JP2022053955A - Method, program, information processing apparatus, authentication server, and information processing system - Google Patents

Abstract

To facilitate authentication for using an information processing apparatus.SOLUTION: A method is a method executed by an information processing system including an authentication server, a user terminal, and an information processing apparatus, and includes: a step of, when the authentication server receives the fact that authentication in the user terminal is successful from the user terminal, transmitting identification information to the user terminal; a step of the user terminal transmitting the identification information received from the authentication server to the information processing apparatus; and a step of the information processing apparatus inquiring of the authentication server as to whether the identification information received from the user terminal is the same as the identification information that the authentication server transmits to the user terminal, and when receiving the fact that the pieces of information are the same, permitting the use of the information processing apparatus.SELECTED DRAWING: Figure 5

Description

The present invention relates to methods, programs, information processing devices, authentication servers, and information processing systems.

Conventionally, there is known a system that authenticates a user who wants to use an information processing device such as an MFP (Multifunction Peripheral / Printer / Product) and causes a user who has succeeded in authentication to use the information processing device. For example, Patent Document 1 discloses a method of controlling the availability of services such as printing on an image processing device by using the result of authentication on a user's mobile terminal.

However, in Patent Document 1, authentication is required every time the user uses the image processing device.

Therefore, it is an object of the present invention to facilitate authentication for using the information processing apparatus.

A method according to an embodiment of the present invention is a method executed by an information processing system including an authentication server, a user terminal, and an information processing device, in which the authentication server has succeeded in authentication at the user terminal. When the fact is received from the user terminal, a step of transmitting the identification information to the user terminal, a step of the user terminal transmitting the identification information received from the authentication server to the information processing apparatus, and the information processing. The device inquires the authentication server whether or not the identification information received from the user terminal is the same as the identification information transmitted to the user terminal by the authentication server, and receives the same. In some cases, the step of permitting the use of the information processing apparatus is included.

In the present invention, authentication for using the information processing device can be facilitated.

It is an overall block diagram of the information processing system which concerns on one Embodiment of this invention. It is a figure which shows the hardware configuration of the authentication server which concerns on one Embodiment of this invention. It is a figure which shows the hardware composition of the user terminal which concerns on one Embodiment of this invention. It is a figure which shows the hardware configuration of the information processing apparatus which concerns on one Embodiment of this invention. It is a figure which shows the functional block of the information processing system which concerns on one Embodiment of this invention. This is an example of data stored in the user management unit of the authentication server according to the embodiment of the present invention. This is an example of data stored in the user management unit of the authentication server according to the embodiment of the present invention. This is an example of data stored in the authentication storage unit of the user terminal according to the embodiment of the present invention. This is an example of data stored in the user management unit of the authentication server according to the embodiment of the invention. This is an example of data stored in the authentication storage unit of the user terminal according to the embodiment of the present invention. It is a sequence diagram which shows the flow of the process of distribution of the token which concerns on one Embodiment of this invention. It is a sequence diagram which shows the flow of the processing of the notification of the token which concerns on one Embodiment of this invention. It is a sequence diagram which shows the flow of the process of inquiry of the token which concerns on one Embodiment of this invention.

Hereinafter, each embodiment will be described with reference to the attached drawings. In the present specification and the drawings, the components having substantially the same functional configuration are designated by the same reference numerals, and duplicate description thereof will be omitted.

In one embodiment of the present invention, FIDO (Fast IDentity Online) can be used. Here, FIDO will be described. FIDO is one of the authentication technologies. Specifically, FIDO uses a public key cryptosystem. The client (user terminal described below) creates a key pair, the private key is registered on the client side, and the public key is registered on the server side (authentication server described below). If the authentication on the user terminal (for example, biometric authentication) is successful, the private key can be used. That is, when the authentication on the user terminal is biometric authentication, the physical information for biometric authentication is stored on the client side instead of the server side, and the biometric authentication is completed on the client side. Then, on the server side, user authentication is realized by an authentication protocol using a public key with the client.

In this specification, an embodiment in which biometric authentication is performed by a user terminal such as a smartphone will be described, but the present invention uses any authentication other than biometric authentication (for example, authentication by PIN or passcode). Can be done.

<System configuration>
FIG. 1 is an overall configuration diagram of an information processing system 1 according to an embodiment of the present invention. As shown in FIG. 1, the information processing system 1 includes an authentication server 10, a user terminal 20, and an information processing device 30. The authentication server 10 can send and receive data to and from the user terminal 20 and the information processing device 30 via an arbitrary communication network N. Further, the user terminal 20 can send and receive data to and from the information processing device 30 via Bluetooth, NFC (Near field communication) and the like.

The information processing apparatus 30 may be connected to the communication network N via the proxy server 31 like the office A, or may be connected to the communication network N without going through the proxy server 31 like the office B. You may.

When the authentication performed by the user terminal 20 (for example, FIDO using biometric authentication) is successful, the authentication server 10 transmits identification information (for example, a token) to the user terminal 20. Further, in the authentication server 10, the identification information (for example, a token) received from the user terminal 20 by the information processing device 30 in response to the request from the information processing device 30 is the identification information transmitted by the authentication server 10 to the user terminal 20. Check whether it is (for example, a token).

It should be noted that the group of devices described in the examples is only one of a plurality of computing environments for implementing the embodiments disclosed in the present specification. In one embodiment, the authentication server 10 includes a plurality of computing devices such as server clusters. The plurality of computing devices are configured to communicate with each other over any type of communication link, including networks, shared memory, and the like, and perform the processes disclosed herein.

When the authentication performed by the user terminal 20 (for example, FIDO using biometric authentication) is successful, the user terminal 20 receives identification information (for example, a token) from the authentication server 10. Further, the user terminal 20 transmits the identification information (for example, a token) received by the user terminal 20 from the authentication server 10 to the information processing apparatus 30. For example, the user terminal 20 is a smartphone or the like.

The information processing apparatus 30 determines whether or not the identification information (for example, a token) received by the information processing apparatus 30 from the user terminal 20 is the identification information (for example, a token) transmitted by the authentication server 10 to the user terminal 20. Inquire to the authentication server 10. When the identification information (for example, a token) received by the information processing apparatus 30 from the user terminal 20 is the identification information (for example, a token) transmitted by the authentication server 10 to the user terminal 20, the information processing apparatus 30 is a user. Is permitted to use the information processing device 30 (for example, the information processing device 30 is logged in). For example, the information processing device 30 is an MFP or the like.

The information processing device 30 is not limited to an image forming device such as an MFP as long as it has a communication function. The information processing device 30 is, for example, a PJ (Projector: projector), an IWB (Interactive White Board: a white board having an electronic blackboard function capable of mutual communication), an output device such as a digital signage, and a HUD (Head Up Display) device. , Industrial machines, image pickup devices, sound collectors, medical devices, network home appliances, automobiles (Connected Cars), notebook PCs (Personal Computers), mobile phones, smartphones, tablet terminals, game machines, PDA (Personal Digital Assistant), digital cameras , A wearable PC, a desktop PC, or the like.

Here, the identification information (for example, a token) will be described. The user terminal 20 can hold the identification information (for example, a token) received from the authentication server 10 in the user terminal 20. The user terminal 20 transmits the retained identification information (for example, a token) to the information processing apparatus 30. Therefore, the user does not need to perform authentication on the user terminal 20 such as biometric authentication every time the information processing apparatus 30 is used.

When the authentication server 10 determines the expiration date of the identification information (for example, a token), the information processing apparatus 30 uses the identification information (for example, a token) held by the user terminal 20 until the expiration date expires. The authentication success can be received from the authentication server 10. When the expiration date of the identification information (for example, the token) defined by the authentication server 10 has passed, the information processing apparatus 30 receives the authentication failure even if the identification information (for example, the token) is transmitted to the authentication server 20. In this case, the user is again authenticated by the authentication server 10 by biometric authentication or the like, and when the authentication is successful, the user terminal 20 updates the token held by the token newly received from the authentication server 10. The user terminal 20 may automatically delete the token after a certain period of time.

In this way, the authentication server 10 can set an expiration date for the identification information (for example, a token). That is, the authentication server 10 can centrally manage authentication (that is, collation of tokens) and expiration date of tokens. Therefore, it is possible to prevent the user from being able to use the information processing apparatus 30 without performing biometric authentication or the like indefinitely while allowing the user to use the information processing apparatus 30 without performing biometric authentication or the like.

<Hardware configuration of authentication server>
FIG. 2 is a diagram showing a hardware configuration of the authentication server 10 according to the embodiment of the present invention.

As shown in FIG. 2, the authentication server 10 is constructed by a computer, and as shown in FIG. 2, a CPU (Central Processing Unit) 101, a ROM (Read Only Memory) 102, and a RAM ( Random Access Memory) 103, HD104, HDD (Hard Disk Drive) controller 105, display 106, external device connection I / F (Interface) 107, network I / F (Interface) 108, data bus 109, keyboard 110, pointing device 111 , DVD-RW (Digital Versatile Disk Rewritable) drive 113, and media I / F (Interface) 115.

Of these, the CPU 101 controls the operation of the entire authentication server 10. The ROM 102 stores a program used to drive the CPU 101 such as an IPL. The RAM 103 is used as a work area of the CPU 101. The HD 104 stores various data such as programs. The HDD controller 105 controls reading or writing of various data to the HD 104 according to the control of the CPU 101. The display 106 displays various information such as cursors, menus, windows, characters, or images. The external device connection I / F 107 is an interface for connecting various external devices. The external device in this case is, for example, a USB (Universal Serial Bus) memory, a printer, or the like. The network I / F 108 is an interface for performing data communication using a communication network. The bus line 109 is an address bus, a data bus, or the like for electrically connecting each component such as the CPU 101 shown in FIG.

Further, the keyboard 110 is a kind of input means including a plurality of keys for inputting characters, numerical values, various instructions and the like. The pointing device 111 is a kind of input means for selecting and executing various instructions, selecting a processing target, moving a cursor, and the like. The DVD-RW drive 113 controls reading or writing of various data to the DVD-RW 112 as an example of a detachable recording medium. In addition, it is not limited to DVD-RW, and may be DVD-R or the like. The media I / F 115 controls reading or writing (storage) of data to a recording medium 114 such as a flash memory.

<Smartphone hardware configuration>
FIG. 3 is a diagram showing a hardware configuration of a user terminal (in the case of a smartphone) 20 according to an embodiment of the present invention. The user terminal 20 is provided with hardware for authentication (for example, a camera for face authentication (CMOS, image sensor I / F described below), etc.).

As shown in FIG. 3, the user terminal (in the case of a smartphone) 20 includes a CPU 201, ROM 202, RAM 203, EEPROM 204, CMOS sensor 205, image sensor I / F 206, acceleration / orientation sensor 207, media I / F 209, and GPS. The receiving unit 211 is provided.

Of these, the CPU 201 controls the operation of the entire user terminal (in the case of a smartphone) 20. The ROM 202 stores a program used to drive the CPU 201 such as the CPU 201 and the IPL. The RAM 203 is used as a work area of the CPU 201. The EEPROM 204 reads or writes various data such as a smartphone program according to the control of the CPU 201. The CMOS (Complementary Metal Oxide Semiconductor) sensor 205 is a kind of built-in imaging means for acquiring image data by imaging a subject (mainly a self-image) under the control of the CPU 201. In addition, instead of a CMOS sensor, an image pickup means such as a CCD (Charge Coupled Device) sensor may be used. The image sensor I / F 206 is a circuit that controls the drive of the CMOS sensor 205. The acceleration / orientation sensor 207 is a variety of sensors such as an electronic magnetic compass, a gyro compass, and an acceleration sensor that detect the geomagnetism. The media I / F 209 controls reading or writing (storage) of data to a recording medium 208 such as a flash memory. The GPS receiving unit 211 receives a GPS signal from a GPS satellite.

Further, the user terminal (in the case of a smartphone) 20 includes a long-distance communication circuit 212, a CMOS sensor 213, an image pickup element I / F214, a microphone 215, a speaker 216, a sound input / output I / F217, a display 218, and an external device connection I / F. (Interface) 219, a short-range communication circuit 220, an antenna 220a of the short-range communication circuit 220, and a touch panel 221 are provided.

Of these, the telecommunications circuit 212 is a circuit that communicates with other devices via the communication network N. The CMOS sensor 213 is a kind of built-in imaging means for capturing an image of a subject and obtaining image data under the control of the CPU 201. The image sensor I / F 214 is a circuit that controls the drive of the CMOS sensor 213. The microphone 215 is a built-in circuit that converts sound into an electric signal. The speaker 216 is a built-in circuit that converts an electric signal into physical vibration to produce sounds such as music and voice. The sound input / output I / F 217 is a circuit that processes sound signal input / output between the microphone 215 and the speaker 216 under the control of the CPU 201. The display 218 is a kind of display means such as a liquid crystal display or an organic EL (Electro Luminescence) for displaying an image of a subject, various icons, and the like. The external device connection I / F219 is an interface for connecting various external devices. The short-range communication circuit 220 is a communication circuit such as NFC (Near Field Communication) or Bluetooth (registered trademark). The touch panel 221 is a kind of input means for operating the user terminal (in the case of a smartphone) 20 by the user pressing the display 218.

Further, the user terminal (in the case of a smartphone) 20 includes a bus line 210. The bus line 210 is an address bus, a data bus, or the like for electrically connecting each component such as the CPU 201 shown in FIG.

<Hardware configuration of MFP>
FIG. 4 is a diagram showing a hardware configuration of an information processing device (in the case of an MFP) 30 according to an embodiment of the present invention.

As shown in FIG. 4, the information processing apparatus (in the case of an MFP) 30 includes a controller 310, a short-range communication circuit 320, an engine control unit 330, an operation panel 340, and a network I / F (Interface) 350. There is.

Of these, the controller 310 includes a CPU 301, a system memory (MEM-P) 302, a north bridge (NB) 303, a south bridge (SB) 304, an ASIC (Application Specific Integrated Circuit) 305, and a storage unit, which are the main parts of the computer. It has a local memory (MEM-C) 306, an HDD controller 307, and a storage unit HD308, and has a configuration in which the NB 303 and the ASIC 305 are connected by an AGP (Accelerated Graphics Port) bus 321.

Of these, the CPU 301 is a control unit that controls the entire information processing device (in the case of the MFP) 30. The NB 303 is a bridge for connecting the CPU 301, the MEM-P302, the SB304, and the AGP bus 321. The NB 303 includes a memory controller that controls reading and writing to the MEM-P302, a PCI (Peripheral Component Interconnect) master, and an AGP target. Has.

The MEM-P302 includes a ROM 302a which is a memory for storing programs and data that realizes each function of the controller 310, and a RAM 302b which is used as a memory for developing programs and data and a memory for drawing at the time of memory printing. The program stored in the RAM 302b is configured to be recorded and provided as a file in an installable format or an executable format on a computer-readable recording medium such as a CD-ROM, CD-R, or DVD. You may.

The SB 304 is a bridge for connecting the NB 303 to a PCI device and peripheral devices. The ASIC 305 is an IC (Integrated Circuit) for image processing applications having hardware elements for image processing, and has a role of a bridge connecting the AGP bus 321 and the PCI bus 322, the HDD 307, and the MEM-C306, respectively. This ASIC 305 is a PCI target and an AGP master, an arbiter (ARB) which is the core of the ASIC 305, a memory controller that controls MEM-C306, and a plurality of DMACs (Direct Memory Access Controllers) that rotate image data by hardware logic and the like. , And a PCI unit that transfers data between the scanner unit 331 and the printer unit 332 via the PCI bus 322. A USB (Universal Serial Bus) interface or an IEEE 1394 (Institute of Electrical and Electronics Engineers 1394) interface may be connected to the ASIC 305.

The MEM-C306 is a local memory used as a copy image buffer and a code buffer. The HD308 is a storage for accumulating image data, accumulating font data used at the time of printing, and accumulating forms. The HD 308 controls reading or writing of data to the HD 308 according to the control of the CPU 301. The AGP bus 321 is a bus interface for a graphics accelerator card proposed to speed up graphic processing, and the graphics accelerator card can be speeded up by directly accessing the MEM-P302 with a high throughput. ..

Further, the short-range communication circuit 320 is provided with the short-range communication circuit 320a. The short-range communication circuit 320 is a communication circuit such as NFC or Bluetooth.

Further, the engine control unit 330 is composed of a scanner unit 331 and a printer unit 332. Further, the operation panel 340 displays the current setting value, the selection screen, and the like, and sets the panel display unit 340a such as a touch panel that accepts the input from the operator, and the setting value of the condition related to image formation such as the density setting condition. It is provided with an operation panel 340b including a numeric keypad for receiving and a start key for receiving a copy start instruction. The controller 310 controls the entire information processing device (in the case of the MFP) 30, for example, drawing, communication, input from the operation panel 340, and the like. The scanner unit 331 or the printer unit 332 includes an image processing portion such as error diffusion and gamma conversion.

The information processing apparatus (in the case of the MFP) 30 can sequentially switch and select the document box function, the copy function, the printer function, and the facsimile function by the application switching key of the operation panel 340. When the document box function is selected, the document box mode is set, when the copy function is selected, the copy mode is set, when the printer function is selected, the printer mode is set, and when the facsimile mode is selected, the facsimile mode is set.

Further, the network I / F 350 is an interface for performing data communication using a communication network. The short-range communication circuit 320 and the network I / F 350 are electrically connected to the ASIC 305 via the PCI bus 322.

<Functional block of information processing system>
FIG. 5 is a diagram showing a functional block of the information processing system 1 according to the embodiment of the present invention.

<Authentication server>
The authentication server 10 of the information processing system 1 includes a user management unit 1001, a cloud authentication server unit 1002, a biometric authentication server unit (also referred to as a user terminal authentication server unit) 1003, and a communication unit 1004. Further, the authentication server 10 functions as a cloud authentication server unit 1002, a biometric authentication server unit 1003, and a communication unit 1004 by executing a program.

The user management unit 1001 stores information about all users. Specifically, the user management unit 1001 stores information such as a user name, a user ID, a password, a public key, and a token of each user. Later, with reference to FIGS. 6, 7, and 9, the data stored in the user management unit 1001 will be described in detail.

The biometric authentication server unit 1003 generates a token when the authentication on the user terminal 20 is successful. For example, the biometric authentication server unit 1003 generates a token when the authentication using the FIDO protocol is successful. Further, the biometric authentication server unit 1003 stores the generated token in the user management unit 1001. Further, the biometric authentication server unit 1003 transmits the generated token to the biometric authentication client unit 2004 of the user terminal 20.

The cloud authentication server unit 1002 determines the validity of the token in response to an inquiry from the cloud authentication client unit 3002 of the information processing apparatus 30. Specifically, the cloud authentication server unit 1002 determines whether or not the inquired (that is, received from the information processing device 30) token is stored in the user management unit 1001. Further, when the inquired token is stored in the user management unit 1001, the cloud authentication server unit 1002 notifies the cloud authentication client unit 3002 that the authentication is successful.

Here, the token will be described. The token may be a token with an expiration date. The user can use both the information processing device 30 of the office A and the information processing device 30 of the office B by using the token distributed to the user terminal 20 as long as it is within the expiration date.

The communication unit 1004 transmits / receives data to / from the communication unit 2001 of the user terminal 20 and the communication unit 3001 of the information processing device 30.

<User terminal>
The user terminal 20 of the information processing system 1 includes a communication unit 2001, an MFP authentication client unit (also referred to as an information processing device authentication client unit) 2002, an authentication storage unit 2003, and a biometric authentication client unit (also referred to as a user terminal authentication client unit). ) 2004, a user operation unit 2005, and an authentication unit 2006. Further, the user terminal 20 functions as a communication unit 2001, an MFP authentication client unit 2002, a biometric authentication client unit 2004, a user operation unit 2005, and an authentication unit 2006 by executing a program.

The authentication storage unit 2003 stores information about a user who uses the user terminal 20. Specifically, the authentication storage unit 2003 stores information (URL) indicating the authentication server 10, user ID, password, private key, token, and the like. Later, with reference to FIGS. 8 and 10, the data stored in the authentication storage unit 2003 will be described in detail.

The biometric authentication client unit 2004 receives a token from the biometric authentication server unit 1003 of the authentication server 10. Further, the biometric authentication client unit 2004 stores the acquired token in the authentication storage unit 2003.

The MFP authentication client unit 2002 acquires the token stored in the authentication storage unit 2003. Further, the MFP authentication client unit 2002 transmits the acquired token to the MFP authentication server unit 3003 of the information processing apparatus 30.

The user operation unit 2005 provides a user interface and accepts operations from the user.

The communication unit 2001 transmits / receives data to / from the communication unit 1004 of the authentication server 10 and the communication unit 3001 of the information processing device 30.

The authentication unit 2006 authenticates the user (for example, biometric authentication).

<Information processing equipment>
The information processing device 30 of the information processing system 1 includes a communication unit 3001, a cloud authentication client unit 3002, and an MFP authentication server unit (also referred to as an information processing device authentication server unit) 3003. Further, the information processing apparatus 30 functions as a communication unit 3001, a cloud authentication client unit 3002, and an MFP authentication server unit 3003 by executing a program.

The MFP authentication server unit 3003 acquires a token from the MFP authentication client unit 2002 of the user terminal 20.

The cloud authentication client unit 3002 inquires the cloud authentication server unit 1002 of the authentication server 10 about the validity of the token. Specifically, when the information processing device 30 acquires a token from the user terminal 20, the cloud authentication client unit 3002 transmits the token acquired by the information processing device 30 from the user terminal 20 to the user terminal 20 by the authentication server 10. Inquires whether or not it is a token to the cloud authentication server unit 1002. When the inquired token is stored in the user management unit 1001, the cloud authentication client unit 3002 receives a notification from the cloud authentication server unit 1002 that the authentication is successful.

The communication unit 3001 transmits / receives data to / from the communication unit 1004 of the authentication server 10 and the communication unit 2001 of the user terminal 20.

FIG. 6 is an example of data (user ID and password registered) stored in the user management unit 1001 of the authentication server 10 according to the embodiment of the present invention. As shown in FIG. 6, the user management unit 1001 of the authentication server 10 stores data of "user name", "user ID", and "password" of each user. When registering the public key in the authentication server 10, the "user ID" and "password" stored in the user management unit 1001 of the authentication server 10 and the "user ID" and the "password" are stored in the authentication storage unit 2003 of the user terminal 20. The "user ID" and "password" are collated.

FIG. 7 is an example of data (public key registered) stored in the user management unit 1001 of the authentication server 10 according to the embodiment of the present invention. As shown in FIG. 7, the user management unit 1001 of the authentication server 10 stores the data of the “public key” in addition to the “user name”, “user ID”, and “password” of FIG. The "public key" is a public key for FIDO authentication (paired with a private key stored in the authentication storage unit 2003 of the user terminal 20 described later).

FIG. 8 is an example of data stored in the authentication storage unit 2003 of the user terminal 20 according to the embodiment of the present invention. As shown in FIG. 8, the authentication storage unit 2003 of the user terminal 20 has "information indicating the authentication server 10 (URL (Uniform Resource Locator))", "user ID", "password", and "private key". Memorize the data of. The "private key" is a private key for FIDO authentication (paired with the public key stored in the user management unit 1001 of the authentication server 10 described above). The authentication storage unit 2003 of the user terminal 20 is a storage area that can be accessed only when the biometric authentication at the user terminal 20 is successful.

FIG. 9 is an example of data (registered tokens) stored in the user management unit 1001 of the authentication server 10 according to the embodiment of the invention. As shown in FIG. 9, the user management unit 1001 of the authentication server 10 has data of a "token" in addition to the "user name", "user ID", "password", and "public key" of FIG. Remember. The "token" is a token generated by the biometric authentication server unit 1003 of the authentication server 10.

FIG. 10 is an example of data stored in the authentication storage unit 2003 of the user terminal 20 according to the embodiment of the present invention. As shown in FIG. 10, the authentication storage unit 2003 of the user terminal 20 has a "token" in addition to "information (URL) indicating the authentication server 10", "user ID", "password", and "private key". ”Data is stored. The "token" is a token received by the biometric authentication client unit 2004 of the user terminal 20.

<Processing method>
FIG. 11 is a sequence diagram showing a flow of processing for distributing tokens according to an embodiment of the present invention.

In step 11 (S11), authentication is performed on the user terminal 20 according to the operation received by the user operation unit 2005. Hereinafter, an embodiment in which the user terminal 20 performs biometric authentication and the authentication server 10 authenticates the user using a public key cryptosystem will be described.

First, the authentication unit 2006 of the user terminal 20 acquires physical information for biometric authentication (for example, an image of the user's face detected by the user terminal 20). Next, the authentication unit 2006 determines whether or not the acquired physical information and the physical information stored in the user terminal 20 match.

In step 12 (S12), when the physical information matches in S11 (that is, when the biometric authentication is successful), the authentication unit 2006 receives from the authentication server 10 with the private key stored in the user terminal 20. Create a signature (encrypt the hash) using the challenge and send it to the authentication server 10.

In step 13 (S13), the authentication server 10 decrypts the signature with the public key and verifies the signature based on whether or not it is the same as the challenge transmitted to the user terminal 20.

In step 14 (S14), the biometric authentication server unit 1003 generates a token. Specifically, the biometric authentication server unit 1003 verifies the signature in S13 and generates a token when the authentication is successful.

In step 15 (S15), the biometric authentication server unit 1003 stores the token generated in S14 in the user management unit 1001.

In step 16 (S16), the biometric authentication server unit 1003 transmits the token generated in S14 to the biometric authentication client unit 2004.

In step 17 (S17), the biometric authentication client unit 2004 stores the token received in S16 in the authentication storage unit 2003.

FIG. 12 is a sequence diagram showing a flow of processing for notification of tokens according to an embodiment of the present invention.

In step 21 (S21), the MFP authentication client unit 2002 acquires the token stored in the authentication storage unit 2003 (that is, the token of S17 in FIG. 11).

In step 22 (S22), the MFP authentication client unit 2002 transmits the token acquired in S21 to the MFP authentication server unit 3003. For example, the MFP authentication client unit 2002 can transmit the token to the MFP authentication server unit 3003 via Bluetooth, NFC, or the like.

FIG. 13 is a sequence diagram showing a flow of processing for querying tokens according to an embodiment of the present invention.

In step 31 (S31), the cloud authentication client unit 3002 inquires the cloud authentication server unit 1002 about the validity of the token. Specifically, when the information processing apparatus 30 receives a token from the user terminal 20 (that is, S22 in FIG. 12), the cloud authentication client unit 3002 receives the token received from the user terminal 20 by the information processing apparatus 30 as an authentication server. The cloud authentication server unit 1002 is inquired whether or not 10 is a token transmitted to the user terminal 20.

In step 32 (S32), the cloud authentication server unit 1002 determines whether or not the token inquired in S31 is stored in the user management unit 1001.

In step 33 (S33), when the token inquired in S31 is stored in the user management unit 1001, the cloud authentication server unit 1002 notifies the cloud authentication client unit 3002 that the authentication is successful. The cloud authentication server unit 1002 can notify the cloud authentication client unit 3002 of user information (for example, a user ID, a function that can be provided to the user, etc.) corresponding to the token inquired in S31. .. For example, the information processing device 30 determines a function (for example, a copy function, a scanner function, a fax function, a printer function, etc.) provided by the information processing device 30 based on the notified user information (for example, a user ID). can do. Further, for example, the information processing apparatus 30 provides a function (for example, a copy function, a scanner function, a fax function, a printer function, etc.) according to the notified user information (for example, a function that can be provided to the user). can do.

<Effect>
As described above, in one embodiment of the present invention, the user does not need to perform authentication on the user terminal 20 such as biometric authentication every time the information processing apparatus 30 is used. Further, in one embodiment of the present invention, it is possible to prevent the user from being able to use the information processing device 30 without performing biometric authentication or the like indefinitely while allowing the user to use the information processing device 30 without performing biometric authentication or the like. Can be done. Further, the authentication server 10 transmits the generated identification information (for example, a token) to the user terminal 20, and receives the collation of the identification information (for example, the token) from the information processing apparatus 30. Therefore, the information processing apparatus 30 can provide the function of the information processing apparatus 30 to the user having the user terminal 20 without managing the information of the user terminal 20.

Further, in one embodiment of the present invention, it is not necessary to install a device for performing biometric authentication for each information processing device 30. Further, in one embodiment of the present invention, the physical information of the user used for biometric authentication itself does not flow on the network, so that security can be improved. Further, in one embodiment of the present invention, the legitimacy of the user is guaranteed by the authentication server 10, so that security can be improved. Further, in one embodiment of the present invention, the information processing apparatus 30 does not need to hold the information of the user terminal 20, so that security and convenience can be improved.

Each function of the embodiment described above can be realized by one or more processing circuits. Here, the "processing circuit" as used herein is a processor programmed to perform each function by software, such as a processor implemented by an electronic circuit, or a processor designed to execute each function described above. It shall include devices such as ASIC (Application Specific Integrated Circuit), DSP (digital signal processor), FPGA (field programmable gate array) and conventional circuit modules.

Although the embodiments of the present invention have been described in detail above, the present invention is not limited to the above-mentioned specific embodiments, and various modifications are made within the scope of the gist of the present invention described in the claims.・ Can be changed.

1 Information processing system 10 Authentication server 20 User terminal 30 Information processing device 31 Proxy server 1001 User management unit 1002 Cloud authentication server unit 1003 Biometric authentication server unit 1004 Communication unit 2001 Communication unit 2002 MFP authentication client unit 2003 Authentication storage unit 2004 Biometric authentication client Unit 2005 User operation unit 2006 Authentication unit 3001 Communication unit 3002 Cloud authentication client unit 3003 MFP authentication server unit

Japanese Unexamined Patent Publication No. 2018-205906

Claims (9)

It is a method executed by an information processing system including an authentication server, a user terminal, and an information processing device.
When the authentication server receives from the user terminal that the authentication at the user terminal is successful, the step of transmitting the identification information to the user terminal and the step.
A step in which the user terminal transmits the identification information received from the authentication server to the information processing apparatus.
The information processing apparatus inquires the authentication server whether or not the identification information received from the user terminal is the same as the identification information transmitted by the authentication server to the user terminal, and the same is true. A method including a step of permitting the use of the information processing apparatus when the information processing device is received. The method according to claim 1, wherein the identification information is a token. The method according to claim 1 or 2, wherein the notification from the user terminal to the authentication server that the authentication at the user terminal is successful is performed by the method of FIDO. The method according to any one of claims 1 to 3, wherein the authentication in the user terminal is biometric authentication. The method according to any one of claims 1 to 4, wherein the information processing apparatus accesses the authentication server via a proxy. User terminal,
An authentication unit that authenticates a user and sends to the authentication server that the user's authentication was successful.
User terminal authentication client unit that receives identification information from the authentication server,
A program for functioning as an information processing device authentication client unit that transmits the identification information received from the authentication server to the information processing device. Information processing device authentication server unit that receives identification information from the user terminal,
The authentication server is inquired whether or not the received identification information is the same as the identification information transmitted to the user terminal, and when the same is received, the use of the information processing device is permitted. An information processing device equipped with a cloud authentication client unit. When the user terminal receives the fact that the authentication on the user terminal is successful, the user terminal authentication server unit that transmits the identification information to the user terminal and the user terminal authentication server unit.
An authentication server provided with a cloud authentication server unit that determines whether or not the identification information received from the information processing device is the same as the identification information transmitted to the user terminal. An information processing system that includes an authentication server, a user terminal, and an information processing device.
The authentication server is
When the user terminal receives the fact that the authentication in the user terminal is successful, the user terminal authentication server unit that transmits the identification information to the user terminal and the user terminal authentication server unit.
A cloud authentication server unit for determining whether or not the identification information received from the information processing device is the same as the identification information transmitted to the user terminal is provided.
The user terminal is
An authentication unit that authenticates the user and sends the fact that the user's authentication was successful to the authentication server.
A user terminal authentication client unit that receives the identification information from the authentication server, and
It includes an information processing device authentication client unit that transmits the identification information received from the authentication server to the information processing device.
The information processing device is
An information processing device authentication server unit that receives the identification information from the user terminal, and
The authentication server is inquired whether or not the received identification information is the same as the identification information transmitted to the user terminal, and when the authentication server receives the same, the information processing apparatus. An information system equipped with a cloud authentication client section that permits its use.

Images