Information processing device, control method for information processing device, and program

Abstract

In devices with multiple user interfaces, such as image forming machines, it was necessary to register a passkey for each user interface, which was cumbersome. [Solution] When a passkey is registered for the remote UI in MFP01 (S1101~S1104), the user is asked to choose whether to use the registered passkey in the local UI as well (S1106). If the user chooses to use it (Yes in S1108), the registered passkey is also registered and associated with the local UI (S1109). Similarly, when a passkey is registered for the local UI, the user is asked to choose whether to use the registered passkey in the remote UI as well. If the user chooses to use it, the registered passkey is also registered and associated with the remote UI.

Description

Technical Field

[0005]

[0001] The present invention relates to an information processing apparatus, a control method for an information processing apparatus, and a program.

Background Art

[0002] In recent years, as a means for authenticating a user, technologies such as FIDO2.0 defined by the FIDO (registered trademark) Alliance are known. Note that FIDO is an abbreviation for "Fast Identity Online". FIDO is a technology that performs biometric authentication on a terminal at the user's hand and verifies data signed with a private key on the authentication server side.

[0003] Patent Document 1 discloses a technique for displaying a list of authenticators for authentication and performing passwordless authentication by allowing a user to select an authenticator from the list when logging in to a service provided by a service providing system on a terminal device.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] Information processing devices, such as image forming machines, are equipped with multiple user interfaces, including a local UI for operating the control panel, a remote UI for changing settings and operating the image forming machine via a web browser from external devices such as PCs (Personal Computers), and mobile commands that receive operation instructions from mobile terminals and execute functions such as printing and sending. Furthermore, user authentication functions are provided for using each user interface, and users can log in and use the functions of the image forming machine only after authentication is permitted. When providing passwordless login using FIDO for each interface of an image forming machine, image forming machines with multiple user interfaces require passkey registration for each interface, which is cumbersome.

[0006] This invention was made to solve the above-mentioned problems. The purpose of this invention is to provide a mechanism that allows for easy registration of passkeys for multiple user interfaces in a single step, thereby significantly improving usability and authentication security of the device. [Means for solving the problem]

[0007] The present invention relates to an information processing device capable of communicating with a terminal having an authentication function, comprising: a plurality of user interfaces including a first user interface for operation from an operation unit of the information processing device and a second user interface for operation from an external device via a network; storage means for storing information relating to authentication; a first registration means for receiving passkey information generated from the terminal based on user authentication by the terminal's authentication function, registering the received passkey information in association with the first user interface in the storage means, and setting up authentication using the terminal's authentication function for the first user interface; selection means for accepting a user selection of whether or not to register the passkey information in association with other user interfaces different from the user interface associated with the passkey information when the passkey information has been registered; and a second registration means for further registering the passkey information registered by the first registration means in association with the second user interface in the storage means, and setting up authentication using the terminal's authentication function for the second user interface when the selection means selects to register it in association with other user interfaces. [Effects of the Invention]

[0008] According to the present invention, it becomes possible to easily register passkeys for multiple user interfaces in a single step, significantly improving usability and the authentication security of the device. [Brief explanation of the drawing]

[0009] [Figure 1] A diagram illustrating the system configuration of this embodiment. [Figure 2] A diagram illustrating the hardware configuration of each device included in the system of this embodiment. [Figure 3] A diagram illustrating the software configuration of this embodiment. [Figure 4] A diagram illustrating the information stored in the user database. [Figure 5]This diagram illustrates a screen related to the login function of the local UI displayed on the control panel. [Figure 6] This diagram illustrates a screen related to the settings for the local UI displayed on the control panel. [Figure 7] This diagram illustrates a screen related to the login function of a remote UI displayed in the browser of an information processing device. [Figure 8] This diagram illustrates a screen related to the settings of the remote UI displayed in the browser of an information processing device. [Figure 9] A diagram illustrating the sequence for registering a passkey in the remote UI. [Figure 10] A diagram illustrating the passkey authentication sequence for the local UI. [Figure 11] A flowchart illustrating the passkey registration process for the remote UI. [Figure 12] A diagram illustrating a screen related to guide display. [Figure 13] A diagram illustrating the screen of a mobile device. [Modes for carrying out the invention]

[0010] The embodiments for carrying out the present invention will be described below with reference to the drawings. [First Embodiment] Embodiments of the present invention will be described using an image forming apparatus such as an MFP (Multifunction Peripheral) equipped with functions such as copying, printing, and scanning as an example of an information processing apparatus to which the present invention is applied. In this embodiment, digital signature verification technology, which is also used in FIDO, is employed as an authentication mechanism for users to use the functions and services provided by the image forming apparatus. Specifically, the technology described in the embodiment relates to a mechanism that authenticates the user by performing biometric authentication on a mobile terminal (information processing apparatus) in the user's possession and verifying the resulting digital signature data on the image forming apparatus side. By using this mechanism, it becomes possible to authenticate users using the device without a password.

[0011] As will be described later, as one of the features of the present embodiment, a digital function corresponding to the FIDO service using the FIDO technology is incorporated and implemented in the image processing apparatus. Although FIDO is given as an example of such a mechanism, it should be noted in advance that the present invention is not limited to FIDO. Further, authentication on the mobile terminal is not limited to biometric authentication, and other authentication methods, for example, authentication using a password, etc. may also be used.

[0012] <System Configuration> Hereinafter, the system configuration of the present embodiment will be described with reference to FIG. 1. FIG. 1 is a diagram illustrating a system configuration showing an embodiment of the present invention. The MFP 101 is an image forming apparatus as an information processing apparatus to which the present invention is applied. The mobile terminal 102 is a mobile terminal such as a smartphone. The mobile terminal is, for example, a terminal equipped with iOS of Apple or a terminal equipped with Android (registered trademark) of Google. The mobile terminal 102 can communicate with the MFP 101 via a wireless LAN (Local Area Network) access point (AP) 103, a wired LAN 104, or the like. The information processing apparatus 105 is, for example, a PC (Personal Computer) or the like. The information processing apparatus 105 can also communicate with the MFP 101 via the access point 103 or the wired LAN 104.

[0013] Further, when the MFP 101 has a wireless LAN access point function, the mobile terminal 102 may be connected to the wireless LAN access point function of the MFP 101 to communicate directly.

[0014] <Hardware Configuration of MFP101> FIG. 2(a) is a schematic diagram illustrating the hardware configuration of the MFP 101. The CPU 201 is a central processing unit (processor) that controls the operation of the entire MFP 101. RAM (Random Access Memory) 203 is volatile memory and a work area, used as a temporary storage area for loading various control programs stored in ROM 202 and HDD 204.

[0015] ROM (Read Only Memory) 202 is non-volatile memory and stores the MFP101's boot program and other related information. HDD204 is a high-capacity non-volatile hard disk or flash storage compared to RAM203. HDD204 stores the MFP control program. The OS (Operating System) and application programs are also stored on HDD204.

[0016] When the MFP101 starts up, CPU201 executes the boot program stored in ROM202. This boot program reads the OS program stored in HDD204 and loads it onto RAM203. After executing the boot program, CPU201 then executes the OS program loaded onto RAM203 to control the MFP101. CPU201 also stores and reads / writes data used by the control program onto RAM203.

[0017] In this example, the MFP101 is designed so that a single CPU201 executes each of the processes shown in the flowchart described later, but other configurations are also possible. For example, multiple CPUs or microprocessors (MPUs) can work together to execute each of the processes shown in the flowchart described later. Furthermore, some of the processes described later may be executed using hardware circuits such as ASICs (Application Specific Integrated Circuits) or FPGAs (Field-Programmable Gate Arrays).

[0018] The control panel (operating unit) 205 is a touch-operable display (touch panel). The printer 206 is a printer engine that prints print data received from an external source via the communication unit 208 or digital data acquired from the scanner 207. Scanner 207 is a scanner device that reads paper documents and converts them into digital data. The communication unit 208 is a network interface for connecting to the internet or the office's LAN (Local Area Network).

[0019] <Hardware configuration of mobile device 102> Figure 2(b) is a simplified diagram illustrating the hardware configuration of the mobile terminal 102. The CPU 211 is a central processing unit (processor) that controls the overall operation of the mobile terminal 102. RAM213 is a volatile memory and work area, used as a temporary storage area for deploying various control programs stored in ROM212 and flash storage214.

[0020] ROM212 is non-volatile memory and stores the boot program for the mobile terminal 102, among other things. The flash storage 214 is a high-capacity, non-volatile memory storage compared to the RAM 203. The flash storage 214 stores the control program for the mobile device. The OS and application programs are also stored in the flash storage 214.

[0021] The control panel 215 is a touch-enabled display (touch panel). Camera 216 is a camera module that can be used for taking photos and videos, and for capturing QR codes (registered trademark), etc. Front camera 217 is a camera that can be used for taking pictures of the mobile device user and for facial recognition. Fingerprint sensor 218 is a sensor that can be used for fingerprint authentication. Communication unit 219 is a network interface for wireless communication.

[0022] <Hardware configuration of information processing device 105> Figure 2(c) is a simplified diagram illustrating the hardware configuration of the information processing device 105. The CPU 221 is a central processing unit (processor) that controls the operation of the entire information processing unit 105. RAM223 is a volatile memory and work area, used as a temporary storage area for deploying various control programs stored in ROM222 and flash storage224.

[0023] ROM222 is a non-volatile memory that stores the boot program for the information processing unit 105, among other things. Flash storage 224 is a non-volatile memory storage with a larger capacity compared to RAM 223. The flash storage 224 stores the control program for the mobile device. The OS and application programs are also stored in flash storage 224.

[0024] Display 225 is a display that shows the UI displayed by the application program. Display 225 may be an external device. Display 225 may also be a display with a touch panel. USB226 is an interface for USB connections. For example, a keyboard can be connected to USB226. Alternatively, the keyboard may be pre-installed in the main unit of the information processing device 105. The communication unit 227 is a network interface for wired LAN communication.

[0025] <Software Configuration> Figure 3 is a simplified diagram illustrating the software configurations of the MFP 101, mobile terminal 102, and information processing device 105. The software configuration of the MFP 101 is achieved by the CPU 201 of the MFP 101 reading and executing programs stored in the HDD 204, etc. The software configuration of the mobile terminal 102 is achieved by the CPU 211 of the mobile terminal 102 reading and executing programs stored in the flash storage 214, etc. The software configuration of the information processing device 105 is achieved by the CPU 221 of the information processing device 105 reading and executing programs stored in the flash storage 224, etc.

[0026] (MFP101) The MFP101 includes an authentication service 301 for authenticating users who use the MFP101. The authentication service 301 includes a local login service 302, a remote login service 303, and a FIDO (Fast IDentity Online) service 304.

[0027] The local login service 302 displays a login screen on the control panel 205, authenticates users who wish to use the control panel, and allows them to log in to the control panel. The remote login service 303 authenticates users accessing the web service (remote UI) via the communication unit 208 and logs them into the remote UI.

[0028] FIDO Service 304 includes web server functionality that enables communication via HTTP (Hypertext Transfer Protocol). Furthermore, FIDO Service 304 incorporates WebAuthn (Web Authentication) authentication functionality as defined by the FIDO Alliance and the W3C (World Wide Web Consortium).

[0029] The MFP101's local UI service 305 provides a user interface for delivering functions to users logged into the control panel. The local UI service 305 includes a UI platform that controls menus for users to select functions, applications, and screen transitions. For example, the local UI service 305 includes a "Copy" application that provides a UI for the copy function, a "Print" application that provides a UI for the print function, and a "Scan and Send" application that provides a UI for sending scanned documents externally.

[0030] The MFP101's remote UI service 306 provides a user interface displayed on the information processing device 105's web browser 317 to users who have logged into the web service. The remote UI service 306 includes personal settings / administrative settings for users to change function settings, applications, a web server, etc.

[0031] The printer control unit 308 is a software module that controls the printer 206. The scanner control unit 307 is a software module that controls the scanner 207. Each of these software modules provides an API (Application Programming Interface) to the application to operate the printer 206 and scanner 207. Although not shown in the diagram, the software configuration of the MFP101 includes the operating system and driver software for controlling various hardware components.

[0032] (Mobile device 102) The OS311 of the mobile device 102 is the operating system. OS311 consists of devices such as those running Apple's iOS or Google's Android (registered trademark).

[0033] Authenticator 312 is software that provides FIDO authenticator functionality as defined by the FIDO Alliance. The functionality of Authenticator 312 may also be integrated into the operating system (OS311) as a function of the operating system.

[0034] Camera application 313 is an application that controls the camera 216 and the front camera 217 to take photos and videos. Camera application 313 also has the function of capturing and decoding QR codes (registered trademark). Web browser 314 is software that operates as a client function for HTTP communication. Web browser 314 consists of Apple's Safari, Google's Chrome, Microsoft's Edge, and others.

[0035] (Information processing device 105) The OS315 of the information processing device 105 is the operating system. Authenticator 316 is software that provides FIDO authenticator functionality as defined by the FIDO Alliance. The functionality of Authenticator 316 may also be integrated into the operating system (OS315) as a function of the operating system. Web browser 317 is software that operates as a client function for HTTP communication. Web browser 317 consists of Apple's Safari, Google's Chrome, Microsoft's Edge, and others.

[0036] <User Account> Figure 4 is an example of a user database stored on the HDD204 of the MFP101. MFP101 stores and manages user account information in user database 401. Alternatively, user database 401 may be a database on another node on the network, provided that the communication path and storage are encrypted and tamper-proof. User database 401 records information such as user ID, password, passkey information (credential ID, public key) used for FIDO authentication, role, email address, and whether password authentication is enabled or disabled.

[0037] In user database 401, "User ID" is an identifier used to identify a user. "Password" is the password used for authentication. A "role" is information indicating a user's access rights to the MFP101. Examples of each role and access rights are shown in Role Information Table 402. The information in Role Information Table 402 is set at the time of shipment of the MFP101. In addition to the role definitions that the MFP101 has from the factory, users may also be allowed to set detailed access rights, create new roles, and register them in Role Information Table 402. It is also possible to modify the definitions of existing roles. "Email" refers to information that indicates the user's email address.

[0038] User account information can be registered, edited, and deleted via the user account management screen 602 and user account editing screen 603 shown in Figure 6, and the user account management screen 802 and user information modification / editing screen 803 shown in Figure 8, which will be described later. The user database 401 is referenced by the user authentication service 301 to authenticate users. Passkey information (credential ID, public key) is stored via the FIDO service 304. The user database 401 can store and manage separate passkey information: passkey information (credential ID, public key) for the local UI (LUI) and passkey information (credential ID, public key) for the remote UI (RUI).

[0039] <User Authentication Function> Next, with reference to Figures 5, 6, 7, and 8, the user authentication function of the MFP101 will be explained.

[0040] (User authentication feature in the local UI) Figure 5 illustrates the login screen, menu screen, and passkey registration screen of the local UI displayed on the operation panel 205. Figure 6 illustrates the settings screen for logging into the local UI and managing user accounts, which is displayed on the control panel 205. The screen shown in Figure 6 is displayed when a setting menu is selected from the management settings screen 504 shown in Figure 5. For example, selecting "Local UI Login Method Settings" displays the Local UI Login Method Settings screen 601.

[0041] The local UI login method settings screen 601 allows users to select how to log in to the operation panel. In this embodiment, "Password Authentication" and "Mobile Authentication (Passkey Authentication)" can be selected and enabled.

[0042] Password authentication provides a method for logging in by entering a user ID and password. In password authentication, the password authentication screen 502 is displayed on the control panel 205 as the login screen to authenticate the user. The user ID and password are entered using a hard key provided on the control panel 205 of the MFP101, or a software key (not shown). The local login service 302 accepts the user ID and password input via the hard key or software key. The local login service 302 then verifies whether user account information matching the accepted user ID and password combination exists in the user database 401. If matching user account information exists, the local login service 302 considers user authentication successful and displays the post-login menu screen.

[0043] In mobile authentication (passkey authentication), the local login service 302, the FIDO service 304, and the authenticator 312 of the mobile terminal 102 work together to authenticate the user using a technology that utilizes Public Key Infrastructure (PKI) defined by FIDO, called a passkey.

[0044] If password authentication is enabled on the local UI login method settings screen 601, the MFP101 will display the password authentication certificate screen 502 on the control panel 205 as the login screen to authenticate the user. Furthermore, if mobile authentication (passkey authentication) is enabled, the MFP101 will display the mobile authentication screen 501 on the control panel 205 as the login screen to authenticate the user. Furthermore, if both password authentication and mobile authentication (passkey authentication) are enabled, the MFP101 displays the password authentication display button 510 and the mobile authentication display button 511 on the login screen, allowing the user to switch between the login screens (password authentication screen 502 / mobile authentication screen 501). Details regarding passkey registration and passkey authentication methods will be provided later.

[0045] If user authentication is successful via password authentication or mobile authentication (passkey authentication), the local login service 302 logs the user into the control panel 205. Upon successful login, the local UI service 305, which detected the user's login, displays the menu screen 503 on the control panel 205. The local UI service 305 then provides functions that are based on user authentication.

[0046] Features that require user authentication include, for example, the printing function using printer 206 with predetermined print settings. For instance, if a user assigned the Administrator or GeneralUser role is authenticated, they will be able to print in color. Conversely, if a user assigned the LimitedUser role is authenticated, they will only be allowed to print in black and white.

[0047] Furthermore, a function that requires user authentication is the ability to transmit image data obtained by scanning with scanner 207 to an external device. For example, this function is provided when a user with the Administrator or GeneralUser role is authenticated.

[0048] Furthermore, a feature that relies on user authentication is the ability to use the address book when specifying the destination for image data obtained by scanning with scanner 207. The address book is a list containing information on one or more destinations. For example, a user assigned the GeneralUser role can select a destination from the address book to specify the destination for image data. In addition, a user assigned the Administrator role can not only select a destination from the address book, but also register new destinations in the address book and edit the address book.

[0049] Furthermore, a function that relies on user authentication is the ability to configure the MFP101. As shown on the management settings screen 504, the MFP101 configuration includes settings for the local UI login method, settings for each user account, device settings, and network settings. These configuration functions are provided when a user with the Administrator role is authenticated, allowing them to configure the MFP101. Device settings include options for displaying the history recorded during job execution on the control panel 205, and other settings related to print and scan jobs. Network settings include options for allowing the use of various printing protocols during printing.

[0050] (User authentication function for remote UI) Figure 7 illustrates the login screen of the remote UI displayed in the web browser 317, the device status screen displayed after login, and the screen related to passkey registration. Figure 8 illustrates the settings screen for logging into the remote UI and managing user accounts, which is displayed in the web browser 317. The screen shown in Figure 8 is displayed by pressing the settings registration menu 711 on the device status screen 708 shown in Figure 7. Furthermore, the screen display in Figure 8 can be switched by selecting the switching menu 810.

[0051] The remote UI login method settings screen 801 allows users to select how to log in to the remote login service 303. In this embodiment, "password authentication" cannot be disabled from the remote UI login method settings screen 801, but "mobile authentication (passkey authentication)" can be enabled or disabled.

[0052] Password authentication provides a method of logging in by entering a user ID and password. Specifically, the remote login service 303 displays the password authentication screen 709 as a login screen on the web browser 314 of the information processing device 105. The user can enter the user ID and password using a keyboard or the like provided in the information processing device 105. When the remote login service 303 receives the user ID and password via HTTP communication, it verifies whether user account information that matches the received combination of the user ID and password exists in the user database 401. If the matching user account information exists, the remote login service 303 displays the post-login device status screen 708 on the web browser 314, assuming that the user authentication has succeeded.

[0053] Mobile authentication (passkey authentication) is a technology that authenticates a user using PKI (Public Key Infrastructure) defined by FIDO, which is called a passkey, through the cooperation of the remote login service 303, the FIDO service 304, the authenticator 316 of the information processing device 105, or the authenticator 312 of the mobile terminal 102.

[0054] When mobile authentication (passkey authentication) is enabled, the passkey authentication screen 701 is displayed on the web browser 317 as a login screen to authenticate the user. If the user authentication is successful by password authentication or mobile authentication (passkey authentication), the remote login service 303 allows the user to log in to the screen displayed on the web browser 317. When the login is successful, the remote UI service 306 that detects the user's login displays the device status screen 708 on the web browser 317.

[0055] <FIDO Service Function> FIDO Service 304 includes web server functionality that can communicate using HTTP (Hypertext Transfer Protocol). Furthermore, FIDO Service 304 includes WebAuthn authentication functionality as defined by the FIDO Alliance and the W3C.

[0056] The FIDO service 304 is accessed via HTTPS communication from the web browser 317 of the information processing device 105. The FIDO service 304, as a web server, provides access and functionality for URLs 1 to 3, for example, as follows.

[0057] URL1: https: / / MFP101.office.local / RemoteUI / registration / URL1 is the URL that returns HTML for passkey registration. URL1 is associated with the "Passkey Registration" button on the passkey registration screen 703, which will be described later. The HTML returned by URL1 for passkey registration includes JavaScript to access the REST (Representational State Transfer) APIs at URL2 and URL3 below. Additionally, this HTML for passkey registration includes WebAuthn JavaScript as defined by FIDO 2.0. Output JSON data = await navigator.credentials.create(input JSON data);

[0058] URL2: https: / / MFP101.office.local / RemoteUI / registration / challenge URL2 is the URL of a REST API that returns input JSON data to be input to the navigator.credentials.create() API mentioned above. The input JSON data includes challenge data issued by FIDO service 304. The challenge is a random number.

[0059] URL3:https: / / MFP101.office.local / RemoteUI / registration / verification URL3 is the URL of the REST API that FIDO service 304 uses to receive information for passkey registration, and it receives the output JSON data output by the navigator.credentials.create() API mentioned above. The output JSON data includes the credential ID, challenge, public key, transport, digital signature, etc., issued by the mobile device 102.

[0060] URL4:https: / / MFP101.office.local / LocalUI / authentication / random_numbers URL4 is a URL that responds with HTML for passkey authentication and is embedded in the QR code displayed on the mobile authentication screen 501. The random number included in URL4 is a string such as "b15dee080a1a549be6e3c74e6b59f5c5". The HTML for passkey authentication returned from URL4 includes JavaScript for accessing the REST APIs of URL5 and URL6, as well as WebAuthn JavaScript as defined by FIDO2.0, as shown below. Output JSON data = await navigator.credentials.get(input JSON data);

[0061] URL5:https: / / MFP101.office.local / LocalUI / authentication / challenge URL5 is the URL of the REST API that returns input JSON data to be input to navigator.credentials.get() mentioned above. The input JSON data includes a challenge issued by FIDO service 304. The challenge is a random number.

[0062] URL6:https: / / MFP101.office.local / LocalUI / authentication / verification URL6 is the URL of the REST API to which the FIDO service 304 receives information for passkey authentication, and receives the output JSON data output by the navigator.credentials.get() API mentioned above. The output JSON data includes the credential ID of the passkey used for digital signing, the challenge, and the digital signature.

[0063] <Passkey Registration Sequence> Refer to the sequence diagram in Figure 9 to explain the processing flow related to passkey registration. Figure 9 illustrates the sequence of passkey registration for the remote UI. In the sequence shown in Figure 9 and Figure 10 (described later), the processing of the MFP 101 is achieved by the CPU 201 of the MFP 101 reading and executing a program stored in the HDD 204 or the like. The processing of the mobile terminal 102 is achieved by the CPU 211 of the mobile terminal 102 reading and executing a program stored in the flash storage 214 or the like. The processing of the information processing device 105 is achieved by the CPU 221 of the information processing device 105 reading and executing a program stored in the flash storage 224 or the like. Figure 13(a) is an example of the operation screen of the mobile terminal 102 during passkey authentication.

[0064] In S901, when the user launches the web browser 317 of the information processing device 105 and enters the login URL for the remote UI into the URL input field, the web browser 317 of the information processing device 105 proceeds to S902. At S902, the web browser 317 of the information processing device 105 accesses the login URL mentioned above. When the FIDO service 304 of the MFP 101 detects access to the login URL, it proceeds to S903.

[0065] At S903, the FIDO service 304 of the MFP101 sends HTML to the web browser 317 of the information processing device 105 to display the passkey authentication screen 701. Upon receiving this HTML, the web browser 317 of the information processing device 105 displays the passkey authentication screen 701 according to the HTML.

[0066] In S904, when the web browser 317 of the information processing device 105 detects that the user has clicked the link 713 to register a passkey, it proceeds to S905. At S905, the web browser 317 of the information processing device 105 accesses the passkey registration URL. When the FIDO service 304 of the MFP 101 detects access to the above passkey registration URL, it proceeds to S906.

[0067] At S906, the FIDO service 304 of the MFP101 sends HTML to the web browser 317 of the information processing device 105 to display the user authentication screen 702. Upon receiving this HTML, the web browser 317 of the information processing device 105 displays the user authentication screen 702 according to the HTML.

[0068] At S907, when the web browser 317 of the information processing device 105 detects that the user has entered a username and password and pressed the authentication button, it proceeds to S908. At S908, the web browser 317 of the information processing device 105 sends the entered username and password to the FIDO service 304 of the MFP 101. Upon receiving this username and password, the FIDO service 304 of the MFP 101 proceeds to S909.

[0069] In S909, the FIDO service 304 of MFP101 performs user authentication by comparing the received username (user ID) and password combination with the user account information stored in the user database stored on HDD204. If user authentication fails, the FIDO service 304 of the MFP101 notifies the web browser 317 of the information processing device 105 of the error (not shown). On the other hand, if user authentication is successful, the FIDO service 304 of MFP101 proceeds to process S910.

[0070] At S910, the FIDO service 304 of the MFP101 sends HTML to the web browser 317 of the information processing device 105 to display the passkey registration screen 703. Upon receiving this HTML, the web browser 317 of the information processing device 105 displays the passkey registration screen 703 according to the HTML.

[0071] At S911, when the web browser 317 of the information processing device 105 detects that the user has pressed the "Passkey Registration Button," it proceeds to S912. At S912, the web browser 317 of the information processing device 105 accesses URL1. When the FIDO service 304 of the MFP 101 detects the access to URL1, it proceeds to S913.

[0072] At S913, the FIDO service 304 of the MFP101 verifies the accessed URL1 and responds to the web browser 317 of the information processing device 105 with HTML to display the HTML screen 704 for passkey registration. This HTML for passkey registration includes JavaScript for accessing the REST APIs of URL2 and URL3, as well as WebAuthn JavaScript as defined in FIDO2.0, as shown below. Output JSON data = await navigator.credentials.create(input JSON data); Furthermore, the header of the communication packet responded to in S913 includes a session ID for storage in the web browser 317's cookie. The session ID is used to verify that access to URL1 and subsequent accesses to URL2 and URL3 are performed within the same session. If URL2 or URL3 is accessed directly without a session ID in the cookie, the FIDO service 304 can return an error without processing the request.

[0073] Upon receiving the HTML from S913, the web browser 317 displays a passkey creation method selection screen 704 according to the HTML, and prompts the user to select a passkey creation method. When the system detects that the user has selected "Use phone or tablet" (710) as the method for creating a passkey, it proceeds to process S914.

[0074] At S914, the web browser 317 of the information processing device 105 executes the JavaScript included in the HTML for passkey registration and accesses URL2. Upon receiving access to URL2, FIDO service 304 generates a challenge at S915. The challenge is a random number.

[0075] Next, in S916, the FIDO service 304 of the MFP101 responds to the web browser 317 of the information processing device 105 with input JSON data including the challenge generated in S914. In addition to the challenge, the input JSON data also includes server information (for example, a hostname or domain name such as MFP101.office.local) and a user ID.

[0076] When the web browser 317 of the information processing device 105 receives the above input JSON data, it proceeds to process S917. On S917, the web browser 317 uses the received input JSON data to execute the following WebAuthn JavaScript, generating a QR code and displaying QR screen 705. Output JSON data = await navigator.credentials.create(input JSON data);

[0077] Next, on S918, the user launches the camera application 313 from their mobile device 102 and takes a picture of the QR code displayed on the web browser 317. Next, at S919, the camera application 313 of the mobile terminal 102 reads the captured QR code and displays the connection screen 1301 (Figure 13(a)) based on the read data. When the user presses the "Allow" button on the connection screen 1301, the mobile terminal 102 uses the data read from the QR code to start BLE (Bluetooth® Low Energy) pairing and communication with the information processing device 105 and activates the authenticator 312.

[0078] Next, in S920, the authenticator 312 of the mobile terminal 102 authenticates the owner of the mobile terminal 102 using one of the following methods: facial recognition, fingerprint recognition, PIN code, pattern recognition, etc. For example, the authenticator 312 prompts the user to enter their fingerprint, and when the user enters their fingerprint, it authenticates the user using the fingerprint. If user authentication is successful, the authenticator 312 proceeds to S921.

[0079] Next, in S921, the authenticator 312 generates a key pair called a passkey (PKI private key and public key) and a credential ID to identify the passkey, and stores it in a tamper-proof memory area, associating it with server information (e.g., MFP101.office.local) and a user ID.

[0080] Next, in S922, the authenticator 312 uses the generated secret key to digitally sign the data, including the challenge data received from the information processing device 105. Next, in S923, the authenticator 312 returns the generated public key, credential ID, digital signature, etc., to the web browser 317 of the information processing device 105.

[0081] When the web browser 317 of the information processing device 105 receives the generated public key, credential ID, digital signature, etc., it proceeds to process S924. At S924, the web browser 317 accesses URL3 and sends output JSON data, including the public key, credential ID, transport, and digital signature, to the FIDO service 304. When the FIDO service 304 of MFP101 receives the above output JSON data, it proceeds to process it in S925.

[0082] In S925, FIDO service 304 verifies the digital signature using the challenge it issued in S915 and the public key it received. Specifically, FIDO service 304 decrypts the digital signature using the received public key to verify whether the digital signature is identical to the challenge it issued. If they are identical, the verification of the digital signature is considered successful; otherwise, it is considered a failure. If the verification of the digital signature is successful, FIDO service 304 proceeds to S926.

[0083] In S926, FIDO service 304 stores passkey information (public key, credential ID) associated with the user ID in the user database on HDD204 as passkey information for the remote UI.

[0084] Next, in S927, FIDO service 304 verifies the above transport. If the above transport is hybrid, the FIDO service 304 sends HTML to the web browser 317 of the information processing device 105 at S928 to display the passkey sharing settings screen 706. When the web browser 317 of the information processing device 105 receives the HTML, it displays the passkey sharing settings screen 706 according to the HTML.

[0085] Next, in S929, when the web browser 317 receives a local UI passkey registration instruction from the user (by pressing the "Yes" button on the passkey sharing settings screen 706), it sends the local UI passkey registration instruction to the FIDO service 304 of the MFP101. When the FIDO service 304 of MFP101 receives the above local UI passkey registration instruction, it proceeds to process S930.

[0086] On S930, FIDO service 304 stores passkey information (public key, credential ID) associated with the user ID in the user database on HDD204 as passkey information for the local UI. Next, at S931, the FIDO service 304 notifies the remote login service 303 that the passkey registration is complete. When the remote login service 303 receives notification that the above passkey registration is complete, it proceeds to process S932.

[0087] In S932, the remote login service 303 sends a screen 707 to the web browser 317 of the information processing device 105, which allows the user to select whether or not to disable password authentication for the interface where the passkey registration has been completed. The web browser 317 of the information processing device 105 receives and displays a screen 707 that allows the user to choose whether or not to disable the password authentication.

[0088] When the web browser 317 detects that the user has selected the interface to disable password authentication (checked the box) on screen 707 where the user can choose whether or not to disable password authentication, and has pressed the "Yes" button, it sends an instruction to the MFP 101's remote login service 303 regarding whether or not to disable password authentication (S933).

[0089] When the remote login service 303 receives an instruction to disable password authentication, it checks whether the local UI and remote UI are checked based on that instruction. The remote login service 303 then stores the disabled password authentication in the user database on HDD204, associating it with the user ID for the checked items (S934). Users who have disabled password authentication will no longer be able to log in with their user ID and password, and the MFP101 controls them so that they can only log in to the local UI or remote UI using mobile authentication (passkey authentication).

[0090] Furthermore, enabling / disabling password authentication for each user, checking the registration status of passkeys, and deleting registrations can be done on the user information editing screen 803 (Figure 8). The user information change / editing screen 803 is a screen that can be viewed and edited by administrator users who have been assigned the Administrator role and have the authority to change the management settings of the MFP101.

[0091] When the authentication service 301 authenticates an administrator user with the Administrator role assigned and logs them into the remote UI, the remote UI service 306 displays the device status screen 708 (Figure 7). Furthermore, when the remote UI service 306 accepts the selection of setting registration 711 on the device status screen 708, it displays the remote UI login method setting screen 801. Then, when the remote UI login method setting screen 801 accepts the selection of "User Account Management" from menu 810, it displays the user account management screen 802. On the user account management screen 802, the administrator selects the user they want to edit and presses the "Edit" button. When the remote UI service 306 detects the press of the "Edit" button, it displays the user information change editing screen 803 for the selected user.

[0092] Furthermore, when the authentication service 301 authenticates a general user assigned the GeneralUser role and logs them into the remote UI, the remote UI service 306 controls the system so that it does not accept the selection of management settings. Therefore, the general user cannot view the user account management screen 802. When the general user selects the setting registration 711 displayed on the device status screen 708, the remote UI service 306 displays the user information change / edit screen 803 for the logged-in general user's account.

[0093] On the user information editing screen 803, disabled password authentication can be re-enabled by pressing the "Enable" button 804. Note that if a passkey is registered and password authentication is enabled, the "Disable" button will be displayed instead of the "Enable" button 804, allowing the user to disable password authentication. Alternatively, if a passkey is not registered, disabling password authentication would leave the user with no way to log in; therefore, the system may be configured to prevent password authentication from being disabled if a passkey is not registered. Furthermore, if a passkey is registered, the passkey registration can be deleted by pressing the "Delete Registration" button 805. Since deleting a passkey registration prevents the user from logging in with the passkey, it is advisable to configure the system to automatically re-enable disabled password authentication if it is disabled. Also, if a passkey is not registered, the passkey registration status will display "Not Registered." If a passkey is not registered, the "Delete Registration" button 805 should be grayed out or hidden.

[0094] Although details are omitted here, the login method settings screen 601, user account management screen 602, and user account editing screen 603 in Figure 6 are screens displayed on the operation panel 205, and their functions are the same as those of the login method settings screen 801, user account management screen 802, and user information modification / editing screen 803 shown in Figure 8.

[0095] As described above, the FIDO service 304 displays a registration QR code on the web browser 317 (password authenticated) of an external device (information processing device 105) that accesses the MFP 101 via the network. The user reads this QR code with their mobile terminal 102, and the authenticator 316 of the mobile terminal 102 performs authentication. If the authentication is successful, the authenticator 316 generates a digital signature on the data containing the private key and public key pair and the challenge data generated by the FIDO service 304, and sends the public key, digital signature, etc. as passkey information to the FIDO service 304. The FIDO service 304 then receives this passkey information, verifies the received passkey information, associates it with the remote UI, and registers it in the user database. This makes it possible to register a passkey for the remote UI to set up authentication using the authentication function of the mobile terminal. Furthermore, when a passkey is registered for the remote UI, the FIDO service 304 receives a user selection from the web browser 317 regarding whether or not to use the remote UI passkey information for the local UI. If the user selects to use it for the local UI, the FIDO service 304 further associates the remote UI passkey information with the local UI and registers it in the user database. This allows for passkey registration to be set up for authentication using the mobile device's authentication function for the local UI as well. In this way, it becomes possible to register passkeys registered for the remote UI in the local UI as well.

[0096] Furthermore, if a passkey for the remote UI is registered and a passkey for the local UI is already registered for that user, the system may choose to display a screen 707 to select whether or not to disable password authentication without displaying the passkey sharing settings screen 706 (i.e., without accepting user selection for passkey sharing).

[0097] <Passkey Authentication Sequence> The following describes the process of logging into the local UI using the passkey registered in S930 in Figure 9, referring to the sequence diagram in Figure 10. Figure 10 illustrates the process sequence for logging into the local UI using a passkey. Figure 13(b) is an example of the operation screen of the mobile terminal 102 during passkey authentication.

[0098] In S1001, the local login service 302 starts displaying the mobile authentication screen 501 if the user is not logged in. For example, if a logged-in user logs out, the mobile authentication screen 501 is displayed. Alternatively, the system may be configured to display the mobile authentication screen 501 when the MFP101 is powered on.

[0099] Next, at S1002, the local login service 302 generates a random number. The random number is a string such as "b15dee080a1a549be6e3c74e6b59f5c5". Next, at S1003, the local login service 302 transmits and shares the generated random numbers with the FIDO service 304. The method of transmission may be via an API, or by temporarily storing them in RAM 203 or HDD 204 and then sharing them; there are no particular limitations on the means or timing. Furthermore, the random numbers may be generated by the FIDO service 304 or other modules, rather than the local login service 302, and then shared with the local login service 302.

[0100] Next, in S1004, the local login service 302 generates a QR code and controls its display to show the QR code on the mobile authentication screen 501. This QR code contains the URL4 data, which includes the random number generated in S1002. The random number is information that only the person scanning the QR code would know, and its purpose is to confirm that the user accessing URL4 is in front of the control panel.

[0101] Next, in S1005, the user launches the camera application 313 from their mobile device 102 and takes a picture of the QR code from S1004 displayed on the operation panel 205. Next, at S1006, the camera application 313 launches the web browser 314. Next, in S1007, the web browser 314 accesses the URL 4 address obtained from the QR code.

[0102] In S1008, the FIDO service 304 of the MFP101 detects access to URL4. It verifies the accessed URL, and if the random number obtained in S1003 is not included in the accessed URL, it responds to the web browser 314 with an error such as "HTTP 404 Not Found". On the other hand, if the random number obtained in S1003 is included, the FIDO service 304 of the MFP101 proceeds to S1009.

[0103] At S1009, the FIDO service 304 responds to the web browser 314 of the mobile terminal 102 with HTML for displaying the HTML screen 1311 (Figure 13(b)) for passkey authentication. The FIDO service 304 includes JavaScript in the HTML for passkey authentication to access the REST APIs of URL5 and URL6. The FIDO service 304 also includes WebAuthn JavaScript as defined in FIDO2.0, as shown below, in the HTML for passkey authentication. <WebAuthnのJavaScript> Output JSON data = await navigator.credentials.get(input JSON data);

[0104] When the web browser 314 of the mobile terminal 102 receives the HTML for passkey authentication responded to by the FIDO service 304 in S1009, it displays the HTML screen 1311 for passkey authentication. The FIDO service 304 includes a session ID in the header of the communication packet responded to in S1009 for storage in the web browser 314's cookie. This session ID is used to confirm that the access to URL4, which underwent random number verification in S1008, and the subsequent accesses to URL5 and URL6 are performed within the same session. If URL5 or URL6 is accessed directly without a session ID in the cookie, the FIDO service 304 can return an error without processing the request.

[0105] Furthermore, when the web browser 314 displays the HTML screen 1311 for passkey authentication, it is desirable that it automatically executes the JavaScript contained within the HTML for passkey authentication and accesses URL 5 without requiring any user interaction with the web browser. This can be achieved by using the JavaScript onload event, which is called when the HTML of HTML screen 1311 has been fully loaded into the web browser 314.

[0106] Upon receiving access to URL5, FIDO service 304 generates a challenge in S1011. The challenge is a random number. Next, in S1012, the FIDO service 304 responds to the web browser 314 with input JSON data, including the challenge generated in S1011. The input JSON data also includes information about the MFP101 server (for example, a hostname or domain name such as MFP101.office.local). When the web browser 314 receives the response to S1011, it proceeds to process S1013.

[0107] In S1013, the web browser 314 uses the received input JSON data to execute the following WebAuthn JavaScript and activate the authenticator 312. If the authenticator 312 manages multiple passkeys associated with the server information of the MFP101, it may display a screen for selecting one passkey from among the multiple passkeys. <WebAuthnのJavaScript> Output JSON data = await navigator.credentials.create(input JSON data);

[0108] Next, in S1014, the authenticator 312 authenticates the owner of the mobile terminal 102 using one of the following methods: facial recognition, fingerprint recognition, PIN code, pattern recognition, etc. For example, the authenticator 312 may prompt the user to enter their fingerprint, and when the user enters their fingerprint, the authenticator 312 authenticates the user using the fingerprint. If user authentication is successful, the authenticator 312 proceeds to S1015.

[0109] In S1015, the authenticator 312 retrieves the passkey (PKI private key) stored in association with the server information of MFP101 (e.g., MFP101.office.local) contained in the input JSON data received in S1011. The authenticator 312 then generates a digital signature on the data containing the challenge received in S1012 using the PKI private key. The authenticator 312 then returns the output JSON data to the web browser 314. The authenticator 312 includes the digital signature and the credential ID of the passkey used for the digital signature in this output JSON data.

[0110] When the web browser 314 receives the output JSON data from the authenticator 312, it proceeds to process S1016. In S1016, the web browser 314 accesses URL 6 using JavaScript included in the HTML for passkey authentication and sends output JSON data containing the public key, credential ID, and digital signature to the FIDO service 304. When FIDO service 304 detects access to URL6, it proceeds to S1017.

[0111] In S1017, FIDO service 304 refers to the user database on HDD204 and retrieves the user ID and public key of the account associated with the credential ID contained in the received output JSON data.

[0112] Next, in S1018, FIDO service 304 verifies the digital signature received in S1016 using the challenge it issued in S1011 and the public key obtained from the user database in S1017. Specifically, FIDO service 304 decrypts the digital signature using the public key to verify whether the digital signature is identical to the challenge it issued. If it is identical to the challenge it issued and the digital signature verification is successful, it determines that authentication is successful. On the other hand, if the digital signature verification fails, it determines that authentication is unsuccessful.

[0113] Next, at S1019, the FIDO service 304 responds to the web browser 314 regarding the success or failure of the authentication. The web browser 314 receives the success or failure of the authentication response from the FIDO service 304.

[0114] Furthermore, if authentication is successful in S1018, FIDO service 304 requests login to the control panel from local login service 302 in S1020. The login request includes the user ID. When the local login service 302 receives this request, it proceeds to process S1021.

[0115] In S1021, the local login service 302 performs login processing to log in the user with the user ID specified in the login request in S1020 to the control panel. Specifically, the local login service 302 refers to the user database on HDD204 and obtains user information such as the user ID, role, and email address of the account to be logged in. Furthermore, the local login service 302 notifies the local UI service 305 of the login event. The login event includes the information of the user to be logged in.

[0116] Finally, in S1022, the local login service 302 closes the mobile authentication screen 501 displayed in S1001, and the local UI service 305 displays the menu screen 503, ending the login process.

[0117] If the local UI service 305 successfully completes the verification in S1018 above, it will provide the user with functions that require user authentication. The functions that require user authentication and are provided upon successful verification are as described above in the explanation of the user authentication function.

[0118] As described above, the local login service 302 displays an authentication QR code on the local UI, and the user reads this QR code with the mobile terminal 102 to perform authentication by the authenticator 316 on the mobile terminal 102. If the authentication is successful, the authenticator 316 generates signature data based on this and sends it to the FIDO service 304. The FIDO service 304 then receives this signature data and verifies the received passkey information using the passkey information registered in association with the local UI, thereby enabling mobile authentication (passkey authentication) of the local UI.

[0119] Similarly, the remote login service 303 displays an authentication QR code on the web browser 317 of the information processing device 105 (external device) that accesses the MFP 101 via the network. The user reads this QR code with their mobile terminal 102, and the authenticator 316 on the mobile terminal 102 performs authentication. If the authentication is successful, the authenticator 316 generates signature data based on this and sends it to the FIDO service 304 via the web browser 317. The FIDO service 304 then receives this signature data and verifies the received passkey information using the passkey information registered in association with the remote UI, thereby enabling mobile authentication (passkey authentication) of the remote UI.

[0120] If verification fails in S1018, the FIDO service 304 notifies the web browser 314 of the failure in S1019. Examples of failures include "the specified user ID is not registered in the user database," "the passkey public key is not registered in association with the user ID," or "digital signature verification failed" in S1018. The FIDO service 304 may also notify the local login service 302 of the error if verification fails, and display an authentication failure message on the mobile authentication screen 501.

[0121] Furthermore, the random number stored in the QR code on the mobile authentication screen 501 should be updated with a new random number when a notification of successful or failed authentication is received. Even when no notification of successful or failed authentication is received, it is safer to update it periodically to shorten the lifetime of the random number.

[0122] Furthermore, the above configuration shows an example where the web browser 314, having completed receiving the HTML for the passkey authentication HTML screen 1311 in S1009, receives the JavaScript onload event, automatically executes JavaScript, and accesses URL5. However, instead of the passkey authentication HTML screen 1311, a screen with a "Passkey Authentication" button, such as the passkey authentication HTML screen 1312, may be used, and the web browser 314 may execute JavaScript and access URL5 upon detecting that the user has pressed the "Passkey Authentication" button. Alternatively, a screen with a text field for entering a user ID, such as the passkey authentication HTML screen 1313, may be used, and the web browser 314 may execute JavaScript and access URL5 upon detecting that the user has entered a user ID and pressed the "Passkey Authentication" button. In this case, the user ID is included in the URL5 access in S1010. Upon receiving this, the FIDO service 304 can retrieve the credential ID associated with the user ID from the user database and include the credential ID in the response in S1012. This allows the authenticator 312 to manage multiple passkeys, but to narrow down the passkey used based on the credential ID to just one.

[0123] <Passkey Sharing Flowchart> Figure 11 is a flowchart illustrating the process of registering a passkey in the remote UI of the information processing device 105. Specifically, it details the process by which the FIDO service 304 of the MFP 101 receives access to URL3 at S924 in Figure 9, and registers the passkey at S925-S934. The processing of the MFP 101 in this flowchart is achieved by the CPU 201 of the MFP 101 reading and executing a program stored in the HDD 204 or the like.

[0124] In S1101, the FIDO service 304 of MFP101 detects access to URL3 and, upon receiving output JSON data including the public key, credential ID, transport, and digital signature, proceeds to S1102. In S1102, FIDO service 304 verifies the received digital signature. FIDO service 304 decrypts the digital signature using the received public key to verify whether the digital signature is identical to the challenge it issued. If they are identical, the verification of the digital signature is successful; otherwise, it is deemed unsuccessful.

[0125] Next, in S1103, the FIDO service 304 determines whether or not the verification of the digital signature was successful. If the digital signature verification fails at this point (resulting in No in S1103), the FIDO service 304 terminates the processing of this flowchart.

[0126] On the other hand, if the digital signature verification is successful (Yes in S1103), the FIDO service 304 proceeds to process S1104. In S1104, the FIDO service 304 associates the passkey information (public key and credential ID) received in S1101 with the user ID and stores it in the user database on HDD204 as passkey information for the remote UI.

[0127] Next, in S1105, the FIDO service 304 verifies whether the transport information of the received passkey is hybrid. When performing passkey authentication in the local UI, personal authentication is performed using the mobile terminal 102, as explained in S1005-S1019 of Figure 10. Therefore, only if the transport is hybrid, indicating a mobile terminal, can it be registered as a passkey in the local UI.

[0128] If the transport is not hybrid (No in S1005), FIDO service 304 terminates processing in this flowchart. On the other hand, if the transport is hybrid (Yes in S1005), FIDO service 304 proceeds to S1106. At S1106, the FIDO service 304 sends the HTML of the passkey sharing settings screen 706 to the web browser 317 of the information processing device 105.

[0129] At S1107, when the FIDO service 304 receives the user selection operation performed on the passkey sharing settings screen 706 from the web browser 317, it proceeds to S1108. At S1108, FIDO service 304 determines the user selection operation received above. If the user selection operation is "Register" (i.e., "Yes" is selected on the passkey sharing settings screen 706) (Yes in S1108), the FIDO service 304 proceeds to S1109.

[0130] In S1109, FIDO service 304 associates the above passkey information (public key, credential ID) with the user ID and stores it in the user database on HDD204 as passkey information for the local UI. At this time, if a passkey for the local UI is already registered, it may be overwritten, or the user may be given the option of whether or not to overwrite it.

[0131] After storing the passkey information in S1109, the FIDO service 304 proceeds to process S1110. At S1110, the remote login service 303 of the MFP101 sends the HTML of the password authentication deactivation screen 707 to the web browser 317 of the information processing device 105.

[0132] In S1111, when the remote login service 303 receives the user selection operation performed on the password authentication deactivation screen 707 from the web browser 317, it proceeds to S1112. At S1112, the remote login service 303 determines the user selection operation received above. If the user selection operation on the password authentication disablement screen 707 is "No" (No in S1112), the remote login service 303 terminates the processing of this flowchart.

[0133] On the other hand, if the user selection operation on the password authentication disable screen 707 is "Yes" (Yes in S1112), the remote login service 303 proceeds to S1113. In S1113, the remote login service 303 verifies whether the local UI is selected (checked) during the user selection operation. If the local UI is selected (checked) here (Yes in S1113), the remote login service 303 proceeds to S1114. At S1114, the remote login service 303 disables password authentication for the local UI and proceeds to S1115. On the other hand, if the local UI is not selected (checked) (No in S1113), the remote login service 303 proceeds directly to S1115.

[0134] In S1115, the remote login service 303 verifies whether the remote UI is selected (checked) during the user selection operation on the password authentication disable screen 707. If Remote UI is selected (checked) at this point (Yes in S1115), the Remote Login Service 303 proceeds to S1116. At S1115, the remote login service 303 disables password authentication for the remote UI and terminates the processing of this flowchart. On the other hand, if the remote UI is not selected (checked) (No in S1115), the remote login service 303 terminates the processing of this flowchart.

[0135] Furthermore, in S1108, if the user selection operation on the passkey sharing settings screen 706 is "Do not register" (i.e., "No" is selected on the passkey sharing settings screen 706) (No in S1108), the FIDO service 304 proceeds to S1117.

[0136] At S1117, the FIDO service 304 sends the HTML of the password authentication deactivation screen 715 to the web browser 317 of the information processing device 105. At S1118, when the MFP101's remote login service 303 receives the user selection operation performed on the password authentication deactivation screen 715 from the web browser 317, it proceeds to S1119.

[0137] At S1119, the remote login service 303 determines the user selection operation received above. If the user selection operation on the password authentication disablement screen 715 is "No" (No in S1119), the remote login service 303 terminates the processing of this flowchart.

[0138] On the other hand, if the user selection operation on the password authentication disable screen 715 is "Yes" (Yes in S1119), the remote login service 303 proceeds to S1120. At S1120, the remote login service 303 disables password authentication for the remote UI and terminates the processing of this flowchart.

[0139] The above configuration describes how to register a passkey for local UI login when a passkey for remote UI login has been registered. However, the reverse is also possible: you can register a passkey for remote UI login when registering a passkey for local UI login.

[0140] The following briefly explains the procedure for registering a passkey for remote UI login when registering a passkey for local UI login, using Figure 5. When the FIDO service 304 detects that the passkey registration button 512 has been pressed on the mobile authentication screen 501, it displays the user authentication screen 505 on the operation panel 205. When the FIDO service 304 detects that the user has entered a username and password and pressed the authentication button, it performs user authentication by comparing the entered username (user ID) and password combination with the user account information stored in the user database stored on the HDD 204. If this user authentication fails, the FIDO service 304 displays an error on the operation panel 205 (not shown). On the other hand, if this user authentication is successful, although the details are omitted, the FIDO service 304 generates a QR code and displays the QR screen 506 containing the QR code on the operation panel 205.

[0141] The user launches the camera application 313 from their mobile device 102 and photographs the QR code on the QR screen 506 displayed on the operation panel 205. The mobile device 102 then registers the local UI passkey based on the data read from the photographed QR code, similar to the passkey registration for remote UI login described above. Although details are omitted, the mobile device 102 authenticates the owner using fingerprint authentication or the like, generates a key pair called a passkey (PKI private key and public key) and a credential ID, and stores it in a tamper-proof storage area, associating it with server information (e.g., MFP101.office.local) and the user ID. Furthermore, it sends data including the public key, credential ID, transport, and digital signature to the FIDO service 304 of the MFP101. When FIDO service 304 receives the above data, it verifies the digital signature contained in the data. If the verification is successful, it stores the passkey information (public key, credential ID), associated with the user ID, in the user database on HDD204 as passkey information for the local UI.

[0142] Furthermore, the FIDO service 304 displays the passkey sharing settings screen 507 on the operation panel 205, similar to the case of passkey registration for remote UI login described above. When the "Yes" button on the passkey sharing settings screen 507 is pressed, the FIDO service 304 stores the passkey information (public key, credential ID), associated with the user ID, in the user database on the HDD 204 as passkey information for the local UI. The FIDO service 304 then notifies the local login service 302 that the passkey registration is complete.

[0143] Furthermore, the local login service 302 displays a screen 509 on the operation panel 205 that allows the user to choose whether or not to disable password authentication for the interface where the passkey registration has been completed, similar to the case of passkey registration for remote UI login described above. When a user selects (checks) the interface to disable password authentication on screen 509 and presses the "Yes" button, the local login service 302 stores the disabled password authentication in the user database on HDD204, associating it with the user ID for the checked item.

[0144] If the "No" button is pressed on the passkey sharing settings screen 507, the local login service 302 displays screen 408, which allows the user to choose whether or not to disable password authentication. If the "Yes" button is pressed on screen 508, the local login service 302 stores the setting to disable password authentication in the user database on HDD 204, associating it with the user ID for the local UI items. This disables password authentication for the local UI. As described above, the passkey registered in the local UI can also be registered in the remote UI.

[0145] Alternatively, a display similar to the passkey sharing settings screen 507 may be shown when the passkey registration button 512 on screen 501 is pressed, or just before screen 506 is displayed, to allow the user to select whether to register the passkey simultaneously using multiple user interfaces. Similarly, a display such as the passkey sharing settings screen 706 may be shown when the passkey registration button 713 on screen 701 or the passkey registration button on screen 703 is pressed, or just before displaying screen 704, to allow the user to select whether to register the passkey simultaneously using multiple user interfaces.

[0146] Furthermore, if a passkey for the local UI is registered and a passkey for the remote UI is already registered for that user, the system may choose to display a screen 509 to select whether or not to disable password authentication without displaying the passkey sharing settings screen 507 (i.e., without accepting user selection for passkey sharing). In other words, if a passkey for one user interface is registered, and a passkey for another user interface is already registered for that user, the system may display a screen asking whether or not to disable password authentication without accepting the user selection for passkey sharing.

[0147] Note that the user interface for passkey registration is not limited to the remote UI or local UI; other interfaces may also be used. Mobile communication authentication, for example, may also be used. Furthermore, the MFP101 may have three or more user interfaces, and when a passkey is registered for one of these user interfaces, that passkey may also be registered for two or more other interfaces.

[0148] Note that the passkey authentication for the remote UI and the passkey authentication for the local UI may have significantly different operation flows. When the operation flows differ so greatly, even if a passkey is registered, the user may get confused during the login process. To solve this, in S1109 in Figure 11, after storing the passkey information for the local UI on the HDD, the FIDO service 304 may display (present) an operation guide on the operation panel 205 as shown in Figure 12.

[0149] Figure 12 is an example of the user interface for the guide display. First, screen 1201 explains the equipment required for login and instructs the user to prepare their mobile device. When the user presses the "Next" button on screen 1201, the operation screen switches to screen 1202.

[0150] Screen 1202 explains how to launch the camera application on a mobile device and scan the QR code on the control panel. When the user presses the "Next" button on screen 1202, the control screen switches to screen 1203.

[0151] Screen 1203 informs the user that they will need to perform identity verification (such as biometric authentication) on their mobile device. This allows the user to confirm how to log in to the local UI and reduces confusion when they first attempt passkey authentication on the control panel.

[0152] Similarly, when a local UI passkey is registered and that passkey is to be registered to the remote UI, a screen like Figure 12 will be displayed on the control panel 205 to guide the user through the equipment to be prepared and the authentication procedure for passkey authentication in the remote UI. This allows the user to confirm how to log in to the remote UI and reduces confusion when performing passkey authentication from an external device for the first time.

[0153] <Effects> As described above, when a user registers a passkey in the remote UI, they can easily register the same passkey in the local UI as well. Therefore, users do not need to register passkeys separately in the remote UI and the local UI, meaning they do not need to register the passkey twice, reducing the registration procedure and significantly improving usability. In addition, the digital signature verification technology using passkeys, which is used in FIDO, can improve the security of login operations. In particular, a single passkey registration operation can improve the security of multiple login operations. Furthermore, password authentication can be easily disabled for each authentication method for users who have registered a passkey. By disabling password authentication, security concerns such as brute-force password attacks and password leaks can be eliminated, thereby enhancing security.

[0154] Furthermore, if mobile authentication (passkey authentication) for the local UI is successful, and the user has not registered a passkey for the remote UI, a selection screen like 507 in Figure 5 may be displayed along with a message such as "Passkey authentication was successful. Do you want to use this passkey for the remote UI as well?". If "Yes" is selected, the passkey information registered in association with the local UI for which the mobile authentication was successful may be associated with the authenticated user's user ID and stored in the user database of HDD204 as passkey information for the remote UI.

[0155] Similarly, if mobile authentication (passkey authentication) of the remote UI is successful and the user has not registered a passkey for the local UI, a selection screen like 507 in Figure 5 may be displayed with a message such as "Passkey authentication was successful. Do you want to use this passkey for the local UI as well?". If "Yes" is selected, the passkey information registered in association with the remote UI for which mobile authentication was successful may be associated with the authenticated user's user ID and stored in the user database of HDD204 as passkey information for the local UI.

[0156] Furthermore, the aforementioned selection screen may include a checkbox along with the message "Do not show this again," and if this checkbox is checked, a flag or similar mechanism may be set to prevent the selection screen from being displayed in the future.

[0157] As described above, in this embodiment, a common passkey can be registered for authentication of each user interface, reducing the registration procedure for passwordless login. Furthermore, a passwordless login passkey can be registered for authentication of multiple user interfaces with a simple operation, making authentication of multiple user interfaces passwordless and enhancing authentication security. In other words, a passwordless login passkey can be registered for authentication of multiple user interfaces with a simple operation, making authentication of multiple user interfaces passwordless with a single registration operation, reducing the registration procedure. In addition, multi-factor authentication technologies such as FIDO can be used, further enhancing authentication security. In other words, it becomes possible to easily register passkeys for multiple user interfaces with a single step, significantly improving usability and device authentication security.

[0158] It should be noted that the structure and content of the various data described above are not limited to those mentioned, and it goes without saying that they can be composed of various structures and contents depending on the use and purpose. Although one embodiment has been described above, the present invention can take the form of, for example, a system, apparatus, method, program, or storage medium. Specifically, it may be applied to a system consisting of multiple devices, or to an apparatus consisting of a single device. Furthermore, any configurations combining the above embodiments are also included in the present invention.

[0159] [Other Embodiments] The present invention can also be realized by supplying a program that implements one or more of the functions of the above-described embodiments to a system or device via a network or storage medium, and by having one or more processors in the computer of that system or device read and execute the program. It can also be realized by a circuit (e.g., an ASIC) that implements one or more functions. Furthermore, the present invention may be applied to a system consisting of multiple devices or to a device consisting of a single device. The present invention is not limited to the embodiments described above, and various modifications (including organic combinations of each embodiment) are possible based on the spirit of the invention, and these are not excluded from the scope of the invention. That is, all configurations that combine the above-described embodiments and their modified forms are included in the present invention.

[0160] This embodiment includes the following configurations, methods, and programs. (Composition 1) An information processing device capable of communicating with a terminal having an authentication function, Multiple user interfaces, including a first user interface for operation from the operation unit of the information processing device, and a second user interface for operation from an external device via a network, A storage means for storing information related to authentication, A first registration means that receives passkey information generated based on user authentication by the authentication function of the terminal from the terminal, registers the received passkey information in association with the first user interface in the storage means, and sets up authentication using the authentication function of the terminal for the first user interface. When the aforementioned passkey information is registered, a selection means is provided to accept a user selection as to whether or not to register the passkey information in association with a user interface other than the user interface associated with the passkey information. If the selection means selects to register the information in association with the other user interface, the second registration means further registers the passkey information registered by the first registration means in association with the second user interface in the storage means, and sets up authentication using the terminal's authentication function for the second user interface. An information processing device characterized by having the following features. (Configuration 2) A third registration means that receives passkey information generated based on user authentication by the authentication function of the terminal from the terminal, registers the received passkey information in association with the second user interface in the storage means, and sets up authentication using the authentication function of the terminal for the second user interface. If the selection means selects to register the information in association with the other user interface, the fourth registration means further registers the passkey information registered by the third registration means in association with the first user interface to the storage means, thereby setting up authentication using the terminal's authentication function for the first user interface. The information processing apparatus according to configuration 1, characterized by having the following features. (Composition 3) An information processing device capable of communicating with a terminal having an authentication function, Multiple user interfaces, including a first user interface for operation from the operation unit of the information processing device, and a second user interface for operation from an external device via a network, A storage means for storing information related to authentication, A first registration means that receives passkey information generated based on user authentication by the authentication function of the terminal from the terminal, registers the received passkey information in association with the second user interface in the storage means, and sets up authentication using the authentication function of the terminal for the second user interface. When the aforementioned passkey information is registered, a selection means is provided to accept a user selection as to whether or not to register the passkey information in association with a user interface other than the user interface associated with the passkey information. If the selection means selects to register the information in association with the other user interface, the second registration means further registers the passkey information registered by the first registration means in association with the first user interface to the storage means, and sets up authentication using the terminal's authentication function for the second user interface. An information processing device characterized by having the following features. (Composition 4) The information processing device according to any one of configurations 1 to 3, characterized in that the selection means does not accept the user selection if a passkey associated with the other user interface has already been registered. (Composition 5) The information processing device according to any one of configurations 1 to 4, wherein, if the selection means selects to register the other user interface in association with it, the device has a presentation means for presenting an authentication procedure using the terminal's authentication function for the other user interface. (Composition 6) The information processing device according to any one of configurations 1 to 5, characterized in that it has a means for disabling password authentication corresponding to a user interface associated with the passkey information when the passkey information is registered. (Composition 7) The information processing device according to any one of configurations 1 to 5, characterized in that, when the aforementioned passkey information is registered, it accepts a user selection to select a user interface from among the user interfaces associated with the passkey information to which password authentication should be disabled, and has a means for disabling password authentication corresponding to the selected user interface. (Composition 8) The information processing device according to any one of configurations 1 to 7, characterized in that, when authentication using the terminal's authentication function is successful for any of the user interfaces, the selection means accepts a user selection as to whether or not to register the passkey information registered in association with the authenticated user interface in association with other user interfaces different from the user interface. (Method 1) A control method for an information processing device having a terminal with authentication functionality, a first user interface for operation from an operating unit, a second user interface for operation from an external device via a network, and storage means for storing information related to authentication, wherein the information processing device is capable of communicating with a terminal with authentication functionality and includes multiple user interfaces, including a first user interface for operation from an operating unit and a second user interface for operation from an external device via a network, and storage means for storing information related to authentication, A first registration step involves receiving passkey information generated based on user authentication performed by the terminal's authentication function from the terminal, registering the received passkey information in association with the first user interface in the storage means, and setting up authentication using the terminal's authentication function for the first user interface. A selection step is provided to allow the user to choose whether or not to register the passkey information in association with a user interface other than the user interface associated with the passkey information, once the passkey information has been registered. If, in the selection step, it is selected to register the information in association with the other user interface, a second registration step is performed to further register the passkey information registered in the first registration step in association with the second user interface and to set up authentication using the terminal's authentication function for the second user interface. A control method for an information processing device, characterized by having the following features. (Method 2) A third registration step involves receiving passkey information generated based on user authentication by the terminal's authentication function from the terminal, registering the received passkey information in association with the second user interface in the storage means, and setting up authentication using the terminal's authentication function for the second user interface. If, in the selection step, it is selected to register the information in association with the other user interfaces, the fourth registration step further registers the passkey information registered in the third registration step in association with the first user interface and stores it in the storage means, thereby setting up authentication using the terminal's authentication function for the first user interface. A control method for an information processing device according to Method 1, characterized by having the following features. (Method 3) A control method for an information processing device having a terminal with authentication functionality, a first user interface for operation from an operating unit, a second user interface for operation from an external device via a network, and storage means for storing information related to authentication, wherein the information processing device is capable of communicating with a terminal with authentication functionality and includes multiple user interfaces, including a first user interface for operation from an operating unit and a second user interface for operation from an external device via a network, and storage means for storing information related to authentication, A first registration step involves receiving passkey information generated based on user authentication by the terminal's authentication function from the terminal, registering the received passkey information in association with the second user interface in the storage means, and setting up authentication using the terminal's authentication function for the second user interface. A selection step is provided to allow the user to choose whether or not to register the passkey information in association with a user interface other than the user interface associated with the passkey information, once the passkey information has been registered. If, in the selection step, it is selected to register the information in association with the other user interface, a second registration step is performed to further register the passkey information registered in the first registration step in association with the first user interface and to set up authentication using the terminal's authentication function for the first user interface. A control method for an information processing device, characterized by having the following features. (Program 1) A program that causes a computer to execute one of the control methods for an information processing device described in one of methods 1 to 3.

Claims

1. An information processing device capable of communicating with a terminal having an authentication function, A plurality of user interfaces, including a first user interface for operation from the operation unit of the information processing device, and a second user interface for operation from an external device via a network, A storage means for storing information related to authentication, A first registration means that receives passkey information generated based on user authentication by the authentication function of the terminal from the terminal, registers the received passkey information in association with the first user interface in the storage means, and sets up authentication using the authentication function of the terminal for the first user interface. When the aforementioned passkey information is registered, a selection means is provided to accept a user selection as to whether or not to register the passkey information in association with a user interface other than the user interface associated with the passkey information. If the selection means selects to register the information in association with the other user interface, the second registration means further registers the passkey information registered by the first registration means in association with the second user interface in the storage means, and sets up authentication using the terminal's authentication function for the second user interface. An information processing device characterized by having the following features.

2. A third registration means that receives passkey information generated based on user authentication by the authentication function of the terminal from the terminal, registers the received passkey information in association with the second user interface in the storage means, and sets up authentication using the authentication function of the terminal for the second user interface. If the selection means selects to register the information in association with the other user interface, the fourth registration means further registers the passkey information registered by the third registration means in association with the first user interface to the storage means, thereby setting up authentication using the terminal's authentication function for the first user interface. The information processing apparatus according to claim 1, characterized by having the following features.

3. An information processing device capable of communicating with a terminal having an authentication function, A plurality of user interfaces, including a first user interface for operation from the operation unit of the information processing device, and a second user interface for operation from an external device via a network, A storage means for storing information related to authentication, A first registration means that receives passkey information generated based on user authentication by the authentication function of the terminal from the terminal, registers the received passkey information in association with the second user interface in the storage means, and sets up authentication using the authentication function of the terminal for the second user interface. When the aforementioned passkey information is registered, a selection means is provided to accept a user selection as to whether or not to register the passkey information in association with a user interface other than the user interface associated with the passkey information. If the selection means selects to register the information in association with the other user interface, the second registration means further registers the passkey information registered by the first registration means in association with the first user interface to the storage means, and sets up authentication using the terminal's authentication function for the second user interface. An information processing device characterized by having the following features.

4. The information processing apparatus according to any one of claims 1 to 3, characterized in that the selection means does not accept the user selection if a passkey associated with the other user interface has already been registered.

5. The information processing device according to any one of claims 1 to 3, wherein, if the selection means selects to register the other user interface in association with it, the device has a presentation means for presenting an authentication procedure using the authentication function of the terminal for the other user interface.

6. The information processing apparatus according to any one of claims 1 to 3, characterized in that it has a means for disabling password authentication corresponding to a user interface associated with the passkey information when the passkey information is registered.

7. The information processing apparatus according to any one of claims 1 to 3, characterized in that, when the aforementioned passkey information is registered, it accepts a user selection to select a user interface from among the user interfaces associated with the passkey information to which password authentication should be disabled, and has a means for disabling password authentication corresponding to the selected user interface.

8. The information processing apparatus according to any one of claims 1 to 3, characterized in that the selection means accepts a user selection of whether or not to register the passkey information registered in association with the authenticated user interface in association with other user interfaces different from the user interface, when authentication using the terminal's authentication function is successful for any of the user interfaces.

9. A control method for an information processing device having a terminal with authentication functionality, a first user interface for operation from an operating unit, a second user interface for operation from an external device via a network, and storage means for storing information related to authentication, wherein the information processing device is capable of communicating with a terminal with authentication functionality and includes a plurality of user interfaces, including a first user interface for operation from an operating unit and a second user interface for operation from an external device via a network, and storage means for storing information related to authentication, A first registration step involves receiving passkey information generated based on user authentication performed by the terminal's authentication function from the terminal, registering the received passkey information in association with the first user interface in the storage means, and setting up authentication using the terminal's authentication function for the first user interface. A selection step is provided to allow the user to choose whether or not to register the passkey information in association with a user interface other than the user interface associated with the passkey information, once the passkey information has been registered. If, in the selection step, it is selected to register the information in association with the other user interface, the second registration step further registers the passkey information registered in the first registration step in association with the second user interface and stores it in the storage means, thereby setting up authentication using the terminal's authentication function for the second user interface. A control method for an information processing device, characterized by having the following features.

10. A third registration step involves receiving passkey information generated based on user authentication by the terminal's authentication function from the terminal, registering the received passkey information in association with the second user interface in the storage means, and setting up authentication using the terminal's authentication function for the second user interface. If, in the selection step, it is selected to register the information in association with the other user interfaces, the fourth registration step further registers the passkey information registered in the third registration step in association with the first user interface in the storage means, and sets up authentication using the terminal's authentication function for the first user interface. A control method for an information processing apparatus according to claim 9, characterized by having the following features.

11. A control method for an information processing device having a terminal with authentication functionality, a first user interface for operation from an operating unit, a second user interface for operation from an external device via a network, and storage means for storing information related to authentication, wherein the information processing device is capable of communicating with a terminal with authentication functionality and includes a plurality of user interfaces, including a first user interface for operation from an operating unit and a second user interface for operation from an external device via a network, and storage means for storing information related to authentication, A first registration step involves receiving passkey information generated based on user authentication performed by the terminal's authentication function from the terminal, registering the received passkey information in association with the second user interface in the storage means, and setting up authentication using the terminal's authentication function for the second user interface. A selection step is provided to allow the user to choose whether or not to register the passkey information in association with a user interface other than the user interface associated with the passkey information, once the passkey information has been registered. If, in the selection step, it is selected to register the information in association with the other user interface, a second registration step is performed to further register the passkey information registered in the first registration step in association with the first user interface in the storage means and to set up authentication using the authentication function of the terminal for the first user interface. A control method for an information processing device, characterized by having the following features.

12. A program for causing a computer to execute the control method for an information processing device described in any one of claims 9 to 11.

Images