# US 9,521,144 B2 · Authority delegate system, authorization server system, control method, and program > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,521,144 B2 - Document ID: US9521144B2 - Status: Granted - Kind: B2 - Application number: 14/308,502 - Filed: 2014-06-18 - Published: 2014-12-25 - Granted: 2016-12-13 - Earliest claimed: 2013-06-21 - Assignees: Canon Kabushiki Kaisha - Applicants: Canon Kabushiki Kaisha - Inventors: Hayato Matsugashita - Web page: https://patentgrep.com/patent/US9521144B2 ## CPC - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An authority delegate system, including a server system which provides a service to a device having an application, and an authorization server system which performs authorization processing to delegate user authority in the service to a usage source of the service, includes a management unit, and a providing unit. The management unit identifies authority of the application, in accordance with having received a request to register the application as the usage source, and manages the identified authority, and an identifier of the application, in an associated manner. The providing unit provides the service, in a case where an authorization operation has been performed to permit delegating of the user authority to the application transmitting a request to use the service, and an authority which the application uses is included in authorities associated with the identifier of the application. ## Claims ### Claim 1 An authority delegate system, including a provider server system which provides a service to a device having an application, and an authorization server system which performs authorization processing to delegate user authority in the service to a usage source of the service, the authority delegate system comprising: at least one processor coupled to a memory; a management unit of the authorization server system configured to receive a request from the device to register the application as the usage source of the service, to identify authority of the application in accordance with the received request, and to manage, in an associated manner, an identifier of the application and the identified authority; and a providing unit of the provider server system configured to provide the service in a case where (i) an authorization operation has been performed to permit delegating the user authority to the application that will be transmitting a request to use the service, and (ii) the management unit issues an authorization code to the application in response to permitting delegating the user authority to the application, and (iii) the issued authorization code is received by the providing unit from the application, wherein a scope identification (ID) is acquired based on the authorization code, and (iv) a range authorization ID, identified by the acquired scope ID, is included in range authorization IDs set in the application, wherein the management unit and the providing unit are implemented by the at least one processor. ### Claim 2 (depends on 1) The authority delegate system according to claim 1, wherein the management unit receives authentication information of the application along with the request to register the application as the usage source, and identifies the authority of the application based on the received authentication information. ### Claim 3 (depends on 1) The authority delegate system according to claim 1, wherein an authentication screen is provided to input authentication information of the user, and the authority of the user is identified based on the authentication information input by way of the authentication screen, and wherein the providing unit provides the service in a further case where the authority which the application uses is included within the identified authority of the user. ### Claim 4 (depends on 3) The authority delegate system according to claim 3, wherein, in a case where the authorization operation to permit delegating the user authority to the application transmitting a request to use the service has not been performed, an error response is transmitted, wherein, in a case where an authority which the application uses is not included in authorities associated with the identifier of the application, an error response is transmitted, or wherein, in a case where the authority which the application uses is not included within the identified authority of the user, an error response is transmitted. ### Claim 5 (depends on 1) The authority delegate system according to claim 1, wherein the management unit receives information of the authority which the application uses and authentication information of the application along with the request to register the application as the usage source, wherein, in a case where the authority that the application uses is included within the authority of the application identified based on the authentication information of the application, the management unit manages the identified authority and the identifier of the application in an associated manner, and wherein, in a case where the authority that the application uses is not included within the authority of the application identified based on the authentication information of the application, the management unit does not register the application but instead transmits an error response. ### Claim 6 (depends on 1) The authority delegate system according to claim 1, wherein the identified authority of the application differs depending on a certificate that the application transmits. ### Claim 7 (depends on 1) The authority delegate system according to claim 1, wherein, in response to a user installing and then starting the application in the device, the management unit receives the request from the device to register the application as the usage source of the service. ### Claim 8 (depends on 1) The authority delegate system according to claim 1, wherein, authority associated with the authentication information which the application transmits, is granted by the management unit of the authorization server system to the application module. ### Claim 9 (depends on 8) The authority delegate system according to claim 8, wherein the management unit obtains a tenant master distinguished name (DN) based on the authentication information and uses the tenant master DN to obtain a tenant identification (ID), wherein the management unit uses the tenant ID to obtain the authority associated with the authentication information. ### Claim 10 (depends on 1) The authority delegate system according to claim 1, wherein the device is at least one of a smartphone, a portable terminal, and an image formation apparatus. ### Claim 11 (depends on 1) The authority delegate system according to claim 1, wherein the authorization server system is configured to be in communication with a database server and the authorization server, the provider server system, and database server are configured on the same server. ### Claim 12 A control method to control an authority delegate system, including a provider server system which provides a service to a device having an application, and an authorization server system which performs authorization processing to delegate user authority in the service to a usage source of the service, the control method comprising: in a management unit of the authorization server system, receiving a request from the device to register the application as the usage source of the service, identifying authority of the application in accordance with the received request, and managing, in an associated manner, an identifier of the application and the identified authority; and providing, via a providing unit of the provider server system, the service in a case where (i) an authorization operation has been performed to permit delegating the user authority to the application that will be transmitting a request to use the service, and (ii) the management unit issues an authorization code to the application in response to permitting delegating the user authority to the application, and (iii) the issued authorization code is received by the providing unit from the application, wherein a scope identification (ID) is acquired based on the authorization code, and (iv) a range authorization ID, identified by the acquired scope ID, is included in range authorization IDs set in the application. ### Claim 13 A non-transitory computer-readable storage medium storing a program to cause an authority delegate system to perform a control method, wherein the authority delegate system includes a provider server system which provides a service to a device having an application, and an authorization server system which performs authorization processing to delegate user authority in the service to a usage source of the service, the control method comprising: in a management unit of the authorization server system, receiving a request from the device to register the application as the usage source of the service, identifying authority of the application in accordance with the received request, and managing, in an associated manner, an identifier of the application and the identified authority; and providing, via a providing unit of the provider server system, the service in a case where (i) an authorization operation has been performed to permit delegating the user authority to the application that will be transmitting a request to use the service, and (ii) the management unit issues an authorization code to the application in response to permitting delegating the user authority to the application, and (iii) the issued authorization code is received by the providing unit from the application, wherein a scope identification (ID) is acquired based on the authorization code, and (iv) a range authorization ID, identified by the acquired scope ID, is included in range authorization IDs set in the application.