# US 10,375,069 B2 · Authorization delegation system, information processing apparatus, authorization server, control method, and storage medium > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,069 B2 - Document ID: US10375069B2 - Status: Granted - Kind: B2 - Application number: 15/362,128 - Filed: 2016-11-28 - Published: 2017-06-15 - Granted: 2019-08-06 - Earliest claimed: 2015-12-09 - Assignees: Canon Kabushiki Kaisha - Applicants: Canon Kabushiki Kaisha - Inventors: Hayato Matsugashita - Web page: https://patentgrep.com/patent/US10375069B2 ## CPC - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A device transmits an acquisition request for first authorization information indicating that a user's authority to create a tenant-dedicated client is delegated to a vendor client on the basis of first authentication information provided from an authorization server in response to the registration of the vendor client. The device registers the tenant-dedicated client in the authorization server on the basis of the first authorization information, and transmits an acquisition request for second authorization information indicating that the user's authority in a service of a resource server is delegated to the tenant-dedicated client on the basis of second authentication information provided from the authorization server in response to the registration of the tenant-dedicated client. Then the device uses the service of the resource server on the basis of the second authorization information. ## Claims ### Claim 1 An authorization delegation system that comprises an information processing apparatus, a service providing apparatus configured to provide a service via a network, and an authorization server and that registers the information processing apparatus as a client in the authorization server, wherein the information processing apparatus comprises: at least one first processer and at least one first memory coupled to the at least one first processor and having stored thereon instructions that, when executed by the at least one first processor, cause the at least one first processor and the at least one first memory to cooperatively act as: a first acquisition requesting unit configured to transmit an acquisition request for first authorization information indicating that a user's authority to create a second client is delegated to a first client on the basis of first authentication information provided from the authorization server in accordance with a registration of the first client in the authorization server; and a registration requesting unit configured to transmit a registration request for the second client to the authorization server in accordance with an acquisition of the first authorization information in response to the acquisition request by the first acquisition requesting unit, wherein the authorization server comprises: at least one second processer and at least one second memory coupled to the at least one second processor and having stored thereon instructions that, when executed by the at least one second processor, cause the at least one second processor and the at least one second memory to cooperatively act as: a managing unit configured to specify a tenant of the user on the basis of the first authorization information transmitted along with the registration request and to manage the specified tenant and the second client to be newly registered in association with each other; and an issuing unit configured to issue second authentication information corresponding to the second client which is managed in association with the tenant, wherein the at least one first processor and the at least one first memory in the information processing apparatus further cooperatively act as: a second acquisition requesting unit configured to transmit an acquisition request for second authorization information indicating that a specific authority is delegated to the second client on the basis of the second authentication information provided from the authorization server in accordance with a registration of the second client in response to the registration request; and a using unit configured to use a service of the service providing apparatus on the basis of the second authorization information acquired in response to the acquisition request by the second acquisition requesting unit, and wherein the service providing apparatus comprises at least one third processer and at least one third memory coupled to the at least one third processor and having stored thereon instructions that, when executed by the at least one third processor, cause the at least one third processor and the at least one third memory to cooperatively act as: a storing unit configured to confirm the specified tenant on the basis of the second authorization information and to store data relevant to provision of the service in association with the confirmed tenant. ### Claim 2 (depends on 1) The authorization delegation system according to claim 1, wherein the second processer and the second memory of the authorization server further cooperate to act as: a screen transmitting unit configured to transmit authorization confirmation screen data to a terminal which is operated by the user in response to the acquisition request for the first authorization information; a first providing unit configured to provide the first authorization information if the user provides an instruction for permission of delegation of the authority to create the second client to the first client via the authorization confirmation screen displayed in the terminal; a second providing unit configured to provide the second authorization information in response to the acquisition request from the second acquisition requesting unit; and an authorizing unit configured to verify whether or not to authorize the using unit to use the service of the service providing apparatus with the specific authority on the basis of the second authorization information transmitted when the using unit uses the service of the service providing apparatus. ### Claim 3 (depends on 1) The authorization delegation system according to claim 1, wherein registering of the first client in the authorization server is performed in response to the registration request that does not include information of the tenant of the user. ### Claim 4 (depends on 1) The authorization delegation system according to claim 1, wherein the second processer and the second memory of the authorization server cooperate to act as a memory unit configured to store the second authorization information which is associated at least with the second client and the tenant. ### Claim 5 (depends on 1) The authorization delegation system according to claim 1, wherein the using unit determines whether personal information is included in data transmitted to the service providing apparatus when using the service and uses the service of the service providing apparatus on the basis of the second authorization information if the personal information is included in the data. ### Claim 6 (depends on 5) The authorization delegation system according to claim 5, wherein, if the personal information is included in the data, the using unit determines whether the data is data associated with a user of the authorization server and, if the data is not data associated with the user of the authorization server, the using unit uses the service of the service providing apparatus on the basis of the second authorization information. ### Claim 7 (depends on 5) The authorization delegation system according to claim 5, wherein, if the personal information is not included in the data, the using unit uses the service of the service providing apparatus in a first mode in which authorization information associated with the information processing apparatus registered in the authorization server and a tenant and a tenant associated with the information processing apparatus registered in the service providing apparatus are used. ### Claim 8 (depends on 7) The authorization delegation system according to claim 7, wherein the tenant is registered in the service providing server in association with the information processing apparatus by causing the information processing apparatus to transmit a key associated with a tenant ID indicating the tenant along with a device serial ID indicating the information processing apparatus to the service providing apparatus. ### Claim 9 (depends on 6) The authorization delegation system according to claim 6, wherein, if the data is data associated with the user of the authorization server, the using unit uses the service of the service providing apparatus in a second mode in which authorization information associated with the user having delegating authority on the service of the service providing apparatus to the information processing apparatus is used. ### Claim 10 (depends on 9) The authorization delegation system according to claim 9, wherein, if the data is data associated with the user of the authorization server, the using unit determines whether the user is logged in to the information processing apparatus, and wherein, if the user is not logged in to the information processing apparatus, the using unit uses the service of the service providing apparatus in one mode of the second mode in which authorization information which is issued in response to a refresh request of a refresh token stored in association with an application ID in the information processing apparatus by the delegation of the authority. ### Claim 11 (depends on 9) The authorization delegation system according to claim 9, wherein, if the data is data associated with the user of the authorization server, the using unit determines whether the user is logged in to the information processing apparatus, and wherein, if the user is logged in to the information processing apparatus, the using unit uses the service of the service providing apparatus in one mode of the second mode in which authorization information which is issued in response to a refresh request of a refresh token stored in association with a login context in the information processing apparatus by the delegation of the authority. ### Claim 12 (depends on 1) The authorization delegation system according to claim 1, wherein the acquisition request for the first authorization information includes the first authentication information including a client ID indicating the first client and a secret, and wherein the acquisition request for the second authorization information includes the second authentication information including a client ID indicating the second client and a secret. ### Claim 13 A control method for an authorization server that registers an information processing apparatus as a client and performs an authorization process for the information processing apparatus to use a service provided from a service providing apparatus via a network, the control method comprising: registering a first client in response to a registration request for the first client from the information processing apparatus and issuing first authentication information; providing first authorization information to the information processing apparatus in response to an acquisition request for the first authorization information indicating that a user's authority to create a second client is delegated to the information processing apparatus, wherein the acquisition requests for the first authorization information is transmitted from the information processing apparatus in which the first authentication information is provided; specifying a tenant of the user on the basis of the first authorization information transmitted along with a registration request for the second client in response to the registration request transmitted from the information processing apparatus in which the first authorization information is provided and managing the specified tenant in associated with the second client which is newly registered; issuing second authentication information corresponding to the second client which is managed in association with the tenant; and providing second authorization information to the information processing apparatus in response to an acquisition request from the information processing apparatus for the second authorization information indicating that a specific authority is delegated to the information processing apparatus, wherein the acquisition request for the second authorization information is based on the second authentication information provided in response to the registration of the second client, wherein the information processing apparatus uses the service of the service providing apparatus on the basis of the second authorization information. ### Claim 14 A non-transitory storage medium on which is stored a computer program for making a computer execute a method for controlling an authorization server that registers an information processing apparatus as a client and performs an authorization process for the information processing apparatus to use a service provided from a service providing apparatus via a network, the method comprising: registering a first client in response to a registration request for the first client from the information processing apparatus and issuing first authentication information; providing first authorization information to the information processing apparatus in response to an acquisition request for the first authorization information indicating that a user's authority to create a second client is delegated to the information processing apparatus, wherein the acquisition requests for the first authorization information is transmitted from the information processing apparatus in which the first authentication information is provided; specifying a tenant of the user on the basis of the first authorization information transmitted along with a registration request for the second client in response to the registration request transmitted from the information processing apparatus in which the first authorization information is provided and managing the specified tenant in associated with the second client which is newly registered; issuing second authentication information corresponding to the second client which is managed in association with the tenant; and providing second authorization information to the information processing apparatus in response to an acquisition request from the information processing apparatus for the second authorization information indicating that a specific authority is delegated to the information processing apparatus, wherein the acquisition request for the second authorization information is based on the second authentication information provided in response to the registration of the second client, wherein the information processing apparatus uses the service of the service providing apparatus on the basis of the second authorization information.