JP7803118B2 - Service providing system, service providing method and program - Google Patents

Description

The present invention relates to a service provision system, a service provision method, and a program.

Traditionally, there are cloud services that manage users by tenant (account), and service usage rights are managed by user/device in units called licenses. These cloud services offer guest invitations, which allow users who want to try the service to be added to the tenant for a limited period of time.

Patent Document 1 discloses technology that identifies users of external devices that are subject to access control, reducing the amount of work required by administrators to assign service usage rights to each user belonging to a tenant.

However, with conventional technology, when a device license is granted when inviting a user as a guest, there is a problem in that service usage permissions cannot be added without administrator action.

The present invention was made in consideration of the above, and aims to add service usage permissions without administrator action when granting a device license upon inviting a user as a guest.

In order to solve the above-mentioned problems and achieve the object, the present invention provides a system including: a tenant information storage unit that stores tenant information defining tenants for dividing a service provision range; a user information storage unit that is linked to the tenant information and stores user information used to identify users; a license information storage unit that stores license information that defines usage rights for services used by users; and an authentication management unit that manages the tenant information stored in the tenant information storage unit, the user information stored in the user information storage unit, and the license information stored in the license information storage unit, wherein , if the license type of the license information to be granted to a new user is a user license in which usage rights are granted for each user, the authentication management unit checks whether the usage rights remain, and if there are no remaining usage rights of the license information, executes a process to request the purchase of additional usage rights, and then links a newly created guest license to the new user; and, if the license type of the license information to be granted to the new user is a device license in which usage rights are granted for each device, there is no need to check whether the usage rights remain, and links a guest license that is automatically inactivated when its expiration date has passed to the new user.

This invention has the advantage that when a device license is granted upon inviting a user as a guest, service usage authorization can be added without any action by the administrator.

FIG. 1 is a block diagram illustrating a configuration of a cloud system according to an embodiment. FIG. 2 is a block diagram illustrating an example of the hardware configuration of the control system of the service providing system and the information processing device. FIG. 3 is a functional block diagram showing the functional configuration of the service providing system. FIG. 4 is a sequence diagram showing the processing in the service providing system when a new user receives an invitation email. FIG. 5 is a sequence diagram showing the processing in the service providing system when there is no remaining usage authority. FIG. 6 is a diagram showing an example of a notification of insufficient usage authority. FIG. 7 is a diagram showing an example of a usage authority additional purchase screen.

Embodiments of the service provision system, service provision method, and program are described in detail below with reference to the attached drawings.

Figure 1 is a block diagram showing the configuration of a cloud system 1 according to an embodiment. As shown in Figure 1, the cloud system 1 includes a service providing system 2 and multiple information processing devices 3. The service providing system 2 and the multiple information processing devices 3 are connected via a network 4.

The service providing system 2 is realized by at least one information processing device such as a server. The service providing system 2 provides various services.

The information processing device 3 is an information processing device used by a user, such as a PC (Personal Computer), smartphone, tablet terminal, multifunction device (having at least two of the functions of copying, printing, scanning, and facsimile), copier, printer, scanner device, facsimile device, etc.

Network 4 is a communication network such as the Internet to which the service providing system 2 and information processing device 3 are connected, enabling them to communicate with each other.

Figure 2 is a block diagram showing an example of the hardware configuration of the control systems of the service providing system 2 and the information processing device 3. As shown in Figure 2, the service providing system 2 and the information processing device 3 include a CPU (Central Processing Unit) 11, a RAM (Random Access Memory) 12, a ROM (Read Only Memory) 13, a HDD (Hard Disk Drive) 14, an input device 15, a display device 16, an external I/F (Interface) 17, and a communication I/F (Interface) 18. The CPU 11, RAM 12, ROM 13, HDD 14, input device 15, display device 16, external I/F 17, and communication I/F 18 are each connected by a bus line 19.

The CPU 11 is a computing device that controls the entire service providing system 2 or information processing device 3 and realizes the functions of the service providing system 2 or information processing device 3. The CPU 11 reads programs and data from the ROM 13, HDD 14, etc. onto the RAM 12 and executes various processes.

RAM 12 is a volatile semiconductor memory. RAM 12 temporarily stores programs and data.

ROM 13 is a non-volatile semiconductor memory. ROM 13 stores programs and data (BIOS, OS settings, network settings, etc.).

The HDD 14 is a non-volatile storage device. The HDD 14 stores programs and data (OS, applications, etc.). The OS and applications stored on the HDD 14 differ between the service providing system 2 and the information processing device 3. For example, the information processing device 3 has a browser as an application.

The input device 15 is a keyboard, mouse, touch panel, etc. The input device 15 accepts input from the user.

The display device 16 is a display or the like. The display device 16 displays the processing results.

The external I/F 17 is an interface that connects to an external device (such as a recording medium 20). The recording medium 20 may be a flexible disk (FD), a compact disc (CD), a digital versatile disc (DVD), an SD memory card, a USB memory, etc.

The communication I/F 18 is an interface that connects to the network 4.

The programs executed by the service providing system 2 or information processing device 3 of this embodiment are provided as installable or executable files recorded on a computer-readable recording medium such as a CD-ROM, FD, CD-R, or DVD.

The program executed by the service providing system 2 or information processing device 3 of this embodiment may be stored on a computer connected to a network such as the Internet and provided by downloading it via the network. The program executed by the service providing system 2 or information processing device 3 of this embodiment may be provided or distributed via a network such as the Internet.

Furthermore, the programs executed by the service providing system 2 or information processing device 3 of this embodiment may be configured to be provided by being pre-installed in a ROM or the like.

Next, we will explain the functional configuration of the service providing system 2.

Figure 3 is a functional block diagram showing the functional configuration of the service providing system 2. As shown in Figure 3, the program executed by the service providing system 2 of this embodiment has a modular configuration including various units (application management unit 21, application information storage unit 22, web service processing unit 23, authentication management unit 24, tenant information storage unit 25, user information storage unit 26, license information storage unit 27, authentication information storage unit 28, and email sending unit 29). In actual hardware, the CPU 11 reads and executes the program from the HDD 14, loading the various units into RAM 12 and generating the various units (application management unit 21, application information storage unit 22, web service processing unit 23, authentication management unit 24, tenant information storage unit 25, user information storage unit 26, license information storage unit 27, authentication information storage unit 28, and email sending unit 29) on RAM 12.

The application management unit 21 manages the applications that are executed. The application management unit 21 also performs periodic batch processing such as checking for license expiration dates.

The app information storage unit 22 stores app information required by the app management unit 21. In addition, the app information storage unit 22 is responsible for storing data for the survey emails described below in the service providing system 2.

The web service processing unit 23 is downloaded by the browser of the information processing device 3 in a format such as JavaScript (registered trademark) or CSS, and is executed by the CPU 11 of the information processing device 3. The web service processing unit 23 includes an application execution unit 231 and an image composition unit 232.

The application execution unit 231 executes applications for configuring applications. The application execution unit 231 accepts user input and requests the application management unit 21 to change default values, etc. The application execution unit 231 also requests the authentication management unit 24 to perform authentication for displaying personal settings, and if authentication of external services such as file upload destinations is required for application settings, the application execution unit 231 requests the authentication management unit 24 to obtain authentication information.

The image construction unit 232 executes the application screen display. The image construction unit 232 presents the necessary parameters to the user and accepts input.

The authentication management unit 24 acquires and updates tenant information stored in the tenant information storage unit 25 and user information stored in the user information storage unit 26. The authentication management unit 24 stores authentication information in the authentication information storage unit 28 and manages login and access restrictions for users, devices, etc. The authentication management unit 24 also creates, acquires, and updates license information stored in the license information storage unit 27.

The tenant information storage unit 25 stores tenant information that defines tenants for dividing the service provision range, as shown below.
[Tenant information example]
Tenant ID: tenant1
Tenant Name: Test Tenant

The user information storage unit 26 stores user information that is linked to tenant information and used to identify users, as shown below. The following example shows a state in which user1 belongs to tenatn1 and tenant2.
[User information example]
User ID: user1
Tenant ID: [tenant1, tenant2]
Username: AAAA
Email address: user1@example.com
License ID: 110

The license information storage unit 27 stores license information that is assigned to tenants, users, and information processing devices 3, as described below, and defines the authority of services that users can use.
[License information example]
License ID: 110
Service ID: guest_license
Service class: Guest license (time-limited license or limited-function license)
License type: user
License expiration date: 2025/08/31
[Device information example]
Device ID: device1
Tenant ID: tenant1
Device name: MFP01

The types of official licenses and guest licenses are as shown in the table below. A guest license is a license that is automatically deactivated after the expiration date.

License types include user licenses, device licenses, and composite licenses. A user license is a license type in which usage rights are granted per user. A device license is a license type in which usage rights are granted per device. A composite license is a license type in which there are limits on the number of licenses that can be used by both users and devices. Licenses can be assigned per tenant, package, or application.

The authentication information storage unit 28 stores authentication information such as user access tokens and one-time access tokens.

The email sending unit 29 sends an email based on the email address in the user information and the text provided from an external source.

Next, we will explain the processing in the service providing system 2 when a new user receives an invitation email.

Figure 4 is a sequence diagram showing the processing in the service providing system 2 when a new user receives an invitation email.

As shown in Figure 2, first, a new user accesses the URL of an invitation email sent by a user currently using the service, inviting a user who is not currently using the service, via the browser of the information processing device 3 (S1).

The browser on the information processing device 3 accesses the URL in the invitation email to the web service processing unit 23 (S2).

The web service processing unit 23 requests the authentication management unit 24 to verify the one-time authentication information (S3).

The authentication management unit 24 compares the one-time authentication information with the authentication information storage unit 28 (S4).

When the authentication management unit 24 receives the matching result from the authentication information storage unit 28, it returns the matching result to the web service processing unit 23 (S5).

The web service processing unit 23 then displays a page on the browser of the information processing device 3 to accept the new user's invitation (S6).

The new user confirms the page displayed in the browser of the information processing device 3, which asks the user to accept the invitation (S7).

The new user presses the approval button displayed on the browser of the information processing device 3 (S8).

When the approve button is pressed, the browser on the information processing device 3 sends a request to the web service processing unit 23 to accept the invitation (S9).

Next, the web service processing unit 23 requests the authentication management unit 24 to grant a guest license to the new user (S10).

Next, the authentication management unit 24 obtains tenant information from the tenant information storage unit 25 (S11).

The authentication management unit 24 also obtains the license type from the license information storage unit 27 (S12).

The authentication management unit 24 creates a guest license in the license information stored in the license information storage unit 27 (S13). Note that the authentication management unit 24 creates a guest license at the time of access in the process of S13, but it may also be possible to create the guest license before the invitation and associate it with the URL, so that the process of S13 is omitted when the URL is accessed.

The authentication management unit 24 associates the newly created guest license with the new user in the user information storage unit 26 (S14).

More specifically, when the web service processing unit 23 requests that a guest license be granted to a new user, the authentication management unit 24 changes the subsequent processing depending on the license type. Specifically, if the license type is a user license, the authentication management unit 24 checks whether there is any remaining usage authority, and if there is no remaining usage authority, executes the "processing when there is no remaining usage authority" described below. Then, in processing S14, the newly created guest license is linked to the new user. On the other hand, if the license type is a device license, the authentication management unit 24 does not need to perform the "processing when there is no remaining usage authority," and so links the guest license as is. Note that if there are multiple licenses, license candidates may be presented to the new user to select one when the matching result is returned in processing S5 (or before processing S10).

Next, the authentication management unit 24 obtains information about the tenant administrator from the user information storage unit 26 (S15).

The authentication management unit 24 passes the new user, tenant administrator information, and email content to the email sending unit 29 (S16).

When the email sending unit 29 receives the email content, it notifies the new user that a guest license has been granted (S17).

In addition, the email sending unit 29 notifies the tenant administrator that a guest license has been granted to the new user (S18).

The authentication management unit 24 returns a notification to the web service processing unit 23 that the guest license has been validated (S19).

The web service processing unit 23 returns a page to the browser of the information processing device 3 indicating that the guest license has been validated (S20).

The new user confirms via the browser on the information processing device 3 that the guest license has been validated (S21).

Next, we will explain what happens when there are no remaining usage rights (when additional purchases are required).

Figure 5 is a sequence diagram showing the processing in the service providing system when there are no remaining usage rights. As shown in Figure 5, the email sending unit 29 notifies the tenant administrator that there are no remaining usage rights (S31). More specifically, during the guest license period, the server monitors the license expiration date in the [License Information], and when the expiration date approaches, it identifies the user associated with the license, extracts an email address based on the user's [User Information], and sends a survey email to that email address.

Figure 6 shows an example of a notification of insufficient usage rights. To continue using the service after the guest license period has expired, usage rights for the official license are required. If there is no remaining usage rights for the official license, the service providing system 2 notifies the tenant administrator that there are no remaining usage rights. This prevents failure to grant an official license, even in the case of a user license.

As shown in Figure 6, the survey email includes a question about whether or not the tenant desires a formal license. If a formal license is desired but the tenant administrator still lacks usage rights, the service providing system 2 notifies the tenant administrator. If the tenant administrator does not desire a formal license, the service providing system 2 cancels the license without issuing a notification.

In addition to email, notifications can also be sent via a pop-up or other method when the tenant administrator logs in to the site.

When the administrator accesses the link in the notified survey email (S32), the browser on the information processing device 3 accesses the link in the notified survey email (S33).

The web service processing unit 23 requests license information from the authentication management unit 24 (S34).

The authentication management unit 24 acquires license information from the license information storage unit 27 (S35). Next, the authentication management unit 24 notifies the web service processing unit 23 of the license information (S36).

Then, the web service processing unit 23 displays an additional usage authorization purchase screen for adding licenses to the tenant administrator (S37). Figure 7 shows an example of the additional usage authorization purchase screen. The tenant administrator can purchase the desired licenses on the additional usage authorization purchase screen shown in Figure 7.

The tenant administrator purchases additional usage rights for the official version of the license from the usage rights additional purchase screen for adding licenses (S38).

The web service processing unit 23 requests the authentication management unit 24 to grant a formal license (S39).

The authentication management unit 24 registers the official version request in the license information storage unit 27 (S40).

As described above, according to this embodiment, when the license type is a user license, the authentication management unit 24 checks whether there are any remaining usage rights, and if there are no remaining usage rights, it performs the "processing when there are no remaining usage rights" described below, and then links the newly created guest license to the new user. On the other hand, when the license type is a device license, the authentication management unit 24 does not need to perform the "processing when there are no remaining usage rights," and simply links the guest license. This allows service usage rights to be added without any action by the administrator when a device license is granted when a user invites a guest.

In this embodiment, if a different tenant administrator is assigned to each license, the relevant tenant administrator may be notified. That is, a tenant administrator may be set for each license, and only the set administrator may decide whether to grant a guest license or a formal license. In this case, notifications in the event of insufficient usage rights are also sent to this set tenant administrator. This makes it possible to prevent failure to grant a formal license even if the tenant administrator is different.

As mentioned above, in the case of a license type that does not require confirmation of the remaining number of usage rights, i.e., if the license type is other than a user license, the authentication management unit 24 of the service providing system 2 may simply upgrade the guest license to a formal license after the expiration date. This prevents rework due to the formal license not being granted.

Furthermore, if a response is received to the above-mentioned questionnaire email, the authentication management unit 24 of the service providing system 2 may determine whether to upgrade to a formal license or invalidate the guest license based on the response. Furthermore, in the case of a composite license, the authentication management unit 24 of the service providing system 2 performs the same processing as for a user license.

2 Service providing system 24 Authentication management unit 25 Tenant information storage unit 26 User information storage unit 27 License information storage unit

Japanese Patent Application Laid-Open No. 2019-036141

Claims (6)

a tenant information storage unit that stores tenant information that defines tenants for dividing a service provision range;
a user information storage unit that stores user information associated with the tenant information and used to identify a user;
a license information storage unit that stores license information that defines the access rights of a service used by a user;
an authentication management unit that manages the tenant information stored in the tenant information storage unit, the user information stored in the user information storage unit, and the license information stored in the license information storage unit;
Equipped with
The authentication management unit
If the license type of the license information to be granted to the new user is a user license in which usage rights are given to each user, it is checked whether there is any remaining usage rights, and if there is no remaining usage rights in the license information, a process is executed to request the additional purchase of the usage rights, and then a newly created guest license is linked to the new user,
If the license type of the license information to be granted to the new user is a device license in which usage rights are granted for each device, there is no need to check whether the usage rights remain, and a guest license, which is automatically inactivated when the expiration date has passed, is linked to the new user.
A service providing system characterized by: The authentication management unit notifies a tenant administrator when the new user wants to continue using the service but does not have enough authorization to use the service.
2. The service providing system according to claim 1. If the tenant administrator is different for each license, the authentication management unit notifies the tenant administrator of the license that lacks the service usage authority.
3. The service providing system according to claim 2. If the license type of the license information to be granted to a new user is other than a user license in which usage rights are given to each user, the authentication management unit automatically grants a formal license when the guest license expires.
2. The service providing system according to claim 1. a tenant information storage unit that stores tenant information that defines tenants for dividing a service provision range;
a user information storage unit that stores user information associated with the tenant information and used to identify a user;
a license information storage unit that stores license information that defines the access rights of a service used by a user;
A service providing method in a service providing system comprising:
an authentication management step of managing tenant information stored in the tenant information storage unit, user information stored in the user information storage unit, and license information stored in the license information storage unit;
The authentication management step includes:
If the license type of the license information to be granted to the new user is a user license in which usage rights are given to each user, it is checked whether there is any remaining usage rights, and if there is no remaining usage rights in the license information, a process is executed to request the additional purchase of the usage rights, and then a newly created guest license is linked to the new user,
If the license type of the license information to be granted to the new user is a device license in which usage rights are granted for each device, there is no need to check whether the usage rights remain, and a guest license, which is automatically inactivated when the expiration date has passed, is linked to the new user.
A service providing method comprising: Computer,
a tenant information storage unit that stores tenant information defining tenants for dividing a service provision range;
a user information storage unit that stores user information associated with the tenant information and used to identify a user;
a license information storage unit that stores license information that defines the access rights of a service used by a user;
an authentication management unit that manages the tenant information stored in the tenant information storage unit, the user information stored in the user information storage unit, and the license information stored in the license information storage unit;
It functions as
The authentication management unit
If the license type of the license information to be granted to the new user is a user license in which usage rights are given to each user, it is checked whether there is any remaining usage rights, and if there is no remaining usage rights in the license information, a process is executed to request the additional purchase of the usage rights, and then a newly created guest license is linked to the new user,
If the license type of the license information to be granted to the new user is a device license in which usage rights are granted for each device, there is no need to check whether the usage rights remain, and a guest license, which is automatically inactivated when the expiration date has passed, is linked to the new user.
program.