MFP Session ID Cookie Authentication Bypass
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Information processing apparatuses, such as MFPs, face challenges in efficiently notifying servers of control operation completion without undergoing authentication processing, leading to increased load on Web servers due to long response times for device control operations like printing.
Innovation Solution
The system allows the information processing apparatus to notify the server of control operation completion without undergoing authentication processing by using a session ID cookie to manage sessions between the MFP and the server, enabling the MFP to transmit completion notifications directly to the server without additional authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication processing is performed for each notification from information processing apparatus to server, then security is improved, but response time increases and server load increases
Solution Approach 1:
The server performs authentication processing in advance when receiving a control operation request from the information processing apparatus. The server stores the apparatus identification information and authentication result in association with each other before the control operation is executed. This preliminary authentication eliminates the need for repeated authentication during subsequent notification exchanges, thereby reducing response time while maintaining security.
Solution Approach 2:
Instead of performing full authentication processing for each notification, the system uses the pre-stored authentication result and apparatus identification information as a substitute for repeated authentication. The information processing apparatus includes its identification information in notification transmissions, and the server uses this copied authentication context to verify the notification source without re-running the complete authentication protocol.
2Reliability
If authentication processing is performed for each notification from information processing apparatus to server, then security is improved, but server load increases
Solution Approach 1:
The server performs authentication processing in advance when receiving a control operation request from the information processing apparatus. The server stores the apparatus identification information and authentication result in association with each other before the control operation is executed. This preliminary authentication eliminates the need for repeated authentication during subsequent notification exchanges, thereby reducing response time while maintaining security.
Solution Approach 2:
Instead of performing full authentication processing for each notification, the system uses the pre-stored authentication result and apparatus identification information as a substitute for repeated authentication. The information processing apparatus includes its identification information in notification transmissions, and the server uses this copied authentication context to verify the notification source without re-running the complete authentication protocol.
Data Source
Figure 1
Figure 2~3
Figure 4~5
AI summary
In an information processing system of the invention, when authentication using authentication information from a Web browser of an MFP succeeds, a server generates a session ID, and transmits screen information added with the session ID to the Web browser. The Web browser accepts an operation through an operation screen displayed based on the screen information received from the server, and transmits its operation content to the server. The server transmits, to a service provider of the MFP, a request for executing a job corresponding to the operation content, in which a session ID is designated. Upon completion of execution of the job, the service provider transmits, to the server without intervening the Web browser, completion information indicating the execution result and added with the session ID.