Authentication system and method for controlling authentication system

Abstract

To provide an authentication system that can perform secure authentication as authentication processing in an authentication server.SOLUTION: An authentication system comprises an MFP and an authentication server. The MFP includes a user registration information storage unit that stores user registration information for which identification information that identifies a user is mapped with a cryptographic key, a user information acquisition unit that acquires user registration information based on the operation of the user, and an authentication request unit that generates an authentication request containing data encrypted based on the cryptographic key of the acquired user registration information and the identification information, then transmits the same to the authentication server. The authentication server includes an authentication registration information storage unit that stores authentication registration information for which the identification information is mapped with the cryptographic key, a cryptographic key acquisition unit that acquires a cryptographic key of the authentication registration information correspondingly to the identification information contained in the authentication request received from the MFP and an authentication processing unit that decodes the data encrypted based on the acquired cryptographic key, then transmits the result of the authentication to the MFP.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an authentication system, and more particularly to a technique for authenticating a user who uses an information processing device. [Background technology]

[0002] Traditionally, user authentication of users of information processing devices has generally been performed based on the user ID and password that the user inputs into the operation panel. However, because manually inputting a user ID and password into the operation panel is cumbersome, in recent years user authentication has come to be performed by reading card information from an IC card carried by the user, or by reading biometric information such as a fingerprint pattern or vein pattern that indicates the user's physical characteristics. These authentication methods are easy to use because they do not require the user to manually operate the operation panel and input character strings, etc.

[0003] On the other hand, when user authentication is performed by installing an authentication server on the cloud, the basic information to be checked during user authentication, i.e., the user ID, password, card information, biometric information, etc. of legitimate users must be registered on the authentication server in advance. However, storing such information on an authentication server installed on a public cloud can lead to security issues such as information leaks.

[0004] Because passwords, which consist of a string of characters, can be changed by the user at will, even if they are leaked from the cloud-based authentication server, unauthorized use of the leaked password can be prevented by changing to a new password. However, card information recorded on an IC card or biometric information that indicates the user's own physical characteristics cannot be easily changed by the user. In particular, biometric information is information that cannot be changed. Therefore, if card information or biometric information is leaked from the cloud-based authentication server, there is a problem in that it is not easy to prevent the unauthorized use of the leaked card information or biometric information. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2014-1866602 Summary of the Invention [Problem to be solved by the invention]

[0006] The present disclosure has been made to solve the above-mentioned problems, and aims to provide an authentication system and a control method for the authentication system that are capable of performing secure authentication as an authentication process in an authentication server provided on a network. [Means for solving the problem]

[0007] The authentication system disclosed herein includes an information processing device and an authentication server connected to the information processing device via a network. The information processing device includes a user registration information storage unit that stores user registration information that associates identification information for identifying a user with an encryption key set for each user, a user information acquisition unit that acquires the user registration information stored in the user registration information storage unit based on an instruction operation from the user, and an authentication request unit that generates an authentication request including data encrypted based on the encryption key included in the acquired user registration information and the identification information included in the acquired user registration information and transmits the authentication request to the authentication server. The authentication server includes an authentication registration information storage unit that stores authentication registration information that associates identification information for identifying a user registered in the information processing device with the encryption key set for each user, an encryption key acquisition unit that acquires the encryption key included in the authentication registration information in response to the identification information included in the authentication request received from the information processing device, and an authentication processing unit that decrypts the encrypted data based on the acquired encryption key and transmits an authentication result to the information processing device.

[0008] Preferably, the information processing device further includes a card information acquisition unit that acquires card information of a card held by the user, and the user information acquisition unit acquires the user registration information stored in the user registration information storage unit based on the card information acquired based on the user's instruction operation on the card information acquisition unit.

[0009] Preferably, the information processing device further includes a biometric information acquisition unit that acquires the user's biometric information, and the user information acquisition unit acquires the user registration information stored in the user registration information storage unit based on the biometric information acquired based on the user's instruction operation on the biometric information acquisition unit.

[0010] Preferably, the user information acquisition unit acquires the user registration information stored in the user registration information storage unit based on a user's operation to input a code.

[0011] Preferably, the information processing device further includes a receiving unit that receives a result of the authentication, and a login control unit that switches the information processing device to a logged-in state based on the authentication result received by the receiving unit.

[0012] Preferably, the information processing device further includes a user registration management unit that registers user registration information for each user in the user registration information storage unit, and the authentication server further includes an authentication registration management unit that registers authentication registration information for each user in the authentication registration information storage unit.

[0013] Preferably, the user registration management unit accepts a registration request including the user's identification information and transmits the registration request to the authentication server, the authentication registration management unit accepts the registration request, generates temporary information and transmits it to the information processing device, the user registration management unit receives the temporary information and generates an encryption key for each user, encrypts the temporary information based on the encryption key together with the encryption key and transmits it to the authentication server, the user registration management unit decrypts the encrypted data based on the encryption key and registers the identification information and the encryption key as authentication registration information in the authentication registration information storage unit based on the decryption result.

[0014] Preferably, the user registration management unit generates a private key paired with the public key as an encryption key, encrypts temporary information based on the private key together with the public key, and transmits the encrypted temporary information to the authentication server; the authentication registration management unit decrypts the encrypted temporary information based on the public key, and registers the identification information and the public key as authentication registration information in the authentication registration information storage unit based on the decryption result.

[0015] Preferably, the encryption key has an expiration date. Preferably, the information processing device further includes a user registration management unit that registers user registration information for each user in the user registration information storage unit, and the user registration management unit determines whether the encryption key included in the user registration information is within its expiration date, and based on the determination result, re-registers the user registration information for each user in the user registration information storage unit.

[0016] The control method for an authentication system disclosed herein is a control method for an authentication system that includes an information processing device and an authentication server connected to the information processing device via a network, and includes the steps of: storing user registration information that associates identification information for identifying a user with an encryption key set for each user; acquiring the stored user registration information based on the user's instruction operation; generating an authentication request that includes data encrypted based on the encryption key included in the acquired user registration information and the identification information included in the acquired user registration information, and sending the authentication request to the authentication server; storing authentication registration information that associates identification information for identifying a user registered in the information processing device with an encryption key set for each user; acquiring the encryption key included in the authentication registration information in accordance with the identification information included in the authentication request received from the information processing device; and decrypting the encrypted data based on the acquired encryption key and sending the authentication result to the information processing device. [Brief explanation of the drawings]

[0017] [Figure 1] FIG. 1 is a diagram illustrating a configuration of an authentication system according to an embodiment. [Figure 2] FIG. 1 is a diagram illustrating a configuration of an image forming apparatus (MFP) 1, which is a type of information processing apparatus according to an embodiment. [Figure 3] FIG. 2 is a diagram illustrating functional blocks of an image forming apparatus 1 according to an embodiment. [Figure 4] FIG. 2 is a diagram illustrating functional blocks of an authentication server 100 according to an embodiment. [Figure 5] FIG. 2 is a diagram illustrating an example of a display screen of a display unit 14 according to the embodiment. [Figure 6] 10A and 10B are diagrams illustrating another example of the display screen of display unit 14 according to the embodiment. [Figure 7] FIG. 10 is a diagram illustrating user registration information stored in a user registration information storage unit 38 according to the embodiment. [Figure 8] FIG. 10 is a diagram illustrating authentication registration information stored in an authentication registration information storage unit 108 according to the embodiment. [Figure 9] FIG. 10 is a diagram illustrating a flow of data exchange during registration processing between image forming apparatus 1 and authentication server 100 according to the embodiment. [Figure 10] FIG. 10 is a diagram illustrating a flow of data exchange during authentication processing between image forming apparatus 1 and authentication server 100 according to the embodiment. [Figure 11] FIG. 10 is a diagram illustrating user registration information stored in a user registration information storage unit 38 according to a modification of the embodiment. [Figure 12] FIG. 10 is a diagram illustrating a flow of data exchange during re-registration processing between image forming apparatus 1 and authentication server 100 according to a modification of the embodiment. [Figure 13] 10A and 10B are diagrams illustrating another example of the display screen of the display unit 14 according to another embodiment. [Figure 14] FIG. 10 is a diagram illustrating user registration information stored in a user registration information storage unit 38 according to another embodiment. [Figure 15] FIG. 10 is a diagram illustrating authentication registration information stored in an authentication registration information storage unit 108 according to another embodiment. [Figure 16]FIG. 10 is a diagram illustrating the flow of data exchange during registration processing between an image forming device 1 and an authentication server 100 according to another embodiment. [Figure 17] FIG. 10 is a diagram illustrating the flow of data exchange during authentication processing between an image forming apparatus 1 and an authentication server 100 according to another embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0018] Hereinafter, embodiments of the technical concept according to the present disclosure will be described with reference to the drawings. In the following description, the same components are denoted by the same reference numerals. The names and functions of the components are also the same. Therefore, detailed descriptions thereof will not be repeated.

[0019] In the following embodiments, an image forming apparatus, which is a type of information processing apparatus, may be, for example, an MFP, a printer, a copying machine, or a facsimile machine.

[0020] FIG. 1 is a diagram illustrating a configuration of an authentication system according to an embodiment. 1, an authentication system according to an embodiment includes an authentication server 100, a network 50, and an information processing device, an MFP (Multi Functional Peripheral) 1. The MFP 1 is capable of communicating with the authentication server 100 via the network 50, and performs authentication processing by exchanging data with the authentication server 100.

[0021] 2 is a diagram illustrating the configuration of an image forming apparatus (MFP) 1, which is a type of information processing apparatus according to an embodiment. Referring to FIG. 2, the image forming apparatus (MFP) 1 has multiple functions such as a copy function and a scan function, and can transmit and receive various data such as document data and image data via a network 50.

[0022] The image forming device 1 includes a CPU (control unit) 10, an operation unit 12, a display unit 14, a network communication unit 16, an image reading unit 18, a printer unit 20, an IC card reader 22, a memory 24, a RAM 26, and a biometric information acquisition unit 28.

[0023] The operation unit 12 includes a touch panel and operation keys. The display unit 14 is a display that displays information, and may be configured in combination with a touch panel.

[0024] An antenna (not shown), a wireless module, and the like are connected to the network communication unit 16. The image forming apparatus 1 exchanges data with external communication devices via the antenna and the wireless module. The external communication devices include, for example, a mobile communication terminal such as a smartphone, and an authentication server 100. The image forming apparatus 1 may be configured to be able to download necessary information from the authentication server 100 via the antenna.

[0025] The image reading unit 18 is a scanner and is capable of acquiring image data. The printer unit 20 is capable of printing the acquired image data on recording paper.

[0026] The image forming apparatus 1 is equipped with an authentication information acquisition device that acquires authentication information. The image forming apparatus 1 of the present disclosure is equipped with two authentication information acquisition devices: an IC card reader 22 and a biometric information acquisition unit 28. The IC card reader 22 acquires user-specific authentication information by reading recorded information (card information) recorded on a portable IC card (portable recording medium) that has a built-in computer-readable recording medium owned by each user.

[0027] Furthermore, the biometric information acquisition unit 28 reads, for example, a fingerprint pattern or vein pattern on a fingertip, which is a physical characteristic of the user, as biometric information and acquires the biometric information as authentication information unique to the user. However, the biometric information acquired by the biometric information acquisition unit 28 is not necessarily limited to a fingerprint pattern or vein pattern, and may be other biometric information. For example, the biometric information acquired may be a voiceprint, iris, or face image of the user.

[0028] When using image forming apparatus 1, a user can manually input a user ID and password consisting of a string of characters of at least a predetermined number of characters by performing an input operation on operation unit 12, thereby instructing image forming apparatus 1 to begin user authentication. If manually operating operation unit 12 is bothersome, the user can set an IC card they carry in a position where it can be read by IC card reader 22, or place the user's fingertip in a reading position on biometric information acquisition unit 28, thereby allowing these authentication information acquisition devices to automatically acquire authentication information and instruct the start of user authentication. Once user authentication is successful and image forming apparatus 1 is in a logged-in state, the user can perform various input operations on operation unit 12, such as setting up a job or issuing a job execution instruction.

[0029] The CPU 10 controls the operation of the image forming apparatus 1 by executing various programs of the image forming apparatus 1. Upon receiving a program execution command, the CPU 10 reads the program from the memory 24 to the RAM 26. The RAM 26 functions as a working memory and temporarily stores various data required for executing the program.

[0030] The memory 24 is, for example, a hard disk, a solid-state drive (SSD), or another storage device. The memory 24 may be internal or external. The memory 24 stores a program according to the present embodiment. However, the program may be stored in a location other than the memory 24, such as a ROM, RAM, or an external device (e.g., a server). The program may be provided not as a standalone program but as part of an arbitrary program. In this case, the control process according to the present embodiment is realized in cooperation with the arbitrary program. Even a program that does not include some of the modules does not deviate from the spirit of the program according to the present embodiment. Furthermore, some or all of the functions provided by the program may be realized by dedicated hardware. Furthermore, the image forming apparatus 1 may be configured as a so-called cloud service in which at least one server executes part of the program's processing.

[0031] 3 is a diagram illustrating functional blocks of image forming apparatus 1 according to an embodiment. Referring to FIG. 3, image forming apparatus 1 realizes various functional blocks by CPU 10 executing programs stored in memory 24.

[0032] The image forming apparatus 1 includes a user information acquisition unit 30, an authentication request unit 32, a login control unit , a user registration management unit , and a user registration information storage unit .

[0033] The user registration information storage unit 38 stores user registration information that associates identification information for identifying a user with an encryption key set for each user.

[0034] The user information acquisition unit 30 acquires the user registration information stored in the user registration information storage unit 38 based on an instruction operation by the user. The user information acquisition unit 30 acquires the user registration information stored in the user registration information storage unit 38 based on card information acquired based on an instruction operation by the user on the IC card reader 22. The user information acquisition unit 30 may acquire the user registration information stored in the user registration information storage unit 38 based on biometric information acquired based on an instruction operation by the user on the biometric information acquisition unit 28. The user information acquisition unit 30 may acquire the user registration information stored in the user registration information storage unit 38 based on an instruction operation by the user to input a code.

[0035] The authentication request unit 32 generates an authentication request including data encrypted based on the encryption key included in the acquired user registration information, and transmits the authentication request to the authentication server 100.

[0036] The login control unit 34 switches the image forming apparatus 1 to a login state based on the authentication result received from the authentication server 100 via the network communication unit 16.

[0037] The user registration management unit 36 registers user registration information for each user in the user registration information storage unit 38. The user registration management unit 36 accepts a registration request including the user's identification information and transmits the registration request to the authentication server 100. The user registration management unit 36 receives temporary information from the authentication server 100 via the network communication unit 16 and generates an encryption key for each user. The user registration management unit 36 encrypts the temporary information based on the encryption key together with the generated encryption key and transmits the encrypted information to the authentication server 100.

[0038] The user registration management unit 36 may generate a private key paired with the public key as an encryption key. The user registration management unit 36 may encrypt temporary information based on the private key along with the public key and transmit the encrypted information to the authentication server 100. An expiration date may be set for the encryption key.

[0039] The user registration management unit 36 may determine whether the encryption key included in the user registration information is within its expiration date, and based on the determination result, re-register the user registration information for each user in the user registration information storage unit 38.

[0040] 4 is a diagram illustrating functional blocks of authentication server 100 according to an embodiment. Referring to FIG. 4, authentication server 100 includes an authentication processing unit 102, an encryption key acquisition unit 104, an authentication registration management unit 106, and an authentication registration information storage unit 108.

[0041] The authentication registration information storage unit 108 stores authentication registration information that associates identification information for identifying a user registered in the image forming apparatus 1 with an encryption key set for each user.

[0042] The encryption key acquisition unit 104 acquires the encryption key included in the authentication registration information in correspondence with the identification information included in the authentication request received from the image forming apparatus 1.

[0043] The authentication processing unit 102 decrypts the encrypted data based on the acquired encryption key, and transmits the authentication result to the image forming apparatus 1.

[0044] The authentication registration management unit 106 registers authentication registration information for each user in the authentication registration information storage unit 108. The authentication registration management unit 106 accepts a registration request, generates temporary information, and transmits it to the image forming apparatus 1. The authentication registration management unit 106 decrypts encrypted data based on an encryption key, and registers the authentication registration information in the authentication registration information storage unit 108 as authentication registration information in which the identification information and the encryption key are associated based on the decryption result. The authentication registration management unit 106 may also decrypt encrypted temporary information based on a public key, and register the authentication registration information in the authentication registration information storage unit 108 as authentication registration information in which the identification information and the public key are associated based on the decryption result.

[0045] 5 is a diagram illustrating an example of a display screen of display unit 14 according to an embodiment. Referring to FIG. 5, screen 200 is shown. In this example, "Please touch your IC card." is displayed. When logging in, the user can follow the instructions on screen 200 to place the IC card in a readable position on IC card reader 22.

[0046] 6 is a diagram illustrating another example of the display screen of display unit 14 according to the embodiment. Referring to FIG. 6, a user ID registration screen 210 is shown. In this example, an input field 212 for inputting a user ID is provided. An "OK" button 214 is also provided.

[0047] If the user registration information is not registered in the user registration information storage unit 38, the user ID registration screen 210 can prompt the user to enter a user ID, and the user registration information can be registered.

[0048] 7 is a diagram illustrating user registration information stored in the user registration information storage unit 38 according to the embodiment. In this example, a user ID, an encryption key, and a temporary key are registered in association with a card ID.

[0049] As an example, the user ID "AAA", encryption key "Ekey0001", and temporary key "OTP1" are registered in association with the card ID "0001". The user ID "BBB", encryption key "Ekey0007", and temporary key "OTP7" are registered in association with the card ID "0007". The user ID "CCC", encryption key "Ekey0024", and temporary key "OTP24" are registered in association with the card ID "0024". The user ID "DDD", encryption key "Ekey0581", and temporary key "OTP581" are registered in association with the card ID "0581". The user ID "EEE", encryption key "Ekey0005", and temporary key "OTP5" are registered in association with the card ID "0005". The same applies to other user registration information.

[0050] 8 is a diagram illustrating authentication registration information stored in the authentication registration information storage unit 108 according to an embodiment. Referring to FIG. 8, in this example, an encryption key "Dkey0001" and a temporary key "OTP1" are registered in association with a user ID "AAA." An encryption key "Dkey0007" and a temporary key "OTP7" are registered in association with a user ID "BBB." An encryption key "Dkey0024" and a temporary key "OTP24" are registered in association with a user ID "CCC." An encryption key "Dkey0581" and a temporary key "OTP581" are registered in association with a user ID "DDD." An encryption key "Dkey0005" and a temporary key "OTP5" are registered in association with a user ID "EEE." The same applies to other user registration information.

[0051] 9 is a diagram illustrating the flow of data exchange during registration processing between image forming apparatus 1 and authentication server 100 according to an embodiment. In this example, a case will be described in which a user who possesses an IC card has not yet registered as a user.

[0052] Referring to FIG. 9, IC card reader 22 acquires card information (sequence SQ0). User information acquisition unit 30 checks whether it is possible to acquire user registration information stored in user registration information storage unit 38 according to the card ID acquired via IC card reader 22 (sequence SQ1). In this example, user information acquisition unit 30 shows a case where user registration information is not registered in user registration information storage unit 38 according to the acquired card information (sequence SQ2). If user information acquisition unit 30 determines that it cannot acquire user registration information, it instructs user registration management unit 36. User registration management unit 36 displays a user ID registration screen (sequence SQ4).

[0053] The user registration management unit 36 transmits a registration request for the user ID to the authentication server 100 in accordance with the user ID input on the user ID registration screen 210 (sequence SQ6).

[0054] Next, the authentication registration management unit 106 receives a user ID registration request from the image forming apparatus 1 and generates a temporary key (sequence SQ8).

[0055] Next, the authentication registration management unit 106 transmits the generated temporary key to the image forming apparatus 1 (sequence SQ10).

[0056] The user registration management unit 36 receives the temporary key from the authentication server 100 and generates a public encryption key (sequence SQ11). The public encryption key includes a private key and a public key.

[0057] Next, the user registration management unit 36 encrypts the temporary key using the private key of the generated public encryption key (sequence SQ12).

[0058] The user registration management unit 36 transmits the user ID, the encrypted data, and the public key to the authentication server 100. The encrypted data is the temporary key encrypted using the private key.

[0059] The authentication registration management unit 106 receives the user ID, the encrypted data, and the public key from the authentication server 100, and decrypts the encrypted data with the public key (sequence SQ16).

[0060] The authentication registration management unit 106 checks whether the decrypted temporary key is the same as the transmitted temporary key (sequence SQ17).

[0061] If the authentication registration management unit 106 determines that the collation results are a match, it registers the authentication registration information in the authentication registration information storage unit 108 (sequence SQ18).

[0062] The authentication registration management unit 106 transmits a registration completion notification to the image forming apparatus 1 (sequence SQ20).

[0063] When the user registration management unit 36 receives a registration completion notification from the authentication server 100, it registers the user registration information in the user registration information storage unit 38 in response to the result of the registration completion in the authentication server 100 (sequence SQ22).

[0064] This completes the registration process. 10 is a diagram illustrating the flow of data exchange during authentication processing between image forming apparatus 1 and authentication server 100 according to an embodiment. In this example, a case will be described in which a user who possesses an IC card is a registered user.

[0065] Referring to FIG. 10, IC card reader 22 acquires card information (sequence SQ30). User information acquisition unit 30 checks whether it can acquire user registration information stored in user registration information storage unit 38 according to the card ID acquired via IC card reader 22 (sequence SQ31). In this example, user information acquisition unit 30 indicates that user registration information has been registered in user registration information storage unit 38 according to the acquired card information (sequence SQ32). Next, user information acquisition unit 30 instructs authentication request unit 32, and authentication request unit 32 generates an authentication request (sequence SQ34). Authentication request unit 32 transmits the user ID and encrypted data to authentication server 100 as the authentication request. The encrypted data is generated by encrypting a temporary key using a private key.

[0066] Next, authentication processing unit 102 receives an authentication request from image forming apparatus 1 (sequence SQ38).

[0067] Next, authentication processing unit 102 acquires an encryption key according to the user ID included in the authentication request (sequence SQ40). Specifically, authentication processing unit 102 acquires a public key corresponding to the user ID from the authentication registration information stored in authentication registration information storage unit 108.

[0068] Next, authentication processing unit 102 decrypts the encrypted data based on the acquired public key (sequence SQ42).

[0069] The authentication processing unit 102 checks whether the decrypted temporary key is the same as the temporary key included in the authentication registration information (sequence SQ43).

[0070] If the verification result indicates a match, the authentication processing unit 102 determines that the authentication is OK (sequence SQ44).

[0071] The authentication processing unit 102 transmits an authentication OK notification to the image forming apparatus 1 (sequence SQ46).

[0072] When authentication request unit 32 receives an authentication OK notification from authentication server 100, it notifies login control unit 34, and login control unit 34 executes login processing (sequence SQ48), thereby completing the authentication processing.

[0073] According to the method according to the embodiment, an encryption key is generated for each user, and authentication processing is performed based on the generated encryption key, thereby enabling secure authentication.

[0074] Furthermore, according to this method, when performing authentication processing using an IC card possessed by each user, there is no need to transmit the IC card information to the authentication server 100, and the IC card information can be kept secure.

[0075] In this example, a user authentication method using an IC card has been described, but it is not limited to an IC card, and biometric information can be used instead of an IC card in the same way. All that is needed is to register the biometric information instead of the card ID. Furthermore, it is not limited to biometric information, and the same can be applied to a user authentication method using, for example, a PIN code.

[0076] (Variation) 11 is a diagram illustrating user registration information stored in the user registration information storage unit 38 according to the modified embodiment. In this example, a user ID, an encryption key, a temporary key, and a creation date are registered in association with a card ID.

[0077] For example, the user ID "AAA", encryption key "Ekey0001", temporary key "OTP1", and creation date "XA" are associated and registered with the card ID "0001". The user ID "BBB", encryption key "Ekey0007", temporary key "OTP7", and creation date "XB" are associated and registered with the card ID "0007". The user ID "CCC", encryption key "Ekey0024", temporary key "OTP24", and creation date "XC" are associated and registered with the card ID "0024". The user ID "DDD", encryption key "Ekey0581", temporary key "OTP581", and creation date "XD" are associated and registered with the card ID "0581". The card ID "0005" is associated with the user ID "EEE", encryption key "Ekey0005", temporary key "OTP5", and creation date "XE". The same applies to other user registration information.

[0078] In a modified embodiment, the creation date of the encryption key is registered in association with the user registration information. The creation date is used to set the expiration date of the encryption key. For example, a predetermined period (e.g., 30 days) is set as the expiration date. The date of authentication processing is compared with the creation date of the encryption key, and if it is within 30 days, the encryption key can be used. On the other hand, if it is more than 30 days, the use of the encryption key is set to be invalid.

[0079] If the use of the encryption key is invalid, the image forming apparatus 1 executes a process of re-registering the user registration information.

[0080] 12 is a diagram illustrating the flow of data exchange during re-registration processing between the image forming device 1 and the authentication server 100 according to a modified example of the embodiment. In this example, a case will be described in which a user who possesses an IC card has registered as a user but the expiration date of the encryption key has expired.

[0081] Referring to FIG. 12, IC card reader 22 acquires card information (sequence SQ0). User information acquisition unit 30 checks whether it can acquire user registration information stored in user registration information storage unit 38 according to the card ID acquired via IC card reader 22 (sequence SQ1). In this example, user information acquisition unit 30 shows a case where user registration information is registered in user registration information storage unit 38 according to the acquired card information (sequence SQ2). Next, user information acquisition unit 30 checks the expiration date of the encryption key included in the user registration information (sequence SQ3A). User information acquisition unit 30 compares the creation date of the encryption key for the user registration information according to the acquired card information with the date of authentication processing, and determines whether the expiration date is within 30 days.

[0082] The user information acquisition unit 30 determines that the encryption key has expired (sequence SQ3B). The user information acquisition unit 30 compares the creation date of the encryption key for the user registration information according to the acquired card information with the date of authentication processing and determines that it is not within 30 days.

[0083] Next, if the user information acquisition unit 30 determines that the encryption key has expired, it instructs the user registration management unit 36. The user registration management unit 36 displays a user ID registration screen (sequence SQ4). The subsequent processing is the same as that described in FIG. 9.

[0084] That is, the user registration management unit 36 sends a registration request for the user ID to the authentication server 100 in accordance with the user ID entered on the user ID registration screen 210 (sequence SQ6). Next, the authentication registration management unit 106 receives the user ID registration request from the image forming apparatus 1 and generates a temporary key (sequence SQ8). Next, the authentication registration management unit 106 sends the generated temporary key to the image forming apparatus 1 (sequence SQ10). The user registration management unit 36 receives the temporary key from the authentication server 100 and generates a public encryption key (sequence SQ11). The public encryption key includes a private key and a public key. Next, the user registration management unit 36 encrypts the temporary key using the private key of the generated public encryption key (sequence SQ12). The user registration management unit 36 sends the user ID, encrypted data, and public key to the authentication server 100. The encrypted data is the temporary key encrypted using the private key. The authentication registration management unit 106 receives the user ID, encrypted data, and public key from the authentication server 100 and decrypts the encrypted data with the public key (sequence SQ16). The authentication registration management unit 106 verifies whether the decrypted temporary key is the same as the temporary key it sent (sequence SQ17). If the verification results indicate a match, the authentication registration management unit 106 registers the authentication registration information in the authentication registration information storage unit 108 (sequence SQ18). The authentication registration management unit 106 transmits a registration completion notification to the image forming apparatus 1 (sequence SQ20). If the user registration management unit 36 receives the registration completion notification from the authentication server 100, it registers the user registration information in the user registration information storage unit 38 in response to the result of the registration completion in the authentication server 100 (sequence SQ22).

[0085] This completes the re-registration process. This process allows the expiration date of the encryption key to be set, and when the expiration date has passed, the encryption key can be regenerated by executing a new re-registration process, thereby maintaining a secure authentication process.

[0086] In this example, a user authentication method using an IC card has been described, but it is not limited to an IC card, and biometric information can be used instead of an IC card in the same way. All that is needed is to register the biometric information instead of the card ID. Furthermore, it is not limited to biometric information, and the same can be applied to a user authentication method using, for example, a PIN code.

[0087] (Other embodiments) In the above embodiment, the case where a user ID is registered has been described, but the case where a password (PW) is registered together with the user ID will now be described.

[0088] 13 is a diagram illustrating another example of a display screen of display unit 14 according to another embodiment. Referring to FIG. 13, a user ID registration screen 210# is shown. In this example, an input field 212 for inputting a user ID and an input field 213 for inputting a password are provided. An "OK" button 214 is also provided.

[0089] If the user registration information is not registered in the user registration information storage unit 38, the user ID registration screen 210 prompts the user to enter a user ID and password, and the user registration information registration process can be executed.

[0090] 14 is a diagram illustrating user registration information stored in the user registration information storage unit 38 according to another embodiment. In this example, a user ID, a password, and an encryption key are registered in association with a card ID.

[0091] As an example, a user ID "AAA", a password "PW1", and an encryption key "Ekey0001" are registered in association with a card ID "0001". A user ID "BBB", a password "PW7", and an encryption key "Ekey0007" are registered in association with a card ID "0007". A user ID "CCC", a password "PW24", and an encryption key "Ekey0024" are registered in association with a card ID "0024". A user ID "DDD", a password "PW581", and an encryption key "Ekey0581" are registered in association with a card ID "0581". A user ID "EEE", a password "PW5", and an encryption key "Ekey0005" are registered in association with a card ID "0005". The same applies to other user registration information.

[0092] 15 is a diagram illustrating authentication registration information stored in the authentication registration information storage unit 108 according to another embodiment. Referring to FIG. 15, in this example, a password "PW1" and an encryption key "Dkey0001" are registered in association with a user ID "AAA." A password "PW7" and an encryption key "Dkey0007" are registered in association with a user ID "BBB." A password "PW24" and an encryption key "Dkey0024" are registered in association with a user ID "CCC." A password "PW581" and an encryption key "Dkey0581" are registered in association with a user ID "DDD." A password "PW5" and an encryption key "Dkey0005" are registered in association with a user ID "EEE." The same applies to other user registration information.

[0093] FIG. 16 is a diagram illustrating the flow of data exchange during registration processing between an image forming apparatus 1 and an authentication server 100 according to another embodiment. In this example, a case is described in which a user carrying an IC card has not registered as a user. Referring to FIG. 16, the IC card reader 22 acquires card information (sequence SQ0). The user information acquisition unit 30 checks whether it is possible to acquire user registration information stored in the user registration information storage unit 38 according to the card ID acquired via the IC card reader 22 (sequence SQ1). In this example, the user information acquisition unit 30 illustrates a case in which user registration information has not been registered in the user registration information storage unit 38 according to the acquired card information (sequence SQ2). If the user information acquisition unit 30 determines that it cannot acquire user registration information, it instructs the user registration management unit 36. The user registration management unit 36 displays a user ID registration screen (sequence SQ4).

[0094] The user registration management unit 36 transmits a registration request for the user ID and password (PW) to the authentication server 100 in accordance with the user ID and password input on the user ID registration screen 210 (sequence SQ6).

[0095] Next, the authentication registration management unit 106 receives a registration request for the user ID and password (PW) from the image forming apparatus 1, and generates a temporary key (sequence SQ8).

[0096] Next, the authentication registration management unit 106 transmits the generated temporary key to the image forming apparatus 1 (sequence SQ10).

[0097] The user registration management unit 36 receives the temporary key from the authentication server 100 and generates a public encryption key (sequence SQ11). The public encryption key includes a private key and a public key.

[0098] Next, the user registration management unit 36 encrypts the temporary key using the private key of the generated public encryption key (sequence SQ12).

[0099] The user registration management unit 36 transmits the user ID, password (PW), encrypted data, and public key to the authentication server 100. The encrypted data is a temporary key encrypted using a private key.

[0100] The authentication registration management unit 106 receives the user ID, password (PW), encrypted data, and public key from the authentication server 100, and decrypts the encrypted data with the public key (sequence SQ16).

[0101] The authentication registration management unit 106 checks whether the decrypted temporary key is the same as the transmitted temporary key (sequence SQ17).

[0102] If the authentication registration management unit 106 determines that the comparison results match, it registers the authentication registration information in the authentication registration information storage unit 108 (sequence SQ18). The authentication registration information storage unit 108 stores authentication registration information that associates identification information (user ID and password) for identifying users registered in the image forming device 1 with encryption keys (public keys) set for each user, as shown in Fig. 15 .

[0103] The authentication registration management unit 106 transmits a registration completion notification to the image forming apparatus 1 (sequence SQ20).

[0104] When the user registration management unit 36 receives a registration completion notification from the authentication server 100, it registers the user registration information in the user registration information storage unit 38 in response to the result of the registration completion in the authentication server 100 (sequence SQ22). The user registration management unit 36 registers the user registration information in the user registration information storage unit 38, which associates the user ID and password for each user with the encryption key (secret key) set for each user, as shown in Fig. 14 .

[0105] This completes the registration process. 17 is a diagram illustrating the flow of data exchange during authentication processing between an image forming apparatus 1 and an authentication server 100 according to another embodiment. In this example, a case will be described in which a user who possesses an IC card is a registered user.

[0106] Referring to FIG. 17, IC card reader 22 acquires card information (sequence SQ30). User information acquisition unit 30 checks whether it can acquire user registration information stored in user registration information storage unit 38 according to the card ID acquired via IC card reader 22 (sequence SQ31). In this example, user information acquisition unit 30 indicates that user registration information has been registered in user registration information storage unit 38 according to the acquired card information (sequence SQ32). Next, user information acquisition unit 30 instructs authentication request unit 32, and authentication request unit 32 generates an authentication request (sequence SQ34). Authentication request unit 32 transmits the user ID and encrypted data to authentication server 100 as the authentication request. The encrypted data is a password encrypted using a private key.

[0107] Next, authentication processing unit 102 receives an authentication request from image forming apparatus 1 (sequence SQ38).

[0108] Next, authentication processing unit 102 acquires an encryption key according to the user ID included in the authentication request (sequence SQ40). Specifically, authentication processing unit 102 acquires a public key corresponding to the user ID from the authentication registration information stored in authentication registration information storage unit 108.

[0109] Next, authentication processing unit 102 decrypts the encrypted data based on the acquired public key (sequence SQ42). Authentication processing unit 102 decrypts the encrypted password using the public key.

[0110] The authentication processing unit 102 checks whether the decrypted password is the same as the password included in the authentication registration information (sequence SQ43).

[0111] If the verification result indicates a match, the authentication processing unit 102 determines that the authentication is OK (sequence SQ44).

[0112] The authentication processing unit 102 transmits an authentication OK notification to the image forming apparatus 1 (sequence SQ46).

[0113] When authentication request unit 32 receives an authentication OK notification from authentication server 100, it notifies login control unit 34, and login control unit 34 executes login processing (sequence SQ48), thereby completing the authentication processing.

[0114] According to another embodiment, data is exchanged using a password as encrypted data instead of a temporary key. An encryption key is generated for each user, and authentication is performed based on the generated encryption key. This allows for secure authentication.

[0115] Furthermore, according to this method, when performing authentication processing using an IC card possessed by each user, there is no need to transmit the IC card information to the authentication server 100, and the IC card information can be kept secure.

[0116] In this example, a user authentication method using an IC card has been described, but it is not limited to an IC card, and biometric information can be used instead of an IC card in the same way. All that is needed is to register the biometric information instead of the card ID. Furthermore, it is not limited to biometric information, and the same can be applied to a user authentication method using, for example, a PIN code.

[0117] The embodiments disclosed herein should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims. [Explanation of symbols]

[0118] 1 Image forming device, 12 Operation unit, 14 Display unit, 16 Network communication unit, 18 Image reading unit, 20 Printer unit, 22 Card reader, 24 Memory, 26 RAM, 28 Biometric information acquisition unit, 30 User information acquisition unit, 32 Authentication request unit, 34 Login control unit, 36 User registration management unit, 38 User registration information storage unit, 50 Network, 100 Authentication server, 102 Authentication processing unit, 104 Encryption key acquisition unit, 106 Authentication registration management unit, 108 Authentication registration information storage unit.

Claims

1. an information processing device; an authentication server connected to the information processing device via a network; The information processing device includes: a user registration information storage unit that stores user registration information in which identification information for identifying a user is associated with an encryption key set for each user; a user information acquisition unit that acquires the user registration information stored in the user registration information storage unit based on an instruction operation by a user; an authentication request unit that generates an authentication request including data encrypted based on an encryption key included in the acquired user registration information and identification information included in the acquired user registration information, and transmits the authentication request to the authentication server; a user registration management unit that registers the user registration information in the user registration information storage unit for each user, The authentication server an authentication registration information storage unit that stores authentication registration information that associates identification information for identifying a user registered in the information processing device with an encryption key set for each user; an encryption key acquisition unit that acquires an encryption key included in the authentication registration information in response to the identification information included in the authentication request received from the information processing device; an authentication processing unit that decrypts the encrypted data based on the acquired encryption key and transmits an authentication result to the information processing device; an authentication registration management unit that registers the authentication registration information in the authentication registration information storage unit for each user; the user registration management unit accepts a registration request including user identification information and transmits the registration request to the authentication server; the authentication registration management unit receives the registration request, generates temporary information, and transmits the temporary information to the information processing device; The user registration management unit receiving the temporary information and generating a public key and a private key paired with the public key, which are encryption keys, for each user; encrypting the temporary information based on the private key together with the public key and transmitting the encrypted temporary information to the authentication server; the authentication registration management unit decrypts the encrypted temporary information based on the acquired public key, and registers the decrypted temporary information in the authentication registration information storage unit as the authentication registration information in which the identification information and the public key are associated based on a comparison of the temporary information; the encrypted data included in the authentication request is the temporary information encrypted based on the private key; The authentication processing unit decrypts the encrypted temporary information based on the public key, which is the acquired encryption key, and transmits an authentication result based on a comparison of the temporary information as the decryption result to the information processing device.

2. the information processing device further includes a card information acquisition unit that acquires card information of a card held by a user; The authentication system according to claim 1 , wherein the user information acquisition unit acquires the user registration information stored in the user registration information storage unit based on card information acquired based on the user's instruction operation on the card information acquisition unit.

3. the information processing device further includes a biometric information acquisition unit that acquires biometric information of a user; The authentication system according to claim 1 , wherein the user information acquisition unit acquires the user registration information stored in the user registration information storage unit based on biometric information acquired based on an instruction operation of the user to the biometric information acquisition unit.

4. 2. The authentication system according to claim 1, wherein the user information acquisition unit acquires the user registration information stored in the user registration information storage unit based on an input instruction operation of the user's code.

5. The information processing device includes: a receiving unit that receives the authentication result; The authentication system according to claim 1 , further comprising a login control unit that switches the information processing device to a login state based on the authentication result received by the receiving unit.

6. 2. The authentication system according to claim 1, wherein the encryption key has an expiration date.

7. the information processing device further includes a user registration management unit that registers the user registration information for each user in the user registration information storage unit; The user registration management unit determining whether the encryption key included in the user registration information is within its expiration date; 2. The authentication system according to claim 1, wherein the user registration information is re-registered in the user registration information storage unit for each user based on the determination result.

8. A control method for an authentication system including an information processing device and an authentication server connected to the information processing device via a network, storing user registration information in which identification information for identifying a user and an encryption key set for each user are associated with each other; acquiring the stored user registration information based on an instruction operation by a user; generating an authentication request including data encrypted based on an encryption key included in the acquired user registration information and identification information included in the acquired user registration information, and transmitting the authentication request to the authentication server; registering the user registration information for each user; storing authentication registration information in which identification information for identifying a user registered in the information processing device is associated with an encryption key set for each user; acquiring an encryption key included in the authentication registration information corresponding to the identification information included in the authentication request received from the information processing device; decrypting the encrypted data based on the obtained encryption key and transmitting an authentication result to the information processing device; registering the authentication registration information for each user; The step of registering the user registration information includes accepting a registration request including user identification information and transmitting the registration request to the authentication server; The step of registering the authentication registration information includes receiving the registration request, generating temporary information, and transmitting the temporary information to the information processing device; The step of registering the user registration information includes: receiving the temporary information and generating a public key and a private key paired with the public key, which are encryption keys, for each user; encrypting the temporary information based on the private key together with the public key and transmitting the encrypted temporary information to the authentication server; the step of registering the authentication registration information includes decrypting the encrypted temporary information based on the acquired public key, and registering the decrypted temporary information as the authentication registration information in which the identification information and the public key are associated with each other based on a comparison of the temporary information; the encrypted data included in the authentication request is the temporary information encrypted based on the private key; A control method for an authentication system, wherein the step of transmitting the authentication result to the information processing device decrypts the encrypted temporary information based on the public key, which is the acquired encryption key, and transmits the matching result of the temporary information as the decryption result.

Images