JP7243144B2 - Terminal device, authentication support device and program - Google Patents

Description

The present invention relates to a terminal device, an authentication support device, and a program.

Patent Document 1 discloses single sign-on for an application program executed on an image forming apparatus. Note that single sign-on is a mechanism that enables connection to a plurality of servers by inputting authentication information once.

JP 2018-112811

SUMMARY OF THE INVENTION It is an object of the present invention to provide a terminal device, an authentication support device, and a program that can reduce the number of times a user performs operations compared to the case of entering authentication information multiple times.

The present invention according to claim 1 comprises: a first request receiving means for receiving a request to connect to a first server; and a request for using a second server connected to the first server via a network for connection control. second request receiving means for receiving; storage means for storing transmission information corresponding to the user, including at least organization information specifying an organization to which the user belongs; When a request to connect to a server is received and a request to use the second server for connection control is received by the second request receiving means, transmission information including organization information stored in the storage means is transmitted. and control means for controlling transmission to the second server.

The present invention according to claim 2 further comprises authentication means for authenticating a user, and said control means sends transmission information including organization information corresponding to the user authenticated by said authentication means to said second 2. The terminal device according to claim 1, which controls transmission to a server. The authentication means here performs authentication for using the terminal device, and is, for example, a reading device for reading an IC card.

The present invention according to claim 3 is the terminal device according to claim 1 or 2, further comprising authentication information receiving means for receiving authentication information to be sent to a third server cooperating with the second server.
is.

According to a fourth aspect of the present invention, a first request receiving means for receiving a request to connect to a first server and a request for using a second server connected to the first server via a network for connection control second request receiving means for receiving; storage means for storing transmission information corresponding to the user, including at least organization information specifying an organization to which the user belongs; When a request to connect to a server is received and a request to use the second server for connection control is received by the second request receiving means, transmission information including organization information stored in the storage means is transmitted. and control means for controlling transmission to the second server.

According to a fifth aspect of the present invention, there are provided: a first request receiving step of receiving a request to connect to a first server; and a request to use a second server connected to the first server via a network for connection control. a second request receiving step for receiving; a storing step for storing transmission information corresponding to the user, including at least organization information specifying an organization to which the user belongs; When a request to connect to a server is received and a request to use the second server for connection control is received by the second request receiving step, the transmission information including the organization information stored by the storing step is received. and a control step of controlling transmission to the second server.

According to the first, fourth, or fifth aspect of the present invention, the number of operations performed by the user can be reduced compared to the case where the authentication information is input a plurality of times.

According to the second aspect of the present invention, in addition to the effect of the first aspect of the invention, it is possible to send information for transmission to the server by authenticating the user.

According to the third aspect of the present invention, it is possible to connect to the first server by inputting authentication information.

FIG. 2 is a schematic diagram showing information flow in an authentication system having a terminal device according to an embodiment of the present invention; It is a chart showing the memory content memorized by the storage part of the terminal device concerning the embodiment of the present invention. It is a block diagram which shows the hardware constitutions of the terminal device which concerns on embodiment of this invention. It is a block diagram showing the software configuration of the terminal device according to the embodiment of the present invention. FIG. 4 is a schematic diagram illustrating a method of writing information to a terminal device according to an embodiment of the present invention; 1 is a sequence diagram showing an authentication system having terminal devices according to an embodiment of the present invention; FIG. FIG. 10 is a screen diagram when an application program is selected in the terminal device according to the embodiment of the present invention; FIG. 10 is a screen diagram for logging in in the terminal device according to the embodiment of the present invention.

Next, embodiments of the present invention will be described in detail with reference to the drawings.
FIG. 1 shows an overall authentication system 10 having an image forming apparatus 12, which is a terminal device according to an embodiment of the present invention.

The authentication system 10 can connect the image forming apparatus 12, the first server 14, the second server 16 and the third server 18 via, for example, a local network or the Internet.
Here, "connection" refers not only to physical connection but also to enabling transmission and reception of data.

A user of the image forming apparatus 12 attempts to use an application program authenticated by the first server 14 . A user is first authenticated to use the image forming device 12 . This authentication is performed, for example, by reading an IC card possessed by the user with an IC card reader provided in the image forming apparatus 12 . Actual authentication may be performed by an authentication server connected to the image forming device 12 .

When the image forming apparatus 12 authenticates the user, the user selects an application program that needs to be authenticated by the first server 14 . The user then chooses to be authenticated using the second server 16 rather than being authenticated directly by the first server 14 . The second server 16 is used because it is more familiar with authentication with the second server 14 than with authentication with the first server 14 . The image forming device 12 has an authentication support device for being authenticated by the second server 14 .

When the second server 16 is selected, in step S1, transmission information including domain information, which is information specifying an organization (domain) registered in advance in the image forming apparatus 12, is transmitted to the second server 16. be done. The second server 16 is for example Azure AD. Azure AD is a general term for a group of components provided by Microsoft Corporation for managing users and computer resources on the cloud (AD stands for active directory). When the domain information of the user's organization is input, the second server 16 transfers authentication processing to the second server 16, which will be described later. In the image forming apparatus 12, as shown in FIG. 2, the storage unit 50 of the image forming apparatus 12 stores a mail address including a domain name to which the user belongs and information for transmission which is domain information. Email addresses contain domain information below the at sign.

Upon receiving the domain information from the image forming apparatus 12, the second server 16 sends login screen information to the image forming apparatus 12 in step S2. Authentication information is input to the image forming apparatus 12 from the login screen. The authentication information is login information for the third server 18, such as a user ID and password. When the authentication information for the third server 18 is input to the image forming apparatus 12 , this authentication information is sent to the third server 18 . The third server 18 is, for example, an AD within an organization, including, for example, ADFS (Active Directory Federation Service). ADFS manages connections to external servers in cooperation with AD.

The third server 18 receives the authentication information from the image forming apparatus 12, generates a token, and sends the token for the second server to the second server 16 in step S4. Here, a token is an electronic ticket for connection.

When the second server 16 receives the token from the third server 18, it generates an assertion (the token containing the authenticated user, the user's attributes and attribute values, the expiration information digital signature, and the authentication session), and step This generated assertion is sent to the first server 14 at S5. Note that the session is information indicating that the connection is permitted.

Upon receiving the assertion from the second server 16, the first server 14 verifies the assertion and, in step S6, sends an authentication session to the image forming device 12 to complete the login to the first server 14. FIG.

FIG. 3 is a block diagram showing the hardware of the image forming apparatus 12. As shown in FIG.
The image forming apparatus 12 has a main control section 20. The main control section 20 has a CPU 22, a memory 24, a storage device 26, a communication interface 28, an equipment control section interface 30, and a display operation device interface 32. A CPU 22 , a memory 24 , a storage device 26 , a communication interface 28 , an equipment control section interface 30 and a display operation device interface 32 are connected via a bus 34 .

The CPU 22 executes predetermined processing based on control programs stored in the memory 24 . The storage device 26 is composed of, for example, a hard disk, and stores required software and data. The communication interface 28 is connected to a network 36 and inputs/outputs data via the network 36 .

A device control unit 38 is connected to the device control unit interface 30 . The device control section 38 is connected to the authentication device 40 and the image forming section 42 described above, and controls the authentication device 40 and the image forming section 42 . A display operation device 44 is connected to the display operation device interface 32 .

FIG. 4 is a block diagram showing software executed by the CPU 22. As shown in FIG.
The first request accepting unit 46 accepts a request to connect to the first server 14 described above. A request to connect to the first server 14 is made, for example, by selecting application software that requires authentication by the first server 14 .

A second request receiving unit 48 receives a request to use the second server 16 for connection control.

As shown in FIG. 2, the storage unit 50 stores transmission information corresponding to the user, including at least organization information to which the user belongs. Specifically, it is stored in the storage device 26 described above.

The control unit 52 has a transmission control unit 54 and a display control unit 56 . The communication control unit 54 receives a connection request to the first server 14 by the first request reception unit 46, and receives a request to use the second server 16 for connection control by the second request reception unit 48. In this case, the information for transmission including the organization information corresponding to the user stored in the storage unit 50 is controlled to be sent to the second server 16 . Further, the display operation control unit 56 controls display on the display operation device 44 described above, and receives operation information from the display operation device 44 .

FIG. 5 shows a method for storing the transmission information shown in FIG.
For example, the administrator uses the personal computer 58 to input transmission information corresponding to the user for each image forming apparatus 12 individually. The list shown in FIG. 2 is stored in advance in the personal computer 58 , and the stored list may be transferred to each image forming apparatus 12 .

FIG. 6 is a sequence diagram showing transmission and reception of data in the authentication system 10. As shown in FIG.

Here, it is assumed that the image forming apparatus 12 already stores the transmission information list shown in FIG. It is also assumed that the user has already been authenticated to use the image forming apparatus 12 .

On the screen of the image forming apparatus 12, as shown in FIG. 7, an icon 60 of an application program requiring authentication of the first server 14 is displayed. When the user selects one of the application programs in step S100, information on the selection of the application program is transferred to the first server 14 via the image forming apparatus 12 in step S102. When the first server 14 receives the information for selecting the application program, the screen for logging in to the first server 14 is returned to the image forming apparatus 12 in step S102.

The image forming apparatus 12 displays the login screen returned from the first server 14 . That is, as shown in FIG. 7, a user ID input section 62 and a password input section 64 for logging into the first server 14 and a button 66 for selecting login with another account are displayed.

When the user selects the button 66 in step S103, the image forming apparatus 12 extracts domain information from the transmission information shown in FIG. 2, and sends this domain information to the second server 14 in step S104. When the second server 14 accepts the domain information, it starts requesting authentication and approval, and in step S105, sends the login screen of the second server 16 to the image forming apparatus 12. In the image forming apparatus 12, The domain information is automatically entered into the login screen of the second server 16 without displaying the login screen, and the domain information is sent to the second server 16 in step S106.

When receiving the domain ID from the image forming apparatus 12, the second server 16 returns information indicating that the domain information has been received to the image forming apparatus 12 in step S107. The image forming apparatus 12 transfers the data to the third server 18 cooperating with the second server 16 in the next step S108. The third server 18 sends a screen for receiving authentication by the third server 18 to the image forming apparatus 12 .

The image forming apparatus 12 displays a user ID input section 68 and a password input section 70 for receiving authentication by the third server 18, as shown in FIG. Upon receiving this display, the user enters a user ID and password for authentication by the third server 18 in step S109. When the user ID and password for authentication by the third server 18 are entered, the image forming apparatus 12 sends the user ID and password to the third server 18 in step S110.

When the third server 18 receives the user ID and password from the image forming apparatus 12, it verifies whether or not it can be authenticated, and if it can be authenticated, issues a token for authentication by the second server 16. Then, this token is sent to the image forming apparatus 12 in step S111. The image forming apparatus 12 that has received this token transfers the token to the second server 16 in step S112.

When the second server 16 receives the token from the image forming device 12, it generates an assertion, and in step S113, the image forming device including the acquired authentication session and the transfer destination information specified in step S104. Send to 12. The image forming apparatus 12 transfers these information to the first server 14 in step S114.

The first server 14 verifies whether or not it can be authenticated from the assertion generated by the second server 16, and if it can be authenticated, issues a session linked to the assertion, and in step S115, the session is transmitted to the image forming apparatus 14. to complete the login.

In the above embodiment, in step S109, the user inputs the user ID and password for obtaining the authentication of the third server 18, but the domain information is included in the transmission information transmitted in step S104. In addition, if user information is included, the input of the user ID can be omitted. On the screen of the image forming apparatus 12, the user ID may be input in the user ID input section 62 assuming that it has already been input, or the user input section 62 is not displayed and only the password input section 64 is displayed. You may do so.

REFERENCE SIGNS LIST 10 authentication system 12 image forming apparatus 14 first server 16 second server 18 third server 20 main controller 22 CPU
24 memory 26 storage device 28 communication interface 30 device control unit 32 display operation control device interface 34 bus 36 network 38 device control unit 40 authentication device 42 image forming unit 44 display operation device 46 first request reception unit 48 second request reception Section 50 Storage Section 52 Control Section 54 Communication Control Section 56 Display Operation Control Section 58 Personal Computer 60 Icon 62 User ID Input Section 64 Password Input Section 66 Button 68 User ID Input Section 70 Password Input Section

Claims (3)

a first request receiving means for receiving a request to connect to the first server;
a second request receiving means for receiving a request to use a second server connected to the first server via a network for connection control;
storage means for storing transmission information corresponding to a user, including at least organization information specifying an organization to which the user belongs and user information specifying the user;
on the screen for accepting input of information for connecting to the first server, which is displayed after the request for connection to the first server is accepted by the first request accepting means, by the second request accepting means when receiving a request to use the second server for connection control, sending information for transmission including organization information and user information stored in the storage means to the second server; Control means for controlling transfer of the response to a third server cooperating with the second server in response to the response ;
An authentication screen transmitted from the third server in response to forwarding the response to the third server, wherein at least part of the information requested to be input is already based on the user information display means for displaying an entered authentication screen;
authentication information receiving means for receiving input of authentication information input via the authentication screen displayed on the display means;
terminal device. a first request receiving means for receiving a request to connect to the first server;
a second request receiving means for receiving a request to use a second server connected to the first server via a network for connection control;
storage means for storing transmission information corresponding to a user, including at least organization information specifying an organization to which the user belongs and user information specifying the user;
on the screen for accepting input of information for connecting to the first server, which is displayed after the request for connection to the first server is accepted by the first request accepting means, by the second request accepting means when receiving a request to use the second server for connection control, sending information for transmission including organization information and user information stored in the storage means to the second server; Control means for controlling transfer of the response to a third server cooperating with the second server in response to the response ;
An authentication screen transmitted from the third server in response to forwarding the response to the third server, wherein at least part of the information requested to be input is already based on the user information display means for displaying an entered authentication screen;
authentication information receiving means for receiving input of authentication information input via the authentication screen displayed on the display means;
An authentication support device having a first request receiving step of receiving a request to connect to the first server;
a second request receiving step of receiving a request to use a second server connected to the first server via a network for connection control;
a storage step of storing transmission information corresponding to a user, including at least organization information specifying the organization to which the user belongs and user information specifying the user;
connection control of the second server by the second request receiving step on the screen for receiving input of information for connecting to the first server displayed after receiving the request to connect to the first server; when receiving a request to use the information for transmission, the information for transmission including the organization information and the user information stored in the storing step is sent to the second server, and in response to a response from the second server a control step of controlling to transfer the response to a third server cooperating with the second server;
An authentication screen transmitted from the third server in response to forwarding the response to the third server, wherein at least part of the information requested to be input is already based on the user information a display step of displaying an entered authentication screen;
an authentication information receiving step of receiving input of authentication information input via the authentication screen displayed in the display step;
A program that causes a computer to run

Images