Computer programs for communication systems, intermediary servers, and communication devices.

Abstract

To provide a technology that can reduce the processing load on communication devices in an environment where authentication processing is to be performed. [Solution] When an authentication start instruction is received, the communication device requests the intermediary server to generate authentication-related information. Authentication-related information is information for executing authentication-related processing between the communication device and the authenticator. When the intermediary server receives a generation request from the communication device, it generates the authentication-related information, and when it receives a transmission request from the authenticator requesting the transmission of the authentication-related information, it transmits the authentication-related information to the authenticator. Furthermore, after the authentication-related information has been transmitted from the intermediary server to the authenticator, the communication device controls the authentication process using the authentication-related information, and executes predetermined processing if authentication according to the authentication process is successful.

Description

Technical Field

[0001] This specification discloses a technology related to authentication for a communication device to execute a predetermined process.

Background Art

[0002] Patent Document 1 discloses a system in which authentication according to the FIDO (abbreviation for Fast Identity Online) method is executed. When an MFP (abbreviation for Multi-Function Peripheral) receives a print operation from a user, it encodes each piece of information such as an authentication server and the MFP to generate a QR code and displays the QR code. The terminal device acquires each piece of the above information by reading the QR code, and executes authentication according to the FIDO method using each piece of the above information.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] This specification provides a technology that enables a communication device not to display authentication-related information in an environment where authentication processing should be executed.

Means for Solving the Problems

[0005] This specification discloses a communication system. The communication system may include a communication device and an intermediary server. The communication device may include a generation request transmission unit that requests the intermediary server to generate authentication-related information when an authentication start instruction is obtained. The authentication-related information may be information for performing authentication-related processing between the communication device and an authenticator. The intermediary server may include a generation unit that generates the authentication-related information when it receives the generation request from the communication device. The intermediary server may include a first information transmission unit that transmits the authentication-related information to the authenticator when it receives a transmission request from the authenticator after the authentication-related information has been generated. The communication device may further include an authentication control unit that controls the authentication process using the authentication-related information after the authentication-related information has been transmitted from the intermediary server to the authenticator. The communication device may include a predetermined processing execution unit that executes predetermined processing when authentication corresponding to the authentication process is successful.

[0006] According to the above configuration, when the communication device sends a generation request to the intermediary server, the intermediary server generates authentication-related information and sends it to the authenticator. Thus, the authentication-related information is transmitted from the intermediary server to the authenticator. The communication device then controls the authentication process and executes predetermined processing if authentication is successful. With this technology, the communication device does not need to display the authentication-related information in the environment where the authentication process should be performed.

[0007] This specification also discloses the following communication system. The communication system may include a communication device and an intermediary server. The communication device may include a generation unit that generates authentication-related information when an authentication start instruction is received. The authentication-related information may be information for executing authentication-related processing between the communication device and an authenticator. The communication device may include a first information transmission unit that transmits the authentication-related information to the intermediary server. The intermediary server may include a second information transmission unit that transmits the authentication-related information to the authenticator when it receives the authentication-related information from the communication device. The communication device may further include an authentication control unit that controls the authentication process using the authentication-related information after the authentication-related information has been transmitted from the intermediary server to the authenticator. The communication device may include a predetermined processing execution unit that executes predetermined processing when authentication corresponding to the authentication process is successful.

[0008] According to the above configuration, the communication device generates authentication-related information and sends it to the intermediary server. This authentication-related information is then sent from the intermediary server to the authenticator. The communication device then controls the authentication process and executes predetermined processing if authentication is successful. With this technology, the communication device does not need to display authentication-related information in the environment where the authentication process should be performed.

[0009] The computer program for implementing the above-mentioned intermediary server, and the computer-readable recording medium for storing the computer program, are also novel and useful. The intermediary server itself, and the method executed by the intermediary server, are also novel and useful. The computer program for implementing the above-mentioned communication device, and the computer-readable recording medium for storing the computer program, are also novel and useful. Furthermore, the above-mentioned communication device itself, and the method executed by the communication device, are also novel and useful. Note that the above-mentioned recording medium may be a single medium or multiple mediums. [Brief explanation of the drawing]

[0010] [Figure 1] This shows the configuration of the communication system. [Figure 2] This is a sequence diagram of Case A, showing the process performed by each device. [Figure 3] This is a continuation of Figure 2. [Figure 4] This is a sequence diagram of Case B, showing the process performed by each device. [Figure 5] This is a sequence diagram of Case C, showing the process performed by each device. [Figure 6] This is a sequence diagram of Case D, showing each process performed by each device. [Figure 7] This is a sequence diagram of the second embodiment. [Modes for carrying out the invention]

[0011] (First embodiment) (Configuration of communication system 2: Figure 1) As shown in Figure 1, the communication system 2 comprises a printer 10, an authenticator 100, an authentication intermediary server 200, and a print intermediary server 300. Each device 10-300 is connected to the Internet 6. Each device 10-300 can communicate with each other via the Internet 6. Switches, access points, routers, etc., are omitted in Figure 1.

[0012] (Printer 10 configuration) Printer 10 is a peripheral device capable of performing printing functions. In some variations, printer 10 may be a multi-function device capable of performing scanning functions, facsimile functions, etc., in addition to printing functions. Printer 10 can operate according to the FIDO (Fast Identity Online) authentication method. The FIDO authentication method is a method of user authentication that uses biometric authentication (e.g., fingerprint authentication, voiceprint authentication, facial recognition) instead of password authentication. Hereafter, authentication according to the FIDO authentication method will be referred to as "FIDO authentication".

[0013] The printer 10 includes an operation unit 12, a Bluetooth interface 14, a LAN interface 16, a printing execution unit 18, and a control unit 30. The printer 10 does not include a display unit for displaying information. Each of the units 12 to 30 is connected to a bus line. In FIG. 1, an interface is denoted as "I / F".

[0014] The operation unit 12 is a user interface that enables a user to input various information to the printer 10. The operation unit 12 includes, for example, a touch panel for displaying software keys (operation areas), hardware keys, or both. The hardware keys include, for example, buttons, switches, and the like.

[0015] The Bluetooth interface 14 is an interface for performing communication according to the BLE (abbreviation for Bluetooth Low Energy) method. Bluetooth is a registered trademark of Bluetooth SIG. Hereinafter, Bluetooth will be described as "BT".

[0016] The LAN interface 16 is connected to a LAN. The LAN may be a wired LAN or a wireless LAN. The LAN is connected to the Internet 6.

[0017] The printing execution unit 18 is an inkjet, electrophotographic, or thermal printing engine. The inkjet printing engine includes a print head that ejects ink droplets. The electrophotographic printing engine includes a photoreceptor and an exposure device that emits light to expose the photoreceptor. The thermal printing engine includes a print head that generates heat by a heater.

[0018] The control unit 30 includes a CPU 32 and a memory 34. The memory 34 includes a main storage device and an auxiliary storage device. As an example, the main storage device includes a RAM and a cache memory. As an example, the auxiliary storage device may be a ROM, a flash memory, an SSD, an HDD, or a combination thereof. A program 36 is stored in the auxiliary storage device of the memory 34. The CPU 32 realizes various processes according to the program loaded from the auxiliary storage device to the main storage device.

[0019] A QR code 40 obtained by encoding the URL (abbreviation of Uniform Resource Locator) of the authentication intermediary server 200 is attached to the housing of the printer 10. The QR code is a registered trademark of Denso Wave Incorporated. Thereby, the authenticator 100 can acquire the URL of the authentication intermediary server 200 by reading the QR code 40. The said URL further includes the printer ID "001" of the printer 10 as a query.

[0020] (Configuration of the Authenticator 100) The authenticator 100 is a user terminal used by the user of the printer 10, and is, for example, a portable terminal device such as a mobile phone, a smartphone, a PDA, a tablet PC, etc. The authenticator 100 is operable according to the FIDO authentication method.

[0021] The authenticator 100 includes an operation unit 112, a BT interface 114, a LAN interface 116, a display unit 118, a camera 120, and a control unit 130. Each unit 112 - 130 is connected to a bus line.

[0022] The operation unit 112 is a user interface that enables the user to input various information to the authenticator 100. The operation unit 112 includes, for example, a touch panel for displaying software keys (operation areas), hardware keys, or both. The hardware keys include, for example, buttons, switches, etc. Also, the operation unit 112 includes a biometric authentication device such as a fingerprint authentication sensor.

[0023] The BT interface 114 and the LAN interface 116 are the same as interfaces 14 and 16 of the printer 10, respectively. The authenticator 100 may belong to a different LAN than the printer 10, or to the same LAN as the printer 10. Furthermore, if the authenticator 100 is equipped with a network interface for carrier communication, that network interface may be used instead of the LAN interface 116.

[0024] The display unit 118 is a display or panel for displaying various information and various screens described later. The display is, for example, a liquid crystal display or an organic EL display. The panel may or may not be a touch panel. The panel may also be, for example, a liquid crystal panel or an organic EL panel.

[0025] Camera 120 is a device for photographing objects. In this embodiment, camera 120 is used to photograph a QR code 40 attached to the casing of printer 10.

[0026] The control unit 130 comprises a CPU 132 and a memory 134. The memory 134 comprises a main memory and an auxiliary memory. The details of these are the same as those described for the memory 34 of the printer 10. The program 136 is stored in the auxiliary memory of the memory 134. The CPU 132 performs various processes according to each program loaded from the auxiliary memory into the main memory.

[0027] (Configuration of authentication intermediary server 200) The authentication intermediary server 200 generates Passkey information used in FIDO authentication and transmits the Passkey information to the printer 10 and the authenticator 100. Normally, Passkey information is generated by a device that receives an operation that triggers FIDO authentication. For example, such a device displays a QR code obtained by encoding the Passkey information. The authenticator then obtains the Passkey information by reading the QR code. However, in this embodiment, the printer 10, which is the device that receives an operation that triggers FIDO authentication, does not have a display unit. Therefore, the printer 10 cannot display a QR code. Thus, in this embodiment, a configuration is adopted in which the authentication intermediary server 200 generates the Passkey information and transmits it to the authenticator 100.

[0028] The authentication intermediary server 200 is installed on the Internet 6 by, for example, the vendor of the printer 10. In a modified example, the authentication intermediary server 200 may be installed by a different operator than the vendor. In another modified example, the vendor may not prepare the hardware for the authentication intermediary server 200 itself, but instead use an environment provided by an external cloud computing service. In this case, the vendor may implement the authentication intermediary server 200 by preparing the program (i.e., software) for the authentication intermediary server 200 and installing it in the above environment.

[0029] The authentication intermediary server 200 comprises a communication interface 216 and a control unit 230. Each of the units 216 and 230 is connected to a bus line. The communication interface 216 is connected to the Internet 6.

[0030] The control unit 230 comprises a CPU 232 and a memory 234. The memory 234 comprises a main memory and an auxiliary memory. The details of these are the same as those described for the memory 34 of the printer 10. The program 236 is stored in the auxiliary memory of the memory 234. The CPU 232 performs various processes according to each program loaded from the auxiliary memory into the main memory.

[0031] (Configuration of print intermediary server 300) The print intermediary server 300 generates and stores print jobs to be executed by each of the multiple printers, including printer 10. The print intermediary server 300 is installed on the Internet 6 by, for example, the vendor of printer 10. In a modified example, the print intermediary server 300 may be installed on the Internet 6 by a different operator than the vendor. The vendor may use an environment provided by an external cloud computing service, as explained in the description of the authentication intermediary server 200.

[0032] The print intermediary server 300 comprises a communication interface 316 and a control unit 330. Each of the units 316 and 330 is connected to a bus line. The communication interface 316 is connected to the Internet 6.

[0033] The control unit 330 comprises a CPU 332 and a memory 334. The memory 334 comprises a main memory and an auxiliary memory. The details of these are the same as those described for the memory 34 of the printer 10. The program 336 is stored in the auxiliary memory of the memory 334. The CPU 332 performs various processes according to each program loaded from the auxiliary memory into the main memory.

[0034] The print intermediary server 300 also operates as an authentication server in the FIDO authentication scheme. In other words, in this embodiment, the print intermediary server and the authentication server are configured as a single unit. In a modified example, the print intermediary server and the authentication server may be configured as separate units.

[0035] (Specific processes performed between each device: Figures 2-6) Next, referring to Figures 2 to 6, we will explain a specific case in which printing is performed on printer 10 using FIDO authentication. In the following, the processing performed by the CPU of each device will be described with each device as the main processing unit, rather than with the CPU as the main unit. Also, the following communications are mainly performed via LAN interfaces 16, 116 or communication interfaces 216, 316. For this reason, the phrases "via LAN interface" or "via communication interface" will be omitted in the description of each communication. However, for communications performed via other interfaces, the interface will be specified in the description.

[0036] (Case A: Figure 2) First, let's explain Case A in Figure 2. In the initial state of Figure 2, the print intermediary server 300 has already stored one or more print jobs to be executed by the printer 10. For example, when an operation is performed on a terminal device to cause the printer 10 to perform printing via the print intermediary server 300, one print job is registered with the print intermediary server 300. Specifically, for example, the terminal device receives a print operation from a user that includes specifying image data, print settings, and the printer 10's identification information (e.g., serial number). In this case, the terminal device sends a job registration request to the print intermediary server 300 that includes the image data, print settings, and the printer 10's identification information. As a result, the print intermediary server 300 generates and stores one print job that includes each piece of information included in the registration request. The following processes are executed to cause the printer 10 to perform printing according to the print job stored in the print intermediary server 300.

[0037] At T10, printer 10 accepts a login request from the user to log in to the print intermediary server 300. In this case, at T12, printer 10 sends an assertion options request to the print intermediary server 300. The assertion options request is a signal requesting login to the print intermediary server 300. The assertion options request includes an instruction to the print intermediary server 300 to send parameters used in FIDO authentication.

[0038] At T12, the print intermediary server 300 receives an assertion options request from the printer 10. In this case, at T14, the print intermediary server 300 sends the options to the printer 10. The options include parameters used in FIDO authentication. These parameters include information indicating that the print intermediary server 300 can use the FIDO authentication method Passkey. Passkey is an authentication method also known as Cross-device Authentication or Hybrid Authentication.

[0039] When printer 10 receives options from the print mediation server 300 at T14, it sends a Passkey information generation request to the authentication mediation server 200 at T20. Hereafter, the Passkey information generation request will be referred to as the "generation request". The generation request is a signal requesting the authentication mediation server 200 to generate Passkey information. The generation request includes the printer ID "001", which is information that identifies printer 10.

[0040] When the authentication intermediary server 200 receives a generation request from the printer 10 at T20, it generates Passkey information at T22. The authentication intermediary server 200 further associates the printer ID "001" with the Passkey information and stores it in memory 234. The Passkey information includes key information and communication information. The key information is used for communication regarding Advertise, described later, between the printer 10 and the authenticator 100. The communication information is used to perform encrypted communication between the printer 10 and the authenticator 100, and includes, for example, a public key. When the authentication intermediary server 200 generates the Passkey information, it sends the Passkey information to the printer 10 at T24.

[0041] Printer 10 receives Passkey information from the authentication intermediary server 200 at T24. This allows Printer 10 to use the Passkey information to perform the Advertise and tunneling communications described later. In other words, Printer 10 can control FIDO authentication using the Passkey information. Upon receiving the Passkey information, Printer 10 switches the BT interface 14 to a state where it waits for the Advertise signal to be received. That is, if the BT interface 14 is in the OFF state, it switches to the ON state.

[0042] The authentication intermediary server 200 further monitors for receiving a Passkey information transmission request from the authenticator 100. Hereafter, the Passkey information transmission request will be referred to as a "transmission request". Specifically, the authentication intermediary server 200 counts the elapsed time since the Passkey information was generated in T22 and monitors for receiving a transmission request within a predetermined time.

[0043] In Case A, the transmission request is sent from the authenticator 100 to the authentication mediation server 200 within the predetermined time frame. Specifically, at T30, the authenticator 100 receives a request from the user to read the QR code 40 attached to the casing of the printer 10. As a result, at T32, the authenticator 100 uses the camera 120 to read and decode the QR code 40 and obtains the URL of the authentication mediation server 200. Then, at T34, the authenticator 100 sends a transmission request with the obtained URL as the destination URL. As described above, this URL includes the printer ID "001" of the printer 10. Therefore, at T34, the authenticator 100 can send a transmission request including the printer ID "001" to the authentication mediation server 200.

[0044] In T34, the authentication intermediary server 200 receives a transmission request from the authenticator 100 within a predetermined time after generating the Passkey information. In this case, the authentication intermediary server 200 obtains the Passkey information (see T22) associated with the printer ID "001" included in the transmission request from memory 234. Then, in T36, the authentication intermediary server 200 transmits the obtained Passkey information to the authenticator 100. As described above, the authentication intermediary server 200 stores the printer ID "001" in association with the Passkey information. Therefore, when the authentication intermediary server 200 receives a transmission request containing the printer ID "001", it can appropriately transmit the Passkey information associated with the printer ID "001", i.e., the Passkey information to be used for authentication in the printer 10, to the authenticator 100.

[0045] At T36, the authenticator 100 receives Passkey information from the authentication intermediary server 200. This allows the authenticator 100 to use the Passkey information to perform the Advertise and tunneling communications described later. Furthermore, the printer 10 and the authenticator 100 can share the same Passkey information.

[0046] In FIDO authentication, proximity verification is performed using BLE communication to ensure more secure authentication. Proximity verification is a process to confirm that the authenticator 100 is in close proximity to the printer 10. The authenticator 100 generates encrypted information by encrypting the Advertise data using the key information contained in the Passkey information. Here, the Advertise data includes, for example, a routing ID. The routing ID is used in the tunneling communication described later. At T40, the authenticator 100 transmits an Advertise signal according to the BLE method via the BT interface 114. The Advertise signal contains the generated encrypted information.

[0047] When the printer 10 is located near the authenticator 100, at T40, it receives an Advertise signal from the authenticator 100 via the BT interface 114. In this case, at T42, the printer 10 determines whether the received signal strength of the Advertise signal is above a predetermined threshold, that is, whether the distance to the authenticator 100 is within a predetermined distance. In this case, the printer 10 determines that the distance to the authenticator 100 is within a predetermined distance. In this case, at T42, the printer 10 further uses the key information in the Passkey information received at T24 to decrypt the encrypted information in the Advertise signal and obtain the Advertise data. This allows the printer 10 and the authenticator 100 to share the same Advertise data. If the printer 10 determines that the distance to the authenticator 100 is greater than the predetermined distance, it discards the Advertise data and does not perform the subsequent processes.

[0048] Next, the printer 10 and the authenticator 100 establish encrypted communication in accordance with tunneling technology using the WEBSocket server 400 at T50 to T54. Specifically, the authenticator 100 establishes a connection with the WEBSocket server 400 at T50. The printer 10 establishes a connection with the WEBSocket server 400 at T52. Then, the printer 10 and the authenticator 100 perform a handshake via the WEBSocket server 400 at T54.

[0049] During the communication process described above (T50-T54), communication information within the Passkey information shared by the printer 10 and the authenticator 100 is used. Additionally, during this communication process, the routing ID within the Advertise data shared by the printer 10 and the authenticator 100 is used. Once the printer 10 and the authenticator 100 establish encrypted communication according to tunneling technology, they use this encrypted communication to execute the communications described below.

[0050] (Continuation of Figure 2: Figure 3) As shown in Figure 3, the printer 10 sends a biometric authentication request to the authenticator 100 via the WEBSocket server 400 at T60. The biometric authentication request is a signal requesting the execution of biometric authentication.

[0051] At T60, the authenticator 100 receives a biometric authentication request from the printer 10. In this case, the authenticator 100 displays a biometric authentication screen containing a message requesting the execution of biometric authentication on the display unit 118. At T62, the authenticator 100 accepts a biometric authentication operation from the user who viewed the screen. The biometric authentication operation is, for example, a fingerprint authentication operation in which the sensor on the operation unit 112 reads the user's fingerprint and causes the authenticator 100 to acquire the fingerprint. In a modified example, the biometric authentication operation is a facial authentication operation in which the camera 120 photographs the user's face and causes the authenticator 100 to acquire a facial image. In this case, the authenticator 100 determines that the fingerprint information acquired by the fingerprint authentication operation matches the pre-stored fingerprint information and determines that fingerprint authentication was successful. In this case, at T64, the authenticator 100 sends an assertion result to the printer 10 via the WEBSocket server 400. The assertion result includes information indicating that biometric authentication was successful and signature information. The signature information is, for example, a one-time password obtained in advance from the print intermediary server 300, which is then encrypted using the private key of the authenticator 100.

[0052] At T64, printer 10 receives an assertion result from authenticator 100 via WEBSocket server 400. In this case, at T70, printer 10 sends the assertion result to print mediation server 300. The assertion result at T70 also includes printer ID "001" of printer 10.

[0053] When the print intermediary server 300 receives an assertion result from the printer 10 at T70, it performs verification at T72 using the signature information in the assertion result. Specifically, the print intermediary server 300 has pre-stored the public key that corresponds to the private key of the authenticator 100. The print intermediary server 300 decrypts the signature information using the public key and determines that verification has succeeded if it has already stored the information obtained from the decryption (e.g., a one-time password). In this case, verification is successful, so the print intermediary server 300 sends a login success notification to the printer 10 at T74. The login success notification includes a token that will be used in subsequent processing. The print intermediary server 300 stores the token in memory 334, associating it with the printer ID "001" in the assertion result.

[0054] When printer 10 receives a login success notification from the print intermediary server 300 at T74, it sends a print job list request to server 200 at T80. The print job list request is a signal requesting the transmission of a print job list corresponding to printer 10, and includes the above token and printer ID "001".

[0055] When the print intermediary server 300 receives a print job list request from the printer 10 at T80, it performs verification of the token in the print job list request. Specifically, the print intermediary server 300 determines whether the token is already stored in association with the printer ID "001" in the print job list request. In this case, since the token is already stored in association with the printer ID "001", the print intermediary server 300 identifies the print job list corresponding to the printer 10. The print job list contains one or more print job identification pieces that identify one or more print jobs to be executed on the printer 10. Then, at T82, the print intermediary server 300 sends the print job list to the printer 10.

[0056] At T82, the printer 10 receives a print job list from the print intermediary server 300. In this case, at T90, the printer 10 sequentially sends a download request to the print intermediary server 300 for each of the one or more print job identification information entries in the print job list, including the said print job identification information. In a modified version, if the printer 10 is equipped with a display unit, one or more print job identification information entries may be displayed on the display unit, and the desired print job identification information may be selected by the user. In this case, the printer 10 sends a download request to the print intermediary server 300 including the selected print job identification information. In another modified version, the printer 10 may send the print job list to the authenticator 100 via the WEBSocket server 400, and the authenticator 100 may allow the user to select the desired print job identification information.

[0057] At T90, the print intermediary server 300 receives a download request from the printer 10. In this case, the print intermediary server 300 identifies the print job based on the print job identification information in the download request. The print intermediary server 300 then converts the image data in the print job according to the print settings in the print job and generates print data. The print data has a data format that can be interpreted by the printer 10. At T92, the print intermediary server 300 sends the generated print data to the printer 10.

[0058] At T92, the printer 10 receives print data from the print intermediary server 300. In this case, at T94, the printer 10 supplies the received print data to the print execution unit 18, causing the print execution unit 18 to print the image to be printed.

[0059] (Case B: Figure 4) Next, we will explain Case B with reference to Figure 4. In Cases B through D, the same steps as in Figure 2 are assigned to processes that are the same as in Figure 2. In Case B, the authentication mediation server 200 does not receive a transmission request from the authenticator 100 before a predetermined time has elapsed since generating the Passkey information. This is different from Case A in Figure 2.

[0060] T10 to T24 in Figure 4 are the same as T10 to T24 in Figure 2. At T22, the authentication mediation server 200 does not receive a transmission request from the authenticator 100 even after a predetermined time has elapsed since generating the Passkey information. In this case, at T100, the authentication mediation server 200 deletes the Passkey information associated with printer ID "001" from memory 34.

[0061] Subsequently, at T110, the authenticator 100 receives a request from the user to read the QR code 40. At T112, the authenticator 100 decodes the QR code 40 and obtains the URL of the authentication mediation server 200. Then, at T114, the authenticator 100 sends a transmission request containing the printer ID "001" to the authentication mediation server 200.

[0062] At T114, the authentication intermediary server 200 receives a transmission request from the authenticator 100. However, at T100, the Passkey information associated with the printer ID "001" in the transmission request has been deleted from memory 234. Therefore, the authentication intermediary server 200 cannot retrieve the Passkey information from memory 234. As a result, the authentication intermediary server 200 does not send the Passkey information to the authenticator 100. Thus, the authentication intermediary server 200 does not send the Passkey information to the authenticator 100 if it receives a transmission request after a predetermined amount of time has elapsed since the Passkey information was generated. In other words, the Passkey information has an expiration date. This enables a highly secure authentication system.

[0063] Since the authenticator 100 does not receive Passkey information from the authentication intermediary server 200, it cannot send the Advertise signal at T40 in Figure 2. As a result, the proximity verification process between the printer 10 and the authenticator 100 fails, and encrypted communication is not performed between the printer 10 and the authenticator 100. In other words, in case B, each process from T40 onward in Figure 2 is not executed.

[0064] (Case C: Figure 5) Next, we will explain Case C with reference to Figure 5. In Case C, after the Passkey information is sent from the authentication intermediary server 200 to the authenticator 100, a transmission request is sent from an authenticator 150, which is different from the authenticator 100, to the authentication intermediary server 200. This is different from Case A in Figure 2.

[0065] T10-T38 in Figure 5 are the same as T10-T38 in Figure 2. As described above, when the authentication intermediary server 200 sends the Passkey information to the authenticator 100, T38 deletes the Passkey information from memory 34. After that, the same processes as T40-T54 in Figure 2 and T60-T94 in Figure 3 are executed.

[0066] After the processing at T38 is completed, the authenticator 150, which is different from the authenticator 100, accepts a request from the user to read the QR code 40 at T210. At T212, the authenticator 150 decodes the QR code 40 and obtains the URL of the authentication mediation server 200. Then, at T214, the authenticator 150 sends a transmission request containing the printer ID "001" to the authentication mediation server 200.

[0067] At T214, the authentication intermediary server 200 receives a transmission request from the authenticator 150. However, at T38, the Passkey information associated with the printer ID "001" in the transmission request is deleted from memory 234. Therefore, the authentication intermediary server 200 cannot retrieve the Passkey information from memory 234. As a result, the authentication intermediary server 200 does not send the Passkey information to the authenticator 150. Furthermore, even if the authentication intermediary server 200 receives a transmission request again from the authenticator 100 instead of the authenticator 150, it does not send the Passkey information to the authenticator 100. In this way, the authentication intermediary server 200 does not send the Passkey information if it receives a transmission request again after sending the Passkey information to the authenticator 100. This prevents the same Passkey information from being used for multiple authentications. Thus, an authentication system with high security is realized.

[0068] (Case D: Figure 6) Next, we will explain Case D with reference to Figure 6. In Case D, the generation request is sent to the authentication intermediary server 200 after the Passkey information has been generated and before the transmission request is sent to the authentication intermediary server 200. This is different from Case A in Figure 2.

[0069] T10-T24 in Figure 5 are the same as T10-T24 in Figure 2. Before the transmission request is sent to the authentication intermediary server 200, the printer 10 accepts a login operation from the user again at T300. In this case, the printer 10 sends an assertion options request to the print intermediary server 300 at T312, and receives the options from the print intermediary server 300 at T314. Then, the printer 10 sends a generation request including the printer ID "001" to the print intermediary server 300 at T320.

[0070] At T320, the authentication intermediary server 200 receives a generation request from the printer 10. In this case, the authentication intermediary server 200 determines whether or not the Passkey information associated with the printer ID "001" in the generation request is stored in memory 234. At this stage, since no transmission request has been received from the authenticator 100, the Passkey information associated with the printer ID "001" is still stored in memory 234. In this case, at T322, the authentication intermediary server 200 deletes the Passkey information from memory 234. If the Passkey information associated with the printer ID "001" is not stored in memory 234, the authentication intermediary server 200 generates new Passkey information.

[0071] Subsequently, at T330, the authenticator 100 receives a request from the user to read the QR code 40. At T332, the authenticator 100 decodes the QR code 40 and obtains the URL of the authentication mediation server 200. Then, at T334, the authenticator 100 sends a transmission request containing the printer ID "001" to the authentication mediation server 200.

[0072] At T334, the authentication intermediary server 200 receives a transmission request from the authenticator 100. However, at T322, the Passkey information associated with the printer ID "001" in the transmission request is deleted from memory 234. Therefore, the authentication intermediary server 200 cannot retrieve the Passkey information from memory 234. As a result, the authentication intermediary server 200 does not send the Passkey information to the authenticator 100.

[0073] As in this case, the authentication intermediary server 200 may receive another generation request from the printer 10 before sending the Passkey information for the printer 10 to the authenticator 100. This can occur when multiple users attempt to log in to the printer 10 within a short period of time. In such a situation, the authentication intermediary server 200 may not be able to provide the Passkey information to the appropriate user. For this reason, when the authentication intermediary server 200 receives a transmission request from the authenticator 100, it does not send the Passkey information to the authenticator 100. This ensures a highly secure authentication system. Furthermore, even if the authentication intermediary server 200 receives another generation request from T320, it does not generate new Passkey information. As a result, when multiple users attempt to log in to the printer 10 within a short period of time, none of the users are provided with Passkey information. This ensures a highly secure authentication system.

[0074] (Effects of this embodiment) In this embodiment, when the printer 10 sends a generation request to the authentication intermediary server 200 (T20), the authentication intermediary server 200 generates Passkey information and sends it to the printer 10 and the authenticator 100 (T22, T24, T36). The printer 10 then controls the authentication process (T42, T52, T54, T60) and, if authentication is successful, executes printing-related processes (T80-T94). In this embodiment, the printer 10 does not have a display unit and therefore cannot display a QR code representing the Passkey information. Even in this situation, the authenticator 100 can appropriately obtain the Passkey information from the authentication intermediary server 200. Furthermore, the printer 10 does not need to generate Passkey information. Therefore, the processing load on the printer 10 can be reduced in an environment where authentication processing according to the FIDO authentication method should be performed.

[0075] (Correspondence) Printer 10 and authentication intermediary server 200 are examples of "communication device" and "intermediary server," respectively. Passkey information is an example of "authentication-related information." Printer ID "001" is an example of "identification information." QR code 40 is an example of "code image."

[0076] The correspondence between the parts of the "communication device" is as follows: T20 in Figure 2 is an example of processing performed by the "generation request transmission unit". T42, T52, T54, and T60 in Figure 3 are examples of processing performed by the "authentication control unit". T70 to T94 are examples of processing performed by the "predetermined processing execution unit".

[0077] The correspondence between the parts of the "intermediary server" is as follows: T22 is an example of processing performed by the "generation unit" and the "storage control unit". T24 is an example of processing performed by the "second information transmission unit". T36 is an example of processing performed by the "first information transmission unit".

[0078] (Second embodiment: Figure 7) A second embodiment will be described with reference to Figure 7. In this embodiment, the printer 10 generates Passkey information.

[0079] T10-T14 in Figure 7 are the same as T10-T14 in Figure 2. Printer 10 generates Passkey information at T400. Then, at T410, printer 10 sends a storage request to authentication intermediary server 200 that includes printer ID "001" and Passkey information.

[0080] When the authentication intermediary server 200 receives a storage request from the printer 10 at T410, it associates the printer ID "001" with the Passkey information and stores it in memory 234 at T412. Although not shown in the diagram, the authentication intermediary server 200 sends a completion notification to the printer 10 indicating that the Passkey information has been stored.

[0081] When printer 10 receives a completion notification from authentication intermediary server 200, it changes the state of BT interface 14 to a state waiting for the Advertise signal to be received. In a modified example, printer 10 may change the state of BT interface 14 to a state waiting for the Advertise signal to be received when it sends a memory request T410. In this case, the completion notification described above can be omitted. T30 to T54 in Figure 7 are the same as T30 to T54 in Figure 2. When the process in Figure 7 is completed, the process in Figure 3 is executed.

[0082] (Effects of this embodiment) In this embodiment, the printer 10 generates Passkey information and sends it to the authentication intermediary server 200 (T400, T410). The Passkey information is then sent from the authentication intermediary server 200 to the authenticator 100. In this embodiment as well, the authenticator 100 can appropriately obtain the Passkey information from the authentication intermediary server 200.

[0083] (Correspondence) The correspondence between the parts of the "communication device" is as follows: T400 in Figure 7 is an example of processing performed by the "generation unit". T410 is an example of processing performed by the "first information transmission unit". The correspondence between the parts of the "intermediary server" is as follows: T36 is an example of processing performed by the "second information control unit". The correspondence between the other parts is the same as in the first embodiment.

[0084] Although specific examples of the present invention have been described in detail above, these are merely illustrative and do not limit the scope of the claims. The technology described in the claims includes various modifications and changes to the specific examples illustrated above. Modifications of the above embodiments are listed below.

[0085] (Modification 1) The term "communication device" is not limited to printers, but includes all devices such as scanners, multifunction devices, PCs, and servers. For example, a scanner may perform a scan if FIDO authentication is successful. In this modification, the scan process is an example of a "predetermined process." For example, a PC may log in to a server if FIDO authentication is successful in response to receiving an operation to log in to a server. In this modification, the login process is an example of a "predetermined process."

[0086] (Modification 2) The authentication intermediary server 200 may store the printer ID "001" and address information for sending information to the authenticator 100 in association with each other in advance. In this case, when the authentication intermediary server 200 generates Passkey information at T22 in Figure 2, it can send the Passkey information to the authenticator 100 using the above address information without receiving a generation request from the authenticator 100. Generally speaking, the "intermediary server" may send authentication-related information to the authenticator without receiving a transmission request from the authenticator. Also, in this modification, the "storage control unit" can be omitted.

[0087] (Modification 3) The authentication mediation server 200 does not need to monitor whether a predetermined time has elapsed since the Passkey information was generated at T22 in Figure 2. That is, the authentication mediation server 200 may send the Passkey information to the authenticator 100 when it receives a transmission request from the authenticator 100, regardless of the time elapsed since the Passkey information was generated. Generally speaking, the "first information transmission unit" may send the authentication-related information to the authenticator when it receives a transmission request from the authenticator after a predetermined time has elapsed since the authentication-related information was generated.

[0088] (Modification 4) After the authentication mediation server 200 has sent the Passkey information to the authenticator 100 at T36 in Figure 2, if it receives another transmission request from the authenticator 100 or another authenticator 150, it may send the Passkey information to the authenticator 100 or another authenticator 150. Generally speaking, the "first information transmission unit" may send authentication-related information to the authenticator, and if it receives another transmission request from the authenticator or another authenticator after sending the authentication-related information to the authenticator, it may send the authentication-related information to the authenticator or another authenticator.

[0089] (Modification 5) The authentication intermediary server 200 may send the Passkey information to the authenticator 100 if it receives a generation request from the printer 10 before sending the Passkey information to the authenticator 100, and then receives a transmission request from the authenticator 100. Generally speaking, the "first information transmission unit" may send the authentication-related information to the authenticator if it receives a generation request again from the communication device after the authentication-related information has been generated but before the authentication-related information has been sent to the authenticator.

[0090] (Modification 6) The QR code 40 does not have to be affixed to the casing of the printer 10. For example, the QR code 40 may be affixed to the instruction manual for the printer 10. In another modification, the URL of the authentication mediation server 200 itself may be written on the casing of the printer 10 or on the instruction manual. In yet another modification, the URL of the authentication mediation server 200 itself may be written on a web page, and the user may access that web page to obtain the URL.

[0091] (Modification 7) The printer 10 does not have a display unit large enough to display a QR code, but it may have a small display unit capable of displaying text or the like. This display unit may, for example, be capable of displaying only one line of text. This modification is also an example of "the communication device does not have a display unit capable of displaying a code image."

[0092] (Modification 8) The printer 10 may be equipped with a display unit capable of displaying a QR code. However, in this modification as well, the printer 10 may not display a QR code representing the Passkey information, as in the above embodiment, and may instead have the authentication intermediary server 200 generate the Passkey information. Generally speaking, the "communication device" may be equipped with a display unit capable of displaying a code image. Note that the "code image" is not limited to a QR code, but may be other two-dimensional codes or one-dimensional codes such as barcodes.

[0093] (Modification 9) The technology of the above embodiment can be used for authentication other than FIDO authentication. For example, the technology of the above embodiment can be used for authentication to establish a Wi-Fi connection in accordance with DPP (Device Provisioning Protocol). Specifically, when the printer 10 accepts a DPP start operation, it sends a generation request including the printer 10's public key to the authentication mediation server 200. When the authentication mediation server 200 receives the generation request from the printer 10, it generates authentication information including the public key and sends the authentication information to the authenticator 100. When the printer 10 receives an Authentication request using the public key from the authenticator 100, it performs authentication using the information in the request. If authentication is successful, the printer 10 performs Configuration and Network Access to establish a Wi-Fi connection with other devices (e.g., access points). In this modification, authentication in response to an Authentication request is an example of processing performed by the "Authentication Control Unit". Also, Configuration and Network Access are examples of processing performed by the "Predetermined Processing Execution Unit".

[0094] (Modification 10) In the above embodiment, each process in Figures 2 to 6 is implemented by software (for example, programs 36, 136, 236), but at least one of these processes may be implemented by hardware such as a logic circuit.

[0095] Furthermore, the technical elements described herein or in the drawings demonstrate technical usefulness individually or in various combinations, and are not limited to the combinations described in the claims at the time of filing. In addition, the technologies illustrated herein or in the drawings achieve multiple objectives simultaneously, and achieving even one of these objectives constitutes technical usefulness in itself.

[0096] Even if, in the claims of this patent application, each claim depends on only some of the claims, it is not limited to the claim being dependent only on those specific claims. To the extent that it is not technically contradictory, each claim may be dependent on other claims that were not dependent at the time of application. That is, the technologies of each claim can be combined in various ways as follows: (Item 1) It is a communication system, Communication equipment and Equipped with an intermediary server, The aforementioned communication device is A generation request transmission unit that, when an authentication start instruction is obtained, requests the intermediary server to generate authentication-related information, wherein the authentication-related information is information for executing authentication-related processing between the communication device and the authenticator, comprises the generation request transmission unit. The aforementioned intermediary server, When the generation request is received from the communication device, the generation unit generates the authentication-related information, The system includes a first information transmission unit that transmits the authentication-related information to the authenticator, The aforementioned communication device further, After the authentication-related information is transmitted from the intermediary server to the authenticator, an authentication control unit controls the authentication process using the authentication-related information, A predetermined processing execution unit executes predetermined processing when authentication according to the aforementioned authentication process is successful, A communication system equipped with these features. (Item 2) The generation request includes identification information that identifies the communication device, The aforementioned intermediary server further, Memory and The system includes a storage control unit that, when the aforementioned authentication-related information is generated, associates the identification information with the aforementioned authentication-related information and stores it in the memory, The communication system according to item 1, wherein the first information transmission unit transmits the authentication-related information stored in the memory in association with the identification information to the authenticator when a transmission request including the identification information is received from the authenticator after the authentication-related information has been generated. (Item 3) The first information transmission unit described above is: If a transmission request is received from the authenticator before a predetermined time has elapsed since the authentication-related information was generated, the authentication-related information is transmitted to the authenticator. A communication system according to item 1 or 2, wherein if the transmission request is received from the authenticator after the predetermined time has elapsed since the authentication-related information was generated, the authentication-related information is not transmitted to the authenticator. (Item 4) The first information transmission unit described above is: When a transmission request is received from the authenticator, the authentication-related information is transmitted to the authenticator. A communication system according to any one of items 1 to 3, wherein if the authentication-related information is transmitted to the authenticator and then the transmission request is received again from the authenticator or another authenticator, the authentication-related information is not transmitted to the authenticator or the other authenticator. (Item 5) The communication system according to any one of items 1 to 4, wherein the first information transmission unit does not transmit the authentication-related information to the authenticator if the generation request is received again from the communication device after the authentication-related information has been generated but before the authentication-related information has been transmitted to the authenticator. (Item 6) The aforementioned intermediary server further, The system includes a second information transmission unit that transmits the aforementioned authentication-related information to the communication device, The communication system according to any one of items 1 to 5, wherein the authentication control unit controls the authentication process using the authentication-related information after receiving the authentication-related information from the intermediary server. (Item 7) The casing of the communication device has a code image attached to it, which is obtained by encoding the location information of the intermediary server. The communication system according to any one of items 1 to 6, wherein the first information transmission unit transmits the authentication-related information to the authenticator when a transmission request is received from the authenticator in response to the code image being read by the authenticator. (Item 8) The communication system according to any one of items 1 to 7, wherein the communication device does not include a display unit capable of displaying a code image obtained by coding the authentication-related information. (Item 9) The aforementioned authentication-related information is Passkey information in accordance with the Fast Identity Online (FIDO) method. The authentication process is a process in accordance with the FIDO scheme, as described in any one of items 1 to 8 of the communication system. (Item 10) A computer program for an intermediary server, The aforementioned intermediary server computer is comprised of the following parts, namely: A generation unit that generates authentication-related information when a generation request is received from a communication device, wherein the authentication-related information is information for performing authentication-related processing between the communication device and the authenticator, After the authentication-related information has been generated, if the authenticator receives a transmission request requesting the transmission of the authentication-related information, the first information transmission unit transmits the authentication-related information to the authenticator. A computer program that functions as such. (Item 11) It is a communication system, Communication equipment and Equipped with an intermediary server, The aforementioned communication device is A generation unit that generates authentication-related information when an authentication start instruction is received, wherein the authentication-related information is information for executing authentication-related processing between the communication device and the authenticator, The system includes a first information transmission unit that transmits the authentication-related information to the intermediary server, The aforementioned intermediary server, The system includes a second information transmission unit that transmits the authentication-related information to the authenticator when the authentication-related information is received from the communication device, The aforementioned communication device further, After the authentication-related information is transmitted from the intermediary server to the authenticator, an authentication control unit controls the authentication process using the authentication-related information, A communication system comprising a predetermined processing execution unit that executes a predetermined process when authentication according to the aforementioned authentication process is successful. (Item 12) A communication device, A generation unit that generates authentication-related information when an authentication start instruction is received, wherein the authentication-related information is information for executing authentication-related processing between the communication device and the authenticator, A first information transmission unit that transmits the aforementioned authentication-related information to an intermediary server, After the authentication-related information is transmitted from the intermediary server to the authenticator, an authentication control unit controls the authentication process using the authentication-related information, A predetermined processing execution unit executes predetermined processing when authentication according to the aforementioned authentication process is successful, A communication device equipped with the following features. [Explanation of Symbols]

[0097] 2: Communication system, 6: Internet, 10: Printer, 12: Control unit, 14: Bluetooth interface, 16: LAN interface, 18: Print execution unit, 30: Control unit, 32: CPU, 34: Memory, 36: Program, 100: Authenticator, 112: Control unit, 114: Bluetooth interface, 116: LAN interface, 118: Display unit, 120: Camera, 130: Control unit, 132: CPU, 134: Memory, 136: Program, 200: Authentication intermediary server, 216: Communication interface, 230: Control unit, 232: CPU, 234: Memory, 236: Program, 300: Print intermediary server, 316: Communication interface, 330: Control unit, 332: CPU, 334: Memory, 336: Program

Claims

1. It is a communication system, Communication equipment and Equipped with an intermediary server, The aforementioned communication device is A generation request transmission unit that, when an authentication start instruction is obtained, requests the intermediary server to generate authentication-related information, wherein the authentication-related information is information for executing authentication-related processing between the communication device and the authenticator, comprises the generation request transmission unit. The aforementioned intermediary server, When the generation request is received from the communication device, the generation unit generates the authentication-related information, The system includes a first information transmission unit that transmits the authentication-related information to the authenticator, The aforementioned communication device further, After the authentication-related information is transmitted from the intermediary server to the authenticator, an authentication control unit controls the authentication process using the authentication-related information, A communication system comprising a predetermined processing execution unit that executes a predetermined process when authentication according to the aforementioned authentication process is successful.

2. The generation request includes identification information that identifies the communication device, The aforementioned intermediary server further, Memory and The system includes a storage control unit that, when the aforementioned authentication-related information is generated, associates the identification information with the aforementioned authentication-related information and stores it in the memory, The communication system according to claim 1, wherein the first information transmission unit transmits the authentication-related information stored in the memory in association with the identification information to the authenticator when a transmission request including the identification information is received from the authenticator after the authentication-related information has been generated.

3. The first information transmission unit is, If a transmission request is received from the authenticator before a predetermined time has elapsed since the authentication-related information was generated, the authentication-related information is transmitted to the authenticator. The communication system according to claim 1, wherein if the transmission request is received from the authenticator after a predetermined time has elapsed since the authentication-related information was generated, the authentication-related information is not transmitted to the authenticator.

4. The first information transmission unit is, When a transmission request is received from the authenticator, the authentication-related information is transmitted to the authenticator. The communication system according to claim 1, wherein if the authentication-related information is transmitted to the authenticator and then the transmission request is received again from the authenticator or another authenticator, the authentication-related information is not transmitted to the authenticator or the other authenticator.

5. The communication system according to claim 1, wherein the first information transmission unit does not transmit the authentication-related information to the authenticator if the generation request is received again from the communication device after the authentication-related information has been generated but before the authentication-related information has been transmitted to the authenticator.

6. The aforementioned intermediary server further, The system includes a second information transmission unit that transmits the aforementioned authentication-related information to the communication device, The communication system according to claim 1, wherein the authentication control unit controls the authentication process using the authentication-related information after receiving the authentication-related information from the intermediary server.

7. The casing of the communication device has a code image attached to it, which is obtained by encoding the location information of the intermediary server. The communication system according to claim 1, wherein the first information transmission unit transmits the authentication-related information to the authenticator when a transmission request is received from the authenticator in response to the code image being read by the authenticator.

8. The communication system according to claim 1, wherein the communication device does not include a display unit capable of displaying a code image obtained by encoding the authentication-related information.

9. The aforementioned authentication-related information is Passkey information in accordance with the FIDO (Fast Identity Online) method. The communication system according to claim 1, wherein the authentication process is a process in accordance with the FIDO method.

10. A computer program for an intermediary server, The aforementioned intermediary server computer is comprised of the following parts, namely: A generation unit that generates authentication-related information when a generation request is received from a communication device, wherein the authentication-related information is information for performing authentication-related processing between the communication device and the authenticator, A first information transmission unit that transmits the authentication-related information to the authenticator, A computer program that functions as such.

11. A communication device, A generation unit that generates authentication-related information when an authentication start instruction is received, wherein the authentication-related information is information for executing authentication-related processing between the communication device and the authenticator, A first information transmission unit that transmits the aforementioned authentication-related information to an intermediary server, After the authentication-related information is transmitted from the intermediary server to the authenticator, an authentication control unit controls the authentication process using the authentication-related information, A predetermined processing execution unit executes predetermined processing when authentication according to the aforementioned authentication process is successful, A communication device equipped with the following features.

Images