Information processing apparatus, computer program product, and resource providing method

According to an embodiment, an information processing apparatus issues an access token in response to a token issuance request from a client. The information processing apparatus includes one or more processors configured to: receive the token issuance request from the client, the token issuance request including a nonce issued to the client, a first public key generated by the client, and a first signature for client information including the nonce; transmit, to the client, a login request including first identification information of the token issuance request, when the first signature of the token issuance request is successfully verified, using the first public key; and generate and issue a sender constrained token with the first public key as the access token, upon receipt of an authorization permission request from the client, the authorization permission request including the first identification information and authentication information of a user who uses the client.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is based upon and claims the benefit of priority from Japanese Patent Application No. 2018-171240, filed on Sep. 13, 2018; the entire contents of which are incorporated herein by reference.

FIELD

Embodiments described herein relate generally to an information processing apparatus, a computer program product, and a resource providing method.

BACKGROUND

In recent years, browser applications for allowing a client to implement a Web service have drawn attention. Use of a standard protocol OAuth2.0 (RFC 6749) for authentication between a client and a server in a system including such a browser application is known. OAuth2.0 defines an authorization flow as an implicit flow. The implicit flow refers to a flow for directly receiving an access token from an authorization server in response to an authorization request.

However, according to the protocol including the implicit flow, the type of access token issuable by the server is a bearer token, so that the leakage of an access token, if occurs, may lower security.

DETAILED DESCRIPTION

According to an embodiment, an information processing apparatus issues an access token in response to a token issuance request from a client. The information processing apparatus includes one or more processors configured to receive the token issuance request from the client, the token issuance request including a nonce issued to the client, a first public key generated by the client, and a first signature for client information including the nonce; transmit, to the client, a login request including first identification information of the token issuance request, when the first signature of the token issuance request is successfully verified, using the first public key; and generate and issue a sender constrained token with the first public key as the access token, upon receipt of an authorization permission request from the client, the authorization permission request including the first identification information and authentication information of a user who uses the client.

Hereinafter, an information processing apparatus, a computer program product, and a resource providing method will be described in detail with reference to the accompanying drawings.

First Embodiment

FIG. 1is a schematic diagram illustrating an exemplary information processing system1according to a first embodiment.

The information processing system1includes an information processing apparatus10, a client terminal12, a service providing apparatus14, and a resource providing apparatus16. The information processing apparatus10, the client terminal12, the service providing apparatus14, and the resource providing apparatus16are connected through a network18to be able to communicate with each other. The information processing system1may include one or two or more client terminals12, one or two or more service providing apparatuses14, one or two or more resource providing apparatuses16, and one or two or more information processing apparatuses10.

The information processing apparatus10functions as an OAuth authorization server.

The client terminal12refers to a terminal device that is operated by a user. The client terminal12executes a client script with a Web browser12B on the client terminal12and uses resources provided by the resource providing apparatus16. The resources refer to, for example, a resource application for implementing a printing service or an online reporting service.

The service providing apparatus14refers to a client that is hosted on the Web and executed on the Web browser by OAuth.

The resource providing apparatus16refers to a resource server incorporating a client program that is hosted on the Web by OAuth. The resource providing apparatus16provides resources to the client terminal12in response to a resource request from the client terminal12.

Next, the functional configuration of each apparatus of the information processing system1will be described in detail.

The client terminal12includes a communicator12A, the Web browser12B, and an operating System (OS)12E. The communicator12A performs data communication with the other apparatuses through the network18.

In the client terminal12, a central processing unit (CPU) executes the OS12E stored in a read only memory (ROM) or an external memory to control each application. The OS12E represents a general-purpose OS such as a real-time OS or Linux (registered trademark).

The Web browser12B represents a user agent for using the World Wide Web (WWW). The Web browser120reads a service page12C and an authentication page120from the service providing apparatus and the information processing apparatus, respectively, and executes the read pages.

The service page12C refers to a page of a website provided from the service providing apparatus14and the substance of OAuth Client.

In the first embodiment, the service page12C generates a pair of a first public key and a first private key for each client terminal12and for each origin being a combination of a protocol, a host, and a host number for identifying a Website provider (the service providing apparatus in the first embodiment). The pair of the first public key and the first private key may be generated by a known method. For example, the service page12C generates the pair of the first public key and the first private key by W3C Web Cryptography API.

The service page12C transmits a token issuance request to the information processing apparatus10. The token issuance request corresponds to an OAuth2.0 authorization request. However, in the second embodiment, the token issuance request refers to an issuance request for a sender constrained token. The sender constrained token may be referred to as a proof-of-possession (PoP) token.

Specifically, in the first embodiment, the token issuance request includes a number used once (nonce) issued from the information processing apparatus10to the client terminal12, the first public key, and a first signature for information including the nonce. The token issuance request includes information on the sender constrained token issuance request.

The nonce refers to a randomly generated number or character string and is used only once.

The service page12C may acquire the nonce from the information processing apparatus10and transmit a token issuance request including the nonce to the information processing apparatus10. The service page12C may receive information indicating a storing location of the nonce from the information processing apparatus10, and access the storing location to acquire the nonce.

The service page12C appends a first signature to the acquired nonce, using the first private key. The first signature refers to a signature for the nonce or data containing client information such as the first public key together with the nonce. The first signature may be appended to the nonce using the first private key by a known method. A signature may be appended not to the nonce but to data containing client information such as the first public key together with the nonce.

The service page12C receives access-token response information from the information processing apparatus10in response to the transmission of the token issuance request to the information processing apparatus10.

The access-token response information includes specific information of an access token issued by the information processing apparatus10. The specific access-token information may be any information for uniquely specifying the access token. The specific information represents, for example, the access token issued from the information processing apparatus10to the client terminal12, information indicating the location where the access token is stored, or information for identifying the access token (third identification information). The first embodiment describes the access token as the specific information by way of example.

Receiving the access-token response information including the access token from the information processing apparatus10, the service page12C stores the access token in association with the first public key.

Then, the service page12C transmits a resource request including the received access token to the resource providing apparatus16. In the first embodiment, the service page12C transmits a resource request including a nonce issued by the resource providing apparatus16and the received access token from the information processing apparatus10, to the resource providing apparatus16.

The resource providing apparatus16verifies the access token, and when successfully verifying the token, provides resources to the service page12C.

The authentication page12D refers to a web page to be displayed by the information processing apparatus10, in response to the token issuance request from the service page12C to the information processing apparatus10. A login request specifically refers to a redirect request for the authentication page12D. A redirect URL to the authentication page12D includes first identification information of the token issuance request. The first identification information will be described in detail below.

As a result of the redirection from the information processing apparatus10, the authentication page12D is loaded on the Web browser12B and displays an authentication screen for allowing the user to log in the information processing apparatus10. The user inputs authentication information to the client terminal12, referring to the authentication screen. The authentication information includes, for example, a user ID, a login password, and a session ID to issue after login authentication. The user ID refers to user identification information.

The authentication page12D transmits, to the information processing apparatus10, an authorization permission request including the authentication information (the user ID and the password) and the first identification information of the token issuance request.

Next, the functional configuration of the information processing apparatus10will be described.

The information processing apparatus10issues an access token in response to the token issuance request from the client. That is, the information processing apparatus10directly returns the access token to the client being the transmission source of the token issuance request, in response to the received token issuance request, as by the OAuth 2.0 implicit flow.

The client represents the client terminal12and the service page12C loaded on the Web browser12B installed in the client terminal12. In the first embodiment, the client is referred to as the client terminal12.

The information processing apparatus10includes a receiver10A, a transmitter10B, a nonce issuer10C, a signature verifier10D, and an issuer10E.

The receiver10A, the transmitter10E, the nonce issuer10C, the signature verifier10D, and the issuer10E may be implemented by software, that is, executing a program by a processor, such as a central processing unit (CPU). These elements may be implemented by hardware, that is, a processor, such as a dedicated integrated circuit (IC). These elements may be implemented by a combination of software and hardware. In use of multiple processors, each processor may implement one or two or more of these elements.

The receiver10A receives various kinds of information from the client terminal12, the service providing apparatus14, and the resource providing apparatus16. In the first embodiment, the receiver10A receives the token issuance request including the nonce issued to the client terminal12, the first public key generated by the client terminal12, and the first signature for the nonce or data including client information, such as the first public key added to the nonce, from the client terminal12. As described above, in the first embodiment, the token issuance request represents an issuance request for a sender constrained token.

The nonce issuer10C issues a nonce to the client terminal12. The nonce issuer10C includes a random number generator to generate a random number, and issues the generated random number as the nonce to the client terminal12.

The transmitter10B transmits various kinds of information to the client terminal12, the service providing apparatus14, and the resource providing apparatus16. In the first embodiment, the transmitter10B transmits nonce information on the nonce to the service page12C. The nonce information represents nonce, nonce identification information, or a nonce storing location. The first embodiment exemplifies the nonce issued by the nonce issuer10C as the nonce information.

Upon receipt of the token issuance request including the first signature from the service page12C, the signature verifier10D verifies the first signature using the first public key. That is, the signature verifier10D determines by the first public key whether the token issuance request has been signed with a private key corresponding to the first public key or whether data to be signed has been converted. The first signature may be verified by a known method.

When the first signature in the token issuance request, received from the service page12C, is successfully verified by the first public key, the transmitter10B transmits a login request to the authentication page12D. The successful verification signifies that the signature verifier10D has verified that data to be signed with the first signature has not been subjected to falsification and has been signed with a private key corresponding to the first public key.

The login request refers to a request for the user operating the client terminal12to urge an explicit operation for authorization. As described above, the login request includes the first identification information of the token issuance request. Specifically, the login request refers to a redirect response (for example, a 302 Found response), and a Location header value (URL) indicating a redirection destination includes the first identification information. For the sake of convenience, it is referred to as login request, however, the login request is an authorization request in practice and the authentication screen displays a screen to prompt the user to authorize access to resources on the resource providing apparatus from the service providing apparatus (client). If the user has already logged in at the time of redirection, a screen for requesting authorization is simply displayed without display of a login interface for inputting a login ID and a password.

The first identification information may be any identification information for associating the token issuance request including the first public key, the first signature, and the nonce, received from the service page12C, with the authentication information (a user ID and a password or login session information after the user has logged in) received from the authentication page12D. For example, the first identification information represents the nonce issued from the nonce issuer10C to the client terminal12, second identification information for identifying the nonce, or session identification information of the token issuance request received from the service page12C.

When receiving from the client the authorization permission request including the authentication information of the user of the client and the first identification information, the issuer10E generates a sender constrained token using the first public key and issues it as the access token to the client.

That is, the issuer10E generates the sender constrained token using the first public key generated by the client terminal12and issues the access token to be usable only by the client terminal12.

Then, the issuer10E appends a second signature to the generated sender constrained token by a certificate for certifying the issuance of the access token to the issued access token by the information processing apparatus10, and issues the access token with the second signature. The certificate can be a second public key generated in advance by the information processing apparatus10.

The information processing apparatus10may generate a pair of the second public key and a second private key in advance. The pair of the second public key and the second private key may be generated by a known method.

The issuer10E may append the second signature to a hash value of the generated sender constrained token and issue the access token with the second signature.

The issuer10E stores the access token generated for the client terminal12, the first public key used to identify the client terminal12, the authentication information (a login ID and a password, or a session ID issued as a result of login) received from the client terminal12in association with one another. Then, the issuer10E transmits access-token response information including the specific information of access token, which has been issued for the client terminal12, to the service page12C of the client terminal12through the transmitter102.

Next, the functional configuration of the resource providing apparatus16will be described.

The resource providing apparatus16includes a communicator16A, a nonce issuer16B, an access token verifier16C, and a responder16D.

The communicator16A, the nonce issuer162, the access token verifier16C, and the responder16D may be implemented by software, i.e., by executing a program by a processor, such as a CPU. These elements may be implemented by hardware, i.e., a processor, such as a dedicated IC. These elements may be implemented by a combination of software and hardware. In use of multiple processors, each processor may implement one or two or more of these elements.

The communicator16A communicates with the client terminal12, the service providing apparatus14, the resource providing apparatus16, and the information processing apparatus10through the network18.

The nonce issuer16B issues a nonce. The nonce issuer16B issues the nonce, as with the nonce issuer10C of the information processing apparatus10. However, the nonce issuer16B is not in cooperation with the information processing apparatus10, and issues a unique random number as the nonce.

Upon receipt of the resource request including the access token from the client terminal12through the communicator16A, the access token verifier16C verifies the access token. For example, the access token verifier16C receives, through the communicator16A, the resource request including the nonce issued by the nonce issuer16B and the access token issued for the client terminal12by the information processing apparatus10. Then, the access token verifier16C inquires of the information processing apparatus10as to whether the access token in the resource request is the one issued to the client terminal12being the transmission source of the access token. Specifically, the access token verifier16C transmits the access token to a token verification end point and determines whether the access token is valid. When the information processing apparatus10stores the access token and the authentication information of the client terminal12or the first public key in association with each other, and the validation of the token has not been expired and the token has not been revoked or invalidated, the resource providing apparatus16determines that the access token is the one issued to the client terminal12and the verification thereof has been successful.

When the access token verifier16C determines the verification as successful, the responder160provides resources to the service page12C.

Next, exemplary information processing performed by the information processing system1will be described.

FIG. 2is a sequence diagram illustrating exemplary information processing performed by the information processing system1

First, the information processing apparatus10generates a pair of the second public key and the second private key (Step S100). The service page12C of the client terminal12generates a pair of the first public key and the first private key (Step S102).

Then, the service page12C transmits a token issuance request to the information processing apparatus10(Step S104). In the first embodiment, the service page120transmits to the information processing apparatus10a token issuance request, that is, an issuance request for a sender constrained token. The token issuance request in Step S104is expressed by, for example, “POST/authorizeresponse_type=token&client_id=x&token_type=pop&redirect_uri=https://rp.example.com/cb”.

Receiving the token issuance request from the service page12C in Step S104, the nonce issuer10C of the information processing apparatus10issues a nonce to the client terminal12(Step S106).

The nonce issuer10C transmits nonce information on the nonce issued in Step S106to the service page12C through the transmitter10B (Step S108). Specifically, the nonce issuer10C transmits a “401 Unauthorizednonce” response containing the nonce at the header, to the service page12C.

The nonce information may be any information representing the nonce issued in Step S106. Specifically, the nonce information represents information including the nonce, nonce identification information, or a nonce storing location. The first embodiment illustrates the nonce as an example of the nonce information.

The service page12C of the client terminal12appends the first signature to the nonce, received from the information processing apparatus10, using the first private key (Step S110). The signature does not need to be appended only to the nonce and may be appended to data including client information such as the first public key.

Then, the service page120of the client terminal12transmits a token issuance request including the first public key, the nonce received in Step S108, and the first signature appended in Step S110to the information processing apparatus10(Step S112).

The token issuance request transmitted in Step S112is expressed by, for example, “POST/authorize?response_type=token&client_id=x&token_type=pop&alg=RS256&key=KRpub&redirect_uri=https://rp.example.com/cb” where RS256 represents the first signature, KRpub represents the first public key, and pop represents the issuance request for a sender constrained token.

The signature verifier100of the information processing apparatus10verifies the first signature in the token issuance request, received from the authentication page120of the client terminal12in Step S112, using the first public key in the token issuance request (Step S114). It is assumed that the verification be successful for the sake of explanation.

The transmitter100of the information processing apparatus10transmits a login request including the first identification information to the authentication page120of the client terminal12(Step S116). In Step S116, the transmitter100transmits any of the nonce issued in Step S106, the second identification information of the nonce, and the communication session identification information of at least one of the token issuance requests received in Steps S104and S112as the first identification information.

The login request is represented as, for example, a “302 Found” response, that is, a redirect response. A Location header includes the URL of the authorization screen.

Receiving the login request, the authentication page12D of the client terminal12displays an authentication screen for allowing the user to log in the information processing apparatus10(Step S118). The user inputs authentication information including a user ID and a password to the client terminal12, referring to the authentication screen. Ac described above, when the user has already logged in, the input of the authentication information is skipped and the authentication screen displays only an interface for prompting the authorization of access from the service providing apparatus to the resources of the resource providing apparatus. The OAuth authorization screen is generally provided with such an interface.

The authentication page12D of the client terminal12transmits, to the information processing apparatus10, an authorization permission request including the input authentication information (the user ID, the password, or the session ID issued after authentication), and the first identification information in the login request received in Step3116(Step S120).

The authorization permission request is expressed by, for example, “POST/grant”.

When receiving the authorization permission request, the issuer10E of the information processing apparatus10determines whether or not the authentication information in the authorization permission request matches the one registered in advance in the information processing apparatus10to thereby determine whether to permit the user operating the client terminal12to log in the information processing apparatus10. It is assumed that the login be permitted for the sake of explanation.

The issuer10E of the information processing apparatus10generates a sender constrained token using the first public key included in the token issuance request received in Step S112, and issues an access token to the client terminal12(Step S122).

Then, the issuer10E appends the second signature to the access token issued in Step S122, using the second private key generated in Step S100(Step S124).

The issuer10E stores the access token issued for the client terminal12, the first public key used to identify the client terminal12, and the authentication information (the login ID and the password) received from the client terminal12in association with one another (Step S126).

The transmitter103of the information processing apparatus10transmits access-token response information including the access token with the second signature, issued in Step S122and Step S124, to the client terminal12(Step S128).

The access-token response information represents, for example, a “302 Found” redirect response, and the value of the location header is expressed by https://rp.example.com/cb#access_token-PoPToken where rp.example.com represents the host of the service providing apparatus14and PoPToken represents the access token with the second signature.

The service page12C of the client terminal12stores the first public key and the access token specified by the specific access token information contained in the access-token response information received in Step S128, in association with each other (Step S150). The access token stored in Step S130has been issued by the information processing apparatus10in Step S122and appended with the second signature in Step S124.

Then, the service page125of the client terminal12transmits a resource request including the access token with the second signature stored in Step S130to the resource providing apparatus16(Step S132).

The resource request in Step S132is expressed by, for example, “GET/some-resource”.

Receiving the resource request in Step S132, the nonce issuer165of the resource providing apparatus16issues nonce for the client terminal12(Step S134). Then, the nonce issuer165transmits nonce information including the nonce issued in Step S134to the client terminal12(Step S136). The nonce information in Step2136is set at, for example, the header of a “401 Unauthorized” error response. The first embodiment describes an example that the nonce issuer165transmits the nonce to the client terminal12.

Receiving the nonce in Step S136, the service page120of the client terminal12transmits a resource request including the access token with the second signature stored in Step S130and the nonce received in Step S136to the resource providing apparatus16(Step S138).

The resource request in Step S138is, for example, expressed by “GET/some-resource”. The access token with the signature and the nonce are designated in an Authorization header and are expressed by, for example, “Authorization: Jpop at=“JWS”, s=“nonce””. JWS represents the access token with the signature.

The access token verifier16C of the resource providing apparatus16verifies the access token with the second signature in the resource request received in Step3138(Step S140and Step S142). The access token verifier16C inquires of the information processing apparatus10as to whether the information processing apparatus10has issued the access token certified by the second signature, to verify the access token. It is assumed that that the verification be determined to be successful for the sake of explanation.

Then, the responder16D of the resource providing apparatus16provides the service page12C with resources (Step S144). For example, the responder16D transmits “200 OK” to the service page12C.

As described above, the information processing apparatus10according to the first embodiment issues the access token in response to the token issuance request from the client. The information processing apparatus10includes the receiver10A, the transmitter108, and the issuer10E. The receiver10A receives the token issuance request including the nonce issued to the client, the first public key generated by the client, and the first signature for information including the nonce. When the verification of the first signature in the token issuance request by the first public key is successful, the transmitter10B transmits the login request including the first identification information of the token issuance request to the client. Upon receipt of the authorization permission request including the first identification information and the authentication information of the user of the client from the client, the issuer10B generates a sender constrained token using the first public key and issues it as the access token.

As such, the information processing apparatus10according to the first embodiment issues the access token in response to the token issuance request from the client. Thus, the information processing apparatus10executes an authorization flow along the implicit flow defined by OAuth2.0. However, upon receiving the authorization permission request including the authentication information of the client and the first identification information, the information processing apparatus10generates a sender constrained token using the first public key generated by the client and issues the sender constrained token as the access token.

That is, the information processing apparatus10according to the first embodiment generates the sender constrained token to be usable only by the client to issue a secure access token.

As a result, the information processing apparatus10according to first embodiment can improve the security of the access token.

The information processing apparatus10according to the first embodiment issues the access token in response to the token issuance request from the client. That is, the information processing apparatus10performs an authorization flow along the implicit flow defined by OAuth2.0. Thus, the information processing apparatus10can issue, to the client terminal12, an access token for access to resources by a simple communication method.

Second Embodiment

A second embodiment will describe an example that the resource providing apparatus performs at least one of the generation of an access token and the appending of a signature to the access token.

FIG. 3is a schematic diagram illustrating an exemplary information processing system1A according to the second embodiment. The same functions and configurations as those in the first embodiment are denoted by the same reference numerals and the detailed description thereof will be omitted.

The information processing system1A includes an information processing apparatus11, a client terminal12, a service providing apparatus14, and a resource providing apparatus17. The client terminal12and the service providing apparatus14are identical to those in the first embodiment. The information processing apparatus11, the client terminal12, the service providing apparatus14, and the resource providing apparatus17are connected through a network18to be able to communicate with one another. The information processing system1A may include one or two or more client terminals12, one or two or more service providing apparatuses14, one or two or more resource providing apparatuses17, and one or two or more information processing apparatuses11.

As with the information processing apparatus according to the first embodiment, the information processing apparatus11represents a server for implementing OAuth and functions as an authorization server. As with the information processing apparatus10according to the first embodiment, the information processing apparatus11issues an access token, in response to a token issuance request from a client. That is, the information processing apparatus11directly returns the access token to the client being the transmission source of the token issuance request, in response to the received token issuance request, as by the OAuth 2.0 implicit flow.

The information processing apparatus11includes a receiver10A, a transmitter10E, a nonce issuer10C, a signature verifier10D, an access verifier11E, and an issuer11F. The receiver10A, the transmitter10B, the nonce issuer10C, and the signature verifier10D are identical to those in the first embodiment.

When receiving a token issuance request including third identification information of the resource providing apparatus17that the client terminal12requests to provide resources, the access verifier11E determines whether the client being the transmission source of the token issuance request has a right to access the resource providing apparatus17identified by the third identification information.

Specifically, in the second embodiment, the receiver10A receives a token issuance request including a first public key generated by the client terminal12, a first signature appended by the client terminal12, a nonce issued from the information processing apparatus11to the client terminal12, and the third identification information.

The third identification information refers to the identification information of the resource providing apparatus17that receives the resource providing request from the client terminal12. In other words, the third identification information is for identifying the resource providing apparatus17that the client terminal12requests to provide resources.

The access verifier11E may pre-store, for each resource providing apparatus17of the information processing system1A, the identification information of the client terminal12to be permitted to access resources. The identification information of the client terminal12can be, for example, the first public key generated by the client terminal1′ That is, the access verifier11E stores the third identification information of the resource providing apparatus17and the first public key generated by the client terminal12that the resource providing apparatus17identified by the third identification information has permitted access, in association with each other. When the first public key and the third identification information contained in the token issuance request are stored in association with each other, the access verifier11E determines that the client terminal12has an access right.

When access verifier11E determines that the client terminal12has an access right, the issuer11F issues an access token to be usable by the resource providing apparatus17identified by the third identification information.

The issuer11F may request the resource providing apparatus17to issue the access token. The second embodiment describes the example that the resource providing apparatus17issues the access token and appends a signature.

In issuing the access token, for example, the issuer11F transmits an access permission request from the client (client terminal12), being the transmission source of the token issuance request, to the resource providing apparatus17identified by the third identification information in the token issuance request received from the client terminal12. Upon receiving the access permission request, the resource providing apparatus17permits the client terminal12to access. However, the resource providing apparatus17has not permitted to provide resources to the client terminal12.

When the access verifier11E determines that the client terminal12has an access right, the issuer11F requests the resource providing apparatus17, identified by the third identification information in the token issuance request received from the client terminal12, to generate a sender constrained token using the first public key generated by the client terminal12. For example, the issuer11F transmits, to the resource providing apparatus17, an access token generation request including the first public key that is included in the token issuance request received from the client terminal12.

The issuer ilk requests the resource providing apparatus17, identified by the third identification information included in the token issuance request received from the client terminal12, to append a third signature to the sender constrained token using a certificate for certifying the issuance of the access token by the resource providing apparatus17. For example, the issuer11F transmits a signature appending request to the resource providing apparatus17.

Then, the issuer lip may receive the sender constrained token (access token) to which the third signature has been appended from the resource providing apparatus17and issue the access token.

The issuer11kmay generate the access token and request the resource providing apparatus17to only append the signature.

Next, the functions of the resource providing apparatus17will be described.

The resource providing apparatus/includes communicator16A, a nonce issuer16B, an access token verifier16C, a responder16D, an access permitter17E, a generator17F, and a signature adder17G. The communicator16A, the nonce issuer16E, the access token verifier16C, and the responder16D are identical to those of the resource providing apparatus16according to the first embodiment.

When receiving an access permission request from the information processing apparatus11, the access permitter17E stores the identification information of the client terminal12included in the access permission request as the identification information of the client to be permitted to access resources. The identification information of the client terminal12can be, for example, the authentication information (a user ID and a password) of the user operating the client terminal12, identification information for uniquely identifying the client terminal12, or the first public key generated by the client terminal12.

The access permitter17E permits the access of the client terminal12through this storing process. The permission of access signifies that the client terminal12is not permitted to be provided with resources but is permitted to access only.

When receiving an access token generation request including the first public key of the client terminal12from the information processing apparatus1, the generator17F generates a sender constrained token (access token) for the client terminal12using the first public key.

When receiving a signature appending request from the information processing apparatus11, the signature adder17G appends the third signature to the sender constrained token (access token) generated by the generator17F, by a certificate for certify ing the issuance of the access token by the resource providing apparatus17. The certificate can be a third private key generated in advance by the resource providing apparatus17.

The resource providing apparatus17may generate a pair of the third public key and a third private key in advance. The pair of the third public key and the third private key may be generated by a known method. The signature adder17G may append the third signature to the access token, using the third private key generated in advance.

The signature adder17G may generate an access token with the third signature by appending the third signature to a hash value of the sender constrained token generated by the generator17F.

Next, exemplary information processing performed by the information processing system1A will be described.

FIG. 4is a sequence diagram illustrating an exemplary information processing performed by the information processing system1A.

First, the resource providing apparatus17generates a pair of the third public key and the third private key (Step3200). The service page12C of the client terminal12generates a pair of the first public key and the first private key (Step S202).

Then, the service page12C of the client terminal12transmits a token issuance request to the information processing apparatus11(Step S204). In the second embodiment, the service page12C transmits an issuance request for a sender constrained token to the information processing apparatus11.

Upon receipt of the token issuance request from the service page12C in Step S204, the nonce issuer10C of the information processing apparatus11issues a nonce to the client terminal12(Step S206). Then, the nonce issuer10C transmits nonce information on the nonce issued in Step S206to the service page12C through the transmitter10B (Step S208). The nonce information may be any information representing the nonce issued in Step S206. The second embodiment describes the nonce as an example of the nonce information.

The service page12C of the client terminal12appends a first signature to the nonce received from the information processing apparatus11, using the first private key (Step S210).

The operation in Steps S202to S210is the same as that in Steps S102to S110according to the first embodiment (seeFIG. 2).

The service page12C of the client terminal12transmits, to the information processing apparatus11, a token issuance request including the first public key, the nonce received in Step S208, and the first signature appended in Step S210, and the third identification information of the resource providing apparatus17that the client terminal12requests to provide resources (Step S212).

That is, in the second embodiment, the operation in Step S212differs from the operation in Step S112in that the service page12C transmits the token issuance request additionally including the third identification information to the information processing apparatus10(seeFIG. 2).

The service page12C of the client terminal12displays information representing a list of multiple resource providing apparatuses17connected to the information processing system1A. The user operates the client terminal12to select a resource providing apparatus17to issue a request for providing resources. Through the selection, the service page12C receives the third identification information of the resource providing apparatus17which is requested to provide resources. The service page12C transmits the token issuance request including the third identification information to the information processing apparatus11.

Upon receipt of the token issuance request including the first signature from the authentication page120of the client terminal12in Step S212, the signature verifier100of the information processing apparatus11verifies the first signature using the first public key included in the token issuance request. (Step S214). The operation in Step3214is the same as that in Step S114(see FIG. according to the first embodiment. It is assumed that the verification be successful for the sake of explanation.

The access verifier115of the information processing apparatus11determines whether the client terminal12being the transmission source of the token issuance request in Step S212has a right to access the resource providing apparatus17identified by the third identification information (Step S216). It is assumed that that the client terminal12be determined to have the access right.

Upon confirming that the client terminal12has the access right, the transmitter108of the information processing apparatus11transmits a login request including the first identification information to the authentication page129of the client terminal12(Step S218). In Step S218, the transmitter108transmits any of the nonce issued in Step S206, the second identification information of the nonce, and the communication session identification information of at least one of the token issuance requests received in Steps S204and S212, as the first identification information.

Having received the login request, the authentication page12D of the client terminal12displays an authentication screen for allowing the user to log in the information processing apparatus11(Step S220). The user inputs authentication information (a user ID and a password) to the client terminal12, referring to the authentication screen.

The authentication page129of the client terminal12transmits an authorization permission request including the authentication information (the user ID and the password) and the first identification information included in the login request received in Step3218, to the information processing apparatus11(Step3222).

The operation in Steps S216to S222is the same as the operation in Steps S116to S120in the first embodiment (seeFIG. 2).

Upon receipt of the token issuance request including the first public key from the client terminal12in Step S212, the issuer11F of the information processing apparatus11transmits an access token generation request including the first public key and a signature appending request to the resource providing apparatus17(Step S224). Assuming that the resource providing apparatus be a device on a private network such as a home network, in general, the information processing apparatus11may not be able to normally access the resource providing apparatus17due to the influence of a firewall, for example. For this reason, the resource providing apparatus17may constantly establish a communication channel with the information processing apparatus11using power-ON as a trigger, by a normally connected communication protocol such as WebSocket, to issue the access token generation request through the WebSocket connection. Alternatively, prior to the token issuance request (Step S204), the service page120(OAuth client) loaded on the Web browser may try to access the intended resource providing apparatus17. At this point the service page12C does not have an access token, therefore, the resource providing apparatus17may be redirected to an authorization end point (/authorize) of the information processing apparatus to establish WebSocket connection ng the access attempt as a trigger and receive the access token generation request.

The generator17F of the resource providing apparatus17generates a sender constrained token (access token) for the client terminal12, using the first public key included in the access token generation request received in Step S224(Step S226).

Then, the signature adder17G of the resource providing apparatus17appends the third signature to the sender constrained token (access token) generated in Step S226, using the third private key generated in Step S200(Step S228).

The signature adder170stores the generated access token and the first public key included in the access token generation request received in Step S224in association with each other (Step S230).

The communicator16A of the resource providing apparatus17transmits the access token with the third signature generated in Steps S226and S228to the information processing apparatus11(Step S231). Upon receiving the access token with the third signature from the resource providing apparatus17, the issuer ilk of the information processing apparatus11issues the access token (Step S232).

As described above, the issuer115of the information processing apparatus11may generate the sender constrained token to issue the access token. The information processing apparatus11may request the resource providing apparatus17to append the third signature.

The transmitter10B of the information processing apparatus11transmits access-token response information including the access token with the third signature received in Step S232to the client terminal12(Step S234).

Upon receipt of the access-token response information in Step3234, the service page120of the client terminal12stores the first public key and the access token included therein in association with each other (Step S236). The access token stored in Step S236has been generated by the information processing apparatus11or the resource providing apparatus17and appended with the third signature by the resource providing apparatus17.

Next, the service page120of the client terminal12transmits a resource request including the access token with the third signature stored in Step S236to the resource providing apparatus17identified by the third identification information (Step S238).

Having received the resource request in Step S238, the nonce issuer165of the resource providing apparatus17issues a nonce for the client terminal12(Step S240). The nonce issuer165transmits once information on the nonce issued in Step S240to the client terminal12(Step S242). The second embodiment describes the example that the nonce issuer165transmits the nonce to the client terminal12.

Having received the nonce in Step S242, the service page12C of the client terminal12transmits a resource request including the access token with the third signature stored in Step S236and the nonce received in Step S242to the resource providing apparatus17identified by the third identification information (Step S244).

The operation in Steps S234to S244is the same as the operation in Steps S128to S138in the first embodiment (seeFIG. 2).

The access token verifier16C of the resource providing apparatus17verifies the access token with the third signature included in the resource request received in Step3244(Step3246). The access token verifier16C verifies the access token with the third signature by determining whether it has been stored in Step S230. That is, in the second embodiment, the access token verifier16C verifies the access token without inquiring of the information processing apparatus11. It is assumed that that verification be successful.

The responder162of the resource providing apparatus17provides resources to the service page12C of the client terminal12(Step S248).

As described above, when receiving a token issuance request additionally including the third identification information of the resource providing apparatus17which is requested to provide resources, the information processing apparatus11according to the second embodiment issues an access token to be usable by the resource providing apparatus17identified by the third identification information. That is, the information processing apparatus11issues the access token being a sender constrained token to be usable only by the client terminal12which has transmitted the token issuance request, and the resource providing apparatus17which the client terminal12requests to provide resources.

Thus, the information processing apparatus1according to the second embodiment can further limit the usage of the access token and further improve the security of the access token, in addition to the effects of the first embodiment.

Further, the information processing apparatus11according to the second embodiment transmits the access permission request from the client terminal12, being the transmission source of the token issuance request, to the resource providing apparatus17identified by the third identification information included in the token issuance request. In response to the access permission request, the resource providing apparatus17permits the client terminal12indicated by the access permission request to access. Thus, the information processing apparatus11can control the resource providing apparatus17to selectively permit the access of client terminal12.

Thus, the information processing apparatus11according to the second embodiment can further improve the security of the access token, in addition to the above effects.

Further, in the second embodiment, the resource providing apparatus17, which receives a request for providing resources from the client terminal12, appends the third signature to the access token. Thus, in the second embodiment, the access token issued to the client terminal12is appended with the third signature by the resource providing apparatus17.

That is, in the second embodiment, the resource providing apparatus17does not need to inquire of the information processing apparatus11every time the access token included in the resource request is received from the client terminal12and verified. The information processing apparatus11receives no inquiries about the verification of the access token from the resource providing apparatus17. This makes it possible for the information processing system lit according to the second embodiment to reduce the load on both the information processing apparatus11and the resource providing apparatus17, in addition to the above effects.

Furthermore, in the second embodiment, the resource providing apparatus17manages the access token. This can reduce the management load of the access token on the information processing apparatus11or reduce operation and management costs thereof.

Hardware Configuration

FIG. 5is a diagram illustrating an exemplary hardware configuration of the main elements of the information processing apparatus10, the information processing apparatus11, the client terminal12, the service providing apparatus14, the resource providing apparatus16, and the resource providing apparatus17according to the first r second embodiment. The information processing apparatus10, the information processing apparatus11, the client terminal12, the service providing apparatus14, the resource providing apparatus16, and the resource providing apparatus17according to the first or second embodiment include a control device401, a main storage402, an auxiliary storage403, a display404, an input405, and a communication device406. The control device401, the main storage402, the auxiliary storage403, the display404, the input405, and the communication device406are connected to one another through a bus410.

The control device401reads a program from the auxiliary storage403to the main storage402and executes the program. The control device401represents a general-purpose processor such as a central processing unit (CPU). The main storage402represents a memory, such as a read only memory (ROM) and a random access memory (RAM). Examples of the auxiliary storage403include a memory card and a hard disk drive (HDD).

The display404displays information. The display404is, for example, a liquid crystal display. The input405receives information. Examples of the input405include a hardware key, a keyboard, and a mouse. The display404and the input405may be a liquid crystal touch panel including both a display function and an input function. The communication device406communicates with the other apparatuses and devices.

A program executed by the information processing apparatus10, the information processing apparatus11, the client terminal12, the service providing apparatus14, the resource providing apparatus16, and the resource providing apparatus17according to the first or second embodiment is stored in an installable or executable file format in a computer-readable storage medium, such as a CD-ROM, a memory card, a CD-R, or a digital versatile disk (DVD), and is provided as a computer program product.

The program executed by the information processing apparatus10, the information processing apparatus11, the client terminal12, the service providing apparatus14, the resource providing apparatus16, and the resource providing apparatus17according to the first or second embodiment may be stored in a computer connected to a network, such as the Internet, and downloaded and provided through the network. The program executed by the information processing apparatus10, the information processing apparatus11, the client terminal12, the service providing apparatus14, the resource providing apparatus16, and the resource providing apparatus17according to the first or second embodiment may be provided through the network, such as the Internet, without being downloaded.

The program executed by the information processing apparatus10, the information processing apparatus11, the client terminal12, the service providing apparatus14, the resource providing apparatus16, and the resource providing apparatus17according to the first or second embodiment may be incorporated into the ROM in advance.

The program executed by the information processing apparatus10, the information processing apparatus11, the client terminal12, the service providing apparatus14, the resource providing apparatus16, and the resource providing apparatus17according to the first or second embodiment has a module configuration including functions implementable by the program among the functional configurations of each of the apparatuses.

The control device401reads and executes a program from a storage medium, such as the auxiliary storage403, to thereby load the functions implementable by the program on the main storage402. That is, the functions implementable by the program are generated in the main storage402.

Part of the functions of the information processing apparatus10, the information processing apparatus11, the client terminal12, the service providing apparatus14, the resource providing apparatus16, and the resource providing apparatus17according to the first or second embodiment may be implemented by hardware such as an IC.