JP2020009095A - Passwords or the like management device, passwords or the like management system, and passwords or the like management method - Google Patents

Abstract

To provide an authentication information management device, an authentication information management system, and an authentication information management method, capable of enhancing security.SOLUTION: A device comprises a storage section 33 for storing a plurality of passwords or the like and a control section 32 for controlling information to be stored into the storage section 33. When a password or the like identical to a password or the like requested to be set is stored in the storage section 33 in a predetermined number, the control section 32 disables it to store the password or the like requested to be set into the storage section 33. Accordingly, it can prevent authentication information including an identical password or the like from being registered beyond the predetermined number.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a password management device, a password management system, and a password management method.

  2. Description of the Related Art Conventionally, when an electronic device such as a computer is used, a password or a passphrase (hereinafter, referred to as passwords) has been widely used as a mechanism for authenticating a valid user. However, if passwords are known to others, there is a risk that personal information, confidential information, and the like may be leaked due to unauthorized access.

  Therefore, as one of techniques for improving the security of passwords, a mechanism has been proposed in which a valid period is provided for a password and the password is updated at regular intervals (for example, see Patent Document 1).

  Further, for example, when it is necessary to register a password for each of a large number of devices constituting a large-scale system, the same password is registered for ease of management (for example, see Patent Document 2). .

Japanese Patent Application Laid-Open No. Hei 7-182604 JP 2006-301888 A

  Registering the same password may reduce security. For example, if employees and employees collude and passwords are the same, contrary to the information security manager's intention, if it is possible to obtain the ID of another person by some means, it is easy to use the electronic device impersonating another person Will be.

  An object of the present invention is to provide a password management apparatus, a password management system, and a password management method that can enhance security.

  In order to achieve the above object, a first aspect according to the present invention includes a storage unit that stores a plurality of passwords, and a control unit that controls storage of information in the storage unit, wherein the control unit If a predetermined number of passwords identical to the passwords requested to be set are stored in the storage unit, the storage of the passwords requested to be set is disabled in the storage unit.

  According to the first aspect, when a predetermined number of passwords identical to the passwords requested to be set are stored in the storage unit, the control unit stores the passwords requested to be set in the storage unit. , It is possible to prevent the same passwords from being registered in excess of a predetermined number. Therefore, security can be improved.

  In a second aspect according to the present invention, in the first aspect, the control unit is configured such that, when a predetermined number of passwords identical to the passwords requested to be set are stored in the storage unit within a predetermined period, And disabling storage of the passwords requested to be set in the storage unit.

  According to the second aspect, when the control unit stores a predetermined number of passwords in the storage unit within the predetermined period, the storage unit stores the passwords requested to be set. Since the storage in the section is disabled, it is possible to prevent the same passwords from being registered in excess of a predetermined number only within a predetermined period. Therefore, accidental matching of passwords caused by a long management period can be excluded from the restriction.

  In a third aspect according to the present invention, in the first or second aspect, the control unit regards the passwords as the same when the matching rate is equal to or higher than a predetermined rate.

  According to the third aspect, the control unit considers the passwords to be the same when the matching rate is equal to or higher than a predetermined ratio. Can be prevented.

  According to a fourth aspect of the present invention, in the first aspect, the predetermined number can be set for each user attribute.

  According to the fourth aspect, since the predetermined number can be set for each attribute of the user, setting the predetermined number to a small number gives priority to security, or increasing the predetermined number to a large number. By setting, priority can be given to convenience.

  A fifth aspect according to the present invention includes any one of the first to fourth aspects, and a terminal device including an input unit to which a setting operation of a password and the like are input, and the control unit includes: When a predetermined number of passwords identical to the passwords requested to be set based on the input to the input unit are stored in the storage unit, the storage of the passwords requested to be set is disabled in the storage unit. I do.

  According to the fifth aspect, when a predetermined number of passwords identical to the passwords requested to be set based on the input to the input unit of the terminal device are stored in the storage unit, the control unit performs the setting. Since the storage of the requested passwords in the storage unit is prohibited, it is possible to prevent the same passwords from being registered in excess of a predetermined number. Therefore, security can be improved.

  In a sixth aspect according to the present invention, a step of determining whether a predetermined number of passwords identical to the passwords requested to be set are stored in the storage unit, and the same password as the passwords requested to be set When a predetermined number of passwords are stored in the storage unit, disabling storage of the passwords requested to be set in the storage unit.

  According to the sixth aspect, when a predetermined number of passwords identical to the passwords requested to be set are stored in the storage unit, the storage of the passwords requested to be set is disabled in the storage unit. Therefore, it is possible to prevent the same passwords from being registered in excess of a predetermined number. Therefore, security can be improved.

  According to the present invention, it is possible to provide a password management apparatus, a password management system, and a password management method that can enhance security.

FIG. 1 is a block diagram showing an authentication information management system which is an embodiment of a password management system according to the present invention. 6 is a flowchart showing a main part of control contents of a client PC of an authentication information management system which is an embodiment of a password management system according to the present invention. It is a flowchart which shows the principal part of the control content of the authentication server of the authentication information management system which is one Embodiment of the password management system concerning this invention.

  An embodiment according to the present invention will be described below with reference to the drawings.

  The authentication server 10 (password management device) of the present embodiment authenticates a predetermined management area (the same domain, a site of the authentication information management system 11, a belonging group, etc.) of the authentication information management system 11 (password management system). Information is centrally managed. In this predetermined management area, a client PC 12 which is one or a plurality of terminal devices is provided, and the authentication server 10 and the client PC 12 are connected via a network 13.

  The client PC 12 includes an input unit 21 that receives an operation input, a display unit 22 that performs display, a terminal control unit 23 that controls the client PC 12, and a terminal that is connected to the network 13 and communicates with the authentication server 10 via the network 13. And a communication unit 24.

  The authentication server 10 is connected to the network 13 and communicates with the terminal communication unit 24 via the network 13. The authentication server 10 transmits authentication information based on information input from each client PC 12 via the server communication unit 31. It has a server control unit 32 (control unit) that controls the authentication server 10 by determining whether setting is possible and the like, and a storage unit 33 that stores authentication information and the like that the server control unit 32 determines that setting is possible. . The authentication information is information necessary for permitting use of each device such as the client PC 12 connected to the authentication server 10 via the network 13, and the storage unit 33 stores a plurality of such authentication information. Have been.

  Here, the authentication information is set for each client PC 12, and is composed of a combination of an ID that is user identification information and a password such as a password or a passphrase set in association with the ID. . Note that the ID may be a user ID, a card ID such as an IC card read by a card reader provided in the input unit 21 of the client PC 12, or a USB connection unit provided in the input unit 21 of the client PC 12. A USB token may be used, as long as the object to be authenticated can be uniquely identified. When a single client PC 12 is shared by a plurality of users, a plurality of user accounts are created, and a plurality of combinations of IDs and passwords are set, so that different authority for each user (such as restricting some functions). ).

  Here, as a specific example, the above-described management area managed by the authentication server 10 is used only when appropriate authentication information of the user A is input to the specific area, which is dedicated to the specific user A. Client PC 12 (A), client PC 12 (B) dedicated to user B who is a specific individual and usable when appropriate authentication information of user B is input, and client PC 12 (B) A client PC 12 (C) which is dedicated to a certain user C and can be used when appropriate authentication information of the user C is input, and a plurality of specific users D, E, F, Clients that are shared with users G,... And can be used when appropriate authentication information of any one of these users D, E, F, G,. When having PC12 (D) It will be described as an example.

  It should be noted that each component of the client PC 12 (A) is denoted by (A), each component of the client PC 12 (B) is denoted by (B), and each component of the client PC 12 (C) is denoted by (B). , A code (C), and the components of the client PC 12 (D) are distinguished by a code (D).

  Here, as described above, the client PC 12 (A) can be used when the proper authentication information of the user A is input, and thus the proper authentication information of the user A is stored in the client PC 12 (A). , And the other authentication information is authentication information not having the authority to use the client PC 12 (A). Similarly, the proper authentication information of the user B becomes the authentication information having the authority to use the client PC 12 (B), and the appropriate authentication information of the user C becomes the authentication information having the authority to use the client PC 12 (C). The appropriate authentication information of the user D is the authentication information having the authority to use the client PC 12 (D).

  In the authentication information management system 11, for example, when using the client PC 12 (A), the user inputs an input to the input unit 21 (A) along the display guide on the display unit 22 (A) of the client PC 12 (A). Do. Then, the terminal control unit 23 (A) first causes the display unit 22 (A) to display a prompt for inputting an ID and a password as authentication information to the input unit 21 (A). When an ID and a password are input to input unit 21 (A) according to this display, terminal control unit 23 (A) transmits authentication information including a combination of the ID and password to terminal control unit 23 (A). Along with the identification information, the information is transmitted from the terminal communication unit 24 (A) to the server communication unit 31 of the authentication server 10 via the network 13.

  When the server communication unit 31 receives the authentication information transmitted from the terminal control unit 23 (A), the server control unit 32 determines that the same authentication information as the authentication information has the authentication right to use the client PC 12 (A). It is determined whether the information is stored in the storage unit 33 as information. That is, the same combination of ID and password as the combination of ID and password transmitted from the terminal control unit 23 (A) is stored as a combination of ID and password having authority to use the client PC 12 (A). Is determined.

  In this determination, if the same authentication information as the authentication information transmitted from the terminal control unit 23 (A) is not stored in the storage unit 33 as the authentication information having the authority to use the client PC 12 (A), the server The control unit 32 transmits information indicating that the authentication information transmitted from the terminal control unit 23 (A) is inappropriate from the server communication unit 31 to the terminal communication unit 24 (A) via the network 13. When this information is received by the terminal communication unit 24 (A), the terminal control unit 23 (A) displays on the display unit 22 (A) that the authentication information including the combination of the ID and the password is incorrect. Then, it waits for re-input of the authentication information including the combination of the ID and the password.

  On the other hand, in this determination, when the same authentication information as the authentication information transmitted from the terminal control unit 23 (A) is stored in the storage unit 33 as the authentication information having the authority to use the client PC 12 (A). The server control unit 32 transmits information indicating that the authentication information transmitted from the terminal control unit 23 (A) is appropriate from the server communication unit 31 to the terminal communication unit 24 (A) via the network 13. . When this information is received by the terminal communication unit 24 (A), the terminal control unit 23 (A) puts the client PC 12 (A) into a login state, and makes it possible to execute a control menu permitted in the login state. .

  Further, for example, when the ID and the password are input to the input unit 21 (B), the terminal control unit 23 (B) transmits the authentication information including the combination of the ID and the password to the authentication server 10 as described above. Send to Then, the server control unit 32 of the authentication server 10 stores the same authentication information transmitted from the terminal control unit 23 (B) in the storage unit 33 as the authentication information having the authority to use the client PC 12 (B). It is determined whether or not it is stored.

  In this determination, if the same authentication information as the authentication information transmitted from the terminal control unit 23 (B) is not stored in the storage unit 33 as the authentication information having the authority to use the client PC 12 (B), the server The control unit 32 transmits information indicating that the authentication information transmitted from the terminal control unit 23 (B) is inappropriate, and upon receiving this information, the terminal control unit 23 (B) transmits the authentication information. A display indicating that the information is inappropriate is displayed on the display unit 22 (B).

  On the other hand, in this determination, when the same authentication information as the authentication information transmitted from the terminal control unit 23 (B) is stored in the storage unit 33 as authentication information having authority to use the client PC 12 (B). The server control unit 32 transmits information indicating that the authentication information transmitted from the terminal control unit 23 (B) is appropriate, and upon receiving this information, the terminal control unit 23 (B) The client PC 12 (B) is set in the login state, and the control menu permitted in the login state can be executed.

  For example, when an ID and a password are input to the input unit 21 (C), the terminal control unit 23 (C) transmits the authentication information including the combination of the ID and the password to the authentication server 10 as described above. Send to Then, the server control unit 32 of the authentication server 10 stores the same authentication information as the authentication information transmitted from the terminal control unit 23 (C) in the storage unit 33 as authentication information having the authority to use the client PC 12 (C). It is determined whether or not it is stored.

  In this determination, if the same authentication information as the authentication information transmitted from the terminal control unit 23 (C) is not stored in the storage unit 33 as the authentication information having the authority to use the client PC 12 (C), the server The control unit 32 transmits information indicating that the authentication information transmitted from the terminal control unit 23 (C) is inappropriate, and upon receiving this information, the terminal control unit 23 (C) transmits the authentication information. An indication that the information is inappropriate is displayed on the display unit 22 (C).

  On the other hand, in this determination, when the same authentication information as the authentication information transmitted from the terminal control unit 23 (C) is stored in the storage unit 33 as authentication information having authority to use the client PC 12 (C). The server control unit 32 transmits information indicating that the authentication information transmitted from the terminal control unit 23 (C) is appropriate, and upon receiving this information, the terminal control unit 23 (C) The client PC 12 (C) is set in the login state, and the control menu permitted in the login state can be executed.

  Further, for example, when an ID and a password are input to the input unit 21 (D), the terminal control unit 23 (D) transmits the authentication information including the combination of the ID and the password to the authentication server 10 as described above. Send to Then, the server control unit 32 of the authentication server 10 stores the same authentication information as the authentication information transmitted from the terminal control unit 23 (D) in the storage unit 33 as authentication information having authority to use the client PC 12 (D). It is determined whether or not it is stored.

  In this determination, if the same authentication information as the authentication information transmitted from the terminal control unit 23 (D) is not stored in the storage unit 33 as the authentication information having the authority to use the client PC 12 (D), the server The control unit 32 transmits information indicating that the authentication information transmitted from the terminal control unit 23 (D) is inappropriate, and upon receiving this information, the terminal control unit 23 (D) transmits the authentication information. An indication that the information is inappropriate is displayed on the display unit 22 (D).

  On the other hand, in this determination, when the same authentication information as the authentication information transmitted from the terminal control unit 23 (D) is stored in the storage unit 33 as the authentication information having the authority to use the client PC 12 (D). The server control unit 32 transmits information indicating that the authentication information transmitted from the terminal control unit 23 (D) is appropriate, and upon receiving this information, the terminal control unit 23 (D) The client PC 12 (D) is set in the login state, and the control menu permitted in the login state can be executed.

  Here, the authentication information stored in the storage unit 33 as the authentication information having the authority to use the client PC 12 (A), and the authentication information stored in the storage unit 33 as the authentication information having the authority to use the client PC 12 (B). The authentication information stored in the storage unit 33 as the authentication information having the authority to use the client PC 12 (C) is one each, and the client PCs 12 (A) to 12 (C) each have the authority to use the client PC 12 (C). When one piece of authentication information and the input authentication information match, a login state is set.

  On the other hand, there are a plurality of pieces of authentication information stored in the storage unit 33 as authentication information having the authority to use the client PC 12 (D), and the client PC 12 (D) determines whether any of these pieces of authentication information is the client PC 12 (D). Even when the authentication information matches the authentication information input in D), the user enters the login state.

  As described above, the authentication information management system 11 collates the ID and password authentication information stored in the storage unit 33 of the authentication server 10 with the ID and password authentication information input by the user in the client PC 12. Thus, the legitimacy of the user is determined. The authentication server 10 permits the use of the client PC 12 when the user is authenticated as a person having the right authority.

  In such an authentication information management system 11, authentication information having the right to use the personal client PCs 12 (A) to 12 (C) is set, and authentication information having the right to use the shared client PC 12 (D) is set. Will be described with reference to the flowcharts of FIGS. 2 and 3.

  When newly setting the authentication information having the authority to use the client PC 12 (A), the setter inputs the authentication information to the input unit 21 (A) along the display guide on the display unit 22 (A) of the client PC 12 (A). Perform input to start new setting. Then, the terminal control unit 23 (A) starts the new setting process of the authentication information, and displays a display prompting the user to input the setting desired ID and the desired setting passwords to the input unit 21 (A) on the display unit 22 (A). A) is displayed.

  When a desired setting ID and a desired setting password are input to the input unit 21 (A) according to the display (step Sa1: YES in FIG. 2), the terminal control unit 23 (A) requests the setting. The terminal-communication unit 24 (A) transmits authentication information of the setting request including the ID and the password of the setting request together with the identification information of the terminal control unit 23 (A) and the new setting request information for requesting the new setting of the ID and the password. A), and transmits to the server communication unit 31 of the authentication server 10 via the network 13 (step Sa2 in FIG. 2).

  Then, the server control unit 32 of the authentication server 10 receives the new setting request information and the authentication information including the passwords desired to be set from the terminal control unit 23 (A) (Step Sb1: FIG. 3). YES), the authentication information of the setting request transmitted from the terminal control unit 23 (A) together with the new setting request information becomes the authentication information of the setting request from the terminal control unit 23 (A), and the setting request information included in the authentication information. Is the ID requested to be set by the terminal control unit 23 (A), and the passwords desired to be set included in the authentication information are the passwords requested to be set by the terminal control unit 23 (A).

  Then, the server control unit 32 stores in the storage unit 33 the passwords included in the authentication information requested to be set by the terminal control unit 23 (A) and the same passwords requested by the terminal control unit 23 (A) to be set. It is determined whether or not a predetermined allowable number (predetermined number) is stored in the passwords included in the authentication information stored in (a) (step Sb2 in FIG. 3). That is, the server control unit 32 determines whether a predetermined number of passwords identical to the passwords requested to be set based on the input to the input unit 21 (A) of the client PC 12 (A) are stored in the storage unit 33 or not. Is performed. Here, the passwords stored in the storage unit 33 that are determined to be the same as the passwords requested to be set are stored in the storage unit 33 to confirm that the user has the right to use in the management area. Passwords for all authentication information.

  In this determination, the passwords identical to the passwords requested to be set by the terminal control unit 23 (A) are stored in the passwords in the management area stored in the storage unit 33 in the above-described allowable limit number. (Step Sb2 in FIG. 3: YES), the server control unit 32 requests that the passwords be changed because the passwords requested to be set by the terminal control unit 23 (A) are incorrect. The change request information shown is transmitted from the server communication unit 31 to the terminal communication unit 24 (A) via the network 13 (step Sb3 in FIG. 3). When the terminal communication unit 24 (A) receives this change request information (Step Sa3 in FIG. 2: YES), the terminal control unit 23 (A) informs the user that the passwords included in the authentication information desired to be set are incorrect. Is displayed on the display unit 22 (A), and the re-input of the passwords is awaited (step Sa1 in FIG. 2).

  On the other hand, in this determination, the same passwords as the passwords requested to be set by the terminal control unit 23 (A) are included in the passwords in the management area stored in the storage unit 33 in the allowable limit number. If the authentication information is not stored (step Sb2 in FIG. 3: NO), the server control unit 32 determines that the authentication information requested to be set by the terminal control unit 23 (A) is appropriate, and The combination of the ID requested to be set by the control unit 23 (A) and the passwords requested to be set by the terminal control unit 23 (A) is newly set and stored as authentication information having the authority to use the client PC 12 (A). It is stored in the unit 33 (step Sb4 in FIG. 3).

  At the same time, the server control unit 32 transmits the new setting completion notification information indicating that the new setting of the authentication information requested to be set by the terminal control unit 23 (A) has been completed from the server communication unit 31 to the terminal communication via the network 13. It is transmitted to the unit 24 (A) (step Sb5 in FIG. 3). When the terminal communication unit 24 (A) receives the new setting completion notification information (step Sa4 in FIG. 2: YES), the terminal control unit 23 (A) ends the authentication information new setting process of the client PC 12 (A). I do. In addition, the passwords satisfy a predetermined strength setting criterion (such as eight or more digits including half-width alphanumeric symbols) as a condition that can be set.

  As described above, in the new setting process, the server control unit 32 determines that if the same passwords as those requested to be set by the terminal control unit 23 (A) are stored in the storage unit 33 in the predetermined allowable limit number, Even if the passwords requested to be set by the terminal control unit 23 (A) satisfy a predetermined strength setting criterion, a step of disabling storage of the passwords requested to be set in the storage unit 33 is performed.

  The allowable limit number of the same passwords can be set to a plurality. For this reason, by setting a plurality of passwords, it becomes possible to set the same passwords for a plurality of different IDs. For example, if the allowable limit number is set to three, the same passwords can be set for three different IDs and stored in the storage unit 33, while the same password is set for four different IDs. It is impossible to set passwords and store them in the storage unit 33.

  When the passwords of the authentication information having the authority to use the client PC 12 (A) are updated and set, the setter operates the input unit 21 (A) along the display guide of the display unit 22 (A) of the client PC 12 (A). Enter the password to start updating passwords. Then, the terminal control unit 23 (A) starts the update setting processing of the passwords of the authentication information having the authority to use the client PC 12 (A), and inputs the desired passwords into the input unit 21 (A). Is displayed on the display unit 22 (A). When a password desired to be set is input to the input unit 21 (A) according to this display (Step Sa1: YES in FIG. 2), the terminal control unit 23 (A) discriminates the identification information of the terminal control unit 23 (A). And the update setting request information for requesting the update setting of the passwords, and transmits the desired passwords to the server communication unit 31 of the authentication server 10 via the terminal communication unit 24 (A) (step in FIG. 2). Sa2).

  Then, the server control unit 32 of the authentication server 10 receives the passwords desired to be set from the terminal control unit 23 (A) (step Sb1: YES in FIG. 3), and the passwords desired to be set are received. Are passwords requested to be set by the terminal control unit 23 (A). The server control unit 32 stores a password identical to the password requested to be set by the terminal control unit 23 (A) in the passwords in the management area stored in the storage unit 33 in a predetermined manner. It is determined whether the allowable limit number is stored (step Sb2 in FIG. 3).

  In this determination, the passwords identical to the passwords requested to be set by the terminal control unit 23 (A) are stored in the passwords in the management area stored in the storage unit 33 in the above-described allowable limit number. (Step Sb2 in FIG. 3: YES), the server control unit 32 transmits the change request information to the server communication unit 31 because the passwords requested to be set by the terminal control unit 23 (A) are incorrect. To the terminal communication unit 24 (A) via the network 13 (step Sb3 in FIG. 3). When this change request information is received by the terminal communication unit 24 (A) (step Sa3 in FIG. 2: YES), the terminal control unit 23 (A) displays a display indicating that the passwords desired to be set are incorrect on the display unit. 22 (A) and waits for re-input of passwords (step Sa1 in FIG. 2).

  On the other hand, in this determination, the same passwords as the passwords requested to be set by the terminal control unit 23 (A) are included in the passwords in the management area stored in the storage unit 33 in the allowable limit number. If the password is not stored (step Sb2 in FIG. 3: NO), the server control unit 32 determines that the passwords requested to be set by the terminal control unit 23 (A) are appropriate, and transmits the passwords to the client PC 12. The password is updated and stored in the storage unit 33 as passwords of the authentication information having the use authority of (A) (step Sb4 in FIG. 3).

  At the same time, the server control unit 32 transmits update setting completion notification information indicating that the update setting of the passwords requested to be set has been completed from the server communication unit 31 to the terminal communication unit 24 (A) via the network 13. (Step Sb5 in FIG. 3). When the terminal setting unit 24 (A) receives the update setting completion notification information (step Sa4 in FIG. 2: YES), the terminal control unit 23 (A) sets the update setting of the passwords of the authentication information of the client PC 12 (A). The process ends.

  As described above, in the update setting process, the server control unit 32 determines whether the same passwords as those requested to be set by the terminal control unit 23 (A) are stored in the storage unit 33 in the predetermined allowable limit number. Even if the passwords requested to be set by the terminal control unit 23 (A) satisfy a predetermined strength setting criterion, a step of disabling storage of the passwords requested to be set in the storage unit 33 is performed.

  At the time of the new setting process of the authentication information having the authority to use the client PC 12 (B), similarly to the above, when the ID desired to be set and the passwords desired to be set are input to the input unit 21 (B), The terminal control unit 23 (B) transmits the identification information of the terminal control unit 23 (B) and the new setting request information as well as the authentication information of the setting request including the ID of the setting request and the passwords of the setting request to the authentication server. Send to 10. Then, the server control unit 32 stores the same passwords as the passwords requested to be set by the terminal control unit 23 (B) included in the authentication information requested to be set by the terminal control unit 23 (B) in the storage unit. It is determined whether a predetermined allowable limit number is stored in the passwords in the management area stored in 33.

  In this determination, if the same passwords as the passwords requested to be set by the terminal control unit 23 (B) are stored in the allowable limit number, the server control unit 32 sends the setting request from the terminal control unit 23 (B). Since the set passwords are incorrect, the change request information is transmitted, and the terminal control unit 23 (B) receiving the change request information displays that the passwords included in the authentication information desired to be set are incorrect. Is displayed on the display unit 22 (B), and re-input of passwords is awaited.

  On the other hand, in this determination, when the allowable limit number of the passwords identical to the passwords requested to be set by the terminal control unit 23 (B) is not stored, the server control unit 32 transmits the password from the terminal control unit 23 (B). The authentication information including the passwords requested to be set is newly set as authentication information having the authority to use the client PC 12 (B) and stored in the storage unit 33. The terminal control unit 23 (B) The new information setting process ends.

  In the update setting process of the passwords of the authentication information having the authority to use the client PC 12 (B), when the passwords desired to be set are input to the input unit 21 (B) in the same manner as described above, the terminal The control unit 23 (B) transmits the passwords desired to be set to the authentication server 10 together with the identification information of the terminal control unit 23 (B) and the update setting request information. Then, the server control unit 32 stores, in the passwords in the management area stored in the storage unit 33, the same passwords as the passwords requested to be set by the terminal control unit 23 (B), It is determined whether the allowable limit number is stored.

  In this determination, if the same passwords as the passwords requested to be set by the terminal control unit 23 (B) are stored in the allowable limit number, the server control unit 32 sends the setting request from the terminal control unit 23 (B). Since the set passwords are incorrect, the change request information is transmitted, and upon receiving the change request information, the terminal control unit 23 (B) displays a display indicating that the passwords desired to be set are incorrect on the display unit 22 (B). B) and wait for re-input of passwords.

  On the other hand, in this determination, when the allowable limit number of the passwords identical to the passwords requested to be set by the terminal control unit 23 (B) is not stored, the server control unit 32 transmits the password from the terminal control unit 23 (B). The passwords requested to be set are updated and set as passwords of authentication information having the authority to use the client PC 12 (B), and are stored in the storage unit 33. The terminal control unit 23 (B) sets the passwords Ends the update setting process.

  At the time of the new setting process of the authentication information having the authority to use the client PC 12 (C), similarly to the above, when the ID desired to be set and the passwords desired to be set are input to the input unit 21 (C), The terminal control unit 23 (C) sends the identification information of the terminal control unit 23 (C) and the new setting request information together with the setting desired authentication information including the desired setting ID and the desired setting password to the authentication server. Send to 10. Then, the server control unit 32 stores, in the storage unit, passwords included in the authentication information requested to be set by the terminal control unit 23 (C) and identical to the passwords requested to be set by the terminal control unit 23 (C). It is determined whether a predetermined allowable limit number is stored in the passwords in the management area stored in 33.

  In this determination, when the same passwords as the passwords requested to be set by the terminal control unit 23 (C) are stored in the allowable limit number, the server control unit 32 sends the setting request from the terminal control unit 23 (C). Since the set passwords are incorrect, the change request information is transmitted, and upon receiving the change request information, the terminal control unit 23 (C) displays that the passwords included in the authentication information desired to be set are incorrect. Is displayed on the display unit 22 (C), and re-input of passwords is awaited.

  On the other hand, in this determination, if the allowable limit number of passwords identical to the passwords requested to be set by the terminal control unit 23 (C) is not stored, the server control unit 32 transmits the password from the terminal control unit 23 (C). The authentication information including the passwords requested to be set is newly set as authentication information having the authority to use the client PC 12 (C) and stored in the storage unit 33. The terminal control unit 23 (C) Ends the new setting process.

  In the update setting process of the passwords of the authentication information having the authority to use the client PC 12 (C), when the passwords desired to be set are input to the input unit 21 (C) in the same manner as described above, the terminal The control unit 23 (C) transmits the passwords desired to be set to the authentication server 10 together with the identification information of the terminal control unit 23 (C) and the update setting request information. Then, the server control unit 32 stores, in the passwords in the management area stored in the storage unit 33, the same passwords as the passwords requested to be set by the terminal control unit 23 (C) in a predetermined manner. It is determined whether the allowable limit number is stored.

  In this determination, when the same passwords as the passwords requested to be set by the terminal control unit 23 (C) are stored in the allowable limit number, the server control unit 32 sends the setting request from the terminal control unit 23 (C). Since the set passwords are incorrect, the change request information is transmitted, and the terminal control unit 23 (C) receiving the change request information displays a message to the effect that the passwords desired to be set are incorrect on the display unit 22 (C). C) and wait for re-input of passwords.

  On the other hand, in this determination, if the allowable limit number of passwords identical to the passwords requested to be set by the terminal control unit 23 (C) is not stored, the server control unit 32 transmits the password from the terminal control unit 23 (C). The passwords requested to be set are updated and set as passwords of authentication information having authority to use the client PC 12 (C), and are stored in the storage unit 33. The terminal control unit 23 (C) sets the passwords The update setting process ends.

  At the time of the new setting process of the authentication information having the authority to use the client PC 12 (D), similarly to the above, when the ID desired to be set and the passwords desired to be set are input to the input unit 21 (D), The terminal control unit 23 (D) sends the identification information of the terminal control unit 23 (D) and the new setting request information together with the authentication information of the setting request including the ID of the setting request and the passwords of the setting request to the authentication server. Send to 10. Then, the server control unit 32 stores the same passwords as the passwords requested to be set by the terminal control unit 23 (D) included in the authentication information requested to be set by the terminal control unit 23 (D) in the storage unit. It is determined whether a predetermined allowable limit number is stored in the passwords in the management area stored in 33.

  In this determination, if the same passwords as the passwords requested to be set by the terminal control unit 23 (D) are stored in the allowable limit number, the server control unit 32 sends the setting request from the terminal control unit 23 (D). Since the set passwords are incorrect, the terminal control unit 23 (D) transmits the change request information, and upon receiving the change request information, displays a message indicating that the passwords included in the authentication information desired to be set are incorrect. Is displayed on the display unit 22 (D), and re-input of passwords is awaited.

  On the other hand, in this determination, when the allowable limit number of passwords identical to the passwords requested to be set by the terminal control unit 23 (D) is not stored, the server control unit 32 transmits the password from the terminal control unit 23 (D). The authentication information including the passwords requested to be set is newly set as authentication information having authority to use the client PC 12 (D), and is stored in the storage unit 33. The terminal control unit 23 (D) performs authentication. The new information setting process ends.

  In the update setting process of the passwords of the authentication information having the authority to use the client PC 12 (D), when the passwords desired to be set are input to the input unit 21 (D) in the same manner as described above, the terminal The control unit 23 (D) transmits the passwords desired to be set to the authentication server 10 together with the identification information of the terminal control unit 23 (D) and the update setting request information. Then, the server control unit 32 stores, in the passwords in the management area stored in the storage unit 33, predetermined passwords identical to the passwords requested to be set by the terminal control unit 23 (D), in a predetermined manner. It is determined whether the allowable limit number is stored.

  In this determination, if the same passwords as the passwords requested to be set by the terminal control unit 23 (D) are stored in the allowable limit number, the server control unit 32 sends the setting request from the terminal control unit 23 (D). Since the set passwords are incorrect, the change request information is transmitted, and upon receiving the change request information, the terminal control unit 23 (D) displays a message indicating that the passwords desired to be set are incorrect on the display unit 22 (D). ) And wait for re-entry of passwords.

  On the other hand, in this determination, when the allowable limit number of passwords identical to the passwords requested to be set by the terminal control unit 23 (D) is not stored, the server control unit 32 transmits the password from the terminal control unit 23 (D). The passwords requested to be set are updated and set as passwords of authentication information having authority to use the client PC 12 (D), and are stored in the storage unit 33. The terminal control unit 23 (D) sets the passwords Ends the update setting process.

  Authentication information that is newly set or updated as authentication information having the authority to use the client PC 12 (A) and stored in the storage unit 33, and is newly set or updated as authentication information having the authority to use the client PC 12 (B). The authentication information stored in the storage unit 33 and the authentication information newly set or updated as the authentication information having the authority to use the client PC 12 (C) and stored in the storage unit 33 are one each.

  On the other hand, a plurality of settings are possible for the authentication information which is newly set or updated as the authentication information having the authority to use the client PC 12 (D) and stored in the storage unit 33.

  According to the above-described embodiment, when a password setting request is issued, the server control unit 32 stores the same passwords as the requested passwords in the storage unit 33 in the predetermined allowable limit number. If not, the passwords requested to be set are stored in the storage unit 33 on condition that the passwords requested to be set satisfy a predetermined strength setting criterion. On the other hand, when a request for setting passwords is made and the same passwords as the passwords requested to be set are stored in the storage unit 33 in a predetermined allowable limit number, the server control unit 32 performs the setting. Even if the requested passwords satisfy the predetermined strength setting criterion, the storage of the requested passwords in the storage unit 33 is disabled. For this reason, it is possible to prevent authentication information including the same passwords from being registered beyond a predetermined allowable limit number. As a result, security can be prevented from being sparse. That is, for example, even if different employees / employees try to use the same password, it is possible to prevent employees / employees exceeding a predetermined allowable number from using the same password. Therefore, it is possible to suppress improper login in the management area including the use of the electronic device such as the client PC 12 impersonating another person. For example, in a case where a shared terminal device is selectively used by giving different authority to each user, execution of a restricted function and access to a file can be prevented. Therefore, the validity of the passwords can be improved, and the security can be improved.

  For example, it is possible to reduce the number of cases in which another person who knows the same passwords can log in by impersonating the authorized user even for the client PC 12 whose password is locked with a different ID after the authorized user leaves the seat after logging in. Can be. Further, even if another person obtains the IC card of the authorized user for the client PC 12, it is possible to reduce a case where the other person who knows the same passwords can impersonate the authorized user and log in. Such unauthorized use in the management area of the authentication server 10 in the authentication information management system 11 can be prevented.

  Further, since a plurality of predetermined allowable limit numbers such as two, three, and the like can be set, passwords can be shared by a limited small group such as a plurality of managers. Therefore, a decrease in usability can be suppressed.

  The above embodiment can be modified as in the following modified examples 1 and 2.

[Modification 1]
In the management area of the authentication server 10, if the same password exceeding a predetermined allowable number is newly set or updated within a certain period (the administrator arbitrarily specifies a period such as one hour to one month), The setting of the password etc. is prohibited. If the period exceeds a certain period, it is assumed that the user has accidentally set the same password, not the mutual confirmation, and the setting of the password is permitted. That is, the server control unit 32 determines that the same passwords as the passwords requested to be set are stored in the storage unit 33 in the storage unit 33 within a predetermined allowable number of times before the time when the setting request is issued. Then, the storage of the passwords requested to be set in the storage unit 33 is disabled. On the other hand, if the same passwords as the passwords requested to be set are not stored in the storage unit 33 within a predetermined period based on the time when the setting request is made, the server control unit 32 stores The passwords requested to be set are stored in the storage unit 33. In this way, the same passwords can be prevented from being registered in excess of the predetermined number only within the predetermined period, so that accidental matching of passwords caused by a long management period is excluded from the restriction. can do.

[Modification 2]
The match rate of the passwords is calculated, and if the match rate is equal to or more than a certain rate, it is regarded as the same password. For example, if 9 of 10 characters are the same, such as “password01” and “password02”, the passwords are regarded as the same password. Thus, for example, it is possible to prevent a fraud that avoids the limitation of the number of the same passwords by changing the last one character. That is, the server control unit 32 regards the same passwords when the matching rate is equal to or higher than a predetermined ratio set to be less than 100%, and regards them as different passwords when the matching ratio is less than the predetermined ratio. Therefore, it is possible to prevent a fraud that avoids the limitation of the quantity of the same password by changing a little character or the like. The second modification is also applicable to the first modification.

[Modification 3]
Further, when the same password exceeding a predetermined allowable number is newly set or updated in the management area of the authentication server 10, the validity period of the password is set shorter than usual and the password is changed earlier. To Changing the password in a shorter time than usual can increase security. The third modification is also applicable to the second modification.

[Modification 4]
A predetermined permissible limit number may be set according to the user attribute (such as rank). For example, when the user has a strong authority like an administrator, security is prioritized by setting a predetermined allowable limit number to 1, and for a general user or a guest user, the predetermined allowable limit number is set relatively gently. By setting, priority can be given to convenience. That is, since the predetermined allowable limit number can be set for each attribute of the user, the priority is given to security by setting the predetermined allowable limit number to a small number, or the predetermined allowable limit number is set to a large number. This makes it possible to prioritize convenience.

10 Authentication server (password management device)
11 Authentication information management system (password management system)
12 Client PC (terminal device)
13 network 21 input unit 32 server control unit (control unit)
33 storage unit

Claims (6)

A storage unit for storing a plurality of passwords,
A control unit that controls storage of information in the storage unit;
With
When a predetermined number of passwords identical to the passwords requested to be set are stored in the storage unit, the control unit disables storing the passwords requested to be set in the storage unit. Management device.   The control unit, when a predetermined number of passwords identical to the passwords requested to be set are stored in the storage unit within a predetermined period, disables storage of the passwords requested to be set in the storage unit. The password management device according to claim 1, wherein   The password management device according to claim 1, wherein the control unit regards the passwords to be the same when the matching rate is equal to or higher than a predetermined ratio.   4. The password management apparatus according to claim 1, wherein the predetermined number can be set for each attribute of a user. 5. A password management device according to any one of claims 1 to 4,
A terminal device having an input unit into which a setting operation of passwords is input,
The control unit, when a predetermined number of passwords identical to the passwords requested to be set based on the input to the input unit are stored in the storage unit, the storage unit of the passwords requested to be set Password management system that disables the storage of passwords. Determining whether a predetermined number of passwords identical to the passwords requested to be set are stored in the storage unit;
When a predetermined number of passwords identical to the passwords requested to be set are stored in the storage unit, disabling storage of the passwords requested to be set in the storage unit;
Password management method including password.

Images