Patent Application
20220116217
A multi-function product (MFP) such as a printing device can be securely linked to a user's cloud account. Secure and controlled access to MFP devices can be provided using an authentication solution using a user login. For example, the login may relate to a user's cloud credentials before the user gains access to cloud assets and resources.
Various features and advantages of certain examples will be apparent from the detailed description which follows, taken in conjunction with the accompanying drawings, which together illustrate, by way of example only, a number of features, and wherein:
In the following description, for purposes of explanation, numerous specific details of certain examples are set forth. Reference in the specification to “an example” or similar language means that a particular feature, structure, or characteristic described in connection with the example is included in at least that one example, but not necessarily in other examples.
Embedded authentication mechanisms can be supported in a multi-function product (MFP). Authentication mechanisms can include: Active Directory; LDAP; PIN; third party authorisation; RFID; smart card; or proximity badge readers. Cloud account authentication can be accomplished via a username and password combination, which can be a separate authorization domain from built-in or third-party authentication solutions which are embedded authentication methods in an MFP.
A method and system are disclosed for securely linking a device, such as a printing device, to a user's cloud account. For example, a secure link or bridge from an embedded MFP or printer authentication mechanism to a cloud account authorization is provided. This securely bridges the gap from any built-in or third-party MFP authentication method to a cloud authorization domain without requiring a user to re-authenticate or re-enter secondary credentials. For example, the user can use a badge swipe to both log into the MFP and log into the cloud and/or other linked cloud resources such as Google, OneDrive, or Box for example. This allows the user to have access to their personal cloud accounts & documents in addition to the MFP device features to which they have been authorized to use. A user's personalized experience can thereby easily follow a user to any capable device they use without extra effort on their part. This is achieved by establishing a secure communication channel via an authentication process. The device is assigned a unique ID and secret key which are used by the cloud service to validate a ticket request for access to the user's cloud account.
At block 102 the method comprises, at the device, authorising credentials for the user. The user credentials may correspond to details used to qualify the user or a user identification, such as personal details. A user can log into the device with their credentials or with a physical token (e.g. RFID badge touch) in order to gain access to access-controlled device functions. Upon logging in, this can add device software such that login will initiate a secure communication sequence with the cloud to gain authorization to cloud services.
At block 104 the method comprises authorising the device by providing a unique identifier and an encryption key. According to an example, an administrator can pre-configure a built-in device (MFP) authentication agent, for example LDAP, Windows, ActiveDirectory. The administrator can pre-install a solution to perform the authentication and authorization, for example Safecom, HP Access Control, PaperCut. The administrator or authenticating agent pre-configures the device to enable cloud web service interaction. The cloud web service interaction can correspond to a cloud storage or cloud storage account for a user. The device upon joining the system is granted with a unique device identifier (UUID) and a secret key. The unique device identifier and secret encryption key allow the device and the cloud to secure communications between them and helps achieving non-repudiation. As such, an authenticating agent authorises the device.
At block 106 the method comprises generating a ticket using the device unique identifier and user credentials. According to an example, a ticket is assembled by the device and comprises the device unique identifier issued previously by the cloud. The ticket may be assembled comprising one or more of the following: the ID of the authenticating agent (which authenticated the user within that device); any server, domain, or scope used to qualify the user; the user ID of the user which was authenticated, for example a qualified username or other unique ID.
At block 108 the method comprises signing the ticket with the encryption key. According to an example, the ticket may be signed or encrypted with keys derived from the secrets previously exchanged between the cloud and device. For example, both the device and the authorization system can participate on the same key domain so that the key derivation functions reach out to the same keys for the same key material attributes. As such, no two submissions of the ticket use the same key. Once created the ticket can be exchanged with the cloud to a cloud authorization endpoint.
At block 110 the method comprises sending the signed ticket to a cloud authorisation service.
At the cloud service, the signed ticket is validated at block 112 using the encryption key. According to an example, the cloud authorization can check whether this ticket is correctly signed and encrypted and is linked to a cloud account.
At block 114 the method comprises matching the ticket to the cloud storage account for the user via the user credentials. Upon finding a match, a user cloud session is created and an access token is issued and returned to the device to enable it to access private user assets such as storage.
The linking of the user to their cloud storage account from the authorized device may be achieved via a web flow, for example called on a browser. The local identity is configured to produce the same claims or tickets for a given user (i.e. stable ID's).
According to an example, when the user links the device to their cloud storage account, the secure communication channel may be time limited, for example valid for eight hours. If a user attempts to log into more than one authorized device, the secure communication channel optionally may not support multiple sessions.
According to an example of account linking, a user may log in on an MFP device using an existing local authorization domain (e.g. AD, Azure, LDAP) and then is offered to link that account to an existing or new user account, that will be used to fulfill personalization (and more) use cases. When logging in again on any other MFP device under the list of authorized devices (same local authorization system), the previously account linkage is discovered by the system and the user leverages this for automatic authorization at that device.
According to an example, the local user is able to either unlink a previously linked account, or determine not to link accounts, which may prevent the system to suggest linkage again.
According to an example, link apps may use a vault to store user credentials. For an installed link app on a device, the link app can leverage the user identity that is logged in the device, so the link apps do not request users to log in again on behalf of the app to use, for example, personalization services. This procedure allows a link app to obtain an authorized asset that the app can use against services (such as the vault), under the app's scoping and identity (i.e. the app's client ID). The procedure may be secure such that link apps do not have access to the original authorization asset present on the device.
According to an example, a reverse direction of linkage may be offered as an option, allowing users who log in to their cloud account (e.g. via mobile phone confirmation, gesture, swipe) to be authorized locally by an embedded authentication agent as a device user. The device can be linked to the cloud authentication directly as the installed authenticating agent, logging into the cloud directly, with restrictions on the domain or authentication provider which is acceptable as an MFP authenticating provider.
According to an example, the administrator of the device can set the authentication method, e.g. built-in authentication agent such as LDAP 816, Windows 818, or an installed solution such as Safecom, HP Access Control. The user can access or log into the device using an RFID badge 820, for example, or an authorised third party may securely access the device 822. According to an example, a private user session may be enabled via a link app 824.
The method and system disclosed provide a secure and convenient linking of a user's cloud storage account to the MFP device that the user is logged into. It provides the end user with ease of use since the user may sign in once with support for link app isolation. This has the advantage of securely allowing the user to log-in once at the device for combined access to the device and their cloud account. This removes a secondary login that the user would otherwise perform to access third party services, since instead the user can be logged into their cloud account securely and automatically. The login is secure in that the authorized device(s) are able to automatically bridge from MFP device login to cloud login. As such, there is provided a method and system for authentication of an MFP device and a cloud authorization domain, without a user re-authenticating or re-entering secondary credentials. The user is provided with secure access to their personal assets, configuration and experience without multiple credential entry. This allows bridging between local and cloud authorization domains whilst keeping the user's account secure from unauthorized access from malicious attack (hackers).
Examples in the present disclosure can be provided as methods, systems or machine-readable instructions, such as any combination of software, hardware, firmware or the like. Such machine-readable instructions may be included on a computer readable storage medium (including but not limited to disc storage, CD-ROM, optical storage, etc.) having computer readable program codes therein or thereon.
The present disclosure is described with reference to flow charts and/or block diagrams of the method, devices and systems according to examples of the present disclosure. Although the flow diagrams described above show a specific order of execution, the order of execution may differ from that which is depicted. Blocks described in relation to one flow chart may be combined with those of another flow chart. In some examples, some blocks of the flow diagrams may not be necessary and/or additional blocks may be added. It shall be understood that each flow and/or block in the flow charts and/or block diagrams, as well as combinations of the flows and/or diagrams in the flow charts and/or block diagrams can be realized by machine readable instructions.
The machine-readable instructions may, for example, be executed by a general-purpose computer, a special purpose computer, an embedded processor or processors of other programmable data processing devices to realize the functions described in the description and diagrams. In particular, a processor or processing apparatus may execute the machine-readable instructions. Thus, modules of apparatus may be implemented by a processor executing machine readable instructions stored in a memory, or a processor operating in accordance with instructions embedded in logic circuitry. The term ‘processor’ is to be interpreted broadly to include a CPU, processing unit, ASIC, logic unit, or programmable gate set etc. The methods and modules may all be performed by a single processor or divided amongst several processors.
Such machine-readable instructions may also be stored in a computer readable storage that can guide the computer or other programmable data processing devices to operate in a specific mode.
For example, the instructions may be provided on a non-transitory computer readable storage medium encoded with instructions, executable by a processor.
at the device,
Instructions to authorise credentials for the user;
Instructions to authorise the device by providing a unique identifier and an encryption key;
Instructions to generate a ticket using the device unique identifier and user credentials;
Instructions to sign the ticket with the encryption key;
Instructions to send the signed ticket to a cloud storage;
at the cloud storage,
Instructions to validate the signed ticket using the encryption key; and
Instructions to match the ticket to the cloud storage account for the user via the user credentials.
Such machine-readable instructions may also be loaded onto a computer or other programmable data processing devices, so that the computer or other programmable data processing devices perform a series of operations to produce computer-implemented processing, thus the instructions executed on the computer or other programmable devices provide an operation for realizing functions specified by flow(s) in the flow charts and/or block(s) in the block diagrams.
Further, the teachings herein may be implemented in the form of a computer software product, the computer software product being stored in a storage medium and comprising a plurality of instructions for making a computer device implement the methods recited in the examples of the present disclosure.
While the method, apparatus and related aspects have been described with reference to certain examples, various modifications, changes, omissions, and substitutions can be made without departing from the spirit of the present disclosure. In particular, a feature or block from one example may be combined with or substituted by a feature/block of another example.
The word “comprising” does not exclude the presence of elements other than those listed in a claim, “a” or “an” does not exclude a plurality, and a single processor or other unit may fulfil the functions of several units recited in the claims.
The features of any dependent claim may be combined with the features of any of the independent claims or other dependent claims.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/US2018/061026 | 11/14/2018 | WO | 00 |
