RELAY APPARATUS, SYSTEM, RELAY METHOD, AND COMPUTER READABLE MEDIUM

• US 20150269368A1
• Filed: 02/12/2015
• Published: 09/24/2015
• Est. Priority Date: 03/18/2014
• Status: Active Grant

• Current Assignee: Fujifilm Business Innovation Corp. (Fujifilm Holdings Corporation)
• Original Assignee: Fuji Xerox Company Limited (Xerox Holdings Corp.)
• Inventors: SAKAI, Yutaka
• Granted Patent: US 9,614,830 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213

Abstract

A relay apparatus includes a storage unit, a first reception unit, a first request unit, a second reception unit, a second request unit, a third reception unit, and an access unit. The storage unit stores, for each user, authorization information for accessing a service providing apparatus. The first reception unit receives from a client apparatus an access request including a request for access to the service providing apparatus and identification information for identifying the user. The first request unit issues an acquisition request for the authorization information to a different relay apparatus. The second reception unit receives authorization information transmitted from the different relay apparatus. The second request unit requests the different relay apparatus to update the received authorization information. The third reception unit receives updated authorization information transmitted from the different relay apparatus. The access unit accesses the service providing apparatus by using the received updated authorization information.

Claims

1. A relay apparatus comprising:

a storage unit that stores, for each user, authorization information for accessing a service providing apparatus;

a first reception unit that receives from a client apparatus an access request including a request for access to the service providing apparatus and identification information for identifying the user;

a first request unit that issues, when authorization information corresponding to the identification information included in the received access request is not stored in the storage unit, an acquisition request for the authorization information to a different relay apparatus;

a second reception unit that receives authorization information transmitted from the different relay apparatus as a response to the acquisition request;

a second request unit that requests, when at least any one of the received authorization information and the received access request satisfies a predetermined condition, the different relay apparatus to update the received authorization information;

a third reception unit that receives updated authorization information transmitted from the different relay apparatus as a response to the update request; and

an access unit that accesses the service providing apparatus by using the received updated authorization information.

2. The relay apparatus according to claim 1, wherein when a term of validity of the authorization information received by the second reception unit satisfies a predetermined condition, the second request unit requests the different relay apparatus to update the received authorization information.

3. The relay apparatus according to claim 1, wherein when a processing time required for a service corresponding to the received access request is equal to or more than a predetermined threshold, the second request unit requests the different relay apparatus to update the received authorization information.

4. A relay apparatus comprising:

a storage unit that stores, for each user, authorization information for accessing a service providing apparatus;

a reception unit that receives an acquisition request for authorization information from a different relay apparatus;

a first transmission unit that reads from the storage unit authorization information corresponding to the received acquisition request and transmits the read authorization information to the different relay apparatus; and

a second transmission unit that transmits, when receiving an update request for the authorization information from the different relay apparatus, to the service providing apparatus an update request for the authorization information corresponding to the received update request, and transmits to the different relay apparatus updated authorization information transmitted from the service providing apparatus.

5. The relay apparatus according to claim 4, wherein when receiving update requests for a piece of authorization information from a plurality of different relay apparatuses, the second transmission unit transmits the updated authorization information to any one of the plurality of different relay apparatuses.

6. The relay apparatus according to claim 4, wherein the second transmission unit changes the authorization information so that authorization indicated by the authorization information transmitted from the service providing apparatus is restricted.

7. The relay apparatus according to claim 4, wherein the second transmission unit determines, in accordance with a type of a different relay apparatus from which an update request for the authorization information has been transmitted, whether or not to permit updating of the authorization information.

8. The relay apparatus according to claim 4, wherein the first transmission unit transmits to the service providing apparatus an update request for the read authorization information, and transmits to the different relay apparatus the updated authorization information transmitted from the service providing apparatus.

9. A system comprising:

a first relay apparatus; and

a second relay apparatus,

wherein the first relay apparatus includes

a first storage unit that stores, for each user, authorization information for accessing a service providing apparatus,

a first reception unit that receives from a client apparatus an access request including a request for access to the service providing apparatus and identification information for identifying the user,

a first request unit that issues, when authorization information corresponding to the identification information included in the received access request is not stored in the first storage unit, an acquisition request for the authorization information to the second relay apparatus,

a second reception unit that receives authorization information transmitted from the second relay apparatus as a response to the acquisition request,

a second request unit that requests, when at least any one of the received authorization information and the received access request satisfies a predetermined condition, the second relay apparatus to update the received authorization information,

a third reception unit that receives updated authorization information transmitted from the second relay apparatus as a response to the update request, and

an access unit that accesses the service providing apparatus by using the received updated authorization information, and

wherein the second relay apparatus includes

a second storage unit that stores, for each user, authorization information for accessing the service providing apparatus,

a fourth reception unit that receives an acquisition request for the authorization information from the first relay apparatus,

a first transmission unit that reads from the second storage unit authorization information corresponding to the received acquisition request and transmits the read authorization information to the first relay apparatus, and

a second transmission unit that transmits, when receiving an update request for the authorization information from the first relay apparatus, to the service providing apparatus an update request for the authorization information corresponding to the received update request, and transmits to the first relay apparatus updated authorization information transmitted from the service providing apparatus.

10. A relay method comprising:

storing, for each user, authorization information for accessing a service providing apparatus;

receiving from a client apparatus an access request including a request for access to the service providing apparatus and identification information for identifying the user;

issuing, when authorization information corresponding to the identification information included in the received access request is not stored, an acquisition request for the authorization information to a different relay apparatus;

receiving authorization information transmitted from the different relay apparatus as a response to the acquisition request;

requesting, when at least any one of the received authorization information and the received access request satisfies a predetermined condition, the different relay apparatus to update the received authorization information;

receiving updated authorization information transmitted from the different relay apparatus as a response to the update request; and

accessing the service providing apparatus by using the received updated authorization information.

11. A relay method comprising:

storing, for each user, authorization information for accessing a service providing apparatus;

receiving an acquisition request for authorization information from a different relay apparatus;

reading authorization information corresponding to the received acquisition request and transmitting the read authorization information to the different relay apparatus; and

transmitting, when receiving an update request for the authorization information from the different relay apparatus, to the service providing apparatus an update request for the authorization information corresponding to the received update request, and transmitting to the different relay apparatus updated authorization information transmitted from the service providing apparatus.

12. A non-transitory computer readable medium storing a program causing a computer to execute a relay process, the process comprising:

storing, for each user, authorization information for accessing a service providing apparatus;

receiving from a client apparatus an access request including a request for access to the service providing apparatus and identification information for identifying the user;

issuing, when authorization information corresponding to the identification information included in the received access request is not stored, an acquisition request for the authorization information to a different relay apparatus;

receiving authorization information transmitted from the different relay apparatus as a response to the acquisition request;

requesting, when at least any one of the received authorization information and the received access request satisfies a predetermined condition, the different relay apparatus to update the received authorization information;

receiving updated authorization information transmitted from the different relay apparatus as a response to the update request; and

accessing the service providing apparatus by using the received updated authorization information.

13. A non-transitory computer readable medium storing a program causing a computer to execute a relay process, the process comprising:

storing, for each user, authorization information for accessing a service providing apparatus;

receiving an acquisition request for authorization information from a different relay apparatus;

reading authorization information corresponding to the received acquisition request and transmitting the read authorization information to the different relay apparatus; and

transmitting, when receiving an update request for the authorization information from the different relay apparatus, to the service providing apparatus an update request for the authorization information corresponding to the received update request, and transmitting to the different relay apparatus updated authorization information transmitted from the service providing apparatus.