Abstract:
A disclosed mediation apparatus collects data of transactions between a provider holding data of a user and a terminal of the user, for authorizing utilization of the data of the user by a consumer, and stores matching data to determine whether response data received from the provider at next time and subsequent times is substantially the same as the response data previously received and reply data used when sending answer data to the provider into an automatic response data storage unit. Thus, the mediation apparatus automatically respond on behalf of the terminal of the user at the next time and subsequent times. Therefore, it is possible to simplify user operations.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application is a continuing application, filed under 35 U.S.C. section 111(a), of International Application PCT/JP2010/063429, filed Aug. 6, 2010. 
     
    
     FIELD 
       [0002]    This technique relates to a mediation technique for communication between computers. 
       BACKGROUND 
       [0003]    When a user stores data in a first server, and has a second server use the data stored in the first server, a protocol so called “OAuth” begins to be used. OAuth will be explained using  FIG. 1 , simply. 
         [0004]    As an assumption in  FIG. 1 , a user stores its own data in a provider. In addition, a consumer registers itself in the provider in advance. Then, the user instructs the consumer to obtain an access right to its own data stored in the provider (step ( 1 )). As a result, the consumer accesses the provider (step ( 2 )), and obtains an unauthorized request token R 0  from the provider (step ( 3 )). After that, the consumer has the user redirect to the provider (step ( 4 )). At this time, the consumer attaches the unauthorized request token R 0  to Uniform Resource Locator (URL) parameters to send the unauthorized request token R 0  to the provider through the user. In response to an access from the user, the provider transmits data to request the user to authorize acquisition of the access right to the provider by the consumer, to the user (step ( 5 )). In response to receipt of the data, the user transmits notification representing the acquisition of the access right by the consumer is allowed to the provider (step ( 6 )). Then, the provider changes the unauthorized request token R 0  to the authorized request token R 1 , and has the user redirect to the consumer (step ( 7 )). At this time, the provider attaches the authorized request token R 1  to the URL parameters to send the authorized request token R 1  to the consumer through the user. 
         [0005]    After that, the consumer transmits the authorized request token R 1  to the provider (step ( 8 )), and obtains an access token A from the provider (step ( 9 )). Then, the consumer obtains the data of the user from the provider by using this access token A (step ( 10 )). 
         [0006]    Generally, not only plural consumers but also plural providers exist, and the aforementioned processing is carried out for each combination. In addition, because the valid term is set for the access right, the same processing is carried out when the valid term is expired. This is complex for the user. 
         [0007]    A conventional technique exists in which an intermediate authentication server is introduced in an authentication mechanism so called “OpenID” to secure the confirmation of the identity. However, this technique cannot resolve the aforementioned problem. Moreover, there is a proxy authentication. For example, a proxy authentication apparatus accesses a server that is connected through a network in response to a request from a client. In this proxy authentication apparatus, plural authentication confirmation logics exist to identify a response representing that the user authentication is incomplete. Then, the proxy authentication apparatus determines based on whether or not the response from the server matches either of the plural authentication confirmation logics, whether the user authentication is required or not. When it is determined that the user authentication is required, the proxy authentication apparatus carries out the user authentication procedure with the server according to the authentication procedure defined in advance in association with the authentication confirmation logic that matches the response from the server. This technique does not assume the situation like in the aforementioned OAuth, and cannot be applied, simply. 
       SUMMARY 
       [0008]    This mediation processing method is executed by a mediation apparatus respectively communicating with a first apparatus holding data of a user, a second apparatus obtaining and using data of the user from the first apparatus and a terminal of the user. Then, this method includes: (A) obtaining an identifier of the user and an identifier of the second apparatus from the terminal of the user, and storing obtained data into a data storage unit; (B) upon receipt of a first response including the identifier of the first apparatus and first data that the first apparatus issues and that represents that use of the data of the user by the second apparatus is unauthorized, from the second apparatus after accessing the second apparatus, confirming whether or not a combination of the identifier of the user, the identifier of the second apparatus, which are stored in the data storage unit, and an identifier of the first apparatus is stored in an automatic response data storage unit storing data for an automatic response for the first apparatus; (C) upon detecting that the combination is not stored in the automatic response data storage unit, transmitting the first response to the terminal of the user; causing the terminal of the user to perform a transaction for an authorization for the use of the data of the user by the second apparatus with the first apparatus through the mediation apparatus to store data of the transaction into the data storage unit; and (D) upon receipt of a response including second data representing that the use of the data of the user by the second apparatus is authorized from the first apparatus, storing matching data and reply data, which are generated from the data of the transaction, which is stored in the data storage unit, into the automatic response data storage unit as correlated with the identifier of the user, the identifier of the second apparatus and the identifier of the first apparatus. 
         [0009]    The object and advantages of the embodiment will be realized and attained by means of the elements and combinations particularly pointed out in the claims. 
         [0010]    It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the embodiment, as claimed. 
     
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         [0011]      FIG. 1  is a diagram illustrating an outline of a processing in “OAuth”; 
           [0012]      FIG. 2  is a diagram illustrating an outline of a system relating to an embodiment; 
           [0013]      FIG. 3  is a functional block diagram of a mediation apparatus; 
           [0014]      FIG. 4  is a diagram depicting a processing flow to explain operations of the system in the embodiment; 
           [0015]      FIG. 5  is a diagram depicting a processing flow to explain the operations of the system in the embodiment; 
           [0016]      FIG. 6  is a diagram depicting an example of data stored in an automatic response DB; 
           [0017]      FIG. 7  is a diagram depicting a processing flow to explain operations of the system in the embodiment; 
           [0018]      FIG. 8  is a diagram depicting an example of an authorization request page; 
           [0019]      FIG. 9  is a diagram depicting a processing flow to explain the operations of the system in the embodiment; 
           [0020]      FIG. 10  is a diagram depicting an example of authorization request page data; 
           [0021]      FIG. 11  is a diagram depicting an example of answer data; 
           [0022]      FIG. 12  is a diagram depicting an example of matching data; 
           [0023]      FIG. 13  is a diagram depicting a processing flow to explain the operations of the system in the embodiment; 
           [0024]      FIG. 14  is a diagram depicting a processing flow to explain the operations of the system in the embodiment; 
           [0025]      FIG. 15  is a diagram illustrating an example of response data; 
           [0026]      FIG. 16  is a diagram depicting an example of generated answer data; 
           [0027]      FIG. 17  is a diagram depicting a processing flow to explain the operations of the system in the embodiment; 
           [0028]      FIG. 18  is a diagram depicting a processing flow to explain the operations of the system in the embodiment; and 
           [0029]      FIG. 19  is a functional block diagram of a computer. 
       
    
    
     DESCRIPTION OF EMBODIMENTS 
       [0030]      FIG. 2  illustrates an outline of a system relating to an embodiment of this technique. For example, one or plural provider apparatuses  7  that operate as a provider in OAuth, one or plural consumer apparatuses  9  that operate as a consumer in OAuth, one or plural user terminals  3  such as a personal computer, in which a Web browser is executed, and a mediation apparatus  5  that carries out a main processing in this embodiment are connected to a network  1  that is an Internet and the like. 
         [0031]    In the provider apparatus  7 , data of a user of the user terminal  3  is held, and a service desired by the user of the user terminal  3  is provided from the consumer apparatus  9 . The provider apparatus  7  is an apparatus that operates based on the conventional OAuth. On the other hand, the consumer apparatus  9  is an apparatus that basically operates based on OAuth, and also executes partially changed operations in order to use the mediation apparatus  5 . The user terminal  3  may be a normal personal computer that executes a normal Web browser, for example, as described above. 
         [0032]      FIG. 3  illustrates a functional block diagram of the mediation apparatus  5 . The mediation apparatus  5  has a relay processing unit  51 , a data storage unit  52  and an automatic response database (DB)  53 . The relay processing unit  51  performs a processing to mediate the communication between the user terminal  3  and the consumer apparatus  9 , and a processing to mediate the communication between the user terminal  3  and the provider apparatus  7 . Then, the relay processing unit  51  has a recording processing unit  511 , especially for the latter processing. The recording processing unit  511  generates data for the response processing unit  512  by using the data storage unit  52  to register the generated data into the automatic response DB  53 . Furthermore, the relay processing unit  51  also has a response processing unit  512  to automatically perform operations for the authorization of the access right to the consumer apparatus  9 , to the provider apparatus  7 , on behalf of the user. When receiving data from the provider apparatus  7 , the response processing unit  512  transmits transmission data to the provider apparatus  7  by using data stored in the automatic response DB  53  to the provider apparatus  7  on behalf of the user terminal  3 . 
         [0033]    Next, operations of the system illustrated in  FIG. 2  will be explained by using  FIGS. 4 to 18 . As an assumption, the user of the user terminal  3  has already logged in the consumer apparatus  9 , provider apparatus  7  and mediation apparatus  5  using a technique such as a single sign-on. In a case in which such an assumption is not satisfied, the user logs in the respective apparatuses by using a user identifier (ID) and a password when the user firstly accesses. 
         [0034]    First, the user operates the user terminal  3  to cause the user terminal  3  to transmit a request to request the consumer apparatus  9  to execute a specific service using specific data of the user, which is stored in the provider apparatus  7 , to the consumer apparatus  9  (step S 1 ). When the consumer apparatus  9  receives the request to request to perform the specific service using the specific data of the user, which is stored in the provider apparatus  7  (step S 3 ), the consumer apparatus  9  sends back a response for the redirect to cause the user terminal  3  to access the mediation apparatus  5 , to the user terminal  3  (step S 5 ). 
         [0035]    When the user terminal  3  receives the response for the redirect to cause the user terminal  3  to access the mediation apparatus  5  from the consumer apparatus  9 , the user terminal  3  accesses the mediation apparatus  5 , as instructed (step S 7 ). In this access by the redirect, the user ID and a Fully Qualified Domain Name (FQDN) of the consumer apparatus  9  (which may be an identifier other than FQDN) are transmitted to the mediation apparatus  5 . 
         [0036]    The relay processing unit  51  of the mediation apparatus  5  receives the user ID and FQDN of the consumer apparatus  9  that is a redirecting source from the user terminal  3 , and stores the received data into the data storage unit  52  (step S 9 ). Then, the relay processing unit  51  identifies a predetermined access destination of the consumer apparatus  9  from the FQDN of the consumer apparatus  9  that is the redirecting source and the like, and accesses the identified access destination (step S 11 ). As a result, a requesting source of the specific service becomes the mediation apparatus  5 . 
         [0037]    In response to the access from the mediation apparatus  5 , the consumer apparatus  9  transmits a request for a request token, which includes a consumer key that has been obtained in advance from the provider apparatus  7  or the like, to the provider apparatus  7  (step S 13 ). Except for a point that this step is executed in response to the access from the mediation apparatus  5 , this step is the same as that in the conventional art, so further explanation is omitted. When the provider apparatus  7  receives a request for the request token from the consumer apparatus  9  (step S 15 ), the provider apparatus  7  transmits an unauthorized request token to the consumer apparatus  9  (step S 17 ). This step is also the same as that in the conventional art, so further explanation is omitted. The consumer apparatus  9  receives the unauthorized request token from the provider apparatus  7  (step S 19 ). This step is also the same as that in the conventional art, so further explanation is omitted. The processing shifts to a processing in  FIG. 5  through a terminal A. 
         [0038]    Shifting to the explanation of the processing in  FIG. 5 , the consumer apparatus  9  sends back a response with the unauthorized request token, which causes the mediation apparatus  5  to redirect to the provider apparatus  7 , to the mediation apparatus  5  (step S 21 ). This response includes the FQDN (which may be an identifier other than the FQDN) of the provider apparatus  7 . The relay processing unit  51  of the mediation apparatus  5  receives the response with the unauthorized request token, which causes to redirect to the provider apparatus  7 , from the consumer apparatus  9  (step S 23 ). Because this response includes the FQDN of the provider apparatus  7 , the relay processing unit  51  of the mediation apparatus  5  confirms according to the received response, whether or not a combination of the user ID and the FQDN of the consumer apparatus  9 , which are stored in the data storage unit  52 , and the FQDN of the provider apparatus  7  has been registered in the automatic response DB  53  (step S 25 ). When a corresponding record exists, that record is read out. 
         [0039]    The automatic response DB  53  stores data as illustrated in  FIG. 6 , for example. In the example of  FIG. 6 , one or plural combinations are registered, each having a user ID, FQDN of the consumer apparatus  9 , FQDN of the provider apparatus  7 , matching data generated from data of a response received from the provider apparatus  7  and reply data generated from data transmitted to the provider apparatus  7 . The user ID, FQDN of the consumer apparatus  9  and FQDN of the provider apparatus  7  are keys. The data format of  FIG. 6  is a mere example, and for each combination of matching data and replay data, one record may be generated, and data representing the turn may be attached to each record. 
         [0040]    When a record concerning a combination of the user ID, FQDN of the consumer apparatus  9  and FQDN of the provider apparatus  7  has been registered in the automatic response DB  53  (step S 27 : Yes route), the processing shifts to a processing in  FIG. 14  through a terminal B. The processing subsequent to the terminal B is a processing when an automatic response is carried out. 
         [0041]    When a record regarding the combination of the user ID, FQDN of the consumer apparatus  9  and FQDN of the provider apparatus  7  has not been registered in the automatic response DB  53  (step S 27 : No route), the relay processing unit  51  of the mediation apparatus  5  stores the FQDN of the provider apparatus  7  in the automatic response DB  53  as correlated with the user ID and FQDN of the consumer apparatus  9  (step S 29 ). In the processing subsequent to this step, data concerning a transaction between the user terminal  3  and the provider apparatus  7  will be collected. 
         [0042]    Then, the recording processing unit  511  of the mediation apparatus  5  changes the redirecting destination of the response received from the consumer apparatus  9  to the mediation apparatus  5 , and then transmits the response with the unauthorized request token, which causes the user terminal  3  to redirect to the mediation apparatus  5 , to the user terminal  3  (step S 31 ). When the user terminal  3  receives the response with the unauthorized request token from the mediation apparatus  5  (step S 33 ), the user terminal  3  transmits a request with the received and unauthorized request token to the mediation apparatus  5  in response to a redirect instruction (step S 35 ). The recording processing unit  511  of the mediation apparatus  5  receives the request with the unauthorized request token from the user terminal  3  (step S 37 ). The processing shifts to a processing in  FIG. 7  through a terminal C. 
         [0043]    Shifting to the explanation of the processing in  FIG. 7 , the recording processing unit  511  transfers the request with the unauthorized request token to the provider apparatus  7  (step S 39 ). When the provider apparatus  7  receives the request with the unauthorized request token from the mediation apparatus  5  (step S 41 ), the provider apparatus  7  transmits an authorization request page data to request to allow the access right to the consumer apparatus  9  to the mediation apparatus  5  (step S 43 ). The recording processing unit  511  of the mediation apparatus  5  receives the authorization request page data, and stores the authorization request page data in the data storage unit  52  in association with the user ID, FQDN of the provider apparatus  7  and FQDN of the consumer apparatus  9  (step S 45 ). 
         [0044]    In addition, the recording processing unit  511  transfers the received authorization request page data to the user terminal  3  (step S 47 ). The user terminal  3  receives the authorization request page data from the mediation apparatus  5 , and displays the page data on a display apparatus (step S 49 ). For example, a display as illustrated in  FIG. 8  is made on the display apparatus. In an example of  FIG. 8 , a message representing that the consumer requests an access to data “XXXX”, valid period of the access right, an “approve” button and “deny” button are displayed. The user clicks the “approve” button or “deny” button. Normally, the “approve” button is clicked. In this embodiment, as an assumption, the login to the provider apparatus  7  can be omitted based on a technique such as the single sign-on, however, when such a technique is not used, the user logs in the provider apparatus  7  using the user ID and password, for example. Furthermore, in the example of  FIG. 8 , a screen example is illustrated in which the approval or denial can be instructed in one screen, however, the approval or denial may be inputted throughout plural screens. 
         [0045]    The user terminal  3  transmits an answer, namely, data representing the approval or denial to the mediation apparatus  5  in response to the click from the user (step S 51 ). The recording processing unit  511  of the mediation apparatus  5  receives the answer from the user terminal  3 , and stores data of the answer in the data storage unit  52  as correlated with the user ID, FQDN of the provider apparatus  7  and FQDN of the consumer apparatus  9  (step S 53 ). Then, the recording processing unit  511  of the mediation apparatus  5  transfers the received reply to the provider apparatus  7  (step S 55 ). The provider apparatus  7  receives the reply from the mediation apparatus  5  (step S 57 ). The processing shifts to the processing in  FIG. 9  through terminals D and E. 
         [0046]    Shifting to the explanation of the processing in  FIG. 9 , after the step S 55 , the recording processing unit  511  of the mediation apparatus  5  generates reply data and matching data, which are to be registered in the automatic response DB  53 , from the authorization request page data received at the step S 45  and data of the answer received at the step S 53 , and stores the generated data into the data storage unit  52  as correlated with the user ID, FQDN of the provider apparatus  7  and FQDN of the consumer apparatus  9  (step S 59 ). 
         [0047]    This processing will be explained by using  FIGS. 10 to 12 . In case of the authorization request page data as illustrated in  FIG. 8 , data of tags is included as illustrated in  FIG. 10 . In other words, tags relating to the answer of the approval and denial are included between a &lt;form&gt; tag and a &lt;/form&gt; tag. On the other hand, when the “approve” button is clicked, a POST message in a Hyper Text Transfer Protocol (HTTP), which has data as illustrated in  FIG. 11  in a body, is transmitted as data of the answer. As illustrated in  FIG. 11 , plural combinations of a key of a request parameter and its value are coupled with “&amp;”. The keys of the request parameters “approve”, “hidden_key 1 ” and “hidden_key 2 ” are values of the attribute “name” within an &lt;input&gt; tag in  FIG. 10 . In addition, as values of the keys of the request parameters, values of the attribute “value” within the same &lt;input&gt; tag are set. Specifically, as for the key of the request parameter “approve”, a value “approval” of the attribute “value” in the same &lt;input&gt; tag as that of the attribute name=“approve” is set. In addition, as for the key of the request parameter “hidden_key 1 ”, a value “hidden_val 1 ” of the attribute “value” in the same &lt;input&gt; tag as that of the attribute name=“hidden_key 1 ” is set. Furthermore, as for the key of the request parameter “hidden_key 2 ”, a value “hidden_val 2 ” of the attribute “value” in the same &lt;input&gt; tag as that of the attribute name=“hidden_key 2 ” is set. 
         [0048]    Thus, by extracting part of the authorization request page data, which is associated with the answer data, matching data to confirm whether or not the substantially same authorization request page data was transmitted is generated. The authorization request page data may include plural &lt;form&gt; tags, and therefore, in order to identify which &lt;form&gt; tag is, attributes “id” and “name” of the &lt;form&gt; tag and their values, and an attribute “action” representing a transmission destination of the answer data and its value are also extracted. “Method” is also extracted, because POST or GET may be used. 
         [0049]    However, the matching data does not include data that may change for each transmission of the authorization request page data or after a certain period elapsed. For example, because a value of the attribute “value” in the &lt;input&gt; tag may be changed, the matching data does not include the attribute “value” and its value. A well-known syntax analysis is used for this extraction processing. 
         [0050]    For example, in the example of  FIG. 10 , data illustrated in  FIG. 12  is extracted as the matching data, and the matching data is stored in the data storage unit  52 . In the example of  FIG. 12 , the top represents an attribute and its value, which are keys within the &lt;form&gt; tag, and  3  following lines are data to be used in the answer data. 
         [0051]    On the other hand, keys of the request parameters are extracted from the answer data. In other words, by extracting “approve”, “hidden_key 1 ” and “hidden_key 2 ”, the reply data is generated. Because a value of the key of the request parameter may vary, it is not included in the reply data. 
         [0052]    In case of the Web page data in another format, the matching data and reply data are extracted according to another format. For example, by using a technique explained in the column of the background art or Japan Laid-Open Patent Publication No. 2006-107007, the matching data and reply data are extracted along with the procedure. 
         [0053]    Returning to the explanation of the processing in  FIG. 9 , the provider apparatus  7  transmits data of a next response to the mediation apparatus  5  (step S 61 ). The recording processing unit  511  of the mediation apparatus  5  receives the next response data (step S 63 ), and confirms whether or not the authorized request token is attached (step S 65 ). The attachment of the authorized request token means that the confirmation for his or her intention with respect to the approval of the access right to the consumer apparatus  9  has been completed. Therefore, after shifting to the step S 69 , the processing of the recording processing unit  511  is terminated. In this case, the response received from the provider apparatus  7  is a response with the authorized request token, which causes to redirect to the consumer apparatus  9 . 
         [0054]    On the other hand, when no authorized request token is attached to the received response, the recording processing unit  511  stores data of the received response into the data storage unit  52  (step S 67 ), because there is a next procedure, and the processing returns to the step S 47  through a terminal H. Namely, matching data and reply data in the next procedure are generated. 
         [0055]    There is also a case where, when the user selects “deny” in the screen in  FIG. 8  or any error occurs, the transaction between the mediation apparatus  5  and the provider apparatus  7  may be terminated without receiving the authorized request token. In such a case, the matching data, reply data and data regarding the transaction, which are stored in association with a combination of the user ID, FQDN of the provider apparatus  7  and FQDN of the consumer apparatus  9 , are left in the data storage unit  52  without being registered in the automatic response DB  53 . In such a case, by discarding data left in the data storage unit  52  when a predetermined period elapsed since data was firstly or finally stored, data for the transaction that is not normally completed is discarded. 
         [0056]    When the response with the authorized request token is received, the recording processing unit  511  transfers the response with the authorized request token, which causes to redirect to the consumer apparatus  9 , after changing the destination to the user terminal  3  (step S 69 ). The user terminal  3  receives the response with the authorized request token, which causes to redirect to the consumer apparatus  9  (step S 71 ). The processing of the user terminal  3  shifts to a processing in  FIG. 13  through a terminal J. 
         [0057]    On the other hand, the recording processing unit  511  of the mediation apparatus  5  registers a combination of the matching data and the reply data, which are stored in the data storage unit  52 , in the automatic response DB  53  as correlated with a combination of the user ID, FQDN of the provider apparatus  7  and FQDN of the consumer apparatus  9  (step S 73 ). Thus, after confirming that the transaction between the user terminal  3  and the provider apparatus  7  has normally been completed, the data is written into the automatic response DB  53 . Therefore, appropriate data is stored in the automatic response DB  53 . 
         [0058]    Shifting to the explanation of the processing in  FIG. 13 , the user terminal  3  transmits a request with the authorized request token to the consumer apparatus  9  by the redirect (step S 75 ). Then, the consumer apparatus  9  receives the request with the authorized request token from the user terminal  3  (step S 77 ). As a result, the consumer apparatus  9  has obtained the authorized request token. Although it is not illustrated, after this, the consumer apparatus  9  may send a response for an instruction to execute a specific service, however, this point is not a main port ion of this embodiment. Therefore, further explanation is omitted. 
         [0059]    After that, the consumer apparatus  9  transmits an acquisition request for an access token, which includes the authorized request token and the like, to the provider apparatus  7  (step S 83 ). When the provider apparatus  7  receives the acquisition request for the access token, which includes the authorized request token and the like, from the consumer apparatus  9  (step S 85 ), the provider apparatus  7  confirms the authorized request token and the like, and transmits the access token to the consumer apparatus  9  if there is no problem (step S 87 ). The consumer apparatus  9  receives the access token from the provider apparatus  7  (step S 89 ). The following steps are the same as those in the conventional art, so the explanation is omitted. 
         [0060]    By carrying out the aforementioned processing, data for the automatic response has been registered in the automatic response DB  53 . 
         [0061]    Next, a case where it is determined at the step S 27  in  FIG. 5  that the combination of the user ID, FQDN of the provider apparatus  7  and FQDN of the consumer apparatus  9  has been registered will be explained by using  FIGS. 14 to 18 . As described above, the matching data and reply data, which are correlated with the combination of the user ID, FQDN of the provider apparatus  7  and FQDN of the consumer apparatus  9 , are read from the automatic response DB  53 . 
         [0062]    The response processing unit  512  of the mediation apparatus  5  transmits a request with the unauthorized request token, which was received at the step S 23 , to the provider apparatus  7  (step S 91 ). When the provider apparatus  7  receives the request with the unauthorized request token from the mediation apparatus  5  (step S 93 ), the provider apparatus  7  performs a predetermined processing to transmit response data (step S 95 ). The response processing unit  512  of the mediation apparatus  5  receives the response data from the provider apparatus  7 , and stores the received response data in a storage device such as a main memory (step S 97 ). Then, the response processing unit  512  confirms whether or not the received response data matches the matching data read from the automatic response DB  53  (step S 99 ). Specifically, after confirming whether or not the response data includes a &lt;form&gt; tag including the attribute and attribute name (the first line in  FIG. 12 ), which is a key and included in the matching data, and it is confirmed whether or not &lt;input&gt; tags to be matched (the second line to fourth line in  FIG. 12 ) are included between that &lt;form&gt; tag and a corresponding &lt;/form&gt; tag. When both of conditions are satisfied, it is determined that the response data matches the matching data. Because the step S 99  may be carried out plural times, the matching data and reply data are used in order of the registration in the automatic response DB  53  (when the ranking is made, the order follows the ranking, and when the ranking is not made, the order follows the arrangement in the DB). 
         [0063]    When the response data does not match the matching data (step S 101 : No route), the processing shifts to a processing in  FIG. 18  through a terminal F. On the other hand, when the response data matches the matching data (step S 101 : Yes route), the response processing unit  512  generates answer data from the read reply data and the received response data, and transmits the answer data to the provider apparatus  7  (step S 103 ). Specifically, because the reply data includes an attribute value of the attribute “name” in the &lt;input &gt; tag, which is identified in the matching data, as the key of the request parameter, the response processing unit  512  reads out an attribute value of the attribute “value” in the same &lt;input&gt; tag in the response data to couple the attribute values by using “=”. When the plural keys of the request parameters are included in the reply data, they are coupled using “&amp;”, and placed in the body of the POST message in HTTP. As the transmission destination, the attribute value of the attribute “action” in the &lt;form&gt; tag is used. 
         [0064]    At the registration, the response data as illustrated in  FIG. 10  (the aforementioned authorization request page data) was received. However, even when the response data as illustrated in  FIG. 15  is received, answer data as illustrated in  FIG. 16  can be generated when carrying out the aforementioned processing. In other words, the attribute “name” in the &lt;input&gt; tag is “approve”, and the attribute value of the attribute “value” is “allowance” instead of “approval”. Therefore, “approve=allowance” is obtained. In addition, the attribute “name” in the &lt;input&gt; tag is “hidden_key 1 ”, and the attribute value of the attribute “value” is “secret_val 1 ” instead of “hidden_val 1 ”. Therefore, “hidden_key 1 =secret_val 1 ” is obtained. Furthermore, the attribute “name” in the &lt;input&gt; tag is “hidden_key 2 ”, and the attribute value of the attribute “value” is “secret_val 2 ” instead of “hidden_val 2 ”. Therefore, “hidden_key 2 =secret_val 2 ” is obtained. Then, they are coupled by using “&amp;”. 
         [0065]    Thus, it is possible to generate answer data appropriate for the response data at this time from the reply data and the response data. 
         [0066]    The provider apparatus  7  receives the answer data from the mediation apparatus  5  (step S 105 ), and generates next response data by carrying out a predetermined processing to transmit the next response data to the mediation apparatus  5  (step S 107 ). The response processing unit  512  of the mediation apparatus  5  receives the next response data from the provider apparatus  7  (step S 109 ), and determines whether or not the authorized request token is attached to the next response data (step S 111 ). When the authorized request token is not attached (step S 111 : No route), the processing returns to the step S 99  in order to execute a processing with respect to the matching data and reply data on the next turn. 
         [0067]    On the other hand, when the authorized request token is attached to the next response data (step S 111 : Yes route), this means that the procedure for the authorization of the access right to the consumer apparatus  9  is successfully completed. Therefore, the processing shifts to a processing in  FIG. 17  through a terminal G. Incidentally, the response with the authorized request token, which causes to redirect to the consumer apparatus  9 , was received. 
         [0068]    Shifting to the explanation of the processing in  FIG. 17 , the response processing unit  512  of the mediation apparatus  5  transfers the response with the authorized request token, which causes to redirect to the consumer apparatus  9 , to the user terminal  3  (step S 113 ). When the user terminal  3  receives the response with the authorized request token from the mediation apparatus  5  (step S 115 ), the user terminal  3  transmits a request with the authorized request token to the consumer apparatus  9  in response to an instruction of the redirect (step S 117 ). The consumer apparatus  9  receives the request with the authorized request token from the user terminal  3  (step S 119 ). The subsequent processing is the same as the processing of the step S 83  and subsequent processing in  FIG. 13 . Therefore, the explanation is omitted. 
         [0069]    By doing so, the user had the mediation apparatus  5  perform the operations. Therefore, it becomes possible to simply approve the access right to the consumer apparatus  9 . 
         [0070]    On the other hand, a processing executed when it is determined at the step S 101  in  FIG. 14  that the response data does not match the matching data will be explained using  FIG. 18 . The response processing unit  512  of the mediation apparatus  5  deletes data including a combination of the user ID, FQDN of the provider apparatus  7  and FQDN of the consumer apparatus  9  in the automatic response DB  53  (step S 121 ). This is because it is determined that the intention confirmation procedure to approve the access right is largely changed, and data before the change cannot be used. Therefore, such data is deleted. Then, the response processing unit  512  notifies the user terminal  3  of an error occurrence (step S 123 ). The user terminal  3  receives the error occurrence notification from the mediation apparatus  5 , and displays the error occurrence notification on a display apparatus (step S 125 ). By carrying out such a processing, the user can recognize that data for the automatic response registered in the mediation apparatus  5  becomes invalid, and the procedure is carried out again from the initial step. Moreover, the consumer apparatus  9  and provider apparatus  7  are left during the processing. However, typically the time-out occurs, so special problem does not occur. 
         [0071]    Although the embodiment of this technique was explained, this technique is not limited to the embodiment. For example, the functional block diagram illustrated in  FIG. 3  is a mere example, and does not always correspond to an actual program module configuration. 
         [0072]    Moreover, as for the processing flow of the aforementioned processing, as long as the results do not change, the processing turns may be exchanged or plural steps may be executed in parallel. 
         [0073]    In addition, the aforementioned mediation apparatus  5 , consumer apparatus  9  and provider apparatus  7  are computer devices as illustrated in  FIG. 19 . That is, a memory  2501  (storage device), a CPU  2503  (processor), a hard disk drive (HDD)  2505 , a display controller  2507  connected to a display device  2509 , a drive device  2513  for a removable disk  2511 , an input device  2515 , and a communication controller  2517  for connection with a network are connected through a bus  2519  as illustrated in  FIG.19 . An operating system (OS) and an application program for carrying out the foregoing processing in the embodiment, are stored in the HDD  2505 , and when executed by the CPU  2503 , they are read out from the HDD  2505  to the memory  2501 . As the need arises, the CPU  2503  controls the display controller  2507 , the communication controller  2517 , and the drive device  2513 , and causes them to perform necessary operations. Besides, intermediate processing data is stored in the memory  2501 , and if necessary, it is stored in the HDD  2505 . In this embodiment of this technique, the application program to realize the aforementioned functions is stored in the computer-readable, non-transitory removable disk  2511  and distributed, and then it is installed into the HDD  2505  from the drive device  2513 . It may be installed into the HDD  2505  via the network such as the Internet and the communication controller  2517 . In the computer as stated above, the hardware such as the CPU  2503  and the memory  2501 , the OS and the necessary application programs systematically cooperate with each other, so that various functions as described above in details are realized. 
         [0074]    The embodiments described above are summarized as follows: 
         [0075]    A mediation processing method relating to the embodiments is executed by a mediation apparatus respectively communicating with a first apparatus (e.g. provider apparatus) holding data of a user, a second apparatus (e.g. consumer apparatus) obtaining and using data of the user from the first apparatus and a terminal of the user. Moreover, this mediation processing method includes: (A) obtaining an identifier of the user and an identifier of the second apparatus from the terminal of the user, and storing obtained data into a data storage unit; (B) upon receipt of a first response including the identifier of the first apparatus and first data (e.g. unauthorized request token) that the first apparatus issues and that represents that use of the data of the user by the second apparatus is unauthorized, from the second apparatus after accessing the second apparatus, confirming whether or not a combination of the identifier of the user, the identifier of the second apparatus, which are stored in the data storage unit, and an identifier of the first apparatus is stored in an automatic response data storage unit (e.g. automatic response DB) storing data for an automatic response for the first apparatus; (C) upon detecting that the combination is not stored in the automatic response data storage unit, transmitting the first response to the terminal of the user; causing the terminal of the user to perform a transaction for an authorization for the use of the data of the user by the second apparatus with the first apparatus through the mediation apparatus to store data of the transaction, into the data storage unit; and (D) upon receipt of a response including second data (e.g. authorized request token) representing that the use of the data of the user by the second apparatus is authorized from the first apparatus, storing matching data and reply data, which are generated from the data of the transaction, which is stored in the data storage unit, into the automatic response data storage unit as correlated with the identifier of the user, the identifier of the second apparatus and the identifier of the first apparatus. 
         [0076]    Thus, storage of the data for the transaction is started at an appropriate timing that the first data is received and data that becomes a key has not been registered in the automatic response data storage unit. Moreover, the matching data and the reply data, which are used for the automatic response, are registered in the automatic response data storage unit at an appropriate timing that the second data is received. Thus, because appropriate data is registered in the automatic response data storage unit, it is possible for the user to omit the same operations at the next time and subsequent times, and the operations of the user are simplified. 
         [0077]    The mediation processing method relating to the embodiments may further include: (E) generating the reply data by extracting a key (or elements of arguments) of a request parameter from third data that is included in the data of the transaction, which is stored in the data storage unit, and is received from the terminal of the user; and (F) generating the matching data by extracting a portion including, as an attribute value of a predetermined attribute, the key of the request parameter that is included in the reply data from fourth data that is included in the data of the transaction and is received immediately before the first data from the first apparatus. 
         [0078]    Thus, the matching data enabling to identify the substantially same response at the automatic response and the reply data enabling to automatically generate appropriate answer data from the received response are generated. 
         [0079]    Moreover, the mediation processing method relating to the embodiments may further include: (G) upon detecting that the combination is stored in the automatic response data storage unit, reading the matching data and the replay data that are stored as correlated with the obtained identifier of the user, the obtained identifier of the second apparatus and the identifier of the first apparatus from the automatic response data storage unit; second transmitting the first response to the first apparatus; receiving second response from the first apparatus; (H) determining whether or not the second response includes the read matching data; (I) upon determining that the second response includes the matching data, generating answer data from the second response and the reply data; and third transmitting the answer data to the first apparatus. In this case, the second transmitting, the receiving and the determining may be repeated until it is determined that the second response includes the matching data and the second data is received from the first apparatus. By doing so, data stored in the automatic response data storage unit can be effectively utilized to make the user operations simplified. 
         [0080]    A system relating to the embodiments includes: (A) a first apparatus obtaining and using data of a user from a second apparatus holding the data of the user; (B) a terminal of the user; and (C) a mediation apparatus communicating with the terminal of the user, the first apparatus and the second apparatus. Then, the first apparatus transmits a first response that includes an identifier of the first apparatus and causes the terminal of the user to access the mediation apparatus in response to a request from the terminal of the user. 
         [0081]    Moreover, the mediation apparatus has (A) a relay processing unit that receives an identifier of the user and an identifier of the first apparatus, from the terminal of the user, and stores the received data into a data storage unit, and upon receipt of a second response including the identifier of the first apparatus and first data that the second apparatus issues and that represents that use of the data of the user by the first apparatus is unauthorized, from the first apparatus after accessing the first apparatus, confirms whether or not a combination of the identifier of the user, the identifier of the first apparatus, which is stored in the data storage unit, and an identifier of the second apparatus is stored in an automatic response data storage unit storing data for an automatic response for the second apparatus; and (B) a recording processing unit that, upon detecting that the combination is not stored in the automatic response data storage unit, transmits the second response to the terminal of the user, and causes the terminal of the user to perform a transaction for an authorization for the use of the data of the user by the first apparatus with the second apparatus through the mediation apparatus to store data of the transaction into the data storage unit, and upon receipt of a third response including second data representing that the use of the data of the user by the first apparatus is authorized from the second apparatus, stores matching data and reply data, which are generated from the data of the transaction, which is stored in the data storage unit, into the automatic response data storage unit as correlated with the identifier of the user, the identifier of the first apparatus and the identifier of the second apparatus. 
         [0082]    Incidentally, it is possible to create a program causing a computer to execute the aforementioned processing, and such a program is stored in a computer readable storage medium or storage device such as a flexible disk, CD-ROM, DVD-ROM, magneto-optic disk, a semiconductor memory, and hard disk. In addition, the intermediate processing result is temporarily stored in a storage device such as a main memory or the like. 
         [0083]    All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the invention and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions, nor does the organization of such examples in the specification relate to a showing of the superiority and inferiority of the invention. Although the embodiments of the present inventions have been described in detail, it should be understood that the various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the invention.