Information processing device, information processing method, and program

Abstract

To provide an information processing device, an information processing method, a program, and a storage medium which reduce a ratio of the number of users using an authentication service to the number of users using an application using the authentication service.SOLUTION: In an information processing system 1, an information processing device 100 includes: a state acquisition unit 121 which acquires a state of a first application by execution of a second application; an authentication determination unit 122 which determines whether or not to perform authentication processing according to the state of the first application acquired by the execution of the second application; and an authentication instruction unit 123 which, when the authentication processing is determined to be performed, performs an instruction for performing the authentication processing by execution of the first or second application.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] This disclosure relates to a technique for controlling the timing of authentication processing.

Background Art

[0002] User authentication is performed to control a device by accepting only operations from a specific user. Patent Document 1 discloses a technique for outputting information prompting user authentication to an application operating on a mobile terminal according to the positional relationship between a multi-story parking lot and the mobile terminal owned by the user in a control system of the multi-story parking lot. On the other hand, there is a system composed of a client device (hereinafter simply referred to as "client") and a server device (hereinafter simply referred to as "server"). In such a system, an authentication and authorization mechanism for communication between the client and the server using an application operating on the client is required. The authentication and authorization mechanism is provided, for example, as a service (hereinafter referred to as "authentication service") that provides authentication and authorization functions from a public cloud.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] It is required to reduce the ratio of the number of users using the authentication service to the number of users using an application that uses the authentication service.

Means for Solving the Problems

[0005] The information processing device relating to this disclosure is an information processing device that executes a first application and a second application, wherein the execution of the second application executes the first application of A state acquisition means for acquiring a state, and the execution of the second application, which acquires the state of the first application through the state acquisition means. of Depending on the situation, recognition The system includes an authentication determination means for determining whether or not to perform authentication processing, and an authentication instruction means for issuing an instruction to perform the authentication processing by executing the first application or the second application when the authentication determination means determines that the authentication processing should be performed. The state acquired by the state acquisition means is whether or not the first application is installed, and the authentication determination means determines that the authentication process will not be performed if the first application is not installed. do. [Effects of the Invention]

[0006] According to this disclosure, it is possible to reduce the ratio of the number of users using authentication services to the total number of users using applications that utilize authentication services. [Brief explanation of the drawing]

[0007] [Figure 1] This is a block diagram showing an example of the configuration of an information processing system according to Embodiment 1. [Figure 2] This is a block diagram showing an example of the hardware configuration of an information processing device according to Embodiment 1. [Figure 3] This is a block diagram showing an example of the configuration of the management server according to Embodiment 1. [Figure 4] This is a block diagram showing an example of the configuration of the authentication server according to Embodiment 1. [Figure 5] This is a sequence diagram showing an example of a processing sequence according to Embodiment 1. [Figure 6] This is an explanatory diagram illustrating an example of an authentication screen according to Embodiment 1. [Figure 7] This sequence diagram shows another example of the processing sequence according to Embodiment 1. [Figure 8]This is a sequence diagram showing an example of the processing sequence for the authentication process according to Embodiment 1. [Figure 9] This flowchart shows an example of the processing flow according to Embodiment 1. [Figure 10] This is a sequence diagram showing an example of the processing sequence for the authentication process according to Embodiment 2. [Figure 11] This is a sequence diagram showing an example of the processing sequence for the authentication process according to Embodiment 3. [Modes for carrying out the invention]

[0008] Embodiments of this disclosure will be described below with reference to the attached drawings. Note that the configurations shown in the following embodiments are merely examples, and the scope of this disclosure is not limited to these configurations alone. Furthermore, not all configurations shown in the following embodiments are necessarily essential to this disclosure.

[0009] <Embodiment 1> The information processing system 1 according to Embodiment 1 will be described with reference to Figures 1 to 9. Figure 1 is a block diagram showing an example of the configuration of the information processing system 1 according to Embodiment 1. The information processing system 1 includes a management server 11, an authentication server 12, and an information processing device 100. Hereinafter, the management server 11 and the authentication server 12 will be collectively referred to simply as "servers." In other words, when "server" is referred to simply in this specification, it refers to a server system composed of one or more servers. The servers and the information processing device 100 communicate with each other via their respective networks 13, 14, and the internet 15. The management server 11 and the authentication server 12 also communicate with each other via network 14.

[0010] The management server 11 is a device that operates as the backend of the information processing device 100 and manages or controls the resources that can be provided to the information processing device 100. Here, the resources managed or controlled by the management server 11 (hereinafter referred to as "managed resources") are data such as images or documents that can be provided to the information processing device 100, or external devices not shown in Figure 1, such as printers that have functions such as printing. Here, the external device is not limited to a printer, but may be an image input device such as a scanner or camera that has an image reading function. The management server 11 receives information from the information processing device 100 based on user input operations, etc., and manages or controls the managed resources based on that information. The configuration of the management server 11 will be described later. The authentication server 12 is a device that performs the process of authenticating users (hereinafter referred to as "authentication process") and the process of granting users authenticated by the authentication process the authority to access managed resources (hereinafter referred to as "authorization process"). The configuration of the authentication server 12 will be described later.

[0011] As shown in Figure 1, the information processing device 100 operates by executing a first application 110 and a second application 120. The first application 110 has the function of outputting information for accessing management resources to the management server 11 based on user input operations. Specifically, for example, the first application 110 has a resource request unit 111, a screen generation unit 112, and a screen output unit 113 that function when it is executed. In addition to the above configuration that functions when it is executed, the first application 110 may also have an authentication instruction unit, which is not shown in Figure 1 of the first application 110, that functions when it is executed.

[0012] The second application 120 has a function of controlling, according to the state of the first application 110, the timing of a process (authentication process) for causing the authentication server 12 to authenticate the user upon its execution. Specifically, for example, the second application 120 has a state acquisition unit 121, an authentication determination unit 122, an authentication instruction unit 123, and an authentication acquisition unit 124 that function upon its execution. In the first embodiment, the second application 120 will be described as having an authentication instruction unit 123 that functions upon its execution. However, the authentication instruction unit 123 is not necessarily limited to being a component that functions upon the execution of the second application 120. When the second application 120 does not have an authentication instruction unit 123 that functions upon its execution, the authentication instruction unit 123 may be a component that functions upon the execution of the first application 110. The processing of each component that functions upon the execution of the first application 110 and the second application 120 will be described later.

[0013] The processing of each component that functions in the information processing apparatus 100 is performed by hardware such as an ASIC (Application Specific Integrated Circuit) incorporated in the information processing apparatus 100. The processing may be performed by hardware such as an FPGA (Field Programmable Gate Array). Further, the processing may be performed by software using a memory such as a RAM (Random Access Memory) and a processor such as a CPU (Central Processor Unit). The details of the processing of each component that functions in the information processing apparatus 100 will be described later.

[0014] Here, referring to FIG. 2, the hardware configuration of the information processing apparatus 100 when each part functioning in the information processing apparatus 100 operates as software will be described. FIG. 2 is a block diagram showing an example of the hardware configuration of the information processing apparatus 100 according to the first embodiment. The information processing apparatus 100 is configured by a computer, and the computer has a CPU 211, a ROM 212, a RAM 213, an auxiliary storage device 214, a display unit 215, an operation unit 216, a communication unit 217, and a bus 218 as shown as an example in FIG. 2.

[0015] The CPU 211 is a processor that functions as each part that functions in the information processing apparatus 100 shown in FIG. 1 by controlling the computer using a program or data stored in the ROM 212 or the RAM 213. Note that the information processing apparatus 100 may have one or more dedicated hardware different from the CPU 211, and at least a part of the processing by the CPU 211 may be executed by the dedicated hardware. Examples of the dedicated hardware include an ASIC, an FPGA, and a DSP (Digital Signal Processor). The ROM 212 is a memory that stores programs and the like that do not require modification. The RAM 213 is a memory that temporarily stores a program or data supplied from the auxiliary storage device 214, or data and the like supplied from the outside via the communication unit 217. The auxiliary storage device 214 is configured by, for example, a hard disk drive, and stores various data such as image data or audio data.

[0016] The display unit 215 is configured by, for example, a liquid crystal display or an LED, and displays a GUI (Graphical User Interface) or the like for a user to operate the information processing apparatus 100 or view the state of processing in the information processing apparatus 100. The operation unit 216 is configured by, for example, a keyboard, a mouse, a joystick, or a touch panel, and receives an operation by the user and inputs various instructions to the CPU 211. The CPU 211 also operates as a display control unit that controls the display unit 215 and an operation control unit that controls the operation unit 216.

[0017] The communication unit 217 is used for communication between the information processing device 100 and external devices. For example, if the information processing device 100 is connected to an external device by a wired connection, a communication cable is connected to the communication unit 217. If the information processing device 100 has a function for wireless communication with an external device, the communication unit 217 is equipped with an antenna. The bus 218 transmits information by connecting the CPU 211, ROM 212, RAM 213, auxiliary storage device 214, display unit 215, operation unit 216, and communication unit 217 of the information processing device 100. In the first embodiment, the display unit 215 and the operation unit 216 are described as being located inside the information processing device 100, but at least one of the display unit 215 and the operation unit 216 may be located outside the information processing device 100 as a separate device.

[0018] The configurations of the management server 11 and the authentication server 12 will be described with reference to Figures 3 and 4. Figure 3 is a block diagram showing an example of the configuration of the management server 11 according to Embodiment 1. The management server 11 includes a control information acquisition unit 301, a resource control unit 302, and an endpoint acquisition unit 303. The management server 11 is configured by a computer having hardware as shown as an example in Figure 2, and the processing of each part of the management server 11 is performed by said hardware.

[0019] The control information acquisition unit 301 acquires information output from the information processing device 100, which is information necessary for the information processing device 100 to access the management resources, via the Internet 15 or the like. The endpoint acquisition unit 303 acquires API (Application Programming Interface) endpoints. For example, the endpoint acquisition unit 303 acquires API endpoints by reading API endpoint information from a storage device (not shown in Figure 3). Here, an API endpoint is a URI (Uniform Resource Identifier) ​​assigned to each management resource, and is used to access the management resources. The information processing device 100 can access the management resources by making a request to the API endpoint using HTTP (Hyper Text Transfer Protocol) or the like. In other words, the information acquired by the control information acquisition unit 301 is information indicating a request using HTTP or the like, and is information necessary for the information processing device 100 to access the management resources.

[0020] The resource control unit 302 manages or controls the managed resources based on the information acquired by the control information acquisition unit 301 and the API endpoint acquired by the endpoint acquisition unit 303. For example, if the information acquired by the control information acquisition unit 301 is a request to acquire a document data managed by the management server 11, the resource control unit 302 acquires the document data using the API endpoint corresponding to that document data. Note that managed resources such as document data are stored in a storage device (not shown in Figure 3), and the resource control unit 302 acquires them by reading the data corresponding to the API endpoint from the storage device using the API endpoint.

[0021] As described above, management resources are not limited to data such as documents. For example, management resources may be external devices such as printers that are directly connected to the management server 11 or indirectly connected via the network 13, etc., as long as they are managed by the management server 11. For example, if the management resource is a printer, the information processing device 100 can, via HTTP or the like, cause the management server 11 to print an image showing the desired data to the printer.

[0022] Figure 4 is a block diagram showing an example of the configuration of an authentication server 12 according to Embodiment 1. The authentication server 12 has an authentication processing unit 401 and an authorization processing unit 402. The authentication server 12 is configured by a computer having the hardware shown as an example in Figure 2, and the processing of each part of the authentication server 12 is performed by said hardware.

[0023] The authentication processing unit 401 identifies who the user is. Specifically, for example, the authentication processing unit 401 maintains authentication information for each user, such as an ID (Identification) or password, to identify each of multiple users. The authentication processing unit 401 obtains authentication information entered by the user through an input operation from the information processing device 100. Furthermore, the authentication processing unit 401 identifies the user by referring to the multiple authentication pieces of information held for each user and verifying which user the obtained authentication information matches. Hereinafter, the process by which the authentication processing unit 401 identifies the user will be referred to as the authentication process.

[0024] The authorization processing unit 402 grants the user authenticated by the authentication processing unit 401 permission to access the management resources. Hereinafter, the process by which the authentication processing unit 401 grants permission to access the management resources will be referred to as the authorization process. For example, in the standard protocol OAuth, explicit authorization from the user is required for the management server 11 to access the management resources in response to an HTTP or other request from the information processing device 100. Specifically, in the form using OAuth, when a user requests authorization processing from the authorization processing unit 402 using the information processing device 100, the authorization processing unit 402 issues an access token to the information processing device 100 that allows the management server 11 to access the management resources. The information processing device 100 can then use that access token to make an HTTP or other request and access the management resources corresponding to the API endpoint.

[0025] Returning to Figure 1, we will now describe the parts that function when the first application 110 is executed. The resource request unit 111 makes requests to the management server 11, such as reading, changing, adding, deleting, or controlling management resources. For example, the resource request unit 111 makes the request to the management server 11 by outputting information indicating the request to the management server 11. The screen generation unit 112 generates an image showing a screen such as an operation screen, or information that can constitute such a screen, corresponding to the response from the management server 11 to the request made to the management server 11. The screen output unit 113 outputs the image or information generated by the screen generation unit 112.

[0026] The following describes the functions of the second application 120. The state acquisition unit 121 acquires the state of the first application 110. The authentication determination unit 122 determines whether or not to perform authentication processing according to the state of the first application 110 acquired by the state acquisition unit 121. The authentication instruction unit 123 issues an instruction (hereinafter referred to as "authentication instruction") to the authentication server 12 if the authentication determination unit 122 determines that authentication processing should be performed. The authentication instruction unit 123 may issue the authentication instruction directly to the authentication server 12, or it may issue the authentication instruction to the authentication server 12 via the management server 11. The authentication acquisition unit 124 acquires the authentication information that the authentication instruction unit 123 sends to the management server 11 or the authentication server 12 when it instructs the authentication processing. Specifically, for example, it acquires information such as an ID or password entered by a user by operating an operation input device (not shown in Figure 1) as authentication information. In the following description, the authentication instruction unit 123 will also make requests for authorization processing in addition to authentication instructions.

[0027] The processing sequences for authentication and authorization in the information processing system 1 will be described with reference to Figures 5 and 7. Figure 5 is a sequence diagram showing an example of the processing sequence in the information processing system 1 according to Embodiment 1. In the description of Figure 5, the symbol "S" represents a step.

[0028] The sequence diagram shown in Figure 5 is an example of how the first application 110 and the second application 120 operate as web applications running on the information processing device 100. For example, the first application 110 and the second application 120 are written in a scripting language executable by a browser application (hereinafter referred to as "browser") and are executed by a browser running on the information processing device 100. Examples of scripting languages ​​executable by a browser include JavaScript® or CSS (Cascading Style Sheets). However, the scripting languages ​​executable by a browser are not limited to JavaScript® or CSS.

[0029] The first application 110 and the second application 120 may operate on an information processing device 100 that operates as an application server. In this case, the information for configuring the GUI generated by the first application 110 and the second application 120 is output and presented to a device used by the user, such as a personal computer, tablet terminal, or smartphone, which is not shown in Figure 1. Hereinafter, the device used by the user, such as a personal computer, tablet terminal, or smartphone, will be referred to as the user device. The browser operating on the user device renders the information for configuring the GUI generated by the first application 110 and the second application 120, thereby displaying the GUI on a display device connected to the user device. When the user performs an input operation on the user device, the browser operating on the user device sends a request to the first application 110 and the second application 120 operating on the information processing device 100 to instruct them to execute. The first application 110 and the second application 120 perform operations in response to the request from the browser and present the results of the operations to the browser.

[0030] Hereinafter, the first application 110 and the second application 120 are described as being written in a browser-executable scripting language and running on a browser operating in the information processing device 100. In Figure 5, before the processing of S501 is executed, the first application 110 makes a request to the management server 11, etc. Upon receiving the request from the first application 110, the management server 11, etc. returns an HTTP response that redirects to the request.

[0031] When an HTTP response is received from the management server 11, etc., in S501, the browser is given a URL to request information including the second application 120 from the website that provides the second application 120. That is, this URL is the endpoint of the authentication server 12, and this URL is specified when an HTTP response is returned for a redirect to the request from the first application 110 to the management server 11, etc. Next, in S502, the browser sends a request to the website using the specified URL to request information including the second application 120.

[0032] Next, in S503, the website sends information including the second application 120 to the browser by returning a redirect HTTP response to the browser in response to the request from the browser. The browser receives the information including the second application 120 and executes the script contained in that information, thereby running the second application 120. By executing the second application 120, the browser displays a screen for issuing authentication instructions to the authentication server 12 (hereinafter referred to as the "authentication screen") as a GUI (Graphical User Interface) on the display device.

[0033] The authentication screen will be described with reference to Figure 6. Figure 6 is an explanatory diagram illustrating an example of the authentication screen according to Embodiment 1. In Embodiment 1, the authentication screen 600 shown in Figure 6 is a GUI provided by the execution of the second application 120 and is a GUI displayed in a browser. The authentication screen 600 consists of an area 601 for displaying the ID entered by the user, an area 602 for displaying the password, and a button 603 for performing an input operation to indicate that the user has completed entering the ID and password. The text "I authorize the first application to access the service." included in the authentication screen 600 shown in Figure 6 represents the explicit authorization from the user as described above. Note that the authentication screen 600 shown in Figure 6 is merely an example, and the authentication screen 600 is not limited to the one shown in Figure 6.

[0034] Next, in S504, the user refers to the authentication screen 600 displayed in the browser, enters their ID and password as authentication information, and then presses button 603. Here, "pressing" means, for example, using a pointing device to point to any location within the area where button 603 is displayed and clicking, or using a touch sensor to tap that location. The user pressing button 603 constitutes explicit authorization from the user. When button 603 is pressed, the authentication information entered by the user is acquired by the authentication acquisition unit 124. Next, in S505, the browser running the second application 120 sends the ID and password entered by the user as authentication information to the authentication server 12 and issues an authentication instruction. This authentication instruction is issued by the authentication instruction unit 123. Note that the authentication instruction to the authentication server 12 may also be made via the management server 11. In this case, the browser running the second application 120 issues the authentication instruction to the management server 11. Furthermore, the management server 11 receives an authentication instruction from the browser and issues an authentication instruction to the authentication server 12. When an authentication instruction to the authentication server 12 is made via the management server 11, the management server 11 receives the authentication instruction and issues an authentication instruction to the authentication server 12 based on the received instruction. The management server 11 has an instruction relay unit (not shown in Figure 3).

[0035] For example, the second application 120, executed by a browser, obtains the state of the first application 110 before sending authentication information to the authentication server 12. The state of the first application 110 is obtained by the state acquisition unit 121. Furthermore, it determines whether or not to issue an authentication instruction to the authentication server 12 based on this state. This determination is made by the authentication determination unit 122. The manner in which the state of the first application 110 is obtained by the state acquisition unit 121, and the manner in which the authentication determination unit 122 makes a determination based on the state of the first application 110 will be described later. When it is determined that an authentication instruction should be issued to the authentication server 12, the authentication instruction unit 123 sends authentication information and issues an authentication instruction to the authentication server 12. When it is determined that an authentication instruction should not be issued to the authentication server 12, the second application 120 does not send authentication information, but instead, for example, displays a GUI in the browser indicating that authentication is not possible.

[0036] The timing for acquiring the status of the first application 110 and determining whether or not to issue an authentication instruction, as described above, are merely examples and are not limited to the timings described above. For example, the acquisition and determination may be performed when the second application 120 is executed in S503. In this case, if it is determined that no authentication instruction should be issued to the authentication server 12, the second application 120 may, for example, display a GUI in the browser indicating that authentication is not possible, instead of the authentication screen shown as an example in Figure 6.

[0037] Next, at S506, the authentication server 12 receives authentication information sent from the browser running the second application 120. Based on this information, the authentication server 12 identifies the user by verifying the authentication information entered by the user and returns an authorization code corresponding to the identified user to the browser running the second application. This return is done, for example, by an HTTP redirect response, where the redirect URL specifies the API endpoint of the management server 11. Here, the authorization code is temporary authentication information issued from the authorization endpoint of the authentication server 12. Next, at S507, the browser running the second application 120 receives the authorization code returned from the authentication server 12 and sends the authorization code to the management server 11 via redirect. In addition to the authorization code, the browser running the second application 120 may also send credentials corresponding to the authenticated user to the management server 11.

[0038] Next, in S508, the management server 11 receives the authorization code sent from the browser and uses the received authorization code to request an access token from the authentication server 12. If the browser sends credentials to the management server 11, the management server 11 may receive the authorization code and credentials and use the received authorization code and credentials to request an access token from the authentication server 12. The processing of the access token request from the authentication server 12 in the management server 11 is performed, for example, by a token request unit not shown in Figure 3. Next, in S509, the authentication server 12 issues an access token to the management server 11. Next, in S510, the management server 11 receives the access token issued from the authentication server 12 and sends the received access token to the first application 110, which operates as a web application in the information processing device 100.

[0039] Next, in S511, the user performs input operations by referring to the GUI displayed by the execution of the first application 110, which operates as a web application, thereby causing the first application 110 to perform processing corresponding to the input operations. As processing corresponding to the input operations, the first application 110 makes a request to the management server 11 to the API endpoint with an access token. This request is made by the resource request unit 111.

[0040] Next, in S512, the management server 11 receives the request and returns a response corresponding to the received request to the first application 110, which operates as a web application. The first application 110 receives the response, performs predetermined processing, generates information to configure the GUI after processing, and displays the GUI in the browser on which the first application 110 is running. This information is generated by the screen generation unit 112 and output by the screen output unit 113, as described above. The browser on which the first application 110 is running generates the GUI by rendering this information and displays it on the display device. Subsequently, the processes in S511 and S512 are repeatedly executed, allowing the user to perform desired processing such as viewing, editing, or printing images or text. If the access token transmitted in S511 is invalid, for example, in S512, the management server 11 returns information to the first application 110 indicating that it does not have access privileges such as access privileges. In this case, for example, the first application 110 may generate information to configure a GUI that indicates that it does not have access privileges, and the browser on which the first application 110 is running may render the GUI and display it on the display device.

[0041] Figure 7 is a sequence diagram showing another example of a processing sequence in the information processing system 1 according to Embodiment 1. The sequence diagram shown in Figure 7 is an example where the first application 110 and the second application 120 operate as native applications running on the information processing device 100. The first application 110 and the second application 120 are installed and run on an OS (Operating System) such as Windows®, MacOS®, iOS®, or Android®. After installation, the first application 110 and the second application 120 operate as resident applications that run continuously in the information processing device 100. In the explanation of Figure 7, the symbol "S" means step.

[0042] Hereinafter, the first application 110 and the second application 120 will be described as each generating a GUI and displaying it on a display device (not shown in Figure 1) connected to the information processing device 100, but the description is not limited to this. For example, the first application 110 and the second application 120 may be plug-in programs that are added on to extend the functionality of a browser running on the information processing device 100. In this case, the first application 110 and the second application 120, being plug-in programs, are installed on the OS and added on to the browser, similar to native applications, thereby generating a GUI that can be displayed in the browser. The browser renders the GUI generated by the first application 110 and the second application 120 and displays it on the display device.

[0043] At S701, the user launches the first application 110 and the second application 120. After the launch of the first application 110 and the second application 120, at S702, the information processing device 100 obtains an ID (hereinafter referred to as "device ID") that enables the identification of the information processing device 100. For example, the information processing device 100 obtains the MAC (Media Access Control) address attached to the network card it possesses as the device ID. This acquisition is performed, for example, by executing the second application 120. Since the device ID identifies the information processing device 100 used by the user, it can be used as authentication information. That is, the device ID is obtained as authentication information by executing the second application 120.

[0044] Next, in S703, the information processing device 100 sends a device ID to the management server 11 to request device registration. This request is made, for example, by executing the second application 120. In other words, the device registration request referred to here is an example of an authentication instruction. Before making the device registration request in S703, the second application 120 obtains the state of the first application and, based on the obtained state of the first application, determines whether or not to make a device registration request, that is, whether or not to issue an authentication instruction. If, as a result of this determination, it is determined that an authentication instruction should be issued, the information processing device 100 executes S703. The manner in which the state of the first application is obtained by the second application 120, and the manner in which the determination of whether or not to issue an authentication instruction is made will be described later. Next, in S704, the management server 11 receives the device ID sent from the information processing device 100, sends the received device ID to the authentication server 12, and issues an instruction for device registration for the information processing device 100. The authentication server 12 receives the device ID sent from the management server 11 and uses the received device ID to register the information processing device 100 as a device.

[0045] After the information processing device 100 completes device registration, at S705, the authentication server 12 returns a response to the management server 11 indicating that the device registration was successful. Next, at S706, the management server 11 returns a response to the information processing device 100 indicating that the device registration was successful. Next, at S707, the information processing device 100 requests an access token from the management server 11. This request is made, for example, by executing the first application. Next, at S708, the management server, upon receiving the request from the information processing device 100, requests an access token from the authentication server 12. Next, at S709, the authentication server 12, upon receiving the request from the management server 11, issues an access token to the management server 11. Next, at S710, the management server 11, upon receiving the access token issued by the authentication server 12, sends the access token to the information processing device 100. The access token sent from the management server 11 is received by the information processing device 100.

[0046] Next, in S711, the information processing device 100 uses the access token received from the management server 11 to send a request to the API endpoint with the access token attached to the management server 11. This request is made by the execution of the first application. Next, in S712, the management server 11 receives the request with the access token from the information processing device 100 and returns a response corresponding to the request to the information processing device 100. Thereafter, the processes in S711 and S712 are repeatedly executed, allowing the user to perform desired operations such as viewing, editing, or printing images or documents. If the access token sent in S711 is invalid, for example, in S712, the management server 11 returns information to the information processing device 100 indicating that it does not have the necessary permissions, such as access privileges.

[0047] The authentication and authorization processing sequences shown in Figure 5 or Figure 7 are merely examples, and the authentication and authorization processing sequences in this disclosure are not limited thereto. For example, the authentication and authorization processing sequences may be those defined by protocols such as OpenID Connect or OAuth.

[0048] The control of the timing of the authentication process according to the state of the first application 110 will be explained with reference to Figures 8 and 9. Figure 8 is a sequence diagram showing an example of the processing sequence of authentication and authorization processes in the information processing system 1 according to Embodiment 1. The sequence diagram shown in Figure 8 is an example when the first application 110 and the second application 120 operate as native applications running on the information processing device 100. The first application 110 and the second application 120 are installed on the OS running on the information processing device 100 by executing an installation application (hereinafter referred to as "installer"). In the explanation of Figure 8, the symbol "S" means step.

[0049] In S801, the user instructs the OS running on the information processing device 100 to run the installer, thereby instructing the installer to begin installing the first application 110 and the second application 120. Once the user instructs the installation to begin, in S802, the installer installs the first application 110. Next, in S803, the installer installs the second application 120. After the installation of the second application 120 is complete, in S804, the installer launches the second application 120.

[0050] After S804, the second application 120 determines whether or not the first application 110 is running. The running status of the first application 110 is obtained by the status acquisition unit 121, and this determination is made by the status determination unit 122. If the determination determines that the first application 110 is not running, in S807, the second application 120 repeatedly determines the running status of the first application 110 at predetermined intervals until the first application 110 is started.

[0051] For example, in S805, the user instructs the first application 110 to start. In this case, after S805, the second application 120 determines that the first application 110 is running. If it is determined that the first application 110 is running, in S808, the second application 120 issues an authentication instruction to the management server 11. This instruction is made by the authentication instruction unit 123. Next, in S809, the management server 11, having received this instruction from the second application 120, issues an authentication instruction to the authentication server 12. Next, in S810, the authentication server 12, having received this instruction from the management server 11, performs the authentication processing corresponding to the instruction. After that, for example, in S806, the user instructs the first application 110 to stop.

[0052] In the processing sequence shown in Figure 8, the second application 120 is described as issuing an authentication instruction to the management server 11, but this disclosure is not limited to this. For example, when the first application 110 is started, the first application 110 may issue an authentication instruction to the management server 11 or the authentication server 12, and the second application 120 may operate using that authentication information.

[0053] Furthermore, while Figure 8 illustrates an example of a processing sequence in which the authentication determination unit 122 confirms the startup status of the first application 110, this disclosure is not limited to this. For example, the second application 120 may issue an authentication instruction to the management server 11 or the authentication server 12 based on the detection of a predetermined event that occurs as a result of the execution of the first application 110. Specifically, for example, the status acquisition unit 121 detects and acquires an event that occurs as a result of the execution of the first application 110. The authentication determination unit 122 then determines whether the event acquired by the status acquisition unit 121 is a predetermined event. That is, the authentication determination unit 122 determines whether a predetermined event has occurred as a result of the execution of the first application 110. If the authentication determination unit 122 determines that a predetermined event has occurred as a result of the execution of the first application 110, the authentication instruction unit 123 issues an authentication instruction. Here, a predetermined event is, for example, an event corresponding to the first application 110 issuing an instruction to a printer, which is a managed resource managed by the management server 11, to start printing.

[0054] Figure 9 is a flowchart showing an example of the processing flow until the authentication process in each application or server in the information processing system 1 according to Embodiment 1 is completed. In the description of Figure 9, the symbol "S" means step. Figure 9(a) is a flowchart showing an example of the processing flow in the installer according to Embodiment 1. First, at S901, the installer installs the first application 110. Next, at S902, the installer installs the second application 120. Next, at S903, the installer starts the second application 120. After S903, the installer finishes the processing shown in the flowchart in Figure 9(a).

[0055] Figure 9(b) is a flowchart showing an example of the processing flow in the first application 110 according to Embodiment 1. First, at S911, the first application 110 is started and begins operation by user operation. Next, at S912, the first application 110 ends operation by user operation. After S912, the first application 110 completes the processing shown in the flowchart in Figure 9(b).

[0056] Figure 9(c) is a flowchart showing an example of the processing flow in the second application 120 according to Embodiment 1. First, at S921, the second application 120 acquires the state of the first application 110. Specifically, the state acquisition unit 121 acquires the state of the first application 110 by the execution of the second application 120. Here, the state of the first application 110 refers to, for example, whether or not the first application 110 is running, or whether or not some event has occurred as a result of the execution of the first application 110. The state of the first application 110 is not limited to the above. For example, the state of the first application 110 may refer to whether or not the first application 110 is installed and executable, or whether or not the first application 110 has been started at least once, etc.

[0057] After S921, in S922, the second application 120 determines whether or not to issue an authentication instruction depending on the state of the first application 110. If the first application 110 is not running, the second application 120 determines, for example, not to issue an authentication instruction. If it is determined in S922 not to issue an authentication instruction, the second application 120 returns to the process of S921 and, for example, after a predetermined period of time has elapsed, checks the running status of the first application 110 again. In this case, the second application 120 may terminate the flowchart process shown in Figure 9(c). If the first application 110 is running, the second application 120 determines to issue an authentication instruction. If it is determined in S922 to issue an authentication instruction, in S924 the second application 120 issues an authentication instruction to the management server 11. After S924, the second application 120 terminates the flowchart process shown in Figure 9(c).

[0058] Figure 9(d) is a flowchart showing an example of the processing flow in the management server 11 according to Embodiment 1. First, in S931, the management server 11 issues an authentication instruction to the authentication server 12. The process in S931 is executed when the management server 11 receives an authentication instruction from the second application 120, as shown in the process in S924 in Figure 9(c). After S931, the management server 11 terminates the flowchart process shown in Figure 9(d).

[0059] Figure 9(e) is a flowchart showing an example of the processing flow in the authentication server 12 according to Embodiment 1. First, at S941, the authentication server 12 performs authentication processing. The processing at S941 is executed when the authentication server 12 receives an authentication instruction from the management server 11, as shown in the processing at S931 in Figure 9(d). After S941, the authentication server 12 completes the flowchart processing shown in Figure 9(e).

[0060] As explained above, the information processing system 1 determines whether or not to issue an authentication instruction via the second application 120 depending on the state of the first application 110. In other words, the information processing system 1 can control the timing of issuing the authentication instruction depending on the state of the first application 110. Therefore, according to the information processing system 1, even if the number of users using the first application 110 that requires the use of the authentication service increases, the number of users who actually use the authentication service can be suppressed. As a result, according to the information processing system 1, the ratio of the number of users using the authentication service to the number of users using applications that use the authentication service (e.g., the first application) can be reduced.

[0061] Incidentally, some authentication services provided by public clouds charge providers of applications that utilize this authentication service a usage fee based on the number of users to be authenticated (hereinafter referred to as "authenticated users") over a predetermined period. Therefore, as the number of users of applications that utilize this authentication service increases, the number of authenticated users also increases. Consequently, when the number of users of applications that utilize the authentication service increases, the provider's usage fees for using the authentication service become higher. As described above, according to Information Processing System 1, even if the number of users of the first application 110 that requires the use of the authentication service increases, the actual number of users who use the authentication service can be suppressed. Therefore, according to Information Processing System 1, when using the authentication service described above, the usage fees paid can be reduced compared to before.

[0062] <Embodiment 2> Referring to Figure 10, the information processing system 1 according to Embodiment 2 will be described. The configuration of the information processing system 1 according to Embodiment 2 is the same as the configuration described in Embodiment 1 with reference to Figure 1, so the description will be omitted. Referring to Figure 10, the control of the timing of authentication instructions according to the state of the first application 110 according to Embodiment 2 will be described. Figure 10 is a sequence diagram showing an example of the processing sequence of authentication processing and authorization processing in the information processing system 1 according to Embodiment 2. In the description of Figure 10, the symbol "S" means step.

[0063] The sequence diagram shown in Figure 10 is an example where the first application 110 operates as a native application running on the information processing device 100, and the second application 120 operates as a web application. The first application 110 is installed on the OS running on the information processing device 100 by the execution of the second application 120. The first application 110 may also be installed on the OS running on the information processing device 100 as a plugin program that is added on to the browser running on the information processing device 100. In this case, the first application 110 is executed and operates by the browser. Hereafter, the first application 110 will be described assuming that it is a native application running on the information processing device 100.

[0064] Furthermore, the second application 120 is a web application written in a scripting language that is executable by a browser running on the information processing device 100 and is provided from a website. In this case, the second application 120 is executed and operates by rendering by the browser. The browser displays a GUI, as shown as an example in Figure 6, on a display device not shown in Figure 1, by executing the second application 120. The user can instruct the information processing device 100 to perform authentication and authorization processes via the browser by performing input operations.

[0065] The second application 120 may be, for example, a web application running on an application server not shown in Figure 1. In this case, the second application 120 may run on the management server 11 shown in Figure 1. In this case, the GUI provided by the execution of the second application 120, as shown as an example in Figure 6, is displayed in a browser running on the information processing device 100. In this case, the user can instruct the second application to perform authentication and authorization processes via the browser by performing input operations on the information processing device 100. Hereinafter, the second application 120 will be described as a web application written in a scripting language executable by a browser running on the information processing device 100.

[0066] First, in S1001, the user specifies the URL of the website providing the second application 120 to the browser. The browser sends a request to the website using the specified URL. Next, in S1002, the second application 120 is executed by being rendered in the browser and obtains the status of the first application 110. Specifically, for example, the second application 120 obtains information on whether or not the first application 110 is installed on the information processing device 100. This acquisition is performed by the status acquisition unit 121.

[0067] The second application 120 determines whether or not to issue an authentication instruction based on the status of the first application 110. Specifically, for example, the second application 120 obtains information indicating whether or not the first application 110 is installed, and determines whether or not to issue an authentication instruction based on that information. If the first application 110 is installed, the second application 120 determines to issue an authentication instruction, and if the first application 110 is not installed, it determines not to issue an authentication instruction. If the first application 110 is not installed, for example, the second application 120 may obtain information on whether or not it is installed at predetermined intervals until it is installed, and repeat the above determination. In this case, for example, the second application 120 may generate a GUI prompting the user to install the first application 110 and display it in the browser.

[0068] Next, in S1003, the user instructs the second application 120 to install the first application 110. Then, in S1004, the second application 120, upon receiving the instruction, installs the first application 110 on the information processing device 100. The second application 120 may repeatedly determine whether the installation of the first application 110 is complete at predetermined intervals until the installation is finished. When the first application 110 is installed, the second application 120 generates information to constitute the authentication screen 600 shown as an example in Figure 6. The browser renders this information to display the authentication screen 600 shown as an example in Figure 6 on the display device. The user refers to the authentication screen 600 displayed in the browser, enters their ID and password, and then presses button 603.

[0069] Next, in S1005, the second application 120 sends the ID and password entered by the user via the browser to the management server 11 as authentication information and issues an authentication instruction to the management server 11. Next, in S1006, the management server 11 receives the authentication information sent from the second application 120, i.e., the information processing device 100, and after receiving it, sends the authentication information to the authentication server 12 and issues an authentication instruction to the authentication server 12. Next, in S1007, the authentication server 12 receives the authentication information sent from the management server 11 and performs the authentication process after receiving it.

[0070] In the above description, it was explained that in S1004, the second application 120 checks whether the installation of the first application 110 is complete at predetermined intervals, but this is not the only way to do so. For example, in S1002, the second application 120 may check whether the first application 110 is installed only once, when the second application 120 is executed by a browser.

[0071] As explained above, the information processing system 1 determines whether or not to issue an authentication instruction via the second application 120 depending on the state of the first application 110. In other words, the information processing system 1 can control the timing of issuing the authentication instruction depending on the state of the first application 110. Therefore, according to the information processing system 1, even if the number of users using the first application 110 that requires the use of the authentication service increases, the number of users who actually use the authentication service can be suppressed. As a result, according to the information processing system 1, the ratio of the number of users using the authentication service to the number of users using applications that use the authentication service (e.g., the first application) can be reduced.

[0072] <Embodiment 3> Referring to Figure 11, the information processing system 1 according to Embodiment 3 will be described. The configuration of the information processing system 1 according to Embodiment 3 is the same as the configuration described in Embodiment 1 with reference to Figure 1, so the description will be omitted. Referring to Figure 11, the control of the timing of authentication instructions according to the state of the first application 110 according to Embodiment 3 will be described. Figure 11 is a sequence diagram showing an example of the processing sequence of authentication processing and authorization processing in the information processing system 1 according to Embodiment 3. In the description of Figure 11, the symbol "S" means step. The sequence diagram shown in Figure 11 is an example when the first application 110 and the second application 120 operate as native applications running on the information processing device 100. That is, the first application 110 and the second application 120 operate, for example, when installed on an OS running on the information processing device 100.

[0073] The first application 110 and the second application 120 may be programs for plugins that are added to a browser running on the information processing device 100. In this case, the first application 110 and the second application 120 are installed as plugin programs on the OS running on the information processing device 100. In this case, the first application 110 and the second application 120 are executed and operated by the browser. Hereinafter, the first application 110 and the second application 120 will be described as native applications running on the information processing device 100. Furthermore, the second application 120 will be described as an application capable of controlling the installation of one or more applications, including at least the first application 110, on the OS running on the information processing device 100.

[0074] In S1101, the user installs the second application 120 on the OS running on the information processing device 100. Next, in S1102, the user starts the second application 120. After starting, the second application 120 obtains the status of the first application 110. Specifically, for example, the second application 120 obtains information on whether or not the first application 110 is installed. If the first application 110 is not installed, in S1103, the second application 120 starts installing the first application 110. Next, in S1104, the second application 120 determines whether or not the installation of the first application 110 is complete. The second application 120 may determine whether or not the installation of the first application 110 is complete at predetermined intervals, for example, after the start of the installation of the first application 110 until it is determined to be complete.

[0075] If it is determined in S1104 that the installation of the first application 110 is complete, the processes from S1105 to S1108 are performed. In this case, first, in S1105, the user enters authentication information. Specifically, for example, after the second application 120 determines that the installation of the first application 110 is complete, it displays an authentication screen 600, shown as an example in Figure 6, on a display device not shown in Figure 1. The user refers to the authentication screen 600, enters an ID and password as authentication information, and presses button 603 after entering the information. After S1105, in S1106, the second application 120 sends the ID and password entered by the user as authentication information to the management server 11 and issues an authentication instruction to the management server 11. Next, in S1107, the management server 11 receives the authentication information sent from the second application 120, i.e., the information processing device 100, and after receiving it, sends the authentication information to the authentication server 12 and issues an authentication instruction to the authentication server 12. Next, in S1108, the authentication server 12 receives the authentication information sent from the management server 11, and after receiving it, performs the authentication process.

[0076] Although the above description assumes that there is only one first application 110, it is not limited to this. For example, there may be multiple first applications 110. In this case, for example, the second application 120 may acquire the status of one or more of the multiple first applications 110. Furthermore, the second application 120 may determine whether or not to issue an authentication instruction based on the acquired status of the one or more first applications 110.

[0077] Furthermore, while the above description explains a configuration in which the status of the first application 110 is obtained and determined as to whether or not the installation is complete, the status of the first application 110 used by the second application 120 for determination is not limited to this. For example, the second application 120 may obtain a status such as whether or not the first application 110 has been launched before, or whether or not it is currently running, and based on that status, it may determine whether or not to issue an authentication instruction.

[0078] As explained above, the information processing system 1 determines whether or not to issue an authentication instruction via the second application 120 depending on the state of the first application 110. In other words, the information processing system 1 can control the timing of issuing the authentication instruction depending on the state of the first application 110. Therefore, according to the information processing system 1, even if the number of users using the first application 110 that requires the use of the authentication service increases, the number of users who actually use the authentication service can be suppressed. As a result, according to the information processing system 1, the ratio of the number of users using the authentication service to the number of users using applications that use the authentication service (e.g., the first application) can be reduced.

[0079] <Embodiment 4> Embodiments 1 to 3 describe a configuration in which the second application 120 issues an authentication instruction to the management server 11, and the management server 11 then issues an authentication instruction to the authentication server 12. However, the invention is not limited to this configuration. For example, the second application 120 may issue an authentication instruction directly to the authentication server 12 without going through the management server 11.

[0080] Furthermore, while embodiments 1 to 3 describe a configuration in which the decision to issue an authentication instruction is made depending on whether the first application 110 is installed or launched, the invention is not limited to this. The second application 120 only needs to control the timing of issuing an authentication instruction depending on the state of the first application 110. Specifically, for example, the second application 120 may decide whether to issue an authentication instruction based on whether the first application 110 is a predetermined release version (for example, one provided after a specific release version). Alternatively, for example, the second application 120 may decide whether to issue an authentication instruction based on the execution progress of the first application 110. Here, the execution progress of the first application 110 refers to, for example, whether the first application 110 has completed a predetermined process (for example, a transition to a specific screen) up to that point.

[0081] Furthermore, the second application 120 may acquire the status of the authentication server 12 in addition to the status of the first application 110, and determine whether or not to issue an authentication instruction based on the acquired statuses of the first application 110 and the authentication server 12. For example, the second application 120 communicates with the authentication server 12 and, at that time, acquires the number of users that the authentication server 12 is currently authenticating (hereinafter referred to as the "number of authentications"). For example, if the number of authentications is less than a predetermined threshold, the second application 120 issues an authentication instruction, and if the number of authentications is greater than or equal to the threshold, it controls the system so as not to issue an authentication instruction, regardless of the status of the first application 110.

[0082] Furthermore, while embodiments 1 to 3 described communication between the information processing device 100 and the server using HTTP communication as an example, the invention is not limited to this. Communication between the information processing device 100 and the server may be conducted using a communication protocol other than HTTP communication.

[0083] <Other Embodiments> This disclosure can also be implemented by supplying a program that implements one or more of the functions of the embodiments described above to a system or device via a network or storage medium, and by having one or more processors in the computer of that system or device read and execute the program. It can also be implemented by a circuit (e.g., an ASIC) that implements one or more functions.

[0084] Within the scope of this disclosure, it is possible to freely combine the embodiments, modify any component of each embodiment, or omit any component in each embodiment. [Explanation of Symbols]

[0085] 100: Information Processing Device 110: First Application 120: Second Application 121: State acquisition unit 122: Authentication Determination Unit 123: Authentication Instruction Section

Claims

1. An information processing device that executes a first application and a second application, The execution of the second application provides a state acquisition means for acquiring the state of the first application, An authentication determination means determines whether or not to perform authentication processing according to the state of the first application obtained by the state acquisition means upon execution of the second application, When the authentication determination means determines that the authentication process should be performed, the authentication instruction means issues an instruction to perform the authentication process by executing the first application or the second application. It has, The state acquired by the state acquisition means is whether or not the first application is installed. The authentication determination means determines that the authentication process will not be performed if the first application is not installed. An information processing device characterized by the following.

2. The state acquired by the state acquisition means is whether or not the first application has been launched when the first application is installed. The authentication determination means determines that the authentication process will not be performed if the first application has never been launched. The information processing apparatus according to claim 1, characterized in that

3. The state acquired by the state acquisition means is whether or not a predetermined event has occurred during the execution of the first application when the first application is installed. The authentication determination means determines that the authentication process will not be performed if the event has not occurred. The information processing apparatus according to claim 1, characterized in that

4. The state acquired by the state acquisition means is the release version of the first application that is executed when the first application is installed. The authentication determination means determines that the authentication process will not be performed if the release version does not meet the given conditions. The information processing apparatus according to claim 1, characterized in that

5. The state acquired by the state acquisition means is the progress of the first application being executed when the first application is installed. The authentication determination means determines that the authentication process will not be performed if the progress does not meet the given conditions. The information processing apparatus according to claim 1, characterized in that

6. The first application described above is composed of multiple applications, The state acquisition means acquires the state of one or more of the multiple applications, and acquires the acquired state of the one or more applications as the state of the first application. An information processing apparatus according to any one of claims 1 to 5, characterized by the above.

7. The state acquisition means acquires the state of the authentication server that performs the authentication process, in addition to the state of the first application. The authentication determination means determines whether or not to perform the authentication process, in addition to the state of the first application, according to the state of the authentication server. An information processing apparatus according to any one of claims 1 to 6, characterized by the above.

8. The information processing apparatus according to any one of claims 1 to 7, characterized in that the first application and the second application are written in a scripting language that can be executed by a browser application.

9. The authentication instruction means issues the instruction to the management server that manages information associated with the user. Upon receiving the aforementioned instructions, the management server instructs the authentication server that performs the authentication process to perform the authentication process. An information processing apparatus according to any one of claims 1 to 8, characterized by the above.

10. The authentication instruction means gives the instruction to the authentication server that performs the authentication process. An information processing apparatus according to any one of claims 1 to 9, characterized by the above.

11. The authentication instruction means performs the instruction by executing the second application. An information processing apparatus according to any one of claims 1 to 10, characterized by the above.

12. The second application is a resident application installed on the information processing device. An information processing apparatus according to any one of claims 1 to 11, characterized by the above.

13. The second application operates resident in the information processing device in response to the startup of the OS of the information processing device. The information processing apparatus according to claim 12, characterized by the above.

14. The first application is installed on the information processing device by the second application. An information processing apparatus according to any one of claims 1 to 13, characterized by the above.

15. At least one of the first application and the second application is a web application executed by a browser application operating on the information processing device. An information processing apparatus according to any one of claims 1 to 11, characterized by the above.

16. At least one of the first application and the second application is a Web application that operates on the information processing device. An information processing apparatus according to any one of claims 1 to 11, characterized by the above.

17. If the first application is a web application that runs on the information processing device, a browser running on a device other than the information processing device instructs the execution of the first application, and the information processing device presents the result of the execution of the first application to the browser. If the second application is a web application that runs on the information processing device, the execution of the second application is instructed by a browser running on a device other than the information processing device, and the information processing device presents the result of the execution of the second application to the browser. The information processing apparatus according to claim 16, characterized by the above.

18. A method for processing information by executing a first application and a second application, The execution of the second application includes a state acquisition step in which the state of the first application is acquired, The execution of the second application includes an authentication determination step that determines whether or not to perform authentication processing according to the state of the first application obtained by the state acquisition step, If the authentication determination step determines that the authentication process should be performed, the authentication instruction step provides instructions to perform the authentication process by executing the first application or the second application. It has, The state acquired in the state acquisition step is whether or not the first application is installed. In the authentication determination step, if the first application is not installed, it is determined that the authentication process will not be performed. An information processing method characterized by the following.

19. A program for causing a computer to perform each step of the information processing method described in claim 18.

20. A computer-readable storage medium in which a program causing a computer to execute each step of the information processing method described in claim 18 is stored.

Images