US 10,375,069 B2 · Authorization delegation system, information processing apparatus, authorization server, control method, and storage medium

Abstract

A device transmits an acquisition request for first authorization information indicating that a user's authority to create a tenant-dedicated client is delegated to a vendor client on the basis of first authentication information provided from an authorization server in response to the registration of the vendor client. The device registers the tenant-dedicated client in the authorization server on the basis of the first authorization information, and transmits an acquisition request for second authorization information indicating that the user's authority in a service of a resource server is delegated to the tenant-dedicated client on the basis of second authentication information provided from the authorization server in response to the registration of the tenant-dedicated client. Then the device uses the service of the resource server on the basis of the second authorization information.

An authorization delegation system that comprises an information processing apparatus, a service providing apparatus configured to provide a service via a network, and an authorization server and that registers the information processing apparatus as a client in the authorization server,

wherein the information processing apparatus comprises:
at least one first processer and at least one first memory coupled to the at least one first processor and having stored thereon instructions that, when executed by the at least one first processor, cause the at least one first processor and the at least one first memory to cooperatively act as:
a first acquisition requesting unit configured to transmit an acquisition request for first authorization information indicating that a user's authority to create a second client is delegated to a first client on the basis of first authentication information provided from the authorization server in accordance with a registration of the first client in the authorization server;
and
a registration requesting unit configured to transmit a registration request for the second client to the authorization server in accordance with an acquisition of the first authorization information in response to the acquisition request by the first acquisition requesting unit,
wherein the authorization server comprises:
at least one second processer and at least one second memory coupled to the at least one second processor and having stored thereon instructions that, when executed by the at least one second processor, cause the at least one second processor and the at least one second memory to cooperatively act as:
a managing unit configured to specify a tenant of the user on the basis of the first authorization information transmitted along with the registration request and to manage the specified tenant and the second client to be newly registered in association with each other;
and
an issuing unit configured to issue second authentication information corresponding to the second client which is managed in association with the tenant,
wherein the at least one first processor and the at least one first memory in the information processing apparatus further cooperatively act as:
a second acquisition requesting unit configured to transmit an acquisition request for second authorization information indicating that a specific authority is delegated to the second client on the basis of the second authentication information provided from the authorization server in accordance with a registration of the second client in response to the registration request;
and
a using unit configured to use a service of the service providing apparatus on the basis of the second authorization information acquired in response to the acquisition request by the second acquisition requesting unit, and
wherein the service providing apparatus comprises at least one third processer and at least one third memory coupled to the at least one third processor and having stored thereon instructions that, when executed by the at least one third processor, cause the at least one third processor and the at least one third memory to cooperatively act as:
a storing unit configured to confirm the specified tenant on the basis of the second authorization information and to store data relevant to provision of the service in association with the confirmed tenant.

13 more elements

Facts

Application

15/362,128Filed 28 Nov 2016

Priority

JP 2015-2406139 Dec 2015

Published

US 2017/0171201 A115 Jun 2017

Granted

6 Aug 2019

Term ends

Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 63/0884
For authentication of entities: by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity…
G06F 21/6245
To a system of files or objects, e.g. local or distributed file system or database: protecting personal data, e.g. for financial or medical purposes
H04L 63/062
For supporting key management in a packet data network: for key distribution, e.g. centrally by trusted party
H04L 63/10
Network architectures or network communication protocols for network security: for controlling access to devices or network resources

Authorization delegation system, information processing apparatus, authorization server, control method, and storage medium

Life of this patent

Authorization delegation system, information processing apparatus, authorization server, control method, and storage medium

Life of this patent

Abstract

Claims14