Network system, data processing apparatus, and method for multi-factor authentication

• US 9,203,822 B2
• Filed: 08/27/2013
• Issued: 12/01/2015
• Est. Priority Date: 09/06/2012
• Status: Active Grant

• Current Assignee: Ricoh Company Limited
• Original Assignee: Ricoh Company Limited
• Inventors: Ono, Yohei, Kota, Noriko
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US14/010,651
• Publication Number:
  US 20140068714A1
• Time in Patent Office: 826 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 3/1222 Increasing security of the print job
• CPC Class Codes: G06F 3/1238 Secure printing, e.g. user identification, user rights for device usage, unallowed content, blanking portions or fields of a page, releasing held jobs
• CPC Class Codes: G06F 3/1288 in client-server-printer device configuration
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A method for processing data with a terminal and a system connected to the terminal via a network, which includes the steps of executing a process according to a request transmitted from the terminal via the network, performing a first user authentication with respect to the terminal by using the terminal or an authentication apparatus connected to the terminal via the network, storing first authentication data used for the first user authentication in association with second authentication data used for a second user authentication in a storage unit, and performing the second user authentication with respect to the system. In a case where at least a portion of the first authentication data is authenticated by the first user authentication, the second user authentication is performed by using the first and second authentication data stored in the storage unit and the portion of the first authentication data.

Claims

1. A network system, comprising:

a terminal;

a system connected to the terminal via a network, the system including one or more data processing apparatuses and configured to execute a process according to a request transmitted from the terminal via the network;

a first storage unit, at the terminal or an authentication apparatus connected to the terminal, that stores first authentication data used for a first user authentication;

a first authentication unit, at the terminal or the authentication apparatus, that performs a first user authentication with respect to a user at the terminal;

a second storage unit, at the system, that stores user management data that includes specification data in association with second authentication data used for a second user authentication, the specification data identifying a user authenticated by the first authentication data, the first authentication data unit not authenticating the user by only the specification data; and

a second authentication unit, at the system, that performs the second user authentication with respect to the user at the terminal to use the system based on the specification data when the terminal sends the specification data of the authenticated user by the first user authentication and based on the second authentication data when the terminal sends the second authentication data input by the user.

2. The network system as claimed in claim 1,

wherein in a case where the specification data received from the terminal is stored in the second storage unit, the second authentication unit is configured to perform the second user authentication.

3. The network system as claimed in claim 2,

further comprising:

a receiving unit configured to receive the second authentication data from the terminal in a case where the specification data received by the second authentication unit is not stored in the second storage unit;

a third authentication unit configured to perform a third user authentication on the second authentication data received from the terminal; and

a registration unit configured to register at least a portion of the second authentication data received from the terminal in association with the specification data.

4. The network system as claimed in claim 1,

wherein the second authentication unit is configured to receive a portion of the second authentication data associated with the specification data from the terminal and perform the second user authentication.

5. A data processing apparatus, comprising:

a connection unit configured to connect with a terminal, that is stored with first user authentication data used for a first user authentication by a first authentication unit at the terminal, via a network;

a storage unit configured to store user management data that includes specification data in association with second authentication data used for a second user authentication, the specification data identifying a user authenticated by the first user authentication, the first authentication unit not authenticating the user by only the specification data;

a first receiving unit configured to receive authenticated by the first user authentication from the terminal; and

a second authentication unit that performs the second user authentication with respect to the user at the terminal to use a service based on the specification data when the terminal sends the specification data of the authenticated user by the first user authentication and based on the second authentication data when the terminal sends the second authentication data input by the user.

6. The data processing apparatus as claimed in claim 5, wherein in a case where the specification data is stored in the storage unit, the second authentication unit performs the second user authentication.

7. The data processing apparatus as claimed in claim 6, further comprising:

a second receiving unit configured to receive the second authentication data from the terminal in a case where the specification data received by the first receiving unit is not stored in the storage unit;

a third authentication unit configured to perform a third user authentication on the second authentication data received from the terminal; and

a registration unit configured to register at least a portion of the second authentication data received from the terminal in association with the specification data in a case where the second authentication data is authenticated by the third authentication unit.

8. The data processing apparatus as claimed in claim 7, further comprising:

a third receiving unit configured to receive the second authentication data from an apparatus;

a fourth authentication unit configured to perform a fourth user authentication on the second authentication data received by the third receiving unit; and

a data receiving unit configured to receive data from the apparatus in a case where the second authentication data is authenticated by the fourth authentication unit;

wherein the terminal is configured to use the service by using the data received from the apparatus in a case where the second authentication unit performs the second user authentication.

9. A method for processing data with a terminal and a system connected to the terminal via a network, the method comprising the steps of:

executing a process according to a request transmitted from the terminal via the network;

performing a first user authentication with respect to a user at the terminal;

storing user management data that includes specification data in association with second authentication data used for a second user authentication in a storage unit, the specification data identifying a user authenticated by the first user authentication, the first authentication not authenticating the user by only the specification data; and

performing the second user authentication with respect to the user at the terminal to use the system based on the specification data when the terminal sends the specification data of the authenticated user by the first user authentication and based on the second authentication data when the terminal sends the second authentication data input by the user.

10. The method as claimed in claim 9,

wherein in a case where the specification data received from the terminal is stored in the storage unit, the second user authentication is performed.

11. The method as claimed in claim 10,

further comprising:

receiving the second authentication data from the terminal in a case where the specification data is not stored in the storage unit;

performing a third user authentication on the second authentication data received from the terminal; and

registering at least a portion of the second authentication data received from the terminal in association with the specification data.

12. The method as claimed in claim 10,

wherein the storage unit is provided in the authentication apparatus,

wherein the second user authentication is performed in a case where a portion of the second authentication data associated with the specification data from the terminal is received.