Information processing system and program

Abstract

To lower a security risk by updating an access token by using an update token and reducing an opportunity of illegal use of a token as compared with when the access token is managed with an effective time of validity.SOLUTION: An information processing system comprises one or more processors, which are configured to: accept a request to issue an access token to be used when service is utilized; give an instruction to issue an access token and an update token to be used to update the access token when the validity of the access token expires; acquire the access token and update token issued by the instruction; update the access token using the update token based upon predetermined update conditions; and discard the update token under predetermined conditions associated with discard.SELECTED DRAWING: Figure 15

Description

[Technical field]

[0001] The present invention relates to an information processing system and a program. [Background technology]

[0002] Patent document 1 discloses an invention related to an authentication system having a memory unit that stores the expiration date of a service provided by a client, with the aim of making it possible to determine whether a service that uses an existing authentication mechanism can be used based on the expiration date, a receiving unit that receives from the client a request for issuance of an access token to be used to use the service, an issuing unit that issues an access token based on the expiration date in response to receiving the issuance request, and a judgment unit that, in response to receiving the access token from the client, determines that the access token is valid if the current date and time does not exceed the expiration date of the service related to the access token, and determines that the access token is invalid if the date and time exceed the expiration date. Patent Document 2 discloses an invention relating to a server device that mediates the provision of services to a device with a limited service provision period, with the aim of properly discarding authorization information for service provision after use of the device, the server device having an authorization information acquisition unit that acquires authorization information for service provision, a device management unit that receives and manages device information from the device, a user information management unit that associates and manages user information about a user using the device, authorization information, and device information, and a device discrimination unit that determines whether the device is a limited device with a limited service provision period, wherein the user information management unit invalidates and deletes authorization information related to the device information when the device is a limited device and a certain period has elapsed since the start of the service provision period for the limited device. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6354407 [Patent Document 2] Patent Publication No. 2021-196908 Summary of the Invention [Problem to be solved by the invention]

[0004] In a system where an access token is required to use a service, it is desirable to retain the access token for a long period of time for services that are used for a long period of time in order to ensure user convenience. Therefore, the access token is refreshed using a refresh token. However, if the access token is retained for a long period of time, it is considered that the opportunities for the access token to be used illegally by an unauthorized third party increase, and the security risk of information leakage increases.

[0005] The present invention aims to reduce security risks by updating access tokens using update tokens and reducing the opportunities for tokens to be used fraudulently, compared to when access tokens are managed by expiration dates. [Means for solving the problem]

[0006] The invention described in claim 1 is an information processing system comprising one or more processors, which accept a request for issuance of an access token used when using a service, instruct the issuance of the access token and a refresh token used to renew the access token when the access token expires, obtain the access token and refresh token issued in accordance with the instruction, update the access token using the refresh token based on predetermined renewal conditions, and discard the refresh token based on predetermined discard conditions. The invention described in claim 2 is the information processing system described in claim 1, characterized in that the predetermined conditions for discarding include a certain period of time having passed without the user of the service using the service. The invention described in claim 3 is the information processing system according to claim 2, characterized in that the period is determined according to the type of the service to be used. The invention described in claim 4 is the information processing system according to claim 2, characterized in that the period is the date and time that has elapsed since the date and time when the user of the service last used the service. The invention described in claim 5 is the information processing system described in claim 1, characterized in that the processor determines the conditions for discarding based on the usage status of the service by the user of the service at predetermined intervals. The invention described in claim 6 is the information processing system described in claim 5, characterized in that the processor determines that the conditions for discarding are not satisfied when a user of the service is using at least one of the one service or another service related to the one service. The invention described in claim 7 is the information processing system described in claim 5, characterized in that the processor determines that the condition regarding discard is not satisfied when a user of the service is using at least one of the services available using the same access token. The invention described in claim 8 is the information processing system described in claim 5, characterized in that even if the processor determines that the condition regarding discarding is satisfied in one information processing device among multiple information processing devices having a specific relationship, it determines that the condition regarding discarding is not satisfied when a service is being used in another information processing device having a specific relationship. The invention described in claim 9 is a program for enabling a computer to realize the following functions: a function of accepting a request for issuance of an access token used when using a service; a function of instructing a computer to issue an access token and a refresh token used to renew the access token when the access token expires; a function of acquiring the access token and refresh token issued by the instruction; a function of updating the access token using the refresh token based on predetermined renewal conditions; and a function of discarding the refresh token based on predetermined discard conditions. Effect of the Invention

[0007] According to the invention of claim 1, compared to a case where access tokens are managed by expiration date, security risks can be reduced by refreshing access tokens using refresh tokens and reducing the opportunities for tokens to be used fraudulently. According to the invention of claim 2, the token can be discarded by checking the service usage status of the user. According to the invention of claim 3, the deadline for discarding a token can be flexibly determined according to the type of service, compared to when a certain period is fixed. According to the invention of claim 4, the token can be revoked according to the date and time that has elapsed since the last time the user used the service. According to the invention of claim 5, the service usage status of the user can be checked at predetermined intervals and the token can be discarded. According to the invention of claim 6, compared to the case where the usage status is checked for each service, it is possible to discard the token by checking the usage status of related services. According to the invention of claim 7, compared to the case where the usage status is checked for each service, it is possible to check the usage status of available services using the same access token and discard the token. According to the invention of claim 8, compared to a case where the usage status is checked for each information processing device, it is possible to check the usage status of a plurality of information processing devices and discard the token. According to the invention of claim 9, by using a computer having the program of the present invention installed, it is possible to reduce security risks by updating access tokens using update tokens and reducing the opportunities for tokens to be used fraudulently, compared to a case in which access tokens are managed by expiration date. [Brief description of the drawings]

[0008] [Figure 1] 1 is a diagram showing the overall configuration of an information processing system to which the present embodiment is applied. [Diagram 2] FIG. 2 is a diagram illustrating a hardware configuration of an information processing device. [Diagram 3] FIG. 2 is a diagram illustrating the hardware configuration of a service providing server and an authorization server. [Figure 4] FIG. 2 is a diagram illustrating a functional configuration of an information processing device. [Diagram 5] FIG. 13 illustrates an example of a user authentication management DB. [Figure 6] FIG. 11 illustrates an example of a service access management DB. [Figure 7] FIG. 13 illustrates an example of a login status management DB. [Figure 8] FIG. 13 illustrates an example of a token management DB. [Figure 9] FIG. 13 illustrates an example of a service authentication management DB. [Figure 10] FIG. 13 illustrates an example of a service-related management DB; [Figure 11] FIG. 11 is a sequence diagram illustrating an example of a login process. [Figure 12] FIG. 11 is a sequence diagram illustrating an example of a token acquisition process. [Figure 13] 11 is a sequence diagram illustrating an example of a service execution process for a service that requires authorization. [Figure 14] FIG. 11 is a sequence diagram illustrating an example of a process for reacquiring an access token. [Figure 15] FIG. 13 is a sequence diagram illustrating an example of a process for sorting update tokens. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. <Configuration of information processing system> 1 is a diagram showing the configuration of an information processing system to which the present embodiment is applied. The information processing system 1 includes an information processing device 100, a service providing server 200, and an authorization server 300. The devices 100, 200, and 300 are connected via a network.

[0010] The information processing device 100 is a device used by a user. The information processing device 100 connects to a service providing server 200 and executes a service. For example, an image processing device may be used as the information processing device 100, and an SMTP server may be used as the service providing server 200. According to this embodiment, an image scanned by the image processing device is attached to an e-mail and the e-mail is sent to a destination by the SMTP server. The information processing device 100 also connects to an authorization server 300 and obtains an access token required to use the service of the service providing server 200. An example of a system that issues an access token is an OAuth authorization system.

[0011] The service providing server 200 is a server that provides a service in response to a user's request. For example, in the above case where the information processing device 100 is an image processing device and the service providing server 200 is an SMTP server, the SMTP server transmits an e-mail received from the image processing device to a destination. Note that the service providing server 200 requires an access token issued by the authorization server 300 to provide the service.

[0012] The authorization server 300 is a server that issues an access token. The authorization server 300 issues an access token in response to a request from the information processing device 100 in an authorization flow, and transmits the issued access token to the information processing device 100. Note that the authorization flow refers to a procedure for acquiring an access token. The authorization server 300 issues a refresh token together with an access token, and transmits the issued refresh token together with the access token to the information processing device 100. Hereinafter, when there is no need to distinguish between an access token and a refresh token, they will be referred to as a token. An expiration date is set for the access token from a security standpoint. The refresh token is a token used to reissue an access token when the access token expires. An expiration date is set for the refresh token. The expiration date of the refresh token is set longer than that of the access token.

[0013] Furthermore, the authorization server 300 reissues an access token in response to a request by a user using a refresh token. Issuance of an access token based on a request using a refresh token does not require an authorization flow. When an access token is reissued, not only the access token but also the refresh token is reissued. By reissuing a token, the validity period of each token is extended according to the expiration date set for each token. When issuing a token, the authorization server 300 authenticates the user, and issues the token if the authentication is successful.

[0014] <Hardware configuration of information processing device> FIG. 2 is a diagram showing an example of a hardware configuration of an information processing device 100. The information processing device 100 shown in FIG. 2 includes one or more processors 101 as a calculation means, a main memory 102 and an auxiliary memory 103 as storage means, a display mechanism 104 for visually confirming display information, an input device 105 for receiving operations from a user, and a network interface 106 used for information communication. The processor 101 realizes each function of the information processing device 100 by loading a program stored in the auxiliary memory 103 into the main memory 102 and executing it. For example, a central processing unit (CPU), a micro processing unit (MPU), a graphics processing unit (GPU), or a digital signal processor (DSP) is used as the processor 101. For example, a random access memory (RAM) is used as the main memory 102. For example, a magnetic disk device or a solid state drive (SSD) is used as the auxiliary memory 103. For example, a display is used as the display mechanism 104. Examples of the input device 105 include a keyboard, a mouse, and a touch panel. Note that the configuration of the information processing device 100 shown in Fig. 2 is merely an example, and the information processing device 100 used in this embodiment is not limited to the configuration example shown in Fig. 2. For example, the storage device may be configured to include a non-volatile memory such as a flash memory or a ROM (Read Only Memory).

[0015] <Hardware configuration of service provider server and authorization> FIG. 3 is a diagram showing an example of the hardware configuration of the service providing server 200 and the authorization server 300. The service providing server 200 and the authorization server 300 shown in FIG. 3 include one or more processors 201, 301 as a calculation means, main storage devices (main memories) 202, 302 and auxiliary storage devices 203, 303 as storage means, and network interfaces 204, 304 used for information communication. The processors 201, 301 realize the respective functions of the service providing server 200 and the authorization server 300 by loading a program stored in the auxiliary storage device 203, 303 into the main storage device 202, 302 and executing it. For example, a CPU, an MPU, a GPU, a DSP, or the like is used as the processors 201, 301. For example, a RAM is used as the main storage device 202, 302. For example, a magnetic disk device, an SSD, or the like is used as the auxiliary storage device 203, 303. Note that the server configuration shown in Fig. 3 is merely an example, and the server used in this embodiment is not limited to the configuration example shown in Fig. 3. For example, the server may be configured to include a non-volatile memory such as a flash memory or a ROM as a storage device.

[0016] <Functional configuration of information processing device> 4 is a diagram showing an example of a functional configuration of the information processing device 100. The information processing device 100 includes a storage unit 110, a login status management unit 121, a service management unit 122, an access control unit 123, an authentication management unit 124, a token management unit 125, an information input / output unit 126, and a communication unit 127. Each function of the information processing device 100 is realized by the processor 101 reading a program stored in the auxiliary storage device 103 into the main storage device 102 and executing the program. The information processing device 100 displays various screens via a display mechanism 104 and accepts input from a user via an input device 105. In addition, various databases are held in the auxiliary storage device 103.

[0017] The storage unit 110 is configured with various databases (hereinafter, referred to as “DB”). The storage unit 110 includes a user authentication management DB 111, a service access management DB 112, a login status management DB 113, a token management DB 114, a service authentication management DB 115, and a service related management DB 116.

[0018] FIG. 5 is a diagram showing an example of the user authentication management DB 111. The user authentication management DB 111 is a database that manages authentication information of users. FIG. 5 shows a table that stores information managed in the user authentication management DB 111. In the table shown in FIG. 5, for example, a user ID column 701 and a password column 702 are provided, and user IDs and passwords are stored. The user ID is information for identifying a user. Also, the password is information for authenticating a user. Here, for example, it is recorded that the password of a user whose user ID is set to aaa (hereinafter referred to as "user aaa") is pass01.

[0019] FIG. 6 is a diagram showing an example of the service access management DB 112. The service access management DB 112 is a database for managing services that can be used by users. FIG. 6 shows a table for storing information managed in the service access management DB 112. In the table shown in FIG. 6, for example, a user ID column 711 and a service ID column 712 are provided, in which user IDs and service IDs are stored. The service ID is information for identifying a service that can be used by a user. Here, for example, it is recorded that user aaa can use a service whose service ID is defined by smtp (hereinafter referred to as "SMTP service").

[0020] FIG. 7 is a diagram showing an example of the login status management DB 113. The login status management DB 113 is a database for managing the last use date and time of a service by a user. FIG. 7 shows a table for storing information managed in the login status management DB 113. In the table shown in FIG. 7, for example, a user ID column 721, a service ID column 722, and a last use date and time column 723 are provided, and information regarding the user ID, the service ID, and the last use date and time are stored. Note that the last use date and time represents the date and time when the user last used the service. Here, for example, it is recorded that the user aaa used the SMTP service at 0:00:03 on December 1, 2022.

[0021] Fig. 8 is a diagram showing an example of the token management DB 114. The token management DB 114 is a database that manages access tokens and refresh tokens. Fig. 8 shows a table that stores information managed in the token management DB 114. The table shown in Fig. 8 has, for example, a user ID column 731, a service ID column 732, an access token column 733, an refresh token column 734, and a function ID column 735, and stores a user ID, a service ID, an access token, a refresh token, and a function ID. The function ID is identification information that indicates a service that is permitted to be used with the acquired access token.

[0022] FIG. 9 is a diagram showing an example of the service authentication management DB 115. The service authentication management DB 115 is a database for managing conditions related to the discard. FIG. 9 shows a table for storing information managed in the service authentication management DB 115. In the table shown in FIG. 9, for example, a service ID column 741, a host name column 742, and a condition column 743 for discarding the refresh token are provided, and a service ID, a host name, and a condition related to the discard are stored. The host name is information for identifying the authorization server 300 that issues a token in response to a token issuance request by the information processing device 100. The condition related to the discard is a condition for discarding the refresh token under a condition other than the expiration date. The condition related to the discard can be determined by a system administrator or the like. For example, a condition can be determined such that the refresh token is discarded when a certain period of time has elapsed without the user of the service using the service (hereinafter, the certain period of time is referred to as the "discard period"). The discard period is set shorter than the expiration date of the refresh token. The discard period can be determined according to the type of service used. Here, for example, it is recorded that the refresh token is discarded if the SMTP service is not used for XXX days. Therefore, if the update token satisfies the discarding conditions even if the update token is within the validity period, the update token will be discarded. Note that these discarding conditions are merely examples and are not limited to the discarding conditions used in this embodiment.

[0023] FIG. 10 is a diagram showing an example of the service-related management DB 116. The service-related management DB 116 is a database that manages a service in association with a service related thereto. FIG. 10 shows a table that stores information managed in the service-related management DB 116. In the table shown in FIG. 10, for example, a service ID column 751 and a related service ID column 752 are provided, and the service ID and the related service ID are stored. A related service is a service that is related to a service. For example, when a user uses a mail sending service as a service, it is considered that the user also uses a mail receiving service. Therefore, the mail sending service and the mail receiving service can be said to be related services. In the table shown in FIG. 10, it is recorded that the SMTP service and the service whose service ID is determined by pop (hereinafter referred to as "POP service") are related services.

[0024] The login status management unit 121 manages the login status of the user. Specifically, when the user logs in to a service, the login status management unit 121 updates the last usage date and time in the login status management DB 113. When sorting the update token, the login status management unit 121 reads the login status management DB 113 and transmits information stored in the table of the login status management DB 113 to the access control unit 123.

[0025] The service management unit 122 manages services available to the user. Specifically, when the user completes the login process to the information processing device 100, the service management unit 122 reads the service access management DB 112 and displays the services available to the user. When a service is selected by the user, the service management unit 122 checks whether the selected service requires authorization, and if it does, identifies the host name indicating the authorization server 300 that issues a token required for authorization. Furthermore, when sorting process of update tokens is performed, the service management unit 122 reads the service authentication management DB 115 and transmits information stored in a table of the service authentication management DB 115 to the access control unit 123.

[0026] The access control unit 123 performs access control for a user to use a service. Specifically, the access control unit 123 has a role of controlling the operation of the information processing device 100, and transmits instructions to each management unit when a user logs in, a token issuance request issuance ... An example of the predetermined update condition is receiving a selection of a service to be used from a user. The update condition is not limited to this. For example, when a service is provided at regular intervals, the elapse of a certain period of time may be set as the predetermined update condition.

[0027] In addition, when performing the sorting process of the update token, the access control unit 123 receives information stored in each table of the login status management DB 113, the token management DB 114, and the service authentication management DB 115 from the login status management unit 121, the service management unit 122, and the token management unit 125 described later, and determines whether the update token satisfies the conditions for discarding.

[0028] When a user makes a request for login processing, a request for token issuance, or a request for service execution processing, the authentication management unit 124 reads the user authentication management DB 111 and verifies whether the information matches the authentication information entered by the user.

[0029] The token management unit 125 manages access tokens and update tokens. Specifically, when the token management unit 125 is instructed by the access control unit 123 to make a token issuance request, the token management unit 125 makes a token issuance request to the authorization server 300. The token management unit 125 acquires a token from the authorization server 300 and stores the acquired token in the token management DB 114. Furthermore, when a service execution process is performed by a user, the token management unit 125 transmits the acquired access token to the access control unit 123. Furthermore, when an update token sorting process is performed, the token management unit 125 reads out the token management DB 114 and transmits information stored in a table of the token management DB 114 to the access control unit 123.

[0030] The information input / output unit 126 is a user interface that displays a service selection screen or the like to a user who uses the information processing device 100 and receives input of the user's authentication information and the selection of a service to be used from the user.

[0031] The communication unit 127 controls communication with other devices. For example, when the token management unit 125 requests the authorization server 300 to issue a token or when it transmits an access token to the service providing server 200, information is transmitted and received via the communication unit 127.

[0032] <Explanation of the operation overview of the information processing system> An overview of the operation of the information processing system 1 will be described. Note that this embodiment is based on the premise that a user needs to obtain authorization when receiving a service. The user can receive the service by using an access token obtained by executing an authorization flow.

[0033] FIG. 11 is a sequence diagram showing a login process by a user. The access control unit 123 accepts a login request from the user via the information input / output unit 126 (S101). The access control unit 123 instructs the authentication management unit 124 to verify the authentication information (S102). The authentication management unit 124 reads the user authentication management DB 111 and verifies whether the information input by the user matches the information managed in the user authentication management DB 111 (S103). For example, it may be judged whether the user ID and password input by the user match the user ID and password managed in the user authentication management DB 111. If the authentication is successful, the authentication management unit 124 transmits an authentication result indicating that the authentication is successful to the access control unit 123 (S104). On the other hand, if the authentication is unsuccessful, no further operation is performed. When the access control unit 123 receives an authentication result indicating that the authentication is successful from the authentication management unit 124, it causes the information input / output unit 126 to display a screen for the user to select a service (S105). Furthermore, the access control unit 123 instructs the login status management unit 121 to update the login status management DB 113 (S106). The login status management unit 121 updates the last use date and time managed in the login status management DB 113 (S107).

[0034] FIG. 12 is a sequence diagram illustrating a token acquisition process. The user needs to execute the authorization flow to obtain an access token. More specifically, the access control unit 123 accepts the selection of the service to be used from the user via the information input / output unit 126 (S201). The access control unit 123 instructs the authentication management unit 124 to verify the authentication information (S202). The authentication management unit 124 verifies the authentication information in the same manner as in S103 (S203). If the authentication is successful, the authentication management unit 124 transmits an authentication result indicating that the authentication is successful to the access control unit 123 (S204). When the access control unit 123 receives an authentication result indicating that the authentication is successful from the authentication management unit 124, it instructs the service management unit 122 to verify whether the service selected by the user requires authorization (S205). If the service selected by the user requires authorization, the service management unit 122 specifies a host name indicating the authorization server 300 that issues a token required for authorization (S206). The service management unit 122 transmits the specified host name to the access control unit 123 (S207).

[0035] The access control unit 123 instructs the token management unit 125 to make a token issuance request to the authorization server 300 corresponding to the host name identified in S206 (S208). The token management unit 125 makes a token issuance request to the authorization server 300 and acquires the token from the authorization server 300 (S209). The access control unit 123 instructs the token management unit 125 to store the acquired token in the token management DB 114 (S210). The token management unit 125 stores the acquired token in the token management DB 114 (S211).

[0036] FIG. 13 is a sequence diagram showing a process of executing a service by a user. The access control unit 123 receives a selection of a service to be used from a user via the information input / output unit 126 (S301). The access control unit 123 instructs the authentication management unit 124 to confirm whether the user who uses the service has been authenticated (S302). The authentication management unit 124 confirms whether the user has been authenticated (S303). For example, if a login process has been performed by the user, it may be determined that the user has been authenticated. The authentication management unit 124 confirms that the user has been authenticated, and transmits an authentication result indicating that the user has been authenticated to the access control unit 123 (S304). The access control unit 123 instructs the token management unit 125 to transmit the access token acquired in S209 (S305). The access control unit 123 acquires the access token from the token management unit 125 (S306). The access control unit 123 transmits the access token to the service providing server 200 and provides the service to the user (S307).

[0037] As mentioned above, from a security perspective, an expiration date is set for an access token, and the access token is discarded when the expiration date is reached. After an access token is discarded, the user must obtain a new access token in order to receive services again.

[0038] Fig. 14 is a sequence diagram showing the process of reacquiring an access token. The access token is reacquired based on a predetermined update condition. In this process, the user does not need to execute the authorization flow to acquire an access token. The access control unit 123 accepts the selection of a service to be used from the user via the information input / output unit 126 (S401). The access control unit 123 instructs the token management unit 125 to check whether the access token corresponding to the service selected by the user is valid (S402). The token management unit 125 checks whether the access token corresponding to the service selected by the user is valid (S403). For example, the access control unit 123 transmits a user ID and a service ID corresponding to the selected service to the token management unit 125. The token management unit 125 reads the token management DB 114, identifies an access token corresponding to the user ID and service ID received from the access control unit 123, and checks the expiration date of the access token. If the access token has expired, the token management unit 125 transmits a result indicating that the access token has expired to the access control unit 123 (S404). When the access control unit 123 receives a result indicating that the access token has expired from the token management unit 125, it instructs the token management unit 125 to make a request to reissue the access token (S405). The token management unit 125 makes a token issuance request to the authorization server 300 using the update token, and acquires the token (S406).

[0039] 15 is a sequence diagram showing the process of sorting the update token. In this embodiment, the discard period is used as the condition regarding discarding. The access control unit 123 instructs the token management unit 125 to transmit information managed in the token management DB 114 (S501). The token management unit 125 reads the token management DB 114 and transmits the obtained information to the access control unit 123 (S502). For example, the token management unit 125 obtains and transmits information related to the user ID, the service ID, and the update token managed in the token management DB 114. The access control unit 123 also instructs the service management unit 122 to transmit information managed in the service authentication management DB 115 (S503). The service management unit 122 reads the service authentication management DB 115 and transmits the obtained information to the access control unit 123 (S504). For example, the service ID, the host name, and the discarding conditions managed in the service authentication management DB 115 are obtained and transmitted. Furthermore, the access control unit 123 instructs the login status management unit 121 to transmit information managed in the login status management DB 113 (S505). The login status management unit 121 reads the login status management DB 113 and transmits the obtained information to the access control unit 123 (S506). For example, information regarding the user ID, service ID, and last use date and time managed in the login status management DB 113 is obtained and transmitted.

[0040] The access control unit 123 determines an update token that satisfies the conditions for destruction based on the information obtained in S501 to S506 (S507). More specifically, the access control unit 123 checks the destruction period for each service by using the service ID managed in the service authentication management DB 115. In addition, the access control unit 123 checks the last time the user used the service by using the user ID and the service ID managed in the login status management DB 113, and specifies the period from the last time the user used the service to the execution date and time of the token sorting process (hereinafter, the period from the last time the user used the service to the execution date and time of the token sorting process is referred to as the "non-use period"). Furthermore, the access control unit 123 determines the conditions for destruction by comparing the destruction period and the non-use period for the update token managed in the token management unit 125. More specifically, for example, the destruction period of the update token is set to 7 days. If the service is not used for 10 days from the date and time of the last use of the service by the user to the date and time of execution of the token sorting process, the non-use period is identified as 10 days, and the discard period is less than the non-use period, so the access control unit 123 determines that the condition for discarding is met. If the access control unit 123 determines that the update token satisfies the condition for discarding, it instructs the token management unit 125 to discard the update token (S508). The token management unit 125 discards the update token managed in the token management DB 114 (S509).

[0041] Furthermore, if the access control unit 123 determines that the refresh token does not satisfy the conditions for discarding, it instructs the token management unit 125 to reissue the refresh token. The refresh token can be obtained from the host name obtained from the service authentication management DB 115. In this process, the user does not need to execute the authorization flow.

[0042] The token sorting process can be determined to be performed at predetermined intervals. The predetermined intervals can be determined by a system administrator or the like. Furthermore, by setting a discard period shorter than the expiration date of the refresh token as a discard condition, the refresh token can be discarded even if it is within the expiration date if the discard condition is met. This shortens the duration of unused tokens, thereby reducing the opportunities for a third party to illegally use the token.

[0043] In the above-described embodiment, the discard condition is determined by comparing the discard period with the non-use period. On the other hand, the discard condition may be determined using the discard period without using the last use date and time of the service. For example, if there is a period during which the discard period has passed without using the service between the execution date and time of the previous sorting process and the execution date and time of the current sorting process, even if the user used the service immediately before determining the discard condition, the update token may be determined to satisfy the discard condition and the update token may be discarded. More specifically, for example, the discard period of the update token is set to 7 days, and the period for determining the discard condition is set to 30 days. In this case, even if the user used the service within 7 days immediately before determining the discard condition, if there is a period during the past 30 days during which 7 days have passed without using the service, the update token is discarded.

[0044] <Modification> In the above example, the conditions for discarding are determined using the usage status of the user for each service. However, in this embodiment, the conditions for discarding may be determined using the usage status of a plurality of services by the user. For example, services related to each other may be set, and if one of the set related services is used, it may be determined that the condition for discarding is not satisfied for each service. In this case, in the update token sorting process, in addition to the operations of S501 to S506, the access control unit 123 acquires a related service using a related service ID managed in the service related management DB 116. This allows the access control unit 123 to acquire the usage status of multiple services by the user, and it becomes possible to determine the condition for discarding using the usage status of multiple services by the user. Examples of services include an email transmission service and an email reception service. Normally, when a user uses an email transmission service, it is considered that the user also uses an email reception service. Therefore, the email transmission service and the email reception service can be said to be related services. For example, if a user does not use the email transmission service and the update token corresponding to the email transmission service satisfies the condition for discarding, the update token corresponding to the email transmission service is discarded even if the email reception service is continuously used. Therefore, even if a user does not use the email transmission service, if the user uses the email reception service as a service related to the email transmission service, it may be determined that the update token does not satisfy the condition for discarding. More specifically, the access control unit 123 acquires the last usage date and time of the service for the SMTP service via the login status management unit 121. The access control unit 123 also acquires the last usage date and time of the service set as an associated service of the SMTP service in the service association management DB 116, for example, a POP service, via the login status management unit 121. This makes it possible to determine the conditions for discarding using the usage status of multiple services, and even if the discard period has passed without the SMTP service being used, if the POP service was used within the discard period, it is determined that the update token corresponding to the SMTP service does not satisfy the conditions for discarding. As a result, the update token is not discarded.

[0045] In addition, when there are multiple services that can be used with the same access token, if the usage status of one of the multiple services does not satisfy the condition regarding the discarding of the update token, it may be determined that the condition regarding the discarding is not satisfied for all services that use the same access token. For example, consider a case where an email transmission / reception service and a print service are set to be available using the same access token. In this case, if the email transmission service or email reception service is not used within the discard period, but the print service is used, it is determined that the update token corresponding to the email transmission service or email reception service does not satisfy the condition regarding the discarding. For example, in the operation of S506, the access control unit 123 acquires the last usage date and time of the service for multiple services that can be used with the same access token from the login status management DB 113. In the operation of S507, the access control unit 123 may determine whether at least one of the acquired multiple services does not satisfy the condition regarding the discarding.

[0046] Furthermore, the conditions for discarding may be determined using the service usage status of multiple information processing devices 100 that have a specific relationship. Here, the multiple information processing devices 100 that have a specific relationship are multiple information processing devices 100 that are set to share information on the usage status of the service by users through data exchange. This modified example may be applied to information processing devices 100 connected to one LAN (Local Area Network), information processing devices 100 installed in a sales office or office (hereinafter referred to as a "base"), etc. The sharing of information on the usage status of the service by users may be realized, for example, by each information processing device 100 exchanging information on its own device, or may be realized by centralized management by a server on a network to which each information processing device 100 is connected.

[0047] As an example, consider a case where multiple information processing devices 100 are installed in one base and a user uses multiple information processing devices 100. In order to distinguish between the multiple information processing devices 100, one information processing device 100 in the base is referred to as information processing device 100A, and the other information processing device 100 is referred to as information processing device 100B. Note that the location where the information processing device 100 is installed is not limited as long as it is a location where installation is possible within one base. For example, the information processing device 100A and the information processing device 100B may be installed at two locations on one floor, or the information processing device 100A and the information processing device 100B may be installed separately on different floors.

[0048] Consider a case where a user can use both the information processing devices 100A and 100B to use a single service, and the frequency of use of the service in the information processing device 100A is high, but the frequency of use of the service in the information processing device 100B is low. In this case, when the condition regarding the discarding of the refresh token is determined for each device, if the condition regarding the discarding of the refresh token in the information processing device 100B is satisfied, the refresh token managed in the information processing device 100B is discarded even if the same service is used in the information processing device 100A. In this case, in order for the user to use the service using the information processing device 100B, the authorization flow must be executed again to obtain an access token, which increases the amount of work. If the user uses the service using the information processing device 100A and does not satisfy the condition regarding the discarding of the refresh token, it is determined that the condition regarding the discarding of the refresh token in the information processing device 100B also does not satisfy the condition even if the service has not been used in the information processing device 100B beyond the discard period. As a result, the refresh token managed in the information processing device 100B is not discarded.

[0049] Although the embodiment of the present invention has been described above, the technical scope of the present invention is not limited to the above embodiment. For example, in this embodiment, the discard period is used as the discard condition, but it may be determined that the update token is discarded when the authentication information of the user is deleted. For example, the user's transfer or retirement may be considered as a cause for the deletion of the authentication information of the user. More specifically, it is generally considered that information about the user is deleted when the user resigns. In such a case, when determining the discard condition, it is possible to detect the authentication information of the user that does not exist, such as the user ID, and discard the update token. In the above example, the discard condition is determined every predetermined period and the update token is discarded, but if the discard period is set as the discard condition, it is also possible to automatically discard the update token when the elapsed time from the last use date and time of the service reaches the discard period. In addition, various modifications and alternative configurations that do not deviate from the scope of the technical idea of ​​the present invention are included in the present invention.

[0050] <Additional Notes> (((1))) An information processing system comprising one or more processors, the one or more processors receiving a request for issuance of an access token used when using a service, instructing the issuance of the access token and a refresh token used to renew the access token when the access token expires, obtaining the access token and refresh token issued in accordance with the instruction, updating the access token using the refresh token based on predetermined renewal conditions, and discarding the refresh token based on predetermined discard conditions. (((2))) The information processing system according to (((1))), wherein the predetermined conditions for discarding include a certain period of time having elapsed without the user of the service using the service. (((3))) The information processing system according to (((2))) is characterized in that the period is determined according to the type of the service to be used. (((4))) The information processing system according to ((2))) or ((3))), wherein the period is the date and time that has elapsed since the date and time that the user of the service last used the service. (((5))) The information processing system according to any one of ((1)) to (((4))), characterized in that the processor determines the conditions for the discard based on the usage status of the service by the user of the service at each predetermined period. (((6))) The information processing system described in any one of (((1))) to (((5))) is characterized in that the processor determines that the conditions for discarding are not met when a user of the service is using at least one of the one service or another service related to the one service. (((7))) The information processing system described in any one of (((1))) to (((6))) is characterized in that the processor determines that the condition regarding discard is not satisfied when a user of the service is using at least one of the services available using the same access token. (((8))) The information processing system described in any one of ((1)) to (((7))) is characterized in that even if the processor determines that the condition regarding discard is satisfied in one information processing device among multiple information processing devices having a specific relationship, it determines that the condition regarding discard is not satisfied if a service is being used in another information processing device having the specific relationship. (((9))) A program for enabling a computer to implement the following functions: accepting a request for issuance of an access token used when using a service; instructing a computer to issue an access token and a refresh token used to renew the access token when the access token expires; acquiring the access token and refresh token issued by the instruction; updating the access token using the refresh token based on predetermined renewal conditions; and discarding the refresh token based on predetermined discard conditions.

[0051] According to the invention of (((1))), compared to a case where access tokens are managed by expiration date, security risks can be reduced by refreshing access tokens using refresh tokens and reducing the opportunities for tokens to be used fraudulently. According to the invention of (((2))), it is possible to confirm the user's service usage status and discard the token. According to the invention of (((3))), the deadline for discarding a token can be flexibly determined according to the type of service, as compared to when a certain period is fixed. According to the invention (((4))), the token can be revoked according to the time that has elapsed since the user last used the service. According to the invention (((5))), the user's service usage status can be checked at predetermined intervals and the token can be discarded. According to the invention of (((6))), it is possible to discard a token by checking the usage status of related services, as opposed to checking the usage status for each service separately. According to the invention of (((7))), compared to the case where the usage status is checked for each service, it is possible to check the usage status of available services using the same access token and discard the token. According to the invention (((8))), it is possible to discard a token by checking the usage status of a plurality of information processing devices, as compared to a case where the usage status is checked for each information processing device. According to the invention (((9))), a computer having the program of the present invention installed can reduce security risks by updating access tokens using refresh tokens and reducing the opportunities for tokens to be used fraudulently, compared to when access tokens are managed by expiration date. [Explanation of symbols]

[0052] 100...information processing device, 200...service providing server, 300...authorization server, 110...storage unit, 111...user authentication management DB, 112...service access management DB, 113...login status management DB, 114...token management DB, 115...service authentication management DB, 116...service related management DB, 121...login status management unit, 122...service management unit, 123...access control unit, 124...authentication management unit, 125...token management unit, 126...information input / output unit, 127...communication unit

Claims

1. One or more processors; The one or more processors: Accepts requests to issue access tokens used when using the service, instructing issuance of the access token and a refresh token used to refresh the access token when the access token expires; Obtaining the access token and refresh token issued in accordance with the instruction; Renewing the access token using the refresh token based on a predetermined refresh condition; Revoke the refresh token based on a predetermined revocation condition. An information processing system comprising:

2. 2. The information processing system according to claim 1, wherein the predetermined condition regarding the discard includes the lapse of a certain period of time without a user of the service using the service.

3. 3. The information processing system according to claim 2, wherein the period is determined according to the type of the service to be used.

4. 3. The information processing system according to claim 2, wherein the period is a date and time that has elapsed since the date and time that the user of the service last used the service.

5. 2. The information processing system according to claim 1, wherein the processor determines the condition regarding the discarding based on a usage status of the service by a user of the service for each predetermined period.

6. The information processing system according to claim 5, characterized in that the processor determines that the conditions for discarding are not met when a user of the service is using at least one of the one service or another service related to the one service.

7. The information processing system according to claim 5, characterized in that the processor determines that the condition regarding discard is not satisfied when a user of the service is using at least one of the services available using the same access token.

8. The information processing system according to claim 5, characterized in that even if the processor determines that the condition regarding discarding is satisfied in one of a plurality of information processing devices having a specific relationship, it determines that the condition regarding discarding is not satisfied if a service is being used in another information processing device having the specific relationship.

9. On the computer, A function to accept requests to issue access tokens used when using the service; a function for instructing issuance of the access token and a refresh token used to refresh the access token when the access token expires; a function of obtaining an access token and a refresh token issued in response to the instruction; a function of updating the access token using the update token based on a predetermined update condition; A function of discarding the update token based on a predetermined discarding condition; A program to achieve this.

Images