# US 12,764,113 B2 · Federated authentication server, federated authentication method, federated authentication system, and storage medium > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,764,113 B2 - Document ID: US12764113B2 - Status: Granted - Kind: B2 - Application number: 17/579,116 - Filed: 2022-01-19 - Published: 2022-08-04 - Granted: 2026-10-13 - Earliest claimed: 2021-01-29 - Assignees: Canon Kabushiki Kaisha - Applicants: Canon Kabushiki Kaisha - Inventors: Hideo Kuboyama - Web page: https://patentgrep.com/patent/US12764113B2 ## CPC - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 63/102: {Entity profiles} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A federated authentication server provides, in cooperation with an authentication server, a function of authenticating a user terminal to a resource server configured to provide a service to the user terminal, and includes an authentication information transmission unit configured to transmit authentication information about a user of the user terminal to the authentication server, a token reception unit configured to receive, from the authentication server, a token for use in accessing the resource server from the user terminal, a code issue unit configured to issue a code for identifying an authentication success response and transmit the code to the resource server, a storage unit configured to store the code and the token in association with each other, and a token transmission unit configured to transmit the token associated with the code to the resource server in a case where the code is transmitted from the resource server. ## Claims ### Claim 1 A federated authentication server configured to provide, in cooperation with an authentication server, a function of authenticating a user terminal to a resource server configured to provide a service to the user terminal, the federated authentication server comprising: one or more processors; and one or more memories including instructions that, when executed by the one or more processors, causes the federated authentication server to: transmit authentication information about a user of the user terminal to the authentication server; receive, from the authentication server, a token which is used for accessing the resource server from the user terminal; issue a code which is used for identifying an authentication success response after the token is received from the authentication server, wherein the code is generated by the federated authentication server; store the code and the token in association with each other before a token request including the code is transmitted from the resource server; and transmit the token associated with the code to the resource server in a case where the token request is transmitted from the resource server, wherein the token request indicates that the resource server requests the federated authentication server to transmit the token associated with the code. ### Claim 2 (depends on 1) The federated authentication server according to claim 1, wherein the one or more memories further causes the federated authentication server to: provide the user terminal with an authentication screen via which the authentication information is input to the user terminal. ### Claim 3 (depends on 2) The federated authentication server according to claim 2, wherein the one or more memories further causes the federated authentication server to: receive an authentication request from the resource server, provide the authentication screen based on the receiving of the authentication request, and transmit the code to the resource server as a response to the receiving of the authentication request. ### Claim 4 (depends on 1) The federated authentication server according to claim 1, wherein the federated authentication server transmits the code and the token on a basis of OpenID Connect. ### Claim 5 (depends on 1) The federated authentication server according to claim 1, wherein the token includes an identification (ID) token or a refresh token. ### Claim 6 (depends on 1) The federated authentication server according to claim 1, wherein the one or more memories further causes the federated authentication server to transmit a request for updating the token associated with the code to the authentication server and receive an updated token from the authentication server, and transmit the updated token to the resource server. ### Claim 7 A federated authentication method for providing, in cooperation with an authentication server, a function of authenticating a user terminal to a resource server configured to provide a service to the user terminal, the federated authentication method comprising: transmitting authentication information about a user of the user terminal to the authentication server; receiving, from the authentication server, a token which is used for accessing the resource server from the user terminal; issuing a code which is used for identifying an authentication success response after the token is received from the authentication server, wherein the code is generated by the federated authentication server; storing the code and the token in association with each other before a token request including the code is transmitted from the resource server; and transmitting the token associated with the code to the resource server in a case where the token request is transmitted from the resource server, wherein the token request indicates that the resource server requests the federated authentication server to transmit the token associated with the code. ### Claim 8 A non-transitory computer-readable storage medium storing a program for causing a federated authentication server to execute a federated authentication method for providing, in cooperation with an authentication server, a function of authenticating a user terminal to a resource server configured to provide a service to the user terminal, the federated authentication method comprising: transmitting authentication information about a user of the user terminal to the authentication server; receiving, from the authentication server, a token which is used for accessing the resource server from the user terminal; issuing a code which is used for identifying an authentication success response after the token is received from the authentication server, wherein the code is generated by the federated authentication server; storing the code and the token in association with each other before a token request including the code is transmitted from the resource server; and transmitting the token associated with the code to the resource server in a case where the token request is transmitted from the resource server, wherein the token request indicates that the resource server requests the federated authentication server to transmit the token associated with the code. ### Claim 9 A federated authentication system comprising: an authentication server; and a federated authentication server configured to provide, in cooperation with the authentication server, a function of authenticating a user terminal to a resource server configured to provide a service to the user terminal, wherein the federated authentication server includes: one or more processors; and one or more memories including instructions that, when executed by the one or more processors, causes the federated authentication server to: transmit authentication information about a user of the user terminal to the authentication server; receive, from the authentication server, a token which is used for accessing the resource server from the user terminal; issue a code which is used for identifying an authentication success response after the token is received from the authentication server, wherein the code is generated by the federated authentication server; store the code and the token in association with each other before a token request including the code is transmitted from the resource server; and transmit the token associated with the code to the resource server in a case where the token request is transmitted from the resource server, wherein the token request indicates that the resource server requests the federated authentication server to transmit the token associated with the code.