SERVICE USAGE APPARATUS, METHOD THEREFOR, AND NON-TRANSITORY COMPUTER-READABLE STORAGE MEDIUM

A service usage apparatus transmits, to an external authentication device, a request for generation of a key pair to be used for authentication required to use a service which is provided via a network, and stores public key information received from the external authentication device. Then, in response to a request for key generation received from the network, the service usage apparatus transmits the stored public key information to the service providing system without performing further communication with the external authentication device.

BACKGROUND

Field of the Disclosure

Aspects of the present disclosure generally relate to a technique concerning an authentication system using, for example, biometric authentication.

Description of the Related Art

Heretofore, as an authentication system alternative to password authentication, authentication processing using biological information, such as fingerprints, has started to be used.

Recently, Fast Identity Online (FIDO) has appeared, which is a technique serving as an example of a new authentication method and is an alternative to password authentication, which has been heretofore used as an authentication method for a web service. FIDO is an authentication protocol that is based on biometric authentication. In this authentication method, since authentication processing is performed without biological information being transmitted to the outside via a network, it is possible to prevent leakage of biological information about users. Furthermore, in addition to FIDO, as a new authentication method, there is a contrivance which pre-registers, for example, a public key, user information, and terminal information with a server and performs authentication using a challenge and response method.

Japanese Patent Application Laid-Open No. 2018-6896 discusses a technique concerning registration of a public key and a terminal with a server in an authentication system using FIDO.

In the case of using the above-mentioned new authentication method, the user is required to preliminarily register a public key with an authentication system located on a network drive.

With regard to registration of a public key, at the timing of reception of a predetermined request from the authentication system, in association with registration of biological information performed by the user on a terminal for use in authentication, a pair including a public key and a private key is generated by the terminal. Then, data including the generated public key is transmitted from the terminal to the authentication system, so that registration processing for the public key is performed by the authentication system. In the technique discussed in Japanese Patent Application Laid-Open No. 2018-6896, similarly, when the user registers a new terminal for use in authentication with a server, a pair including a public key and a private key is also generated in association with registration of biological information at the time of reception of a predetermined request from the authentication system.

On the other hand, when the user uses the above-mentioned new authentication method, respective different apparatuses may be employed as a mobile apparatus, such as a tablet, which the user uses to access a web service and a terminal which the user uses for authentication (an external authentication device). In the case of using the external authentication device, the user becomes able to use, for example, biometric authentication which does not depend on, for example, the specifications of the mobile apparatus.

On the other hand, in the above-mentioned registration processing, a communication between the mobile apparatus and the external authentication device often needs to be established at the timing of reception of a predetermined request for the registration processing from the authentication system. Accordingly, in a case where the external authentication device is not located near the user when the user wants to cause the mobile apparatus to access a web service, the user may not be able to start the above-mentioned registration processing.

SUMMARY

According to an aspect of the present disclosure, a service usage apparatus includes at least one memory storing instructions, and at least one processor that executes the instructions to cause the service usage apparatus to, in a case where an external authentication device is connected to the service usage apparatus, transmit, to the external authentication device, a request for generation of a key pair to be used for authentication, receive, from the external authentication device, identification information and public key information which correspond to the key pair which is generated in response to the request in a case where authentication processing performed by the external authentication device is successful, store the received identification information and the received public key information, and in response to a request for information required for authentication from a service providing system, which provides a service via the network, transmit the stored public key information to the service providing system without performing communication with the external authentication device.

DESCRIPTION OF THE EMBODIMENTS

Various exemplary embodiments, features, and aspects of the disclosure will be described in detail below with reference to the drawings.

FIG. 1is a diagram illustrating an example of a system configuration of an exemplary embodiment of the present disclosure. The present system includes a mobile apparatus101, a service providing system102, an authentication management system103, an external authentication device104, a peripheral device105, and a network106. The service providing system102and the authentication management system103can be implemented by a single integrated system.

The mobile apparatus101, the service providing system102, the authentication management system103, and the peripheral device105are connected to the network106, and are able to communicate with each other. The network106is what is called a communication network, which is any one of, for example, a local area network (LAN), a wide area network (WAN) such as the Internet, a telephone line, a dedicated digital line, an automated teller machine (ATM) line, a frame relay line, a cable television line, and a data broadcasting wireless circuit line or is implemented by a combination of some of these lines.

The mobile apparatus101and the external authentication device104or the peripheral device105and the external authentication device104have a configuration capable of communicating with each other as needed by the user via, for example, short-range wireless communication typified by Bluetooth® or Near Field Communication (NFC) or Universal Serial Bus (USB) connection.

The mobile apparatus101, such as a smartphone, is merely an example in the present exemplary embodiment and can be any form of a service usage apparatus as long as it is an apparatus which is used by a user who is to be authenticated in the present system, to which an external authentication device is able to be connected, and with which a service provided by the service providing system102is able to be used via a network. Specifically, the mobile apparatus101is, for example, a tablet apparatus, a notebook personal computer (PC), an ATM, a digital home electrical appliance, or an automobile. The external authentication device104is also an apparatus which is used by a user who is to be authenticated in the present system, and is, for example, a wearable terminal of the wristwatch type or eyeglass type. The external authentication device104includes a sensor which detects biological information, such as fingerprint information, iris information, or heart rate information, specific to the user. The peripheral device105is an apparatus capable of performing processing in cooperation with the service providing system102, and is, for example, a data output apparatus such as a printing apparatus.

In the exemplary embodiment described below, a cloud print service for printing content such as a document or image is taken as an example of a service which the service providing system102provides. Furthermore, the service providing system102is similarly able to provide other various services. For example, such other various services include a storage service for uploading data and then storing the data, a conversion service for converting uploaded data into a desired output format, a service for generating and editing content, and a data delivery service for delivering content for playback of music or moving images.

The authentication management system103is a system provided to manage registration information such as public keys.

FIGS. 2A, 2B, 2C, and 2Dare diagrams illustrating examples of hardware configurations of the respective apparatuses or devices in the present exemplary embodiment.

FIG. 2Aillustrates an example of a hardware configuration of the mobile apparatus101. A central processing unit (CPU)201executes programs, such as programs stored in a read-only memory (ROM)203and an operating system (OS) and applications loaded from a storage device204onto a random access memory (RAM)202. Thus, the CPU201executes the programs stored in a readable storage medium, thus functioning as processing units for performing respective processing operations illustrated in sequence diagrams described below. The RAM202is a main memory for the CPU201, and functions as, for example, a work area. A touch panel206is an input device of the mobile apparatus101, and the CPU201detects an operation performed on the touch panel206to control the programs. Furthermore, the input device of the mobile apparatus101is not limited to a touch panel. A display207is one of the output devices of the mobile apparatus101, and the CPU201displays, for example, a result of each type of operation on the display207, thus notifying the user of such a result. A network interface (I/F)205is connected to the network106, and performs intercommunication with an apparatus or device connected to the network106. A short-range communication I/F208is an interface (I/F) which performs inputting and outputting for short-range communication such as Bluetooth® or NFC, and performs intercommunication with an apparatus or device connected thereto. The respective constituent elements of the mobile apparatus101are connected to an internal bus210, thus being able to perform intercommunication with each other. The short-range communication I/F208can be equipped with an I/F for USB (not illustrated). Moreover, the short-range communication I/F208can also be equipped with a storage unit having an anti-tamper property such as a tamper proof module (TPM).

FIG. 2Billustrates an example of an information processing apparatus which configures each of the service providing system102and the authentication management system103.

A CPU221executes programs, such as an operating system (OS) and applications loaded from a hard disk223onto a RAM222. The CPU221executes the program stored in a readable storage medium, thus functioning as processing units for performing respective processing operations illustrated in sequence diagrams described below. The RAM222is a main memory for the CPU221, and functions as, for example, a work area. An input controller224controls operation inputs entered from a keyboard225and a pointing device (not illustrated), such as a mouse, a tach pad, or a trackball. A video controller227controls display outputs provided by, for example, a display228. A network I/F226is connected to the network106, and performs control processing for communication with an apparatus or device connected to the network106.

Moreover, each of the service providing system102and the authentication management system103can be configured with a plurality of information processing apparatuses or can be provided by a virtual machine which is implemented on an information processing apparatus.

FIG. 2Cillustrates an example of a hardware configuration of the external authentication device104. A CPU241executes programs, such as an operating system (OS) and applications stored in a ROM243. Thus, the CPU241executes the programs stored in a readable storage medium, thus functioning as processing units for performing respective processing operations illustrated in sequence diagrams described below. A RAM242is a main memory for the CPU241, and functions as, for example, a work area. A click switch246is an input device of the external authentication device104, and the CPU241detects an operation performed on the click switch246and thus performs program control, such as starting pairing. A light-emitting diode (LED)247is one of output devices of the external authentication device104, and the CPU241operates the LED247to notify the user of, for example, the state of the external authentication device104such as the current pairing state of the external authentication device104. A short-range communication I/F248is an interface (I/F) which performs inputting and outputting for short-range communication such as Bluetooth® or NFC, and performs intercommunication with an apparatus or device connected thereto. A TPM245is a storage unit equipped with an anti-tamper property to prevent stored data from being read from the outside, for the purpose of processing or storing confidential information. In the present exemplary embodiment, the feature amount of biological information entered by the user and a private key that is associated with the biological information are stored in the TPM245, and are thus prevented from leaking to the outside. A biological information sensor249is a sensor which reads biological information about the user, and converts information about, for example, the fingerprint, iris, vein, or an electrocardiogram of the user into a read signal. The short-range communication I/F248can be equipped with an I/F for USB (not illustrated). The respective constituent elements of the external authentication device104are connected to an internal bus250, thus being able to perform intercommunication with each other.

FIG. 2Dillustrates an example of a hardware configuration of the peripheral device105. A CPU261executes programs, such as programs stored in a ROM263and an operating system (OS) and applications loaded from a storage device264onto a RAM262. Thus, the CPU261executes the programs stored in a readable storage medium, thus functioning as processing units for performing respective processing operations illustrated in sequence diagrams described below. The RAM262is a main memory for the CPU261, and functions as, for example, a work area. The storage device264is, for example, a hard disk or flexible disk which stores various pieces of data. A network I/F269exchanges data with an external network device in a unidirectional way or bidirectional way. A short-range communication I/F271is a network interface (I/F) for short-range communication such as NFC or Bluetooth®. The peripheral device105is able to exchange data with the external authentication device104with use of the short-range communication I/F271. A device control unit265controls a printing unit266. An input-output device268represents a plurality of configurations playing the functions of inputting and outputting in the peripheral device105. Specifically, the input-output device268receives an input entered from the user (for example, a button input) and communicates a signal corresponding to the received input to the above-mentioned various processing units via an input-output I/F267. Besides, a display device (for example, a touch panel) used to provide necessary information to the user or receive a user operation is included in the input-output device268. Additionally, a scan device used to read a document and receive electronic data as an input can also be included in the input-output device268. Additionally, the input-output device268can be equipped with an I/F for USB (not illustrated).

FIGS. 3A, 3B, 3C, 3D, and 3Eare diagrams illustrating examples of the respective functional blocks representing functions which are implemented by software in the respective apparatuses and devices in the present exemplary embodiment.

FIG. 3Aillustrates functional blocks of the external authentication device104. An information management unit301manages, via the TPM245, biological information for use in authentication, a public key which is generated in association with the biological information, and a private key. Moreover, the information management unit301also has the function of generating a public key and a private key. An authentication processing unit302performs biometric authentication processing by comparing the feature amount (biological information) that is based on a signal read by the biological information sensor249with biological information stored in the TPM245. A short-range communication control unit303controls communication which is performed with an external apparatus, such as the mobile apparatus101, with use of the short-range communication I/F248or a USB I/F.

FIG. 3Billustrates functional blocks of the mobile apparatus101. A short-range communication control unit311controls communication which is performed with an external apparatus, such as the external authentication device104, with use of the short-range communication I/F208or a USB I/F. An authentication device control unit312selects an authentication device which the user uses, or manages information about the authentication device. A temporary authentication unit313performs, for example, a request for key generation to the external authentication device104. Moreover, the temporary authentication unit313manages information about, for example, a public key. A wide-area communication control unit314controls communication which is performed with use of the network OF205. A display control unit315controls displaying which is performed with use of the display207.

FIG. 3Cillustrates functional blocks of the peripheral device105. A short-range communication control unit321controls communication with, for example, the external authentication device104or the mobile apparatus101using, for example, the short-range communication I/F271. An authentication device control unit322controls exchange of, for example, an authentication request to an authentication device connected via the short-range communication I/F271. A wide-area communication control unit323controls communication which is performed with use of the network I/F269. An output processing unit324controls output processing for content data which is performed with use of the printing unit266or the network I/F269. Besides, the output processing unit324also controls playback output processing for content data which is performed with use of a touch panel or a loudspeaker (not illustrated) of the input-output device268. A display control unit325controls displaying which is performed with use of the input-output device268.

FIG. 3Dillustrates functional blocks of the service providing system102. A user verification unit331receives registration of users and cooperates with the authentication management system103to implement authentication.

A content transmission and reception unit332receives content serving as a service to be provided from a registered user or transmits (provides) such content to the outside. A content storage unit333stores and retains content.

FIG. 3Eillustrates functional blocks of the authentication management system103. A registration information management unit341manages registration information about users. The registration information includes information concerning public keys. A verification unit342performs verification of a signature using a public key.

Here, processing which is performed in the present exemplary embodiment is configured with the following three processing operations when roughly divided.Registration processing to be performed prior to service usage.Authentication processing to be performed at the time of service usage using a mobile apparatus.Authentication processing to be performed at the time of service usage using a peripheral device.

These processing operations are described with reference to the drawings.

Furthermore,FIGS. 4A, 4B, 4C, 4D, and 4Eillustrate examples of data structures such as formats of requests and responses in the respective processing operations.

First, “registration processing to be performed prior to service usage” is described.FIG. 5illustrates an example of a sequence of this registration processing.

In step S501to step S502, the short-range communication control unit311of the mobile apparatus101and the short-range communication control unit303of the external authentication device104operate in conjunction with each other and enter a state capable of performing intercommunication with each other. For example, in the case of Bluetooth®, this processing operation corresponds to a general flow called pairing. Peer-to-peer communication connection using, for example, USB can also be established.

In step S503, after establishment of intercommunication, the temporary authentication unit313of the mobile apparatus101requests the external authentication device104to generate one or more pairs each including a public key and a private key. At this time, the mobile apparatus101is not accessing, for example, the service providing system102or the authentication management system103. A relying party (RP) is implemented for each service which the service providing system102provides, and pieces of identification information (relying party identifiers (RPIDs)) different for respective services are assigned thereto. Therefore, an RPID can be an ID specific to a business operator which provides a service or specific to a business, and, generally, a fully qualified domain name (FQDN) of a service providing business operator is used therefor.

FIG. 4Aillustrates contents of a generation request to be transmitted from the mobile apparatus101to the external authentication device104. An operation code (Op) is set to “RegNoRP”, which indicates a request for key generation without being associated with any RP.

In step S503, moreover, in a case where, in the external authentication device104having received a request illustrated inFIG. 4A, the authentication processing unit302has received biological information about the user with use of the biological information sensor249, the information management unit301generates a pair including a public key and a private key. Here, since the information management unit301has generated a key pair without association with a particular RPID, the information management unit301sets an expiration date with respect to the generated keys. Moreover, the short-range communication control unit303transmits, to the mobile apparatus101, a response including the generated public key, an authentication device ID for identifying the external authentication device104, a key ID, and an expiration date (FIG. 4B). Furthermore, details of processing in step S503are further described below with reference to the sequence diagram ofFIG. 8.

Information which the information management unit301of the external authentication device104manages is shown in Table A and Table B.

In table A, the key ID is an ID for uniquely identifying a pair including a public key and a private key. Moreover, the biological information represents the feature amount that is based on a signal read by the biological information sensor249, and can be binary data obtained by collecting feature vectors of the biological information about the user. The expiration date is information to be assigned to a key which is not associated with an RPID. A key pair which has exceeded the expiration date without association being performed is caused to lapse as being expired. The authentication processing unit302compares biological information about the user entered via the biological information sensor249with the registered biological information, then performs authentication by determining whether the two pieces of biological information have similar features, and further determines whether the user has the ownership of keys.

In Table B, RPID represents identification information corresponding to a service which the service providing system102provides. Table B indicates that, with respect to three services, key IDs corresponding to public keys registered in association with the respective services are managed. This means that the same public key has been registered with respect to two different services “example.net” and “example.org”.

From Table A and Table B, it can be seen that a key pair the key ID of which is “KEY03” has been generated according to the request illustrated inFIG. 4A.

Table C represents information concerning a public key which the temporary authentication unit313of the mobile apparatus101manages.

A record which the key ID identifies with “KEY03” represents information which was stored in the case of reception of a response illustrated inFIG. 4B. A record which the key ID identifies with “KEYZZ” represents information about a public key which was registered when the mobile apparatus101used a different external authentication device.

In the present exemplary embodiment, in step S504, a connection between the external authentication device104and the mobile apparatus101is cancelled.

Next, in step S505, in response to a user operation, the mobile apparatus101accesses a website concerning a service which the service providing system102provides, and starts a user registration. On this occasion, registration information such as a user ID (for example, an e-mail address of an individual person) and a password, which are identification information about a user entered by the user into the mobile apparatus101, is transmitted from the mobile apparatus101to the website. This operation does not need to be performed following the above-mentioned operations performed in step S501to step S504. Additionally, in the present exemplary embodiment, suppose that the external authentication device104is not located near the mobile apparatus101and, during a period until later processing in step S519, the mobile apparatus101and the external authentication device104are not able to communicate with each other.

In step S506, the user verification unit331of the service providing system102transmits, to the authentication management system103, a registration request for a user registration using the registration information received in step S505. In step S507, the registration information management unit341stores the registration information, which includes a user ID and a password, in a storage which is implemented by a storage device such as the hard disk223. Moreover, in step S508, the verification unit342generates an attestation challenge. The attestation challenge is generated usually by use of a random byte sequence. In step S509, the authentication management system103transmits, as a response, the attestation challenge to the service providing system102.

In step S510, the user verification unit331of the service providing system102transmits, to the mobile apparatus101, a request for key generation including the attestation challenge (FIG. 4C).

As illustrated inFIG. 4C, operation code (Op) for the request for key generation is set to “Reg”. Moreover, this request includes an RPID, which is identification information corresponding to the service, a user ID, and an attestation challenge.

In step S511, upon receiving the request for key generation via the wide-area communication control unit314, the authentication device control unit312of the mobile apparatus101checks (searches for) an external authentication device which is currently connected or is connectable to the mobile apparatus101. Then, the authentication device control unit312presents, as a list of authentication devices, a list including information corresponding to found external authentication devices and information corresponding to the temporary authentication unit313to the user. Here, since there is no connection to any external authentication device, only the information corresponding to the temporary authentication unit313is presented. Then, the authentication device control unit312receives, from the user, selection of any authentication device from the presented information.

In step S512, the authentication device control unit312requests the selected authentication device to perform authentication processing accompanied by key generation. In the case of the present exemplary embodiment, since the temporary authentication unit313is selected, a request for authentication processing accompanied by key generation is performed to the temporary authentication unit313.

In response to this request, the temporary authentication unit313uses previously-acquired public key information which is not associated with any RPID. Here, as a result, biometric authentication processing using the external authentication device104and generation processing for a private key and a public key are skipped. Such displaying as to prompt the user to perform biometric authentication is also not performed.

In step S513, the temporary authentication unit313generates response data using a previously-acquired public key which is not associated with any RPID. Here, the response data is generated by use of public key information and an authentication device ID corresponding to the key ID “KEY03”, which is managed in Table C. Moreover, the temporary authentication unit313digitally signs the attestation challenge with an encryption key. Response data generated by including, for example, a key ID, public key information, an authentication device ID, and a digital signature is referred to as an “attestation response”, which is illustrated inFIG. 4D.

In step S514, the temporary authentication unit313transmits the attestation response as the response data. This response data is transmitted to the authentication management system103via the service providing system102.

In step S515, the verification unit342of the authentication management system103verifies a signature included in the attestation response transmitted from the mobile apparatus101.

Here, a signature included in the attestation response is supplementarily described.

An encryption key to be used for signature generation by the temporary authentication unit313can be replaced by a common key. In this case, it is necessary to previously pass this common key to the external authentication device104in step S503, encrypt the common key with an attestation private key, and manage the encrypted common key in association with the key ID “KEY03” managed in Table C. The attestation private key is a key which is prepared by a providing source of the external authentication device104for each model of authentication device, and is managed as a certificate at, for example, a trusted execution environment (TEE) of the external authentication device104. In such a case, the temporary authentication unit313causes the attestation response to include a key ID, public key information, an authentication device ID, a digital signature using a common key, and a common key encrypted with an attestation private key. The verification unit342of the authentication management system103decrypts the encrypted common key included in the response data with use of an attestation public key, thus extracting a common key. The verification unit342verifies a signature with use of the extracted common key. Specifically, the verification unit342performs a comparison between hashes and checks whether a hash decrypted with the common key and a hash of data transmitted from the mobile apparatus101coincide with each other. Moreover, the verification unit342checks whether an attestation challenge included in response data obtained by decryption processing coincides with an attestation challenge generated by the verification unit342itself in step S508. If the two attestation challenges coincide with each other, the verification unit342determines that the signature is successfully verified.

Alternatively, the temporary authentication unit313can manage and use an attestation private key as a private key for use in a signature. In this case, the temporary authentication unit313generates a signature using an attestation private key, and the verification unit342of the authentication management system103verifies the signature with use of an attestation public key.

In step S516, in response to the verification performed in step S515being successful, the registration information management unit341stores, as shown in Table D, the key ID, the authentication device ID, and the public key information in association with the user ID.

Password in Table D represents a password obtained by hashing a password entered when the above-mentioned user registration was performed, with use of a hash function.

In step S517, the authentication management system103transmits, to the mobile apparatus101, a notification indicating that registration of the public key has been normally completed. Furthermore, in a case where the verification performed in step S515is unsuccessful, registration of the public key is not performed, so that the authentication management system103transmits a registration error notification to the mobile apparatus101.

In step S518, the temporary authentication unit313of the mobile apparatus101stores an RPID (“NewService.com”) and a user ID in association with the previously-used key ID (“KEY03”), as shown in Table E.

In step S519, the display control unit315of the mobile apparatus101performs displaying concerning the progress of a registration operation for service usage as illustrated inFIG. 6. Further registering the information stored in Table E with the external authentication device104enables the user to use authentication to be performed at the external authentication device104at the time of using a service which the service providing system102provides. Therefore, the display control unit315displays, to the user, a message for prompting the user to connect to the external authentication device104.

As an example of displaying by the display control unit315, the number of public keys the association of which caused by connection to the external authentication device104is presented at an icon601of an application used for communicating with external authentication devices, as illustrated in a screen611. This enables prompting the user to re-perform communication with an external authentication device. Additionally, a message indicating that registration with an authentication device for service usage is not yet completed, as illustrated in a screen612, can be communicated to the user. In a case where registration with an authentication device for usage of a plurality of services is not yet completed, displaying the names of the respective services or presenting the number of services enables prompting the user to re-perform communication with an external authentication device.

Next, in step S520and step S521, procedures similar to those described above in step S501and step S502are performed, so that the external authentication device104and the mobile apparatus101enter a state capable of communicating with each other. In step S522, the temporary authentication unit313of the mobile apparatus101requests the information management unit301of the external authentication device104to reflect association of a public key and an RPID added on Table E therein. Processing in step S520and subsequent steps does not need to be immediately performed following a user operation for performing processing in step S505to step S519. Such processing only needs to be performed at any time within the above-mentioned expiration date.

FIG. 4Eis a diagram illustrating the contents of a request to be transmitted from the mobile apparatus101to the external authentication device104in step S522. The request includes, in addition to operation code “RegRP”, which indicates additional registration of an RPID, a key ID and an RPID associated with the key ID.

In response to the request, the information management unit301of the external authentication device104adds a key ID and an RPID included in the request to Table B. After that, the external authentication device104notifies the mobile apparatus101of completion of the association. Details of step S522are further described below with reference toFIG. 8.

In step S523, the display control unit315of the mobile apparatus101displays a message indicating that registration with an authentication device for service usage has been completed, thus notifying the user of the message.

FIG. 7illustrates an example of displaying which is performed in step S523. In a screen711illustrated inFIG. 7, it can be seen that the number which has been appended to the icon601in the screen611illustrated inFIG. 6has disappeared. Causing a transition of displaying in this way can serve as a notification of the completion. Moreover, the display control unit315can display, while indicating the name of a predetermined service, a message indicating that the service has become usable with the external authentication device104, as in a screen712illustrated inFIG. 7.

Furthermore, inFIG. 5, step S501to step S504, step S505to step S519, and step S520to step S523do not need to be performed in a temporal or spatially consecutive manner. For example, it could be possible that processing in step S501to step S504is performed at work, processing in step S505to step S519is performed at home after work, and processing in step S520to step S523is performed at work again the next day.

FIG. 8is a sequence diagram illustrating details of processing which is performed between the mobile apparatus101and the external authentication device104in each of step S503and step S522described above with reference toFIG. 5. For example, each time a connection between the mobile apparatus101and the external authentication device104is established, the processing illustrated inFIG. 8is performed, so that, as a result, one of step S503and step S522or both step S503and step S522are performed.

First, processing concerning step S522is described as step S801to step S809, and, then, processing concerning step S503is described as step S810to step S816.

In step S801, the temporary authentication unit313of the mobile apparatus101refers to the above-mentioned Table E to determine if a new RPID has been newly associated with a KEY ID and then searches Table C for a public key stored in association with the external authentication device104. If a public key stored in association with the connected external authentication device104has been found (YES in step S801), the processing proceeds to step S802, and, if such a public key has not been found (NO in step S801), the processing proceeds to step S810.

In step S802, the temporary authentication unit313transmits the request illustrated inFIG. 4Eto the external authentication device104. Moreover, in step S803, the display control unit315of the mobile apparatus101displays a screen for prompting the user to perform biometric authentication with the external authentication device104.

In step S804, the information management unit301of the external authentication device104receives inputting of biological information from the user and then performs authentication processing. Furthermore, with regard to the authentication processing, in the case of fingerprint authentication, processing such as template matching that is based on image information is performed. With regard to authentication processing using another type of biological information, matching processing of another method is performed.

In a case where authentication is successful in step S804, the information management unit301confirms that a key ID that is based on the biological information and a key ID included in the request coincide with each other. Moreover, the information management unit301also confirms that any RPID is not associated with the key ID. Then, in step S805, the information management unit301determines whether a public key associated with the key ID is within an expiration date. If the public key is within the expiration date (YES in step S805), the processing proceeds to step S806. In step S806, pursuant to the request from the mobile apparatus101, the information management unit301additionally registers the key ID and an RPID with respect to the above-mentioned Table B, thus performing registration of the association. On this occasion, the information management unit301deletes an expiration date corresponding to the key ID managed in the above-mentioned Table A. In step S807, the short-range communication control unit303transmits, to the mobile apparatus101, a notification indicating that association with an RPID has been completed.

On the other hand, if, in step S805, it is determined that a public key associated with the key ID has exceeded the expiration date (NO in step S805), then in step S808, the short-range communication control unit303transmits, to the mobile apparatus101, a notification indicating that association with an RPID has been failed due to the expiration date being exceeded.

In step S809, in response to the response transmitted from the external authentication device104, the temporary authentication unit313of the mobile apparatus101deletes information about, for example, a key ID targeted for the request in step S802, the corresponding public key, and the corresponding RPID from Table C and Table E.

In step S810, the temporary authentication unit313of the mobile apparatus101refers to Table C and then determines whether the mobile apparatus101is managing a public key which is not associated with any RPID. On this occasion, the temporary authentication unit313also checks the number of public keys each of which is not associated with any RPID and the expiration date of each public key. The temporary authentication unit313can be designed in such a way as to manage up to a predetermined number of public keys each of which is not associated with an RP owned by the temporary authentication unit313itself. If, in step S810, the temporary authentication unit313determines that a predetermined number of public keys each of which is not associated with any RPID and the expiration date of each of which is still sufficiently far to be reached (for example, several days being left) are not currently managed (NO in step S810), the processing proceeds to step S811, and, if the temporary authentication unit313determines that such a predetermined number of public keys are currently managed (YES in step S810), the processing ends.

In step S811, the temporary authentication unit313transmits, to the external authentication device104, a request for key generation such as that illustrated inFIG. 4A. Furthermore, on this occasion, the temporary authentication unit313is able to request the external authentication device104to generate up to the above-mentioned number of pairs each including a public key and a private key. The temporary authentication unit313is also able to transmit a request for key generation on a pair-by-pair basis. Moreover, in step S812, the display control unit315of the mobile apparatus101displays a screen for prompting the user to perform biometric authentication with the external authentication device104.

In step S813, the authentication processing unit302of the external authentication device104receives inputting of biological information from the user and then performs authentication processing. In step S814, the information management unit301of the external authentication device104generates a key pair including a public key and a private key. The key pair is associated with a key ID. Moreover, here, since a key pair is generated without being associated with any specific RPID, an expiration date is set to each key.

In step S815, the short-range communication control unit303transmits, to the mobile apparatus101, a response including the generated public key, an authentication device ID for identifying the external authentication device104, a key ID, and an expiration date, such as that illustrated inFIG. 4B.

In step S816, the temporary authentication unit313of the mobile apparatus101stores information included in the response in Table C and then ends the processing.

Next, “authentication processing to be performed at the time of service usage using a mobile apparatus” is described with reference to a sequence diagram illustrated inFIG. 9.

In step S901and step S902, the external authentication device104and the mobile apparatus101enter a state capable of communicating with each other. Then, in step S903, the processing described with reference toFIG. 8is performed.

In step S904, pursuant to a user operation, the mobile apparatus101accesses the service providing system102with use of an application such as web browser. In step S905, the service providing system102transmits an authentication request to the authentication management system103to perform authentication required for service usage.

In step S906, the verification unit342of the authentication management system103generates an assertion challenge. In step S907, the authentication management system103transmits the assertion challenge to the service providing system102. The assertion challenge is a byte sequence which is generated in a random manner. The assertion challenge is later used for verification processing. Furthermore, the assertion challenge can be stored with an expiration date thereof set, and can be made invalid (failed in authentication) when the expiration date is exceeded.

In step S908, the service providing system102transmits, to the mobile apparatus101, an assertion request including an assertion challenge illustrated inFIG. 11A.

Referring toFIG. 11A, operation code (Op) indicates “Auth”, which represents an assertion request including authentication processing. As illustrated inFIG. 11A, the assertion request includes an RPID and an assertion challenge.

In step S909, upon receiving the assertion request, the authentication device control unit312of the mobile apparatus101checks (searches for) an external authentication device which is currently connected or is connectable to the mobile apparatus101. In a case where a plurality of authentication devices has been found, the authentication device control unit312displays such a result on the display207and then allows the user to select one authentication device from the plurality of authentication devices. Here, suppose that the external authentication device104has been selected.

In step S910, the authentication device control unit312of the mobile apparatus101transmits an authentication request to the external authentication device104. The authentication request includes the RPID and the assertion challenge, which have been included in the assertion request. Along with the authentication request, in step S911, the display control unit315displays, on the display207, a screen for prompting the user to perform authentication with the external authentication device104.

In step S912, the authentication processing unit302of the external authentication device104receives inputting of biological information from the user and then performs authentication processing. On this occasion, authentication that is based on biological information corresponding to an RPID included in the authentication request is performed. In a case where authentication is successful, in step S913, the information management unit301refers to Table A and Table B and then identifies an RPID and a key ID and a private key, which are managed in association with biological information which has been used for authentication processing.

On the other hand, in a case where authentication processing that is based on biological information entered from the user is failed, no private key is specified, a failure in authentication is communicated to the mobile apparatus101, and processing illustrated in the sequence diagram ofFIG. 9is interrupted, so that the processing ends.

In step S914, the information management unit301generates a digital signature with use of the specified private key and the assertion challenge and thus generates an assertion response including the signature, such as that illustrated inFIG. 11B. In step S915, the external authentication device104transmits the generated response data to the mobile apparatus101.

In step S916, the wide-area communication control unit314of the mobile apparatus101transmits the assertion response to the authentication management system103via the service providing system102.

In step S917, the verification unit342of the authentication management system103refers to Table D and then specifies a public key based on a key ID included in the assertion response. The verification unit342verifies a signature included in the assertion response with use of the specified public key. Specifically, in a case where the assertion challenge obtained from the specified public key and the signature included in the assertion response coincides with the assertion challenge generated in step S906, the verification unit342determines that verification of the signature is successful.

In a case where such verification is successful, in step S918, the verification unit342generates, as an authentication result, data including an authentication token corresponding to a user ID associated with the key ID, and then transmits the generated data to the mobile apparatus101via the service providing system102. The authentication token is a token such as that typified by, for example, JSON Web Token (JWT). With the processing performed so far, authentication processing required to use a service which the service providing system102provides is completed.

In step S919, pursuant to a user operation, the wide-area communication control unit314of the mobile apparatus101transmits content to the service providing system102. On this occasion, the wide-area communication control unit314also transmits an authentication token obtained as a result of authentication together with the content.

In step S920, the user verification unit331of the service providing system102verifies the authentication token and thus specifies a user ID with use of the token. In step S921, the content transmission and reception unit332processes the received content. For example, in a case where a storage service of the service providing system102is used, as shown in Table F, the received content is stored in association with the specified user ID (“Tanaka”). Then, in step S922, the content transmission and reception unit332communicates, to the mobile apparatus101, a processing result indicating, for example, save successful.

Next, “authentication processing to be performed at the time of service usage using the peripheral device105” is described with reference to the sequence diagram ofFIG. 10. Processing operations assigned the same reference characters as those inFIG. 9are processing operations similar thereto and, therefore, omitted from description here.

In step S1001and step S1002, the external authentication device104and the peripheral device105enter a state capable of communicating with each other. Such a connection is established in response to a user operation performed on the peripheral device105. For example, using Near Field Communication (NFC) enables reducing a load on a pairing work between the external authentication device104and the peripheral device105.

In step S1003, the user operates a web browser of the peripheral device105to cause the peripheral device105to access the service providing system102.

After that, processing operations similar to those described above with reference toFIG. 9are performed, so that the peripheral device105receives an assertion request.

In step S1010, the authentication device control unit322of the peripheral device105transmits an authentication request to the external authentication device104. The authentication request includes an RPID and an assertion challenge, which have been included in the assertion request. Along with the authentication request, in step S1011, the display control unit325displays, on the touch panel of the input-output device268, a screen for prompting the user to perform authentication with the external authentication device104.

In step S1012, the authentication processing unit302of the external authentication device104receives biological information from the user and then performs authentication processing. On this occasion, authentication that is based on biological information corresponding to an RPID included in the authentication request is performed. In a case where authentication is successful, in step S1013, the information management unit301refers to Table A and Table B and then identifies an RPID and a key ID and a private key, which are managed in association with biological information which has been used for authentication processing.

On the other hand, in a case where authentication processing that is based on biological information entered from the user is failed, no private key is specified, a failure in authentication is communicated to the mobile apparatus101, and processing illustrated in the sequence diagram ofFIG. 10is interrupted, so that the processing ends.

In step S1014, the information management unit301generates a digital signature with use of the specified private key and the assertion challenge and thus generates an assertion response including the signature, such as that illustrated inFIG. 11B. In step S1015, the external authentication device104transmits the generated response data to the peripheral device105.

In step S1016, the wide-area communication control unit323of the peripheral device105transmits the assertion response to the authentication management system103via the service providing system102.

After that, processing operations similar to those described above with reference toFIG. 9are performed, so that the peripheral device105receives an authentication result.

In step S1020, pursuant to a user operation, the wide-area communication control unit323of the peripheral device105makes a request for a content list associated with the user to the service providing system102. This request includes an authentication token included in the authentication result assigned thereto.

In step S1021, the user verification unit331of the service providing system102verifies the authentication token and thus specifies a user ID with use of the token. In step S1022, the content storage unit333refers to Table F and then acquires a content list including IDs of one or more contents which are managed in association with user IDs. In step S1023, the service providing system102transmits the content list to the peripheral device105.

In step S1024, the display control unit325of the peripheral device105displays a content selection screen with use of the received content list. Moreover, in a case where a content is selected by the user via the content selection screen, the wide-area communication control unit323transmits a content request including an ID of the selected content to the service providing system102. The content request includes an authentication token included in the above-mentioned authentication result assigned thereto.

In step S1025, the user verification unit331of the service providing system102verifies the authentication token and then acquires content data corresponding to the ID of the designated content from a storage. In step S1026, the content transmission and reception unit332of the service providing system102transmits the targeted content data to the peripheral device105.

In step S1027, the output processing unit324of the peripheral device105performs output processing of the acquired content data. For example, in the present exemplary embodiment, the output processing includes print outputting of image content and playback outputting of music content or still image or moving image content.

Modification Example

As mentioned above, in the present exemplary embodiment, information about a public key the association of which has been completed in step S807is deleted in step S809. However, this processing in step S809is not essential. The mobile apparatus101and the external authentication device104are able to re-use the acquired public key for a plurality of targets and thus associate the acquired public key with a plurality of RPIDs. Even if a plurality of RPIDs is associated with the same key ID, it is possible to identify the key ID and perform a flow of biometric authentication.

Additionally, in the present exemplary embodiment, a public key with an expiration date set thereto is used. This management is also not essential. In that case, the user will not have to become concerned about any expiration date of the public key, so that it becomes possible to further improve usability.

Moreover, a configuration in which the processing itself illustrated inFIG. 8is performed each time the mobile apparatus101and the external authentication device104connect to each other has been described above. However, a configuration in which processing in step S810to step S816illustrated inFIG. 8is performed in response to, for example, a user instruction issued onto a dedicated screen (an application for implementing the temporary authentication unit313) of the mobile apparatus101can be employed. Moreover, in such a case, the processing in step S810to step S816can be omitted at the time of connection between the mobile apparatus101and the external authentication device104.

Application Example 1

While, in the present exemplary embodiment, for example, a cloud print service has been described as an example, the service which the service providing system provides is not limited to such a service. Since the service providing system is able to provide a service associated with the user, for example, the service providing system is able to manage address books and provide an address book associated with the user in response to authentication.

Application Example 2

In the present exemplary embodiment, as an example of the peripheral device105, an output and playback apparatus for content, such as an image processing apparatus, has been taken as a specific example. However, as an example of the peripheral device105, besides, the present disclosure can also be applied to a door system which controls locking and unlocking of a door. For example, even in the case of a door system in which a short-range communication device, such as an NFC device, is located near a door and the door is opened and closed in response to the state of user authentication, a biometric authentication device owned by an individual user can be used to issue an instruction to open and close the door.

The present disclosure should be interpreted to include an apparatus, a system, or a method configured by combining the above-described exemplary embodiments as appropriate.

OTHER EMBODIMENTS

This application claims the benefit of Japanese Patent Application No. 2019-036849 filed Feb. 28, 2019, which is hereby incorporated by reference herein in its entirety.