Information processing system, information processing method, and computer readable medium

Abstract

Disclosed are an information processing system, an information processing method, and a computer readable medium, the information processing system being provided with one or more processors that manage a token used in access to a service and identification information for identifying the service in association with each other, when a request including a designated token of a service based on the identification information is accepted from the external device and a valid token of the designated service is possessed, a response including the token of the designated service is returned to the external device.

Description

Technical Field

[0001] The present invention relates to an information processing system, an information processing method and a computer readable medium. Background Art

[0002] For example, from the viewpoint of realizing single sign-on (SSO) and improving security, the introduction of so-called advanced authentication such as authentication using OAuth authorization (hereinafter, sometimes referred to as “OAuth authentication”) is being promoted.

[0003] Japanese Patent No. 6873642 describes the following technology: in an image forming device having a selection unit and a second user authentication unit, a sending unit that sends an image file to a sending address uses a function of an external server to execute after performing user authentication based on the second user authentication unit, the selection unit selects an access token to be used from access tokens managed by an access token management unit based on a user authenticated by a first user authentication unit, and the second user authentication unit uses the selected access token to perform user authentication on the external server.

[0004] A portable information terminal device is described in Japanese Patent No. 5831480. The portable information terminal device has an acquisition unit and a request unit. The acquisition unit enables an information device shared by multiple users to acquire an access token and acquires the access token it has acquired. The request unit sends the access token to the information device when requesting the execution of a service process, thereby enabling the information device to execute data communication with a service usage system based on a request for the execution of the service process. Summary of the invention

[0005] In advanced authentication such as OAuth authentication, an external device presents an access token acquired based on authentication settings to an authorization server to a service side, and if the presented access token is valid, access to the service can be performed through the external device.

[0006] However, there is a method in which an external device directly obtains an access token from an authorization server based on the authentication setting performed between the external device and the authorization server. In this method, it is necessary to perform authentication setting with the authorization server for each external device that uses the service. Therefore, for example, when a service is to be used in multiple external devices, it is necessary to perform authentication setting operations in each external device to obtain an access token, which is labor-intensive and time-consuming.

[0007] Compared with the case where an access token is acquired through authentication setting performed between an external device and an authorization server, the present invention reduces the workload and time required for acquiring an access token in an external device.

[0008] According to a first aspect of the present invention, there is provided an information processing system comprising one or more processors, which manage a token used in accessing a service in association with identification information for identifying the service, and upon receiving a request for a token designated for a service based on the identification information from an external device and the system possessing a valid token for the designated service, return a response including the token for the designated service to the external device.

[0009] According to the second aspect of the present invention, in the information processing system based on the first aspect, the one or more processors obtain the token associated with the identification information in advance based on the authentication settings of the system and the authorization server, and manage the information of the authentication settings in association with the identification information.

[0010] According to the third aspect of the present invention, in the information processing system based on the second aspect, when the one or more processors receive the request from the external device and do not have a valid token for the specified service and the authentication setting information of the token, they will notify the external device that the token for the specified service cannot be provided.

[0011] According to the fourth aspect of the present invention, in the information processing system based on any one of the first to third aspects, the one or more processors, as the token associated with the identification information, manage the access token prompted to the service server providing the service when accessing the service and the update token capable of obtaining the access token by prompting the authorization server, and return the response including the access token of the specified service to the external device when having a valid access token for the specified service.

[0012] According to the fifth aspect of the present invention, in the information processing system based on the fourth aspect, the one or more processors use an update token to obtain an access token for the specified service without having a valid access token for the specified service, and return the response including the obtained access token for the specified service to the external device.

[0013] According to the sixth aspect of the present invention, in the information processing system based on any one of the first to third aspects, the one or more processors, as the token associated with the identification information, manage an update token capable of obtaining an access token that prompts a service server that provides the service when accessing the service by prompting an authorization server, and when having a valid update token for the specified service, return the response including the update token for the specified service to the external device.

[0014] According to the seventh aspect of the present invention, in the information processing system based on the sixth aspect, the one or more processors manage the update token and the access token as the token associated with the identification information, and when having a valid update token for the specified service, return the response including both the update token and the access token for the specified service to the external device.

[0015] According to the eighth aspect of the present invention, in the information processing system based on any one of the first to seventh aspects, the one or more processors manage the service information used by the service server that provides the service in association with the identification information, and the service information of the specified service is included in the response including the token of the specified service to the external device.

[0016] According to a ninth aspect of the present invention, a computer-readable medium is provided, which stores a program that causes a computer to perform processing, wherein the processing includes: a process of managing a token used in accessing a service and identification information used to identify the service in association with each other; and a process of returning a response including the token for the specified service to the external device when a request for a token for a specified service based on the identification information is received from the external device and the external device has a valid token for the specified service.

[0017] According to the tenth aspect of the present invention, there is provided an information processing method comprising: a process of managing a token used in accessing a service and identification information used to identify the service in association with each other; and a process of returning a response including the token for the specified service to the external device when a request for a token specifying a service based on the identification information is received from the external device and the external device has a valid token for the specified service.

[0018] (Effect)

[0019] According to the first and tenth aspects, compared with the case where an access token is acquired through authentication setting performed between an external device and an authorization server, the workload and time required for acquiring an access token in an external device are reduced.

[0020] According to the second aspect, the authentication setting information is stored, and the workload and time required to obtain a token again are reduced.

[0021] According to the third aspect, in the external device, various processes corresponding to failure to acquire the requested token can be executed.

[0022] According to the fourth aspect, compared with the case where only the access token is managed, the degree of freedom is increased in the correspondence when a valid access token is not possessed.

[0023] According to the fifth aspect, even when a valid access token is not possessed, a valid access token can be reacquired by updating the token and provided to an external device.

[0024] According to the sixth aspect, in the external device, it is possible to acquire an access token using the update token.

[0025] According to the seventh aspect, in the external device, a fast service can be used by the provided access token, and an access token using an update token can be acquired.

[0026] According to the eighth aspect, compared with the case where service information is registered in each external device used, the workload and time are reduced.

[0027] According to the ninth aspect, compared with the case where an access token is acquired through authentication setting performed between the external device and the authorization server, the workload and time required for acquiring the access token in the external device are reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a diagram showing an example of the structure of a service utilization system.

[0029] Figure 2 This is a block diagram showing an example of the hardware configuration of a user terminal.

[0030] Figure 3 This is a diagram showing an example of the hardware configuration of an external device.

[0031] Figure 4 This is a block diagram showing an example of the functional configuration of a user terminal to which the first embodiment is applied.

[0032] Figure 5 This is a diagram showing an example of an information management table.

[0033] Figure 6 This is a block diagram showing an example of the functional structure of an external device.

[0034] Figure 7 This is a sequence diagram showing an example of the operation of the service utilization system.

[0035] Figure 8 This is a flowchart showing an example of operations related to provision of an access token in a user terminal to which the first embodiment is applied.

[0036] Fig. 9 This is a flowchart showing an example of the operation related to the provision of the update token in the user terminal to which the second embodiment is applied. DETAILED DESCRIPTION

[0037] Hereinafter, the first embodiment and the second embodiment will be described in detail as embodiments of the present invention with reference to the drawings. In addition, when describing the common structure in the first embodiment and the second embodiment, when the two are not particularly distinguished, they may be labeled as "this embodiment".

[0038] First, refer to Figure 1 to Figure 7 , a first embodiment is described.

[0039] <First embodiment>

[0040] [Service usage system 1000]

[0041] Figure 1 This is a diagram showing an example of the structure of the service utilization system 1000.

[0042] As shown in the figure, the service use system 1000 includes a user terminal 1, an external device 2, an authorization server 3 (3a, 3b, ...), and a service server 4 (4a, 4b, ...). In addition, each device is connected via a network. There is no particular limitation on the network as long as it can be used for data communication between devices.

[0043] The service use system 1000 is a computer system that enables the use of services provided by the service server 4 in the external device 2. More specifically, when the external device 2 in the service use system 1000 requests the use (access) of the service of the service server 4, it presents the access token obtained based on the authentication setting of the authorization server 3 to the service server 4. If the presented access token is valid, the service server 4 provides the service to the external device 2.

[0044] The access token is a token presented to the service server 4 when accessing a service, and is unique information created based on authentication settings by the authorization server 3. The access token is given, for example, with several dozen alphanumeric characters.

[0045] The access token is set with an expiration date, and if an access token with an expired expiration date is presented, the service server 4 will not allow the use of the service. The expiration date of the access token is set to, for example, about one hour to several hours.

[0046] In addition, the update token is a token that can obtain an access token by prompting the authorization server 3, and is unique information created by the authorization server 3 based on the authentication setting. As a specific example, when the user terminal 1 or the external device 2 prompts the authorization server 3 for an update token, the authorization server 3 will newly issue a corresponding access token. In addition, the update token is sometimes also called a refresh token.

[0047] Sometimes, an expiration date is set for the update token. If the update token whose expiration date has expired is displayed, the authorization server 3 will not issue an access token. The expiration date of the update token is set to about one month to several months, for example. In addition, the expiration date of the update token can be updated (extended) by request.

[0048] Access tokens and update tokens are examples of tokens used to access services.

[0049] Here, consider a method in which the external device 2 directly obtains the access token from the authorization server 3 based on the authentication setting between the external device 2 and the authorization server 3. In this method, for example, when a user uses multiple external devices 2, each external device 2 must perform the authentication setting for the authorization server 3, which is time-consuming and laborious. In addition, for example, when the same authentication setting is used to obtain the access token next time or later, the information of the authentication setting between the external device 2 and the authorization server 3 must be stored in each external device 2, and the storage capacity of the external device 2 (for example, the storage capacity to be used later) is limited. Figure 3 The capacity of the auxiliary storage unit 22 described above is compressed.

[0050] Therefore, in this embodiment, authentication is set up between the user terminal 1 and the authorization server 3 , and the user terminal 1 obtains an access token or an update token from the authorization server 3 and provides it to the external device 2 .

[0051] The user terminal 1 is a device that provides an access token or an update token of a designated service to the external device 2 in response to a request from the external device 2. Figure 1 In the example shown in FIG. 1 , only one user terminal 1 is shown, but there may be multiple user terminals 1. More specifically, when multiple users use the service usage system 1000, multiple user terminals 1 used by each user may be set. In this embodiment, the case where only one user terminal 1 owned by each user is used is taken as an example.

[0052] As the user terminal 1, various computer devices (information processing devices) can be used, and specific examples thereof include smartphones, tablet computers, etc. The user terminal 1 may be composed of one computer or a plurality of computers.

[0053] The user terminal 1 is an example of the information processing system to which the first embodiment is applied.

[0054] The external device 2 is a device used by the user. The external device 2 uses the service provided by the service server 4 and executes various processes corresponding to the instructions of the user.

[0055] In addition, the word "external device" indicates a device that is external to the structure of the service server 4 (not included in the structure of the service server 4), and indicates that when using the service provided by the service server 4, some kind of authentication such as OAuth authentication is requested.

[0056] In this embodiment, the external device 2 is described as an example in which the external device 2 is an image processing device capable of reading (scanning) an image formed on a recording material or forming (printing) an image on a recording material, etc. However, the external device 2 may be any of various devices, and there is no limitation as long as the device has a computer as a control unit and uses the service provided by the service server 4.

[0057] The authorization server 3 is a server that issues access tokens or update tokens. The authorization server 3 of this embodiment issues access tokens and update tokens according to requests from other devices in the authorization process, and transmits them to the device of the request source. The authorization process refers to the steps (process) for obtaining access tokens, including the process of authentication setting for the authorization server 3. In addition, as described above, the authorization server 3 also issues the corresponding access token when prompted to update the token. In the re-issuance of the access token using the update token, the authorization process is not required.

[0058] In this embodiment, the case where the authorization server 3a issues a token for using the service provided by the service server 4a and the authorization server 3b issues a token for using the service provided by the service server 4b is taken as an example. In addition, sometimes the token issued by the authorization server 3a is referred to as token A, access token A, and update token A, and the token issued by the authorization server 3b is referred to as token B, access token B, and update token B for distinction.

[0059] The service server 4 is a server that provides services in response to requests from other devices. More specifically, when the service server 4 requests provision of services from other devices and is presented with a valid access token, it provides services to the device of the request source.

[0060] Here, each service server 4 provides different services. Different services not only refer to services of different categories such as a service for sending files by e-mail and a service for storing files, but also include cases where other elements are different. For example, a service server 4 and another service server 4 provide the same type of service, but the providers of the two are different.

[0061] In addition, Figure 1 In the example of FIG. 4 , only two service servers 4a and 4b are shown, but the number of service servers 4 may be three or more. Correspondingly, the number of authorization servers 3 may also be three or more.

[0062] In this embodiment, the case where both service servers 4a and 4b can provide a service (sometimes referred to as a "mail service") of sending an email including data received from an external device 2 to a specified address via SMTP (Simple Mail Transfer Protocol) is taken as an example. However, in service server 4a and service server 4b, the service providers are different, and the services provided by the two are different services. Hereinafter, service servers 4a and 4b are sometimes referred to as SMTP servers 4a and 4b. In addition, the mail service performed by SMTP server 4a is sometimes referred to as mail service A, and the mail service performed by SMTP server 4b is sometimes referred to as mail service B.

[0063] Moreover, in this embodiment, the external device 2, which serves as an image processing device, can provide the user with a function of sending an email including image data created by scanning to a specified address by using the mail service A of the SMTP server 4a or the mail service B of the SMTP server 4b (sometimes referred to as a "scan mail function").

[0064] [User terminal 1]

[0065] Figure 2 This is a block diagram showing an example of the hardware configuration of the user terminal 1 .

[0066] As shown in the figure, the user terminal 1 includes a control unit 10, an auxiliary storage unit 12, a communication unit 13, an input unit 14, and a display unit 15. This configuration is an example, and the user terminal 1 may include a camera or a voice output device in addition to the above.

[0067] The control unit 10 executes various processes according to the read program to control the operation of the device. In addition, the control unit 10 includes a CPU (Central Processing Unit) 10a as a computing unit, a RAM (Random Access Memory) 10b used as a working memory of the CPU 10a, and a ROM (Read Only Memory) 10c storing programs executed by the CPU 10a or pre-prepared setting values. In addition, it includes a non-volatile memory 10d that can be rewritten and can retain data even when the power supply is interrupted, and an interface unit 10e that controls various units such as a communication unit 13 connected to the control unit 10. In addition, the non-volatile memory 10d is composed of, for example, an SRAM or flash memory backed up by a battery.

[0068] In the user terminal 1 to which the present embodiment is applied, various functions described later are realized by the CPU 10 a as an example of a processor reading and executing a program.

[0069] Here, various programs executed by CPU10a are provided in a state of being stored in a computer-readable recording medium such as a magnetic recording medium (tape, disk, etc.), an optical recording medium (optical disk, etc.), a magneto-optical recording medium, a semiconductor memory, etc. In addition, the program executed by CPU10a can also be downloaded using a communication unit such as the Internet. In addition, a processor refers to a processor in a broad sense, including a general-purpose processor (such as a CPU, etc.), or a dedicated processor (such as a GPU: Graphics Processing Unit (graphics processor), ASIC: Application Specific Integrated Circuit (application-specific integrated circuit), FPGA: Field Programmable Gate Array (field programmable gate array), programmable logic device, etc.). In addition, the action of the processor is not only performed by one processor, but can also be performed by the collaboration of multiple processors in physically separated locations. In addition, the order of the actions of the processor is not limited to the order described as an embodiment, and can also be changed.

[0070] The auxiliary storage unit 12 not only records the programs to be executed by the CPU 10a, but also provides a database (hereinafter referred to as "database") for storing information on authentication settings with the authorization server 3, access tokens / update tokens obtained from the authorization server 3, and various data used by the user terminal 1. Figure 4 The auxiliary storage unit 12 is implemented by a storage device such as a magnetic disk device or a SSD (Solid State Drive).

[0071] The communication unit 13 communicates via a network (see Figure 1 ) to communicate data between it and other devices. As the communication unit 13, an interface corresponding to the communication method of the network is used. In addition, when short-range wireless communication such as BLE (Bluetooth Low Energy) (registered trademark) or NFC (Near Field Communication) is performed between the user terminal 1 and the external device 2, the communication unit 13 may also have an interface for wireless communication corresponding to the communication method.

[0072] The input unit 14 is a device such as a touch sensor that outputs a control signal corresponding to an operation of contact with a hardware button, switch, finger, etc. that receives input operations from the user, a code reader that reads coded information such as a barcode or QR code (registered trademark), and a sensor that reads the user's biological information.

[0073] The display unit 15 is composed of, for example, a liquid crystal display or an organic EL (Electro-Luminescence) display, and displays a screen including various information such as images or texts. In addition, a touch sensor as one of the input units 14 may be combined with the display unit 15 to form a touch panel. In this case, software buttons and the like that receive input operations from the user are displayed on the display unit 15.

[0074] [Hardware Configuration of External Device 2]

[0075] Figure 3 This is a diagram showing an example of the hardware configuration of the external device 2.

[0076] As shown in the figure, the external device 2 includes a control unit 20, an auxiliary storage unit 22, a communication unit 23, an input unit 24, and a display unit 25. In addition, since the external device 2 of this embodiment is an image processing device, it includes an image forming unit 26 and an image reading unit 27 as components related to image processing.

[0077] In addition, since the control unit 20, the communication unit 23, the input unit 24 and the display unit 25 in the external device 2 are respectively connected to the user Figure 2 The control unit 10 , the communication unit 13 , the input unit 14 , and the display unit 15 of the user terminal 1 described above are the same, and thus description thereof will be omitted here.

[0078] The auxiliary storage unit 22 not only records the programs executed by the CPU 20a, but also provides a database (hereinafter referred to as "database") for storing various data used by the external device 2, such as the access token / update token acquired from the user terminal 1, the image data used for printing in the image forming unit 26, and the image data created based on the reading result in the image reading unit 27. Figure 6 The auxiliary storage unit 22 is implemented by various storage devices, similar to the auxiliary storage unit 12 of the user terminal 1.

[0079] The image forming unit 26 is constituted by a printer engine such as a laser printer or an inkjet printer, for example, and forms and prints an image corresponding to image data on a recording material such as paper in accordance with an instruction from the control unit 20 .

[0080] The image reading unit 27 is composed of an image scanner or the like, reads an image formed on a recording material (manuscript) such as paper in accordance with an instruction from the control unit 20 , and transmits the image data corresponding to the reading result to the control unit 20 .

[0081] [Hardware Structure of Authorization Server 3 and Service Server 4]

[0082] As an example, the authorization server 3 and the service server 4 have Figure 2 The user terminal 1 shown has the same hardware structure.

[0083] Furthermore, the service server 4 has various structures necessary for providing services.

[0084] [Functional Structure of User Terminal 1]

[0085] Figure 4 This is a block diagram showing an example of the functional configuration of the user terminal 1 to which the first embodiment is applied.

[0086] As shown in the figure, the user terminal 1 to which the first embodiment is applied includes an operation accepting unit 101 , an authentication managing unit 102 , a connection managing unit 103 , a request accepting unit 104 , a token managing unit 105 , a response generating unit 106 , a notification generating unit 107 , and a communication controlling unit 108 .

[0087] Furthermore, the user terminal 1 includes an authentication setting DB 121 storing authentication setting information and a token DB 122 storing access tokens / update tokens as databases (sometimes referred to as “DB”) on the auxiliary storage unit 12 .

[0088] The operation receiving unit 101 receives the user's input via the input unit 14 (see Figure 2 ) input. The operation receiving unit 101 receives, for example, an operation of inputting authentication setting information or service information via the input unit 14. In addition, for example, when the user terminal 1 is used as a remote UI (user interface) (hereinafter referred to as remote UI), Figure 7 ), the operation accepting unit 101 accepts an operation for selecting a function to be used in the external device 2, etc.

[0089] The authentication management unit 102 manages the authentication settings between the present system (user terminal 1) and the authorization server 3. The authentication management unit 102 associates the authentication settings for specifying and performing the services provided by the service server 4 with the identification information of the services. More specifically, the authentication settings for specifying and performing the mail service A provided by the SMTP server 4a are associated with the identification information of the mail service A and stored in the authentication settings DB 121 on the auxiliary storage unit 12 for management. In addition, the authentication settings for specifying and performing the mail service B provided by the SMTP server 4b are associated with the identification information of the mail service B and stored in the authentication settings DB 121 for management.

[0090] In addition, when the request accepting unit 104 accepts a request from the external device 2, the authentication management unit 102 can retrieve authentication setting information associated with the identification information of the designated service from the authentication setting DB 121 and use it for processing in the system.

[0091] Here, the identification information is not limited, as long as it is information that can identify the corresponding service in the user terminal 1 and the external device 2. For example, for the identification of the service, it can also be the ID of each service pre-registered in the user terminal 1 and the external device 2. In addition, for example, it can also be the name of each service pre-registered in the user terminal 1 and the external device 2, the address of the service server 4 that provides the service, the account information of the service, the email address in the email service, etc. In addition, as described in the present embodiment, in the case where the authorization server 3 and the service server 4 correspond 1:1, that is, only one authorization server 3 that issues a token to each service server 4 is determined, the information related to the corresponding authorization server 3 can also be used as the identification information. More specifically, it can also be the name, address, ID and password used in the authentication setting determined for the corresponding authorization server 3.

[0092] In addition, in this embodiment, the case where the name of each service is used as identification information is described as an example.

[0093] Information on authentication settings may include, for example, the path of the authorization endpoint in the authorization server 3, or the path of the token endpoint in the service server 4, the ID, password, scope, redirection URI (Uniform Resource Identifier) ​​requested from the authorization server 3 during authentication settings, the authorization code from the authorization server 3, and other authentication settings between the user terminal 1 and the authorization server 3, as well as various information required for the execution of the authorization process.

[0094] The connection management unit 103 manages the connection status between the user terminal 1 and the external device 2. The connection status refers to a status in which the external device 2 and the user terminal 1 specifically designate each other as connection target devices by returning a response to the connection request issued by the user terminal 1 to the external device 2. That is, it refers to a status in which the user terminal 1 specifies the external device 2 as the device of the token request source, and the external device 2 specifies the user terminal 1 as the device of the token request target. The connection management unit 103 specifies the external device 2 as a device in the connection status by accepting a connection request from the external device 2 and returning a response. The connection request and response are transmitted, for example, via the communication unit 13 (see Figure 2 ) and the user terminal 1 reads the data packets displayed on the display unit 25 of the external device 2 (see Figure 3 ) is performed. In addition, for example, via a network connecting the devices of the service use system 1000 (refer to Figure 1 ) to carry out.

[0095] The request accepting unit 104 accepts a request for a token from the external device 2. More specifically, the request accepting unit 104 of the present embodiment is controlled in such a manner that it accepts a request for a token from the external device 2 in a connected state and performs processing such as creation of a response described later according to the accepted request. In addition, the request for a token includes the designation of a service to be used. The designation of the service is performed by using the same identification information as that used by the authentication management unit 102 or the token management unit 105.

[0096] Furthermore, the request accepting unit 104 stores and manages the request history of the token accepted from the external device 2 in the database on the auxiliary storage unit 12 .

[0097] The token management unit 105 manages the token acquired from the authorization server 3 in association with the identification information of the corresponding service. As described above, since the authorization server 3 of this embodiment issues both access tokens and update tokens, the token management unit 105 manages the acquired access tokens and update tokens in association with the identification information of the corresponding service.

[0098] In addition, the token management unit 105 of this embodiment manages the service information provided by the external device 2 to the service server 4 when using the service and used by the service server 4 in association with the identification information of the corresponding service, similarly to the token. The service information includes information such as the email address, port number, encryption method, etc. required when using the mail services A and B.

[0099] Here, the token management unit 105 of the present embodiment collects and manages information such as identification information, access tokens, update tokens, or service information associated with each service in an information management table within the token DB 122 .

[0100] Figure 5 It is a diagram showing an example of the information management table 500 .

[0101] In the illustrated information management table 500, the second row stores information about mail service A, and the third row stores information about mail service B. As described above, in this embodiment, since the name of the service is used as identification information, for example, in addition to the access token (abc123...) or the update token (xyz456...), service information such as the mail account (user1@hogehoge.com) is managed in association with the name of "mail service B". Figure 5 In the example, the authentication settings or service information related to mail service A have not been registered, and the access token, update token, and mail account columns are "Not Acquired". If the authentication settings and service information related to mail service A have been registered, each information is associated with the name of "mail service A" and added to these columns for management.

[0102] Furthermore, when the request accepting unit 104 accepts a token request from the external device 2 , the token management unit 105 can retrieve the token and service information associated with the identification information of the designated service from the token DB 122 and use them for other processing.

[0103] In addition, the token management unit 105 of the present embodiment uses the authentication setting between the present system and the authorization server 3 to request an access token and an update token from the authorization server 3. In addition, the update token is used to request an access token from the authorization server 3. The authorization server 3 issues a token in accordance with these requests, thereby acquiring a token that becomes a management target of the token management unit 105. In addition, the token management unit 105 can also update / delete access tokens and update tokens that have expired among the tokens that become management targets.

[0104] The response creation unit 106 creates a response including a token of a designated service as a response to a token request from the external device 2. More specifically, the external device 2 of the request source is set as the target, and a response including the token retrieved by the token management unit 105 and service information is created in response to the token request.

[0105] The notification creation unit 107 creates various notifications to be sent to other devices. For example, when the token acquisition from the authorization server 3 fails for some reason or the acquired token cannot be sent to the external device 2, the notification creation unit 107 sets the external device 2 or the terminal of the administrator as the destination and creates an error notification to that effect. In addition, for example, when a certain operation / task is required by the user or administrator of the external device 2 of the user terminal 1, a notification to request the operation / task is created.

[0106] The communication control unit 108 controls the communication unit 13 (see Figure 2 The communication control unit 108 controls, for example, a method of sending a response including a token of a designated service created by the response creation unit 106 to the external device 2 of the request source. In addition, for example, the communication control unit 108 controls a method of sending various notifications created by the notification creation unit 107 and requests for various data used in the processing of the system to other devices such as the external device 2.

[0107] In addition, the communication control unit 108 can extract necessary information from data received from other devices and use it for each functional unit. As a specific example, the communication control unit 108 can extract information related to the token request from data received from the external device 2 and use it for the request receiving unit 104.

[0108] [Functional Structure of External Device 2]

[0109] Figure 6 This is a block diagram showing an example of the functional structure of the external device 2.

[0110] As shown in the figure, the external device 2 includes an operation accepting unit 201 , a connection managing unit 202 , a token requesting unit 203 , a service requesting unit 204 , a display controlling unit 205 , and a communication controlling unit 206 .

[0111] Furthermore, the external device 2 includes, as databases on the auxiliary storage unit 22 , an identification information DB 221 storing identification information of services and an acquisition information DB 222 storing acquired access tokens / update tokens and service information.

[0112] The operation receiving unit 201 receives the user's input via the input unit 24 (see Figure 3 The operation accepting unit 201 accepts operations such as selecting various functions provided by the external device 2 to the user, such as the scan mail function, and accepting operations requesting the use of the functions. In addition, for example, the operation accepting unit 201 accepts input and registration operations of various information performed by users, administrators, etc.

[0113] The connection management unit 202 manages the connection state between the external device 2 and the user terminal 1. The connection management unit 202 identifies the user terminal 1 as a device in the connection state by receiving a connection request and a response from the user terminal 1.

[0114] In addition, the connection management unit 202 releases the connection state with the user terminal 1 at a predetermined timing, such as when the use of the service based on the token provided from the user terminal 1 ends. In addition, for example, when no response is obtained from the user terminal 1 within a pre-set time (timeout), the connection state with the user terminal 1 is released.

[0115] The token request unit 203 creates a token request including the identification information of the designated service as a request to the connected user terminal 1. More specifically, for example, when the operation accepting unit 201 accepts the selection of a function by the user, a token request including the identification information of the service required for the execution of the function is created. In addition, the token request may also include a request for service information corresponding to the designated service.

[0116] Furthermore, when the token request unit 203 of the present embodiment has a renewal token, it may request the authorization server 3 to issue an access token using the renewal token.

[0117] The service request unit 204 creates a service use request to the service server 4. The service use request includes, for example, data used in the service of the service server 4, such as image data created by scanning by the external device 2 and used in the mail service. In addition, for example, it includes service information received from the user terminal 1, information for specifying the external device 2 (self-device) of the request source, information for specifying the service server 4 of the request destination, and the like.

[0118] Furthermore, the service request unit 204 associates the created service use request with the corresponding access token.

[0119] The display control unit 205 controls the type and content of the images, various icons, texts, etc. displayed on the display unit 25 , and also controls the display form such as the position and size of the displayed images, etc.

[0120] The display control unit 205 controls, for example, displaying a screen for selecting a function that can be used in the external device 2 to the user. Also, for example, the display control unit 205 controls, for example, displaying a notification screen for presenting the content of a notification received from the user terminal 1 to the user.

[0121] The communication control unit 206 controls the communication unit 23 (see Figure 3The communication control unit 206 controls, for example, to send a request for a token created by the token request unit 203 to the user terminal 1 in the connected state. In addition, for example, a request for use of a service created by the service request unit 204 and an access token associated with the request for use are sent to the service server 4.

[0122] [Use of service]

[0123] Next, use Figure 1 to Figure 7 , an overview of the service usage process in the service usage system 1000 is provided.

[0124] Figure 7 This is a sequence diagram showing an example of the operation of the service utilization system 1000 .

[0125] like Figure 7 As shown, the user terminal 1 accepts the operation of the user or the like requesting authentication settings (S701). Then, the user terminal 1 sends an authorization request to the authorization server 3 (S702). More specifically, for example, when the authentication setting of token A for obtaining mail service A is performed, an authorization request is sent to the authorization server 3a. In addition, for example, when the authentication setting of token B for obtaining mail service B is performed, an authorization request is sent to the authorization server 3b. At this time, the information required for the authentication setting, such as the ID and password of each service, is input and sent to the authorization server 3. The authorization server 3 authorizes the user terminal 1 according to the authorization request, and sends the token and authentication setting information to the user terminal 1 (S703). In addition, the user terminal 1 associates the acquired token and authentication setting information with the identification information of the corresponding service for storage (S704).

[0126] Next, the service information is registered to the user terminal 1 (S705). In addition, the user terminal 1 stores the registered service information (S706).

[0127] In addition, the steps S701 to S704 are steps related to the authentication setting between the user terminal 1 and the authorization server 3. In the present embodiment, when the authentication setting between the user terminal 1 and the authorization server 3 is performed once, the authentication setting information is stored by the user terminal 1. Thereafter, the stored authentication setting information is used, so there is no need to perform the authentication setting again.

[0128] In addition, the steps of S705 and S706 are steps related to registration of service information in the user terminal 1. Since the registered service information is stored in the user terminal 1, it is not necessary to register it again.

[0129] That is, in Figure 7In the example, the steps S701 to S706 surrounded by the dotted lines are not performed every time the service in the service use system 1000 is used, but only once, for example, when the service is used for the first time. Then, the service can be used according to the steps S707 to S713.

[0130] Back to Figure 7 The external device 2 accepts the function selection made by the user (S707). In this example, the operation requesting the use of the scan mail function is accepted.

[0131] The external device 2 scans the document set by the user and creates image data used in the scan mail function (S708).

[0132] The external device 2 specifies a service corresponding to the selected function to the user terminal 1 and requests a token ( S709 ).

[0133] Here, the service usage system 1000 of the present embodiment includes an SMTP server 4a that provides mail service A and an SMTP server 4b that provides mail service B as services of the same category. Moreover, when the external device 2 performs the scanning mail function, it uses either mail service A or mail service B. In this case, for example, in the external device 2, the user's choice of which mail service to use is accepted, and the selected party is used as the designated service to request a token. In addition, for example, in the external device 2, the administrator or the like sets the priority of each mail service or the mail service that is restricted in use in advance, and the mail service with a high priority or the mail service that is not restricted in use is used as the designated service to request a token. In addition, in the method of setting the priority, when the token of the designated service cannot be obtained for some reason, the service with a high priority can also be designated to request a token next.

[0134] Back to Figure 7 , the user terminal 1 returns a response including the token of the specified service and the service information to the external device 2 of the request source (S710). More specifically, when the mail service A is specified, a response including the token A is returned, and when the mail service B is specified, a response including the token B is returned. Thus, the token is provided from the user terminal 1 to the external device 2. In addition, as described in detail later, the user terminal 1 may also re-acquire the token of the specified service from the corresponding authorization server 3 before creating a response, depending on the presence or absence of a valid token.

[0135] The external device 2 uses the token provided from the user terminal 1 to make a request for the use of a specified service to the corresponding service server 4 (S711). More specifically, in the first embodiment, an access token is provided from the user terminal 1, so a request for the use of a service is made to the service server 4 using the provided access token and service information. In addition, as a second embodiment, as described later, in the case where only an update token is provided, after an access token is obtained using the provided update token, a request for the use of a service is made to the service server 4 using the obtained access token and service information. In addition, in the present embodiment, the use request includes image data used in the mail service.

[0136] The service server 4 verifies the access token included in the use request from the external device 2 (S712). If the access token is valid, the service information and image data included in the use request are used to perform the service (S713). In this example, the image data included in the use request is sent to a designated destination via email.

[0137] [Operation of User Terminal 1]

[0138] As described above, the user terminal 1 to which the first embodiment is applied provides an access token for a designated service in response to a token request from the external device 2 .

[0139] Hereinafter, the operation related to the provision of the access token by the user terminal 1 to which the first embodiment is applied will be described in more detail. Figure 7 This corresponds to the action of the user terminal 1 in the step S710.

[0140] Figure 8 This is a flowchart showing an example of the operation related to the provision of an access token in the user terminal 1 to which the first embodiment is applied.

[0141] First, the user terminal 1 receives a token request from the external device 2 (S801). Next, based on the service identification information contained in the token request and the information managed by the authentication setting DB121, it is determined whether the authentication setting information of the specified service is possessed (S802). Moreover, when the authentication setting of the specified service is possessed ("Yes" in S802), based on the service identification information and the information managed by the token DB122, it is determined whether the specified service has a valid access token (S803). When a valid access token is possessed ("Yes" in S803), a response including the access token and service information is created (S804). In addition, when a valid access token is not possessed ("No" in S803), an access token is requested and obtained from the corresponding authorization server 3 using an update token (S805). Then, a response including the obtained access token and service information is created (S804). Finally, the user terminal 1 returns the response created in S804 to the external device 2 of the request source (S806).

[0142] On the other hand, when the authentication setting for the designated service is not present (No in S802), the external device 2 is notified that a token cannot be provided (S807).

[0143] As described above, through the operations of S801 to S807 , the process related to the provision of the access token in the user terminal 1 is completed.

[0144] As described above, the user terminal 1 of the first embodiment applies a token associated with identification information, manages access tokens and update tokens, and when a token request is received from an external device 2 and the user terminal 1 has a valid access token for a specified service, returns a response including the access token for the specified service to the external device 2.

[0145] In addition, when the user terminal 1 does not have a valid access token for the designated service, the user terminal 1 acquires the access token for the designated service from the authorization server 3 using the update token, and returns a response including the acquired access token to the external device 2 .

[0146] In addition, since the user terminal 1 to which the first embodiment is applied manages the access token and the update token, both the access token and the update token of the specified service can be included in the response and returned to the external device 2. In this case, the external device 2 can obtain the access token from the authorization server 3 using the update token, and even if the validity period of the access token provided from the user terminal 1 expires, the service can be used by re-acquiring the access token by the device itself. That is, when using the service next time or later, the access token can be obtained without connecting to the user terminal 1.

[0147] <Second embodiment>

[0148] In the first embodiment described above, the user terminal 1 returns a response including an access token for a specified service in response to a token request from the external device 2. In contrast, in the second embodiment, the user terminal returns a response including an update token for a specified service in response to a token request from the external device 2. Then, the external device 2 obtains an access token from the authorization server 3 using the update token provided from the user terminal, and uses the obtained access token to utilize the service.

[0149] Next, use Figure 1 to Figure 7 and Fig. 9 The second embodiment is described in detail. In addition, in the first embodiment and the second embodiment, a part of the operation of the user terminal 1 and a part of the operation of the external device 2 are different, and the structure of each device (refer to Figure 1 to Figure 6 ) or the general flow of using the service (refer to Figure 7 ) are the same. Therefore, in the second embodiment, the same symbols are used to represent the same parts as in the first embodiment, and the description is omitted. In addition, regarding the user terminal, it is distinguished from the user terminal 1 applied to the first embodiment and is set as the user terminal 1' applied to the second embodiment. That is, in the second embodiment, Figure 1 to Figure 7 The user terminal 1 in is replaced by the user terminal 1′.

[0150] [Operation Example of User Terminal 1']

[0151] The operation related to the provision of the update token of the user terminal 1' to which the second embodiment is applied will be described in detail. Figure 7 This corresponds to the operation of the user terminal 1' in the step S710.

[0152] Fig. 9 This is a flowchart showing an example of the operation related to the provision of the update token in the user terminal 1 ′ to which the second embodiment is applied.

[0153] First, the user terminal 1′ receives a token request from the external device 2 (S901). Next, based on the service identification information contained in the token request and the information managed by the authentication setting DB 121, it is determined whether the authentication setting information of the specified service is present (S902). Furthermore, when the authentication setting of the specified service is present (“Yes” in S902), based on the service identification information and the information managed by the token DB 122, it is determined whether the specified service has a valid update token (S903). When the specified service has a valid update token (“Yes” in S903), a response including the update token and service information is created (S904). In addition, when the specified service does not have a valid update token (“No” in S903), the authentication setting information is used to request and obtain the update token from the corresponding authorization server 3 (S905). Furthermore, a response including the obtained update token and service information is created (S904). Finally, the user terminal 1′ returns the response created in S904 to the external device 2 of the request source (S906).

[0154] On the other hand, when the authentication setting for the designated service is not present (No in S902), the external device 2 is notified that a token cannot be provided (S907).

[0155] As described above, through the operations of S901 to S907, the process of providing the update token in the user terminal 1' is completed.

[0156] As described above, the user terminal 1' applying the second embodiment acts as a token associated with identification information, manages at least an update token, and when a token request is received from an external device 2 and the user terminal 1' has a valid update token for a specified service, returns a response including the update token for the specified service to the external device 2.

[0157] Incidentally, the user terminal 1' to which the second embodiment is applied manages the update token and the access token as tokens associated with the identification information, and therefore, when a valid update token is possessed for a specified service, a response including both the update token and the access token for the specified service may be returned to the external device 2. In addition, at this time, when a valid access token is not possessed, a response to the external device 2 may be returned after acquiring the access token using the update token. However, by setting a structure in which the user terminal 1' only provides the update token, the amount of communication between the user terminal 1' and the external device 2 can be reduced.

[0158] The user terminals 1 and 1′ of the first and second embodiments of the application described above are understood as examples of an information processing system, which manages the access token / update token and the identification information of the corresponding service in association with each other, and when a request for a designated token including a service based on the identification information is received from the external device 2 and the system has a valid token as the token for the designated service, a response including the token for the designated service is returned to the external device 2.

[0159] <Others, Modifications, etc.>

[0160] Although the embodiments of the present invention have been described above, the technical scope of the present invention is not limited to the scope described as the first and second embodiments. Various changes or improvements made without departing from the technical concept of the present invention are also included in the present invention.

[0161] For example, in the first and second embodiments, the service servers 4a and 4b both provide mail services, but the types of services are not limited, and different types of services may be provided. In addition, an example is described in which the external device 2 is set as an image processing device and image data created by scanning in the external device 2 is used for the service, but the type of the external device 2 or the type of data used in the service is not limited, and various data owned by the external device 2 can be used.

[0162] In the first and second embodiments, the service information is managed by the user terminal 1, 1' and provided to the external device 2 together with the token, but this structure is not essential. The required service information may also be stored in the external device 2. By providing the service information from the user terminal 1, 1' to the external device 2, the workload and time of registering the service information in the external device 2 can be reduced.

[0163] In the first and second embodiments, when the authentication setting information of the designated service is not available, the external device 2 is notified that a token cannot be provided (see Figure 8 S807, Fig. 9 At this time, the external device 2 may be notified of information indicating that it does not have the authentication settings for the designated service. The external device 2 may respond to the notification, for example, on the display unit 25 (see S907). Figure 3) displays various information for the user to understand that the token cannot be obtained / the information of the authentication setting is not possessed. In addition, for example, as an alternative means for obtaining the token, the external device 2 may obtain the token from the authorization server 3 by using the authentication setting between the external device 2 (self-device) and the authorization server 3 that was previously performed by the administrator or the like. In this way, the user terminal 1, 1' can perform various corresponding processes in the external device 2 by notifying the external device 2 that the token cannot be provided or the information of the authentication setting for the designated service is not possessed.

[0164] Furthermore, in the first and second embodiments, an example of specifying a service in a request for a token from the external device 2 to the user terminal 1, 1' is described. There is no limit to the number of specified services, and multiple services may be specified. For example, when there are multiple services of the same category, such as the mail services A and B in the present embodiment, and the external device 2 may use any of the services, a request may be made to set all of the multiple services as specified services. In this case, the user terminal 1, 1' may provide tokens for all services, or may only provide tokens owned by the system, as long as they can be provided. In addition, the user terminal 1, 1' may accept the user's choice as to which service the token is to be provided, and only provide the token for the selected service.

[0165] In addition, in the first and second embodiments, an example of determining which of the access token and the update token is provided to the external device 2 in the user terminal 1 and 1' is described. It can be set as a structure in which the user terminal 1 and 1' and the external device 2 accept the user's choice of which of the access token and the update token is provided, and provide the selected token. In addition, the user may also be able to choose to provide both the access token and the update token. Thus, for example, the user can make a choice after considering various conditions such as the ownership status of the token of the user terminal 1 and 1', the storage capacity of the external device 2, and the risk of token leakage.

[0166] <Note> (1)

[0168] An information processing system, characterized in that

[0169] Having one or more processors,

[0170] The one or more processors

[0171] The token used to access the service is managed in association with identification information for identifying the service.

[0172] When receiving a request including a token specifying a service based on the identification information from an external device and possessing a valid token for the specified service, a response including the token for the specified service is returned to the external device. (2)

[0174] The information processing system according to (1) is characterized in that

[0175] The one or more processors

[0176] Based on the authentication setting of the present system and the authorization server, the token associated with the identification information is acquired in advance, and the information of the authentication setting is managed in association with the identification information. (3)

[0178] The information processing system according to (2) is characterized in that

[0179] The one or more processors

[0180] When the request is received from the external device and the token for the specified service and the authentication setting information of the token are not valid, the external device is notified that the token for the specified service cannot be provided. (4)

[0182] The information processing system according to any one of (1) to (3), wherein:

[0183] The one or more processors

[0184] As the token associated with the identification information, an access token presented to a service server providing the service when accessing the service and a renewal token capable of acquiring the access token by presenting the access token to an authorization server are managed,

[0185] In the case of possessing a valid access token for the designated service, the response including the access token for the designated service is returned to the external device. (5)

[0187] The information processing system according to (4) is characterized in that:

[0188] The one or more processors

[0189] If the external device does not have a valid access token for the designated service, the external device acquires the access token for the designated service using the update token, and returns the response including the acquired access token for the designated service to the external device. (6)

[0191] The information processing system according to any one of (1) to (3), characterized in that:

[0192] The one or more processors

[0193] As the token associated with the identification information, an update token capable of acquiring an access token presented to a service server providing the service when accessing the service is managed by presenting the token to an authorization server,

[0194] When the update token of the designated service is valid, the response including the update token of the designated service is returned to the external device. (7)

[0196] The information processing system according to (6) is characterized in that

[0197] The one or more processors

[0198] managing the update token and the access token as the token associated with the identification information,

[0199] When the external device has a valid update token for the designated service, the response including both the update token and the access token for the designated service is returned to the external device. (8)

[0201] The information processing system according to any one of (1) to (7), characterized in that:

[0202] The one or more processors

[0203] managing service information used by a service server providing a service in association with the identification information,

[0204] The response including the token of the designated service to the external device includes service information of the designated service. (9)

[0206] A program that causes a computer to:

[0207] A function to manage a token used for accessing a service in association with identification information for identifying the service; and

[0208] A function of returning a response including the token for a service specified based on identification information to the external device when receiving a request including the token for the service specified based on identification information and the external device has a valid token for the specified service.

[0209] According to the information processing system of (1), compared with the case where an access token is acquired through authentication setting performed between the external device and the authorization server, the workload and time for acquiring the access token in the external device are reduced.

[0210] According to the information processing system of (2), the authentication setting information is stored, thereby reducing the workload and time required to obtain a token again.

[0211] According to the information processing system of (3), various processes corresponding to failure to acquire the requested token can be executed in the external device.

[0212] According to the information processing system of (4), compared with the case where only the access token is managed, the degree of freedom in the response when a valid access token is not possessed increases.

[0213] According to the information processing system of (5), even when a valid access token is not possessed, a valid access token can be reacquired by updating the token and provided to an external device.

[0214] According to the information processing system of (6), the external device can acquire an access token using the update token.

[0215] According to the information processing system of (7), in the external device, a fast service can be used by the provided access token, and an access token using an updated token can be acquired.

[0216] According to the information processing system of (8), compared with the case where service information is registered for each external device used, the workload and time are reduced.

[0217] According to the procedure of (9), compared with the case where the access token is acquired through authentication setting performed between the external device and the authorization server, the workload and time for acquiring the access token in the external device are reduced.

Claims

1. An information processing system, characterized in that: Having one or more processors, The one or more processors A token used for accessing a service is managed in association with identification information for identifying the service. When receiving a request including a token specifying a service based on identification information from an external device and possessing a valid token for the specified service, a response including the token for the specified service is returned to the external device.

2. The information processing system according to claim 1, wherein: The one or more processors Based on the authentication setting of the present system and the authorization server, the token associated with the identification information is acquired in advance, and the information of the authentication setting is managed in association with the identification information.

3. The information processing system according to claim 2, wherein: The one or more processors When the request is received from the external device and the token that is valid for the designated service and the information on the authentication setting of the token are not possessed, the external device is notified that the token cannot provide the designated service.

4. The information processing system according to any one of claims 1 to 3, wherein: The one or more processors managing, as the token associated with the identification information, an access token presented to a service server providing the service when accessing the service and a renewal token capable of acquiring the access token by presenting the access token to an authorization server, In a case where the access token of the designated service is valid, the response including the access token of the designated service is returned to the external device.

5. The information processing system according to claim 4, wherein: The one or more processors If the access token of the specified service is not valid, use the update token to obtain the access token of the specified service. The response including the acquired access token of the designated service is returned to the external device.

6. The information processing system according to any one of claims 1 to 3, wherein: The one or more processors As the token associated with the identification information, managing an update token capable of acquiring an access token presented to a service server providing the service when accessing the service by presenting it to an authorization server, When the update token of the designated service is valid, the response including the update token of the designated service is returned to the external device.

7. The information processing system according to claim 6, wherein: The one or more processors managing the update token and the access token as the token associated with the identification information, When the update token of the specified service is valid, the response including both the update token of the specified service and the access token is returned to the external device.

8. The information processing system according to any one of claims 1 to 7, wherein: The one or more processors managing service information used by a service server providing a service in association with the identification information, In the response including the token of the designated service to the external device, service information of the designated service is included.

9. A computer-readable medium storing a program for causing a computer to execute a process, characterized in that: The process has: A step of managing a token used for accessing a service and identification information for identifying the service in association with each other; and A process of returning a response including the token for specifying a service based on identification information to the external device when receiving a request including the token for specifying a service from the external device and the external device has a valid token for the specified service.

10. An information processing method, characterized in that: have: A step of managing a token used for accessing a service and identification information for identifying the service in association with each other; and A process of returning a response including the token for specifying a service based on identification information to the external device when receiving a request including the token for specifying a service from the external device and the external device has a valid token for the specified service.

Images