Information processing system and program

Abstract

To provide an information processing system for acquiring an access token from an authorization server according to a request from an external device and providing the same to the external device, which attains both of suppressing the effective period of an access tone at a specified service and suppressing the shortage of an effective period at the other service.SOLUTION: An information processing system comprises one or plural processors, acquires an access token which enables an access to a specified service from an authorization server according to a request from an external device and provides the same to the external device. The one or plural processors acquire a first access token set with a first effective period from the authorization server and provide the same to the external device when they receive a request to specify a first service, and acquire a second access token set with a second period shorter than the first effective period from the authorization server and provide the same to the external device when they receive a request to specify a second service.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an information processing system and a program. [Background technology]

[0002] For example, from the standpoint of realizing single sign-on (SSO) and improving security, the introduction of so-called advanced authentication, such as authentication using OAuth authorization (hereinafter sometimes referred to as "OAuth authentication"), is being promoted. Patent document 1 describes how an application that uses an authorization token to access a service stores service information, compares it against the service information included in a request to the application, and accesses the service using the authorization token only if the service is correct, thereby preventing the leakage of authorization tokens. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2014-142732 A Summary of the Invention [Problem to be solved by the invention]

[0004] In advanced authentication such as OAuth authentication, an external device presents an access token acquired based on an authentication setting for an authorization server to a service side. If the presented access token is within its expiration date, the external device is allowed to access the service. Incidentally, there is a mode in which an information processing system such as a cloud holds authentication settings, acquires an access token from an authorization server in response to a request from an external device, and provides the access token to the external device. In such a mode, if an access token with a uniformly long expiration date is provided to the external device regardless of the service, the expiration date may be excessive for services with a relatively short usage time, and if the access token is leaked, damage due to unauthorized use may be large. On the other hand, if an access token with a uniformly short expiration date is provided to the external device regardless of the service, the expiration date may be insufficient for services with a relatively long usage time, and this may hinder smooth use of the access token. The present invention aims to achieve both preventing the access token's expiration date from becoming excessive for a specific service and preventing the access token's expiration date from becoming insufficient for other services in an information processing system that obtains an access token from an authorization server in response to a request from an external device and provides it to the external device. [Means for solving the problem]

[0005] The invention described in claim 1 is an information processing system having one or more processors, which obtains an access token from an authorization server that enables access to a specified service in response to a request from an external device, and provides the access token to the external device, wherein the one or more processors, when receiving a request specifying a first service, obtain a first access token having a first expiration date set from the authorization server and provide the access token to the external device, and when receiving a request specifying a second service, obtain a second access token from the authorization server having a second expiration date shorter than the first expiration date and provide the access token to the external device. The invention described in claim 2 is the information processing system described in claim 1, characterized in that the one or more processors obtain the first access token by utilizing a first authentication setting including the first expiration date setting made by the local system to the authorization server, and obtain the second access token by utilizing a second authentication setting including the second expiration date setting made by the local system to the authorization server. The invention described in claim 3 is the information processing system described in claim 2, characterized in that the one or more processors link a login made to the system from the external device to the first authentication setting and the second authentication setting, and make the first authentication setting and the second authentication setting available in response to the login. The invention described in claim 4 is the information processing system described in claim 1, characterized in that the second expiration date is specified from the local system to the authorization server. The invention described in claim 5 is an information processing system described in claim 4, characterized in that the designation is made based on information of the usage time when the second service was used in the past. The invention described in claim 6 is the information processing system described in claim 4, characterized in that the second service is a service that uses data obtained from the external device, and the designation is made based on information related to the capacity of the data. The invention described in claim 7 is an information processing system described in any one of claims 1 to 6, characterized in that the one or more processors provide the second access token in response to the request from the external device, and when information is received from the external device indicating that the second service cannot be accessed because the second expiration date has passed, obtain a third access token from the authorization server, the third access token having a third expiration date longer than the second expiration date, and provide it to the external device. An invention described in claim 8 is the information processing system described in claim 7, characterized in that the third expiration date is shorter than the first expiration date. The invention described in claim 9 is the information processing system described in claim 1, characterized in that the second service is a service of transmitting data held by the external device by email. The invention described in claim 10 is a program that realizes the following functions in a computer that obtains an access token enabling access to a specified service from an authorization server in response to a request from an external device, and provides the access token to the external device: when the request specifying a first service is received, a first access token having a first expiration date set from the authorization server, and provides the access token to the external device; and when the request specifying a second service is received, a second access token having a second expiration date shorter than the first expiration date set from the authorization server, and provides the access token to the external device. Effect of the Invention

[0006] According to the invention described in claims 1 and 10, in an information processing system that obtains an access token from an authorization server in response to a request from an external device and provides the access token to the external device, it is possible to simultaneously prevent the access token's expiration date from becoming excessive for a specific service and prevent the access token's expiration date from becoming insufficient for other services. According to the invention recited in claim 2, even if the authorization server is configured to issue an access token with a predetermined expiration date for each authentication setting, it is possible to obtain the first access token and the second access token. According to the invention as recited in claim 3, it becomes unnecessary for the external device to hold login information for each authentication setting of the authorization server. According to the invention as recited in claim 4, the effort required for authentication setting is reduced compared to the case where authentication setting is performed for each expiration date. According to the invention recited in claim 5, the expiration date is set in a way that reflects the status of the service usage time, as compared to the case where a predetermined fixed value is used. According to the invention recited in claim 6, the expiration date is set in a way that reflects the status of data used for the service, as compared to the case where a predetermined fixed value is used. According to the invention as recited in claim 7, even in a situation where the second validity period is insufficient, access to the second service is possible. According to the invention recited in claim 8, unauthorized use of the access token is suppressed, compared to a case in which the third expiration date is set to be longer than the first expiration date. According to the invention recited in claim 9, in a service for transmitting data of an external device by email, excessive expiration of the access token is prevented. [Brief description of the drawings]

[0007] [Figure 1] FIG. 1 illustrates an example of a configuration of a service utilization system. [Diagram 2] FIG. 2 is a block diagram showing an example of a hardware configuration of a token providing server. [Diagram 3] FIG. 2 illustrates an example of a hardware configuration of an external device. [Figure 4] FIG. 2 is a block diagram showing an example of a functional configuration of a token providing server to which the first embodiment is applied. [Diagram 5] FIG. 2 is a block diagram showing an example of a functional configuration of an external device. [Figure 6] FIG. 11 is a sequence diagram showing an example of an operation of the service using system. [Figure 7] 11 is a flowchart illustrating an example of an operation related to providing an access token in a token providing server to which the first embodiment is applied. [Figure 8] FIG. 11 is a block diagram showing an example of a functional configuration of a token providing server to which a second embodiment is applied. [Figure 9] 13 is a flowchart illustrating an example of an operation related to providing an access token in a token providing server to which the second embodiment is applied. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] Hereinafter, a first embodiment and a second embodiment of the present invention will be described in detail with reference to the accompanying drawings. In addition, when there is no need to distinguish between the first and second embodiments, such as when describing a configuration common to both embodiments, the two may be referred to as "the present embodiment." First, the first embodiment will be described with reference to FIGS.

[0009] <First embodiment> [Service Usage System 1000] FIG. 1 is a diagram showing an example of the configuration of a service utilization system 1000. As shown in FIG. As shown in the figure, the service utilization system 1000 includes a token providing server 1, an external device 2, an authorization server 3, and a service server 4 (4a, 4b, ...). Each device is connected via a network. The network is not particularly limited as long as it can be used for data communication between the devices.

[0010] The service utilization system 1000 is a computer system that enables an external device 2 to use a service provided by a service server 4. More specifically, when the external device 2 in the service utilization system 1000 requests the utilization (access) of a service of the service server 4, it presents an access token acquired based on an authentication setting for the authorization server 3 to the service server 4. If the presented access token is valid, the service server 4 provides the service to the external device 2.

[0011] The access token is unique information that is created based on authentication settings by the authorization server 3. The access token is given, for example, as several tens of alphanumeric characters. An expiration date is set for the access token, and even if an expired access token is presented, the service server 4 will not permit use of the service.

[0012] Here, consider a case where the external device 2 directly obtains an access token from the authorization server 3 based on the authentication settings between the external device 2 and the authorization server 3. In this case, for example, when a user uses multiple external devices 2, authentication settings for the authorization server 3 must be configured in each external device 2, which is troublesome. Also, for example, when obtaining an access token using the same authentication settings from the next time onwards, information on the authentication settings with the authorization server 3 must be stored in each external device 2, which puts pressure on the storage capacity of the external device 2 (for example, the capacity of the secondary storage unit 22 described later with reference to FIG. 3). Therefore, in this embodiment, authentication is set between the token providing server 1 and the authorization server 3, and the token providing server 1 obtains an access token from the authorization server 3 and provides it to the external device 2.

[0013] The token providing server 1 is a server that, in response to a request from an external device 2, obtains an access token for a corresponding service from an authorization server 3 and provides the access token to the external device 2. Various computer devices (information processing devices) can be used as devices constituting the token providing server 1. The token providing server 1 may be constituted by one computer or may be constituted by multiple computers. Also, the token providing server 1 may be constituted as a so-called on-premise type server or a cloud type server. The token providing server 1 is an example of an information processing system to which the first embodiment is applied.

[0014] The external device 2 is a device used by a user. The external device 2 uses the services provided by the service server 4 to execute various processes in response to instructions from the user. The term “external device” indicates that the device is external to the configuration of service server 4 (not included in the configuration of service server 4), and indicates that some kind of authentication, such as OAuth authentication, is required when using a service provided by service server 4. In this embodiment, the external device 2 will be described as an image processing device capable of reading (scanning) an image formed on a recording material and forming (printing) an image on the recording material, etc. However, the external device 2 is not limited to this as long as it has a computer as a control unit and uses the services provided by the service server 4, and various devices may be used.

[0015] The authorization server 3 is a server that issues an access token. The authorization server 3 issues an access token in response to a request from another device in an authorization flow, and passes it to the requesting device. The authorization flow refers to a procedure (flow) for acquiring an access token, and includes a process of authentication settings for the authorization server 3. Alternatively, the authorization server 3 may issue a refresh token in addition to the access token and pass it to the requesting device. The refresh token is used to request reissue of the access token when the access token expires. The reissue of the access token by a request using the refresh token does not require an authorization flow. The refresh token may also be called a refresh token.

[0016] The service server 4 is a server that provides a service in response to a request from another device. More specifically, when a request for service is received from another device and a valid access token is presented, the service server 4 provides the service to the requesting device. Here, each service server 4 provides a different service. Different services do not only refer to different types of services, such as a file storage service and an email transmission service described later, but also include cases where there are differences in other elements. For example, it includes cases where a certain service server 4 and another service server 4 provide the same type of service, but the providers of the two are different. Note that, although only two service servers 4a and 4b are shown in the example of FIG. 1, the number of service servers 4 may be three or more.

[0017] In this embodiment, the service server 4a is capable of providing a service of storing and keeping data received from the external device 2 in a specified storage location on the network (sometimes referred to as a "file storage service"). Also, the service server 4b is capable of providing a service of sending an e-mail containing data received from the external device 2 to a specified destination by SMTP (Simple Mail Transfer Protocol) (sometimes referred to as an "e-mail sending service"). In the following, the service server 4a is sometimes referred to as the file server 4a, and the service server 4b is sometimes referred to as the SMTP server 4b. The file storage service provided by the file server 4a is an example of a first service, and the mail transmission service provided by the SMTP server 4b is an example of a second service.

[0018] In this embodiment, the external device 2, which is an image processing device, can provide the user with a function of storing image data created by scanning in a specified storage location (sometimes called a "scan and store function") by utilizing the file storage service of the file server 4a. Also, the external device 2 can provide the user with a function of sending an e-mail including image data created by scanning to a specified destination (sometimes called a "scan and mail function") by utilizing the mail sending service of the SMTP server 4b. The image data created by scanning is an example of data held by the external device 2 and data acquired by the service server 4 from the external device 2.

[0019] [Token providing server 1] FIG. 2 is a block diagram showing an example of a hardware configuration of the token providing server 1. As shown in FIG. As shown in the figure, the token providing server 1 includes a control unit 10, a secondary storage unit 12, and a communication unit 13. Note that this configuration is merely an example, and the token providing server 1 may also include a display device capable of displaying various information on a screen, an input device capable of receiving information input by an administrator of the device, or the like.

[0020] The control unit 10 executes various processes according to the loaded programs and controls the operation of the device itself. The control unit 10 also includes a CPU (Central Processing Unit) 10a as a calculation means, a RAM (Random Access Memory) 10b used as a working memory for the CPU 10a, and a ROM (Read Only Memory) 10c in which the programs executed by the CPU 10a and pre-prepared setting values ​​are stored. The control unit 10 also includes a non-volatile memory 10d that is rewritable and can hold data even if the power supply is cut off, and an interface unit 10e that controls each unit such as a communication unit 13 connected to the control unit 10. The non-volatile memory 10d is, for example, an SRAM or a flash memory backed up by a battery.

[0021] In the token providing server 1, a CPU 10a, which is an example of a processor, reads and executes programs to realize various functions, which will be described later. Here, the various programs executed by the CPU 10a are provided in a state of being stored in a computer-readable recording medium such as a magnetic recording medium (magnetic tape, magnetic disk, etc.), an optical recording medium (optical disk, etc.), a magneto-optical recording medium, or a semiconductor memory. The programs executed by the CPU 10a may be downloaded using a communication means such as the Internet. The processor refers to a processor in a broad sense, and includes a general-purpose processor (e.g., a CPU, etc.) and a dedicated processor (e.g., a graphics processing unit (GPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a programmable logic device, etc.). The operation of the processor may not only be performed by one processor, but may be performed by multiple processors located at physically separate locations working together. Furthermore, the order of the operations of the processor is not limited to the order described as an embodiment, and may be changed.

[0022] The secondary storage unit 12 records programs to be executed by the CPU 10a, and also provides a database for storing various data used by the token providing server 1, such as authentication settings with the service server 4 and access tokens / update tokens acquired from the authorization server 3, and stores the stored data. The secondary storage unit 12 is realized by a storage device such as a magnetic disk device or an SSD (Solid State Drive), for example. The communication unit 13 performs data communication with other devices via a network (see FIG. 1). As the communication unit 13, an interface corresponding to the communication method of the network is used.

[0023] [Hardware configuration of external device 2] FIG. 3 is a diagram illustrating an example of a hardware configuration of the external device 2. As shown in FIG. As shown in the figure, the external device 2 includes a control unit 20, a secondary storage unit 22, a communication unit 23, an input unit 24, and a display unit 25. In addition, since the external device 2 according to this embodiment is an image processing device, it includes an image forming unit 26 and an image reading unit 27 as components related to image processing. The control unit 20 and the communication unit 23 in the external device 2 are similar to the control unit 10 and the communication unit 13 in the token providing server 1 described with reference to FIG. 2, respectively, and therefore will not be described here.

[0024] The secondary storage unit 22 records programs to be executed by the CPU 20a, and also stores various data used by the external device 2, such as information related to logging in to the token providing server 1, an access token acquired from the token providing server 1, image data used for printing in the image forming unit 26, and image data created from the results of reading in the image reading unit 27. Similar to the secondary storage unit 12 of the token providing server 1, the secondary storage unit 22 is realized by various storage devices.

[0025] The input unit 24 is a device such as a hardware button or switch that accepts input operations from the user, a touch sensor that outputs a control signal in response to contact with a finger or the like, a code reader that reads code information such as a barcode or QR code (registered trademark), a card reader that reads an IC (Integrated Circuit) card, or a sensor that reads the user's biometric information. Display unit 25 is configured, for example, by a liquid crystal display or an organic EL (Electro-Luminescence) display, and displays a screen including various information such as images and text. A touch sensor as one of input units 24 may be combined with display unit 25 to configure a touch panel. In this case, software buttons that accept input operations from the user are displayed on display unit 25.

[0026] The image forming unit 26 is constituted by a printer engine such as a laser printer or an inkjet printer, and in response to instructions from the control unit 20, forms and prints an image corresponding to the image data on a recording material such as paper. The image reading unit 27 is configured with an image scanner or the like, and reads an image formed on a recording material (original) such as paper in response to instructions from the control unit 20, and passes the read result to the control unit 20 as image data.

[0027] [Hardware configuration of Authorization Server 3 and Service Server 4] As an example, the authorization server 3 and the service server 4 have the same hardware configuration as the token providing server 1 shown in Fig. 2. Furthermore, like the token providing server 1, the authorization server 3 and the service server 4 may include a display device, an input device, and the like. In addition, the service server 4 includes various components necessary for providing the service.

[0028] [Functional configuration of token provisioning server 1] FIG. 4 is a block diagram showing an example of a functional configuration of the token providing server 1 to which the first embodiment is applied. As shown in the figure, the token providing server 1 to which the first embodiment is applied includes a login management unit 101, an authentication management unit 102, a request receiving unit 103, a deadline determination unit 104, a token acquisition unit 105, a service information management unit 106, a notification creation unit 107, and a communication control unit 108.

[0029] The login management unit 101 manages the login status from the external device 2 to its own system. More specifically, it accepts login from the external device 2 based on login information received from the external device 2. The login information includes, for example, a pre-registered ID and password. Hereinafter, login from the external device 2 to the token provision server 1 may be referred to as "system login" to distinguish it from a user's login to the external device 2 (described later with reference to FIG. 5). Furthermore, the login management unit 101 stores various data relating to system login, such as registered login information and system login history, in a database on the secondary storage unit 12, and manages the data for each user.

[0030] The authentication management unit 102 manages the authentication settings between its own system and the authorization server 3. The authentication management unit 102 links the authentication settings made in a state where a login is made from the external device 2 to the login information. Then, in this linked state, the authentication setting information is stored in a database on the secondary storage unit 12 and managed. Furthermore, when the login management unit 101 accepts a login from an external device 2, the authentication management unit 102 retrieves the authentication settings linked to the corresponding login information from the database and makes them available for later processing in the system.

[0031] In the first embodiment, a first authentication setting including a first expiration date setting and a second authentication setting including a second expiration date setting that is shorter than the first expiration date are associated with one piece of login information. When the authentication management unit 102 accepts a login using this login information, the authentication management unit 102 makes both the first authentication setting and the second authentication setting available. As a result, the token providing server 1 to which the first embodiment is applied can obtain a first access token with a first expiration date set thereto by making a request for an access token to the authorization server 3 using the first authentication setting. Also, can obtain a second access token with a second expiration date set thereto by making a request for an access token to the authorization server 3 using the second authentication setting.

[0032] The request receiving unit 103 receives a request for an access token from the external device 2. More specifically, the request receiving unit 103 receives a request for an access token from the external device 2 in a logged-in state. Then, in response to the received request, the request receiving unit 103 controls to perform processes such as determining an expiration date, acquiring an access token, and creating a response, which will be described later. Note that the request for the access token includes a designation of the service to be used. Additionally, the request receiving unit 103 stores and manages a history of access token requests received from the external device 2 in a database on the secondary storage unit 12.

[0033] The deadline determination unit 104 determines the deadline of the access token to be acquired, based on the request accepted by the request acceptance unit 103. More specifically, the deadline determination unit 104 according to the first embodiment determines, in accordance with the service specified in the request, which authentication setting to use when requesting an access token from the authorization server 3, between a first authentication setting including a first deadline setting and a second authentication setting including a second deadline setting shorter than the first deadline.

[0034] Here, the criterion for the expiration date determination unit 104 to determine the expiration date is preset by, for example, an administrator. More specifically, for example, the expiration date for which an access token is to be acquired is preset for each service provided by the service server 4. In the first embodiment, it is preset by the administrator so that when the mail transmission service of the SMTP server 4b is specified, an access token with the second expiration date is acquired, and when another service such as the file storage service of the file server 4a is specified, an access token with the first expiration date is acquired. The first expiration date and the second expiration date are set in advance by, for example, an administrator. The second expiration date is set, for example, to several to several tens of seconds as the minimum time required to use the mail transmission service of the SMTP server 4b. The first expiration date is set, for example, to several tens of minutes, which is longer than the second expiration date and provides a margin for using other services such as the file storage service of the file server 4a.

[0035] The token acquisition unit 105 creates a request for an access token with the expiration date determined by the deadline determination unit 104 as a request to the authorization server 3. The token acquisition unit 105 according to the first embodiment requests an access token from the authorization server 3 using an authentication setting corresponding to the expiration date determined by the deadline determination unit 104. This allows an access token with the expiration date determined by the deadline determination unit 104 to be acquired. Then, the token acquisition unit 105 creates a response including the acquired access token as a response to the access token request from the external device 2. Note that in this embodiment, the response created by the token acquisition unit 105 includes service information (described later). In addition, the token acquisition unit 105 manages access tokens and refresh tokens, such as storing the access tokens and refresh tokens acquired from the authorization server 3 in a database on the secondary storage unit 12, and deleting expired access tokens and refresh tokens.

[0036] The service information management unit 106 manages service information that is necessary for the external device 2 to use a service provided by the service server 4. For example, when the request receiving unit 103 receives a request for an access token, the service information management unit 106 retrieves service information of a specified service from the database on the secondary storage unit 12 and makes the service information available. The service information is, for example, information such as a storage location path and a port number that are required when the external device 2 uses the file storage service of the file server 4a, and information such as an email address, a port number, and an encryption method that are required when the external device 2 uses the email transmission service of the SMTP server 4b.

[0037] The notification creating unit 107 creates various notifications to be sent to other devices. For example, if the notification creating unit 107 fails to obtain an access token from the authorization server 3 for some reason or if the obtained access token cannot be sent to the external device 2, the notification creating unit 107 creates an error notification indicating the fact, addressed to the external device 2 or the administrator's terminal. Also, for example, if some operation / task is required by the user or administrator of the external device 2, the notification creating unit 107 creates a notification requesting the operation / task.

[0038] The communication control unit 108 controls data communication by the communication unit 13 (see FIG. 2). For example, the communication control unit 108 controls so as to transmit a response including the access token acquired by the token acquisition unit 105 to the requesting external device 2. In addition, for example, the communication control unit 108 controls so as to transmit various notifications created by the notification creation unit 107 and requests for various data used for processing in its own system to other devices such as the external device 2. Furthermore, the communication control unit 108 extracts necessary information from data received from other devices and makes it available to each functional unit. As a specific example, the communication control unit 108 extracts information related to an access token request from data received from the external device 2 and makes it available to the request receiving unit 103.

[0039] [Functional configuration of external device 2] FIG. 5 is a block diagram showing an example of a functional configuration of the external device 2. As shown in FIG. As shown in the figure, the external device 2 includes an operation reception unit 201, a login management unit 202, a token request unit 203, a service request unit 204, a display control unit 205, and a communication control unit 206.

[0040] The operation reception unit 201 receives various operations input by the user via the input unit 24. For example, the operation reception unit 201 receives an operation requesting the use of a scan and store function or a scan and mail function, which is performed via the input unit 24. In addition, for example, the operation reception unit 201 receives an operation for inputting user information used for logging in, which will be described later.

[0041] The login management unit 202 manages the login status of users to the device itself. More specifically, it accepts logins by users based on user information input by the users. The user information includes, for example, a pre-registered user ID and password. Note that a login by a user to the external device 2 may be referred to as a "user login" to distinguish it from a system login (described above with reference to FIG. 4). Additionally, the login management unit 202 stores various data related to user login, such as registered user information and user login history, in a database on the secondary storage unit 22, and manages them for each user.

[0042] The token requesting unit 203 creates a request for an access token including information specifying a service to be used as a request to the token providing server 1. More specifically, for example, when the operation receiving unit 201 receives a function selection by a user, the token requesting unit 203 creates a request for an access token including information specifying a service required to execute the function. In addition, the access token request may include a request for service information corresponding to the specified service. Furthermore, the token request unit 203 stores and manages login information required for system login to the authorization server 3 that is the request destination in a database on the secondary storage unit 22. When creating a request for an access token, the token request unit 203 retrieves the login information required for system login to the authorization server 3 from the database and associates it with the request for an access token.

[0043] The service request unit 204 creates a service utilization request for the service server 4. The service utilization request includes data used in the service of the service server 4, such as image data created by scanning in the external device 2 and used in a file storage service or an email transmission service. In addition, the service utilization request includes, for example, service information received from the token provision server 1, information for identifying the requesting external device 2 (own device), information for specifying the requested service server 4, and the like. Furthermore, the service request unit 204 associates the created service utilization request with the corresponding access token provided by the token providing server 1.

[0044] The display control unit 205 controls the types and contents of images, various icons, text, etc. displayed on the display unit 25, as well as the display mode such as the position and size of the displayed images, etc. The display control unit 205, for example, controls the display of a screen that allows the user to select a function available on the external device 2. Also, for example, the display control unit 205 controls the display of a notification screen that presents the contents of the notification received from the token providing server 1 to the user.

[0045] The communication control unit 206 controls data communication by the communication unit 23. For example, the communication control unit 206 controls so as to transmit a request for an access token created by the token request unit 203 to the token providing server 1. Also, for example, the communication control unit 206 transmits to the service server 4 a request to use a service created by the service request unit 204 and an access token linked to the request to use the service.

[0046] [Use of the Service] Next, the flow of using a service in the service use system 1000 will be outlined with reference to FIGS. FIG. 6 is a sequence diagram showing an example of the operation of the service use system 1000. As shown in FIG.

[0047] As shown in Fig. 6, first, the token providing server 1 accepts a request for adding authentication settings from an administrator or the like (S601). Then, the token providing server 1 transmits an authorization request to the authorization server 3 (S602). At this time, for example, the administrator inputs information required for authentication settings, such as an ID and a password, and transmits the information to the authorization server 3. The authorization server 3 authorizes the token providing server 1 in response to the authorization request, and transmits information on the authentication settings to the token providing server 1 (S603). In addition, the token providing server 1 stores the information on the authentication settings (S604). Next, an administrator or the like registers service information in the token providing server 1 (S605). In addition, the token providing server 1 stores the registered service information (S606).

[0048] The steps S601 to S604 are steps related to authentication setting between the token providing server 1 and the authorization server 3. In this embodiment, once authentication setting between the token providing server 1 and the authorization server 3 is performed, the authentication setting information is stored in the token providing server 1. Thereafter, the stored authentication setting information is used, so there is no need to perform authentication setting again. Moreover, steps S605 and S606 are steps related to the registration of service information in the token provision server 1. Since the registered service information is stored in the token provision server 1, there is no need to register it again. 6, the steps S601 to S606 enclosed by a dashed line are not necessarily performed every time a service is used in the service use system 1000, but may be performed once, for example, during the initial setup of the external device 2. After the initial setup, the service can be used through the steps S607 to S616.

[0049] Returning to FIG. 6, the external device 2 accepts a user login (S607). Next, the external device 2 accepts a function selection by the user (S608). More specifically, for example, an operation requesting the use of a scan-to-save function or a scan-to-mail function is accepted. The external device 2 scans the document set by the user and creates image data to be used in the scan-and-save function and the scan-to-mail function (S609). The external device 2 requests an access token from the token providing server 1 by specifying a service corresponding to the selected function (S610). This request includes a request for service information of the specified service.

[0050] In response to a request from the external device 2, the token providing server 1 requests the authorization server 3 for the first access token or the second access token (S611). Note that the authentication setting information acquired in S601 to S604 is used in the access token request. In response to the request from the token provision server 1, the authorization server 3 issues an access token (S612). The token providing server 1 returns a response including the access token and service information acquired from the authorization server 3 to the external device 2 (S613). As a result, the access token is provided from the token providing server 1 to the external device 2.

[0051] The external device 2 uses the access token and the service information provided by the token providing server 1 to make a service utilization request to the service server 4 (S614). Note that this utilization request includes image data to be used in the service. The service server 4 verifies the access token included in the usage request from the external device 2 (S615). If the access token is valid, the service server 4 executes the service using the service information and image data included in the usage request (S616).

[0052] [Token provisioning server 1 operation] Here, the operation of the token providing server 1 to which the first embodiment is applied, related to providing an access token, will be described in more detail. Note that the operation described below corresponds to the operation of the token providing server 1 in steps S610 to S612 in FIG. FIG. 7 is a flowchart showing an example of an operation related to providing an access token in the token providing server 1 to which the first embodiment is applied.

[0053] First, the token provision server 1 receives a request for an access token from the external device 2 (S701). Next, it is determined whether the service specified in the access token request from the external device 2 is an email transmission service (S702). If the specified service is an email transmission service (YES in S702), the token providing server 1 determines to obtain an access token using a second authentication setting including a second expiration date setting (S703). Then, the token providing server 1 requests an access token from the authorization server 3 using the second authentication setting (S704), and obtains a second access token with a second expiration date set (S705).

[0054] On the other hand, if the service specified in the access token request from the external device 2 is not an email sending service (NO in S702), for example, a file storage service, the token providing server 1 decides to obtain an access token using a first authentication setting including a first expiration date setting (S706). Then, the token providing server 1 requests an access token from the authorization server 3 using the first authentication setting (S707), and obtains a first access token with a first expiration date set (S708).

[0055] Finally, the token provision server 1 provides the access token acquired in S705 or S708 to the external device 2 that made the request (S709). As described above, by the operations of S701 to S709, the processing of accepting the request for an access token, determining the expiration date, and obtaining and providing the access token in the token provision server 1 is completed.

[0056] As described above, when the token providing server 1 to which the first embodiment is applied accepts a request for an access token designating a file storage service, the token providing server 1 uses the first authentication setting to obtain a first access token with a first expiration date set thereto from the authorization server 3, and provides the token to the external device 2. When the token providing server 1 accepts a request for an access token designating a mail transmission service, the token providing server 1 uses the second authentication setting to obtain a second access token with a second expiration date set thereto that is shorter than the first expiration date, and provides the token to the external device 2.

[0057] In the above description, the token providing server 1 is capable of using the first authentication setting and the second authentication setting, and provides a first access token with a first expiration date set or a second access token with a second expiration date set according to a specified service, but the token providing server 1 may be capable of using three or more authentication settings including an expiration date setting different from the first expiration date and the second expiration date. In other words, the token providing server 1 may obtain an access token with an expiration date set different from the first expiration date and the second expiration date according to a specified service, and provide the access token to the external device 2.

[0058] <Second embodiment> In the above-described first embodiment, the token providing server 1 acquires access tokens with different expiration dates by using a plurality of authentication settings including different expiration dates. In contrast, in the second embodiment, the token providing server acquires access tokens with different expiration dates by specifying an expiration date when requesting an access token and having the authorization server issue an access token with the specified expiration date. The second embodiment will be described in detail below with reference to Figs. 1-3, 5-6, 8 and 9. Note that the first and second embodiments differ from each other in part of the functional configuration and part of the operation of the token providing server and the operation of the authorization server, but are otherwise similar. Therefore, in the second embodiment, parts similar to those in the first embodiment are indicated by the same reference numerals, and descriptions thereof will be omitted. Also, parts different from the first embodiment are distinguished by adding "'" to the reference numerals.

[0059] [Functional configuration of token provision server 1'] FIG. 8 is a block diagram showing an example of a functional configuration of a token providing server 1' to which the second embodiment is applied. As shown in the figure, the token providing server 1' to which the second embodiment is applied includes a login management unit 101, an authentication management unit 102', a request receiving unit 103, a deadline determination unit 104', a token acquisition unit 105', a service information management unit 106, a notification creation unit 107, and a communication control unit 108.

[0060] The authentication management unit 102' manages the authentication settings between its own system and the authorization server 3. The authentication management unit 102' links the authentication settings made in a state where a login is made from the external device 2 to the login information. Then, in this linked state, the authentication setting information is stored in a database on the secondary storage unit 12 and managed. Furthermore, when the login management unit 101 accepts a login from an external device 2, the authentication management unit 102' retrieves the authentication settings linked to the corresponding login information from the database and makes them available for later processing in the system.

[0061] In the second embodiment, one authentication setting is associated with one piece of login information. The token providing server 1′ to which the second embodiment is applied uses a common authentication setting regardless of whether the token to be acquired has a first expiration date or a second expiration date.

[0062] The expiration date determining unit 104' determines the expiration date of the access token to be acquired, based on the request received by the request receiving unit 103. More specifically, the expiration date determining unit 104' according to the second embodiment determines, in accordance with the service specified in the request, which expiration date to specify when requesting an access token from the authorization server 3', between a first expiration date and a second expiration date that is shorter than the first expiration date. Here, the criteria by which the term determination unit 104' determines the term, and the lengths of the first and second term are set in advance by an administrator or the like, as in the first embodiment.

[0063] The token acquisition unit 105' creates a request for an access token with the expiration date determined by the expiration date determination unit 104' as a request to the authorization server 3'. In the token acquisition unit 105' according to the second embodiment, the request for an access token to the authorization server 3' includes information specifying the expiration date determined by the expiration date determination unit 104'. This information allows the authorization server 3' to issue an access token with a specified expiration date set, and makes it possible to acquire an access token with a specified expiration date set. Then, the token acquisition unit 105' creates a response including the acquired access token as a response to the access token request from the external device 2. In addition, the token acquisition unit 105′ manages access tokens and refresh tokens, such as storing the access tokens and refresh tokens acquired from the authorization server 3′ in a database on the secondary storage unit 12, and deleting expired access tokens and refresh tokens.

[0064] The authorization server 3' according to the second embodiment issues an access token with a specified expiration date set based on information specifying the expiration date included in an access token request. More specifically, if the access token request includes information specifying a first expiration date, the authorization server 3' issues a first access token with a first expiration date set. If the access token request includes information specifying a second expiration date, the authorization server 3' issues a second access token with a second expiration date set.

[0065] [Use of the Service] The flow of service usage in the second embodiment is similar to the flow of service usage in the first embodiment described with reference to Fig. 6, and therefore the description will be omitted here. Note that in the second embodiment, the operation of the token providing server 1 in Fig. 6 is replaced with the operation of the token providing server 1', and the operation of the authorization server 3 is replaced with the operation of the authorization server 3'.

[0066] [Example of operation of token provision server 1'] The operation of the token providing server 1' to which the second embodiment is applied, which is related to providing an access token, will be described in detail below. Note that the operation described below corresponds to the operation of the token providing server 1' in steps S609 to S611 in FIG. 6. FIG. 9 is a flowchart showing an example of an operation related to providing an access token in a token providing server 1′ to which the second embodiment is applied.

[0067] First, the token provision server 1' receives a request for an access token from the external device 2 (S901). Next, it is determined whether the service specified in the access token request from the external device 2 is an email transmission service (S902). If the specified service is an email transmission service (YES in S902), the token providing server 1′ specifies a second expiration date and determines to acquire an access token (S903). Then, the token providing server 1' requests an access token from the authorization server 3' by specifying the second expiration date (S904), and obtains the second access token with the second expiration date set (S905).

[0068] On the other hand, if the service specified in the access token request from the external device 2 is not an email sending service (NO in S902), for example, a file storage service, the token providing server 1' determines to acquire an access token by specifying a first expiration date (S906). Then, the token providing server 1' requests an access token from the authorization server 3' by specifying the first expiration date (S907), and obtains the first access token with the first expiration date set (S908).

[0069] Finally, the token provision server 1' provides the access token acquired in S905 or S908 to the external device 2 that has made the request (S909). Through the operations of S901 to S909, the processes of accepting a request for an access token, determining the expiration date, and obtaining and providing an access token in the token provision server 1' are completed.

[0070] As described above, when the token providing server 1′ to which the second embodiment is applied receives a request for an access token designating a file storage service, the token providing server 1′ acquires a first access token by designating a first expiration date and requests an access token from the authorization server 3′, and provides the first access token to the external device 2. When the token providing server 1′ receives a request for an access token designating a mail transmission service, the token providing server 1′ acquires a second access token by designating a second expiration date and requests an access token from the authorization server 3′, and provides the second access token to the external device 2.

[0071] Here, in the second embodiment, the second expiration date may be specified based on information on the usage time when the service was used in the past. For example, the token providing server 1' may set and specify the second expiration date based on information on the usage time when the mail transmission service was used in the past. This usage time information is extracted from the history (log) of various processes in the token providing server 1' or the external device 2. For example, when the mail transmission service is used, the usage time may be calculated from the time from when the token providing server 1' obtains an access token from the authorization server 3' to when the external device 2 receives a notification of the completion of the use of the service. Also, for example, the usage time may be calculated from the time from when the external device 2 obtains an access token to when the use of the service is completed. The value of the usage time used may be the value of one past use, or may be the average or maximum value of multiple uses.

[0072] Furthermore, when a service is provided in which the service server 4 uses data acquired from the external device 2, such as an e-mail transmission service, depending on the volume of data, it may take time for processing in each device and communication between devices. Therefore, in the second embodiment, the second expiration date may be specified based on information related to the volume of data to be used. For example, the token providing server 1' may set the second expiration date to be longer the larger the volume of image data transmitted in the e-mail transmission service is, and set the second expiration date to be shorter the smaller the volume is. In this case, the information related to the volume of data may be included in the access token request from the external device 2.

[0073] The token providing servers 1, 1' to which the first and second embodiments described above are applied can be understood as examples of an information processing system that, when a request for an access token specifying a file storage service is received from an external device 2, obtains a first access token having a first expiration date set from the authorization server 3, 3' and provides it to the external device 2, and, when a request for an access token specifying a mail sending service is received, obtains a second access token having a second expiration date shorter than the first expiration date from the authorization server 3, 3' and provides it to the external device 2.

[0074] <Other variations, etc.> Although the embodiments of the present invention have been described above, the technical scope of the present invention is not limited to the scope described as the first and second embodiments. Various modifications or improvements that do not depart from the technical concept of the present invention are also included in the present invention. For example, in the first and second embodiments, a file storage service is exemplified as the first service, and an email transmission service is exemplified as the second service, but the types of services are not limited. Also, an example has been described in which the external device 2 is an image processing device, and image data created by scanning in the external device 2 is used in the service, but the data used in the service is not limited, and various types of data held by the external device 2 may be used. Also, for example, in the first and second embodiments, the service information is managed by the token provision server 1, 1′ and provided to the external device 2, but such a configuration is not essential. Necessary service information may be stored in the external device 2.

[0075] Incidentally, the second expiration date may be set to a very short time, such as the minimum time required to use the service. For this reason, if the processing in each device of the service use system 1000 or the communication between the devices takes longer than usual, the access token may expire before the use of the service is completed. In view of this, in the first and second embodiments, when the token providing server 1, 1' receives information from the external device 2 indicating that the service cannot be accessed because the second expiration date has passed (sometimes referred to as "expiration information"), the token providing server 1, 1' may obtain a third access token having a third expiration date longer than the second expiration date from the authorization server 3, 3' and provide it to the external device 2. This third expiration date may be a time set in advance by, for example, an administrator. Also, for example, in the first embodiment, a plurality of third expiration dates may be set and a plurality of corresponding authentication settings may be prepared, and the third access token may be provided in order from the one with the shortest expiration date until expiration information from the external device 2 is no longer received. Furthermore, for example, in the second embodiment, the third access token may be provided by repeatedly extending the third expiration date until expiration information from the external device 2 is no longer accepted. The third expiration date may be any date longer than the second expiration date, for example, it may be longer than the first expiration date. However, making the third expiration date shorter than the first expiration date is better in terms of preventing unauthorized use of the access token than making the third expiration date longer than the first expiration date.

[0076] <Additional Notes> (((1))) An information processing system comprising one or more processors, which acquires an access token enabling access to a designated service from an authorization server in response to a request from an external device, and provides the access token to the external device, The one or more processors: When the request specifying a first service is received, a first access token having a first expiration date set thereto is obtained from the authorization server, and the first access token is provided to the external device; When the request specifying a second service is accepted, a second access token having a second expiration date shorter than the first expiration date is obtained from the authorization server, and the second access token is provided to the external device. An information processing system comprising: (((2))) The one or more processors: Obtaining the first access token by using a first authentication setting including the setting of the first expiration date performed by the local system on the authorization server; Obtain the second access token by using a second authentication setting including the second expiration date setting made by the local system to the authorization server. 2. An information processing system according to claim 1, wherein: (((3))) The one or more processors: linking a login made from the external device to the local system with the first authentication setting and the second authentication setting; The first authentication setting and the second authentication setting are made available in response to the login. 2. An information processing system according to claim 1 , (((4))) The information processing system according to (((1))), wherein the second expiration date is specified from the system itself to the authorization server. (((5))) The information processing system according to (((4))), wherein the designation is made based on information about the usage time when the second service was used in the past. (((6))) the second service is a service that utilizes data acquired from the external device, The designation is made based on information related to the volume of the data. 4. An information processing system according to claim 3, wherein: (((7))) The one or more processors: providing the second access token in response to the request from the external device, and when receiving information from the external device indicating that the second service cannot be accessed because the second expiration date has passed, obtaining a third access token from the authorization server, the third access token having a third expiration date longer than the second expiration date, and providing the third access token to the external device. 2. The information processing system according to claim 1, wherein: (((8))) The information processing system according to (((7))), wherein the third expiration date is shorter than the first expiration date. (((9))) The information processing system according to any one of ((1))) to (((8))), wherein the second service is a service of transmitting data held by the external device by email. (((10))) In response to a request from an external device, a computer obtains an access token that enables access to a specified service from an authorization server, and provides the access token to the external device, a function of obtaining a first access token having a first expiration date set thereto from the authorization server when the request specifying a first service is received, and providing the first access token to the external device; a function of obtaining, when the request specifying a second service is received, a second access token having a second expiration date set thereto that is shorter than the first expiration date from the authorization server, and providing the second access token to the external device; A program to achieve this.

[0077] According to the information processing system relating to (((1))), in an information processing system that obtains an access token from an authorization server in response to a request from an external device and provides the access token to the external device, it is possible to simultaneously prevent the access token's expiration date from becoming excessive for a specific service and prevent the access token's expiration date from becoming insufficient for other services. According to the information processing system of (((2))), even if the authorization server is configured to issue an access token with a predetermined expiration date for each authentication setting, it is possible to obtain a first access token and a second access token. According to the information processing system of (((3))), it becomes unnecessary for the external device to hold login information for each authentication setting of the authorization server. According to the information processing system of (((4))), the effort required for authentication setting is reduced compared to when authentication setting is performed for each expiration date. According to the information processing system of (((5))), the expiration date is set in a way that reflects the status of the service usage time, as compared to the case where a predetermined fixed value is used. According to the information processing system of (((6))), the expiration date is set in a way that reflects the status of the data used for the service, as compared to the case where a predetermined fixed value is used. According to the information processing system of (((7))), even in a situation where the second expiration date is insufficient, access to the second service is possible. According to the information processing system of (((8))), unauthorized use of the access token is suppressed, compared to a case in which the third expiration date is set to be longer than the first expiration date. According to the information processing system of (((9))), in a service for transmitting data from an external device by email, the validity period of an access token is prevented from becoming excessive. According to the program pertaining to (((10))), in an information processing system that obtains an access token from an authorization server in response to a request from an external device and provides the access token to the external device, it is possible to simultaneously prevent the access token from expiring too late for a specific service and prevent the access token from expiring insufficiently for other services. [Explanation of symbols]

[0078] 1, 1'... token providing server, 2... external device, 3, 3'... authorization server, 4, 4a, 4b... service server (file server, SMTP server), 10a... CPU, 1000... service using system

Claims

1. An information processing system comprising one or more processors, which acquires an access token enabling access to a designated service from an authorization server in response to a request from an external device, and provides the access token to the external device, The one or more processors: When the request specifying a first service is received, a first access token having a first expiration date set thereto is obtained from the authorization server, and the first access token is provided to the external device; When the request specifying a second service is accepted, a second access token having a second expiration date set thereto that is shorter than the first expiration date is obtained from the authorization server, and the second access token is provided to the external device. An information processing system comprising:

2. The one or more processors: Obtaining the first access token by using a first authentication setting including a setting of the first expiration date made by the local system to the authorization server; Obtain the second access token by using a second authentication setting including the second expiration date setting made by the local system to the authorization server.

2. The information processing system according to claim 1 .

3. The one or more processors: linking a login made from the external device to the local system with the first authentication setting and the second authentication setting; The first authentication setting and the second authentication setting are made available in response to the login.

3. The information processing system according to claim 2.

4. 2. The information processing system according to claim 1, wherein the second expiration date is specified by the local system to the authorization server.

5. 5. The information processing system according to claim 4, wherein the designation is made based on information on a usage time when the second service was used in the past.

6. the second service is a service that utilizes data acquired from the external device, The designation is made based on information related to the volume of the data.

5. The information processing system according to claim 4.

7. The one or more processors: providing the second access token in response to the request from the external device, and when receiving information from the external device indicating that the second service cannot be accessed because the second expiration date has passed, obtaining a third access token from the authorization server, the third access token having a third expiration date longer than the second expiration date, and providing the third access token to the external device.

7. The information processing system according to claim 1, wherein the information processing system comprises:

8. 8. The information processing system according to claim 7, wherein the third expiration date is shorter than the first expiration date.

9. 2. The information processing system according to claim 1, wherein the second service is a service for transmitting data held by the external device by email.

10. In response to a request from an external device, a computer obtains an access token that enables access to a specified service from an authorization server, and provides the access token to the external device, a function of obtaining a first access token having a first expiration date set thereto from the authorization server when the request specifying a first service is received, and providing the first access token to the external device; a function of obtaining, when the request specifying a second service is received, a second access token having a second expiration date set thereto that is shorter than the first expiration date from the authorization server, and providing the second access token to the external device; A program to achieve this.

Images