JP2017182396A - Information processing device, control method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a highly secure user authentication technique that can be introduced without altering a server that provides services.SOLUTION: An information processing device 2000 includes a service identifier acquisition unit 2020, a conversion unit 2040, and a transmission unit 2060. The service identifier acquisition unit 2020 obtains a service identifier. The service identifier is an arbitrary identifier for identifying one of services that are different from each other. The conversion unit 2040 obtains conversion rule that is associated with the service identifier obtained by the service identifier acquisition unit 2020. This conversion rule is obtained without passing through a device that provides the target service. In this case, the conversion rule is defined for each service. In addition, the conversion unit 2040 converts a first character string to a second character string on the basis of the obtained conversion rule. The transmission unit 2060 transmits the second character string generated by the conversion unit 2040, to the device that provides the target service.SELECTED DRAWING: Figure 1

Description

  The present invention relates to character string processing.

  One means for performing user authentication in a service such as a Web service is authentication using a password. When performing authentication using a password, the user registers a password for each service in advance. Then, when using the service, the user inputs the password registered in the service and requests user authentication.

  If the same password is used for a plurality of services, the probability that the password will be leaked and the damage when the password is leaked may increase. Therefore, it is preferable to use a different password for each service. However, it is said that there are many users who use the same password for a plurality of services because it takes much effort for the user to memorize a plurality of passwords.

  Patent Document 1 is a prior art document disclosing a technology related to password management. Patent Document 1 discloses a technique for ensuring security while using the same password for a plurality of services by cooperating between a server providing a service and a client terminal. First, the user makes an authentication request specifying a user ID to the server. Upon receiving this authentication request, the server returns information including the server-specific seed to the client terminal. The client terminal performs hash processing using a server-specific seed on the password input by the user. Then, the client terminal transmits the hashed password to the server.

JP 2013-20212 A

  In Patent Document 1, a server that provides a service manages a server-specific seed. When receiving an authentication request from the user, the server providing the service transmits a server-specific seed to the client terminal. Therefore, in order to introduce the technology of Patent Document 1 into an existing service, it is necessary to modify a server that provides the service.

  The present invention has been made in view of the above problems, and an object of the present invention is to provide a highly secure user authentication technology that can be introduced without modifying a server that provides a service.

  The information processing apparatus of the present invention is associated with (1) service identifier acquisition means for acquiring a service identifier for specifying one of different services, and (2) a service specified by the service identifier. (3) the acquisition unit that acquires a conversion rule without using a device that provides the service and converts a first character string into a second character string based on the acquired conversion rule; Transmitting means for transmitting the second character string to a device that provides a service specified by the service identifier. The conversion rule is defined for each service.

  The control method of the present invention is executed by a computer. The control method includes (1) a service identifier acquisition step of acquiring a service identifier in which one of different services is specified, and (2) a conversion rule associated with the service specified by the service identifier. A conversion step of obtaining the service without providing the service and converting the first character string into a second character string based on the obtained conversion rule; and (3) the acquired service. And a transmission step of transmitting the second character string to a device that provides a service specified by the identifier. The conversion rule is defined for each service.

  The program of this invention makes a computer perform each step which the control method of this invention has.

  According to the present invention, a highly secure user authentication technique that can be introduced without modifying a server providing a service is provided.

1 is a block diagram illustrating an information processing apparatus according to a first embodiment. It is a figure which illustrates the computer for implement | achieving information processing apparatus. 3 is a flowchart illustrating a flow of processing executed by the information processing apparatus according to the first embodiment. It is a 1st figure which illustrates a mode that an information processing apparatus receives provision of a service via a network. It is a 2nd figure which illustrates a mode that an information processing apparatus receives provision of a service via a network. It is the 1st figure which illustrates the rule which replaces a character. It is a 2nd figure which illustrates the rule which substitutes a character. It is a figure which illustrates conversion by addition of a character string. It is a figure which illustrates the relationship between the memory | storage device which memorize | stores a conversion rule, and another apparatus. It is a figure which illustrates the input area of a password. It is a figure which illustrates the utilization environment of the information processing apparatus of an Example. The pre-registration screen is illustrated. It is a user account registration screen. It is a figure which illustrates notionally the flow of processing in the information processor of an example. It is a figure which illustrates the keyboard layout used for conversion.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In all the drawings, the same reference numerals are given to the same components, and the description will be omitted as appropriate.

[Embodiment 1]
FIG. 1 is a block diagram illustrating an information processing apparatus 2000 according to the first embodiment. In FIG. 1, each block represents a functional unit configuration, not a hardware unit configuration.

  The information processing apparatus 2000 includes a service identifier acquisition unit 2020, a conversion unit 2040, and a transmission unit 2060. The service identifier acquisition unit 2020 acquires a service identifier. The service identifier is an arbitrary identifier that identifies one of the different services. For example, the service identifier is a service name, a service domain name, or the like. Here, the service specified by the service identifier acquired by the service identifier acquisition unit 2020 is referred to as a target service.

  The conversion unit 2040 acquires a conversion rule associated with the service identifier acquired by the service identifier acquisition unit 2020. This conversion rule is acquired without going through a device that provides the target service. Here, the conversion rule is determined for each service. Hereinafter, a device that provides a service is also referred to as a service providing device. The service providing apparatus is, for example, a server machine.

  Furthermore, the conversion unit 2040 converts the first character string into the second character string based on the acquired conversion rule.

  The transmission unit 2060 transmits the second character string generated by the conversion unit 2040 to the service providing apparatus of the target service.

  The first character string is input by the user with the intention of being used as a password in user authentication of the target service. Therefore, the second character string is transmitted to the service providing apparatus of the target service as a password for user authentication of the target service.

<Action and effect>
According to the information processing apparatus 2000 of the present embodiment, the first character string input as the password in the user authentication of the target service is converted into the second character string, and the second character string is transmitted to the service providing apparatus of the target service. Is done. By doing so, the second character string is used as a password in user authentication of the target service instead of the first character string input by the user.

  Furthermore, the rule for converting the first character string into the second character string is different for each service. Therefore, even if the user inputs the same first character string as a password used for each of a plurality of services, the first character string is converted into a different second character string for each service by the conversion unit 2040. . As a result, it is possible to prevent the same password from being used in a plurality of services, and as a result, it is possible to improve the security of user authentication.

  Further, the conversion rule used by the information processing apparatus 2000 is acquired without going through the service providing apparatus of the target service. If the conversion rule cannot be acquired without going through the service providing apparatus for the target service, it is necessary to modify the service providing apparatus for the target service when the information processing apparatus 2000 is introduced. Specifically, it is necessary to introduce a function such as “accepting a request for requesting transmission of a conversion rule from the information processing apparatus 2000 and transmitting the conversion rule as a response to the request” to the service providing apparatus of the target service. .

  According to the information processing apparatus 2000, since the conversion rule is acquired without going through the service providing apparatus for the target service, there is no need to modify the service providing apparatus for the target service when installing the information processing apparatus 2000. Therefore, according to the information processing apparatus 2000 of the present embodiment, the security of user authentication can be improved without modifying the service providing apparatus of the target service.

  Here, as another means to solve the problems (probability of password leakage and increased damage caused by password leakage) caused by using the same password for multiple services, (1) Single sign-on A method of using, and (2) a method of using an automatic password input function are also conceivable. Single sign-on is a technology that enables a user ID and password pair managed by a certain management organization to be used in common for user authentication of a plurality of services. However, in order to use single sign-on, it is necessary to make the service correspond to user authentication using single sign-on. That is, in order to use single sign-on, it is necessary to modify the service providing apparatus. On the other hand, when introducing the information processing apparatus 2000 of the present embodiment, it is not necessary to modify the service providing apparatus.

  The password auto-input function stores the password entered when the user uses a certain service, and then automatically enters the password when the user tries to use the same service. It is a function. For example, this function is provided by a Web browser. However, in order to use this function, a password input by the user needs to be stored in the storage device. Therefore, when the computer used by the user is attacked by malware or the like, there is a risk that the password stored in the storage device will be leaked.

  On the other hand, in the case of the information processing apparatus 2000 of the present embodiment, both the second character string used as the password and the first character string that is the source for generating the second character string are stored in the storage device. There is no need to be. Therefore, unlike the case of using the automatic password input function, there is no risk that the password stored in the storage device is leaked.

  Hereinafter, this embodiment will be described in more detail.

<Hardware configuration example of information processing apparatus 2000>
Each functional component of the information processing apparatus 2000 may be realized by hardware (eg, a hard-wired electronic circuit) that implements each functional component, or a combination of hardware and software (eg: It may be realized by a combination of an electronic circuit and a program for controlling it). Hereinafter, the case where each functional component of the information processing apparatus 2000 is realized by a combination of hardware and software will be further described.

  FIG. 2 is a diagram illustrating a computer 1000 for realizing the information processing apparatus 2000. The computer 1000 is an arbitrary computer. For example, the computer 1000 is a personal computer (PC), a server machine, a tablet terminal, or a smartphone. The computer 1000 may be a dedicated computer designed for realizing the information processing apparatus 2000 or a general-purpose computer.

  The computer 1000 includes a bus 1020, a processor 1040, a memory 1060, a storage medium 1080, an input / output interface 1100, and a network interface 1120. The bus 1020 is a data transmission path through which the processor 1040, the memory 1060, the storage medium 1080, the input / output interface 1100, and the network interface 1120 transmit / receive data to / from each other. However, the method of connecting the processors 1040 and the like is not limited to bus connection. The processor 1040 is an arithmetic processing device such as a CPU (Central Processing Unit) or a GPU (Graphics Processing Unit). The memory 1060 is a memory such as a RAM (Random Access Memory) or a ROM (Read Only Memory). The storage medium 1080 is a storage device such as a hard disk, an SSD (Solid State Drive), or a memory card. The storage medium 1080 may be a memory such as RAM or ROM.

  The input / output interface 1100 is an interface for connecting the computer 1000 and an input / output device. In FIG. 2, the input device 30 is connected to the computer 1000. The input device 30 is, for example, a keyboard or a touch panel.

  The network interface 1120 is an interface for connecting the computer 1000 to an external device so as to be communicable. The computer 1000 is connected to a service providing apparatus for each service via a network interface 1120. The network interface 1120 may be a network interface for connecting to a wired line or a network interface for connecting to a wireless line.

  The storage medium 1080 stores a program module that implements each functional component of the information processing apparatus 2000. The processor 1040 reads each program module into the memory 1060 and executes it, thereby realizing each function corresponding to the program module.

  The hardware configuration of the computer 1000 is not limited to the configuration shown in FIG. For example, each program module may be stored in the memory 1060. In this case, the computer 1000 may not include the storage medium 1080.

<Process flow>
FIG. 3 is a flowchart illustrating the flow of processing executed by the information processing apparatus 2000 according to the first embodiment. The service identifier acquisition unit 2020 acquires a service identifier (S102). The conversion unit 2040 acquires a conversion rule corresponding to the target service without going through the service providing apparatus for the target service. The conversion unit 2040 acquires the first character string (S106). The conversion unit 2040 converts the first character string into the second character string based on the acquired conversion rule (S108). The transmission unit 2060 transmits the second character string to the service providing apparatus of the target service (S110).

<Use environment of information processing apparatus 2000>
A prerequisite environment for using the information processing apparatus 2000 will be described. The information processing apparatus 2000 can receive a plurality of services. Each service is an arbitrary service that can be provided via a network. This network may be a wide area network (WAN) or a local area network (LAN).

  However, each service performs user authentication independently of other services. That is, the user needs to receive user authentication by inputting a user ID and password for each service to be used.

  FIG. 4 is a first diagram illustrating a state where the information processing apparatus 2000 receives provision of services via the network. The service providing apparatus 10-1, the service providing apparatus 10-2, and the information processing apparatus 2000 belong to the same network 20. Therefore, the information processing apparatus 2000 can receive service from both the service providing apparatus 10-1 and the service providing apparatus 10-2.

  When a user uses each service, the user receives user authentication for each service. Specifically, when using a service provided by the service providing apparatus 10-1, the user receives user authentication by transmitting a user ID and a password to the service providing apparatus 10-1. On the other hand, when using the service provided by the service providing apparatus 10-2, the user receives user authentication by transmitting a user ID and a password to the service providing apparatus 10-2.

  Note that the device that provides the service and the device that performs user authentication may be different devices. In this case, the information processing apparatus 2000 communicates with an apparatus that performs user authentication to receive user authentication, and then communicates with a service providing apparatus to receive a service.

  Here, the information processing apparatus 2000 does not need to be able to use a plurality of services simultaneously. For example, the information processing apparatus 2000 may use only one service at a certain time.

  For example, assume that multiple services are provided in different LANs. In this case, the information processing apparatus 2000 at a certain time can receive a service provided on the LAN to which the information processing apparatus 2000 belongs at that time.

  FIG. 5 is a second diagram illustrating a state in which the information processing apparatus 2000 receives provision of services via the network. In FIG. 5, the network 20-1 and the network 20-2 are different LANs. The service providing apparatus 10-1 belongs to the network 20-1, and the service providing apparatus 10-2 belongs to the network 20-2. In this case, the information processing apparatus 2000 can receive a service provided by the service providing apparatus 10-1 when belonging to the network 20-1. On the other hand, the information processing apparatus 2000 can receive a service provided by the service providing apparatus 10-2 when belonging to the network 20-2.

<Acquisition of service identifier: S102>
The service identifier acquisition unit 2020 acquires a service identifier (S102). Here, the service identifier acquired by the service identifier acquisition unit 2020 is a service identifier that identifies a service that the information processing apparatus 2000 intends to use (a service that the information processing apparatus 2000 is attempting to connect to). For example, when the information processing apparatus 2000 intends to use the service provided by the service providing apparatus 10-1, the service identifier acquisition unit 2020 acquires the service identifier of the service provided by the service providing apparatus 10-1. .

  The method by which the service identifier acquisition unit 2020 acquires the service identifier is arbitrary. Hereinafter, a typical method for acquiring the service identifier will be exemplified.

<< Method 1 >>
The service identifier acquisition unit 2020 acquires a character string input to an application used for using the service as a service identifier. More specifically, the service identifier acquisition unit 2020 acquires, for example, a URL input to a Web browser, and acquires a domain name included in the URL as a service identifier. Here, a known technique can be used as a method for acquiring a domain name from a URL input to a Web browser. For example, the service identifier acquisition unit 2020 can be implemented as a Web browser plug-in having a function of “acquiring a URL input to a Web browser and extracting a domain name from the URL”.

<< Method 2 >>
The service identifier acquisition unit 2020 monitors character input by the user, and acquires a service identifier from the character string when the character string is input in a predetermined format. For example, it is assumed that a combination of a service identifier and a first character string is input to the information processing apparatus 2000 in the format “:: service name: first character string:”. In this case, the service identifier acquisition unit 2020 acquires, as a service identifier, a character string from immediately after “:” is input twice to immediately before “:” is input next. In this case, it is assumed that “:” is not included in the service identifier.

  For example, the service identifier acquisition unit 2020 is implemented as a device driver that hooks key inputs. The service identifier acquisition unit 2020 determines whether the character string obtained by hooking the key input matches a predetermined format. When the character string matches a predetermined format, the service identifier acquisition unit 2020 extracts a service identifier from the character string based on the format. A known technique can be used for a method of mounting a device driver that hooks key input and a method of determining whether or not a character string matches a predetermined format.

  Here, the monitoring of the character input by the user may always be performed, or may be performed only when a certain condition is satisfied. The certain condition is, for example, a condition that “an application (for example, a Web browser) used to use the service is a target of character input”. This condition is satisfied, for example, when the window of the application has focus.

<< Method 3 >>
The service identifier acquisition unit 2020 acquires a service identifier from an application used for using the service. This application is, for example, a web browser. For example, it is assumed that the user of the information processing apparatus 2000 selects a link on a certain Web page and uses a service provided at the link destination. In this case, for example, the service identifier acquisition unit 2020 acquires the domain name included in the URL of this link as a service identifier.

  When acquiring the service identifier from the URL of the link, the service identifier acquisition unit 2020 may acquire the service identifier from the URL of an arbitrary link, or may acquire the service identifier only from a URL that satisfies a certain condition. . In the latter case, the certain condition is, for example, a condition that “the Web page acquired by the URL is a login page”.

  In general, a login page includes a password input area. Therefore, if the Web page acquired with the URL of the selected link includes a password input area, the service identifier acquisition unit 2020 determines that the Web page is a login page and sets the domain name of the URL. Obtained as a service identifier.

  Whether or not the input area included in the Web page is a password input area can be estimated from the name of the input area. For example, the service identifier acquisition unit 2020 analyzes a source file (HTML file or the like) of a web page, and if the web page includes an input area with a predetermined name such as “passwd” or “password”, the web page is displayed. It is determined that it is a login page.

<About conversion rules>
The conversion rule acquired by the conversion unit 2040 is an arbitrary rule that can convert a certain character string to another character string. Hereinafter, typical conversion rules will be exemplified.

<< Character replacement >>
An example of the conversion rule is a rule for replacing each character included in the first character string with another character. The rule for replacing a character is, for example, a rule for replacing an original character with a predetermined number of characters (for example, one) before or after. The order here is, for example, the order when numbers, alphabets or kana characters are arranged in ascending order.

  FIG. 6 is a first diagram illustrating rules for replacing characters. In FIG. 6A, the conversion rule is “replace with the character of the previous rank”. According to this rule, the conversion unit 2040 converts “2” to “1”, “d” to “c”, and “o” to “e”.

  In FIG. 6B, the conversion rule is “replace with the next three characters”. According to this rule, the conversion unit 2040 converts “2” to “5”, “d” to “g”, and “O” to “ku”.

  Note that the method of representing the rule for character replacement is not limited to the method of representing the above-described order. For example, a rule representing character replacement may be represented by a positional relationship on the keyboard layout of characters before and after conversion.

  FIG. 7 is a second diagram illustrating rules for replacing characters. In FIG. 7, the conversion rule is “replace with the character of the key right one”. Further, the keyboard layout as a premise is the layout 40. This rule indicates that in the layout 40, the key corresponding to the character after conversion is positioned one right when viewed from the key corresponding to the character before conversion.

  In FIG. 7, the character before conversion is “G”. Here, in the layout 40, the right key of the “G” key is “H”. Therefore, the conversion unit 2040 converts “G” to “H”. The layout 40 used for replacement is determined in advance.

<< Addition of character string >>
Another example of the conversion rule is a rule for adding another character string to the first character string. FIG. 8 is a diagram illustrating conversion by adding a character string. In FIG. 8, the first character string is “abcd” and the conversion rule is “1234 is added”. Therefore, the conversion unit 2040 converts the first character string [abcd] into the second character string “abcd1234”.

<Acquisition of conversion rule: S104>
The conversion unit 2040 acquires a conversion rule corresponding to the target service without going through the service providing apparatus of the target service (S104). In this way, by obtaining the conversion rule without going through the service providing apparatus for the target service, the service providing apparatus for the target service does not need to handle the conversion rule. Therefore, when introducing the information processing apparatus 2000, it is not necessary to modify the service providing apparatus for the target service.

  The conversion rule is stored in the storage device in association with the service identifier. This storage device can be accessed without going through the service providing device of the target service. FIG. 9 is a diagram illustrating the relationship between a storage device that stores conversion rules and other devices. In FIG. 9A, the storage device 50 that stores the conversion rule is provided inside the information processing device 2000. For example, the storage device 50 is a storage medium 1080 inside the computer 1000 that implements the information processing device 2000. Since the storage device 50 is inside the information processing device 2000, the conversion unit 2040 can access the storage device 50 without going through the service providing device 10.

  On the other hand, in FIG. 9B, the storage device 50 is connected to the database server 60 that can be accessed from the information processing device 2000 without going through the service providing device 10. The conversion unit 2040 can acquire the conversion rule stored in the storage device 50 by requesting the database server 60 to perform a search process using the service identifier of the target service as a search key.

  As described above, the conversion rule differs for each service. For example, the conversion rules associated with each service have the same algorithm, and the parameters given to the algorithm are different. For example, assume that a common algorithm “replace each character with a character of another key” is used as a conversion rule for each service. In this case, the parameters representing the positional relationship of the characters before and after conversion on the keyboard layout are different for each service. For example, the conversion rule corresponding to the service A is “replaced with the character of the right key” and the conversion rule corresponding to the service B is “replaced with the character of the key left one”.

  In this case, only the parameters given to a predetermined algorithm such as “one right” or “one left” may be stored in association with the service identifier. The predetermined algorithm may be set in the conversion unit 2040 in advance, or may be stored in a storage device accessible from the conversion unit 2040.

<Acquisition of first character string: S106>
The conversion unit 2040 acquires the first character string (S106). The input of the first character string is performed using, for example, the input device 30 connected to the computer. As described above, the input device 30 is, for example, a keyboard or a touch panel.

  Here, the first character string is input by the user with the intention of being used as a password in user authentication of the target service. The information processing apparatus 2000 converts such a first character string into a second character string, and transmits the second character string as a password in user authentication of the target service. Therefore, the password actually used for user authentication of the target service is not the first character string itself input by the user, but the second character string generated from the first character string by the information processing apparatus 2000.

  Therefore, the conversion unit 2040 acquires a character string that is intended to be used as a password in user authentication of the target service as the first character string. Here, there are various methods for obtaining the first character string (character string intended to be used as a password in user authentication of the target service) from among various character strings input by the user. Hereinafter, typical methods will be exemplified.

<< Specification based on input location >>
The conversion unit 2040 acquires the character string input in the specific input area as the first character string. The specific input area is an input area in which it is estimated that a password for user authentication of the target service is input. More specifically, for example, the specific input area is an input area for a password included in the login page of the target service.

  FIG. 10 is a diagram illustrating a password input area. FIG. 10 shows a Web browser on which a target service login page is displayed. For example, the conversion unit 2040 treats an input area having a predetermined name such as “passwd” or “password” as an input area where a password is input for user authentication of the target service. Therefore, the conversion unit 2040 acquires, as the first character string, the character string input to the input area having such a predetermined name on the login page of the target service.

<< Specification based on character string format >>
When a character string that matches a predetermined format is input, the conversion unit 2040 acquires a first character string from the character string. For example, the predetermined format is the above-described format “:: service name: first character string:”. In this case, the first character string is a series of inputs in which (1) “:” is input twice in succession, (2) some character string is subsequently input, and (3) “:” is further input. Is a character string that starts immediately after The end of the first character string is the character up to immediately before “:” to be input next. In this case, it is assumed that “:” is not included in the first character string.

  In this case, the conversion unit 2040 is implemented as a device driver that hooks the key input together with the service identifier acquisition unit 2020.

<Conversion to second character string: S108>
The conversion unit 2040 converts the first character string into the second character string based on the acquired conversion rule (S108). Here, the method of converting the first character string into the second character string according to the conversion rule is as described in the explanation of the conversion rule.

  When the first character string is partially converted into the second character string, the conversion unit 2040 may acquire all the characters constituting the first character string and then convert the first character string into the second character string. You may perform conversion to a 2nd character string, whenever the character required for conversion is acquired.

  For example, in the latter case, each character of the first character string is replaced according to the conversion rule. In this case, the conversion unit 2040 obtains the characters that make up the first character string one by one, and replaces the characters at the timing when each character is obtained. More specifically, when replacing the first character string “asdf” with the conversion rule “replace with the next-ranked character”, the conversion unit 2040 converts it at the timing of acquiring “a”. Replace it with “b”, replace it with “t” at the timing when “s” is acquired, replace it with “e” at the timing when “d” is acquired, and replace it with the timing when “f” is acquired Is replaced with “g”. As a result, a second character string “bteg” is generated.

<Transmission of second character string: S110>
The transmission unit 2060 transmits the second character string to the service providing apparatus of the target service (S110). Here, the transmitting unit 2060 transmits the second character string instead of the first character string to the service providing apparatus of the target service. The transmission method is the same as the method for transmitting the first character string to the service providing apparatus of the target service.

  As described above, the first character string is input by the user with the intention of being used as a password in user authentication of the target service. Therefore, the transmission unit 2060 transmits the second character string to the service providing apparatus of the target service using an existing method of transmitting a password for user authentication of the target service to the service providing apparatus of the target service.

  For example, it is assumed that a password is transmitted as a parameter of the HTTP protocol POST request to the service providing apparatus of the target service. In this case, the transmission unit 2060 transmits a POST request in which the second character string is set in the password parameter to the service providing apparatus of the target service.

[Example]
An embodiment in which the method of using the information processing apparatus 2000 is more concrete will be described. The embodiment described below is merely an example of a method of using the information processing apparatus 2000, and does not limit the method of realizing the information processing apparatus 2000.

  FIG. 11 is a diagram illustrating a usage environment of the information processing apparatus 2000 according to the embodiment. The information processing apparatus 2000 is connected to the service providing apparatus 10-1, the service providing apparatus 10-2, and the database server 60 via the network 20.

  The information processing apparatus 2000 is a smartphone owned by the user. A user who wants to use the information processing apparatus 2000 first installs a program configured by a combination of program modules for realizing the service identifier acquisition unit 2020, the conversion unit 2040, and the transmission unit 2060 in a general-purpose smartphone. By doing so, the smartphone operates as the information processing apparatus 2000.

  The service identifier is represented by the domain name of the service. The domain name of the service provided by the service providing apparatus 10-1 is “service_1.co.jp”, and the domain name of the service provided by the service providing apparatus 10-2 is “service_2.co.jp”. To do.

  The database server 60 manages a storage device 50 that stores service identifiers and conversion rules in association with each other.

  First, the user operates the information processing apparatus 2000 to perform pre-registration. Pre-registration is a process for generating a conversion rule associated with a service identifier and storing information in which the generated conversion rule is associated with a service identifier in the storage device 50.

  FIG. 12 illustrates a pre-registration screen. The user inputs the service identifier in the input area 80. The information processing apparatus 2000 transmits the service identifier input in the input area 80 to the database server 60.

  The database server 60 generates a conversion rule corresponding to the acquired service name. In this embodiment, a conversion rule of character replacement based on the positional relationship on the keyboard layout is used in common for all services. However, a parameter indicating the positional relationship of keys before and after conversion (such as “one right”) is determined for each service identifier.

  The database server 60 that has acquired the service identifier generates a conversion rule parameter associated with the service identifier, and stores the parameter in association with the service identifier. For example, this parameter is randomly generated.

  For example, it is assumed that the user performs pre-registration for a service provided by the service providing apparatus 10-1. In this case, the user inputs “service_1.co.jp” in the input area 80 of FIG. Then, this service identifier is transmitted to the database server 60. For example, the database server 60 stores information in which the service identifier is associated with the parameter of the conversion rule “one right” in the storage device 50.

  Similarly, it is assumed that the user has pre-registered the service provided by the service providing apparatus 10-2. In the present embodiment, it is assumed that the database server 60 stores information in which the service identifier “service_2.co.jp” is associated with the parameter of the conversion rule “one lower” in the storage device 50.

  A user who has completed pre-registration registers a user account with the service to be used. FIG. 13 is a user account registration screen. First, the user inputs a user ID “user1” in an input area 82 which is an area for inputting a user ID. Furthermore, the user inputs a character string in the format “:: service identifier: password:” in the input area 84, which is an area for inputting a password. For example, it is assumed that the user uses a service provided by the service providing apparatus 10-1. Also assume that the user uses the string “password” as the password. In this case, the user inputs “:: service_1.co.jp: password:” in the input area 84. Note that the character string input in the input area 84 is a hidden character.

  Hereinafter, the flow of processing in the information processing apparatus 2000 when the character string “:: service_1.co.jp: password:” is input in the input area 84 will be described. FIG. 14 is a diagram conceptually illustrating the flow of processing in the information processing apparatus 2000 according to the embodiment.

  In this embodiment, a device driver 90 for realizing a service identifier acquisition unit 2020 and a conversion unit 2040 operates in an OS (Operating System) 110 that operates on the information processing apparatus 2000. The device driver 90 extracts the service identifier and the first character string (password) from the character string that matches the format “:: service identifier: password:”.

  The user uses the touch panel 100 to input the above-described character string “:: service_1.co.jp: password:”. The device driver 90 operates every time one key is touched. The device driver 90 recognizes that “:” has been input twice in succession, and then recognizes a character string made up of each character recognized until it is recognized that one “:” has been input next. (Service_1.co.jp) is treated as a service identifier. Therefore, the device driver 90 acquires the parameter of the conversion rule “one right” corresponding to the service identifier “service_1.co.jp” from the database server 60.

  Furthermore, after acquiring the service identifier, the device driver 90 sequentially converts each character recognized until “:” is input next, according to a conversion rule of “replace with the character of the right key”. I will do it. FIG. 15 is a diagram illustrating a keyboard layout used for conversion. Specifically, the device driver 90 converts “p” to “[”, “a” to “s”, “s” to “d”, “s” to “d”. , "W" to "e", "o" to "p", "r" to "t", "d" to "f" . Therefore, the character string recognized by the web browser 120 as the character string input in the input area 84 is not “:: service_1.co.jp: password:” input by the user, but “:: service_1.co.jp”. : [sddeptf:]

  Each character input using the touch panel 100 is displayed on the touch panel 100 through processing by the device driver 90 and rendering processing by the Web browser 120.

  When the user presses the send button 86, the information processing apparatus 2000 performs a process of transmitting the user ID and password to the service providing apparatus 10-1. Here, the transmission unit 2060 is a plug-in that operates inside the Web browser 120.

  The web browser 120 generates a POST request for transmitting a set of user ID and password. The password in this POST request is “:: service_1.co.jp: [sddeptf:”, which is input in the input area 84. Therefore, the transmission unit 2060 replaces the password in the POST request with “[sddeptf”. By doing so, the password transmitted to the service providing apparatus 10-1 becomes the second character string generated based on the conversion rule.

  The above-described POST request is divided into packets by the protocol stack 92, and then transmitted to the service providing apparatus 10-1 via the network interface 1120. As a result, the service providing apparatus 10-1 generates a user account in which the user ID “user1” is associated with the password “[sddeptf”. In addition, a known technique can be used for the process of dividing the POST request into packets and transmitting them.

  Further, it is assumed that the user generates a user account using the same user ID and password for the service provided by the service providing apparatus 10-2. At this time, the conversion unit 2040 performs conversion using a parameter “one down” associated with “service_2.co.jp”. That is, the first character string “password” is converted into the second character string “; zxxslfc” according to the conversion rule “replace with the character of the key one level lower”. Therefore, in the service providing apparatus 10-2, a user account in which the user ID “user1” is associated with the password “; zxxslfc” is generated.

  Thus, according to the information processing apparatus 2000, even when the same user account is used for a plurality of services, the passwords that are actually registered in the services differ for each service. Thus, the user does not need to be aware that a different password is registered for each service. This is because the conversion based on the conversion rule is automatically performed by the information processing apparatus 2000. Therefore, according to the information processing apparatus 2000, it is possible to improve the security of the password without placing a burden on the user to remember a different password for each service.

  In addition, providing the database server 60 outside the service providing apparatus 10 eliminates the need to modify the service providing apparatus 10. The database server 60 may be provided inside the information processing apparatus 2000. In this case, the program for realizing the information processing apparatus 2000 includes a program module for generating and managing the association between the service identifier and the conversion rule.

  In the above-described example, a user account is newly generated after performing pre-registration, but a user account may be generated before performing pre-registration. In this case, the user changes the password in the service to be used. At that time, the user inputs the service identifier and the password in the format of “:: service identifier: password:” in the input area for inputting a new password. By doing so, a second character string is generated from this password, and the second character string is transmitted to the service providing apparatus 10 as a new password. As a result, the second character string is registered as a new password.

  As mentioned above, although embodiment of this invention was described with reference to drawings, these are the illustrations of this invention, Various structures other than the above are also employable.

Hereinafter, examples of the reference form will be added.
1. Service identifier acquisition means for acquiring a service identifier for identifying one of the different services;
A conversion rule associated with the service specified by the service identifier is acquired without using a device that provides the service, and a first character string is converted into a second character string based on the acquired conversion rule. A conversion means for converting to a character string;
Transmitting means for transmitting the second character string to a device that provides a service specified by the acquired service identifier;
The information processing apparatus, wherein the conversion rule is defined for each service.
2. The conversion rule associated with the service specified by the service identifier is stored in a storage device that can be accessed without using a device that provides the service. The information processing apparatus described in 1.
3. The conversion rule is a parameter used in a predetermined algorithm for converting a first character string into a second character string. Or 2. The information processing apparatus described in 1.
4). The conversion rule indicates a positional relationship of keys corresponding to characters before and after conversion on a predetermined keyboard layout.
The conversion means converts the first character string into the second character string by replacing each character representing the first character string with another character based on the acquired conversion rule. 1. To 3. The information processing apparatus according to any one of the above.
5. The service identifier acquisition means acquires the service identifier from a character string input by a user,
The conversion means obtains the first character string from a character string input subsequent to the service identifier. To 4. The information processing apparatus according to any one of the above.
6). A control method executed by a computer,
A service identifier acquisition step for acquiring a service identifier for identifying one of the different services;
A conversion rule associated with the service specified by the service identifier is acquired without using a device that provides the service, and a first character string is converted into a second character string based on the acquired conversion rule. A conversion step to convert to a string;
Transmitting the second character string to a device that provides a service specified by the acquired service identifier, and
The control method, wherein the conversion rule is defined for each service.
7). 5. The conversion rule associated with the service specified by the service identifier is stored in a storage device that can be accessed without using a device that provides the service. The control method described in 1.
8). 5. The conversion rule is a parameter used in a predetermined algorithm for converting a first character string into a second character string. Or 7. The control method described in 1.
9. The conversion rule indicates a positional relationship of keys corresponding to characters before and after conversion on a predetermined keyboard layout.
The conversion step converts the first character string into the second character string by replacing each character representing the first character string with another character based on the acquired conversion rule. 6. To 8. The control method as described in any one.
10. The service identifier acquisition step acquires the service identifier from a character string input by a user,
5. the converting step acquires the first character string from a character string input following the service identifier; Thru 9. The control method as described in any one.
11. 6). To 10. A program for causing a computer to execute each step of the control method according to any one of the above.

DESCRIPTION OF SYMBOLS 10 Service provision apparatus 20 Network 30 Input device 40 Layout 50 Storage device 60 Database server 80 Input area 82 Input area 84 Input area 1000 Computer 1020 Bus 1040 Processor 1060 Memory 1080 Storage medium 1100 Input / output interface 1120 Network interface 2000 Information processing apparatus 2020 Service Identifier acquisition unit 2040 conversion unit 2060 transmission unit

Claims (7)

Service identifier acquisition means for acquiring a service identifier for identifying one of the different services;
A conversion rule associated with the service specified by the service identifier is acquired without using a device that provides the service, and a first character string is converted into a second character string based on the acquired conversion rule. A conversion means for converting to a character string;
Transmitting means for transmitting the second character string to a device that provides a service specified by the acquired service identifier;
The information processing apparatus, wherein the conversion rule is defined for each service.   The information processing apparatus according to claim 1, wherein the conversion rule associated with the service specified by the service identifier is stored in a storage device accessible without using a device that provides the service.   The information processing apparatus according to claim 1, wherein the conversion rule is a parameter used in a predetermined algorithm for converting a first character string into a second character string. The conversion rule indicates a positional relationship of keys corresponding to characters before and after conversion on a predetermined keyboard layout.
The conversion means converts the first character string into the second character string by replacing each character representing the first character string with another character based on the acquired conversion rule. The information processing apparatus according to any one of claims 1 to 3. The service identifier acquisition means acquires the service identifier from a character string input by a user,
5. The information processing apparatus according to claim 1, wherein the conversion unit acquires the first character string from a character string input subsequent to the service identifier. 6. A control method executed by a computer,
A service identifier acquisition step for acquiring a service identifier for identifying one of the different services;
A conversion rule associated with the service specified by the service identifier is acquired without using a device that provides the service, and a first character string is converted into a second character string based on the acquired conversion rule. A conversion step to convert to a string;
Transmitting the second character string to a device that provides a service specified by the acquired service identifier, and
The control method, wherein the conversion rule is defined for each service.   The program which makes a computer perform each step which the control method of Claim 6 has.

Images