Relay apparatus, relay system, relay method, and non-transitory computer readable medium

• US 9,906,529 B2
• Filed: 07/09/2014
• Issued: 02/27/2018
• Est. Priority Date: 10/09/2013
• Status: Active Grant

• Current Assignee: Fujifilm Business Innovation Corp. (Fujifilm Holdings Corporation)
• Original Assignee: Fuji Xerox Company Limited (Xerox Holdings Corp.)
• Inventors: Shinoda, Kazumoto
• Primary Examiner(s): Parsons, Theodore C
• Assistant Examiner(s): RUPRECHT, CHRISTOPHER S
• Application Number:
  US14/327,089
• Publication Number:
  US 20150101023A1
• Time in Patent Office: 1,329 Days
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/608 Secure printing
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

A relay apparatus includes a memory that stores right information indicating a right to access a service providing apparatus, a first retrieval unit that retrieves, from a client apparatus, identification information of a user registered in the service providing apparatus that is a target of an access request from the client apparatus, and an access unit that accesses the service providing apparatus as the target using the identification information retrieved by the first retrieval unit instead of the right information stored on the memory if the right information to access the service providing apparatus as the target is not valid.

Claims

1. A relay apparatus comprising:

at least one hardware processor;

a memory configured to store, for at least one service providing apparatus, a token comprising right information indicating a right to access the service providing apparatus;

a transmitter configured to transmit to a client apparatus, a list of the at least one service providing apparatus together with identification information identifying the token and status information indicating a current status of the token for each of the at least one service providing apparatus to be displayed by the client apparatus, prior to a request by the client apparatus to access content from the at least one service providing apparatus;

a first retriever configured to use the hardware processor to retrieve, from the client apparatus, identification information of a user registered in a service providing apparatus selected from the list that is a target of an access request from the client apparatus; and

an accessor configured to use the hardware processor, in response to determining that the token to access the target service providing apparatus is not valid, to update the status information of the token for the target service providing apparatus and access the target service providing apparatus using the identification information retrieved by the first retriever instead of the right information stored on the memory.

2. The relay apparatus according to claim 1, wherein in response to the access request, the accessor is configured to access the target service providing apparatus using the token stored on the memory, or access the target service providing apparatus using the identification information in response to the service providing apparatus not permitting an access using the token.

3. The relay apparatus according to claim 1, wherein the client apparatus is configured to make the access request to a plurality of service providing apparatuses,

wherein the first retriever is further configured to use the hardware processor to retrieve identification information of a user registered in a first service providing apparatus that does not permit the access using the token stored on the memory, out of the plurality of service providing apparatuses, and

wherein the accessor is further configured to use the hardware processor to use the identification information retrieved by the first retriever to access the first service providing apparatus, or use the token stored on the memory to access a second service providing apparatus, other than the first service providing apparatus, included in the plurality of service providing apparatuses.

4. The relay apparatus according to claim 2, wherein the client apparatus is configured to make the access request to a plurality of service providing apparatuses,

wherein the first retriever is further configured to use the hardware processor to retrieve identification information of a user registered in a first service providing apparatus that does not permit the access using the token stored on the memory, out of the plurality of service providing apparatuses, and

wherein the accessor is further configured to use the hardware processor to use the identification information retrieved by the first retriever to access the first service providing apparatus, or use the token stored on the memory to access a second service providing apparatus, other than the first service providing apparatus, included in the plurality of service providing apparatuses.

5. The relay apparatus according to claim 1, wherein the memory is configured to store the identification information retrieved by the first retriever,

wherein the accessor is further configured to use the hardware processor to access the target service providing apparatus using the identification information stored on the memory in response to the token to access the target service providing apparatus not being stored on the memory, and

wherein the relay apparatus comprises a deleter configured to use the hardware processor to delete the identification information from the memory in response to a predetermined condition being satisfied.

6. The relay apparatus according to claim 2, wherein the memory is configured to store the identification information retrieved by the first retriever,

wherein the accessor is further configured to use the hardware processor to access the target service providing apparatus using the identification information stored on the memory in response to the token to access the target service providing apparatus not being stored on the memory, and

wherein the relay apparatus comprises a deleter configured to use the hardware processor to delete the identification information from the memory in response to a predetermined condition being satisfied.

7. The relay apparatus according to claim 3, wherein the memory is configured to store the identification information retrieved by the first retriever,

wherein the accessor is further configured to use the hardware processor to access the first service providing apparatus as the target service providing apparatus using the identification information stored on the memory in response to the token to access the first service providing apparatus as the target service providing apparatus not being stored on the memory, and

wherein the relay apparatus comprises a deleter configured to use the hardware processor to delete the identification information from the memory in response to a predetermined condition being satisfied.

8. The relay apparatus according to claim 4, wherein the memory is configured to store the identification information retrieved by the first retriever,

wherein the accessor is further configured to use the hardware processor to access the first service providing apparatus as the target service providing apparatus using the identification information stored on the memory in response to the token to access the first service providing apparatus as the target service providing apparatus not being stored on the memory, and

wherein the relay apparatus comprises a deleter configured to use the hardware processor to delete the identification information from the memory in response to a predetermined condition being satisfied.

9. The relay apparatus according to claim 5, wherein the predetermined condition is that an operation related to the access request to the target service providing apparatus is completed.

10. The relay apparatus according to claim 6, wherein the predetermined condition is that an operation related to the access request to the target service providing apparatus is completed.

11. The relay apparatus according to claim 7, wherein the predetermined condition is that an operation related to the access request to the target service providing apparatus is completed.

12. The relay apparatus according to claim 8, wherein the predetermined condition is that an operation related to the access request to the target service providing apparatus is completed.

13. The relay apparatus according to claim 5, wherein the client apparatus is configured to make the access request in response to an operation of a user who has logged on to the relay apparatus, and

wherein the predetermined condition is that the user has logged out from the relay apparatus.

14. The relay apparatus according to claim 6, wherein the client apparatus is configured to make the access request in response to an operation of a user who has logged on to the relay apparatus, and

wherein the predetermined condition is that the user has logged out from the relay apparatus.

15. The relay apparatus according to claim 5, wherein the predetermined condition is that a predetermined period of time has elapsed since storage of the identification information retrieved by the first retriever onto the memory.

16. The relay apparatus according to claim 1, further comprising a second retriever configured to use the hardware processor to retrieve, from the service providing apparatus, another token to access the service providing apparatus,

wherein the memory is configured to store the other token retrieved by the second retriever.

17. The relay apparatus according to claim 1, wherein the accessor is further configured use the hardware processor to update the information on the status of the stored token for the target service providing apparatus by changing the status of the stored token for the target service providing apparatus stored in the memory to expired.

18. The relay apparatus according to claim 1, wherein the relay apparatus determines that the token to access the target service providing apparatus is not valid, in response to being denied access by the target service providing apparatus.

19. A relay system comprising a relay apparatus and a client apparatus,

wherein the relay apparatus includes:

at least one hardware processor;

a memory configured to store, for at least one service providing apparatus, a token comprising right information indicating a right to access the service providing apparatus;

a transmitter configured to transmit to the client apparatus, a list of the at least one service providing apparatus together with identification information identifying the token and status information indicating a current status of the token for each of the at least one service providing apparatus to be displayed by the client apparatus, prior to a request by the client apparatus to access content from the at least one service providing apparatus;

a first retriever configured to use the hardware processor to retrieve, from the client apparatus, identification information of a user registered in a service providing apparatus selected from the list that is a target of an access request from the client apparatus; and

an accessor configured to use the hardware processor, in response to determining that the token to access the target service providing apparatus is not valid, to update the status information of the token for the target service providing apparatus and access the target service providing apparatus using the identification information retrieved by the first retriever instead of the right information stored on the memory, and

wherein the client apparatus is configured to make an access request to the relay apparatus to access a service providing apparatus selected by a user.

20. The relay system according to claim 19, further comprising a token registration apparatus,

wherein the token registration apparatus includes:

a third retriever configured to use the hardware processor to retrieve, from the service providing apparatus, permission information to permit retrieving token indicating a right to access the service providing apparatus; and

a transmitter configured to use the hardware processor to transmit to the relay apparatus the permission information retrieved by the third retriever, and

wherein the relay apparatus includes a second retriever configured to use the hardware processor to retrieve, from the service providing apparatus, the token indicating a right to access the service providing apparatus, by transmitting to the service providing apparatus the permission information received from the right registration apparatus.

21. A relay method comprising:

storing, onto a memory, for at least one service providing apparatus, a token comprising right information indicating a right to access the service providing apparatus;

transmitting to a client apparatus, a list of the at least one service providing apparatus together with identification information identifying the token and status information indicating a current status of the token for each of the at least one service providing apparatus to be displayed by the client apparatus, prior to a request by the client apparatus to access content from the at least one service providing apparatus;

retrieving, from the client apparatus, identification information of a user registered in a service providing apparatus selected from the list that is a target of an access request from the client apparatus;

in response to determining that the token to access the target service providing apparatus is not valid, updating the status information of the token for the target service providing apparatus and accessing the target service providing apparatus using the retrieved identification information instead of the right information stored on the memory.

22. A non-transitory computer readable medium storing a program causing a computer to execute a process for relaying, the computer including a memory configured to store, for at least one service providing apparatus, a token comprising right information indicating a right to access the service providing apparatus, the process comprising:

transmitting to a client apparatus, a list of the at least one service providing apparatus together with identification information identifying the token and status information indicating a status of the token for each of the at least one service providing apparatus to be displayed by the client apparatus, prior to a request by the client apparatus to access content from the at least one service providing apparatus;

retrieving, from the client apparatus, identification information of a user registered in a service providing apparatus selected from the list that is a target of an access request from the client apparatus;

in response to determining that the token to access the target service providing apparatus is not valid, updating the status information of the token for the target service providing apparatus and accessing the target service providing apparatus using the retrieved identification information instead of the right information stored on the memory.