AUTHORIZATION SERVER, AUTHENTICATION COOPERATION SYSTEM, AND STORAGE MEDIUM STORING PROGRAM

• US 20170163636A1
• Filed: 11/30/2016
• Published: 06/08/2017
• Est. Priority Date: 12/08/2015
• Status: Active Grant

• Current Assignee: Canon Kabushiki Kaisha (Canon Inc.)
• Original Assignee: Canon Kabushiki Kaisha (Canon Inc.)
• Inventors: Nishida, Takahiko
• Granted Patent: US 9,985,962 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G07F 17/26 for printing, stamping, franking, typing or teleprinting apparatus ticket printing or the like apparatus G07F17/42
• CPC Class Codes: G07F 7/08 by coded identity card or credit card or other personal identification means without personal verification means G07F7/02
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04W 12/06 Authentication

Abstract

An authorization token verification request including a second authorization token is received from an application server having received a processing request along with the second authorization token from a client device, and, in a case where the authorization token is verified successfully on basis of the received second authorization token and the authorization token information, the local user information included in the authorization token information is responded to the application server.

Claims

1. An authorization server comprising:

a unit configured to receive an authorization token generation request along with representative authorization token information and local user information from a client device, the client device receiving transfer of an authority for using an application server based on an authorization operation performed by a user, the client device registering a first authorization token issued based on the transfer as representative authorization token information;

a unit configured to, in a case where the client device is authenticated successfully on the basis of the representative authorization token information received along with an authorization token generation request, respond a second authorization token to the client device and generate and store authorization token information by associating the local user information received along with the authorization token generation request with the second authorization token; and

a responding unit configured to receive an authorization token verification request including the second authorization token from an application server that received a processing request along with the second authorization token from the client device, and, in the case that the authorization token is verified successfully on the basis of the received second authorization token and the authorization token information, respond with the local user information included in the authorization token information to the application server.

2. The authorization server according to claim 1,

wherein the representative authorization token information includes identification information of the client and identification information of a tenant of the representative client;

and

wherein the responding unit responds, as a part of the authorization token information, the identification information of the tenant of the client device.

3. The authorization server according to claim 1, wherein the local user information includes information describing a domain accessible by a user authenticated by a local authentication server and user identification information in the domain.

4. The authorization server according to claim 3,

wherein the authorization token verification request is received from an application server having received a processing request from the client device along with the second authorization token;

and

wherein the local user information is used by the application server for identifying a user being a requestor of the processing request.

5. An authentication cooperation system comprising an authorization server according to claim 1, and an application server, and a client device,

wherein the client device comprises:

a storing unit configured to store a first authorization token as representative authorization token information, the first authorization token being issued based on transfer of an authority for using the application server based on an authorization operation performed by a user;

a transmitting unit configured to transmit an authorization token generation request along with local user information of a log-in user and the representative authorization token information to the authorization server; and

wherein, in the case that a second authorization token is received along with the authorization token generation request, the transmitting unit is configured to transmit a request for processing along with the second authorization token to the application server; and

wherein the application server comprises;

a transmitting unit configured to transmit the authorization token verification request to the authorization server when the application server receives a processing request along with the second authorization token from the client device and receive the authorization token information including the local user information associated with the second authorization token as a response as a result of a success of the authorization token verification request; and

a processing unit configured to process the processing request for a user described in the local user information or for the client device.

6. The authentication cooperation system according to claim 5,

wherein the representative authorization token information includes identification information of the client device and identification information of a tenant of the client device;

the authorization server is configured to respond, as a part of the authorization token information, with the identification information of the tenant of the client device requesting to generate the authorization token verified successfully; and

wherein the application server is configured to process the processing request for a user described in the local user information or for the client device in the case that the local authentication cooperation mode set based on the identification information of the tenant is enabled.

7. A storage medium storing a program which, when run on a device, causes the device to act as the authorization server according to claim 1.