Information processing system and program

Abstract

To suppress occurrence of unauthorized acquisition of token information caused by spoofing, in a case in which information used for acquiring the token information between a device performing data communication and other terminals corresponding to an authorization server is delivered.SOLUTION: An information processing device extracts identification information of a user from an ID token when receiving login of the user, and acquiring an access token and the ID token issued from an authorization server in response to a request from an external device, compares identification information on a user acquired when receiving the login with identification information on the user extracted from the ID token, and permits access based on the access token when they coincide with each other.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to an information processing system and a program. [Background technology]

[0002] In data communication, so-called modern authentication such as OAuth authentication is increasingly required to strengthen security. In OAuth authentication, when issuing an access token in response to a request, a request for an authorization code is made from the web browser to the authorization endpoint of the authorization server.

[0003] If the Web browser installed in the device used for data communication does not support the authorization server, the authorization code required to issue the access token cannot be obtained. In such a case, the authorization code may be obtained through another terminal having a Web browser that supports the authorization server.

[0004] Patent document 1 discloses an information processing device that has a web browser function and a web browser service that operates the web browser function, in which the web browser service accepts an authorization processing request from a local application on the information processing device, generates a URL required for the authorization processing, and presents the generated URL to a mobile terminal using the web browser function, thereby enabling user authorization via a mobile terminal. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent Publication No. 2021-118437 Summary of the Invention [Problem to be solved by the invention]

[0006] When transferring information between a device performing data communication and another terminal corresponding to an authorization server, if a method such as displaying the information on a screen is used, there is a possibility that a third party may obtain the information illegally. Specifically, the information displayed on the screen may be secretly viewed or photographed illegally. This may lead to the illegal acquisition of token information through spoofing.

[0007] The present invention aims to prevent the occurrence of fraudulent acquisition of token information through impersonation when information used to acquire token information is exchanged between a device performing data communication and another terminal corresponding to an authorization server. [Means for solving the problem]

[0008] The present invention according to claim 1 is one or more processors; The processor, Accept the user's login, When an access token and an ID token issued by an authorization server in response to a request from an external device are obtained, the access token and the ID token are extracted from the ID token; comparing the user identification information acquired when accepting the login with the user identification information extracted from the ID token, and if they match, permitting access based on the access token; The present invention relates to an information processing system. The present invention according to claim 2 is The processor, In response to the login, an authentication URL and a user code are obtained from the authorization server; providing the obtained authentication URL and the user code to the user; Extracting user identification information from the ID token obtained after providing the authentication URL and the user code to the user, and comparing the extracted information with the identification information obtained at the time of login. The information processing system according to claim 1 is characterized in that: The present invention according to claim 3 is The processor, As a method for providing the obtained authentication URL and user code, an image including information on the authentication URL and the user code is displayed on a display device. The information processing system according to claim 2 is characterized in that: The present invention according to claim 4 is The processor, If the user identification information acquired when accepting the login does not match the user identification information extracted from the ID token, notify an administrator that it is determined that information used to request the access token and the ID token from the authorization server has been leaked. The information processing system according to claim 1 is characterized in that: The present invention according to claim 5 is The processor, Notifying the administrator of the user's identification information extracted from the ID token. The information processing system according to claim 4 is characterized in that: The present invention according to claim 6 is one or more processors; The processor, Accepting a login by a user using identification information shared by multiple users; Obtaining, in response to the login, an authentication URL and a user code from the authorization server for causing the authorization server to issue an access token and an ID token; Providing the obtained authentication URL to the user, and transmitting information about the user code to the user via a route different from the authentication URL. The present invention relates to an information processing system. The present invention according to claim 7 is The processor, As a method for providing the obtained authentication URL, an image including information of the authentication URL is displayed on a display device. The information processing system according to claim 6 is characterized in that: The present invention according to claim 8 is The processor, sending said user code to said user by email; The information processing system according to claim 6 is characterized in that: The present invention according to claim 9 is On the computer, A function to accept user logins, a function of extracting user identification information from an ID token when the access token and the ID token are issued by an authorization server in response to a request from an external device; a function of comparing the user identification information acquired when accepting the login with the user identification information extracted from the ID token, and permitting access based on the access token if they match; The present invention is a program characterized by realizing the above. The present invention according to claim 10 comprises: On the computer, A program for controlling a computer that can be connected to multiple networks, The computer includes: A function for accepting login by a user using identification information shared by multiple users; a function of acquiring, from the authorization server in response to the login, an authentication URL and a user code for causing the authorization server to issue an access token and an ID token; a function of providing the acquired authentication URL to the user and transmitting information of the user code to the user via a route different from the authentication URL; The present invention is a program characterized by realizing the above. Effect of the Invention

[0009] According to the invention of claim 1, compared to a system that relies on ID tokens for authentication, it is possible to prevent unauthorized use of the system caused by the token itself being issued through spoofing. According to the invention of claim 2, unlike a configuration that targets all acquired ID tokens, it is possible to detect spoofing caused by leakage of the user code. According to the invention of claim 3, unlike a configuration that targets all acquired ID tokens, it is possible to detect spoofing caused by leakage of the user code displayed on the display device. According to the invention of claim 4, unlike a configuration in which access based on an access token acquired together with an ID token is simply prohibited, it is possible to notify the occurrence of impersonation due to leakage of a user code. According to the invention of claim 5, unlike a configuration in which access based on an access token acquired together with an ID token is simply prohibited, it is possible to notify the occurrence of impersonation due to leakage of a user code. According to the invention of claim 6, unlike a configuration in which the authentication URL and the user code are provided together, it is possible to prevent the occurrence of leakage of the user code. According to the invention of claim 7, unlike a configuration in which the information processing system instructs the authorization server to issue an access token, it is possible to instruct the authorization server to issue an access token regardless of the display function in the information processing system. According to the invention of claim 8, unlike the configuration in which the authentication URL and the user code are provided together, the user code can be provided only to the target user by using email. According to the invention of claim 9, in a computer having the program of the present invention installed, compared to a system that relies on ID tokens for authentication, it is possible to prevent unauthorized use of the system caused by the token itself being issued through spoofing. According to the invention of claim 10, in a computer having the program of the present invention installed, unlike a configuration in which an authentication URL and a user code are provided together, it is possible to prevent the occurrence of leakage of the user code. [Brief description of the drawings]

[0010] [Figure 1]1 is a diagram showing a configuration of an information processing system to which the present embodiment is applied. [Diagram 2] FIG. 1 is a diagram illustrating a configuration of an image processing device. [Diagram 3] FIG. 2 is a diagram illustrating a functional configuration of a control device. [Figure 4] FIG. 2 illustrates an example of a hardware configuration of an authorization server. [Diagram 5] FIG. 2 illustrates an example of a hardware configuration of a terminal device. [Figure 6] This is a diagram showing the operation in the case of user login. [Figure 7] FIG. 13 is a diagram showing another example of the operation in the case of user login. [Figure 8] FIG. 13 is a diagram illustrating an operation in the case of administrator login. [Figure 9] FIG. 11 is a diagram illustrating another example of the operation in the case of administrator login. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. <System configuration> Fig. 1 is a diagram showing the configuration of an information processing system to which the present embodiment is applied. This information processing system includes an information processing device 100, an authorization server 200, and a terminal device 300. The information processing device 100 and the authorization server 200, and the authorization server 200 and the terminal device 300 are connected via a network (see the solid arrows in Fig. 1).

[0012] The information processing device 100 is a device that executes data processing in response to an instruction from an authenticated user. The information processing device 100 performs user authentication processing, and also authenticates an instruction to execute processing based on a token issued by the authorization server 200. The information processing device 100 includes a display device and has a screen display function using a Web browser. As the information processing device 100, various devices and the like equipped with a computer as a control device may be assumed. For example, the information processing device 100 may be an image processing device equipped with a computer as a control device. In the following description, an example will be described in which an image processing device is used as the information processing device 100. Hereinafter, this image processing device will be described with the same reference numeral 100 as the information processing device 100.

[0013] The authorization server 200 provides credential information to a user in response to a request from the user. The credential information includes an authentication URL (Uniform Resource Locator) and a user code. The authentication URL is a URL to be accessed to request authentication and token issuance by the authorization server 200. The user code is code data used in combination with the authentication URL, and is information for managing a token issued after authentication.

[0014] Furthermore, the authorization server 200 performs user authentication in response to an authentication request based on the credential information, and issues a token for executing processing in the image processing device 100. The issued token includes an access token that grants authority to cause the image processing device 100 to execute processing, and an ID token in which authentication information of the user is recorded. The authentication information includes a user ID that is identification information of the user. This user ID is assumed to be the same as the user ID input by the user in a login operation to the image processing device 100, which will be described later. For the authorization server 200 to issue a token, it is necessary to request an authorization code from a Web browser to an authorization end point of the authorization server 200. An authentication URL provided as credential information is used to access this authorization end point.

[0015] The terminal device 300 is an information terminal used by a user to obtain authentication by the authorization server 200. Although one terminal device 300 is illustrated in FIG. 1, the terminal device 300 is individually owned by a plurality of users who use the image processing device 100. The terminal device 300 includes a display device and has a screen display function using a Web browser. The terminal device 300 also includes an imaging means for capturing images. For example, a smartphone, a tablet terminal, a notebook personal computer, or the like is used as the terminal device 300.

[0016] As described above, in order for the authorization server 200 to issue a token, it is necessary to request an authorization code from a Web browser. Also, it has been described that the image processing device 100 has a screen display function using a Web browser. However, if the Web browser of the image processing device 100 is not compatible with the authorization server 200 due to a version difference or the like, it is not possible to access the authorization server 200 from the image processing device 100 to obtain a token. On the other hand, if the image processing device 100 is a device such as an image processing device equipped with a computer as a control device, it may be difficult to always keep the Web browser up to date for system management reasons. Therefore, credential information is transferred to a terminal device 300 having a Web browser compatible with the authorization server 200 (see the dashed arrow in FIG. 1) and a request is made to issue a token.

[0017] As an example of a method for transferring credential information between the information processing device 100 and the terminal device 300, a screen including the credential information is displayed on the information processing device 100, and the screen is photographed and acquired by the terminal device 300. However, in this case, if a third party secretly views or photographs the screen displayed on the information processing device 100 to acquire the credential information, the unauthorized third party can receive a token from the authorization server 200 and use the information processing device 100. In this embodiment, the image processing device 100 has a means for preventing such unauthorized third parties from using the image processing device 100. This prevention means will be described later.

[0018] <Configuration of image processing device 100> 2 is a diagram showing the configuration of the image processing device 100. The image processing device 100 includes an image forming unit 110, an image reading unit 120, a display device 130, an operation device 140, a communication interface 150, a storage device 160, and a control device 170.

[0019] The image forming unit 110 forms an image based on image data on paper, which is an example of a recording material, using an image forming material. Examples of a method for forming an image on a recording material include an electrophotographic method in which toner attached to a photoreceptor is transferred to the recording material to form an image, and an inkjet method in which ink is ejected onto the recording material to form an image.

[0020] The image reading unit 120 is configured by a so-called scanner device, optically reads an image on a set document, and generates data of the read image. Examples of image reading methods include a CCD method in which light reflected from light irradiated from a light source onto a document is reduced by a lens and received by a CCD (Charge Coupled Devices), and a CIS method in which light reflected from light irradiated in sequence from an LED (Light Emitting Diode) light source onto a document is received by a CIS (Contact Image Sensor).

[0021] The display device 130 displays information images that present various information to the user, preview images of images to be processed such as read and output, operation images for the user to operate, etc. The display device 130 is configured, for example, with a liquid crystal display. The display device 130 may be combined with the operation device 140 to be used as a user interface means for the user to input and output information to the image processing device 100.

[0022] The operation device 140 is a device for a user to operate to input commands and data, etc. The operation device 140 is configured, for example, by a hardware key, a touch sensor that outputs a control signal according to a position pressed or touched by a finger, etc. It may be configured as a touch panel that combines a touch sensor and a liquid crystal display that constitutes the display device 130.

[0023] The communication interface 150 is an interface for transmitting and receiving commands and data to and from an external device. An interface according to a communication method with the external device is used as the communication interface 150. The connection with the external device may be made via a network or by direct connection. The communication line may be a wired line or a wireless line. Furthermore, if the image processing device 100 has a facsimile function, the communication interface 150 includes an interface for a telephone line.

[0024] The storage device 160 stores various data, such as programs and data executed by the control device 170, image data read by the image reading unit 120, log data generated by various operations, etc. The storage device 160 is realized by a storage device such as a magnetic disk device or an SSD (Solid State Drive), for example.

[0025] The control device 170 includes a processor as a calculation means and a memory as a storage means, and realizes each function described below by loading a program stored in the storage device 160 into the memory and executing it. As the processor, in addition to a central processing unit (CPU), a micro processing unit (MPU), a graphics processing unit (GPU), a digital signal processor (DSP), etc. are used. As the memory, for example, a dynamic random access memory (DRAM), etc. are used.

[0026] <Functional configuration of the control device 170> 3 is a diagram showing the functional configuration of the control device 170. The control device 170 includes a login management unit 171, a credential information acquisition unit 172, a credential information provision unit 173, a verification unit 174, and a function control unit 175.

[0027] The login management unit 171 accepts a login to the image processing device 100 by a user and manages the login information. The login is performed, for example, by the user operating the operation device 140 to input user information (login operation). The login management unit 171 determines that the login is successful when the input user information matches the user information registered in advance. The user information includes a user ID, which is identification information of the user, and a password. The login management unit 171 stores and manages the login information including the input user information and information such as the time of login in the storage device 160. In this embodiment, the login to the image processing device 100 includes a login using user credentials using the user information of the user who uses the image processing device 100 (hereinafter referred to as "user login") and a login using system credentials using the user information of the administrator of the image processing device 100 (hereinafter referred to as "administrator login").

[0028] When the login management unit 171 accepts a user login, the credential information acquisition unit 172 requests the authorization server 200 to issue credential information, and acquires the issued credential information. As described above, there are user login and administrator login for login to the image processing device 100, but the credential information issued by the authorization server 200 is the same for the user login and the administrator login. However, the storage device 160 of the image processing device 100 stores administrator information, and the control device 170 can distinguish between the credential information acquired by the user login and the credential information acquired by the administrator login.

[0029] The credential information providing unit 173 provides the user with the credential information acquired by the credential information acquiring unit 172. The credential information may be provided by displaying it on the display device 130, transmitting it by email, or presenting it using a WebUI (Web User Interface). The credential information providing unit 173 provides the credential information by displaying at least an image indicating an authentication URL on the display device 130. The authentication URL may be displayed by displaying the URL text as is, or may be displayed as a code image generated by converting it into a two-dimensional code or the like.

[0030] On the other hand, the credential information providing unit 173 provides the user code included in the credential information by different means depending on the login method to the image processing device 100. When the login to the image processing device 100 is a user login, the credential information providing unit 173 provides the user code by displaying it on the display device 130. The user code may be displayed as the code text as is, or may be displayed as a code image generated by converting it into a two-dimensional code or the like together with the authentication URL.

[0031] On the other hand, when the login to the image processing device 100 is an administrator login, the credential information providing unit 173 provides the user code to the user via a route different from the provision of the authentication URL (display on the display device 130). For example, the credential information providing unit 173 may send an email containing the user code to the logged-in user (hereinafter referred to as the "logged-in user"). The credential information providing unit 173 may also generate a data file containing the user code and provide the data file by making it accessible via a WebUI that can be operated by the logged-in user. Since the login to the image processing device 100 is an administrator login, the logged-in user in these cases is the administrator.

[0032] The verification unit 174 verifies whether or not the token issued by the authorization server 200 is based on a valid issuance request. This verification is performed when the login to the image processing device 100 is a user login. The verification unit 174 extracts a user ID from an ID token among the tokens acquired from the authorization server 200, and checks whether or not it matches the user ID entered at the time of login. If the two user IDs match, the verification unit 174 determines that the token is based on a valid issuance request, and if they do not match, the verification unit 174 determines that the token is based on a valid issuance request.

[0033] The function control unit 175 controls various functions of the image processing device 100. In addition, the function control unit 175 accepts the above-mentioned login, controls communication when acquiring credential information and tokens from the authorization server 200, displays the credential information on the display device 130 and sends e-mails when providing the credential information to the user, controls the WebUI, and the like.

[0034] <Configuration of the Authorization Server 200> FIG. 4 is a diagram showing an example of a hardware configuration of the authorization server 200. The authorization server 200 is realized by, for example, a computer as shown in FIG. 4. The computer shown in FIG. 4 includes one or more processors 201 as a calculation means, and a main memory 202 and an auxiliary memory 203 as storage means. The processor 201 realizes each function of the authorization server 200 by loading a program stored in the auxiliary memory 203 into the main memory 202 and executing it. For example, a central processing unit (CPU), a micro processing unit (MPU), a graphics processing unit (GPU), a digital signal processor (DSP), or the like is used as the processor 201. For example, a random access memory (RAM) is used as the main memory 202. For example, a magnetic disk device or a solid state drive (SSD) is used as the auxiliary memory 203.

[0035] The computer shown in Fig. 4 also includes a communication interface 204 for connecting to the image processing device 100 and the terminal device 300 via a network. The computer configuration shown in Fig. 4 is merely an example, and the computer used in this embodiment is not limited to the configuration example shown in Fig. 4. For example, the computer may be configured to include a non-volatile memory such as a flash memory or a ROM (Read Only Memory) as a storage device. Furthermore, the authorization server 200 is not limited to a single computer as shown in Fig. 4, but may be configured by distributing functions among multiple computers, or may be realized as a so-called cloud server constructed using resources on a network.

[0036] When the authorization server 200 is realized by the computer shown in Figure 4, the function of providing credential information in response to a request from the image processing device 100, the function of performing user authentication in response to an authentication request based on the credential information, and the function of issuing a token in response to the result of user authentication are realized, for example, by the processor 201 executing a program.

[0037] <Configuration of Terminal Device 300> FIG. 5 is a diagram showing an example of a hardware configuration of the terminal device 300. The terminal device 300 is realized by, for example, a computer as shown in FIG. 5. The computer shown in FIG. 5 includes one or more processors 301 as a calculation means, and a main storage device (main memory) 302 and an auxiliary storage device 303 as storage means. The processor 301 realizes each function of the terminal device 300 by loading a program stored in the auxiliary storage device 303 into the main storage device 302 and executing it. For example, a CPU, an MPU, a GPU, a DSP, or the like is used as the processor 301. For example, a RAM is used as the main storage device 302. For example, a magnetic disk device, an SSD, or the like is used as the auxiliary storage device 303. A web browser compatible with the authorization server 200 is installed in the computer as the terminal device 300.

[0038] The computer shown in FIG. 5 includes a display unit 304 that displays various screens and an input device 305 on which a user performs an input operation. The display unit 304 is, for example, a liquid crystal display. The input device 305 is, for example, a touch sensor. The touch sensor of the input device 305 and the liquid crystal display of the display unit 304 may be combined to form a touch panel. The computer also includes an imaging unit 306 for capturing images. The imaging unit 306 is, for example, realized by a camera using an image sensor. The computer also includes a communication interface 307 for connecting to the authorization server 200 via a network. Note that the configuration of the computer shown in FIG. 5 is merely an example, and the computer used as the terminal device 300 is not limited to the configuration example of FIG. 5. For example, the computer may be configured to include a non-volatile memory such as a flash memory or a ROM as a storage device.

[0039] When the terminal device 300 is realized by the computer shown in FIG. 5, the function of making an authentication request based on the credential information is realized, for example, by the processor 301 executing a program. More specifically, the processor 301 starts a web browser, and an authentication request is made to the authorization server 200 by the function of this web browser. In addition, in the computer as the terminal device 300, the function of acquiring the credential information from the image processing device 100 is realized, for example, by the processor 301 executing a program and controlling the imaging unit 306 and the communication interface 307. More specifically, when the credential information is displayed on the display device 130 of the image processing device 100, when the screen of the display device 130 of the image processing device 100 is photographed by the imaging unit 306, the processor 301 extracts the credential information from the photographed image. In addition, when a user code of the credential information is transmitted by email, the processor 301 extracts the user code from the email received via the communication interface 307. In addition, when the user code among the credential information is provided by the WebUI, the processor 301 launches a Web browser, and the Web browser accepts user operations on the WebUI displayed on the display unit 304, and the user code is displayed on the display unit 304.

[0040] <Authentication Operation> The following describes an authentication operation when a user uses the image processing device 100. Here, the explanation is given using a sequence diagram in which the image processing device 100, the authorization server 200, and the terminal device 300 are the main actors in the operation. In the following explanation, the terminal device 300 used by a legitimate user who has logged in to the image processing device 100 is referred to as terminal device 300A, and the terminal device 300 used by a third party (unauthorized user) who has not logged in to the image processing device 100 is referred to as terminal device 300B. The terminal devices 300A and 300B have the same functions.

[0041] <Operation when user is logged in> 6 is a diagram showing operations in the case of a user logging in. This operation example shows a procedure in which an access token is issued in response to a request from a valid user who has logged in to the image processing device 100, and the image processing device 100 is used.

[0042] First, a login operation is performed in the image processing device 100 using the user's own user information (user ID and password) (S10). When the image processing device 100 accepts the login operation, it requests the authorization server 200 to issue credential information (S11). In response to this request, the authorization server 200 generates a user code and returns it to the image processing device 100 together with an authentication URL as credential information (S12).

[0043] The image processing device 100 displays an image showing the credential information acquired from the authorization server 200 on the display device 130 and provides it to the user (S13). The credential information may be displayed, for example, as a code image converted into a two-dimensional code including the authentication URL and the user code, or only the authentication URL may be displayed as a code image and the user code may be displayed as text. Alternatively, the authentication URL may be displayed as text and the user code may be displayed as a code image. Furthermore, both the authentication URL and the user code may be displayed as text.

[0044] The user uses his / her terminal device 300A to capture an image showing the credential information displayed on the display device 130 of the image processing device 100. The terminal device 300A extracts an authentication URL and a user code from the captured image of the credential information (S14). Next, the user starts a web browser on the terminal device 300A and accesses the authorization server 200 using the extracted authentication URL. The user then inputs the user code extracted from the credential information and his / her own authentication information (user ID and password). The terminal device 300A transmits the input user code and authentication information to the authorization server 200 to make an authentication request (S15).

[0045] When the authorization server 200 receives an authentication request from the terminal device 300A, it identifies an issuance event of credential information based on the user code, and performs authentication processing based on the authentication information acquired together with the user code (S16). If the authentication information acquired from the terminal device 300A is registered in its own system, the authorization server 200 issues an access token and an ID token and transmits them to the image processing device 100 (S17). Here, the authorization server 200 determines only whether the authentication information is registered in its own system, and does not know whether the user identified by the authentication information is the user who logged in to the image processing device 100.

[0046] When the image processing device 100 acquires the access token and ID token from the authorization server 200, it extracts the user ID from the ID token and judges whether the extracted user ID is the same as the user ID input in S10 (S18). This ID token is the ID token acquired after the image processing device 100 provides the user with credential information. In this case, the user who has logged in to the image processing device 100 has requested authentication from the authorization server 200, so the two user IDs are the same. Therefore, the instruction to the image processing device 100 to execute the process is authenticated, and the image processing device 100 executes the process in accordance with the user's operation (S19).

[0047] 7 is a diagram showing another example of the operation when a user logs in. This operation example shows a procedure when an access token is issued in response to a request from a third party (an unauthorized user) different from the user who has logged in to the image processing device 100.

[0048] The operations (S10 to S13) from when login is performed at image processing device 100, when credential information is provided from authorization server 200, until the credential information is displayed at image processing device 100 are the same as those in Fig. 6. Here, it is assumed that an image of the credential information displayed on display device 130 of image processing device 100 has been photographed by a third party, different from the user who logged in to image processing device 100, using his / her own terminal device 300B. Note that this third party is not the user who logged in to image processing device 100 in this series of operations, but is a user whose authentication information is registered in authorization server 200.

[0049] The terminal device 300B extracts an authentication URL and a user code from the captured image of the credential information (S21). Next, the third party launches a web browser on the terminal device 300B and accesses the authorization server 200 using the extracted authentication URL. The third party then inputs the user code extracted from the credential information and his / her own authentication information (user ID and password). The terminal device 300B transmits the input user code and authentication information to the authorization server 200 and makes an authentication request (S22).

[0050] The authorization server 200 performs authentication processing for the authentication request from the third party, similar to the authentication request from the valid user shown in FIG. 6 (S16), and issues an access token and an ID token and transmits them to the image processing device 100 (S17).

[0051] When the image processing device 100 acquires the access token and ID token from the authorization server 200, it extracts the user ID from the ID token and judges whether the extracted user ID is the same as the user ID input in S10 (S18). In this case, a third party, who is a user different from the user who logged in to the image processing device 100, has made an authentication request to the authorization server 200, so the two user IDs are different. Therefore, the instruction to the image processing device 100 to execute the process is not authenticated, and the image processing device 100 executes error processing (S23).

[0052] In this manner, when a user different from the user who logged in to the image processing device 100 makes an authentication request to the authorization server 200, it is determined that the credential information has been leaked due to a mismatch in the user ID. Then, unauthorized use of the access token is prevented. Examples of the error processing in S23 include displaying a message on the display device 130 indicating that the user is not authorized to use the image processing device 100, or notifying the administrator that it is determined that the user code has been leaked. The notification to the administrator may also include the user ID extracted from the ID token.

[0053] <Operation when administrator logs in> Fig. 8 is a diagram showing the operation in the case of administrator login. The operations (S10 to S12) from when login is performed in the image processing device 100 until credential information is provided from the authorization server 200 are the same as those in Fig. 6. However, login to the image processing device 100 is performed using the user ID of the administrator.

[0054] The image processing device 100 displays an image indicating an authentication URL from the credential information acquired from the authorization server 200 on the display device 130 and provides it to the user (S13). The authentication URL may be displayed, for example, as a code image obtained by converting the authentication URL into a two-dimensional code or the like, or only the authentication URL may be displayed as a code image.

[0055] The user uses his / her terminal device 300A to capture an image showing information about the authentication URL displayed on the display device 130 of the image processing device 100. The terminal device 300A extracts the authentication URL from the captured image (S31).

[0056] Furthermore, the image processing device 100 provides the user with a user code from the credential information acquired from the authorization server 200 via a route different from the authentication URL. Here, an e-mail containing the user code is sent to the user's terminal device 300A (S33). In this operation example, since the login to the image processing device 100 is performed using the administrator's user ID, the destination of the e-mail is the administrator's terminal device 300. Therefore, if the user who has logged in to the image processing device 100 is a user other than the administrator, it is necessary to transfer the e-mail from the administrator's terminal device 300 to the terminal device 300A.

[0057] When the user's terminal device 300A receives the e-mail from the image processing device 100, it extracts the user code written in the received e-mail (S34). Next, the user starts a web browser on the terminal device 300A and accesses the authorization server 200 using the authentication URL extracted in S41. The user then inputs the user code extracted in S44 and his / her own authentication information. The terminal device 300A transmits the input user code and authentication information to the authorization server 200 and makes an authentication request (S35).

[0058] Here, it is assumed that a third party, different from the user who logged in to the image processing device 100, uses his / her own terminal device 300B to capture an image showing the information of the authentication URL displayed on the display device 130 of the image processing device 100 in S13. The third party's terminal device 300B extracts the authentication URL from the captured image (S32). However, the image processing device 100 does not transmit an e-mail containing a user code to the third party's terminal device 300B, who is not an administrator. For this reason, although the third party can access the authorization server 200 using the authentication URL, he / she cannot make an authentication request to the authorization server 200.

[0059] As in the operation example shown in FIG. 6, the authorization server 200 performs authentication processing in response to the authentication request from the terminal device 300A (S16), and issues and transmits an access token and an ID token to the image processing device 100 (S17).

[0060] When the image processing device 100 acquires the access token and the ID token from the authorization server 200, it executes processing according to the user's operation based on the acquired access token (S19). Note that in this operation example, a third party who cannot acquire the user code cannot cause the authorization server 200 to issue an access token, so there is no need to verify the user ID (S18 shown in FIGS. 6 and 7).

[0061] Fig. 9 is a diagram showing another example of the operation when an administrator logs in. The operations (S10 to S13) from when login is performed in the image processing device 100, when credential information is provided from the authorization server 200, until when an image showing an authentication URL in the credential information is displayed in the image processing device 100 are the same as those in Fig. 8.

[0062] The user uses his / her terminal device 300A to capture an image showing information about the authentication URL displayed on the display device 130 of the image processing device 100. The terminal device 300A extracts the authentication URL from the captured image (S41).

[0063] Furthermore, the image processing device 100 provides the user with a user code, which is part of the credential information acquired from the authorization server 200, via a route different from the authentication URL. Here, the image processing device 100 generates a data file containing the user code, which can be referenced via the WebUI. Then, the image processing device 100 notifies the user's terminal device 300A to prompt the user to acquire the user code via the WebUI (S43).

[0064] When the user's terminal device 300A receives the above notification from the image processing device 100, the user launches a web browser on the terminal device 300A to display the WebUI, and operates the displayed WebUI to obtain a user code (S44). Note that in this operation example, login to the image processing device 100 is performed using the administrator's user ID, so the destination of the notification is the administrator's terminal device 300. Therefore, if the user who has logged in to the image processing device 100 is a user other than the administrator, the administrator who has operated the WebUI to obtain the user code must inform the user, who is the owner of the terminal device 300A, of the user code.

[0065] Next, the user accesses the authorization server 200 from the web browser of the terminal device 300A using the authentication URL extracted in S41. Then, the user inputs the user code acquired in S44 and his / her own authentication information. The terminal device 300A transmits the input user code and authentication information to the authorization server 200 and makes an authentication request (S45).

[0066] Here, it is assumed that a third party, different from the user who logged in to the image processing device 100, uses his / her own terminal device 300B to capture an image showing information about the authentication URL displayed on the display device 130 of the image processing device 100 in S13. The third party's terminal device 300B extracts the authentication URL from the captured image (S42). However, the image processing device 100 does not notify the terminal device 300B of the third party, who is not an administrator, to prompt the terminal device 300B to obtain a user code via the WebUI. For this reason, although the third party can access the authorization server 200 using the authentication URL, he / she cannot make an authentication request to the authorization server 200.

[0067] As in the operation example shown in FIG. 6, the authorization server 200 performs authentication processing in response to the authentication request from the terminal device 300A (S16), and issues and transmits an access token and an ID token to the image processing device 100 (S17).

[0068] When the image processing device 100 acquires the access token and the ID token from the authorization server 200, it executes processing according to the user's operation based on the acquired access token (S19). Note that in this operation example, a third party who cannot acquire the user code cannot cause the authorization server 200 to issue an access token, so there is no need to verify the user ID (S18 shown in FIGS. 6 and 7).

[0069] In the above operation in case of administrator login, even if a user other than the administrator uses the image processing device 100, the administrator's user ID is used to log in. For this reason, the administrator's user ID is shared by users who may use the image processing device 100. A user who uses the image processing device 100 can obtain the user code provided by the image processing device 100 by, for example, informing the administrator that he / she will be using the image processing device 100 and requesting the administrator to provide the user code at the time of logging in or before logging in.

[0070] Although the embodiment of the present invention has been described above, the technical scope of the present invention is not limited to the above embodiment. For example, in the above embodiment, in the case of administrator login, the authentication URL and the user code in the credential information are provided to the user via different routes. In contrast, the image processing device 100 may be configured to store the authentication information of each user in association with the notification destination such as the email address of the corresponding user, and provide the user code to each user who logs in to the image processing device 100 in a manner obtained by email or WebUI. In addition, various modifications and alternative configurations that do not deviate from the scope of the technical idea of ​​the present invention are included in the present invention.

[0071] <Additional Notes> (((1))) 1. An information processing system comprising: one or more processors, the processor accepting a user login; when the processor acquires an access token and an ID token issued by an authorization server in response to a request from an external device, extracting user identification information from the ID token; comparing the user identification information acquired when the login was accepted with the user identification information extracted from the ID token; and, if they match, permitting access based on the access token. (((2))) The information processing system described in (((1))) is characterized in that the processor obtains an authentication URL and a user code from the authorization server in response to the login, provides the obtained authentication URL and user code to the user, extracts user identification information from the ID token obtained after providing the authentication URL and the user code to the user, and compares it with the identification information obtained at the time of login. (((3))) The information processing system described in (((2))) is characterized in that the processor displays an image including information of the authentication URL and the user code on a display device as a method of providing the acquired authentication URL and user code. (((4))) The information processing system described in any of (((1))) to (((3))), characterized in that, if the user identification information obtained when accepting the login does not match the user identification information extracted from the ID token, the processor notifies an administrator that it is determined that information used to request the access token and the ID token from the authorization server has been leaked. (((5))) The information processing system according to (((4))), wherein the processor notifies the administrator of the user's identification information extracted from the ID token. (((6))) 1. An information processing system comprising one or more processors, the processors accepting a login by a user using identification information shared by a plurality of users, acquiring an authentication URL and a user code from an authorization server in response to the login for causing an authorization server to issue an access token and an ID token, providing the acquired authentication URL to the user, and transmitting information of the user code to the user via a route different from the authentication URL. (((7))) The information processing system described in (((6))) is characterized in that the processor displays an image including information of the authentication URL on a display device as a method of providing the acquired authentication URL. (((8))) The information processing system according to (((7))), wherein the processor transmits the user code to the user by email. (((9))) A program that causes a computer to realize the following functions: a function of accepting a user's login; a function of extracting user identification information from an ID token when an access token and an ID token issued by an authorization server in response to a request from an external device are obtained; and a function of comparing the user identification information obtained when the login was accepted with the user identification information extracted from the ID token, and allowing access based on the access token if they match. (((10))) A program for controlling a computer that can be connected to multiple networks, the program causing the computer to realize the following functions: accepting login by a user using identification information shared by multiple users; acquiring an authentication URL and a user code from an authorization server in response to the login, for causing an authorization server to issue an access token and an ID token; and providing the acquired authentication URL to the user and transmitting information of the user code to the user via a route different from the authentication URL.

[0072] The information processing system according to (((1))) can prevent unauthorized use of the system caused by the token itself being issued through spoofing, compared to a system that relies on ID tokens for authentication. According to the information processing system of (((2))), unlike a configuration that targets all acquired ID tokens, it is possible to detect spoofing caused by leakage of the user code. According to the information processing system of (((3))), unlike a configuration that targets all acquired ID tokens, it is possible to detect spoofing caused by leakage of the user code displayed on the display device. According to the information processing system of (((4))), unlike a configuration that simply prohibits access based on an access token acquired together with an ID token, it is possible to notify the occurrence of impersonation due to leakage of a user code. According to the information processing system of (((5))), unlike a configuration that simply prohibits access based on an access token acquired together with an ID token, it is possible to notify the occurrence of impersonation due to leakage of a user code. According to the information processing system of (((6))), unlike a configuration in which an authentication URL and a user code are provided together, it is possible to prevent the occurrence of leakage of the user code. According to the information processing system of (((7))), unlike a configuration in which the information processing system instructs the authorization server to issue an access token, it is possible to instruct the authorization server to issue an access token regardless of the display function in the information processing system. According to the information processing system of (((8))), unlike the configuration in which the authentication URL and the user code are provided together, the user code can be provided only to the target user by email. According to the program of (((9))), in a computer having such program installed, it is possible to prevent unauthorized use of the system caused by the token itself being issued through spoofing, compared to a system that relies on ID tokens for authentication. According to the program of (((10))), in a computer on which such a program is installed, unlike a configuration in which an authentication URL and a user code are provided together, it is possible to prevent the occurrence of leakage of the user code. [Explanation of symbols]

[0073] 100...information processing device (image processing device), 110...image forming unit, 120...image reading unit, 130...display device, 140...operation device, 150...communication interface, 160...storage device, 170...control device, 171...login management unit, 172...credential information acquisition unit, 173...credential information provision unit, 174...verification unit, 175...function control unit, 200...authorization server, 300 (300A, 300B)...terminal device

Claims

1. One or more processors; The processor, Accept the user's login, When an access token and an ID token issued by an authorization server in response to a request from an external device are acquired, the access token and the ID token are extracted from the ID token; comparing the user identification information acquired when accepting the login with the user identification information extracted from the ID token, and if they match, permitting access based on the access token; An information processing system comprising:

2. The processor, Obtaining an authentication URL and a user code from the authorization server in response to the login; providing the obtained authentication URL and the user code to the user; Extracting user identification information from the ID token obtained after providing the authentication URL and the user code to the user, and comparing the extracted information with the identification information obtained at the time of login.

2. The information processing system according to claim 1 .

3. The processor, As a method for providing the acquired authentication URL and user code, an image including information on the authentication URL and the user code is displayed on a display device.

3. The information processing system according to claim 2 .

4. The processor, If the user identification information acquired when accepting the login does not match the user identification information extracted from the ID token, notify an administrator that it is determined that information used to request the access token and the ID token from the authorization server has been leaked.

2. The information processing system according to claim 1 .

5. The processor, notifying the administrator of the user's identification information extracted from the ID token; 5. The information processing system according to claim 4.

6. One or more processors; The processor, Accepting a login by a user using identification information shared by multiple users; acquiring, from an authorization server in response to the login, an authentication URL and a user code for causing the authorization server to issue an access token and an ID token; Providing the obtained authentication URL to the user, and transmitting information of the user code to the user via a route different from the authentication URL. An information processing system comprising:

7. The processor, As a method for providing the acquired authentication URL, an image including information of the authentication URL is displayed on a display device.

7. The information processing system according to claim 6.

8. The processor, sending said user code to said user by email; 7. The information processing system according to claim 6.

9. A program for controlling a computer that can be connected to multiple networks, The computer includes: A function to accept user logins, a function of extracting user identification information from an ID token when the access token and the ID token are issued by an authorization server in response to a request from an external device; a function of comparing the user identification information acquired when accepting the login with the user identification information extracted from the ID token, and permitting access based on the access token if they match; A program for realizing the above.

10. A program for controlling a computer that can be connected to multiple networks, The computer includes: A function for accepting login by a user using identification information shared by multiple users; a function of acquiring, from an authorization server in response to the login, an authentication URL and a user code for causing the authorization server to issue an access token and an ID token; a function of providing the obtained authentication URL to the user and transmitting information of the user code to the user via a route different from the authentication URL; A program for realizing the above.

Images