Information processing system and program

Abstract

To save the trouble associated with the acquisition of an access token by an external device as compared with a case in which the access token is acquired through authentication settings made between the external device and an authentication server.SOLUTION: An information processing system comprises one or more processors, which link and manage a token used for access a service and identification information for identifying the service, receive a request for a token including specification of the service by the identification information from an external device, and return a response including the token of the specified service to the external device when possessing the token of the effective specified service.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an information processing system and a program. [Background technology]

[0002] For example, from the standpoint of realizing single sign-on (SSO) and improving security, the introduction of so-called advanced authentication, such as authentication using OAuth authorization (hereinafter sometimes referred to as "OAuth authentication"), is being promoted. Patent document 1 describes an image forming apparatus that includes a selection means for selecting an access token to be used from among access tokens managed by an access token management means based on a user authenticated by a first user authentication means, and a second user authentication means for performing user authentication on an external server using the selected access token, and that a transmission means for sending an image file to a destination is executed by utilizing the functions of the external server after user authentication is performed by the second user authentication means. Patent document 2 describes a portable information terminal device that has an acquisition means for causing an information device shared by multiple users to acquire an access token and an acquisition means for acquiring the acquired access token, and a request means for sending the access token to the information device when requesting the execution of a service process, thereby causing the information device to execute data communication with a service utilization system in response to the request for the execution of the service process. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6873642 [Patent Document 2] Patent No. 5831480 Summary of the Invention [Problem to be solved by the invention]

[0004] In advanced authentication such as OAuth authentication, an external device presents an access token acquired based on an authentication setting for an authorization server to a service side. If the presented access token is valid, the external device is allowed to access the service. Incidentally, there is a mode in which an external device directly obtains an access token from an authorization server based on authentication settings made between the external device and the authorization server. In such a mode, authentication settings with the authorization server need to be made for each external device that uses the service. For this reason, for example, when a user wants to use a service with multiple external devices, it is necessary to perform authentication settings on each external device to obtain an access token, which is time-consuming. The present invention reduces the effort required for obtaining an access token in an external device, compared to a case where an access token is obtained through authentication settings made between an external device and an authorization server. [Means for solving the problem]

[0005] The invention described in claim 1 is an information processing system comprising one or more processors, which manage a token used to access a service in association with identification information for identifying the service, accept a request for a token from an external device including a service specified by the identification information, and, if a valid token for the specified service is held, return a response including the token for the specified service to the external device. The invention described in claim 2 is the information processing system described in claim 1, characterized in that the one or more processors obtain the token linked to the identification information in advance based on authentication settings between the system and an authorization server, and manage the authentication setting information by linking it to the identification information. The invention described in claim 3 is the information processing system described in claim 2, characterized in that the one or more processors accept the request from the external device and, when they do not possess a valid token for the specified service and information on authentication settings for the token, notify the external device that the token for the specified service cannot be provided. The invention described in claim 4 is an information processing system described in any one of claims 1 to 3, characterized in that the one or more processors manage, as the tokens linked to the identification information, an access token to be presented to a service server providing a service when accessing the service, and an update token that can be presented to an authorization server to obtain the access token, and when the processor holds a valid access token for the specified service, returns the response including the access token for the specified service to the external device. The invention described in claim 5 is the information processing system described in claim 4, characterized in that, when the one or more processors do not possess a valid access token for the specified service, they obtain an access token for the specified service using an update token, and return the response including the obtained access token for the specified service to the external device. The invention described in claim 6 is an information processing system described in any one of claims 1 to 3, characterized in that the one or more processors manage an update token that can be used to obtain an access token to be presented to a service server providing a service when accessing the service by presenting the update token to an authorization server as the token linked to the identification information, and when the processor holds a valid update token for the specified service, return the response including the update token for the specified service to the external device. The invention described in claim 7 is the information processing system described in claim 6, characterized in that the one or more processors manage the update token and the access token as the tokens linked to the identification information, and when a valid update token for the specified service is held, the response including both the update token and the access token for the specified service is returned to the external device. The invention described in claim 8 is the information processing system described in claim 1, characterized in that the one or more processors manage service information used by a service server providing a service in association with the identification information, and a response to the external device including a token for the specified service includes the service information for the specified service. The invention described in claim 9 is a program that enables a computer to implement the following functions: (1) linking and managing a token used to access a service with identification information for identifying the service; and (2) receiving a request for a token from an external device that includes a service specified by the identification information, and, if the computer holds a valid token for the specified service, returning a response to the external device that includes the token for the specified service. Effect of the Invention

[0006] According to the invention recited in claims 1 and 9, the effort required for obtaining an access token in an external device is reduced compared to when an access token is obtained through authentication settings made between an external device and an authorization server. According to the invention described in claim 2, authentication setting information is stored, reducing the effort required to obtain a token again. According to the invention as recited in claim 3, it becomes possible for the external device to execute various processes in response to the fact that the requested token cannot be acquired. According to the invention as recited in claim 4, there is more flexibility in how to handle the case where a valid access token is not held, compared to the case where only access tokens are managed. According to the invention recited in claim 5, even if a valid access token is not held, it is possible to obtain a new valid access token using an update token and provide the new access token to an external device. According to the invention recited in claim 6, it becomes possible to obtain an access token by using an update token in an external device. According to the invention recited in claim 7, in the external device, it becomes possible to quickly use the service by using the provided access token, and to obtain the access token by using the update token. According to the invention as recited in claim 8, the time and effort required is reduced compared to the case where service information is registered for each external device to be used. [Brief description of the drawings]

[0007] [Figure 1] FIG. 1 illustrates an example of a configuration of a service utilization system. [Diagram 2] 2 is a block diagram showing an example of a hardware configuration of a user terminal; FIG. [Diagram 3] FIG. 2 illustrates an example of a hardware configuration of an external device. [Figure 4] 2 is a block diagram showing an example of a functional configuration of a user terminal to which the first embodiment is applied. FIG. [Diagram 5] FIG. 4 illustrates an example of an information management table. [Figure 6] FIG. 2 is a block diagram showing an example of a functional configuration of an external device. [Figure 7] FIG. 11 is a sequence diagram showing an example of an operation of the service using system. [Figure 8] 11 is a flowchart showing an example of an operation related to providing an access token in a user terminal to which the first embodiment is applied. [Figure 9] 13 is a flowchart showing an example of an operation related to providing an update token in a user terminal to which the second embodiment is applied. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] Hereinafter, a first embodiment and a second embodiment of the present invention will be described in detail with reference to the accompanying drawings. In addition, when there is no need to distinguish between the first and second embodiments, such as when describing a configuration common to both embodiments, the two may be referred to as "the present embodiment." First, the first embodiment will be described with reference to FIGS.

[0009] <First embodiment> [Service Usage System 1000] FIG. 1 is a diagram showing an example of the configuration of a service utilization system 1000. As shown in FIG. As shown in the figure, the service utilization system 1000 includes a user terminal 1, an external device 2, an authorization server 3 (3a, 3b, ...), and a service server 4 (4a, 4b, ...). Each device is connected via a network. There is no particular limitation on the network as long as it can be used for data communication between the devices.

[0010] The service utilization system 1000 is a computer system that enables an external device 2 to use a service provided by a service server 4. More specifically, when the external device 2 in the service utilization system 1000 requests the utilization (access) of a service of the service server 4, it presents an access token acquired based on an authentication setting for the authorization server 3 to the service server 4. If the presented access token is valid, the service server 4 provides the service to the external device 2.

[0011] The access token is a token presented to the service server 4 when accessing a service, and is unique information created based on authentication settings by the authorization server 3. The access token is given, for example, as several tens of alphanumeric characters. An expiration date is set for the access token, and even if an expired access token is presented, the service server 4 will not permit use of the service. The expiration date of the access token is set to, for example, about one hour to several hours.

[0012] Moreover, the refresh token is a token that enables an access token to be obtained by presenting the refresh token to the authorization server 3, and is unique information created based on authentication settings by the authorization server 3. As a specific example, when the user terminal 1 or the external device 2 presents the refresh token to the authorization server 3, the authorization server 3 newly issues a corresponding access token. The refresh token may also be called a refresh token. An expiration date may be set for a refresh token, and even if an expired refresh token is presented, the authorization server 3 will not issue an access token. The expiration date of a refresh token is set to, for example, one month to several months. The expiration date of a refresh token can be updated (extended) upon request. Both access tokens and refresh tokens are examples of tokens used to access a service.

[0013] Here, consider a case where the external device 2 directly obtains an access token from the authorization server 3 based on the authentication settings between the external device 2 and the authorization server 3. In this case, for example, when a user uses multiple external devices 2, authentication settings for the authorization server 3 must be configured in each external device 2, which is troublesome. Also, for example, when obtaining an access token using the same authentication settings from the next time onwards, information on the authentication settings with the authorization server 3 must be stored in each external device 2, which puts pressure on the storage capacity of the external device 2 (for example, the capacity of the secondary storage unit 22 described later with reference to FIG. 3). Therefore, in this embodiment, authentication settings are made between the user terminal 1 and the authorization server 3, and the user terminal 1 obtains an access token and an update token from the authorization server 3 and provides them to the external device 2.

[0014] The user terminal 1 is a device that provides the external device 2 with an access token or an update token for a specified service in response to a request from the external device 2. Although only one user terminal 1 is shown in the example of FIG. 1, there may be multiple user terminals 1. More specifically, when multiple users use the service utilization system 1000, multiple user terminals 1 may be provided for each user. In this embodiment, an example is taken of a case where each user uses only one user terminal 1 that he or she owns. Various computer devices (information processing devices) can be used as the user terminal 1, and specific examples include a smartphone, a tablet terminal, etc. The user terminal 1 may be configured with one computer or multiple computers. The user terminal 1 is an example of an information processing system to which the first embodiment is applied.

[0015] The external device 2 is a device used by a user. The external device 2 uses the services provided by the service server 4 to execute various processes in response to instructions from the user. The term “external device” indicates that the device is external to the configuration of service server 4 (not included in the configuration of service server 4), and indicates that some kind of authentication, such as OAuth authentication, is required when using a service provided by service server 4. In this embodiment, the external device 2 will be described as an image processing device capable of reading (scanning) an image formed on a recording material and forming (printing) an image on the recording material, etc. However, the external device 2 is not limited to this as long as it has a computer as a control unit and uses the services provided by the service server 4, and various devices may be used.

[0016] The authorization server 3 is a server that issues access tokens and refresh tokens. The authorization server 3 according to this embodiment issues an access token and a refresh token in response to a request from another device in the authorization flow, and passes them to the requesting device. The authorization flow refers to a procedure (flow) for acquiring an access token, and includes a process of setting authentication for the authorization server 3. As described above, the authorization server 3 also issues a corresponding access token when a refresh token is presented. Reissuing an access token using this refresh token does not require an authorization flow. In this embodiment, an example is taken of a case where the authorization server 3a issues a token for using a service provided by the service server 4a, and the authorization server 3b issues a token for using a service provided by the service server 4b. Note that the tokens issued by the authorization server 3a may be called token A, access token A, or update token A, and the tokens issued by the authorization server 3b may be called token B, access token B, or update token B to distinguish them from one another.

[0017] The service server 4 is a server that provides a service in response to a request from another device. More specifically, when a request for service is received from another device and a valid access token is presented, the service server 4 provides the service to the requesting device. Here, each service server 4 provides a different service. Different services do not only refer to different types of services, such as a service that transmits files by email and a service that stores files, but also include cases where there are differences in other elements. For example, it includes a case where a certain service server 4 and another service server 4 provide the same type of service, but the providers of the two are different. 1, only two service servers 4a and 4b are shown, but the number of service servers 4 may be three or more. Correspondingly, the number of authorization servers 3 may be three or more.

[0018] In this embodiment, it is assumed that both service servers 4a and 4b can provide a service (sometimes called "mail service") of sending an e-mail containing data received from an external device 2 to a specified destination by SMTP (Simple Mail Transfer Protocol). However, the service providers that provide the services of the service servers 4a and 4b are different, and the services provided by the two servers are different. Hereinafter, the service servers 4a and 4b may be referred to as SMTP servers 4a and 4b. The mail service provided by the SMTP server 4a may be referred to as mail service A, and the mail service provided by the SMTP server 4b may be referred to as mail service B.

[0019] In this embodiment, the external device 2, which is an image processing device, can provide the user with a function (sometimes referred to as a "scan mail function") of sending an e-mail including image data created by scanning to a specified destination by using the mail service A of the SMTP server 4a or the mail service B of the SMTP server 4b.

[0020] [User terminal 1] FIG. 2 is a block diagram showing an example of a hardware configuration of the user terminal 1. As shown in FIG. As shown in the figure, the user terminal 1 includes a control unit 10, a secondary storage unit 12, a communication unit 13, an input unit 14, and a display unit 15. Note that this configuration is an example, and the user terminal 1 may also include a photographing device, an audio output device, etc.

[0021] The control unit 10 executes various processes according to the loaded programs and controls the operation of the device itself. The control unit 10 also includes a CPU (Central Processing Unit) 10a as a calculation means, a RAM (Random Access Memory) 10b used as a working memory for the CPU 10a, and a ROM (Read Only Memory) 10c in which the programs executed by the CPU 10a and pre-prepared setting values ​​are stored. The control unit 10 also includes a non-volatile memory 10d that is rewritable and can hold data even if the power supply is cut off, and an interface unit 10e that controls each unit such as a communication unit 13 connected to the control unit 10. The non-volatile memory 10d is, for example, an SRAM or a flash memory backed up by a battery.

[0022] In the user terminal 1 to which this embodiment is applied, the CPU 10a, which is an example of a processor, reads and executes programs to realize various functions described below. Here, the various programs executed by the CPU 10a are provided in a state of being stored in a computer-readable recording medium such as a magnetic recording medium (magnetic tape, magnetic disk, etc.), an optical recording medium (optical disk, etc.), a magneto-optical recording medium, or a semiconductor memory. The programs executed by the CPU 10a may be downloaded using a communication means such as the Internet. The processor refers to a processor in a broad sense, and includes a general-purpose processor (e.g., a CPU, etc.) and a dedicated processor (e.g., a graphics processing unit (GPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a programmable logic device, etc.). The operation of the processor may not only be performed by one processor, but may be performed by multiple processors located at physically separate locations working together. Furthermore, the order of the operations of the processor is not limited to the order described as an embodiment, and may be changed.

[0023] The secondary storage unit 12 records programs to be executed by the CPU 10a, and also provides a database (described later with reference to FIG. 4) for storing various data used by the user terminal 1, such as authentication setting information between the service server 4 and an access token / update token acquired from the authorization server 3, and stores the stored data. The secondary storage unit 12 is realized by a storage device such as a magnetic disk device or an SSD (Solid State Drive), for example. The communication unit 13 performs data communication with other devices via a network (see FIG. 1). An interface corresponding to the communication method of the network is used as the communication unit 13. When short-distance wireless communication such as BLE (Bluetooth Low Energy) (registered trademark) or NFC (Near Field Communication) is performed between the user terminal 1 and the external device 2, the communication unit 13 may include an interface for wireless communication corresponding to the communication method.

[0024] The input unit 14 is a device such as a hardware button or switch that accepts input operations from a user, a touch sensor that outputs a control signal in response to contact with a finger or the like, a code reader that reads code information such as a barcode or QR code (registered trademark), and a sensor that reads the user's biometric information. Display unit 15 is configured, for example, by a liquid crystal display or an organic EL (Electro-Luminescence) display, and displays a screen including various information such as images and text. Also, a touch sensor as one of input units 14 may be combined with display unit 15 to configure a touch panel. In this case, software buttons that accept input operations from the user are displayed on display unit 15.

[0025] [Hardware configuration of external device 2] FIG. 3 is a diagram illustrating an example of a hardware configuration of the external device 2. As shown in FIG. As shown in the figure, the external device 2 includes a control unit 20, a secondary storage unit 22, a communication unit 23, an input unit 24, and a display unit 25. In addition, since the external device 2 according to this embodiment is an image processing device, it includes an image forming unit 26 and an image reading unit 27 as components related to image processing. In addition, the control unit 20, communication unit 23, input unit 24 and display unit 25 in the external device 2 are similar to the control unit 10, communication unit 13, input unit 14 and display unit 15 of the user terminal 1 described using Figure 2, so their description will be omitted here.

[0026] The secondary storage unit 22 records programs to be executed by the CPU 20a, and also provides a database (described later with reference to FIG. 6) for storing various data used by the external device 2, such as access tokens / update tokens acquired from the user terminal 1, image data used for printing in the image forming unit 26, and image data created from the results of reading in the image reading unit 27, and stores the stored data. Similar to the secondary storage unit 12 of the user terminal 1, the secondary storage unit 22 is realized by various storage devices.

[0027] The image forming unit 26 is constituted by a printer engine such as a laser printer or an inkjet printer, and in response to instructions from the control unit 20, forms and prints an image corresponding to the image data on a recording material such as paper. The image reading unit 27 is configured with an image scanner or the like, and reads an image formed on a recording material (original) such as paper in response to instructions from the control unit 20, and passes the read result to the control unit 20 as image data.

[0028] [Hardware configuration of Authorization Server 3 and Service Server 4] The authorization server 3 and the service server 4 have, for example, the same hardware configuration as the user terminal 1 shown in FIG. In addition, the service server 4 includes various components necessary for providing the service.

[0029] [Functional configuration of user terminal 1] FIG. 4 is a block diagram showing an example of a functional configuration of the user terminal 1 to which the first embodiment is applied. As shown in the figure, a user terminal 1 to which the first embodiment is applied includes an operation receiving unit 101, an authentication management unit 102, a connection management unit 103, a request receiving unit 104, a token management unit 105, a response creation unit 106, a notification creation unit 107, and a communication control unit 108. In addition, the user terminal 1 has, as databases (sometimes referred to as "DB") on the secondary memory unit 12, an authentication setting DB121 in which authentication setting information is stored, and a token DB122 in which access tokens / update tokens are stored.

[0030] The operation reception unit 101 receives various operations input by the user via the input unit 14 (see FIG. 2). The operation reception unit 201 receives, for example, an operation of inputting authentication setting information and service information, which is performed via the input unit 14. Furthermore, for example, when the user terminal 1 is used as a remote UI (user interface) (described later with reference to FIG. 7), the operation reception unit 101 receives an operation of selecting a function to be used in the external device 2, and the like.

[0031] The authentication management unit 102 manages the authentication settings between its own system and the authorization server 3. The authentication management unit 102 links the authentication settings made by specifying a service provided by the service server 4 to the identification information of that service. More specifically, the authentication setting information made by specifying the mail service A provided by the SMTP server 4a is linked to the identification information of the mail service A, and is stored and managed in the authentication setting DB 121 on the secondary storage unit 12. Also, the authentication setting information made by specifying the mail service B provided by the SMTP server 4b is linked to the identification information of the mail service B, and is stored and managed in the authentication setting DB 121. In addition, when the request receiving unit 104 receives a request from the external device 2, the authentication management unit 102 extracts authentication setting information linked to the identification information of the specified service from the authentication setting DB 121 and makes it available for processing in its own system.

[0032] Here, the identification information is not limited as long as it is information that can identify the corresponding service in the user terminal 1 and the external device 2. For example, it may be an ID for each service registered in advance in the user terminal 1 and the external device 2 for the purpose of identifying the service. In addition, it may be, for example, the name of each service registered in advance in the user terminal 1 and the external device 2, the address of the service server 4 that provides the service, account information of the service, an email address for an email service, etc. In addition, when the authorization server 3 and the service server 4 correspond to each other on a one-to-one basis as in this embodiment, that is, when only one authorization server 3 that issues a token is defined for each service server 4, information related to the corresponding authorization server 3 may be used as the identification information. More specifically, it may be a name or address defined for the corresponding authorization server 3, or an ID or password used for authentication setting. In this embodiment, a case will be described in which the name of each service is used as the identification information.

[0033] The authentication setting information includes various information required for executing authentication settings and authorization flows between the user terminal 1 and the authorization server 3, such as the path of the authorization endpoint in the authorization server 3, the path of the token endpoint in the service server 4, the ID and password requested by the authorization server 3 when setting up the authentication, the scope and redirection URI (Uniform Resource Identifier), and the authorization code from the authorization server 3.

[0034] The connection management unit 103 manages the connection state between the user terminal 1 and the external device 2. This connection state refers to a state in which the user terminal 1 returns a response to a connection request issued by the external device 2, and the external device 2 and the user terminal 1 identify each other as devices to which the connection is to be made. In other words, it refers to a state in which the user terminal 1 identifies the external device 2 as a device that has requested a token, and the external device 2 identifies the user terminal 1 as a device to which the token is to be requested. The connection management unit 103 identifies the external device 2 as a device in a connected state by accepting a connection request from the external device 2 and returning a response. The connection request and response are made, for example, by exchanging packets via a short-distance wireless communication means provided in the communication unit 13 (see FIG. 2), or by reading code information displayed on the display unit 25 (see FIG. 3) of the external device 2 by the user terminal 1. Also, for example, the connection is made via a network (see FIG. 1) that connects between devices in the service utilization system 1000.

[0035] The request receiving unit 104 receives a request for a token from the external device 2. More specifically, the request receiving unit 104 of this embodiment receives a request for a token from the external device 2 in a connected state, and controls processing such as creating a response (to be described later) in response to the received request. The token request includes a designation of a service to be used. This designation of the service is performed using the same identification information as that used by the authentication management unit 102 and the token management unit 105. Additionally, the request receiving unit 104 stores and manages the history of token requests received from the external device 2 in a database on the secondary storage unit 12.

[0036] The token management unit 105 manages the token acquired from the authorization server 3 by linking it to the identification information of the corresponding service. As described above, since the authorization server 3 according to this embodiment issues both an access token and a refresh token, the token management unit 105 manages the acquired access token and refresh token by linking them to the identification information of the corresponding service. Furthermore, the token management unit 105 of this embodiment manages service information that is provided by the external device 2 to the service server 4 when using a service and that is used by the service server 4, by linking it to the identification information of the corresponding service, in the same manner as the token. Service information includes information required to use mail services A and B, such as email addresses, port numbers, and encryption methods.

[0037] Here, the token management unit 105 according to the present embodiment compiles and manages information such as identification information, access tokens, update tokens, and service information linked to each service in an information management table in the token DB 122. FIG. 5 is a diagram showing an example of the information management table 500. As shown in FIG. In the illustrated information management table 500, the first row stores information on mail service A, and the second row stores information on mail service B. As described above, in this embodiment, the name of the service is used as identification information, so that, for example, service information such as an access token (abc123...), an update token (xyz456...), and a mail account (user1@hogehoge.com) is managed in association with the name of "mail service B". In addition, in the example of FIG. 5, authentication settings and service information related to mail service A have not been registered, and the access token, update token, and mail account fields are marked "not obtained". When authentication settings and service information related to mail service A are registered, each piece of information is associated with the name of "mail service A" and managed by adding information to these fields.

[0038] In addition, when the request receiving unit 104 receives a token request from the external device 2, the token management unit 105 extracts the token and service information linked to the identification information of the specified service from the token DB 122, and makes them available for other processes. In addition, the token management unit 105 of this embodiment utilizes authentication settings between its own system and the authorization server 3 to request an access token or a refresh token from the authorization server 3. Also, the token management unit 105 uses the refresh token to request an access token from the authorization server 3. When the authorization server 3 issues a token in response to these requests, the token to be managed by the token management unit 105 is acquired. Furthermore, the token management unit 105 may update or delete expired access tokens and refresh tokens among the tokens to be managed.

[0039] The response creation unit 106 creates a response including a token for a specified service as a response to a token request from the external device 2. More specifically, the response is created with the request source external device 2 as the destination, including the token and service information extracted by the token management unit 105 in response to the token request.

[0040] The notification creating unit 107 creates various notifications to be sent to other devices. For example, if the user terminal 1 fails to acquire a token from the authorization server 3 for some reason or if the acquired token cannot be sent to the external device 2, the notification creating unit 107 creates an error notification indicating the fact, addressed to the external device 2 or the administrator's terminal. Also, for example, if some operation / task is required by the user or administrator of the external device 2 of the user terminal 1, the notification creating unit 1 creates a notification requesting the operation / task.

[0041] The communication control unit 108 controls data communication by the communication unit 13 (see FIG. 2). For example, the communication control unit 108 controls so that a response including a token of a specified service created by the response creation unit 106 is transmitted to the requesting external device 2. In addition, for example, the communication control unit 108 controls so that various notifications created by the notification creation unit 107 and requests for various data used for processing in its own system are transmitted to other devices such as the external device 2. In addition, the communication control unit 108 extracts necessary information from data received from other devices and makes it available to each functional unit. As a specific example, the communication control unit 108 extracts information related to a token request from data received from the external device 2 and makes it available to the request receiving unit 104.

[0042] [Functional configuration of external device 2] FIG. 6 is a block diagram showing an example of a functional configuration of the external device 2. As shown in FIG. As shown in the figure, the external device 2 includes an operation receiving unit 201, a connection management unit 202, a token requesting unit 203, a service requesting unit 204, a display control unit 205, and a communication control unit 206. Furthermore, the external device 2 includes, as databases on the secondary storage unit 22, an identification information DB 221 in which identification information of a service is stored, and an acquired information DB 222 in which acquired access tokens / update tokens and service information are stored.

[0043] The operation reception unit 201 receives various operations input by the user via the input unit 24 (see FIG. 3). For example, the operation reception unit 201 receives an operation to select various functions provided to the user by the external device 2, such as a scan mail function, and to request the use of the functions. In addition, for example, the operation reception unit 201 receives operations to input and register various information by the user, the administrator, etc.

[0044] The connection management unit 202 manages the connection state between the external device 2 and the user terminal 1. The connection management unit 202 identifies the user terminal 1 as a device in a connected state by receiving a connection request to the user terminal 1 and a response thereto. In addition, the connection management unit 202 releases the connection with the user terminal 1 at a predetermined timing, such as when the use of a service using a token provided by the user terminal 1 is completed. Also, for example, when no response is received from the user terminal 1 for a preset time (timeout), the connection management unit 202 releases the connection with the user terminal 1.

[0045] The token request unit 203 creates a token request including identification information of the specified service as a request to the connected user terminal 1. More specifically, for example, when the operation reception unit 201 receives a function selection by the user, the token request unit 203 creates a token request including identification information of a service required to execute the function. In addition, the token request may include a request for service information corresponding to the specified service. In addition, when the token request unit 203 in this embodiment holds a refresh token, the token request unit 203 can also use the refresh token to request the authorization server 3 to issue an access token.

[0046] The service request unit 204 creates a service utilization request for the service server 4. The service utilization request includes data used in the service of the service server 4, such as image data created by scanning in the external device 2 and used in the mail service. In addition, the service utilization request includes, for example, service information accepted from the user terminal 1, information for identifying the external device 2 (own device) that has made the request, and information for specifying the service server 4 that is the destination of the request. Furthermore, the service request unit 204 associates the created service usage request with the corresponding access token.

[0047] The display control unit 205 controls the types and contents of images, various icons, text, etc. displayed on the display unit 25, as well as the display mode such as the position and size of the displayed images, etc. The display control unit 205, for example, performs control to display a screen that allows the user to select a function available in the external device 2. Also, for example, the display control unit 205 performs control to display a notification screen that presents the content of the notification received from the user terminal 1 to the user.

[0048] The communication control unit 206 controls data communication by the communication unit 23 (see FIG. 3). For example, the communication control unit 206 controls so as to transmit a request for a token created by the token request unit 203 to the connected user terminal 1. Also, for example, the communication control unit 206 transmits to the service server 4 a service utilization request created by the service request unit 204 and an access token linked to the utilization request.

[0049] [Use of the Service] Next, the flow of using a service in the service use system 1000 will be outlined with reference to FIGS. FIG. 7 is a sequence diagram showing an example of the operation of the service use system 1000. As shown in FIG.

[0050] As shown in FIG. 7, the user terminal 1 accepts an operation by a user or the like to request authentication setting (S701). Then, the user terminal 1 transmits an authorization request to the authorization server 3 (S702). More specifically, for example, when performing authentication setting to obtain a token A for a mail service A, the user terminal 1 transmits an authorization request to the authorization server 3a. Also, for example, when performing authentication setting to obtain a token B for a mail service B, the user terminal 1 transmits an authorization request to the authorization server 3b. At this time, information required for authentication setting, such as an ID and a password for each service, is input and transmitted to the authorization server 3. The authorization server 3 authorizes the user terminal 1 in response to the authorization request, and transmits the token and authentication setting information to the user terminal 1 (S703). Also, the user terminal 1 stores the acquired token and authentication setting information in association with the identification information of the corresponding service (S704). Next, the service information is registered in the user terminal 1 (S705). The user terminal 1 also stores the registered service information (S706).

[0051] The steps S701 to S704 are steps related to authentication setting between the user terminal 1 and the authorization server 3. In this embodiment, once authentication setting between the user terminal 1 and the authorization server 3 is performed, the authentication setting information is stored in the user terminal 1. Thereafter, the stored authentication setting information is used, so there is no need to perform authentication setting again. Moreover, steps S705 and S706 are steps relating to the registration of service information in the user terminal 1. Since the registered service information is stored in the user terminal 1, there is no need to register it again. 7, the steps S701 to S706 enclosed by the dashed line are not necessarily performed every time a service is used in the service use system 1000, but may be performed once, for example, when the service is used for the first time. After that, the service can be used by following the steps S707 to S713.

[0052] 7, the external device 2 accepts a function selection by the user (S707). In this example, an operation requesting the use of the scan mail function is accepted. The external device 2 scans the document set by the user and creates image data to be used in the scan mail function (S708). The external device 2 requests a token from the user terminal 1 by specifying the service corresponding to the selected function (S709).

[0053] Here, the service utilization system 1000 according to the present embodiment includes an SMTP server 4a providing a mail service A and an SMTP server 4b providing a mail service B as services of the same type. The external device 2 uses either the mail service A or the mail service B when executing the scan mail function. In this case, for example, the external device 2 may accept a user's selection of which mail service to use, and may request a token with the selected mail service as the designated service. Also, for example, in the external device 2, an administrator or the like may set in advance the priority of each mail service and the mail service whose use is restricted, and may request a token with the mail service with a high priority or the mail service whose use is not restricted as the designated service. In an aspect in which the priority is set, if a token for the designated service cannot be acquired for some reason, the service with the next highest priority may be specified and a token may be requested.

[0054] Returning to Fig. 7, the user terminal 1 returns a response including the token for the specified service and service information to the external device 2 that originated the request (S710). More specifically, if mail service A is specified, a response including token A is returned, and if mail service B is specified, a response including token B is returned. This allows the token to be provided from the user terminal 1 to the external device 2. Note that, although details will be described later, depending on whether or not a valid token is available, the user terminal 1 may reacquire a token for the specified service from the corresponding authorization server 3 before creating a response.

[0055] The external device 2 uses the token provided by the user terminal 1 to make a request to the corresponding service server 4 to use the specified service (S711). More specifically, in the first embodiment, an access token is provided by the user terminal 1, and a service use request is made to the service server 4 using the provided access token and service information. Also, as will be described later as a second embodiment, when only an update token is provided, an access token is obtained using the provided update token, and then a service use request is made to the service server 4 using the obtained access token and service information. In this embodiment, the use request includes image data used in the mail service. The service server 4 verifies the access token included in the usage request from the external device 2 (S712). If the access token is valid, the service server 4 executes the service using the service information and image data included in the usage request (S713). In this example, the image data included in the usage request is sent by email to a specified destination.

[0056] [User terminal 1 operation] As described above, the user terminal 1 to which the first embodiment is applied provides an access token for a specified service in response to a token request from the external device 2. Hereinafter, the operation of the user terminal 1 to which the first embodiment is applied, related to providing an access token, will be described in more detail. Note that the operation described below corresponds to the operation of the user terminal 1 in step S710 in FIG. FIG. 8 is a flowchart showing an example of an operation related to providing an access token in the user terminal 1 to which the first embodiment is applied.

[0057] First, the user terminal 1 receives a token request from the external device 2 (S801). Next, based on the service identification information included in the token request and the information managed in the authentication setting DB 121, it is determined whether or not the authentication setting information of the specified service is held (S802). Then, if the authentication setting of the specified service is held (YES in S802), it is determined whether or not a valid access token for the specified service is held (S803) based on the service identification information and the information managed in the token DB 122. If the valid access token is held (YES in S803), a response including the access token and the service information is created (S804). If the valid access token is not held (NO in S803), the access token is requested from the corresponding authorization server 3 using the update token and is acquired (S805). Then, a response including the acquired access token and the service information is created (S804). Finally, the user terminal 1 returns the response created in S804 to the external device 2 that is the request source (S806). On the other hand, if the authentication setting for the specified service is not held (NO in S802), the external device 2 is notified that the token cannot be provided (S807). Through the operations in S801 to S807, the process relating to providing an access token in the user terminal 1 is completed.

[0058] As described above, the user terminal 1 to which the first embodiment is applied manages access tokens and update tokens as tokens linked to identification information, accepts a token request from an external device 2, and if it holds a valid access token for a specified service, returns a response including the access token for the specified service to the external device 2. In addition, if the user terminal 1 does not possess a valid access token for the specified service, it obtains an access token for the specified service from the authorization server 3 using the update token, and returns a response including the obtained access token to the external device 2.

[0059] Since the user terminal 1 to which the first embodiment is applied manages access tokens and refresh tokens, it may include both the access token and refresh token of the specified service in the response and return it to the external device 2. In this case, the external device 2 can obtain an access token from the authorization server 3 using the refresh token, and even if the access token provided by the user terminal 1 has expired, the external device 2 can obtain a new access token in its own device and use the service. In other words, the next time the service is used, the access token can be obtained without connecting to the user terminal 1.

[0060] <Second embodiment> In the above-described first embodiment, the user terminal 1 returns a response including an access token for a specified service in response to a token request from the external device 2. In contrast, in the second embodiment, the user terminal returns a response including an update token for a specified service in response to a token request from the external device 2. Then, the external device 2 acquires an access token from the authorization server 3 using the update token provided by the user terminal, and uses the acquired access token to use the service. The second embodiment will be described in detail below with reference to Figs. 1 to 7 and 9. Note that, between the first and second embodiments, some of the operations of the user terminal 1 and some of the operations of the external device 2 are different, but the configurations of the devices (see Figs. 1 to 6) and the general flow of using the services (see Fig. 7) are the same. Therefore, in the second embodiment, the same parts as those in the first embodiment are indicated by the same reference numerals, and the description will be omitted. Note that the user terminal is distinguished as a user terminal 1' to which the second embodiment is applied from the user terminal 1 to which the first embodiment is applied. That is, in the second embodiment, the user terminal 1 in Figs. 1 to 7 is replaced with the user terminal 1'.

[0061] [Example of operation of user terminal 1'] The operation of the user terminal 1' to which the second embodiment is applied, which is related to providing an update token, will be described in detail below. Note that the operation described below corresponds to the operation of the user terminal 1' in step S710 of FIG. FIG. 9 is a flowchart showing an example of an operation related to providing an update token in a user terminal 1' to which the second embodiment is applied.

[0062] First, the user terminal 1′ receives a token request from the external device 2 (S901). Next, based on the service identification information included in the token request and the information managed in the authentication setting DB 121, it is determined whether or not the authentication setting information of the specified service is held (S902). Then, if the authentication setting of the specified service is held (YES in S902), it is determined whether or not a valid update token for the specified service is held (S903) based on the service identification information and the information managed in the token DB 122. If the valid update token is held (YES in S903), a response including the update token and the service information is created (S904). If the valid update token is not held (NO in S903), the authentication setting information is used to request and acquire an update token from the corresponding authorization server 3, and the request is acquired (S905). Then, a response including the acquired update token and the service information is created (S904). Finally, the user terminal 1′ returns the response created in S904 to the external device 2 that is the request source (S906). On the other hand, if the authentication setting for the specified service is not held (NO in S902), the external device 2 is notified that the token cannot be provided (S907). Through the operations of S901 to S907, the process of providing an update token in the user terminal 1' is completed.

[0063] As described above, a user terminal 1' to which the second embodiment is applied manages at least an update token as a token linked to identification information, accepts a token request from an external device 2, and when it holds a valid update token for a specified service, returns a response including the update token for the specified service to the external device 2. In addition, since the user terminal 1' to which the second embodiment is applied manages refresh tokens and access tokens as tokens linked to identification information, when a valid refresh token for a specified service is held, the user terminal 1' may return a response including both the refresh token and the access token for the specified service to the external device 2. Note that, at this time, when a valid access token is not held, the user terminal 1' may obtain an access token using the refresh token and then return a response to the external device 2. However, by configuring the user terminal 1' to provide only the refresh token, the amount of communication between the user terminal 1' and the external device 2 can be reduced.

[0064] The user terminal 1, 1' to which the first and second embodiments described above are applied can be understood as an example of an information processing system that manages access tokens / update tokens in association with identification information of the corresponding services, accepts a token request including a service specified by the identification information from an external device 2, and, if it holds a valid token as a token for the specified service, returns a response including the token for the specified service to the external device 2.

[0065] <Other variations, etc.> Although the embodiments of the present invention have been described above, the technical scope of the present invention is not limited to the scope described as the first and second embodiments. Various modifications or improvements that do not depart from the technical concept of the present invention are also included in the present invention. For example, in the first and second embodiments, the service servers 4a and 4b each provide an e-mail service, but the type of service is not limited, and different types of services may be provided. Also, the external device 2 is an image processing device, and an example has been described in which image data created by scanning in the external device 2 is used in the service, but the type of the external device 2 and the type of data used in the service are not limited, and various types of data held by the external device 2 may be used.

[0066] In the first and second embodiments, the service information is managed by the user terminal 1, 1' and provided to the external device 2 together with the token, but such a configuration is not essential. Necessary service information may be stored in the external device 2. However, by providing the service information from the user terminal 1, 1' to the external device 2, the effort of registering the service information in the external device 2 is reduced.

[0067] Furthermore, in the first and second embodiments, when the authentication setting information of the specified service is not held, the external device 2 is notified that the token cannot be provided (see S807 in FIG. 8 and S907 in FIG. 9). At this time, the external device 2 may be notified that the authentication setting information of the specified service is not held. In response to these notifications, the external device 2 displays, for example, on the display unit 25 (see FIG. 3) various information for allowing the user to understand that the token cannot be acquired / the authentication setting information is not held. Also, for example, as an alternative means for acquiring a token, the token may be acquired from the authorization server 3 by using the authentication setting between the external device 2 (own device) and the authorization server 3, which has been performed in advance by an administrator or the like. In this way, the user terminal 1, 1′ notifies the external device 2 that the token cannot be provided or that the authentication setting information of the specified service is not held, so that various corresponding processes can be executed in the external device 2.

[0068] Furthermore, in the first and second embodiments, an example has been described in which one service is specified in a request for a token from the external device 2 to the user terminal 1, 1'. The number of services specified is not limited, and multiple services may be specified. For example, when multiple services of the same type exist, such as mail services A and B in this embodiment, and the external device 2 may use any of the services, a request may be made to specify all of the multiple services as the specified services. In this case, the user terminal 1, 1' may provide tokens for all services if possible, or may provide only tokens held by its own system. Also, the user terminal 1, 1' may accept the user's selection of which service to provide tokens for, and provide only tokens for the selected service.

[0069] In the first and second embodiments, an example has been described in which the user terminal 1, 1' determines whether to provide an access token or a refresh token to the external device 2. The user terminal 1, 1' or the external device 2 may accept the user's selection of whether to provide an access token or a refresh token, and provide the selected token. Also, it may be possible to select whether to provide both an access token and a refresh token. This allows the user to make a selection after considering various conditions, such as the token holding status of the user terminal 1, 1', the storage capacity of the external device 2, and the risk of token leakage.

[0070] <Additional Notes> (((1))) one or more processors; The one or more processors: Manage the token used to access the service in association with identification information for identifying the service; A request for a token including a service designated by identification information is received from an external device, and if a valid token for the designated service is held, a response including the token for the designated service is returned to the external device. An information processing system comprising: (((2))) The one or more processors: The token associated with the identification information is acquired in advance based on authentication settings between the system itself and an authorization server, and information on the authentication settings is managed in association with the identification information. 2. An information processing system according to claim 1, wherein: (((3))) The one or more processors: When the request is received from the external device and a valid token for the specified service and authentication setting information for the token are not held, the external device is notified that the token for the specified service cannot be provided. 2. An information processing system according to claim 1 , (((4))) The one or more processors: managing, as the token associated with the identification information, an access token to be presented to a service server providing a service when accessing the service, and an update token to be presented to an authorization server to obtain the access token; If a valid access token for the specified service is held, the response including the access token for the specified service is returned to the external device. 2. An information processing system according to claim 1, wherein the information processing system comprises: (((5))) The one or more processors: If the external device does not possess a valid access token for the specified service, the external device acquires an access token for the specified service using an update token, and returns the response including the acquired access token for the specified service to the external device. 4. An information processing system according to claim 3, wherein: (((6))) The one or more processors: managing an update token that can be presented to an authorization server as the token associated with the identification information to obtain an access token to be presented to a service server that provides a service when accessing the service; If a valid update token for the specified service is held, the response including the update token for the specified service is returned to the external device. 2. An information processing system according to claim 1, wherein the information processing system comprises: (((7))) The one or more processors: Manage the refresh token and the access token as the tokens associated with the identification information; If the external device has a valid refresh token for the specified service, the external device returns the response including both the refresh token and the access token for the specified service. 4. An information processing system according to claim 3, wherein: (((8))) The one or more processors: managing service information used by a service server that provides a service in association with the identification information; The response including the token of the specified service to the external device includes service information of the specified service. 2. An information processing system according to claim 1, wherein the information processing system comprises: (((9))) On the computer, A function of managing a token used to access a service in association with identification information for identifying the service; A function of receiving a request for a token including a service designation based on identification information from an external device, and returning a response including the token for the designated service to the external device when a valid token for the designated service is held; A program to achieve this.

[0071] According to the information processing system of (((1))), the effort required for obtaining an access token on an external device is reduced compared to when an access token is obtained through authentication settings made between an external device and an authorization server. According to the information processing system of (((2))), authentication setting information is stored, reducing the effort required to obtain a token again. According to the information processing system of (((3))), various processes can be executed in the external device in response to the fact that the requested token cannot be acquired. According to the information processing system of (((4))), the degree of freedom in dealing with the case where a valid access token is not held is increased compared to the case where only access tokens are managed. According to the information processing system of (((5))), even if a valid access token is not held, it is possible to obtain a new valid access token using an update token and provide the new valid access token to an external device. According to the information processing system of (((6))), it becomes possible for an external device to obtain an access token using an update token. According to the information processing system of (((7))), in the external device, it becomes possible to quickly use the service using the provided access token, and to obtain the access token using the update token. According to the information processing system of (((8))), the time and effort required is reduced compared to the case where service information is registered for each external device to be used. According to the program relating to (((9))), the effort required for obtaining an access token on an external device is reduced compared to when the access token is obtained through authentication settings made between the external device and an authorization server. [Explanation of symbols]

[0072] 1, 1'...user terminal, 2...external device, 3, 3a, 3b...authorization server, 4, 4a, 4b...service server (SMTP server), 10a...CPU, 1000...service utilization system

Claims

1. One or more processors; The one or more processors: Manage the token used to access the service in association with identification information for identifying the service; A request for a token including a service designated by identification information is received from an external device, and if a valid token for the designated service is held, a response including the token for the designated service is returned to the external device. An information processing system comprising:

2. The one or more processors: The token associated with the identification information is acquired in advance based on authentication settings between the system itself and an authorization server, and information on the authentication settings is managed in association with the identification information.

2. The information processing system according to claim 1 .

3. The one or more processors: When the request is received from the external device and a valid token for the specified service and authentication setting information for the token are not held, the external device is notified that the token for the specified service cannot be provided.

3. The information processing system according to claim 2.

4. The one or more processors: managing, as the token associated with the identification information, an access token to be presented to a service server providing a service when accessing the service, and an update token to be presented to an authorization server to obtain the access token; If a valid access token for the specified service is held, the response including the access token for the specified service is returned to the external device.

4. The information processing system according to claim 1, wherein the information processing system comprises:

5. The one or more processors: If the external device does not possess a valid access token for the specified service, the external device acquires an access token for the specified service using an update token, and returns the response including the acquired access token for the specified service to the external device.

5. The information processing system according to claim 4.

6. The one or more processors: managing an update token that can be presented to an authorization server as the token associated with the identification information to obtain an access token to be presented to a service server that provides a service when accessing the service; If a valid update token for the specified service is held, the response including the update token for the specified service is returned to the external device.

4. The information processing system according to claim 1, wherein the information processing system comprises:

7. The one or more processors: Manage the refresh token and the access token as the tokens associated with the identification information; If the external device has a valid refresh token for the specified service, the external device returns the response including both the refresh token and the access token for the specified service.

7. The information processing system according to claim 6.

8. The one or more processors: managing service information used by a service server that provides a service in association with the identification information; The response including the token of the specified service to the external device includes service information of the specified service.

2. The information processing system according to claim 1 .

9. On the computer, A function of managing a token used to access a service in association with identification information for identifying the service; A function of receiving a request for a token including a service designation based on identification information from an external device, and returning a response including the token for the designated service to the external device when a valid token for the designated service is held; A program to achieve this.

Images