Authority verification system, authority verification method, and computer-readable storage medium

• US 10,574,645 B2
• Filed: 11/16/2017
• Issued: 02/25/2020
• Est. Priority Date: 11/25/2016
• Status: Active Grant

• Current Assignee: Canon Kabushiki Kaisha (Canon Inc.)
• Original Assignee: Canon Kabushiki Kaisha (Canon Inc.)
• Inventors: Tamura, Yu
• Primary Examiner(s): Feild, Lynn D
• Assistant Examiner(s): Lakhia, Viral S
• Application Number:
  US15/814,538
• Publication Number:
  US 20180152441A1
• Time in Patent Office: 831 Days
• Field of Search: 713150
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A per-resource user authority management unit that manages user authorities per resource, a user authority refinement unit that refines authorities linked to a user by the per-resource user authorities, and an authority verification unit that determines whether execution of processing with respect to a resource is permitted by using an authority that has been refined by the user authority refinement unit are provided.

Claims

1. An authority verification system operable to verify an access authority for a resource, the system comprising a terminal apparatus, a resource server for providing a resource and an authentication/authorization server, wherein

the terminal apparatus includes at least a processor and at least a memory coupled to the at least the processor and having stored thereon instructions which, when executed by the at least the processor, cause the at least the processor to function as:

a transmission unit configured to transmit a resource access request,

the resource server includes at least a processor and at least a memory coupled to the at least the processor and having stored thereon instructions which, when executed by the at least the processor, cause the at least the processor to function as;

a per-resource user authority management unit configured to manage per-resource user authorities established for each resource; and

a verification request unit configured to, in response to receiving the resource access request, resolve a user authority for a specified resource based on a token included in the resource access request and transmit an authority verification request including the token and the resolved user authority to the authentication/authorization server,

the authentication/authorization server includes at least a processor and at least a memory coupled to the at least the processor and having stored thereon instructions which, when executed by the at least the processor, cause the at least the processor to function as;

a user authority management unit configured to manage user authorities;

a refinement unit configured to confirm user authorities based on the token included in the authority verification request and determine an authority corresponding to the resolved user authority included in the authority verification request from among the confirmed user authorities as an access authority to be verified; and

a validation unit configured to determine whether access to the resource corresponding to the resource access request is permitted based on the access authority refined by the refinement unit,

wherein the terminal apparatus that is a transmission source of the resource access request is allowed to access the resource in a case where it is determined that the access is permitted by the validation unit,

wherein the authentication/authorization server further functions as;

a unit of the authority verification system configured to delegate a user authority to the transmission source of the resource access request and to issue an access token or a JSON web token indicating a delegation source user and a delegated authority, and

wherein the user authority that the resource access request transmission source has is the delegated user authority that is indicated by the access token or the JSON web token, and

the authority necessary for the resource access request with respect to a designated resource of the resource access request is associated with the delegation source user for the user authority.

2. The authority verification system according to claim 1, wherein the refinement unit makes the access authority be an authority that is shared by the authority necessary for the resource access request with respect to the resource and the user authority held by the transmission source of the resource access request.

3. The authority verification system according to claim 1, wherein the refinement unit does not grant the access authority in a case where the authority necessary for the resource access request with respect to the resource is empty.

4. The authority verification system according to claim 1, wherein the refinement unit makes the access authority be the user authority held by the resource access request transmission source in a case where the authority necessary for the resource access request with respect to the resource is empty.

5. The authority verification system according to claim 1, wherein the resource server functions as:

a unit configured to, in accordance with an operation with respect to the per-resource user authorities, add a designated per-resource user authority to the per-resource user authorities managed by the per-resource user authority management unit; and

a unit configured to delete a designated per-resource user authority from the per-resource user authorities managed by the per-resource user authority management unit.

6. The authority verification system according to claim 5, wherein in a case where per-resource user authorities of a specific user are all deleted from the per-resource user authority managed by the per-resource user authority management unit, a user authority of the specific user is deleted from the user authorities managed by the user authority management unit.

7. An authority verification method for verifying an access authority for a resource, which is performed by an information processing system comprising a terminal apparatus, a resource server for providing a resource and an authentication/authorization server, the method comprising:

by the terminal apparatus, transmitting a resource access request,

by the resource server, managing per-resource user authorities established for each resource; and

by the resource server, in response to receiving the resource access request, resolving a user authority for a specified resource based on a token included in the resource access request and transmitting an authority verification request including the token and the resolved user authority to the authentication/authorization server,

by the authentication/authorization server, managing user authorities;

by the authentication/authorization server, confirming user authorities based on the token included in the authority verification request and determining an authority corresponding to the resolved user authority included in the authority verification request from among the confirmed user authorities as an access authority to be verified;

by the authentication/authorization server, determining whether access to the resource corresponding to the resource access request is permitted based on the access authority refined, delegating a user authority to the transmission source of the resource access request, and issuing an access token or a JSON web token indicating a delegation source user and a delegated authority,

wherein the terminal apparatus that is a transmission source of the resource access request is allowed to access the resource in a case where it is determined that the access is permitted, and

wherein the user authority that the resource access request transmission source has is the delegated user authority that is indicated by the access token or the JSON web token, and

the authority necessary for the resource access request with respect to a designated resource of the resource access request is associated with the delegation source user for the user authority.