Server, control method, and program therefor

Abstract

To maintain a security level when issuing a plurality of one-time passwords by disabling the remaining unused one-time passwords without reducing convenience as described above.SOLUTION: A server has: management means that manages a first token and a second token in association with each other; and disabling means that, when receiving the first token from an information processing apparatus, disables the second token managed by the management means in association with the received first token.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a server that issues one-time tokens, a control method, and a program therefor. [Background technology]

[0002] Traditionally, when logging into a website or web application, users have often been authenticated using a user ID and password. Passwords have problems, such as the strength of short strings being low, while long strings are difficult to remember. To improve authentication security, there is also a method of issuing a one-time password as an additional authentication factor in addition to the password for user authentication.

[0003] Patent Document 1 discloses a technology in which a one-time password is issued to a user, and if it is confirmed to match the one-time password entered by the user, the one-time password is invalidated as a used one-time password. Generally, for security reasons, one-time passwords are random numbers or random character strings, have a short expiration date, and once used, they are considered used and cannot be reused. The issued one-time password is notified to the user by email or other means. Other methods of notifying the one-time password include SMS (Short Message Service) to a mobile phone number and token software on a smartphone.

[0004] In Patent Document 1, a one-time password is notified to a user by email, triggered by a user action, such as a payment process. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent Publication No. 2007-328381 Summary of the Invention [Problem to be solved by the invention]

[0006] However, depending on the task performed by a web application, multiple user actions may occur in succession. Therefore, according to the technology of Patent Document 1, multiple one-time passwords are issued to a user in a short period of time. When one of the multiple issued one-time passwords is used, the one-time password is invalidated as "used." However, one-time passwords that have not been used among the multiple issued one-time passwords remain unused. Although the expiration date of one-time passwords is set to a short period of time, multiple valid one-time passwords exist during that expiration date, which leaves the risk of unauthorized login due to theft or leakage of one-time passwords.

[0007] It is also possible to invalidate previously issued one-time passwords each time a new one is issued. However, this method makes it impossible to know which of the multiple one-time passwords issued a user will attempt to use. Even if a user attempts to log in to a service using a certain one-time password, they may not be able to do so because that one-time password has been invalidated.

[0008] The present invention aims to maintain a security level by invalidating the remaining unused one-time passwords without reducing convenience as described above when multiple one-time passwords are issued. [Means for solving the problem]

[0009] A server having a verification means for verifying a token acquired from an information processing device, issuing means for issuing a plurality of tokens to a user, the plurality of tokens including a first token and a second token; a management unit that manages the first token and the second token issued by the issuing unit in association with each other; a sending means for sending an email containing a URL including the token issued by the issuing means to the information processing device; an invalidation unit that invalidates the first token and the second token that are managed by the management unit in association with the first token when the first token is received from the information processing device; A server comprising: [Effects of the Invention]

[0010] According to the present invention, when multiple one-time passwords are issued, the remaining unused one-time passwords can be invalidated without reducing convenience as described above, thereby maintaining the security level. [Brief explanation of the drawings]

[0011] [Figure 1] System and network configuration for implementing the present invention [Figure 2] Information processing function hardware configuration diagram [Figure 3] Software and hardware configuration diagram of this system [Figure 4] Scan application UI diagram (1) [Figure 5] Scan application UI diagram (2) [Figure 6] Client application UI diagram (1) [Figure 7] Client application UI diagram (2) [Figure 8] Notification method explanation diagram (1) [Figure 9] One-time token generation process flowchart [Figure 10] One-time token status change processing flowchart [Figure 11] Automatic division judgment process flowchart [Figure 12] Notification settings UI diagram [Figure 13] Notification method explanation diagram (2) [Figure 14] Role determination process flowchart DETAILED DESCRIPTION OF THE INVENTION

[0012] The following describes embodiments of the present invention with reference to the drawings. Note that the following embodiments do not limit the scope of the invention as claimed, and not all of the combinations of features described in the embodiments are necessarily essential to the solution of the invention.

[0013] Example 1 FIG. 1 shows an example of a system configuration and a network configuration for implementing the present invention.

[0014] Reference numeral 101 denotes a network such as the Internet or an intranet. Reference numeral 111 denotes a web application server. The client terminal 121 denotes an information processing device such as a personal computer, laptop computer, tablet computer, or smartphone. The scanner terminal 131 may be any device with a scanning function, such as a multifunction device that combines copy, print, and scan functions, or a scanner with a single scan function, and the form and type do not matter.

[0015] Figure 2 shows a modular configuration diagram of the information processing functions of the Web application server 111, client terminal 121, and scanner terminal 131. Reference numeral 202 denotes a network interface, which connects to a network such as a LAN and communicates with other computers and network devices. Communication can be via either wired or wireless means. Reference numeral 204 denotes a ROM in which pre-installed programs and data are stored. Reference numeral 205 denotes a temporary memory area, called RAM. Reference numeral 206 denotes a secondary storage device, such as a hard disk drive or flash memory. Reference numeral 203 denotes a CPU, which executes programs loaded from the ROM 204, RAM 205, or secondary storage device 206. Reference numeral 201 denotes a user interface, which inputs and outputs information and signals using a display, keyboard, mouse, buttons, touch panel, and the like. Computers that do not have this hardware can also be connected and operated from other computers using remote desktop or remote shell. Each component is connected via an input / output interface 207.

[0016] 3 shows the software configuration of this system. The software installed on each piece of hardware is executed by the CPU 203, and as shown by the network connection arrows, the configuration allows mutual communication.

[0017] Reference numeral 311 denotes a scan document processing application installed on the Web application server 111. Reference numeral 312 denotes an API (Application Programming Interface) provided by the scan document processing application 311. Reference numeral 313 denotes a Web UI provided by the scan document processing application 311.

[0018] Reference numeral 315 denotes an authentication application provided by the web application server 111. Reference numeral 316 denotes an API provided by the authentication application 315. Reference numeral 317 denotes a web UI provided by the authentication application 315. The web UIs 313 and 317 are configured with HTML, JavaScript, CSS, etc. that comply with the HTTP standard. The APIs 312 and 316 also process data input / output requests from clients as so-called RESTful APIs that comply with the HTTP standard.

[0019] Reference numeral 321 denotes a data store that stores data used by the scanned document processing application 311, authentication application 315, and back-end application 331, which will be described later. Reference numeral 322 denotes a scanned document storage unit. The scanned document storage unit 322 saves the file of the scanned document itself as an image file such as JPEG or a document file such as a portable document format (PDF). Reference numeral 323 denotes a scanned document job queue. The scanned document job queue 323 holds a queue that manages scanned document jobs waiting for input processing, which will be described later. Reference numeral 325 denotes a scanned document processing result storage unit. The scanned document processing result storage unit 325 stores OCR processing results. The scanned document processing result storage unit 325 also stores OCR area information used for each scanned document, input character string values, and the like.

[0020] Reference numeral 326 denotes user data. The user data 326 manages user information that can access the web application server 111. For example, it stores and manages authentication credentials such as user ID, password, and PIN, contact email address, and user role. As will be described in detail later, when the scan data status is ready, an email is sent to the client terminal 121 notifying the URL (access destination) of the scan job list UI. The email address here is used as the destination of the notification.

[0021] Reference numeral 327 denotes authentication session data. The authentication session data 327 stores and manages an authentication session issued when the user is successfully authenticated via the authentication application 315. Reference numeral 328 denotes token data. The token data 328 stores and manages a one-time token, which will be described later. In this embodiment, the explanation will be given on the assumption that the data 322 to 323 and 325 to 328 are all managed by the Web application server 111, but each data may be managed by multiple entities.

[0022] Reference numeral 331 denotes a back-end application for executing background processing. The back-end application 331 executes the following processes asynchronously in the background. Reference numeral 332 denotes an OCR processing unit. The OCR processing unit 332 acquires an input image from the scanned document storage unit 322 and executes OCR. In the OCR processing, the start coordinates, width, and height of the area recognized as a character string image, and the recognized OCR result character string are extracted. Reference numeral 334 denotes an external system communication unit. The external system communication unit 334 executes a process for transmitting the scanned document and the processing results to an external storage or the like. If there is no need to transmit the scanned document and the processing results to an external device, the external system communication unit 334 can be omitted. Reference numeral 335 denotes a notification processing unit. The notification processing unit 335 transmits a notification to the client terminal 121.

[0023] Reference numeral 351 denotes a client application. In this embodiment, the client application 351 is installed on the client terminal 121, and by calling various APIs published by the web application server 111, the client application 351 can utilize the functions of various web applications held by the web application server 111. Specifically, one method is to display web UIs 313 and 317 in a browser and execute the web application by sending and receiving necessary data to and from APIs 312 and 316. Alternatively, a computer or smartphone application designed to send and receive necessary data to and from APIs 312 and 316 may be used. When the client application 351 starts accessing the web application server 111, it first inputs authentication credentials and the like via the authentication application 315 to perform user authentication. The authentication application 315 references user data 326 to verify the entered authentication credentials. If the verification is successful, the authentication application 315 creates a new session in authentication session data 327 and records the authentication session information. The authentication application 315 returns a response including the authentication session to the client application 351, and the client application 351 is logged in to the web application server 111. After successful login, the client application 351 can access the Web UI 313 and API 312 of the scan document processing application 311, and the user can execute the scan document processing task. Details of the scan document processing task will be described later with reference to FIGS. 4 to 7. 355 is a notification receiving application. In this embodiment, an email client is used as the notification receiving application 355. As mentioned above, the notification method may be SMS or another application.

[0024] Reference numeral 352 denotes a scan application. The scan application 352 is installed in the scanner terminal 131, reads a paper document with a scanner unit, generates scan data (image file), and sends it to the scan document processing application 311. Like the client application 351, the scan application 352 also performs user authentication via the authentication application 315. The details of the authentication process are the same as those described for the client application 351, and will not be described here. Note that if the scanner terminal 131 is a model that cannot display a scan application UI, the scanner terminal 131 may be connected to the client terminal separately via USB, WiFi, or the like, and the scan application 352 may be executed on the client terminal 131 side.

[0025] The details of the scanned document processing work will be explained using FIGS.

[0026] 4 and 5 are diagrams illustrating the UI of the scan application 352.

[0027] Reference numeral 400 denotes a login UI. Reference numeral 401 denotes a PIN input control, and 402 denotes a login execution button. The scan application 352 sends the entered credentials to the authentication application 315, and after successful login, the scan application UI is displayed on the display unit of the scan terminal 131. Here, an example is shown in which a PIN is used as the credentials, but other credentials, such as a combination of a user ID and password, may also be used. Furthermore, when the authentication process is successful, the login UI 400 may transition directly to UI 410, but if the scanner terminal 131 is a multifunction device with a print function or the like, a menu screen (not shown) displaying a list of the functions of the multifunction device may be displayed, and UI 400 may be displayed when the scan function is selected on the menu screen.

[0028] Reference numeral 410 denotes a UI for selecting a transmission destination for the scanned document. Reference numeral 411 denotes a button control for selecting a destination. When the user selects and presses the button control 411, the UI transitions to the UI shown below.

[0029] Reference numeral 500 denotes a UI that can change scan settings. Reference numeral 501 denotes a selection control for changing scan setting values ​​such as color type and resolution. Reference numeral 502 denotes a button control for starting scanning. When the scan start button 502 is pressed, the scanner terminal 131 reads the original document with an optical sensor and generates a scanned image for each page.

[0030] Reference numeral 510 denotes a UI for previewing and sending to a destination. Reference numeral 511 denotes a control for displaying thumbnail images for preview and for page forwarding. Reference numeral 512 denotes a send button. When the send button 512 is pressed, the scan application 352 sends the scanned data to the scanned document processing application 311. The scanned document processing application 311 saves the received scanned data in the scanned document storage unit 322. At this time, the scanned data is saved in association with the user who logged in via the login UI 400. Information about the selected sending destination is also saved. The job is also registered in the scanned document job queue as a queue waiting for processing for the user. The queue status is set to awaiting OCR processing.

[0031] The OCR processor 332 obtains a queue of scanned document jobs from the scanned document job queue 323. The OCR processor 332 obtains scanned images stored in the scanned document storage unit 322 and performs OCR. The OCR processor 332 stores the OCR processing results in the scanned document processing result storage unit 325. The OCR processor 332 changes the queue status of the scanned document job queue 323 to waiting for user processing. At this point, the scanned document job is ready, and the user can start processing it in the client application 351.

[0032] FIG. 6 is a diagram illustrating the UI of the client application 351.

[0033] Reference numeral 600 denotes the scan job list UI. Reference numeral 601 denotes the URL of the scan job list UI. Reference numeral 610 denotes a list view control that displays the scan job list. Reference numeral 611 denotes a column that displays a thumbnail of the cover page of the scanned document. Reference numeral 612 denotes a column that displays the file name of the scanned document. Reference numeral 613 denotes a column that displays the date and time when the scanned document job became ready. Reference numeral 615 denotes a column that displays the destination of the scanned document. The client application 351 sends a request to obtain a list of scanned documents for the user who logged in to the scanned document processing application 311. The scanned document processing application 311 obtains scan jobs with a status of waiting for user processing from the scanned document job queue of the logged-in user in the job queue 323 and responds to the client application 351. The client application 351 lists the received list of scanned document jobs in the list view 610. Reference numeral 621 denotes a proofreading UI pane for checking and correcting the file name concatenation string. Reference numeral 623 denotes an image of the character string area extracted by OCR. Reference numeral 624 denotes an input control for displaying and correcting the OCR recognition result string.

[0034] Figure 7 shows a page preview of the scanned image and the UI for selecting the text area.

[0035] Reference numeral 701 denotes a page preview UI. Reference numeral 702 denotes a page preview image. Reference numeral 703 denotes a character string area selected to be used in the linked character string (621) described above. Reference numeral 704 denotes a selection completion button. When a link embedded in the thumbnail 611 is clicked from the list view control 610, the page preview UI 701 opens.

[0036] Reference numeral 711 is a diagram illustrating a character string area extracted by OCR. Reference numeral 712 is an encircling line indicating the OCR character string area. As a result of extracting the area containing the character string to be recognized by OCR from the scanned image, multiple independent character string areas (areas indicated by dotted rectangles in 711) such as 712 within 711 become selectable candidates. In the page preview UI 701, an encircling line is displayed only when the mouse pointer is hovered over the character string area 712, indicating that it is a selectable area. The user selects one or more character string areas to use in the filename concatenation string in the page preview UI 701 and presses the Done button 704 to reflect the selection results in the proofreading UI pane 621. Selected character string areas are highlighted with an encircling line and a tooltip to distinguish the selected area number, such as "1" or "2," as shown in 703.

[0037] Using the selected character string area, one or more recognition result character strings are obtained from the OCR results, concatenated, and set as the file name of the scanned document. As a result, a file name named with the concatenated character strings is displayed in file name 612. The user compares and reviews the character string area image 623 with the OCR recognition result character string 624, and corrects the character string in 624 if necessary. 626 is a send button. When the send button 626 is pressed, the client application 351 requests the scanned document processing application 311 to send the data to the destination. The scanned document processing application 311 saves the set file name in the scanned document processing result storage unit 325. The scanned document processing application 311 changes the queue status of the scanned document job queue 323 to waiting for transmission. The external system communication unit 334 acquires the processing queue of the scanned document job queue 323. The external system communication unit 334 acquires the scan data from the scanned document storage unit 322 and the transmission destination and set file name from the scanned document processing result storage unit 325. The external system communication unit 334 transmits the set file name to the destination so that it becomes the name of the file stored in the external storage, etc. The life cycle of the queue status of the scanned document job queue 323 is as follows: new registration → waiting for OCR processing → waiting for user processing → waiting for transmission processing → deletion.

[0038] In this embodiment, a use case has been exemplified in which the Web application server 111 and the client application 351 perform a task of proofreading the OCR results of a scanned document and sending them to a destination.

[0039] 8 is a diagram for explaining a method for notifying a scanned document job. Here, an example is shown in which email is used as the notification means and the notification receiving application 355 is an email client.

[0040] Reference numeral 800 denotes a user's email address inbox. Reference numeral 801 denotes a list of received emails containing scan job notifications. The inbox 800 is displayed on the user interface 201 of the client terminal 121.

[0041] Reference numeral 810 is an example of the email body. Like the inbox 800, it is displayed on the user interface 201 of the client terminal 121. Reference numeral 811 is a login URL containing a one-time token for logging in to the Web application 111. The login URL 811 includes query strings for otp, its value, and redirectto, its value. otp is a one-time password. In this embodiment, the one-time password will be referred to as a "one-time token" hereafter, but its definition is synonymous with a general one-time password. In other words, it is a credential issued temporarily with an expiration date that can be used for user authentication. One-time passwords issued by token hardware or token software often take a format that is relatively easy for humans to enter and handle, such as a six-digit number. However, when embedding the password in a URL or other location to notify the user, it is preferable to use a random string to ensure the uniqueness and security of the one-time password. For example, the login URL 811 may have a format like "745b4fb1a6d54b0a9370e2a8b23be7e1." Conventionally, the term "token" has the meaning of an identifier for communication handled by a computer, so in this embodiment, a random character string consisting of a long character string is called a one-time token.

[0042] "redirectto" specifies the URL path of the Web UI to which the user is redirected after successful login. "Redirect" refers to automatically transferring data from one URL to another. In this embodiment, after successful login, the authentication application 315 redirects the user to the URL of the Web UI 313 of the scan document processing application 311, and the scan job list UI 600 is displayed. This is the same as the path " / scanprocess" in URL 601.

[0043] In the scanned document processing task described in this embodiment, a notification is sent when OCR processing is complete, the scanned document job is ready, and the user can begin work. This notification is intended to enable the user to quickly begin scanned document processing, such as proofreading the OCR recognition results and sending them to the destination, in the client application 351 after completing scanning on the scanner terminal 131. The email body also includes a login URL 811 with a one-time token, so after receiving the email, the user can open the login URL and immediately use the scanned document processing application 311 to begin work. Logging in via the login URL redirects the user to the URL of the web UI 313 of the scanned document processing application 311, and the scan job list UI 600 is displayed on the client terminal 121.

[0044] The URL contains a one-time token, so the URL described in each email is different. However, because all URLs are redirected to the Web UI 313 of the scanned document processing application 311, even if multiple email notifications are received, if you access the login URL in any one of the emails, the scanned document job list screen (Figure 6) will be displayed and you can start processing the job.

[0045] Table 1 explains how to log in and manage one-time tokens.

[0046] As described above, when OCR processing of the scan data is completed and the queue status of the scanned document job queue 323 transitions to "waiting for user processing," the authentication application 315 generates a new one-time token in the token data 328 (Table 1).

[0047] [Table 1]

[0048] In Table 1, the one-time token "745b4fb1a6d54b0a9370e2a8b23be7e1" is the same as the value of the query string otp in the login URL 811. The user opens the login URL 811 in the notification using the client application 351. The client application 351 sends an HTTP request including the login URL 811 to the authentication application 315. The authentication application 315 verifies whether the URL query string otp in the received HTTP request matches any issued one-time token in the one-time token management data store in Table 1. If a match is found, the authentication application 315 verifies that the "status" in Table 1 is unused and the current date and time has not expired, and that the user ID exists as a valid user in the user data 326. If this verification is successful, the authentication application 315 issues an authentication session and stores it in the authentication session data 327.

[0049] The "User ID" in Table 1 is associated with the user's email address managed in the user data 326. This email address is used when notifying the client terminal 121 of a URL including the "One-Time Token" in Table 1.

[0050] Table 2 shows the authentication session data store.

[0051] [Table 2]

[0052] Once the URL is verified, the authentication application 315 responds to the client application 351 that the login was successful. The response includes a session ID. The client application 351 saves the session ID in local storage within the application. Thereafter, when the URL of the scanned document processing application 311 is accessed, the session ID is set in a cookie in the HTTP request. The scanned document processing application 311 verifies whether the session ID in the request is valid by referencing the authentication session data 327 (Table 2). If the session ID is successfully verified, the client application 351 can continue to access the scanned document processing application 311 using the user ID "User A" associated with the session ID.

[0053] Now, let us focus on Table 1 and the list of scan job notifications 801. The scanned document processing task of this embodiment is one of the use cases in which user actions occur consecutively, as mentioned at the beginning of the description of the problem of the present invention. It is possible that multiple scans are performed in a short period of time, resulting in multiple scanned document jobs. In this case, if a one-time token is issued when the status of each scanned document job becomes awaiting user processing, multiple one-time tokens are generated, as shown in Table 1. Furthermore, multiple URL notifications with one-time tokens are sent, as shown in the list of scan job notifications 801.

[0054] As explained above, a user logs in to the Web application server 111 using a one-time token beginning with "745b4f." However, the remaining two one-time tokens in Table 1 remain unused. Leaving unused one-time tokens open up the risk of unauthorized logins and data theft due to token theft, etc. A solution to this problem will be explained below with reference to FIGS. 9 to 14.

[0055] FIG. 9 is a flowchart of the one-time token generation process.

[0056] The scanned document job is ready, and the user can start processing the scanned document (S901). The authentication application 315 generates a one-time token [n] for the user who is the owner of the scanned document job and stores it in the token data 328 (S902). The issued one-time tokens in the token data 328 are queried using the AND condition for all of the following (S903):

[0057] - Issued to the same user as the S901 scanned document job The issue date and time is within a certain time period (e.g., 60 minutes) from the issue date and time of the one-time token [n]. · Items in unused condition It is determined whether a one-time token matching the query exists (S904).

[0058] If the determination in S904 is Yes, the one-time token [m] and one-time token [n] found in the query are added to the same one-time token management group [p]. If there is no one-time token management group [p], a new one is created. At this time, the one-time token management data store is recorded as shown in Table 3. By adding a management group identifier, different one-time tokens can be associated and grouped. One-time tokens with the same management group identifier are treated as one-time tokens belonging to the same group. Details will be described later, but if even one one-time token belonging to the same group is changed to the "used" state, the other one-time tokens belonging to the same group are also changed to the "used" state.

[0059] [Table 3]

[0060] The notification processing unit 335 transmits the issued login URL with the one-time token to the notification receiving application 352 (S906).

[0061] FIG. 10 is a flowchart for changing a one-time token to a "used" state.

[0062] When the user opens the login URL 811 via the client application 351, a login request is sent to the authentication application 315, which triggers the start of the process shown in FIG.

[0063] The authentication application 315 receives a request (S1001). The authentication application 315 obtains the value of the one-time token from the query string of the login URL of the request. The authentication application 315 verifies whether the obtained one-time token matches any one-time token already issued in the one-time token management data store (S1002). If a match is found, the authentication application 315 verifies that the status is unused and that the current date and time has not expired (S1002). The result of the verification in S1002 is determined (S1003). If the verification result in S1003 is No, the authentication application 315 responds to the client application 351 that the login has failed (S1004) and ends the process. Instead of the login failure response, the authentication application 315 may redirect to a normal login screen so as not to give any hint that the authentication has failed.

[0064] If the verification result in S1003 is Yes, the authentication application 315 changes the status of the one-time token [n] to "used" (S1005). Next, the authentication application 315 changes the status of all other one-time tokens in the management group [p] to which the one-time token [n] belongs to to "used" (S1006). At this time, as shown in Table 3, the use of a token within the same group is recorded as the reason for changing to "used." This is to distinguish between one-time token [n], which was actually used in a login request, and other tokens, which were not used but were changed to "used" due to the use of a token within the same group. This completes the processing in Figure 10.

[0065] As explained above, one-time tokens issued to the same user over a certain period of time are grouped together. This allows all other one-time tokens in the group to be used when any one one-time token in the group is used. This solution prevents unnecessary one-time tokens from remaining unused after a single login, even if multiple one-time tokens are issued, and maintains the same security as the one-time token's advantage of being disposable.

[0066] In this embodiment, a use case is taken as an example in which a one-time token is issued and a user logs in when the user needs to log in within the processing flow of a scanned document processing task. However, it should be noted that this is not limited to the above use case, and the present invention can also be applied to other use cases in which a one-time token is issued when some user action or system trigger action occurs within the processing flow.

[0067] <Example 2> A function that can be provided by the scan application 352 or the scan document processing application 311 is automatic division of a scan document job. The automatic division function is a function that, when a multi-page document is scanned, divides it into units such as by page rather than into a single scan data and saves it as multiple scan data. By saving it as multiple scan data, each scan data is displayed and processed as an independent scan data in the scan job list 610 in FIG. 6. The unit of division is not particularly limited here, and may be, for example, by the number of pages, or by dividing the page where a specific barcode or QR code (registered trademark) is detected as the first page.

[0068] For example, suppose 10 original documents are automatically divided into 10 scanned document jobs. When the preparation of these scanned document jobs is complete, 10 one-time tokens will be generated and notified for the 10 scanned document jobs, as shown in Figure 10. In this situation, an additional issue arises: to prevent the generation of one-time tokens and notification of these one-time tokens by email.

[0069] A solution to this additional problem will be explained with reference to FIGS.

[0070] FIG. 11 is a flowchart of the automatic division decision process.

[0071] After the scan document job [n] is ready in S901, the authentication application 315 determines whether the scan document job [n] was generated by automatic division (S1101). If the determination in S1101 is No, the process proceeds to S902 and a one-time token is issued. If the determination in S1101 is Yes, the process proceeds to S902 and a one-time token is issued. If the determination in S1102 is No, the one-time token is not issued. If the determination in S1102 is Yes, the process proceeds to S902 and a one-time token is issued.

[0072] FIG. 12 illustrates a method for enabling each user to set notification settings for automatic division.

[0073] Reference numeral 1200 denotes a notification setting UI for automatic division, which is a screen provided by the Web UI 317 of the authentication application 315. Reference numeral 1201 denotes radio buttons for selecting the notification timing. By selecting a radio button, it is possible to send an email notification of both the first and last scanned document jobs among the automatically divided scanned document jobs, or to send an email notification of either the first or last scanned document job.

[0074] The notification timing can be selected and set for each user using the notification setting UI 1200. By referring to this setting, the judgment conditions in S1102 can be overridden for each user with the content selected in 1201, and a one-time token can be generated and notified when the conditions selected in 1201 are met. The processing content of S1102 in Figure 11 also changes depending on the item selected in 1201.

[0075] As explained above in Figures 11 and 12, in cases where multiple scanned document jobs are generated and processed within a very short period of time due to automatic division, the number of one-time tokens issued is limited to prevent an unnecessarily large number of one-time tokens from being issued and notified.

[0076] Here, we will explain the job delegation function as an additional function of the scanned document processing job described above. We will also explain how to perform the login process using a one-time token for a delegated scanned document job.

[0077] FIG. 13 is a flowchart showing the delegation notification process for a scanned document job.

[0078] Reference numeral 1300 denotes the body of the scanned document job delegation notification email. Reference numeral 1301 denotes the login URL. The user who logs in via the scan application 352 and sends the scanned data while logged in is the owner of the scanned document job. The owner user can delegate subsequent scanned document processing tasks to other users.

[0079] [Table 4]

[0080] As shown in Table 4, when User A delegates a scanned document job to User B, the scanned document processing application 311 records the delegated user in the scan document job queue waiting for processing. When an assignment event for the delegated user occurs, the notification processing unit 335 sends a scanned document job notification 1300 to the delegated user. At this time, a one-time token is not issued. In other words, the login URL 1301 of the scanned document job notification 1300 notified to the delegated user does not include the one-time token in the query string otp. When the delegated user opens the login URL 1301 with the client application 351, a normal login screen (not shown) is displayed. An example of a normal login screen is a screen for entering a user ID and password. Other user authentication methods are also possible.

[0081] By not issuing a one-time token to the delegated user, it is possible to unconditionally prevent the delegated user from accessing the scan data.

[0082] FIG. 14 is a flowchart showing the process of determining whether a one-time token can be used based on the role assigned to the user.

[0083] [Table 5]

[0084] [Table 6]

[0085] As an example of granted roles, assume there are three roles as shown in Table 5. The overall management role is a role that has administrative authority over the Web application server 111. The user management role is a role that has administrative authority over user data 326. The general role is a role that only uses the scanned document processing application 311 but does not have administrative authority.

[0086] The administrative authority indicates a stronger authority that allows changing the settings of the web application 111 and adding, changing, and deleting user data 326. The general role can use the scanned document processing application 311 from the client application 351, but is only granted limited authority such as access to the user's own scanned document jobs.

[0087] Assume that User C, who has been assigned the administrative role, logs in from the scan application 352, sends a scanned image, and creates a scanned document job. When the scanned document job enters a status of waiting for user processing, a scanned document job notification including a URL with a one-time token is sent to User C's email address, as in 810. When User C accesses the URL with the one-time token, the client application 351 sends a login request to the authentication application 315. The authentication application 315 receives the login URL request with the one-time token (similar to S1001). The authentication application 315 queries the issued one-time token [n] to identify the user ID (S1401). The authentication application 315 queries the user data 326 to identify the roles assigned to the user ID of the one-time token [n] (S1402). The authentication application 315 determines whether at least one of the assigned roles has administrative privileges (S1403). Since User C is assigned the administrative role, the determination in S1403 is Yes and the process proceeds to S1404.

[0088] The authentication application 315 disables the one-time token [n] and responds with a normal login screen to the client application 351 (S1404). If the determination in S1403 is No, the process proceeds to one-time token verification in S1002. The additional processing described in the flowchart of FIG. 14 is an option that disables the use of one-time tokens if the user has stronger administrative authority, even when a one-time token is issued to the user. The advantage of this option is that when a user with stronger administrative authority requests access, login using a one-time token is not permitted and normal user authentication is required. In this embodiment, one-time tokens are permitted as a means for general role users to quickly log in to the scanned document processing application. This is because the access scope of general role users is limited to only their own scanned document jobs in the scanned document processing application. For users with strong administrative authority, normal user authentication is required for screens and operations other than the scanned document processing application after login, as they have administrative authority, thereby maintaining security.

[0089] <Other Examples> The present invention can also be realized by executing the following process. That is, software (program) that realizes the functions of the above-described embodiments is supplied to a system or device via a network or various storage media, and the computer (or CPU, MPU, etc.) of the system or device reads and executes the program. In this case, the computer program and the storage medium storing the computer program constitute the present invention. [Explanation of symbols]

[0090] 111 Web Application Server 121 client terminals 131 Scanner terminal 311 Scan Document Processing Application 315 Authentication Application 321 Data Store 315 Client Applications 352 Scanning Application 355 Notification Receiving Application

Claims

1. A server having a verification means for verifying a token acquired from an information processing device, issuing means for issuing a plurality of tokens to a user, the plurality of tokens including a first token and a second token; a management unit that manages the first token and the second token issued by the issuing unit in association with each other; a sending means for sending an email containing a URL including the token issued by the issuing means to the information processing device; an invalidation unit that invalidates the first token and the second token that are managed by the management unit in association with the first token when the first token is received from the information processing device; A server comprising:

2. 2. The server according to claim 1, wherein the first token is written in the URL.

3. The server The system further includes a providing unit that acquires scan data from a multifunction peripheral having at least a scan function and provides a service related to the scan data, 3. The server according to claim 2, wherein when the URL is accessed by the information processing device, the server provides the service to the information processing device.

4. 4. The server according to claim 3, wherein when the URL is accessed by the information processing device, the server transfers the access destination of the information processing device to the service.

5. The information processing device includes:

5. The server according to claim 3, wherein information about the scan data is displayed when the URL is accessed.

6. The transmitting means A server according to any one of claims 3 to 5, which sends to the information processing device a first email containing a first URL including the first token and a second email containing a second URL including the second token.

7. 7. The server according to claim 6, further comprising a setting means for setting whether to send both the first email and the second email, or to send either the first email or the second email.

8. A server as described in claim 6 or 7, characterized in that the information regarding the scan data displayed by accessing the first URL is the same as the information regarding the scan data displayed by accessing the second URL.

9. The management means A server according to any one of claims 6 to 8, which manages in association with the user information logged in to the multifunction device when the scanned data is sent to the server, the email address to which the first URL and the second URL are sent.

10. 10. The server according to claim 1, wherein the token issued by the issuing means has an expiration date set thereto.

11. The method further includes providing means for providing a service related to the scan data, 11. The server according to claim 1, wherein the information processing device logs in to the service using the token issued by the issuing means.

12. What is token revocation? 12. The server according to claim 1, wherein the server changes information indicating the status of the token to information indicating that the token has been used.

13. A server control method having a verification step of verifying a token acquired from an information processing device, an issuing step of issuing a plurality of tokens to the user, the plurality of tokens including a first token and a second token; a management step of managing the first token and the second token issued in the issuing step in association with each other; a sending step of sending an email containing a URL including the token issued in the issuing step to the information processing device; an invalidation step of invalidating the second token managed in association with the first token in the management step when the first token is received from the information processing device; A server control method comprising:

14. Computer, A program for causing a server to function as a server having a verification means for verifying a token acquired from an information processing device, issuing means for issuing a plurality of tokens to a user, the plurality of tokens including a first token and a second token; a management unit that manages the first token and the second token issued by the issuing unit in association with each other; a sending means for sending an email containing a URL including the token issued by the issuing means to the information processing device; an invalidation unit that invalidates the first token and the second token that are managed by the management unit in association with the first token when the first token is received from the information processing device; A program for functioning as a server, comprising:

Images