Information processing system and information processing program

Abstract

To provide an information processing system and an information processing program which can suppress the issued number of refresh tokens, compared to a case in which the refresh token is uniformly kept issued.SOLUTION: A refresh token holding determination unit 60, for example, monitors acquisition of a token from a cloud server 11 by application such as a cloud cooperation application 54, and when the token is acquired, reads out the settings of the cloud cooperation application 54 having acquired the token to confirm the settings. The refresh token holding determination unit then determines whether or not to the application is executable if there is an access token. When a refresh token is unnecessary according to the settings, the refresh token is invalidated on the cloud server 11.SELECTED DRAWING: Figure 7

Description

[Technical field]

[0001] The present disclosure relates to an information processing system and an information processing program. [Background technology]

[0002] Patent document 1 discloses a document management server that receives instruction information describing the processing contents of a collaborative process, acquires document data, and stores the acquired document data based on an instruction to store the document data and information on the storage location of the document data, both of which are included in the instruction information.

[0003] Patent document 2 discloses a system including an image data processing server including a user authentication unit that authenticates a user of a user device or user terminal using an access token, a token receiving unit that receives the access token from the user device or user terminal, and a determination information sending unit that, when the access token is received, sends to the user device or user terminal determination information capable of determining whether the remaining time until the access token's expiration date is less than a predetermined threshold, and a user authentication unit that, when a request for access token issuance sent by the user device or user terminal that received the determination information, issues a new access token with an updated expiration date. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2014-006925 A [Patent Document 2] JP 2016-143164 A Summary of the Invention [Problem to be solved by the invention]

[0005] There may be a set number of refresh tokens that can be issued, which are used to reissue access tokens that permit access to resources. If the number of refresh tokens that can be issued is set, and the number of refresh tokens issued exceeds the number that can be issued, refresh tokens with the oldest issue date and time will be invalidated. This may result in the invalidation of refresh tokens that the user actually wants to hold. On the other hand, there may be cases where a refresh token is not necessary. For example, if an access token is available, a refresh token may not be necessary. In such cases, unnecessary refresh tokens will be issued, and the issuance of unnecessary refresh tokens will exceed the number that can be issued, resulting in the invalidation of refresh tokens that the user actually wants to hold.

[0006] Therefore, an object of the present disclosure is to provide an information processing system and an information processing program that can reduce the number of refresh tokens issued, compared to a case in which refresh tokens are uniformly left issued. [Means for solving the problem]

[0007] In order to achieve the above-mentioned objective, the information processing system of the first aspect includes a processor, which, when authenticating a cloud service and obtaining an issued refresh token, obtains settings of an application that exchanges information with the cloud service, and if the settings satisfy predetermined criteria, performs processing to invalidate the refresh token for the cloud service.

[0008] In an information processing system according to a second aspect, in the information processing system according to the first aspect, when the criteria are satisfied, a predetermined function that does not require a refresh token is executed.

[0009] In an information processing system according to a third aspect, when the criteria are satisfied in the information processing system according to the first aspect, a predetermined function that can be executed using only an access token is executed.

[0010] An information processing system according to a fourth aspect is the information processing system according to the first aspect, wherein the processor invalidates the refresh token using an application program interface for invalidating the refresh token.

[0011] An information processing program according to a fifth aspect causes a computer to, when authenticating to a cloud service and obtaining an issued refresh token, obtain settings of an application that exchanges information with the cloud service, and if the settings satisfy predetermined criteria, cause the cloud service to execute a process to invalidate the refresh token. Effect of the Invention

[0012] According to the first aspect, it is possible to provide an information processing system capable of suppressing the number of refresh tokens issued, compared to a case where refresh tokens are uniformly left issued.

[0013] According to the second aspect, it is possible to invalidate the refresh token without causing any adverse effects.

[0014] According to the third aspect, unnecessary refresh tokens can be invalidated.

[0015] According to the fourth aspect, it is possible to invalidate an issued refresh token.

[0016] According to the fifth aspect, it is possible to provide an information processing program capable of suppressing the number of refresh tokens issued, compared to a case where refresh tokens are uniformly left issued. [Brief description of the drawings]

[0017] [Figure 1] 1 is a diagram showing a schematic configuration of an information processing system according to an embodiment of the present invention. [Diagram 2] 2 is a block diagram showing a configuration of a main part of an electrical system of an image processing device in the information processing system according to the present embodiment. FIG. [Diagram 3] 2 is a block diagram showing the configuration of the main electrical systems of a cloud server, a client computer, and a mobile terminal in the information processing system according to the embodiment. FIG. [Figure 4] FIG. 1 is a diagram illustrating an example of a cloud service. [Diagram 5] FIG. 11 illustrates an example of a linking process. [Figure 6] FIG. 1 is a diagram for explaining an OAuth device flow. [Figure 7] 2 is a functional block diagram showing the functional configuration of a control unit of an image folding device in the information processing system according to the present embodiment. FIG. [Figure 8] 6 is a flowchart showing an example of a flow of processing performed by an image processing apparatus of the information processing system according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0018] An example of the present embodiment will be described in detail below with reference to the drawings. In the present embodiment, an information processing system in which a cloud server 11, an image processing device, a client computer, a mobile terminal, and the like are connected to each other via communication lines such as various networks will be described as an example. Fig. 1 is a diagram showing a schematic configuration of an information processing system 10 according to the present embodiment.

[0019] 1, an information processing system 10 according to the present embodiment includes a cloud server 11, an image processing device 12, a client computer 14, and a mobile terminal 16. The cloud server 11, the image processing device 12, and the client computer 14 are connected to each other via a communication line 18 such as a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, an intranet, etc. The cloud server 11, the image processing device 12, the client computer 14, and the mobile terminal 16 are each capable of transmitting and receiving various data to and from each other via the communication line 18. In this embodiment, the client computer 14 or the mobile terminal 16 issues a printing instruction to the image processing device 12 via the cloud server 11, whereby the image processing device 12 forms an image in accordance with the printing instruction.

[0020] 1 shows one each of the cloud server 11, image processing device 12, client computer 14, and mobile terminal 16, but there may be more than one of each. In the information processing system 10 according to the present embodiment, in addition to a print instruction via a communication line 18, the mobile terminal 16 can also issue a print instruction via short-range wireless communication such as Wi-Fi (registered trademark) or Bluetooth (registered trademark). Examples of the mobile terminal 16 include a mobile phone such as a smartphone, a PDA (Personal Digital Assistant), and a notebook personal computer.

[0021] The image processing device 12 according to this embodiment has multiple functions such as an image forming function for performing image forming processing, a reading function for reading an original to obtain image information representing the original, a copying function for copying an image recorded on the original onto paper, a facsimile function for transmitting and receiving various data via a telephone line (not shown), a transfer function for transferring original information such as image information read by the reading function, etc., and a storage function for storing original information such as read image information, etc. The multiple functions may include all of these functions, or may include two or more of these functions.

[0022] In the following description, the facsimile function may be referred to as "fax," the reading function as "scan," the image forming function as "print," and the copying function as "copy."

[0023] FIG. 2 is a block diagram showing the configuration of a main part of an electrical system of the image processing device 12 in the information processing system 10 according to this embodiment.

[0024] As shown in Fig. 2, the image processing device 12 according to this embodiment includes a control unit 20 including a CPU (Central Processing Unit) 20A, a ROM (Read Only Memory) 20B, and a RAM (Random Access Memory) 20C. The CPU 20A controls the overall operation of the image processing device 12. The RAM 20C is used as a work area when the CPU 20A executes various programs. The ROM 20B stores various information processing programs such as application programs and various parameters in advance. In the image processing device 12, each component of the control unit 20 is electrically connected to each other via a system bus 42.

[0025] On the other hand, the image processing device 12 according to the present embodiment includes a HDD (hard disk drive) 26 that stores various data, application programs, and the like. The image processing device 12 is also provided with a display control unit 28 that is connected to the user interface 22 and controls the display of various operation screens, etc., on the display of the user interface 22. The image processing device 12 is also provided with an operation input detection unit 30 that is connected to the user interface 22 and detects operation instructions input via the user interface 22. In the image processing device 12, the HDD 26, the display control unit 28, and the operation input detection unit 30 are electrically connected to a system bus 42. In the image processing device 12 according to the present embodiment, the HDD 26 is used as the storage unit, but this is not limited thereto, and a non-volatile storage unit such as a flash memory may be used. In the present embodiment, the user interface 22 is a touch panel capable of display and operation input, but this is not limited thereto, and a user interface having a display and an operation unit separate from each other may be used.

[0026] The image processing device 12 according to the present embodiment also includes a reading control unit 32 that controls the optical image reading operation by the document reading unit 44 and the document feeding operation by the document transport unit, and an image forming control unit 34 that controls the image forming process by the image forming unit 24 and the transport unit 25 to transport paper to the image forming unit 24. The image processing device 12 also includes a communication line I / F (interface) unit 36 ​​that is connected to the communication line 18 and transmits and receives communication data to and from other external devices such as the client computer 14 connected to the communication line 18. The image processing device 12 also includes a facsimile I / F (interface) unit 38 that is connected to a telephone line (not shown) and transmits and receives facsimile data to and from a facsimile device connected to the telephone line. The image processing device 12 also includes a transmission / reception control unit 40 that controls the transmission and reception of facsimile data via the facsimile I / F unit 38. The image processing device 12 also includes a human sensor 46 that detects people around the device. In the image processing device 12, the transmission / reception control unit 40, the reading control unit 32, the image formation control unit 34, the communication line I / F unit 36, the facsimile I / F unit 38, and the human presence sensor 46 are electrically connected to the system bus 42.

[0027] With the above configuration, the image processing device 12 according to this embodiment executes access to the RAM 20C, the ROM 20B, and the HDD 26 by the CPU 20A. The image processing device 12 also executes control of display of information such as an operation screen and various messages on the display of the user interface 22 via the display control unit 28 by the CPU 20A. The image processing device 12 also executes control of operation of the document reading unit 44 and the document transport unit via the reading control unit 32 by the CPU 20A. The image processing device 12 also executes control of operation of the image forming unit 24 and the transport unit 25 via the image formation control unit 34, and control of transmission and reception of communication data via the communication line I / F unit 36 ​​by the CPU 20A. The image processing device 12 also executes control of transmission and reception of facsimile data via the facsimile I / F unit 38 by the transmission and reception control unit 40 by the CPU 20A. Furthermore, in the image processing device 12, the CPU 20A grasps the operation content in the user interface 22 based on the operation information detected by the operation input detection unit 30, and executes various controls based on the operation content.

[0028] In this embodiment, examples of applications stored in the ROM 20B or the HDD 26 include applications that execute functions such as faxing, scanning, printing, and copying.

[0029] Next, the main configuration of the electrical systems of the cloud server 11, the client computer 14, and the mobile terminal 16 according to this embodiment will be described. Fig. 3 is a block diagram showing the main configuration of the electrical systems of the cloud server 11, the client computer 14, and the mobile terminal 16 in the information processing system 10 according to this embodiment. Note that since the cloud server 11, the client computer 14, and the mobile terminal 16 have general computer configurations, the cloud server 11 will be described below as a representative.

[0030] As shown in FIG. 3, the cloud server 11 according to the present embodiment includes a CPU 11A as an example of a processor, a ROM 11B, a RAM 11C, a storage 11D, an operation unit 11E, a display unit 11F, and a communication line I / F (interface) unit 11G. The CPU 11A controls the overall operation of the cloud server 11. The ROM 11B stores various control programs and various parameters in advance. The RAM 11C is used as a work area when the CPU 11A executes various programs. The storage 11D stores various data and application programs. The operation unit 11E is used to input various information. The display unit 11F is used to display various information. The communication line I / F unit 11G is connected to a communication line 18 and transmits and receives various data to and from other devices connected to the communication line 18. The communication line I / F unit 11G may be configured to be capable of directly communicating with each device using various well-known wireless communications. The above-mentioned components of cloud server 11 are electrically connected to each other via system bus 111. In cloud server 11 according to the present embodiment, storage 11D is used as a storage unit, and examples of storage include non-volatile storage units such as HDD (Hard Disk Drive) and flash memory.

[0031] With the above configuration, cloud server 11 according to this embodiment executes, by CPU 11A, access to ROM 11B, RAM 11C, and storage 11D, acquisition of various data via operation unit 11E, and display of various information on display unit 11F. Cloud server 11 also executes, by CPU 11A, control of transmission and reception of communication data via communication line I / F unit 11G.

[0032] Note that mobile terminal 16 includes components not present in cloud server 11, such as position detection unit 16H that detects the position of mobile terminal 16 using a global positioning system (GPS) or the like, and an imaging unit such as a camera (not shown).

[0033] In the information processing system 10 configured in this manner, the cloud server 11 provides a cloud service that stores various information such as faxes received by the image processing device 12, scanned images, and documents created by the client computer 14. Fig. 4 is a diagram for explaining an example of the cloud service.

[0034] 4, the cloud service uploads and stores faxes or scanned images received by an image processing device 12 to a cloud server 11, and the images are used by a client computer 14, a mobile terminal 16, etc. Also, the images are downloaded from the cloud service to the image processing device 12 for printing, etc.

[0035] Moreover, the information processing system 10 according to the present embodiment performs a cooperative process in which a plurality of preset processes are executed in cooperation with each other. Fig. 5 is a diagram showing an example of the cooperative process.

[0036] The linking process, for example, as shown in Fig. 5, involves a process of transferring information stored in box 50 to a predetermined forwarding destination when a fax reception or a scanned image is stored in box 50, such as a confidential box, preset in image processing device 12. By assigning instruction sheet 52, which describes the information of the forwarding destination and the processing contents of the linking process, to box 50, when information is stored in box 50, the linking process is performed according to the contents described in instruction sheet 52. For example, in the example of Fig. 5, instruction sheet 52 describes the processing contents of linking a fax or scan function with a forwarding function, and transferring a fax reception or a scanned image stored in box 50 to the forwarding destination.

[0037] Here, when transferring information to a cloud service in cooperation with the cloud service, authentication of the cloud service must be performed. One example of the authentication method is authentication using the OAuth device flow, which issues a token based on user authentication, and authentication is performed, for example, according to the following procedure. Figure 6 is a diagram for explaining the OAuth device flow.

[0038] 1. The user operates the user interface 22 of the image processing device 12 to start the pre-installed cloud cooperation application 54. The cloud cooperation application 54 is an application that performs cooperation processing with the cloud service provided by the cloud server 11. 2. The cloud cooperation application 54 acquires the two-dimensional code 56 including information for accessing the login screen of the cloud server 11 from the cloud server 11 and displays the two-dimensional code 56 on the user interface 22 . 3. The user accesses the cloud server 11 by reading the two-dimensional code 56 with the mobile terminal 16 or the like, and obtains a login screen from the cloud server 11. 4. The user logs in to the cloud service by entering a user ID (identification) and password on the login screen. If the login is permitted, the cloud server 11 issues a token corresponding to the user ID and password. In OAuth, the tokens issued are an access token with a predetermined expiration date, a refresh token with a longer expiration date than the access token, and an ID token. 5. The cloud cooperation application 54 polls the cloud server 11 for the authentication result for the two-dimensional code 56 issued to its own device. 6. If the authentication is permitted, the cloud-linked application 54 obtains a token, which allows the use of cloud services using the token.

[0039] Incidentally, there are cases where the number of OAuth refresh tokens that can be issued is set. For example, if 50 refresh tokens can be issued at the same time, when the number of tokens that can be issued is exceeded, refresh tokens with the oldest issue date and time will be invalidated. The number of refresh tokens that can be issued is set, for example, for each user ID.

[0040] Furthermore, a refresh token is generally issued at the time of authentication together with other tokens such as an access token.

[0041] However, the side using the OAuth API (Application Programming Interface) does not necessarily use a refresh token. For example, in the image processing device 12, when a guest user temporarily uses an application, the application can be executed with an access token, and a refresh token is not required.

[0042] On the other hand, there are very few API call specifications that do not issue only refresh tokens during authentication. There are cases where a unique token is not issued in the cloud, but there are no cases where the API caller specifies this.

[0043] Therefore, even in "cases where refresh tokens are not required," refresh tokens may be issued, and when the number of issuable tokens is reached, the refresh tokens that the user really wants to hold may be invalidated. For example, if the number of refresh tokens that can be issued during a federation process is exceeded and the tokens are invalidated, the federation process will stop, so it is desirable to be able to continue the federation process.

[0044] Therefore, in this embodiment, when the image processing device 12 obtains a refresh token issued after authentication of the cloud service, it obtains the settings of the application that exchanges information with the cloud service, and if the settings meet a predetermined standard, it performs a process of invalidating the refresh token for the cloud service. This makes it possible to reduce the number of refresh tokens issued compared to the case where refresh tokens are uniformly left issued. Furthermore, by being able to reduce the number of refresh tokens issued, it is possible to reduce the possibility that a refresh token that the user really wants to hold will be invalidated.

[0045] Specifically, as shown in Fig. 7, the image processing device 12 has the function of a refresh token holding determination unit 60. The refresh token holding determination unit 60 is realized, for example, by loading a program stored in the ROM 20B of the control unit 20 into the RAM 20C and executing the program by the CPU 20A. Fig. 7 is a functional block diagram showing the functional configuration of the control unit 20 of the image processing device 12 in the information processing system 10 according to this embodiment.

[0046] The refresh token holding determination unit 60 monitors, for example, acquisition of a token from the cloud server 11 by an application such as the cloud cooperation application 54, and when a token is acquired, reads out the settings of the application that acquired the token (the cloud cooperation application 54 in the case of FIG. 7) and checks the settings. Then, for example, as an example of a predetermined criterion, it determines whether the application can be executed with an access token. That is, it determines whether the execution of a predetermined function does not require a refresh token, or whether the execution of a predetermined function can be executed with only an access token. If a refresh token is not required according to the settings, it invalidates the refresh token for the cloud server 11. The invalidation of the refresh token is performed, for example, by calling a refresh token invalidation API to invalidate the refresh token. This makes it possible to suppress an increase in the number of refresh tokens issued, and therefore the number of refresh tokens issued can be suppressed.

[0047] Next, specific processing performed in the information processing system 10 according to the present embodiment configured as described above will be described. Fig. 8 is a flowchart showing an example of the flow of processing performed in the image processing device 12 of the information processing system 10 according to the present embodiment. Note that the processing in Fig. 8 starts, for example, when an application of the image processing device 12 acquires a token from the cloud server 11 that provides a cloud service.

[0048] In step 100, the CPU 20A reads the application settings and proceeds to step .

[0049] In step 102, the CPU 20A judges whether or not a refresh token is required. For example, based on the read setting, the CPU 20A judges whether or not a predetermined function is to be executed that does not require a refresh token, or whether or not a predetermined function is to be executed with only an access token. If the judgment is affirmative, the process proceeds to step 104, and if the judgment is negative, the process ends.

[0050] In step 104, the CPU 20A calls the refresh token invalidation API and proceeds to step .

[0051] In step 106, the CPU 20A invalidates the refresh token and ends the series of processes.

[0052] By performing this processing, if a refresh token is not required according to the settings, the issued refresh token is invalidated, so the number of refresh tokens issued can be reduced compared to when refresh tokens are uniformly left issued. This prevents the issuance of unnecessary refresh tokens from exceeding the issuable number, resulting in invalidation of refresh tokens that the user actually wants to hold.

[0053] Furthermore, since the number of refresh tokens issued can be reduced, the cooperation process can be prevented from being stopped due to the invalidation of the refresh token, and the cooperation process can be continued.

[0054] In the above embodiment, the image processing device 12 performs the process of invalidating the refresh token, but the present invention is not limited to this. For example, another device, such as an image forming device, other than the image processing device 12 may perform the process of invalidating the refresh token in the same manner as described above.

[0055] In addition, in the above embodiments, the term "processor" refers to a processor in a broad sense, and includes general-purpose processors (e.g., CPUs, etc.) and dedicated processors (e.g., GPU: Graphics Processing Unit, ASIC: Application Specific Integrated Circuit, FPGA: Field Programmable Gate Array, programmable logic devices, etc.).

[0056] In addition, the operations of the processor in the above embodiments may be performed not only by one processor, but also by multiple processors located at physically separate locations working together. The order of the operations of the processor is not limited to the order described in the above embodiments, and may be changed as appropriate.

[0057] In addition, although the "system" in this embodiment has been described as being composed of multiple devices as an example, it may also be composed of a single device having some of the functions of the multiple devices.

[0058] The processing performed by the image processing device 12 according to the above embodiment may be processing performed by software, processing performed by hardware, or a combination of both. The processing performed by the image processing device 12 may be stored as a program in a storage medium and distributed.

[0059] Furthermore, the present disclosure is not limited to the above, and it goes without saying that various modifications can be made without departing from the spirit and scope of the present disclosure.

[0060] The following supplementary notes are further disclosed regarding the above embodiment. (((1))) a processor, the processor comprising: When a refresh token is issued after authentication of the cloud service, the application setting for exchanging information with the cloud service is acquired; If the setting satisfies a predetermined criterion, the information processing system performs a process of invalidating the refresh token for the cloud service.

[0061] (((2))) The information processing system according to (((1))), wherein the criteria are met when a predetermined function is executed that does not require a refresh token.

[0062] (((3))) The information processing system according to (((1))) above, in which the criteria are met when a predetermined function that can be executed using only the access token is executed.

[0063] (((4))) The information processing system of any one of ((1))) to (((3))), wherein the processor invalidates the refresh token using an application program interface that invalidates the refresh token.

[0064] (((5))) On the computer, When a refresh token is issued after authentication of the cloud service, the application setting for exchanging information with the cloud service is acquired; An information processing program for causing the cloud service to execute a process of invalidating the refresh token if the setting satisfies a predetermined criterion.

[0065] According to (((1))), it is possible to provide an information processing system that can reduce the number of refresh tokens issued, compared to a case in which refresh tokens are uniformly issued and left unchanged.

[0066] According to (((2))), it is possible to invalidate refresh tokens without causing any adverse effects.

[0067] According to (((3))), unnecessary refresh tokens can be invalidated.

[0068] According to (((4))), it is possible to invalidate a refresh token that has already been issued.

[0069] According to (((5))), it is possible to provide an information processing program that can reduce the number of refresh tokens issued, compared to a case where refresh tokens are uniformly left issued. [Explanation of symbols]

[0070] 10. Information Processing Systems 12 Image processing device 20 Control Unit 20A CPU 54 Cloud-linked applications 60 Refresh token retention determination unit

Claims

1. a processor, the processor comprising: When a refresh token is issued after authentication of the cloud service, the application setting for exchanging information with the cloud service is acquired; If the setting satisfies a predetermined criterion, the information processing system performs a process of invalidating the refresh token for the cloud service.

2. The information processing system according to claim 1 , wherein the criteria are met when a predetermined function is executed that does not require a refresh token.

3. The information processing system according to claim 1 , wherein the criteria are met when a predetermined function that can be executed using only the access token is executed.

4. The information processing system according to claim 1 , wherein the processor invalidates the refresh token using an application program interface that invalidates the refresh token.

5. On the computer, When a refresh token is issued after authentication of the cloud service, the application setting for exchanging information with the cloud service is acquired; An information processing program for causing the cloud service to execute a process of invalidating the refresh token if the setting satisfies a predetermined criterion.

Images