INFORMATION PROCESSING APPARATUS, CONTROL METHOD THEREFOR, AND PROGRAM

• US 20120096544A1
• Filed: 09/21/2011
• Published: 04/19/2012
• Est. Priority Date: 10/14/2010
• Status: Active Grant

• Current Assignee: Canon Kabushiki Kaisha (Canon Inc.)
• Original Assignee: Canon Kabushiki Kaisha (Canon Inc.)
• Inventors: Hosoda, Yasuhiro
• Granted Patent: US 9,064,105 B2
• Time in Patent Office: Days
• US Class Current: 726/19
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

There are provided an information processing apparatus which provides a user credential sharing service on a user credential sharing condition intended by a vendor that creates an application, and a control method for the information processing apparatus. To accomplish this, the information processing apparatus generates sharing settings which defines a sharing condition for each item of a user credential among applications according to a manifest file acquired from each application. Upon receiving a request of a user credential from one of the applications, the information processing apparatus provides the user credential to the requesting application according to the generated sharing settings.

Claims

1. An information processing apparatus comprising:

an acquisition unit that acquires, from each of a plurality of applications operating on said information processing apparatus, a sharing condition of a user credential with another application, which has been defined for each of a plurality of items of the user credential including information for certifying a user;

a generation unit that generates, based on the acquired sharing condition, sharing settings which defines the sharing condition for each item of the user credential among applications, and stores the generated sharing settings in a memory;

a holding unit that holds, in a memory, the user credential sent from at least one of the applications; and

a provision unit that provides, upon receiving a request of the user credential from one of the applications, the user credential to the requesting application according to the sharing settings stored in the memory.

2. The apparatus according to claim 1, wherein said generation unit generates the sharing settings when said apparatus starts, when an application starts, or when the user logs in, compares the generated sharing settings with the sharing settings already stored in the memory, and updates the memory with the generated sharing settings if there is a difference as a comparison result.

3. The apparatus according to claim 1, wherein said holding unit furthermore holds, in the memory, a use setting for setting to validate or invalidate the sharing condition of each item of the user credential defined in the sharing settings, and

when the use setting indicates a valid state, said provision unit determines based on the sharing settings whether to provide the user credential to the requesting application.

4. The apparatus according to claim 3, further comprising a user interface for changing the sharing settings and the use setting held in the memory.

5. The apparatus according to claim 1, wherein said provision unit does not provide the user credential if the application which has requested the user credential is not defined in the sharing settings to share the user credential, and

provides the user credential if the application which has requested the user credential is defined in the sharing settings to share the user credential.

6. The apparatus according to claim 1, wherein said provision unit includes

an encryption unit that encrypts the user credential held by said holding unit, and

a distribution unit that distributes, to each application, an encryption key used to encrypt the user credential.

7. The apparatus according to claim 1, wherein the plurality of applications include a login application for issuing a user credential of an authenticated user, and

said holding unit holds, in the memory, the user credential, which has been issued by the login application, of the user for whom the login application has executed authentication, and deletes the user credential from the memory when the user logs out.

8. The apparatus according to claim 1, wherein for each item of the user credential, the sharing settings contains information about an application capable of referring to user credential information and information about an application capable of updating the user credential information.

9. A control method for an information processing apparatus, comprising:

acquiring, from each of a plurality of applications operating on the information processing apparatus, a sharing condition of a user credential with another application, which has been defined for each of a plurality of items of the user credential including information for certifying a user;

generating, based on the acquired sharing condition, sharing settings which defines the sharing condition for each item of the user credential among applications, and storing the generated sharing settings in a memory;

holding, in a memory, the user credential sent from at least one of the applications; and

providing, upon receiving a request of the user credential from one of the applications, the user credential to the requesting application according to the sharing settings stored in the memory.

10. A computer-readable storage medium storing a computer program for causing a computer to execute each step of a control method for an information processing apparatus according to claim 9.