JP6626466B2 - API providing apparatus and API use right transfer consent method - Google Patents

Description

  The present invention relates to a technique for managing a consent response of delegation of API usage rights and a user account.

  Non-Patent Documents 1 and 2 disclose techniques for performing API use authentication with an API providing device when a client application uses a Web-API (Web Application Programming Interface).

"OAth 2.0", [online], [Searched February 6, 2017], <URL: https://oauth.net/2/> “The OAuth 2.0 Authorization Framework, 4.1. Authorization Code Grant”, [online], [searched February 13, 2017], <URL: https://tools.ietf.org/html/rfc6749#section-4.1>

  In the case of an API resale business model, a plurality of API providing devices are connected in multiple stages. At this time, in the API use authentication, since the plurality of API providing devices request the end user to consent to the transfer of the API use right, the end user needs to respond to the plurality of consent requests. There is a problem of lack of convenience. In addition, since the consent request is transmitted directly from the API providing device of the API wholesaler to the end user, it is not possible to satisfy the requirement of hiding the API wholesaler from the user or the client.

  The present invention has been made in view of the above circumstances, and has as its object to improve the user's burden of agreeing to transfer the API usage right and hide the API providing device of the API wholesaler.

  In order to solve the above problem, an API providing device according to claim 1 transfers an API usage right from another API providing device to the user based on consent information of a user who has agreed to transfer the usage right of the API. And a response unit for transmitting consent information indicating consent to the consent request.

  The API providing device according to claim 2 is the API providing device according to claim 1, wherein the user of the own API providing device and the user of the another API providing device respectively issue identification information of the user issued to the user. It is characterized by further comprising a storage unit for storing in association with.

  The consent method of delegating the API usage right according to claim 3 is a method of consent of delegation of the API usage right performed by the API providing device, wherein the API providing device adds the consent information of the user who has agreed to delegate the usage right of the API. A step of transmitting consent information indicating consent from another API providing apparatus to a consent request for transfer of an API use right to the user.

  According to a fourth aspect of the present invention, there is provided an API usage right delegation consent method according to the third aspect, wherein the user of the own API providing device and the other API providing device are provided before performing the step. And storing the user identification information in the storage unit in association with the user identification information issued to the user.

  ADVANTAGE OF THE INVENTION According to this invention, the burden of the user concerning the consent of transfer of API use right can be reduced and the API provision apparatus of the API wholesaler can be hidden.

It is a figure showing a system configuration. It is a figure showing the processing sequence of the whole system. FIG. 3 is a diagram illustrating a processing flow of an API request processing unit 11. FIG. 4 is a diagram illustrating a processing flow of an authorization request verification unit 13. FIG. 3 is a diagram illustrating a processing flow of a user authentication unit 14. FIG. 4 is a diagram illustrating a processing flow of an API request generation unit 15. FIG. 3 is a diagram illustrating a processing flow of an API response processing unit 16. FIG. 4 is a diagram showing a processing flow of a user authentication response unit 17; FIG. 4 is a diagram showing a processing flow of an authorization code issuing unit 18; FIG. 3 is a diagram illustrating a processing flow of an API response generation unit 12. FIG. 3 is a diagram showing a processing flow of a token request verification unit 19; FIG. 3 is a diagram illustrating a processing flow of an access token issuing unit 20. FIG. 3 is a diagram showing a processing flow of an access token verification unit 21. FIG. 4 is a diagram showing a processing flow of an access token conversion unit 22. FIG. 4 is a diagram illustrating an example of user authentication information. It is a figure showing an example of an access token. It is a figure showing an example of an authorization code. It is a schematic diagram of this embodiment and a conventional example.

  In order to solve the above-mentioned problem, the present invention provides a plurality of API providing apparatuses connected in multiple stages, in which an API providing apparatus (an upper-level API providing apparatus) of an API wholesaler has a pseudo user function. Then, in response to the consent request of the transfer of the API usage right from the API providing device (lower API providing device) of the API wholesaler to the user, the pseudo user function adds the consent information of the user who has consented to the transfer of the API usage right. Based on the user's behalf, the user's consent is sent by proxy. As a result, it is possible to reduce the burden on the user relating to the consent to the transfer of the API usage right, and to provide the API while hiding the API providing device of the API wholesaler. Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 shows a system configuration according to the present embodiment. This system configuration includes an end-user use terminal 1, an API use device 3, an upper API provision device 5, a lower API provision device 7, and a resource server 9. The connection configuration of the API providing device illustrated in FIG. 1 is an example of two stages, and for example, three or more stages may be connected in multiple stages.

  The end-user terminal 1 is a device for executing services provided by the resource server 9 on the client side, such as a mobile phone and a smartphone. The API using device 3 is an application or a device for executing the service on the client side. The application may be executed inside the end user terminal 1.

  The higher-level API providing device 5 is a device that provides software functions related to the service as an API. The “consent request function” for requesting the end user to consent to the transfer of the API usage right before the API is provided. If the consent has been received, a “pseudo-user function” is provided to proxyly consent the user's consent to the consent request for transfer of the API usage right from the lower API providing device 7 to the end user. In the present embodiment, the higher-level API providing device 5 is used by an API wholesale business.

  On the other hand, the lower API providing device 7 is used by an API wholesaler and has the above-described consent request function. The lower API providing device 7 is basically a conventional API providing device, while the upper API providing device 5 is configured by adding the “pseudo user function” to the conventional API providing device. I have.

  Further, the upper API providing device 5 needs to log in to the lower API providing device 7 when making a proxy response of the user's consent to the lower API providing device 7 by proxy. Therefore, a “user account management function” for retaining and managing the user ID and password issued to the end user by the lower API providing device 7 is further provided.

  A configuration example of the higher-level API providing device 5 will be described. In the present embodiment, as shown in FIG. 1, the higher-level API providing device 5 includes an API request processing unit 11, an API response generation unit 12, an authorization request verification unit 13, a user authentication unit 14, an API request Generating unit 15, API response processing unit 16, user authentication response unit 17, authorization code issuing unit 18, token request verifying unit 19, access token issuing unit 20, access token verifying unit 21, access token converting unit A storage unit 22, a user authentication information storage unit 23, an authorization code storage unit 24, and an access token storage unit 25.

  In FIG. 1, an oblique hatching is added to an additional function unit with respect to the conventional API providing device. The “pseudo-user function” described above includes an API request generation unit 15, an API response processing unit 16, and a user authentication response unit 17. The “user account management function” described above includes the user authentication information storage unit 23. By operating these four functional units in cooperation with each other, a login process and a proxy response process of user consent are performed on the lower API providing device 7.

  In addition, these four functional units and all the other functional units except for the access token converting unit 22 described later are functional units included in the conventional API providing device, and function as an authorization server defined by “OAuth 2.0” or the like. I do. This authorization server is described in detail in Non-Patent Documents 1 and 2. However, simply, a token (a character string representing an access authorization issued to a client, (Indicating the range of authority and access period granted by the client). However, in the present embodiment, the token included in the API request needs to be converted into a token issued by the lower-level API providing device 7 in order to perform the proxy response of the user with the “pseudo-user function”. Therefore, the higher-level API providing device 5 further includes a “token conversion function” for converting a token. This “token conversion function” is configured by the access token conversion unit 22.

  The lower API providing device 7 is a conventional API providing device that functions as an authorization server. Specifically, the lower API providing device 7 includes an API request generating unit 15, an API response processing unit 16, a user authentication responding unit 17, a user authentication information storing unit, and the like from the upper API providing device 5 shown in FIG. 23 and a function unit excluding the access token conversion unit 22.

  The resource server 9 is a server that provides a predetermined service.

  Next, the operation of the higher-level API providing device 5 will be described.

  First, the operation will be outlined. When receiving the API use request from the API use device 3 (client), the higher-level API providing device 5 requests the user to consent to the transfer of the API use right. After the user's consent, the upper API providing device 5 transmits an API use request to the lower API providing device 7. Thereafter, the consent of the transfer of the API usage right is requested from the lower API providing device to the upper API providing device, but since the user's consent has already been received, the user authentication in which the pseudo user function of the upper API providing device 5 is stored. Use the information to automatically respond to your consent and go through the authentication process.

  Subsequently, the operation will be described in detail. FIG. 2 shows a processing sequence of the entire system. FIG. 3 to FIG. 14 are diagrams illustrating a processing flow of each functional unit configuring the higher-level API providing apparatus 5. FIGS. 15 to 17 are diagrams showing examples of various data used in the present processing sequence.

  It should be noted that the user, the API wholesale business, and the API wholesale business previously set a lower API in accordance with the agreement of the transfer of the API usage right by the user accepting the consent to the consent request from the higher API providing apparatus 5. It is considered that the consent request from the providing device 7 is also accepted. "

  It is also assumed that the higher-level API providing apparatus 5 performs user registration with the lower-level API providing apparatus 7 in advance, and stores and manages the issued user authentication information (user ID and password). Specifically, the user authentication information storage unit 23 of the higher-level API providing apparatus 5 stores the API wholesaler of the lower-level API providing apparatus 7 with the user ID already issued to the end user by the API wholesaler of the higher-level API providing apparatus 5 as a key. The user ID and the password issued by the former company to the higher-level API providing apparatus 5 (= pseudo end user) are stored in association with each other (see FIG. 15 described later).

  First, as shown in FIG. 2, when the end user starts using the client application on the higher-level API providing device 5, an authorization request related to API access is provided from the higher-level API providing device 3 through the end-user using terminal 1. It is transmitted to the device 5.

  Next, the higher-level API providing device 5 executes the process of step A in FIG. As shown in FIG. 3A, the API request processing unit 11 receives the authorization request from the end user terminal 1 redirected from the API using device 3 (step A1), and sends the authorization request to the authorization request verification unit 13. A request is transmitted (step A2).

  Next, the higher-level API providing device 5 executes the processing of steps B and C in FIG. As shown in FIG. 4, the authorization request verification unit 13 receives an authorization request from the API request processing unit 11 (step B1), and determines whether or not parameters included in the authorization request conform to the rules (step B1). Step B2). Thereafter, if the parameter matches the regulation, a user authentication start signal is transmitted to the user authentication unit 14 (step B3). On the other hand, if the parameter does not match the regulation, an error signal is generated and transmitted to the API using device 3 (step B4). Hereinafter, it is assumed that a user authentication start signal has been transmitted to the user authentication unit 14.

  Thereafter, as shown in FIG. 5, the user authentication unit 14 receives a user authentication start signal from the authorization request verification unit 13 (step C1), and sends a user authentication screen and an API usage right transfer consent screen to the end user terminal 1. Is transmitted (step C2). Then, it receives the user authentication information and the response of approval or denial with respect to the consent of the transfer of the API usage right from the end user terminal 1 (step C3), and based on the received response, the user authentication is successful and the transfer of the API usage right is performed. Is determined (step C4). If the user authentication has succeeded and the consent to transfer the API usage right has been approved, an authorization request start signal is transmitted to the API request generation unit 15 (step C5). On the other hand, if the user authentication is not successful, or if the consent of the transfer of the API usage right has not been approved, an error signal is generated and transmitted to the API using device 3 (step C6).

  Hereinafter, it is assumed that an authorization request start signal has been transmitted to the API request generation unit 15. Note that the higher-level API providing apparatus 5 receives all information exchanged with the end-user using terminal 1, the API-using apparatus 3, or the lower-level API providing apparatus 7, such as a result of user authentication and an agreement response to the transfer of the API usage right by the user. Save the data to a memory or hard disk at any time.

  Next, the higher-level API providing device 5 executes the process of step D in FIG. As shown in FIG. 6A, the API request generation unit 15 receives an authorization request start signal from the user authentication unit 14 (step D1), and sends the authorization request to the API wholesaler 7 under the API wholesaler. Transmit (step D2).

  Next, the higher-level API providing device 5 executes the processing of steps E, F, and G in FIG. As shown in FIG. 7A, the API response processing unit 16 receives the screen data of the user authentication screen and the consent screen of the transfer of the API usage right from the API providing apparatus 7 of the API wholesaler (step E1). Then, the screen data is transmitted to the user authentication response unit 17 (step E2).

  Thereafter, as shown in FIG. 8, the user authentication response unit 17 receives the screen data of the user authentication screen and the consent screen of the transfer of the API usage right from the API response processing unit 16 (step F1), and the user authentication information storage unit 23 (Step F2). Then, a message that responds to the user authentication and the consent of the transfer of the API usage right is assembled and transmitted to the API request generation unit 15 (step F3).

  Thereafter, as shown in FIG. 6B, the API request generation unit 15 receives a message responding to the user authentication and the consent of the delegation of the API usage right from the user authentication response unit 17 (step G1), and responds to the user consent response. Is transmitted to the lower API providing device 7 of the API wholesaler (step G2).

  Here, the operations of steps F and G will be described in detail. The user preliminarily simulates consent and consent in response to the consent request for transfer of the API use right from the lower API providing device 7, and has already indicated consent to the transfer of the API use right to the upper API providing device 5. Therefore, the user authentication response unit 17 automatically starts the log-in to the lower API providing device 7 and the user agreement process based on the agreement of the user. Specifically, from the user authentication information storage unit 23 (see FIG. 15), the API wholesaler of the lower API providing device 7 corresponding to the user ID of the target user (the user ID issued by the upper API providing device 5) , And executes a login process and a consent process to the lower API providing device 7 based on the user ID and the password and consent information indicating consent of the user.

  Next, the higher-level API providing device 5 executes the process of Step H in FIG. As shown in FIG. 7B, the API response processing unit 16 receives the authorization response from the API providing device 7 of the API wholesaler (step H1), and converts the authorization code (B) in the authorization response. The request is transmitted to the API request generator 15 (step H2).

  Next, the higher-level API providing device 5 executes the process of step I in FIG. As shown in FIG. 6C, the API request generation unit 15 receives the authorization code (B) from the API response processing unit 16 (Step I1), and sends the token request including the authorization code (B) to the API wholesaler. The data is transmitted to the lower API providing device 7 of the former business entity (step I2).

  Next, the higher-level API providing device 5 executes the processing of steps J, K, and L in FIG. As shown in FIG. 7 (c), the API response processing unit 16 receives a token response from the lower API providing device 7 of the API wholesaler (step J1), and an access token (B) included in the token response. Is stored in the access token storage unit 25 (see FIG. 16) (step J2), and an authorization response start signal is transmitted to the authorization code issuing unit 18 (step J3).

  Thereafter, as shown in FIG. 9, the authorization code issuing unit 18 receives the authorization response start signal from the API response processing unit 16 (step K1), issues the authorization code (A), and issues the authorization code (A). 17 (step K2). Then, the authorization code (A) is transmitted to the API response generator 12 (step K3).

  Thereafter, as shown in FIG. 10A, the API response generation unit 12 receives the authorization code (A) from the authorization code issuing unit 18 (Step L1), and sends the authorization code (A) to the end-user terminal 1. Is transmitted (step L2). This authorization response is redirected to the API using device 3.

  Next, the higher-level API providing device 5 executes the processing of steps M, N, O, and P in FIG. As shown in FIG. 3B, the API request processing unit 11 receives a token request including the authorization code (A) from the API using device 3 (Step M1), and transmits the token request to the token request verification unit 19. (Step M2).

  Thereafter, as shown in FIG. 11, the token request verification unit 19 receives the token request from the API request processing unit 11 (Step N1), and determines whether or not the parameters included in the token request conform to the rules. (Step N2). Then, if the parameter matches the regulation, a token issuing signal is transmitted to the access token issuing unit 20 (step N3). On the other hand, if the parameter does not match the regulation, an error signal is generated and transmitted to the API using device 3 (step N4). Hereinafter, it is assumed that a token issuance signal is transmitted to the access token issuance unit 20.

  Thereafter, as shown in FIG. 12, the access token issuing unit 20 receives the token issuing signal from the token request verifying unit 19 (Step O1), issues the access token (A), and stores it in the access token storage unit 25. (Step O2). Then, the access token (A) is transmitted to the API response generation unit 12 (Step O3).

  Thereafter, as shown in FIG. 10B, the API response generation unit 12 receives the access token (A) from the access token issuing unit 20 (Step P1), and sends the access token (A) to the API using device 3. A token response including the token response is transmitted (step P2).

  Next, the higher-level API providing device 5 executes the processing of steps Q, R, and S in FIG. As shown in FIG. 3C, the API request processing unit 11 receives an API request including the access token (A) from the API using device 3 (Step Q1) and transmits the API request to the access token verification unit 21. (Step Q2).

  Thereafter, as shown in FIG. 13, the access token verification unit 21 receives the API request from the API request processing unit 11 (step R1), and stores the access token (A) included in the API request in the access token storage unit 25. It is determined whether or not the access request matches the access token (step R2), and it is determined whether or not the parameter of the API request matches the regulation (step R3). Then, if the access token matches and the parameter matches the regulation, an API request is transmitted to the access token converter 22 (step R4). On the other hand, if the access tokens do not match, or if the parameters do not match the specifications, an error signal is generated and transmitted to the API using device 3 (step R5). Hereinafter, it is assumed that the API request is transmitted to the access token conversion unit 22.

  Thereafter, as shown in FIG. 14, the access token conversion unit 22 receives the access token API request including the access token (A) from the access token verification unit 21 (step S1), and sends the API wholesale source to the access token storage unit 25. The access token (B) received from the lower API providing device 7 of the business entity is queried and acquired (step S2). Then, the access token (A) in the API request is converted into the access token (B) (step S3), and the converted API request is transmitted to the lower API providing device 7 of the API wholesaler (step S4).

  Finally, the higher-level API providing device 5 executes the process of step T in FIG. As shown in FIG. 10C, the API response generation unit 12 receives an API response from the lower API providing device 7 of the API wholesaler (step T1), and transmits the API response to the API using device 3. (Step T2).

  As described above, according to the present embodiment, the API wholesaler's upper-level API providing apparatus 5 accepts the user's consent from the API wholesaler's lower-level API providing apparatus 7 for an API usage right transfer consent request ( The user does not need to respond to each consent request from a plurality of API providing devices, thereby reducing the burden on the user concerning the consent of delegating the API usage right and providing the API wholesaler to the user and the client. The business can be hidden (see FIG. 18).

  Lastly, the higher-level API providing device 5 described in the present embodiment can be realized by a computer. Further, it is also possible to create an API providing program for causing a computer to function as the higher-level API providing device 5 and a storage medium for the API providing program.

DESCRIPTION OF SYMBOLS 1 ... End user use terminal 3 ... API use device 5 ... Upper API provision device 7 ... Lower API provision device 9 ... Resource server 11 ... API request processing part 12 ... API response generation part 13 ... Authorization request verification part 14 ... User authentication part 15 API request generation unit 16 API response processing unit 17 User authentication response unit 18 Authorization code issuing unit 19 Token request verification unit 20 Access token issuing unit 21 Access token verification unit 22 Access token conversion unit 23 User authentication information storage unit 24: authorization code storage unit 25: access token storage unit

Claims (2)

In an API (Application Programming Interface) providing device,
A storage unit for storing user identification information issued by another API providing device,
A receiving unit that receives an API usage right transfer consent request from the other API providing device to the user;
Based on the agreement information of the user who agrees to transfer the right to use the AP I, reads the identification information of the user according to the another API providing device from the storage unit, the identification information and the agreement information of the user A generation unit that generates message data including
A transmission unit that transmits to the other API providing apparatus said Denbun data as consent response of the user to the consent request,
An API providing device, comprising: In the method of consent of transfer of API usage right performed by an API (Application Programming Interface) providing device,
The API providing device includes:
Storing the user identification information issued by another API providing device in the storage unit;
Receiving a consent request for transfer of API usage right from the other API providing device to the user;
Based on the consent information of the user who has agreed to delegate the right to use the API, the identification information of the user related to the another API providing device is read from the storage unit, and the identification information and the consent information of the user are included. Generating message data;
Transmitting the message data to the other API providing device as the user's consent response to the consent request;
And consent method of delegation of API usage right.

Images