JP6068908B2 - Authentication information transfer system and web server - Google Patents

Description

  The present invention relates to a system for inheriting authentication information and a web server.

  In recent years, mobile terminals having communication functions such as smartphones, tablets, and mobile phones have become widespread. A user can use various services by connecting to a network such as the Internet using a mobile terminal and communicating with a server on the network.

  In general, such a portable terminal is downsized in comparison with a personal computer or the like in order to improve portability. For this reason, functions developed on the premise of use on a personal computer such as a web browser may be difficult for a user on the mobile terminal in terms of visibility and touch panel operability. For this reason, an application called “application” suitable for browsing and operating on a small screen of a mobile terminal has been developed. Such an app is commercialized as an iphone app for smartphones, an android app, or the like, and is sometimes called a “smartphone app”.

  Along with the widespread use of such mobile terminals, content providers not only provide services via websites that are supposed to be used on personal computers, but are also suitable for viewing and operating on mobile terminals. Similar services are being provided through the Internet. Among various websites, content providers who operate websites whose types are limited to registered users often limit the use of services only to registered users in applications.

JP2007-172119A

  In general, a web browser constitutes a screen suitable for a user to browse and operate on a personal computer, whereas an app is suitable for a user to browse and operate on a relatively small mobile terminal. Configure the screen. If the same content provider provides services on both the website and the app, the services provided by the app are often part of the services provided on the website and can be used on the website However, there may be services that are not available in the app. In such a case, when the user who is starting up the application on the mobile terminal desires to use a service that can be used only on the website, the user starts the web browser and receives the web received from the web server. The desired service must be used on the page.

  In a conventional computer system, when an application that can only be used by an authenticated user is running, if the user desires a service that is not provided by the app but only provided by the website, the user can It is necessary to re-enter authentication information such as a user ID and password on the login screen provided from the web server. That is, in the conventional computer system, the authentication information cannot be inherited between the application session and the web browser session.

  In view of the above-described problems, an object of the present invention is to provide a technique that makes it possible to safely transfer input authentication information between sessions.

In order to solve the above-described problem, an aspect of the present invention receives an acquisition unit that acquires authentication information corresponding to search key information, a browser activation request message including a screen URL and the search key information from a terminal, The present invention relates to an information processing apparatus including a transmission / reception unit that transmits screen information including authentication information corresponding to received search key information to the terminal .

Another aspect of the present invention is a system for inheriting authentication information, comprising the information processing apparatus described above and the terminal, wherein the terminal is using an input unit to which the authentication information is input, and an application is being used. When the browser activation button is pressed, the browser activation request message including the screen URL and the search key information is transmitted to the information processing apparatus, and the screen information including the authentication information is received from the information processing apparatus. The present invention relates to a system including a transmission / reception unit and a display unit that displays screen information including the received authentication information .

  According to the present invention, input authentication information can be safely inherited between sessions.

FIG. 1 schematically illustrates a system according to one embodiment of the present invention. FIG. 2 shows a hardware configuration of a mobile terminal according to an embodiment of the present invention. FIG. 3 shows a hardware configuration of a server according to an embodiment of the present invention. FIG. 4 shows a functional configuration of a mobile terminal according to an embodiment of the present invention. FIG. 5 shows a functional configuration of a relay server according to an embodiment of the present invention. FIG. 6 shows a functional configuration of a web server according to an embodiment of the present invention. FIG. 7 is a sequence diagram showing authentication information processing in an application according to an embodiment of the present invention. FIG. 8 is a sequence diagram showing authentication information transfer processing from an application to a web service according to an embodiment of the present invention. FIG. 9 shows a screen example of authentication information processing according to an embodiment of the present invention. FIG. 10 shows a screen example of authentication information processing according to an embodiment of the present invention. FIG. 11 shows an example of an authentication information transfer process screen according to an embodiment of the present invention.

  Embodiments of the present invention will be described below with reference to the drawings.

  With reference to FIGS. 1-6, the structure of the system by one Example of this invention is demonstrated. In the system of the present embodiment, the mobile terminal can execute applications for mobile terminals that provide various services (referred to as “apps”), and display and operate web pages provided from websites. A web browser can be executed. In this embodiment, when a content provider provides a service by both a website and an application, this system is executing an application when a mobile terminal that is executing the application moves to the same content provider's website. The authentication information input in step S3 is succeeded to the web service, and the user can access the website without having the user re-enter at least part of the authentication information.

  In order to realize such succession of authentication information, the portable terminal transmits the input authentication information to the server when the authentication information is input by the user when the application is activated. When the user authentication is successful, the mobile terminal acquires search key information associated with the authentication information from the server. When the user requests to start the web browser during the execution of the application, the mobile terminal transmits a browser start request message including a part of the acquired search key information and authentication information to the server. The server extracts authentication information corresponding to the search key information of the received browser activation request message from a part of the search key information and authentication information stored in association with each other, and the web browser screen in which the extracted authentication information is embedded Or other screen information is transmitted to the requesting mobile terminal. As a result, the mobile terminal can display the screen information in which the authentication information is embedded, and the user can access the website without re-inputting part of the authentication information when the web browser is activated. It becomes.

  FIG. 1 schematically illustrates a system according to one embodiment of the present invention. As shown in FIG. 1, the system 10 includes one or more mobile terminals 100, a relay server 200, a web server 300, and a network 400.

  The mobile terminal 100 is typically a smartphone, a tablet, a mobile phone, and the like, a web browser capable of displaying and operating a web page on the Internet, and an application that provides various services called “apps” for the mobile terminal. And have. In general, a web browser constitutes a screen suitable for a user to browse and operate on a personal computer, whereas an app is suitable for a user to browse and operate on a relatively small mobile terminal. Configure the screen. When the same content provider provides both a website and an app, the service provided by the app is often part of the service provided by the website and can be used on the website. However, there may be services that are not available in the app. In such a case, if the user who is starting up the application on the mobile terminal 100 desires to use a service that can be used only on the website, the user needs to start the web browser and access the website. There is.

  In the system according to the present embodiment, when the user of the mobile terminal 100 executes an application and receives various services, the mobile terminal 100 communicates with the relay server 200 and communicates information with the web server 300 via the relay server 200. Communicate. On the other hand, when the user of the mobile terminal 100 executes a web browser and receives various services, the mobile terminal 100 directly communicates with the web server 300 without going through the relay server 200.

  When an application is being executed on the mobile terminal 100, the relay server 200 transmits a user service request requested on the application to the web server 300, and is provided from the web server 300 in response to the service request. Various data is converted into a data format for an application and provided to the mobile terminal 100. In the present embodiment, regarding the user authentication process, when the relay server 200 receives authentication information such as a user ID and a password from the mobile terminal 100, the relay server 200 transfers the received authentication information to the web server 300 and a part of the user ID. A part of the authentication information is stored. Further, when the user authentication is successful, the relay server 200 generates a matching key for the session of the application that is being executed, and transmits the generated matching key to the mobile terminal 100. Further, the relay server 200 stores the generated matching key in association with a part of the user authentication information.

  The web server 300 provides a service via the web screen and also provides various data for the application to the mobile terminal 100 via the relay server 200. In this embodiment, the web server 300 holds user authentication information registered in advance, and determines whether a user who requests to access a website and an application is a registered user. Specifically, the web server 300 authenticates the user by determining whether the authentication information received from the mobile terminal 100 trying to access the website and the application matches the registered user authentication information. . If the user authentication is successful, the web server 300 provides the service to the mobile terminal 100 that is executing the application via the relay server 200, and provides the service to the mobile terminal 100 that is executing the web browser without using the relay service 200. Provide directly. Further, when the mobile terminal 100 that is executing the application transmits a web browser activation request, the user contract number received from the relay server 200 and the matching key are stored in association with each other. After that, when receiving a matching key from a web browser activated on the mobile terminal 100, the web server 300 generates a login screen in which a contract number corresponding to the received matching key is embedded, and the generated login screen is displayed on the mobile terminal 100. Send to.

  The network 400 communicatively connects the mobile terminal 100, the relay server 200, and the web server 300. When the mobile terminal 100 is wirelessly connected to the network 400, the mobile terminal 100 is wirelessly connected to a wireless device such as a base station (not shown) or an access point (not shown) of the network 400, and the relay server 200 or the web is connected via the wireless device. Connect to a network device such as server 300. However, the present invention is not limited to this, and for example, the mobile terminal 100 may be connected to the network 400 by wire.

  In the embodiment described above, the relay server 200 provides the application version service to the mobile terminal 100, and the web server 300 provides the website version service to the mobile terminal 100. However, the present invention is limited to this. Not a thing. For example, the web server 300 may provide the mobile terminal 100 with both an application version service and a website version service.

  FIG. 2 shows a hardware configuration of a mobile terminal according to an embodiment of the present invention. As shown in FIG. 2, the mobile terminal 100 includes a drive device 101, an auxiliary storage device 102, a memory device 103, a CPU (Central Processing Unit) 104, a communication device 105, a display device 106, and an interconnected device via a bus B. An input device 107 is included.

  Programs that realize various functions and processes described later in the portable terminal 100 are downloaded from a server or the like via the network 400. Alternatively, the program may be provided by a recording medium 108 such as a memory card. When the recording medium 108 storing the program is set in the drive device 101, the program is installed from the recording medium 108 to the auxiliary storage device 102 via the drive device 101. The auxiliary storage device 102 stores the installed program and also stores necessary files and data.

  The memory device 103 reads the program and data from the auxiliary storage device 102 and stores them when there is an instruction to start the program. The CPU 104 executes various functions and processes of the portable terminal 100 as described later according to various data such as a program stored in the memory device 103 and parameters necessary for executing the program.

  The communication device 105 is used as a communication interface for wireless and / or wired connection to the network 400. The communication device 105 converts the transmission target data into an appropriate signal and transmits it to the network 400. In addition, the communication device 105 converts a signal received from the network 400 into appropriate data and provides it to an appropriate device such as the memory device 103.

  The display device 106 is used to display the processing result by the CPU 104, and is realized by various displays such as a liquid crystal display, a cathode ray tube display (CRT), and a plasma display. The input device 107 is used when a user inputs a command or data to the mobile terminal 100, and is realized by, for example, a touch panel, a keyboard, a stylus, a microphone, or the like.

  FIG. 3 shows a hardware configuration of a server according to an embodiment of the present invention. The relay server 200 and the web server 300 of the system 10 according to the present embodiment may have the same hardware configuration. Here, the relay server 200 is focused on. As illustrated in FIG. 3, the relay server 200 includes a drive device 201, an auxiliary storage device 202, a memory device 203, a CPU (Central Processing Unit) 204, and an interface device 205 that are interconnected via a bus B.

  Programs for realizing various functions and processes described later in the relay server 200 and the web server 300 may be provided by a recording medium 206 such as a CD-ROM (Compact Disk-Read Only Memory). When the recording medium 206 storing the program is set in the drive device 201, the program is installed from the recording medium 206 to the auxiliary storage device 202 via the drive device 201. However, it is not always necessary to install the program using the recording medium 206, and the program may be downloaded from another server via the network 400. The auxiliary storage device 202 stores the installed program and necessary files and data.

  The memory device 203 reads and stores the program and data from the auxiliary storage device 202 when there is an instruction to start the program. The CPU 204 executes various functions and processing of the server as described later according to various data such as a program stored in the memory device 203 and parameters necessary for executing the program. The interface device 205 is used as a communication interface for connecting to the network 400.

  FIG. 4 shows a functional configuration of a mobile terminal according to an embodiment of the present invention. As illustrated in FIG. 4, the mobile terminal 100 includes a display unit 110, an input unit 120, and a transmission / reception unit 130. The mobile terminal 100 includes an application for a mobile terminal that provides various services by communication with the relay server 200 (referred to as an “app”), a web browser for displaying and operating a web page provided from the web server 300, and Can be executed.

  The display unit 110 displays an application screen provided by an application and a browser screen provided by a web browser. In general, a web browser constitutes a screen suitable for a user to browse and operate on a personal computer, while an app is used by a user on a relatively small portable terminal such as a smartphone, a tablet, or a mobile phone. Configure a screen suitable for browsing and operating. If the same content provider provides both a website and an app, the services provided by the app are often part of the services provided by the website, and services on the website that cannot be used by the app There is a possibility. When a user who is running an application on the mobile terminal 100 desires to use a service that is only available on the website, the user activates the web browser and performs a desired service on the web page received from the web server 300. Must be used. For this reason, the application screen has a web browser activation button for moving to a website provided by the content provider. When the user who is executing the application presses the web browser activation button on the application screen, the mobile terminal 100 activates the web browser and acquires a web page from the migration destination website. As will be described later, authentication information such as the user ID (contract number) of the user input and authenticated at the time of starting the application is already embedded in the acquired web page, and the display unit 110 is a screen including authentication information. Can be displayed. Thus, the user can access the website by inputting only the password without having to re-enter the contract number.

  The input unit 120 acquires authentication information such as a contract number and a password input by the user. In the present embodiment, the input unit 120 is configured to hold all or part of the authentication information acquired at the first activation of the application for subsequent use. For example, the input unit 120 may hold a contract number input by the user.

  The transmission / reception unit 130 transmits / receives various data to / from the relay server 200 and the web server 300. When the start button of the web browser is pressed during execution of the application, the transmission / reception unit 130 sends a browser start request message including a screen URL (Uniform Resource Locator) of the transfer destination website and a matching key to be described later to the web server And the web browser login screen in which the contract number is embedded is received from the web server 300. The transmission / reception unit 130 may transmit data by a transmission method suitable for the required security level. For example, when transmitting authentication information such as a contract number or a password, the transmission / reception unit 130 transmits authentication information using a POST method in order to prevent interception of the authentication information in a router or the like that relays transmission data. On the other hand, the transmitter / receiver 130 may use the GET method when transmitting information such as a matching key, which will be described later, that does not affect much even if it is intercepted.

  FIG. 5 shows a functional configuration of a relay server according to an embodiment of the present invention. In the present embodiment, the relay server 200 mediates between the mobile terminal 100 and the web server 300 in order to provide an application service for the mobile terminal 100. Specifically, the relay server 200 converts the data received from the web server 300 into a data format for an application, and transmits the converted data to the mobile terminal 100. As illustrated in FIG. 5, the relay server 200 includes a transmission / reception unit 210, a storage unit 220, a matching key generation unit 230, and a contract number restoration unit 240.

  The transmission / reception unit 210 transmits / receives various data between the mobile terminal 100 and the web server 300. When the transmission / reception unit 210 receives various processing requests from the application activated on the mobile terminal 100, the transmission / reception unit 210 transfers the received processing request to the web server 300, and converts the processing result from the web server 300 into a data format for the application. To the mobile terminal 100. In the present embodiment, when an application requiring user authentication is activated for the first time on the mobile terminal 100, the transmission / reception unit 210 receives authentication information such as a user ID (contract number) and a password from the mobile terminal 100. The transmission / reception unit 210 transfers the received authentication information to the web server 300 and stores a part of the contract number in the storage unit 220. The transmission / reception unit 210 may transmit data by a transmission method suitable for the required security level. For example, when transmitting authentication information such as a contract number or a password, the transmission / reception unit 210 transmits authentication information using a POST method in order to prevent interception of the authentication information in a router or the like that relays transmission data. On the other hand, the transmitter / receiver 210 may use a GET method when transmitting information such as a matching key, which will be described later, that has little influence even when intercepted.

  The storage unit 220 stores a part of user authentication information transmitted from the mobile terminal 100 and a matching key for a session executed by an application of the transmission-source mobile terminal 100 to be described later. In general, it is not preferable for the relay server 200 to hold all the user authentication information from the viewpoint of security, and the relay server 200 is configured to hold only a part of the authentication information. In this embodiment, the storage unit 220 stores a part of the contract number of the user. For example, when the contract number is composed of 10-digit alphanumeric characters, the relay server 200 stores only the last 7 digits. It may be configured to hold. However, the present invention is not limited to this, and the storage unit 220 may store any appropriate part of the authentication information.

  When the web server 300 succeeds in user authentication, the matching key generation unit 230 generates a matching key for the application session. The matching key generation unit 230 may generate a matching key randomly using, for example, a pseudo random number generation unit. Preferably, the matching key generation unit 230 generates a new matching key every time the application is activated. In this case, the previously generated matching key is invalidated, and the invalidated matching key is deleted from the storage unit 220.

  The contract number restoration unit 240 is configured such that the browser activation button is pressed while the application of the mobile terminal 100 is being executed, the remaining part of the contract number held by the relay server 200 (in the above example, the first three digits of the contract number), the application When the matching key transmitted to the mobile terminal 100 is received during execution, the last 7 digits of the contract number corresponding to the received matching key are extracted, and the upper 3 digits of the received contract number and the last 7 digits of the extracted contract number are extracted. Are combined to restore the 10-digit contract number. However, the present invention is not limited to this, and the contract number can be restored from a part of the contract number received from the mobile terminal 100 and a part of the contract number held in the relay server 200. The contract number may be divided using any appropriate method.

  FIG. 6 shows a functional configuration of a web server according to an embodiment of the present invention. As illustrated in FIG. 6, the web server 300 includes a transmission / reception unit 310, a matching key / contract number storage unit 320, a web page generation unit 330, and an authentication unit 340.

  The transmission / reception unit 310 transmits / receives various data including authentication information between the mobile terminal 100 and the relay server 200.

  The matching key / contract number storage unit 320 stores the contract number received from the relay server 200 in association with the matching key. When the relay server 200 generates a new matching key each time an app is activated on the mobile terminal 100, the matching key / contract number storage unit 320 updates the previous matching key with the newly generated matching key. It may be.

  Further, the matching key / contract number storage unit 320 may store additional information such as the date and time of creation of the record and the status indicating the use history of the record in association with the contract number and the matching key. For example, when the creation date and time is stored as additional information, the matching key / contract number storage unit 320 invalidates the matching key and deletes the record after a predetermined period (such as 10 minutes) has elapsed. Also good. When the status is stored as additional information, the matching key / contract number storage unit 320 invalidates the matching key when the matching key is used more than a predetermined number of times (such as once), The record may be deleted. This can reduce the risk of unauthorized use of the matching key.

  The web page generation unit 330 generates a web page to be displayed on the web browser of the mobile terminal 100. When receiving the login screen URL and the matching key from the mobile terminal 100 that starts the web browser, the web page generation unit 330 extracts the contract number corresponding to the received matching key, and displays the login screen in which the extracted contract number is embedded. Generate. The generated login screen is provided to the mobile terminal 100 via the transmission / reception unit 310.

  The authentication unit 340 authenticates the user who made the login request based on the contract number and password received from the mobile terminal 100 or the relay server 200. Specifically, the authentication unit 340 authenticates the user by determining whether the contract number and the password previously given to the user by the content provider match the received contract number and the password, respectively.

  Next, an authentication information succession process according to an embodiment of the present invention will be described with reference to FIGS. In this embodiment, an authentication information process by an application and an authentication information transfer process for transferring the authentication information acquired by the authentication information process will be described. The authentication information processing and authentication information transfer processing will be described with reference to screen examples of an application and website that provide Internet banking, but the present invention is not limited to this.

  FIG. 7 is a sequence diagram showing authentication information processing in an application according to an embodiment of the present invention. In this embodiment, the authentication information processing in the application is relayed between the mobile terminal 100 of the user who uses the application, between the mobile terminal 100 and the web server 300, and the service provided by the content provider is converted into the application version. This is realized by the server 200 and the web server 300 that provides the website of the content provider. In this embodiment, the service provided by the content provider is provided separately to the relay server 200 that provides the application version service and the web server 300 that provides the website version service. Is not limited to this. For example, the web server 300 may provide the mobile terminal 100 with both an application version service and a website version service.

  As shown in FIG. 7, in step S <b> 101, the user of the mobile terminal 100 activates an application provided by the content provider of the web server 300. The application according to this embodiment can be used only by users registered in advance with the content provider. User authentication information necessary for using the content provider application and website is provided from the content provider by any secure method. For example, user authentication information may be provided to a user via a network when the user registers with a content provider. Alternatively, more preferably, the user authentication information may be provided to the user by a method different from that via a network such as mail. When the application downloaded from the content provider is activated first, the user can use the service by inputting authentication information such as a contract number and a password provided from the content provider.

  In step S102, the activated application requests the user to input a contract number and a password. For example, when the application is activated for the first time, a screen for the first activation as shown in FIG. 9A is displayed and the user is requested to input a contract number and a password.

  In step S <b> 103, the mobile terminal 100 transmits the input contract number and password to the relay server 200. For example, as illustrated in FIG. 9B, when the user inputs a contract number and a password, the mobile terminal 100 transmits the input contract number and password to the relay server 200. Preferably, the contract number and the matching key are transmitted by any secure method such as SSL (Secure Socket Layer). As shown in FIGS. 9A and 9B, the input password may not be displayed on the screen by any appropriate method. In addition, when the user wants to omit re-input of the contract number to the application thereafter, the mobile terminal 100 may store the input contract number or a part thereof.

  In step S104, the relay server 200 stores a part of the received contract number. As described above, it is not preferable that the relay server 200 holds the entire contract number from the viewpoint of security. In this embodiment, the contract number is composed of 10-digit alphanumeric characters, and the relay server 200 stores the last seven digits of the received contract number.

  In step S <b> 105, the relay server 200 transfers the received contract number and password to the web server 300.

  In step S106, the web server 300 authenticates the user of the mobile terminal 100 based on the received contract number and password. Specifically, the web server 300 authenticates the user by determining whether the contract number and password assigned by the content provider match the received contract number and password, respectively.

  In step S107, when the user authentication is successful, the web server 300 transmits a login response to the relay server 200. For example, the web server 300 may transmit basic information (in the example of Internet banking, a user name, a balance total, etc.) regarding the user together with a login response indicating that the user authentication is successful.

  In step S108, when receiving the login response, the relay server 200 generates a matching key for the application session, and stores the matching key generated in association with the last seven digits of the contract number stored in step S104. . The matching key may be generated by any suitable method, such as randomly generating using a pseudo-random number generating means or the like.

  In step S109, the relay server 200 transmits the login response and the generated matching key to the mobile terminal 100. In addition, when receiving basic information about a user, the relay server 200 may transmit the received basic information to the mobile terminal 100.

  In step S110, when receiving the login response, the mobile terminal 100 confirms that the authentication is successful, displays the top screen of the application after login, and stores the received matching key. When the mobile terminal 100 receives basic user information, a top screen after login such as the screen example shown in FIG. 9C is displayed. The user can use the desired service by operating the displayed top screen. Here, in the embodiment of the internet banking application shown in FIG. 9, among the various internet banking services, “transfer”, “balance inquiry”, and “payment / withdrawal statement inquiry” services are provided. The website also provides other transaction services, where the user desires a service other than the "transfer", "balance inquiry", and "payment and withdrawal details inquiry" services, and the "other transaction (browser activation)" button When is pressed, the portable terminal 100 can start a web browser and shift to the website of the content provider.

  The above-described process is an authentication process when the application is first activated. In the second and subsequent activations, input operations may be reduced in consideration of user convenience. For example, the mobile terminal 100 stores the contract number or part of the contract number input in step S101 at the first activation of the application. In the second and subsequent activations, the application displays the screen example in FIG. As shown in FIG. 4, the user may be allowed to input only the password.

  At the first activation of the application, in step S103, the mobile terminal 100 transmits the contract number and the password to the relay server 200. However, at the second and subsequent activations, the mobile terminal 100 relays at the previous application activation. The matching key received from the server 200 and the remaining part of the contract number not held in the relay server 200 may be transmitted. In the illustrated embodiment, the contract number is composed of 10-digit alphanumeric characters, and the relay server 200 holds the last 7-digit contract number. In this case, the mobile terminal 100 may transmit the previously received matching key and the upper 3 digit contract number corresponding to the lower 7 digit contract number to the relay server 200. The relay server 200 may restore the 10-digit contract number from the lower 7-digit contract number corresponding to the received matching key and the received upper 3-digit contract number, and transmit it to the web server 300 in step S105. it can.

  FIG. 8 is a sequence diagram showing authentication information transfer processing from an application to a web service according to an embodiment of the present invention. In the present embodiment, authentication information transfer processing from an application to a web service includes processing in an application realized by the mobile terminal 100, the relay server 200, and the web server 300, and web service realized by the mobile terminal 100 and the web server 300. And processing.

  As shown in FIG. 8, in step S201, while the application is being executed, the user desires to use the service that is not provided by the application but is provided by the content provider website, and the browser activation button. Press. In the example shown in FIG. 11A, the user presses the “other transaction (browser activation)” button.

  In step S <b> 202, the mobile terminal 100 transmits a part of the contract number held, in the present embodiment, the first three digits of the contract number and the matching key held to the relay server 200.

  In step S203, the relay server 200 extracts the last 7 digits of the contract number corresponding to the received matching key, and the 10-digit contract number from the upper 3 digits of the received contract number and the last 7 digits of the extracted contract number. To restore.

  In step S <b> 204, the relay server 200 transmits the restored contract number and the received matching key to the web server 300. Preferably, this transmission is executed by the POST method, and the relay server 200 can securely transmit the contract number and the matching key by embedding the contract number and the matching key in the body portion of the POST method.

  In step S205, when the web server 300 receives the contract number and the matching key from the relay server 200, the web server 300 associates and stores the received contract number and the matching key. The web server 300 may store additional information such as the creation date and time of the record and the status indicating the use history of the record in association with the contract number and the matching key. For example, when the creation date is stored as additional information, the web server 300 may invalidate the matching key and delete the record when a predetermined period (such as 10 minutes) elapses. When the status is stored as additional information, the web server 300 invalidates the matching key and deletes the record when the matching key is used more than a predetermined number of times (such as once). It may be. This can reduce the risk of unauthorized use of the matching key.

  In step S <b> 206, the web server 300 transmits to the relay server 200 a browser redirect response that permits the mobile terminal 100 to shift from the application to the web service.

  In step S <b> 207, the relay server 200 may transfer the received browser redirect response to the mobile terminal 100, and terminate the application session with the mobile terminal 100.

  In step S208, when the mobile terminal 100 receives the browser redirect response from the relay server 200, the mobile terminal 100 terminates the application session with the relay server 200 and activates the web browser to redirect to the website of the content provider.

  In step S <b> 209, the mobile terminal 100 transmits the login screen URL of the redirected website and the matching key held to the web server 300. This transmission may be executed by a GET method. When the expiration date and / or the number of effective use of the matching key are limited, even if the matching key is attached to the login screen URL by the GET method and intercepted on the relay router, it is not greatly affected by security. It is because it is considered.

  In step S210, the web server 300 extracts a contract number corresponding to the received matching key, and generates a login screen in which the extracted contract number is embedded. For example, the web server 300 may generate a web browser login screen as shown in FIG.

  In step S211, the web server 300 transmits a login screen in which the generated contract number is embedded to the mobile terminal 100.

  In step S212, the portable terminal 100 requests the user to input a password on the login screen in which the contract number is embedded by displaying a screen as shown in FIG. 11B.

  In step S213, the mobile terminal 100 transmits the embedded contract number and the password input by the user to the web server 300. Similar to step S204, the transmission is preferably executed by the POST method, and the contract number and the password may be transmitted securely.

  In step S214, the web server 300 authenticates the user based on the received contract number and password. Specifically, the web server 300 authenticates the user by determining whether the contract number and password assigned by the content provider match the received contract number and password, respectively.

  In step S215, when the user authentication is successful, the web server 300 transmits a login response to the mobile terminal 100. The mobile terminal 100 confirms that the authentication has succeeded, and displays the top screen of the website after login. The user can access a desired page by operating the top screen displayed on the web browser.

  As mentioned above, although the Example of this invention was explained in full detail, this invention is not limited to the specific embodiment mentioned above, In the range of the summary of this invention described in the claim, various deformation | transformation・ Change is possible.

10 System 100 Mobile Terminal 200 Relay Server 300 Web Server 400 Network

Claims (5)

An acquisition unit for acquiring authentication information corresponding to the search key information;
  A transmission / reception unit that receives a browser activation request message including a screen URL and the search key information from a terminal, and transmits screen information including authentication information corresponding to the received search key information to the terminal;
An information processing apparatus. The information processing apparatus according to claim 1, wherein the search key information is generated for each session of an application. The information processing apparatus according to claim 1, wherein the search key information is generated by the information processing apparatus. 4. When receiving the search key information and a part of the authentication information from the terminal, the acquisition unit restores the authentication information based on the search key information and a part of the authentication information. The information processing apparatus according to any one of claims. A system that inherits authentication information,
  An information processing apparatus according to any one of claims 1 to 4,
  The terminal;
Have
The terminal
  An input unit for inputting the authentication information;
  When a browser activation button is pressed during use of an application, the browser activation request message including the screen URL and the search key information is transmitted to the information processing apparatus, and the screen information including the authentication information from the information processing apparatus A transmission / reception unit for receiving,
  A display unit for displaying screen information including the received authentication information;
Having a system.

Images