for authenticating a user who uses the apparatus, the processor receives target authorization information to be compared from a source that requests execution of the plug-in when executing the plug-in that is installed in the apparatus as a plug-in package including an authentication setting function that sets whether authentication is to be performed as a general user or an administrator, and controls whether or not to execute the plug-in using unique, predetermined authorization information possessed by the plug-in and the target authorization information, and when the processor has an authentication function for authenticating a user who uses the apparatus, performs processing to control whether or not to execute the plug-in using the authentication function. . In addition, an information processing device according to a fourth aspect includes: The processor receives target authorization information to be compared from a source requesting execution of the plug-in when the plug-in that extends access from outside is executed, and performs a process of controlling whether or not to issue a predetermined access token as a permission or not to execute the plug-in, using predetermined authorization information unique to the plug-in and the target authorization information. .

[0010] Also, 5 The information processing device according to the embodiment is Any one of the first to fourth aspects In an information processing device relating to the aspect, when requesting execution of the plug-in, the processor performs processing to receive the target authorization information from the source of the plug-in execution request by requesting the target authorization information from the source of the plug-in execution request.

[0011] Also, 6The information processing device according to the embodiment is 5 In an information processing device according to an aspect, the processor performs processing to request the target authorization information from a source that requests execution of the plug-in when the device does not have an authentication function for authenticating a user who uses the device.

[0012] Also, 7 The information processing device according to the embodiment is a first embodiment Or the fourth aspect In the information processing device according to the above, when the information processing device has an authentication function for authenticating a user who uses the device, the processor performs processing for controlling whether or not the plug-in is to be executed by the authentication function.

[0013] Also, 8 The information processing device according to the embodiment is 7 In an information processing device relating to the aspect, the plug-in is installed in the device as a plug-in package that includes a setting function that sets whether to prioritize the authentication function or to prioritize processing using the authorization information and the target authorization information.

[0014] Also, 9 The information processing device according to the embodiment is 7 Mode or number 8 In an information processing device relating to the aspect, the plug-in is installed on the device as a plug-in package that includes an authentication setting function for setting whether authentication will be performed by a general user or an administrator when the authentication function has an authentication function for treating general users and administrators separately.

[0017] Also, 1 The information processing device according to the third aspect is 3 In the information processing device according to any one of the aspects, whether or not the plug-in can be executed is whether or not a predetermined access token can be issued.

[0018] Also, the first 1 An information processing system according to an aspect includes the above-mentioned information processing device, and a terminal device that requests the information processing device to execute the plug-in and transmits the target authorization information to the information processing device.

[0019] Also, the first 2 The information processing program according to the embodiment includes: The information processing device according to any one of the first to tenth aspects . Effect of the Invention

[0020] According to the first aspect, it is possible to provide an information processing device capable of restricting execution of plug-ins to authorized users even in a device that does not have an authentication function for authenticating users. In addition, in a device that does not have an authentication function for authenticating a user, the execution of the plug-in can be restricted to authorized users. do. According to the second aspect, it is possible to provide an information processing device capable of restricting the execution of plug-ins to legitimate users even in a device that does not have an authentication function for authenticating a user. When an authentication function for authenticating a user is present, it is possible to ensure security compared to a case in which the authentication function for authenticating a user is not used. It is also possible to set, for each plug-in, whether to prioritize the authentication function for authenticating a user or to prioritize processing using authorization information and target authorization information. According to the third aspect, it is possible to provide an information processing device that can restrict the execution of plug-ins to legitimate users even in a device that does not have an authentication function for authenticating users. When there is an authentication function for authenticating users, it is possible to ensure security compared to a case in which the authentication function for authenticating users is not used, and it is possible to set whether authentication will be performed by a general user or an administrator for each plug-in. According to the fourth aspect, it is possible to provide an information processing device that can restrict the execution of plug-ins to authorized users even in a device that does not have an authentication function for authenticating users, and it is also possible to issue an access token to an authorized user even in a device that does not have an authentication function for authenticating users.

[0021] No. 5 According to the aspect, it is possible to obtain the target authorization information at the required timing.

[0022] No. 6 According to the aspect, in a device that does not have an authentication function for authenticating a user, execution of a plug-in can be restricted to authorized users.

[0023] No. 7 According to the aspect, when there is an authentication function for authenticating a user, it is possible to ensure security compared to when the authentication function for authenticating a user is not used.

[0024] No. 8 According to this aspect, it is possible to set whether to give priority to an authentication function for authenticating a user or to give priority to a process using authorization information and target authorization information for each plug-in.

[0025] No. 9 According to this aspect, it is possible to set whether authentication is to be performed by a general user or an administrator for each plug-in.

[0028] No. 10 According to this aspect, even a device that does not have an authentication function for authenticating a user can issue an access token to a legitimate user.

[0029] No. 1 1 According to the aspect, it is possible to provide an information processing system capable of restricting execution of plug-ins to authorized users even in a device that does not have an authentication function for authenticating users.

[0030] No. 1 2 According to the aspects, it is possible to provide an information processing device, an information processing system, and an information processing program that are capable of restricting execution of plug-ins to authorized users even in a device that does not have an authentication function for authenticating users. [Brief description of the drawings]

[0031] [Figure 1] 1 is a diagram showing a schematic configuration of an information processing system according to a first embodiment. [Diagram 2] 2 is a block diagram showing a configuration of a main part of an electrical system of the image forming apparatus in the information processing system according to the first embodiment. FIG. [Diagram 3] 2 is a block diagram showing a configuration of a main part of an electrical system of the mobile terminal device in the information processing system according to the first embodiment. FIG. [Figure 4] 2 is a functional block diagram showing a functional configuration of a control unit of the image forming apparatus according to the first embodiment. FIG. [Diagram 5] 10 is a flowchart showing an example of a processing flow when an application is operated in the mobile terminal device of the information processing system according to the first embodiment to request the image forming apparatus to execute a plug-in. [Figure 6] 11 is a flowchart showing an example of the flow of processing performed in the image forming apparatus when a plug-in execution request is made from the mobile terminal apparatus in the information processing system according to the first embodiment. [Figure 7] 13 is a flowchart showing an example of the flow of authorization processing based on account information. [Figure 8] 10 is a flowchart showing an example of the flow of processing performed in the mobile terminal device in response to authorization processing based on account information performed in the image forming device in the information processing system according to the first embodiment. [Figure 9]13 is a flowchart showing an example of the flow of authorization processing by plug-in authorization. [Figure 10] 10 is a flowchart showing an example of the flow of processing performed in the mobile terminal device in response to authorization processing based on plug-in authorization information performed in the image forming device in the information processing system according to the first embodiment. [Figure 11] 13 is a flowchart showing a first modified example of the flow of processing performed in the image forming apparatus when a plug-in execution request is made from the mobile terminal apparatus in the information processing system according to the first embodiment. [Figure 12] FIG. 13 is a diagram showing an example of a configuration in an image forming device that has general user account information and administrator account information and is capable of authentication using a general user account and authentication using an administrator account, in which a setting file is set for each plug-in as to whether authorization is to be given using a general user account or an administrator account. [Figure 13] 13 is a flowchart showing a second modified example of the flow of processing performed in the image forming apparatus when a plug-in execution request is made from the mobile terminal apparatus in the information processing system according to the first embodiment. [Figure 14] FIG. 11 is a diagram showing a schematic configuration of an information processing system according to a second embodiment. [Figure 15] FIG. 1 is a diagram illustrating a known resource server that manages personal information of users and provides a web API using access tokens. [Figure 16] FIG. 11 is a functional block diagram showing the functional configuration of a server in an information processing system according to a second embodiment. [Figure 17] 13 is a flowchart showing an example of a processing flow when an application is operated to request the server to execute a plug-in in a mobile terminal device of an information processing system according to a second embodiment. [Figure 18] 13 is a flowchart showing an example of the flow of processing performed by a server when a plug-in execution request is made from a mobile terminal device in an information processing system according to a second embodiment. [Figure 19]13 is a flowchart showing an example of the flow of an access token issuing process based on plug-in authorization information. [Figure 20] 13 is a flowchart showing an example of the flow of processing performed by the mobile terminal device 14 in response to access token issuing processing based on plug-in authorization information. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0032] (First embodiment) An example of an embodiment of the present invention will be described in detail below with reference to the drawings. Fig. 1 is a diagram showing a schematic configuration of an information processing system according to this embodiment.

[0033] The information processing system 10 according to the present embodiment includes an image forming device 12 as an example of an information processing device, and a mobile terminal device 14.

[0034] The mobile terminal device 14 is capable of communicating with the image forming apparatus 12 through short-range communication, and the image forming apparatus 12 can be operated from the mobile terminal device 14. For example, a tablet terminal or a smartphone is used as the mobile terminal device 14. Wi-Fi (registered trademark), Bluetooth (registered trademark), etc. are used as short-range communication.

[0035] As an example of the image forming device 12, an image forming device having multiple functions such as a facsimile function, an image reading function, an image forming function, a copying function, a storage function for storing image information, etc., and a transmission function for transmitting image information, etc. Although one image forming device 12 is shown in Fig. 1, the number is not limited to one and may be two or more. Although one mobile terminal device 14 is shown in Fig. 1, the number is not limited to one and may be two or more, and those owned by each user may be applied.

[0036] In addition, although the communication between the mobile terminal device 14 and the image forming device 12 is described as short-range communication, as shown by the dotted line in FIG. 1, the communication may be performed via a wireless base station of a mobile phone network or the like or a communication line 16 of various networks (e.g., LAN, WAN, Ethernet (registered trademark), etc.).

[0037] FIG. 2 is a block diagram showing the configuration of a main part of an electrical system of the image forming apparatus 12 in the information processing system 10 according to this embodiment.

[0038] 2, the image forming apparatus 12 according to this embodiment includes a control unit 20 including a central processing unit (CPU) 20A, a read only memory (ROM) 20B, and a random access memory (RAM) 20C. The CPU 20A controls the overall operation of the image forming apparatus 12. The RAM 20C is used as a work area when the CPU 20A executes various programs. The ROM 20B stores various control programs, various parameters, and the like in advance. In the image forming apparatus 12, each component of the control unit 20 is electrically connected to each other via a system bus 42.

[0039] On the other hand, the image forming apparatus 12 according to the present embodiment includes a HDD (hard disk drive) 26 that stores various data, application programs, and the like. The image forming apparatus 12 is also connected to a user interface 22 and includes a display control unit 28 that controls the display of various operation screens, etc. on the display of the user interface 22. The image forming apparatus 12 is also connected to the user interface 22 and includes an operation input detection unit 30 that detects operation instructions input via the user interface 22. In the image forming apparatus 12, the HDD 26, the display control unit 28, and the operation input detection unit 30 are electrically connected to a system bus 42. In the image forming apparatus 12 according to the present embodiment, the HDD 26 is used as a storage unit, but this is not limiting, and a non-volatile storage unit such as a flash memory may be used.

[0040] The image forming apparatus 12 according to the present embodiment also includes a reading control unit 32 that controls the optical image reading operation by the document reading unit 44 and the document feeding operation by the document transport unit, and an image forming control unit 34 that controls the image forming process by the image forming unit 24 and the transport of paper to the image forming unit 24 by the transport unit 25. The image forming apparatus 12 also includes a communication line I / F (interface) unit 36 ​​that transmits and receives communication data to and from other external devices connected to the communication lines 16 of various networks, and transmits and receives communication data by short-distance communication to and from the mobile terminal device 14. The image forming apparatus 12 also includes a facsimile I / F (interface) unit 38 that is connected to a telephone line (not shown) and transmits and receives facsimile data to and from a facsimile device connected to the telephone line. The image forming apparatus 12 also includes a transmission / reception control unit 40 that controls the transmission and reception of facsimile data via the facsimile I / F unit 38. In the image forming apparatus 12, the transmission / reception control unit 40, the reading control unit 32, the image forming control unit , the communication line I / F unit , and the facsimile I / F unit are electrically connected to a system bus .

[0041] With the above configuration, the image forming apparatus 12 according to the present embodiment executes access to the RAM 20C, the ROM 20B, and the HDD 26 by the CPU 20A. The image forming apparatus 12 also executes control of display of information such as an operation screen and various messages on the display 22A of the user interface 22 via the display control unit 28 by the CPU 20A. The image forming apparatus 12 also executes control of operation of the document reading unit 44 and the document transport unit via the reading control unit 32 by the CPU 20A. The image forming apparatus 12 also executes control of operation of the image forming unit 24 and the transport unit 25 via the image formation control unit 34, and control of transmission and reception of communication data via the communication line I / F unit 36 ​​by the CPU 20A. The image forming apparatus 12 also executes control of transmission and reception of facsimile data via the facsimile I / F unit 38 by the transmission and reception control unit 40 by the CPU 20A. Furthermore, in the image forming apparatus 12, the CPU 20A grasps the operation content in the user interface 22 based on the operation information detected by the operation input detection unit 30, and executes various controls based on the operation content.

[0042] Next, a description will be given of the main configuration of the electrical system of the mobile terminal device 14 according to this embodiment. Fig. 3 is a block diagram showing the main configuration of the electrical system of the mobile terminal device 14 in the information processing system 10 according to this embodiment.

[0043] As shown in FIG. 3, the mobile terminal device 14 according to the present embodiment includes a CPU 14A as an example of a processor, a ROM 14B, a RAM 14C, a storage 14D, an operation unit 14E, a display unit 14F, a communication line I / F (interface) unit 14G, and a photographing unit 14H. The CPU 14A controls the overall operation of the mobile terminal device 14. The ROM 14B stores various control programs and various parameters in advance. The RAM 14C is used as a work area when the CPU 14A executes various programs. The storage 14D stores various data and application programs. The operation unit 14E is used to input various information. The display unit 14F is used to display various information. The photographing unit 14H outputs image information obtained by photographing. The communication line I / F unit 14G transmits and receives various data to and from other devices connected to communication lines such as various networks. The communication line I / F unit 14G also transmits and receives various data to and from the mobile terminal device 14 using various well-known wireless communications. The above-described components of the mobile terminal device 14 are electrically connected to each other via a system bus 141. In the mobile terminal device 14 according to the present embodiment, the storage 14D is used as a storage unit, and various non-volatile storage units such as an HDD (Hard Disk Drive) and a flash memory are used as the storage 14D, for example.

[0044] With the above configuration, the mobile terminal device 14 according to this embodiment executes, by the CPU 14A, access to the ROM 14B, the RAM 14C, and the storage 14D, acquisition of various data via the operation unit 14E, photographing by the photographing unit 14H, and display of various information on the display unit 14F. In addition, the mobile terminal device 14 executes, by the CPU 14A, control of transmission and reception of communication data via the communication line I / F unit 14G.

[0045] Next, there will be described a functional configuration of the control unit 20 of the image forming apparatus 12. Fig. 4 is a functional block diagram showing a functional configuration of the control unit 20 of the image forming apparatus 12 according to this embodiment.

[0046] The control unit 20 has the functions of a plug-in management section 50 by the CPU 20A executing a program stored in the ROM 20B.

[0047] The plug-in management unit 50 has the functions of an authorization unit 52 and a plug-in execution unit 54 as functions for managing plug-ins 58 installed in the image forming apparatus 12 .

[0048] The authorization unit 52 performs authorization using the account information 64 in response to an external request to execute the plug-in 58. When executing the plug-in 58 that extends access from the outside, the authorization unit 52 receives authorization information 70 as target authorization information to be compared from the source of the execution request for the plug-in 58, and determines whether or not to execute the plug-in using predetermined authorization information 62 unique to the plug-in 58 and the received authorization information 70. As an example, if the image forming apparatus 12 has an authentication function for authenticating a user, the authorization unit 52 performs authentication using the account information 64, and if the image forming apparatus 12 does not have an authentication function for authenticating a user, the authorization unit 52 determines whether or not the user is a legitimate user using the authorization information 62 unique to the plug-in 58 and the authorization information 70 acquired from the source of the execution request for the external plug-in 58, and performs authorization for the execution request for the plug-in 58.

[0049] The plug-in execution unit 54 controls the execution of the plug-in 58 installed as the plug-in package 56 according to the authorization result of the authorization unit 52 .

[0050] The plug-in package 56 includes a plug-in 58, a setting file 60 as an example of a setting function, and authorization information 62, and is installed in the image forming apparatus 12 by an administrator of the image forming apparatus 12 or the like.

[0051] In this embodiment, the plug-in 58 has a function of expanding access from outside the image forming apparatus 12. By executing the plug-in 58 from outside, it becomes possible to execute a predetermined function of the image forming apparatus 12.

[0052] The setting file 60 is a file in which settings related to the execution of the plug-in 58 are stored, and it is possible to set, for example, whether to give priority to authorization based on account information or authorization based on authorization information. In this embodiment, the plug-in is installed with the setting file 60 set for each plug-in, but the setting contents of the setting file 60 may be changeable after installation. Note that the plug-in package 56 may be configured to omit the setting file 60, that is, to include the plug-in 58 and the authorization information 62.

[0053] The authorization information is information specific to the plug-in 58, and is, for example, a predetermined number of character strings including numbers, symbols, and the like.

[0054] In this embodiment, when an application A66 that does not have authorization information 70 requests the image forming device 12 to execute a plug-in 58, the authorization unit 52 determines that the user is not a legitimate user, and the plug-in execution unit 54 performs control to prohibit the execution of the plug-in 58.

[0055] On the other hand, when application B 68 having authorization information 70 requests image forming apparatus 12 to execute plug-in 58, authorization unit 52 compares authorization information 62 of plug-in package 56 with authorization information 70 of application B 68. Then, when authorization information 70 of application B 68 matches authorization information 62, the execution request of plug-in 58 is authorized, and plug-in execution unit 54 controls execution of plug-in 58. Note that the execution request of plug-in 58 may be authorized when authorization information 70 of application B 68 corresponds to authorization information 62.

[0056] In this embodiment, the application B 68 stores the permission information 70. However, the permission information 70 may be input by the user via the operation unit 14E of the mobile terminal device 14.

[0057] Next, specific processes performed in each unit of the information processing system 10 according to this embodiment will be described.

[0058] As a preparation for each unit of information processing system 10 to perform processing, an administrator installs plug-in package 56 in advance in image forming apparatus 12. For example, the ID of plug-in 58 is set to 10000000. In addition, a user installs an application in mobile terminal device 14, and registers account information 64 in image forming apparatus 12.

[0059] First, a process will be described when, after advance preparation, an application on the mobile terminal device 14 is operated to request the image forming device 12 to execute the plug-in 58. Fig. 5 is a flowchart showing an example of a process flow when an application is operated on the mobile terminal device 14 of the information processing system 10 according to this embodiment to request the image forming device 12 to execute the plug-in 58. The process in Fig. 5 starts, for example, when an instruction is given to start the application on the mobile terminal device 14.

[0060] In step 100, the CPU 14A starts an application designated by the user, and the process proceeds to step .

[0061] In step 102, the CPU 14A judges whether or not execution of the plug-in 58 has been instructed. For example, it judges whether or not an operation such as a copy job execution button of an application has been performed. If the judgment is negative, the process ends and other processes are performed. On the other hand, if the judgment is positive, the process proceeds to step 104.

[0062] In step 104, CPU 14A requests image forming apparatus 12 to execute the plug-in, and the process proceeds to step 106. In this embodiment, step 104 is performed, for example, when a user approaches image forming apparatus 12 and short-range communication is established; however, when short-range communication is not established, communication may be established via communication line 16.

[0063] In step 106, CPU 14A ends the process of transmitting the plug-in ID to image forming apparatus 12 to request execution of plug-in 58. For example, a plug-in execution instruction for plug-in ID: 10000000 is transmitted.

[0064] Next, a process performed by the image forming apparatus 12 when a plug-in execution request is made from the mobile terminal device 14 will be described. Fig. 6 is a flow chart showing an example of the flow of processes performed by the image forming apparatus 12 when a plug-in execution request is made from the mobile terminal device 14 in the information processing system 10 according to this embodiment. The process in Fig. 6 starts when a plug-in ID is transmitted from the mobile terminal device 14 to the image forming apparatus 12 in step 106 described above.

[0065] In step 200, the CPU 20A receives the plug-in ID to be executed from the application, and proceeds to step 202. That is, the plug-in ID transmitted from the mobile terminal device 14 in the above-mentioned step 106 is received.

[0066] In step 202, CPU 20A determines whether image forming apparatus 12 has an authentication function for authenticating a user by a login function. If the determination is affirmative, the process proceeds to step 204, and if not, the process proceeds to step 206.

[0067] In step 204, the CPU 20A completes the series of processes by performing authorization processing based on the account information 64. Details of the authorization processing based on the account information 64 will be described later.

[0068] On the other hand, in step 206, the CPU 20A performs authorization processing based on the plug-in authorization information, and ends the series of processes. Note that the authorization processing based on the plug-in authorization information will also be described in detail later.

[0069] Here, a detailed explanation will be given of the authorization process based on the account information in the above-mentioned step 204. Fig. 7 is a flowchart showing an example of the flow of the authorization process based on the account information.

[0070] In step 300 , the CPU 20 A requests account information from the application of the mobile terminal device 14 , and then the process proceeds to step 302 .

[0071] In step 302, the CPU 20A judges whether or not the account information has been received from the mobile terminal device 14. The CPU 20A waits until the judgment is affirmative, and then proceeds to step 304. If a cancel operation or the like is performed from the mobile terminal device 14 during the wait, the process ends, and if another operation is instructed, the process ends and proceeds to another process.

[0072] In step 304, CPU 20A determines whether the account information matches. That is, the account information stored in image forming apparatus 12 is compared with the account information received from mobile terminal device 14 to determine whether authorization for execution of plug-in 58 has been granted. If the determination is negative, the process proceeds to step 306, and if the determination is positive, the process proceeds to step 308.

[0073] In step 306, CPU 20A notifies the user of the failure of plug-in execution and ends the series of processes. For example, by notifying mobile terminal device 14 of the failure of plug-in execution, the user is notified by displaying on display unit 14F of mobile terminal device 14 that plug-in 58 cannot be executed.

[0074] On the other hand, in step 308, CPU 20A executes the specified plug-in and ends the series of processes.

[0075] Next, a description will be given of the processing performed by the mobile terminal device 14 in response to the authorization processing based on the account information performed in the image forming device 12. Fig. 8 is a flowchart showing an example of the flow of processing performed by the mobile terminal device 14 in response to the authorization processing based on the account information performed in the image forming device 12 in the information processing system 10 according to this embodiment. Note that the processing in Fig. 8 starts when account information is requested from the image forming device 12 in step 300 described above.

[0076] In step 400 , the CPU 14 A receives a request for account information sent from the image forming apparatus 12 , and the process proceeds to step 402 .

[0077] In step 402, the CPU 14A displays a predetermined login screen for authenticating the user on the display unit 14F, and then the process proceeds to step 404.

[0078] In step 404, the CPU 14A determines whether or not account information has been input on the login screen by operating the operation unit 14E. If no account information has been input and another operation such as cancel has been performed, the series of processes ends. On the other hand, if it is determined that the account information has been input, the process proceeds to step 406.

[0079] In step 406, CPU 14A transmits the input account information to image forming apparatus 12 that has made the request, and ends the series of processes.

[0080] Next, the authorization process based on the plug-in authorization information will be described in detail below. Fig. 9 is a flowchart showing an example of the flow of authorization process based on plug-in authorization.

[0081] In step 500 , the CPU 20 A requests plug-in authorization information from the application of the mobile terminal device 14 , and then the process proceeds to step 502 .

[0082] In step 502, the CPU 20A judges whether or not authorization information has been received from the mobile terminal device 14. The CPU 20A waits until the judgment is affirmative, and proceeds to step 504. Note that if authorization information has not been received even after a predetermined time has elapsed, the process may be terminated.

[0083] In step 504, CPU 20A determines whether authorization information 62 in plug-in package 56 matches authorization information 70 received from mobile terminal device 14. That is, authorization information 62 of plug-in 58 is compared with authorization information 70 of the application in mobile terminal device 14 to control whether plug-in 58 can be executed. If the determination is negative, the process proceeds to step 506, and if the determination is positive, the process proceeds to step 508.

[0084] In step 506, CPU 20A notifies the user of the failure of plug-in execution and ends the series of processes. For example, by notifying mobile terminal device 14 of the failure of plug-in execution, the user is notified by displaying on display unit 14F of mobile terminal device 14 that the plug-in cannot be executed.

[0085] On the other hand, in step 508, CPU 20A executes the specified plug-in and ends the series of processes.

[0086] Next, a description will be given of the processing performed by the mobile terminal device 14 in response to the authorization processing based on the plug-in authorization information performed in the image forming device 12. Fig. 10 is a flowchart showing an example of the flow of processing performed by the mobile terminal device 14 in response to the authorization processing based on the plug-in authorization information performed in the image forming device 12 in the information processing system 10 according to this embodiment. The processing in Fig. 10 starts when the plug-in authorization information is requested from the image forming device 12 in step 500 described above.

[0087] In step 600 , the CPU 14 A receives a plug-in authorization information request sent from the image forming apparatus 12 , and the process proceeds to step 602 .

[0088] In step 602, the CPU 14A reads the authorization information 70 given to the application, and proceeds to step 604. If the authorization information 70 is not present, the process ends and execution of the plug-in is disabled.

[0089] In step 606, the CPU 14A transmits the read authorization information 70 to the image forming apparatus 12, and then the series of processes ends.

[0090] Incidentally, in this embodiment, by providing a configuration file 60 in the plug-in package 56, even an image forming device 12 having an authentication function for authenticating a user can individually set whether authorization is based on user account information or on plug-in authorization information.

[0091] For example, by setting which one is to be given priority in the setting file 60, the setting file is read and processing is performed according to the setting. Specifically, a plug-in authorization priority flag is set in the setting file 60, and the image forming apparatus 12 performs processing according to the plug-in authorization priority flag. That is, when the plug-in authorization priority flag is set, authorization is performed based on the plug-in authorization information, and when the plug-in authorization priority flag is not set, authorization is performed based on the user account information.

[0092] The setting file 60 may be set for each plug-in package so that the settings cannot be changed, or may be in a form that allows the settings to be changed after installation in the image forming apparatus 12 .

[0093] Here, a process in which the image forming apparatus 12 performs a process by referring to the setting file 60 will be described. Fig. 11 is a flowchart showing a first modified example of the flow of the process performed in the image forming apparatus 12 when a request for execution of the plug-in 58 is made from the mobile terminal apparatus 14 in the information processing system 10 according to this embodiment. Note that the same processes as those in Fig. 6 above will be described with the same reference numerals. Also, the process in Fig. 11 starts when the process in Fig. 5 above is performed and the plug-in ID is transmitted from the mobile terminal apparatus 14 to the image forming apparatus 12 in step 106 above.

[0094] In step 200, the CPU 20A receives the plug-in ID to be executed from the application, and proceeds to step 202. That is, the plug-in ID transmitted from the mobile terminal device 14 in the above-mentioned step 106 is received.

[0095] In step 202, CPU 20A determines whether image forming apparatus 12 has an authentication function for authenticating a user by a login function. If the determination is negative, the process proceeds to step 206 described above, and if the determination is positive, the process proceeds to step 203A.

[0096] In step 206, the CPU 20A performs authorization processing based on the plug-in authorization information, and ends the series of processing, that is, performs the processing shown in FIG.

[0097] On the other hand, in step 203A, CPU 20A refers to setting file 60 of plug-in package 56, and proceeds to step 203B.

[0098] In step 203B, the CPU 20A judges whether or not there is a plug-in authorization priority flag. For example, the judgement is made by judging whether or not the plug-in authorization priority flag is set in the setting file 60. If the judgement is affirmative, the process proceeds to step 206 described above, and if the judgement is negative, the process proceeds to step 204 described above.

[0099] In step 204, the CPU 20A performs authorization processing based on the account information 64, and then ends the series of processing steps. That is, the above-mentioned processing in FIG.

[0100] In addition, settings other than the setting of whether authorization is based on the account information 64 or the plug-in authorization information may be set in the setting file 60. For example, as shown in FIG. 12, in an image forming apparatus 12 that is provided with administrator account information 64A and general user account information 64B and is capable of authentication based on a general user account and authentication based on an administrator account, whether authorization is based on a general user account or an administrator account may be set in the setting file 60 for each plug-in. FIG. 12 is a diagram showing a configuration example in which, in an image forming apparatus 12 that is provided with administrator account information 64A and general user account information 64B and is capable of authentication based on a general user account and authentication based on an administrator account, whether authorization is based on a general user account or an administrator account is set in the setting file 60 for each plug-in. In addition, the same components as those in the functional configuration of the control unit 20 of the image forming apparatus 12 in FIG. 4 will be described with the same reference numerals.

[0101] Specifically, an administrator authentication flag is set in the setting file 60 included in the plug-in package 56, and the image forming apparatus 12 performs processing according to the administrator authentication flag. That is, if the administrator authentication flag is set, authorization for execution of the plug-in 58 is performed using an administrator account, and if the administrator authentication flag is not set, authorization for execution of the plug-in 58 is performed using a general user account.

[0102] Authorization by an administrator account strengthens the security of plug-in execution. Authorization by authenticating only one administrator or fewer administrators than general users provides stronger security than authorization by authenticating multiple general users. The plug-in creator can set the configuration file 60 to set or not set a flag depending on the processing content of the plug-in, making it possible to set whether to authorize the execution of the plug-in with an administrator account or to authorize the execution of the plug-in 58 with a general user account. For example, in the case of a plug-in 58 that performs high-risk processing, such as using a function that handles personal information, such as exporting an address book, or a function that is closely related to the printer business, such as updating a billing meter, a flag is set to authorize the execution of the plug-in 58 using an administrator account, thereby enhancing security.

[0103] Here, a specific process will be described in which an administrator authentication flag is set in the setting file 60 and the image forming apparatus 12 performs a process according to the administrator authentication flag. Fig. 13 is a flowchart showing a second modified example of the process flow performed by the image forming apparatus 12 when a request to execute the plug-in 58 is made from the mobile terminal apparatus 14 in the information processing system 10 according to this embodiment. Note that the same processes as those in Fig. 6 above are described with the same reference numerals. Also, the process in Fig. 13 starts when the process in Fig. 5 above is performed and the plug-in ID is transmitted from the mobile terminal apparatus 14 to the image forming apparatus 12 in step 106 above.

[0104] In step 200, the CPU 20A receives the plug-in ID to be executed from the application, and proceeds to step 202. That is, the plug-in ID transmitted from the mobile terminal device 14 in the above-mentioned step 106 is received.

[0105] In step 202, CPU 20A determines whether image forming apparatus 12 has an authentication function for authenticating a user by a login function. If the determination is negative, the process proceeds to step 206 described above, and if the determination is positive, the process proceeds to step 203A.

[0106] In step 206, the CPU 20A performs authorization processing based on the plug-in authorization information, and ends the series of processing, that is, performs the processing shown in FIG.

[0107] On the other hand, in step 203A, CPU 20A refers to setting file 60 of plug-in package 56, and proceeds to step 203C.

[0108] In step 203C, CPU 20A judges whether or not there is an administrator authentication flag. For example, this judges whether or not the administrator authentication flag is set in setting file 60. If the judgement is negative, the process proceeds to step 204A, and if the judgement is positive, the process proceeds to step 204B.

[0109] In step 204A, the CPU 20A performs authorization processing based on the general user account information 64B, and ends the series of processes. Note that the authorization processing based on the general user account information 64B is the same as the authorization processing based on the account information in FIG. 7 described above, except that the general user account information 64B is used instead of the account information 64.

[0110] On the other hand, in step 204B, the CPU 20A performs authorization processing using the administrator account information 64A, and ends the series of processes. Note that the authorization processing using the administrator account information 64A is the same as the authorization processing using the account information in FIG. 7 described above, except that the administrator account information 64A is used instead of the account information 64.

[0111] Second embodiment In the above first embodiment, an example has been described in which plug-in package 56 is installed in image forming apparatus 12 to execute the plug-in, but the device on which the plug-in is executed is not limited to image forming apparatus 12. In the second embodiment, an example in which a server is applied as another example of a device will be described.

[0112] For example, a server that uses an access token to authorize a web API (Application Programming Interface) is known, and an example will be described in which a server that manages personal information of a user and provides a web API using an access token is applied as a device to which a plug-in 58 is to be executed. Fig. 14 is a diagram showing a schematic configuration of an information processing system according to the second embodiment. Note that the same reference numerals are used for configurations common to Fig. 1, and detailed description thereof will be omitted.

[0113] The information processing system 90 according to the present embodiment includes a mobile terminal device 14 and a server 80 as an example of an information processing device, and these are connected to a communication line 16 .

[0114] Here, a known server that manages personal information of a user and provides a web API by using an access token will be briefly described with reference to Fig. 15. Fig. 15 is a diagram for explaining a known resource server that manages personal information of a user and provides a web API by using an access token.

[0115] When issuing an access token, the user enters the user account into the application and sends a request for address reference authority and the user account to the server, and the server authenticates the user account and issues an access token to the application. For example, if an address is requested, the server issues an access token that grants access to only the address.

[0116] When requesting personal information, the application sends an address lookup request and the access token issued by the server to the server.

[0117] The server validates the access token and sends the personal address to the requesting application.

[0118] In such a server, if there is no authentication function for authenticating a user, an access token cannot be issued. Therefore, in this embodiment, an access token is issued using plug-in authorization information as in the above first embodiment.

[0119] Fig. 16 is a functional block diagram showing the functional configuration of the server 80 in the information processing system 90 according to this embodiment. Note that the same components as those in the control unit 20 of the image forming apparatus 12 in Fig. 4 are denoted by the same reference numerals and will be described.

[0120] The server 80, like the control unit 20 of the image forming apparatus 12, includes a CPU 80A, a ROM 80B, a RAM 80C, etc., as shown in Fig. 14. The CPU 80A executes a program stored in the ROM 80B, so that the server 80 has the functions of a plug-in management unit 50 and an access token management unit 82, as shown in Fig. 16.

[0121] The plug-in management unit 50 has the function of a plug-in execution unit 54 that executes a plug-in 58 installed in the server 80. The plug-in execution unit 54 controls whether or not to execute the plug-in according to the result of access token verification.

[0122] The access token management unit 82 has the functions of an access token verification unit 84 and an access token issuance unit 86 .

[0123] The access token verification unit 84 verifies an access token transmitted from an external source such as the application B 68, and notifies the plug-in execution unit 54 of the verification result.

[0124] If the server 80 has an authentication function for authenticating a user, the access token issuing unit 86 requests a user account from an external device such as a mobile terminal device 14 in which application B68 is installed, performs authentication using the user account, and issues an access token.

[0125] On the other hand, if the server 80 does not have an authentication function for authenticating a user, the access token issuing unit 86 requests authorization information 70 to be compared with authorization information 62 unique to the plug-in 58 from an external device such as the mobile terminal device 14. Then, the authorization information 70 transmitted from the external device is compared with authorization information 62 unique to the plug-in 58 to issue an access token. In this way, authorization is performed to issue an access token even for a device that does not have an authentication function for authenticating a user.

[0126] As in the above embodiment, the plug-in package 56 includes a plug-in 58, a setting file 60 as an example of a setting function, and authorization information 62, and is installed in the image forming apparatus 12 by an administrator of the image forming apparatus 12 or the like.

[0127] The plug-in 58 has a function of expanding access from outside the image forming apparatus 12, and by executing the plug-in 58 from outside, it becomes possible to issue an access token as the execution of a predetermined function of the server 80.

[0128] The setting file 60 is a file that stores settings related to the execution of the plug-in 58, and allows, for example, a setting as to whether authorization based on account information or authorization based on authorization information is to be prioritized. Note that the plug-in package 56 may be configured to omit the setting file 60, that is, to include the plug-in 58 and authorization information 62.

[0129] The authorization information is information specific to the plug-in 58, and is, for example, a predetermined number of character strings including numbers, symbols, and the like.

[0130] Next, specific processes performed by the mobile terminal device 14 and the server 80 in the information processing system 90 according to this embodiment will be described.

[0131] As a preliminary preparation, the device administrator installs the plug-in package 56 in advance on the server 80. In addition, the user installs an application on the mobile terminal device 14.

[0132] First, a process will be described when, after advance preparation, an application on the mobile terminal device 14 is operated to request the server 80 to execute the plug-in 58. Fig. 17 is a flowchart showing an example of a process flow when an application is operated on the mobile terminal device 14 of the information processing system 90 according to this embodiment to request the server 80 to execute the plug-in 58. Note that the same processes as those in Fig. 5 will be described with the same reference numerals. Also, the process in Fig. 17 starts, for example, when an instruction is given to start an application on the mobile terminal device 14.

[0133] In step 100 , the CPU 14 A starts an application designated by the user, and the process proceeds to step 103 .

[0134] In step 103, the CPU 14A judges whether or not a plug-in execution request has been issued. For example, it judges whether or not an instruction such as a request to send personal information of the application has been issued. If the judgment is negative, the process ends and other processes are performed. On the other hand, if the judgment is positive, the process proceeds to step 105.

[0135] In step 105, the CPU 14A requests the server 80 for the authority to execute the plug-in, and the process proceeds to step 107.

[0136] In step 107, the CPU 14A ends the process of transmitting the plug-in ID to the server 80 to request execution of the plug-in 58.

[0137] Next, a process performed by the server 80 when a request for permission to execute a plug-in is made from the mobile terminal device 14 will be described. Fig. 18 is a flow chart showing an example of the flow of processes performed by the server 80 when a request for execution of a plug-in is made from the mobile terminal device 14 in the information processing system 90 according to this embodiment. Note that the same processes as those in Fig. 6 are described with the same reference numerals. Also, the process in Fig. 18 starts when a plug-in ID is transmitted from the mobile terminal device 14 to the server 80 in the above-mentioned step 107.

[0138] In step 200, the CPU 80A receives the plug-in ID to be executed from the application, and proceeds to step 202. That is, the plug-in ID transmitted from the mobile terminal device 14 in step 107 described above is received.

[0139] In step 202, the CPU 80A determines whether the server 80 has an authentication function for authenticating a user by a login function. If the determination is affirmative, the process proceeds to step 203, and if not, the process proceeds to step 205.

[0140] In step 203, the CPU 80A executes an access token issuing process based on the account information, and ends the series of processes. The access token issuing process based on the account information is the same as that of a known server that uses the above-mentioned access token to provide a web API. That is, the CPU 80A obtains a user account from the mobile terminal device 14, performs authentication using the user account, and issues an access token.

[0141] On the other hand, in step 205, the CPU 80A performs an access token issuing process based on the plug-in authorization information, and ends the series of processes. The access token issuing process based on the plug-in authorization information is performed as shown in FIG. 19. FIG. 19 is a flowchart showing an example of the flow of the access token issuing process based on the plug-in authorization information. The same processes as those in FIG. 9 will be described with the same reference numerals.

[0142] That is, in step 500, the CPU 80A requests plug-in authorization information from the application of the mobile terminal device 14, and the process proceeds to step 502.

[0143] In step 502, the CPU 80A judges whether or not authorization information has been received from the mobile terminal device 14. The CPU 80A waits until the judgment is affirmative, and proceeds to step 504. Note that if authorization information has not been received even after a predetermined time has elapsed, the process may be terminated.

[0144] In step 504, CPU 80A determines whether authorization information 62 in plug-in package 56 matches authorization information 70 received from mobile terminal device 14. That is, authorization information 62 of plug-in 58 is compared with authorization information 70 of the application in mobile terminal device 14 to control whether plug-in 58 can be executed. If the determination is negative, the process proceeds to step 505, and if the determination is positive, the process proceeds to step 507.

[0145] In step 505, the CPU 80A ends the series of processes without issuing an access token.

[0146] On the other hand, in step 507, the CPU 80A issues an access token, to which the plug-in execution of the designated ID is granted, to the mobile terminal device 14, and ends the series of processes.

[0147] Next, the processing performed by the mobile terminal device 14 in response to the access token issuing processing based on the plug-in authorization information performed by the server 80 will be described. Fig. 20 is a flow chart showing an example of the flow of processing performed by the mobile terminal device 14 in response to the access token issuing processing based on the plug-in authorization information. Note that the same processes as those in Fig. 10 will be described with the same reference numerals. The processing in Fig. 20 starts when the server 80 requests plug-in authorization information in the above-mentioned step 500.

[0148] In step 600 , the CPU 14 A receives a plug-in authorization information request sent from the server 80 , and the process proceeds to step 602 .

[0149] In step 602, the CPU 14A reads the authorization information 70 given to the application, and proceeds to step 604. If the authorization information 70 is not present, the process ends and execution of the plug-in is disabled.

[0150] In step 606 , the CPU 14 A transmits the read authorization information 70 to the image forming apparatus 12 , and the process proceeds to step 608 .

[0151] In step 608, the CPU 14A judges whether or not the access token has been received. The CPU 14A waits until the judgment is affirmative, and ends a series of processes. If the access token is not received even after a predetermined time has elapsed, the authorization information 70 may be retransmitted, or the user may be notified of the failure to obtain the access token by displaying the failure on the display unit 14F, for example.

[0152] By performing the processing in this manner, even in a server that does not have a function for authenticating a user, an access token is issued by using the plug-in authorization information.

[0153] In the above embodiments, as an example of an authentication function for authenticating a user, an example was described in which account information is stored in the image forming apparatus 12 or the server 80 and the image forming apparatus 12 or the server 80 collates the account information for authentication, but the authentication function for authenticating a user is not limited to this. For example, a separate authentication server for authenticating a user may be provided, and the account information may be stored in the authentication server, which then collates the account information. Then, a form may be applied in which the image forming apparatus 12 or the server 80 performs authentication using the authentication result of the authentication server.

[0154] In addition, in each of the above embodiments, the image forming apparatus 12 or the server 80 acquires the authorization information 70 in a pull manner in which the image forming apparatus 12 or the server 80 receives the authorization information 70 by requesting the authorization information 70 from the mobile terminal apparatus 14 that has requested the plug-in 58. However, the present invention is not limited to this, and the authorization information 70 may be acquired in a push manner. That is, when the mobile terminal apparatus 14 requests the execution of the plug-in 58, the execution request for the plug-in 58 and the authorization information 70 may be transmitted together to the request destination. In addition, in the push manner, if the authorization information 70 is not stored in the application of the mobile terminal apparatus 14, the user may input the authorization information 70 by operating the operation unit 14E when requesting the execution of the plug-in 58, and the input authorization information 70 may be transmitted together with the execution request.

[0155] In addition, in each of the above embodiments, an example has been described in which execution of the plug-in 58 is requested from the mobile terminal device 14. However, this is not limited to the mobile terminal device 14, and the execution of the plug-in 58 may be requested from another device such as a personal computer.

[0156] In addition, in the above embodiment, the CPU has been described as an example of a processor, but the term "processor" refers to a processor in a broad sense, and includes general-purpose processors (e.g., CPUs, etc.) and dedicated processors (e.g., GPU: Graphics Processing Unit, ASIC: Application Specific Integrated Circuit, FPGA: Field Programmable Gate Array, programmable logic devices, etc.).

[0157] In addition, the operations of the processor in the above embodiments may be performed not only by one processor, but also by multiple processors located at physically separate locations working together. The order of the operations of the processor is not limited to the order described in the above embodiments, and may be changed as appropriate.

[0158] The processes performed by each unit of the information processing systems 10 and 90 according to the above embodiments may be processes performed by software, hardware, or a combination of both. The processes performed by each unit of the information processing systems 10 and 90 may be stored as a program in a storage medium and distributed.

[0159] Furthermore, the present invention is not limited to the above, and it goes without saying that various modifications can be made without departing from the spirit and scope of the present invention. [Explanation of symbols]

[0160] 10, 90 Information Processing Systems 12 Image forming device 14 Portable terminal device 20 Control Unit 20A CPU 50 Plug-in Management 52 Licensing Department 54 Plug-in execution unit 56 Plugin Packages 58 Plugins 60 Configuration files 62, 70 Authorization information 64 Account Information 64A Administrator Account 64B General user account 80 Servers 80A CPU 82 Access Token Management Unit 84 Access Token Verification Unit 86 Access Token Issuer

Claims

1. a processor, the processor comprising: receiving target authorization information to be compared with the authentication function for authenticating a user who uses the device when executing a plug-in that extends access from the outside, from a source that requests execution of the plug-in; An information processing device that performs processing to control whether or not the plug-in is to be executed, using predetermined authorization information unique to the plug-in and the target authorization information.

2. a processor, the processor comprising: a plug-in that extends access from the outside and is installed in the device as a plug-in package including a setting function for setting whether to give priority to an authentication function for authenticating a user who uses the device, or to give priority to a process using predetermined authorization information unique to the plug-in and target authorization information that is to be compared by a source of an execution request for the plug-in, the plug-in receiving the target authorization information when executing the plug-in; Using the authorization information and the target authorization information, control whether or not to execute the plug-in; If the information processing apparatus has the authentication function, the information processing apparatus performs processing for controlling whether or not the plug-in can be executed by the authentication function.

3. a processor, the processor comprising: a plug-in for expanding access from outside, the plug-in having an authentication function for individually handling a general user and an administrator as an authentication function for authenticating a user who uses the device, the plug-in being installed in the device as a plug-in package including an authentication setting function for setting whether authentication is to be performed as a general user or an administrator, when executing the plug-in, the plug-in receiving target authorization information to be compared from a source requesting execution of the plug-in, Using predetermined authorization information unique to the plug-in and the target authorization information, control whether or not to allow execution of the plug-in; If the information processing apparatus has an authentication function for authenticating a user who uses the apparatus, the information processing apparatus performs a process for controlling whether or not the plug-in can be executed by the authentication function.

4. a processor, the processor comprising: When executing a plug-in that extends external access, receiving target authorization information to be compared from a source that requests execution of the plug-in; An information processing device that performs processing to control whether or not to issue a predetermined access token as a measure for enabling or disabling execution of the plug-in, using predetermined authorization information unique to the plug-in and the target authorization information.

5. An information processing device as claimed in any one of claims 1 to 4, wherein the processor, when requesting execution of the plug-in, performs a process of receiving the target authorization information from the source of the request to execute the plug-in by requesting target authorization information to be compared to the source of the request to execute the plug-in.

6. The information processing apparatus according to claim 5 , wherein the processor performs processing for requesting the target authorization information from a source that requests execution of the plug-in when the information processing apparatus does not have an authentication function for authenticating a user who uses the apparatus.

7. 5 . The information processing apparatus according to claim 1 , wherein, when the information processing apparatus has an authentication function for authenticating a user who uses the apparatus, the processor performs processing for controlling whether or not the plug-in can be executed by the authentication function.

8. The information processing device according to claim 7 , wherein the plug-in is installed in the device as a plug-in package including a setting function for setting whether to prioritize the authentication function or the processing using the authorization information and the target authorization information.

9. The information processing device according to claim 7 or claim 8, wherein the plug-in is installed in the device as a plug-in package including an authentication setting function for setting whether authentication is to be performed as a general user or an administrator when the authentication function has an authentication function for treating general users and administrators separately.

10. 4. The information processing apparatus according to claim 1, wherein the permission for execution of the plug-in is determined based on permission for issuance of a predetermined access token.

11. An information processing device according to any one of claims 1 to 10; a terminal device that requests the information processing device to execute the plug-in and transmits the target authorization information; An information processing system comprising:

12. An information processing program for causing a computer to function as the information processing device according to any one of claims 1 to 10.

Images