# US 2016/0366151 A1 · Authentication server system, method, and storage medium > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366151 A1 - Document ID: US20160366151A1 - Status: Published application - Kind: A1 - Application number: 15/175,988 - Filed: 2016-06-07 - Published: 2016-12-15 - Earliest claimed: 2015-06-11 - Assignees: Canon Kabushiki Kaisha - Applicants: Canon Kabushiki Kaisha - Inventors: Yu Tamura - Web page: https://patentgrep.com/patent/US20160366151A1 ## CPC - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An authentication server system issues a first-type token for verification of whether a user operating a terminal is a valid user and a second-type token for verification of whether a service is usable with authority transferred to an authorized client cooperating with the service, verifies, based on a token received with a verification request and a scope regardless of a type of the issued token, and notifies a verification result. ## Claims ### Claim 1 An authentication server system communicable with an information processing apparatus including a service that provides a specific function to a terminal and an authorized client, the authentication server system comprising: an issuance unit configured to issue a first-type token for verification of whether a user operating the terminal is a valid user and a second-type token for verification of whether the service is usable with authority transferred to the authorized client cooperating with the service; and a verification unit configured to perform checking for verification based on a token received with a verification request and a scope from the information processing apparatus regardless of a type of the token issued by the issuance unit and to notify a verification result, wherein, the verification unit does not check authority associated with a token if the first-type token is received, and the verification unit checks authority associated with a token and determines whether the scope is within a range of the authority associated with the token if the second-type token is received. ### Claim 2 (depends on 1) The authentication server system according to claim 1, wherein the scope received by the verification unit from the information processing apparatus includes a scope for use of the service requested by the authorized client to the information processing apparatus. ### Claim 3 (depends on 1) The authentication server system according to claim 1, wherein the scope received by the verification unit from the information processing apparatus includes a scope for a prohibition on use of the service using the second-type token. ### Claim 4 (depends on 1) The authentication server system according to claim 1, wherein, if the second-type token is received, the verification unit checks authority associated with the authorized client based on the token and determines whether the scope is within a range of the authority associated with the authorized client, and wherein, if the scope is determined to be within the range of the authority associated with the token and the scope is determined to be within the range of the authority associated with the authorized client, the verification unit notifies that the service is usable with the authority transferred to the authorized client cooperating with the service, as a verification result. ### Claim 5 (depends on 1) The authentication server system according to claim 1, wherein, if authority associated with the authorized client is determined to be a specific authority, the verification unit notifies that the service is usable with the authority transferred to the authorized client cooperating with the service, as a verification result, even though the scope received from the information processing apparatus includes a scope for a prohibition on use of the service using the second-type token. ### Claim 6 (depends on 1) The authentication server system according to claim 1, wherein the issuance unit issues the first-type token if authentication information input via an authentication screen is determined to be appropriate, and the issuance unit issues the second-type token if transfer of user authority in the service to the authorized client is determined to be authorized via an authorization confirmation screen. ### Claim 7 (depends on 1) The authentication server system according to claim 1, wherein, if the first-type token is received, the verification unit determines whether user information of the user operating the terminal is being registered in the authentication server system. ### Claim 8 A method executed by an authentication server system communicable with an information processing apparatus including a service that provides a specific function to a terminal and an authorized client, the method comprising: issuing a first-type token for verification of whether a user operating the terminal is a valid user and a second-type token for verification of whether the service is usable with authority transferred to the authorized client cooperating with the service; checking for verification based on a token received with a verification request and a scope from the information processing apparatus regardless of a type of the token issued by the issuing; and notifying a verification result, wherein, authority associated with a token is not checked if the first-type token is received, and authority associated with a token is checked and it is determined whether the scope is within a range of the authority associated with the token if the second-type token is received. ### Claim 9 A computer-readable storage medium storing computer executable instructions for causing an authentication server system communicable with an information processing apparatus including a service that provides a specific function to a terminal and an authorized client to execute a method, the method comprising: issuing a first-type token for verification of whether a user operating the terminal is a valid user and a second-type token for verification of whether the service is usable with authority transferred to the authorized client cooperating with the service; checking for verification based on a token received with a verification request and a scope from the information processing apparatus regardless of a type of the token issued by the issuing; and notifying a verification result, wherein, authority associated with a token is not checked if the first-type token is received, and authority associated with a token is checked and it is determined whether the scope is within a range of the authority associated with the token if the second-type token is received. ### Claim 10 (depends on 8) The method according to claim 8, wherein in the checking step, the scope received from the information processing apparatus includes a scope for use of the service requested by the authorized client to the information processing apparatus. ### Claim 11 (depends on 8) The method according to claim 8, wherein in the checking step, the scope received from the information processing apparatus includes a scope for a prohibition on use of the service using the second-type token. ### Claim 12 (depends on 8) The method according to claim 8, wherein in the checking step, if the second-type token is received, the checking checks authority associated with the authorized client based on the token and determines whether the scope is within a range of the authority associated with the authorized client, and wherein, if the scope is determined to be within the range of the authority associated with the token and the scope is determined to be within the range of the authority associated with the authorized client, the checking notifies that the service is usable with the authority transferred to the authorized client cooperating with the service, as a verification result. ### Claim 13 (depends on 8) The method according to claim 8, wherein in the checking step, if authority associated with the authorized client is determined to be a specific authority, the checking notifies that the service is usable with the authority transferred to the authorized client cooperating with the service, as a verification result, even though the scope received from the information processing apparatus includes a scope for a prohibition on use of the service using the second-type token. ### Claim 14 (depends on 8) The method according to claim 8, wherein in the checking step, the issuing issues the first-type token if authentication information input via an authentication screen is determined to be appropriate, and the issuing issues the second-type token if transfer of user authority in the service to the authorized client is determined to be authorized via an authorization confirmation screen.