JP2014228951A - Proxy approval providing system and content providing device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To make it possible to dynamically impart an access right to resources, to apparatuses that do not have authentication means.SOLUTION: A first apparatus, a second apparatus and a server providing service are connected through a network. The first apparatus comprises means to receive authentication and approval from the server, means to control the second apparatus and means to receive an approval request redirected from the server and perform approval determination. The second apparatus comprises means to transmit communication endpoint information of the first apparatus as well as a request to the server by control from the first apparatus. The server comprises means to perform authentication and approval of the first apparatus and store the first communication endpoint information, means to redirect the request from the second apparatus to the first communication endpoint, and means to determine whether or not to provide the service to the second apparatus on the basis of a response message to the redirected request.

Description

  The present invention relates to a proxy authorization providing system and a content providing apparatus, and more particularly to a technique suitable for use in a technique for granting an access right that has been authenticated / authorized for a Web service to a device connected to a network by proxy.

  In recent years, not only personal computers but also mobile phones and home appliances can be connected to a network. In an environment where home appliances are used in conjunction with each other, home appliances and other electrical appliances that have been used alone until now are also connected to the network, and still images, videos, music, etc. are transferred to each other to play and save content Is possible.

  Furthermore, home appliances connected to the network can directly access an external Web server and enjoy services. For home appliances that do not have a screen input device such as a personal computer or have restrictions, it is possible to set information such as a user name and password for Web services in advance. Yes.

  For example, Patent Document 1 discloses that an information processing device performs scoring from a response packet unique to an electrical appliance by transmitting and receiving a network protocol to the electrical appliance, and specifies the type of electrical appliance. .

JP 2010-097587 A

  In the above-described technology, when a device without a graphical user interface accesses a resource such as content in a Web service, it is difficult to dynamically grant access to the resource.

Further, when proxy authorization is performed on the server side, there is a problem that it is difficult to confirm whether or not the other party to whom the access right is granted is genuine.
In view of the above-described problems, an object of the present invention is to dynamically grant access rights to resources even for devices that do not have authentication means.

  The proxy authorization providing system of the present invention is a network system in which a first device, a second device, and a server that provides a service are connected via a network, wherein the first device performs the service. A means for receiving authentication / authorization by performing data communication with the server to be provided; a means for controlling the second device; an authorization request redirected from the server for providing the service; And the second device has a means for transmitting a request together with communication endpoint information of the first device to a server that provides the service under the control of the first device. The server providing the service performs authentication / authorization of the first device, and performs authentication / authorization information and a communication endpoint of the first device. Storage means for storing and managing information, and means for receiving a request from the second device together with the communication endpoint information of the first device and redirecting the request to the communication endpoint of the first device And a means for determining whether or not to provide the service to the second device based on the response message of the redirected request.

According to the present invention, it is possible to dynamically grant access rights to resources even for devices that do not have authentication means, and it is possible to access resources.
Furthermore, it is possible to confirm the entity of the other party to whom the access right to the resource is granted, and it is possible to ensure high security.

It is a block diagram of the proxy authorization provision system which shows embodiment of this invention. It is a block diagram of the apparatus which shows embodiment of this invention. It is a sequence diagram which shows the sequence which implement | achieves the process of embodiment of this invention.

  An embodiment of the present invention will be described below with reference to the drawings. In the following embodiments, descriptions of specific processing examples are also shown, but the present invention is not limited to these specific processing examples.

(First embodiment)
FIG. 1 is a diagram showing an overall configuration of a proxy authorization providing system in an embodiment of the present invention.
The proxy authorization providing system of this embodiment includes a control device 100, a rendering device 101, and a content providing device 102, which are connected to each other via a network 103.

The control device 100 has a function as a controller that acquires content from a web server and performs print control, and is configured by a smartphone / tablet terminal or the like.
The rendering apparatus 101 acquires specified content from the web server under the control of the control apparatus 100 and performs printing by itself.
The content providing apparatus 102 is provided as a web server that provides content and the like. Note that the present invention is not limited to the configuration of the rendering device 101, the content providing device 102, and the content providing device 102.

  Each of the devices described above has a resource necessary for executing the program, such as a calculation function and a data holding function, and has a communication function for communicating with a control function for controlling the device itself.

  The control device 100, the rendering device 101, and the content providing device 102 are connected to each other via the network 103, and are capable of exchanging data such as content and control commands.

  The control device 100 has a screen input / output function such as a so-called smartphone, a browser that acquires and displays the content of the web server, and a function that performs authentication and authorization by performing data communication with the web server via the browser. Further, it has a function of searching for and controlling network devices such as the rendering apparatus 101 connected in the same network 103.

  The rendering device 101 is an output device that prints and displays content, such as a printer or a TV. In the present embodiment, it has a function of transmitting / receiving data via the network 103, a function of searching for a device connected to another network, a function of advertising itself, and a controlled function.

  The content providing apparatus 102 is a so-called web server, and has a function of providing content and the like, a determination of an accessible user, and a function of controlling access to the content. Further, it has a function of receiving a content acquisition request and redirecting the request to another network device.

  FIG. 2 is a block diagram illustrating a general configuration of a hardware system such as the control device 100, the rendering device 101, and the content providing device 102, which is exemplified as an embodiment of the present invention. Various devices are not limited to the configuration shown in FIG. The control device 100 and the content providing device 102 have a so-called PC architecture.

Reference numeral 200 denotes an input / output bus (address bus, data bus, and control bus) for connecting the units.
A timer 201 has a function of generating an interrupt at a specified time interval. In addition, it has a so-called watchdog timer function and timekeeping function.
A ROM (Read Only Memory) 202 has a function of storing program codes and fixed data that does not change.

Reference numeral 203 denotes a RAM (Random Access Memory), which has functions as a main memory, an execution program area, an execution area of the program, and a data area.
A parallel controller 204 has a function of inputting / outputting parallel data handled inside the computer to / from an external device as it is.
A serial controller 205 has a function of outputting parallel data handled inside the computer as serial data, or converting serial data into parallel data and inputting the serial data.

Reference numeral 206 denotes an MPU (Micro Processor Unit), which has a function of sequentially executing program instructions and a function of performing interrupt control.
A device controller 207 has a function of connecting to a general external input / output device such as a hard disk or a display.

A direct memory access controller (DMAC) 208 has a control function for directly transferring data between the memory and an external device.
Reference numeral 209 denotes an A / D (Analog to Digital), which has a function of converting data from analog to digital, and a function of digitizing the amount detected by a sensor or the like.

Reference numeral 210 denotes a D / A (Digital to Analog), which has a function of converting data from digital to analog, and has a function of digitizing an operation amount in an external actuator or the like.
Reference numeral 211 denotes a network interface (NETIF), which performs control for transferring data between information processing apparatuses via the network 103 and diagnoses the connection status.

Hereinafter, functional units configured by software included in the control device 100, the rendering device 101, and the content providing device 102 will be described.
The control device 100 includes means for receiving authentication / authorization with a server that provides a service such as the content providing device 102. Furthermore, it has a means for controlling the rendering apparatus 101 and a means for receiving an authorization request redirected from the content providing apparatus 102 that provides the service and making an authorization decision.

  The rendering apparatus 101 includes means for transmitting a request together with communication endpoint information to a server that provides a service such as the content providing apparatus 102 under the control of the control apparatus 100.

  The content providing apparatus 102 includes means for authenticating and authorizing the control apparatus 100 and storing communication endpoint information of the control apparatus 100. The content acquisition request from the rendering apparatus 101 is received together with the communication endpoint information of the control apparatus 100, and the content acquisition request is redirected to the communication endpoint of the control apparatus 100. Furthermore, it has means for determining whether or not to provide its own service to the rendering apparatus 101 based on the response message of the redirected request.

FIG. 3 is a sequence diagram showing a sequence for realizing the system processing exemplified as an embodiment of the present invention.
Hereinafter, processing performed by the control device 100, the rendering device 101, and the content providing device 102 via the network 103 will be described with reference to FIG.

A login is made from the control device 100 to the content providing device 102, an authentication request is made, and a trust relationship is established (S31).
The content providing apparatus 102 records and manages the authentication / authorization information and the communication endpoint information of the control apparatus 100, and sends an authentication response to the control apparatus 100 (S32).

  Next, a print request is issued from the control device 100 to the rendering device 101 (S33). At this time, the control apparatus 100 adds its own communication endpoint information to the request and transmits it to the rendering apparatus 101.

  A content acquisition request of the rendering apparatus 101 that does not have authorization information is transmitted to the content providing apparatus 102. At this time, the rendering apparatus 101 adds and transmits the communication endpoint information of the control apparatus 100 received earlier (S34).

  The content providing apparatus 102 that has received the content acquisition request from the rendering apparatus 101 converts the request into a message asking whether the request is permitted or not permitted to the control apparatus 100 having a trust relationship, and redirects the request (S35). The redirect destination is a communication end point of the control device 100.

  When the trust relationship with the control device 100 is expired (expiration or logout), or when the trust is not established, that is, when the content providing device 102 is not managed by the communication endpoint information of the control device 100 Do not redirect.

  The control device 100 that has received the redirected message determines whether or not to permit the content acquisition request, whether or not the content position (for example, the URL of the content) included in the content print request created by itself is the same. Judging. If they are the same, permission is returned, and if they are different, not allowed is returned (S36).

  It is also conceivable that the redirected message is displayed on the display of the control device 100, a user interface is provided for the user to make a decision, and the result is returned.

  The content providing apparatus 102 transmits the requested content to the rendering apparatus 101 if the response from the control apparatus 100 is approved, and returns an error such as inaccessibility if the above response is rejected (S37).

  The rendering apparatus 101 that has acquired the content from the content providing apparatus 102 prints the content (S38).

(Other embodiments)
The present invention can also be realized by executing the following processing. That is, software (computer program) that implements the functions of the above-described embodiments is supplied to a system or apparatus via a network or various computer-readable storage media. Then, the computer (or CPU, MPU, etc.) of the system or apparatus reads out and executes the program.

DESCRIPTION OF SYMBOLS 100 Control apparatus 101 Rendering apparatus 102 Content provision apparatus 200 System bus 201 Timer 202 ROM
203 RAM
204 Parallel controller 205 Serial controller 206 MPU
207 Device controller 208 DMAC
209 A / D
210 D / A
211 NET / IF

Claims (9)

In a proxy authorization providing system in which a first device, a second device, and a service providing server are connected via a network,
The first device is:
A means for receiving authentication / authorization through data communication with the server providing the service, a means for controlling the second device, and an authorization request received from the authorization request redirected from the server providing the service And means for transmitting a response message,
The second device is:
Means for transmitting a request together with communication endpoint information of the first device to a server that provides the service under control from the first device;
The server providing the service is:
Storage means for performing authentication / authorization of the first device, storing and managing authentication / authorization information and communication endpoint information of the first device, and a request from the second device for the first device Means for receiving together with the communication endpoint information of the device and redirecting the request to the communication endpoint of the first device, and whether to provide the service to the second device by the response message of the redirected request And a proxy authorization providing system comprising: means for determining whether or not.   The proxy authorization providing system according to claim 1, wherein the first device has a display for displaying a message redirected from the server.   The proxy authorization providing system according to claim 1 or 2, wherein the request transmitted from the second device to the server is a content acquisition request.   The proxy authorization providing system according to claim 1, wherein the second device prints content acquired from the server.   The means for redirecting the request to the communication endpoint of the first device redirects when the trust relationship is established with the first device. The proxy authorization provision system described.   The server determines that the requested content is transmitted to the second device if the response from the first device is approval, and does not transmit the requested content to the second device if the response is rejected. The proxy authorization providing system according to any one of claims 1 to 5, wherein a determination is made. A rendering device that outputs content, and a content providing device that is interconnected via a network with a control device that controls the rendering device,
Storage means for performing authentication / authorization of the control device, storing and managing authentication / authorization information and communication endpoint information of the control device,
Means for receiving a request from the rendering device along with communication endpoint information of the control device and redirecting the request to the communication endpoint of the control device;
And a means for determining whether to provide the rendering apparatus with its service based on the redirected response message. A control method for a content providing apparatus interconnected via a network with a rendering apparatus that outputs content, and a control apparatus that controls the rendering apparatus,
A storage step of performing authentication / authorization of the control device, storing and managing authentication / authorization information and communication endpoint information of the control device,
Receiving a request from the rendering device with the communication endpoint information of the control device and redirecting the request to the communication endpoint of the control device;
And determining whether to provide the rendering apparatus with its own service based on the redirected request response message. A program that causes a computer to execute a control method of a rendering device that outputs content and a control device that controls the rendering device and a content providing device that is interconnected via a network,
A storage procedure for performing authentication / authorization of the control device, storing and managing authentication / authorization information and communication endpoint information of the control device,
Receiving a request from the rendering device along with communication endpoint information of the control device and redirecting the request to the communication endpoint of the control device;
A program for causing a computer to execute a procedure for determining whether or not to provide its own service to the rendering device based on a response message of the redirected request.

Images