JP2004110474A - Password storage restricting means - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To secure security regarding a password storage restricting method by preventing automatic log-in using a password stored in an application. <P>SOLUTION: An input section 11 sets authentication screen information and input column information. An authentication screen information registering section 12 registers the authentication screen information into a storage section 14, and an input column information registering section 13 registers the input column information into the storage section 14. The storage section 14 stores the authentication screen information and the input column information associating each other every authentication screen. A monitor screen monitoring section 15 monitors a screen displayed on the monitor screen and acquires the monitor screen information. A screen information comparing section 16 determines whether the authentication screen information and the monitor screen information are identical or not, and when they are determined to be identical, a password deleting section 17 deletes a password in a password input column of the authentication screen displayed on the monitor screen. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a password storage restriction method for restricting login and the like by a stored password and improving security, and in particular, in an application for performing password authentication in a computer system, using information on an authentication screen and a password storage setting screen. The present invention relates to a password storage restriction method for restricting authentication with a stored password or storing a password in an application.
[0002]
[Prior art]
With the recent computerization, the number of applications that require personal authentication by password input, such as operating system (OS) login, dial-up, e-mail, and groupware, has increased, and the number of passwords owned by users has increased. I have. Therefore, the burden of password management is increasing.
[0003]
Some applications have a function of saving a user ID and a password in order to reduce the burden of password input and reduce the burden of password management. In an application having such a function, when the application is started, a password is automatically input, so that anyone can log in.
[0004]
As another means for simplifying the management of passwords, it is considered that personal authentication of all applications is performed by one authentication means. When the authentication screen is displayed on the monitor screen, the user is requested to input biometric information such as a fingerprint or a password. Software has been developed in which when a user is successfully authenticated by this input, a password registered in advance is automatically input to an authentication screen and a button (OK button) for transmitting the input content is automatically pressed. Hereinafter, this software is referred to as password input agency software.
[0005]
By registering the authentication screen and the password in advance by using the password entry proxy software, the user can log in to the application using one authentication means such as fingerprint authentication. In addition, the password input agency software not only simplifies management, but also performs personal authentication, so that users who can log in can be restricted and security can be ensured.
[0006]
FIG. 21 is a flowchart showing a procedure of automatic password input by conventional password input proxy software. Hereinafter, screen information (for example, authentication screen information, monitor screen information, etc.) refers to information that can specify a screen, such as a window title, text, and a URL of a Web application.
[0007]
First, screen information for specifying an authentication screen (authentication screen information) and a password to be input to the authentication screen are registered in advance (step S100). The screen displayed on the monitor screen is monitored (step S101), and the screen information (monitor screen information) displayed on the monitor screen is compared with the registered authentication screen information. Is determined (step S102).
[0008]
If the monitor screen information and the authentication screen information are equal, the user is requested to authenticate the user (step S103). When the user is successfully authenticated by fingerprint or voice input (step S104), the password registered in advance is displayed on the monitor screen. Is automatically input to the authentication screen displayed in (1) and the user logs in (step S105). If the personal authentication is not successful (step S104), the authentication processing ends without logging in.
[0009]
In the system using the above-mentioned password entry proxy software, the user who can log in by the personal authentication can be restricted. However, if the password is stored by the function of the application, the user is authenticated by the password entry proxy software. Anyone can log in to the application even without it, so ultimately it is not possible to restrict who can log in, and security cannot be ensured.
[0010]
Conventionally, the only way to ensure security in such a case is for the administrator to restrict the saving of the application password by an operation rule. It was common in writing to tell them not to save their passwords.
[0011]
However, there is a great potential for a user to intentionally or accidentally save a password. That is, even if the administrator sets rules regarding the password of the application, the password saving operation of the user cannot be practically restricted, and the password is saved depending on the user.
[0012]
In addition, a system is known in which the burden on the user is reduced by performing the user authentication on behalf of an arbitrary Web site that requires the user authentication (for example, see Patent Document 1).
[0013]
In addition, the terminal device compares the biological information collected from the user with the biological information stored in the storage device, and when it is determined that the two match, the personal information is determined by the login information stored in the storage device. A personal authentication method for performing secondary authentication is known (for example, see Patent Document 2).
[0014]
However, there has not been proposed any technique regarding a method of automatically deleting authentication information such as a password stored in an application and a method of preventing an application from storing authentication information such as a password.
[0015]
[Patent Document 1]
JP 2002-32340 A
[Patent Document 2]
JP-A-2002-108823
[0016]
[Problems to be solved by the invention]
As described above, in the past, the administrator could not restrict the operation of saving the password only by setting the rules for operation, and when the password was saved, the application was started. Anyone could log in.
[0017]
In addition, even when the password entry proxy software is operated as described above, if the application has a function of saving a password, each of the application that displays the authentication screen and the application that does not display the authentication screen is as follows. There was a problem.
[0018]
In an application that displays an authentication screen, an authentication screen in which a password is input from the beginning is displayed on the monitor screen. The above-described password input proxy software detects the authentication screen and requests the user to authenticate the user. However, even without performing personal authentication, anyone can log in because the password has already been entered on the displayed authentication screen.
[0019]
For applications that do not display the authentication screen, log in as is without displaying the authentication screen. In the related art, since the information on the registered authentication screen is compared with the information on the screen displayed on the monitor screen, the authentication screen display cannot be detected, and the user cannot be required to authenticate the user. . Therefore, anyone can log in by activating the application.
[0020]
SUMMARY OF THE INVENTION The present invention solves the above problems, restricts a user from saving a password in an application and logging in without user authentication, restricts a user from setting password storage, and provides security during user authentication. The aim is to provide technology that improves
[0021]
[Means for Solving the Problems]
In order to solve the above problems, a first invention is a means for registering information on an authentication screen for inputting a password, a means for registering information for specifying an input field for a password, the authentication screen information and the input Means for storing field information in association with each other; means for monitoring a screen displayed on a monitor screen to detect that a screen having the registered authentication screen information is displayed; Means for specifying a password entry field from the list, and means for erasing the password entered in the password entry field of the authentication screen. After the detection of the authentication screen display, the password is erased and stored. Prohibit login with password.
[0022]
Furthermore, by combining the functions of the password entry proxy software, a means for registering authentication information for identifying the user as an identity, a means for requesting identity authentication, and a means for comparing the input information with the authentication information to identify the identity. Means for performing authentication, means for registering a password to be input to the authentication screen, means for registering information in an input field for inputting the password, means for specifying a password input field from the input field information, Means for inputting the password in the input field of the authentication screen. After detecting the display of the authentication screen, if the password is displayed on the displayed authentication screen, the password is erased and the user is authenticated. May be automatically input to the input field of the authentication screen when the authentication is successful.
[0023]
Further, a second invention is a means for registering information of a file for storing a setting for saving a password or a file for storing a saved password, and a means for specifying the file using the registered information. And means for rewriting or deleting the file, and the password is prohibited from being stored by rewriting or deleting the file.
[0024]
Further, in the second invention, means for registering information on a setting screen for saving a password, means for monitoring a screen displayed on a monitor screen and detecting that the setting screen is displayed, Using means for detecting that the screen has been closed, it is determined from the display of the setting screen that the password saving setting may have been made, and after the setting screen is closed, rewriting or deletion of the file is started. You may make it.
[0025]
A third invention is a means for registering information on a setting screen for saving a password, a means for monitoring a screen displayed on a monitor screen and detecting that the setting screen is displayed, Means for detecting whether the setting for saving the password is provided, and means for automatically canceling the setting when the setting for saving the password is provided. Prohibiting the password from being saved by canceling.
[0026]
A fourth invention is a means for registering information on a setting screen for storing a password, a means for monitoring a screen displayed on a monitor screen and detecting that the setting screen is displayed, and a method for storing a password. Means for registering the position or size of a setting field, and means for displaying a separate screen at the position, wherein after detecting the display of the setting screen, the screen of the size is superimposed and displayed at the position of the setting screen. To make the setting field invisible to the user, thereby prohibiting the password from being stored.
[0027]
In the fourth aspect, means for acquiring a position at which the setting screen is displayed, means for detecting a change in the display position by comparing with a previous display position of the setting screen, Means for changing the display position, detecting that the setting screen has been moved, moving the another screen according to the moved position, and hiding the setting item, thereby saving the password. It can be banned.
[0028]
Instead of displaying another screen in a superimposed manner, a substitute screen corresponding to the setting screen and having no password storage item is displayed. After detecting the setting screen display, the substitute screen is displayed on the setting screen. The information set on the alternative screen may be transmitted to the actual screen to prohibit the password from being stored.
[0029]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, a technique for achieving the above-described object by the present invention will be described.
[0030]
FIG. 1 is a diagram illustrating a configuration example of hardware for implementing the present invention. The hardware for implementing the present invention may be a general-purpose computer such as a normal personal computer (PC). For example, as shown in FIG. 1, it comprises an input device 1, an output device 2, a network connection device 3, a memory 4, an external storage device 5, a CPU 6, and a bus 7. The input device 1 and the output device 2 perform input and output on a user interface, respectively. The network connection device 3 is an interface device with a network. The memory 4 is an internal storage device for executing a program. The external storage device 5 is a device such as a hard disk device for storing programs or data. The CPU 6 controls the input device 1, the output device 2, the network connection device 3, the memory 4, and the external storage device 5. The bus 7 connects the devices (1 to 6).
[0031]
FIG. 2 is a diagram showing a configuration example (1) of the password storage restriction device according to the present invention. An example of prohibiting login without entering the password even if the password is already stored in the application will be described.
[0032]
Some applications display the authentication screen on the monitor screen for confirmation when the password is already stored, and others perform login processing without displaying the authentication screen. In the example of FIG. 2, the password storage function has a function of deleting the stored password when the authentication screen is displayed, for an application for displaying the authentication screen on the monitor screen even when the password is already stored. It is a configuration example of a limiting device 10.
[0033]
2 includes an input unit 11, an authentication screen information registration unit 12, an input field information registration unit 13, a storage unit 14, a monitor screen monitoring unit 15, a screen information comparison unit 16, and a password deletion unit 17. Consists of
[0034]
The input unit 11 inputs and sets authentication screen information (authentication screen information) of an application that the user does not want to log in with the stored password and information (input field information) such as the position of an input field for inputting a password. The authentication screen information registration unit 12 sends the authentication screen information to the storage unit 14. The input column information registration unit 13 sends the input column information to the storage unit 14. The storage unit 14 stores authentication screen information and input field information in association with each authentication screen. Here, the input field information indicates the position of the password input field using information such as a control ID and coordinates.
[0035]
The monitor screen monitoring unit 15 monitors the screen displayed on the monitor screen, acquires screen information (monitor screen information) of the newly displayed application, and sends the screen information to the screen information comparison unit 16. The screen information comparison unit 16 acquires the authentication screen information registered by the authentication screen information registration unit 12 from the storage unit 14 and compares it with the monitor screen information sent from the monitor screen monitoring unit 15. If both pieces of screen information are equal, the password elimination unit 17 is notified that the registered authentication screen has been displayed on the monitor screen.
[0036]
The password erasing unit 17 acquires input field information corresponding to the authentication screen displayed on the monitor screen from the storage unit 14 and uses the input field information to change the password in the password input field of the authentication screen displayed on the monitor screen. Erase (clear).
[0037]
With the configuration described above, the display of the authentication screen is detected by registering the information of the authentication screen and the information of the password input field in advance, and the password in the password input field of the authentication screen is automatically erased. Can be.
[0038]
FIG. 3 is a diagram showing a configuration example (2) of the password storage restriction device according to the present invention. In the example of FIG. 3, a password for which automatic login is prohibited is canceled by canceling the password storage setting for an application that performs login processing without displaying an authentication screen on the monitor screen when the password is already saved. 2 is a configuration example of a storage restriction device 20.
[0039]
In the case of an application that does not display the authentication screen on the monitor screen, the process of deleting the password when the authentication screen is displayed cannot be performed. Therefore, the setting for saving the password is canceled in the setting file. The setting of the password storage means to store the user's selection information "save password" for the password input on the authentication screen.
[0040]
3 includes an input unit 21, a setting file information registration unit 22, a storage unit 23, a setting file identification unit 24, and a setting release unit 25.
[0041]
The input unit 21 inputs and sets information (setting file information) of a setting file of an application for which password saving setting is not desired. The setting file information includes a file name, a setting description place, a coping method, and the like. The setting file information registration unit 22 sends the setting file information to the storage unit 23. The storage unit 23 stores setting file information.
[0042]
The setting file specifying unit 24 checks the external storage device 5, specifies a setting file corresponding to the setting file information stored in the storage unit 23 from the setting files stored therein, and specifies the specified setting file. Is transmitted to the setting release unit 25. The setting canceling unit 25 rewrites or deletes the setting file specified by the setting file specifying unit 24 using the setting file information stored in the storage unit 23, and cancels the setting for saving the password.
[0043]
With the above-described configuration, the information of the setting file for storing the password is registered in advance, and the corresponding setting file on the external storage device 5 is rewritten or deleted, and the setting for storing the password is released. Prevents preservation.
[0044]
FIG. 4 is a diagram showing a configuration example (3) of the password storage restriction device according to the present invention. The example of FIG. 4 is a configuration example of the password storage restricting device 30 for canceling the setting of the password storage by the means different from the example of FIG. 3 for the application for which the password storage is already set.
[0045]
4 includes an input unit 31, a setting screen information registration unit 32, a setting column information registration unit 33, a storage unit 34, a monitor screen monitoring unit 35, a screen information comparison unit 36, and a setting detection unit 37. , A setting change unit 38.
[0046]
The input unit 31 inputs and sets information (setting screen information) of a setting screen of an application for which password saving is not desired and information of a setting field (setting field information) for enabling password saving. The setting screen information registration unit 32 sends the setting screen information to the storage unit 34. The setting column information registration unit 33 sends the setting column information to the storage unit 34. The storage unit 34 stores setting screen information and setting column information in association with each setting screen. Here, the setting field information indicates the position of the password storage setting field by information such as a control ID and coordinates.
[0047]
The monitor screen monitoring unit 35 monitors the screen displayed on the monitor screen, acquires screen information (monitor screen information) of the newly displayed application, and sends it to the screen information comparison unit 36. The screen information comparison unit 36 acquires the setting screen information registered by the setting screen information registration unit 32 from the storage unit 34, and compares the acquired setting screen information with the monitor screen information sent from the monitor screen monitoring unit 35. When both pieces of screen information are equal, the fact that the registered setting screen has been displayed on the monitor screen is notified to the setting detecting section 37.
[0048]
The setting detection unit 37 acquires the setting column information corresponding to the setting screen displayed on the monitor screen from the storage unit 34, and uses the setting column information to store the password in the setting column of the setting screen displayed on the monitor screen. Check whether saving is set. The setting change unit 38 changes the valid password storage setting and forcibly cancels the setting.
[0049]
With such a configuration, the information on the setting screen for password storage and the information in the setting field for password storage are registered in advance to detect the display on the setting screen, and whether the user has enabled the password storage setting. By checking whether it is enabled and forcibly canceling the setting when it is enabled, saving the password can be prevented.
[0050]
FIG. 5 is a diagram showing a configuration example (4) of the password storage restriction device according to the present invention. The example of FIG. 5 is a configuration example of the password storage restricting device 40 for preventing the user from storing the password, instead of taking action after the password is stored.
[0051]
5 includes an input unit 41, a setting screen information registration unit 42, a setting column information registration unit 43, a storage unit 44, a monitor screen monitoring unit 45, a screen information comparison unit 46, and another screen display unit. 47.
[0052]
The input unit 41 inputs and sets information on a setting screen (setting screen information) of an application for which password saving is not desired and information on a setting field for enabling password saving (setting field information). The setting screen information registration unit 42 sends the setting screen information to the storage unit 44. The setting column information registration unit 43 sends the setting column information to the storage unit 44. The storage unit 44 stores the setting screen information and the setting column information in association with each other for each setting screen.
[0053]
The monitor screen monitoring unit 45 monitors the screen displayed on the monitor screen, acquires screen information (monitor screen information) of the newly displayed application, and sends the screen information to the screen information comparison unit 46. The screen information comparing unit 46 acquires the setting screen information registered by the setting screen information registering unit 42 from the storage unit 44, and compares the acquired setting screen information with the monitor screen information transmitted from the monitor screen monitoring unit 45. When both pieces of screen information are equal, the fact that the registered setting screen has been displayed on the monitor screen is notified to the separate screen display unit 47.
[0054]
The separate screen display unit 47 acquires the setting column information corresponding to the setting screen displayed on the monitor screen from the storage unit 44, and stores the password of the setting screen displayed on the monitor screen using the setting column information. A separate screen is displayed over the setting field, and the password storage setting field is covered.
[0055]
With this configuration, by registering the information on the password storage setting screen and the information on the password storage setting field in advance, the display of the setting screen is detected, and another screen is displayed on the setting field of the setting screen. By superimposing and displaying the setting items for storing the password, the setting items for storing the password are hidden so that the setting items cannot be seen by the user, so that the storage of the password can be prevented.
[0056]
FIG. 6 is a diagram showing a configuration example (5) of the password storage restriction device according to the present invention. The example of FIG. 6 is a configuration example of the password storage restriction device 50 for preventing the user from storing the password by means different from the example of FIG.
[0057]
6 includes an input unit 51, a setting screen information registration unit 52, an alternative screen setting unit 53, a storage unit 54, a monitor screen monitoring unit 55, a screen information comparison unit 56, and an alternative screen display unit 57. , A setting information transmitting unit 58.
[0058]
The input unit 51 inputs and sets information on a setting screen (setting screen information) of an application for which password saving setting is not desired and a screen (alternative screen) to be displayed instead of the setting screen. The setting screen information registration unit 52 sends the setting screen information to the storage unit 54. The substitute screen setting unit 53 sends the information of the substitute screen to the storage unit 54. The storage unit 54 stores the setting screen information and the information of the alternative screen in association with each other for each setting screen.
[0059]
The monitor screen monitoring unit 55 monitors the screen displayed on the monitor screen, acquires screen information (monitor screen information) of the newly displayed application, and sends the screen information to the screen information comparison unit 56. The screen information comparison unit 56 acquires the setting screen information registered by the setting screen information registration unit 52 from the storage unit 54, and compares the acquired setting screen information with the monitor screen information transmitted from the monitor screen monitoring unit 55. If both pieces of screen information are equal, the substitute screen display unit 57 is notified that the registered setting screen has been displayed on the monitor screen.
[0060]
The substitute screen display unit 57 acquires a substitute screen corresponding to the setting screen displayed on the monitor screen from the storage unit 54, and displays the substitute screen on the setting screen displayed on the monitor screen. The setting information transmitting unit 58 transmits the information set on the substitute screen to the actual setting screen.
[0061]
With such a configuration, by registering the information of the setting screen for saving the password and the information of the alternative screen in advance, the display of the setting screen is detected, and the setting item for saving the password is replaced with the setting screen. Displaying an alternative screen can prevent passwords from being saved.
[0062]
【Example】
Hereinafter, embodiments of the present invention will be described with reference to the drawings. Here, the password in the present invention may be called a personal identification number, a personal identification key, a secret number, a secret key, a secret key, or the like.
[0063]
[Example 1]
FIG. 7 is a flowchart of the password storage restriction process according to the first embodiment. The first embodiment is an example of a mode in which a password is deleted by the password storage restricting device 10 having the configuration shown in FIG.
[0064]
First, the screen information (authentication screen information) of the authentication screen of the application whose login is to be prohibited using the saved password is associated with the input field information and registered in the storage unit 14 (step S10). The screen displayed on the monitor screen is monitored by the monitor screen monitoring unit 15 (step S11), and the screen information (monitor screen information) of the screen newly displayed on the monitor screen and the storage unit 14 are displayed by the screen information comparison unit 16. Then, it is determined whether the two pieces of screen information are equal to each other by comparing the authentication screen information registered with the authentication screen information (step S12).
[0065]
When the monitor screen information and the authentication screen information are equal, the password erasing unit 17 acquires the input field information corresponding to the authentication screen displayed on the monitor screen from the storage unit 14 (step S13), and stores the input field information. Then, the password input field of the authentication screen displayed on the monitor screen is specified, and the password input in the password input field is automatically deleted (step S14).
[0066]
As described above, even if the user intentionally saves the password, the saved password is erased at the same time that the authentication screen is displayed on the monitor screen, so that login with the saved password can be prohibited.
[0067]
[Example 2]
FIG. 8 is a diagram illustrating a configuration example of a password storage restriction device according to the second embodiment. The password storage restriction device 60 according to the second embodiment includes an input unit 61, a setting screen information registration unit 62, a setting file information registration unit 63, a storage unit 64, a monitor screen monitoring unit 65, a screen information comparison unit 66, and a setting file identification unit. 67, and a setting release unit 68. This configuration is such that a setting screen information registration unit 62, a monitor screen monitoring unit 65, and a screen information comparison unit 66 are added to the configuration of the password storage restriction device 20 of FIG.
[0068]
The input unit 61 inputs and sets information on a setting screen (setting screen information) and information of a setting file (setting file information) of an application for which password saving setting is not desired. The setting screen information registration unit 62 sends the setting screen information to the storage unit 64. The setting file information registration unit 63 sends the setting file information to the storage unit 64. The storage unit 64 stores the setting screen information and the setting file information in association with each other.
[0069]
FIG. 9 is a diagram illustrating an example of the setting file information according to the second embodiment. The setting file information according to the second embodiment includes information such as a file name that is the name of the setting file, a description location of the setting indicating a location where the setting for saving the password is described in the setting file, a coping method, and the like. The coping method information is information indicating a method for canceling settings such as partial correction of the setting file and deletion of the setting file.
[0070]
The monitor screen monitoring unit 65 monitors the screen displayed on the monitor screen, acquires screen information (monitor screen information) of the newly displayed application, and sends it to the screen information comparison unit 66. The screen information comparison unit 66 acquires the setting screen information registered by the setting screen information registration unit 62 from the storage unit 64, and compares the acquired setting screen information with the monitor screen information transmitted from the monitor screen monitoring unit 65. If both pieces of screen information are equal, the monitor screen monitoring unit 65 is notified that the registered setting screen has been displayed on the monitor screen.
[0071]
The monitor screen monitoring unit 65 further monitors the setting screen displayed on the monitor screen, detects that the setting screen has been closed, and notifies the setting file specifying unit 67 of that fact. The setting file specifying unit 67 obtains the setting file information corresponding to the setting screen closed on the monitor screen from the storage unit 64, checks the external storage device 5, and obtains the setting obtained from the stored setting files. The setting file corresponding to the file information is specified, and the information of the specified setting file is sent to the setting canceling unit 68. The setting canceling unit 68 uses the setting file information acquired from the storage unit 64 to rewrite or delete the setting file specified by the setting file specifying unit 67, and cancels the setting for saving the password.
[0072]
FIG. 10 is a flowchart of a password storage restriction process according to the second embodiment. First, the setting screen information and the setting file information of the application whose password storage is to be prohibited are registered in the storage unit 64 (step S20). The screen displayed on the monitor screen is monitored by the monitor screen monitoring unit 65 (step S21), and is registered as screen information (monitor screen information) of the screen newly displayed on the monitor screen by the screen information comparison unit 66. A comparison is made with certain setting screen information to determine whether both pieces of screen information are equal (step S22).
[0073]
When the monitor screen information is equal to the setting screen information, the monitor screen monitoring unit 65 monitors whether the setting screen displayed on the monitor screen has been closed (step S23). When the setting screen displayed on the monitor screen is closed, the setting file specifying unit 67 acquires the setting file information corresponding to the setting screen closed on the monitor screen from the storage unit 64 (Step S24). Then, the external storage device 5 is examined using the setting file information, and the setting file corresponding to the acquired setting file information is specified. The setting canceling unit 68 cancels the password saving setting of the setting file specified by the setting file specifying unit 67 according to the handling method of the setting file information (step S25).
[0074]
As described above, since the setting screen is displayed on the monitor screen, it is judged that there is a high possibility that the password saving setting has been changed, and the user cancels the password saving setting. Even if the password storage is set, the password is automatically and effectively released, so that the password storage can be prohibited.
[0075]
[Example 3]
FIG. 11 is a flowchart of a password storage restriction process according to the third embodiment. The third embodiment is an example of a form in which password storage is prohibited by the password storage restriction device 30 having the configuration shown in FIG.
[0076]
First, the screen information (setting screen information) and the setting column information of the setting screen of the application whose password storage is to be prohibited are registered in the storage unit 34 (step S30). The screen displayed on the monitor screen is monitored by the monitor screen monitoring unit 35 (step S31), and the screen information (monitor screen information) registered as the screen information (monitor screen information) of the newly displayed screen by the screen information comparison unit 36. And whether or not both pieces of screen information are equal is determined (step S32).
[0077]
When the monitor screen information is equal to the setting screen information, the setting detecting unit 37 acquires the setting column information corresponding to the setting screen displayed on the monitor screen from the storage unit 34 (Step S33), and stores the setting column information. Then, the password storage setting field of the setting screen displayed on the monitor screen is specified, and it is confirmed whether the password storage is set (step S34). If the setting for saving the password has been made, the setting change unit 38 cancels the setting (step S35).
[0078]
FIG. 12 is a diagram illustrating an example of the setting column information according to the third embodiment. The setting column information according to the third embodiment shown in FIG. 12A includes a control ID (when an ID is assigned to each part in the screen) and a position for specifying the setting column in the setting screen such as coordinates. It consists of information, types of formats for setting check boxes, text boxes, and the like, and information such as a coping method as a method of releasing a password according to the types.
[0079]
FIG. 12B is a diagram illustrating an example of types and coping methods according to the third embodiment. The password storage setting field is often a check box or a text box for entering a password. For example, when the type is a check box, information such as unchecking is set as a coping method. For example, if the type is a text box, information such as deleting the displayed password is set. If the type and the coping method correspond one-to-one, either the type or the coping method can be omitted as the setting column information.
[0080]
As described above, even if the user sets the password saving on the setting screen, the password saving setting is automatically canceled and not saved, so that the user can be prohibited from saving the password.
[0081]
[Example 4]
FIG. 13 is a diagram illustrating a configuration example of a password storage restriction device according to the fourth embodiment. The password storage restriction device 70 according to the fourth embodiment includes an input unit 71, a setting screen information registration unit 72, a setting column information registration unit 73, a storage unit 74, a monitor screen monitoring unit 75, a screen information comparison unit 76, a separate screen display unit. 77, a screen display position comparing section 78. This is a configuration in which a screen display position comparison unit 78 is added to the configuration of the password storage restriction device 40 of FIG.
[0082]
The input unit 71 inputs and sets information on a setting screen (setting screen information) of an application for which password saving is not desired and information on a setting field (setting field information) for enabling password saving. The setting screen information registration unit 72 sends the setting screen information to the storage unit 74. The setting column information registration unit 73 sends the setting column information to the storage unit 74. The storage unit 74 stores setting screen information and setting column information in association with each other for each setting screen.
[0083]
The monitor screen monitoring unit 75 monitors the screen displayed on the monitor screen, acquires screen information (monitor screen information) of the newly displayed application, and sends the screen information to the screen information comparison unit 76. The screen information comparison unit 76 acquires the setting screen information registered by the setting screen information registration unit 72 from the storage unit 74, and compares the acquired setting screen information with the monitor screen information sent from the monitor screen monitoring unit 75. If both pieces of screen information are equal, the separate screen display unit 77 is notified that the registered setting screen has been displayed on the monitor screen.
[0084]
The separate screen display unit 77 acquires the setting column information corresponding to the setting screen displayed on the monitor screen from the storage unit 74, and uses the setting column information to set the password storage of the setting screen displayed on the monitor screen. Display another screen over the field and cover the password storage setting field.
[0085]
After detecting the setting screen, the monitor screen monitoring unit 75 acquires the display position of the setting screen as needed and sends it to the screen display position comparing unit 78. The screen display position comparison unit 78 compares the display position of the setting screen acquired from the monitor screen monitoring unit 75 with the display position of the previous setting screen to check whether or not the display position has moved. If it is moving, the display position of the moved setting screen is sent to the separate screen display section 77. The separate screen display unit 77 moves the different screen to the display position of the setting screen received from the screen display position comparison unit 78.
[0086]
FIG. 14 is a flowchart of the password storage restriction process according to the fourth embodiment. First, the screen information (setting screen information) of the setting screen of the application whose password storage is to be prohibited and the setting column information for enabling the password storage are registered in the storage unit 74 (step S40). The screen displayed on the monitor screen is monitored by the monitor screen monitoring unit 75 (step S41), and the screen information (monitor screen information) registered as the screen information (monitor screen information) of the screen newly displayed by the screen information comparison unit 76. And whether the two pieces of screen information are equal is determined (step S42).
[0087]
When the monitor screen information is equal to the setting screen information, the separate screen display unit 77 acquires the setting column information corresponding to the setting screen displayed on the monitor screen from the storage unit 74 (step S43), and the setting column information Is used to specify a password storage setting field on the setting screen displayed on the monitor screen, and display another screen so as to cover the password storage setting field (step S44).
[0088]
Further, the monitor screen monitoring unit 75 continues to monitor the monitor screen thereafter (step S45), and the screen display position comparison unit 78 checks whether the display position of the setting screen has moved on the monitor screen (step S45). Step S46). If the setting screen has been moved, the separate screen display unit 77 acquires the display position of the setting screen after the movement, moves the other screen in the same manner (step S47), and sets the password storage of the setting screen whose display position has moved. Cover the column.
[0089]
FIG. 15 is a diagram illustrating an example of the setting column information according to the fourth embodiment. The setting column information according to the fourth embodiment includes position information such as coordinates of the setting column in the setting screen, and information such as the size of the setting column so that the entire setting column can be covered and hidden on another screen. .
[0090]
FIG. 16 is a diagram illustrating an example of a setting screen in which password storage is prohibited in the fourth embodiment. FIG. 16A is an example of a setting screen having a password storage setting field, and a check box (password storage setting field) for storing a password is provided slightly below the center of the setting screen.
[0091]
FIG. 16B is an example in which another screen is displayed over the setting screen of FIG. 16A by the technique described in the fourth embodiment. A check box (password setting field) for saving a password on the setting screen of FIG. 16A is covered by another screen.
[0092]
As described above, even if the user displays the setting screen on the monitor screen, the password storage setting field of the setting screen is covered by another screen, so the user cannot see the password storage setting field, and You can forbid saving passwords.
[0093]
[Example 5]
FIG. 17 is a flowchart of a password storage restriction process according to the fifth embodiment. The fifth embodiment is an example of a mode in which the password storage restricting device 50 having the configuration shown in FIG. 6 displays an alternative screen without a password storage setting field instead of a setting screen with a password storage setting field.
[0094]
First, the screen information (setting screen information) of the setting screen of the application whose password storage is to be prohibited and the information of the substitute screen are registered in the storage unit 54 (step S50). The screen displayed on the monitor screen is monitored by the monitor screen monitoring unit 55 (step S51), and the screen information (monitor screen information) of the screen newly displayed by the screen information comparison unit 56 is registered as setting screen information. And whether the two pieces of screen information are equal is determined (step S52).
[0095]
When the monitor screen information is equal to the setting screen information, the substitute screen display unit 57 acquires the information of the substitute screen corresponding to the setting screen displayed on the monitor screen from the storage unit 54 (step S53), and displays the information on the monitor screen. The alternative screen is superimposed on the setting screen displayed in (1) (step S54). The setting information transmitting unit 58 transmits the content set on the alternative screen by the user to the setting screen hidden by the alternative screen (step S55).
[0096]
FIG. 18 is a diagram illustrating an example of an alternative screen according to the fifth embodiment. For example, for the setting screen as shown in FIG. 18A, an alternative screen as shown in FIG. 18B for setting the setting items excluding the setting field of the password storage from FIG. 18A is created. When a setting screen as shown in FIG. 18 (A) is displayed on the monitor screen, an alternative screen as shown in FIG. 18 (B) (note that the user name and password input fields are blank) ) Is superimposed.
[0097]
When the user inputs each setting of the user name and the password on the alternative screen as shown in FIG. 18B, the setting contents are hidden under the alternative screen as shown in FIG. 18A. Make it fill in the screen automatically. For example, if "user" and "****" are respectively entered in the user name field and the password field on the alternative screen in FIG. 18B, the user name field on the setting screen in FIG. "User" and "****" are automatically entered in the password fields. If the OK button is pressed on the alternative screen of FIG. 18B, the OK button is automatically pressed on the setting screen of FIG.
[0098]
As described above, even if the user displays the setting screen on the monitor screen, the setting screen (alternate screen) without the password setting field is displayed on the setting screen. Only the alternative screen without the field is visible, and the user can be prohibited from saving the password.
[0099]
[Example 6]
FIG. 19 is a diagram illustrating a configuration example of a password storage restriction device according to the sixth embodiment. The sixth embodiment is an example of a form in which the password erasing technique described in the first embodiment is added to the above-described password input proxy software (software that performs personal authentication of all applications by one authentication unit).
[0100]
The password storage restriction device 80 according to the sixth embodiment includes an input unit 81, an authentication screen information registration unit 82, an input field information registration unit 83, a password registration unit 84, a personal authentication information registration unit 85, a storage unit 86, and a monitor screen monitoring unit. 87, a screen information comparing section 88, a password erasing section 89, an authentication request section 90, an authentication information input section 91, an authentication section 92, a password acquisition section 93, and a password input section 94.
[0101]
The input unit 81 inputs and sets information on an authentication screen of an application (authentication screen information), information on an input field for inputting a password (input field information), a password of the application, and personal authentication information for performing personal authentication. Here, the means of personal authentication include password authentication, biometric information authentication such as fingerprint, voiceprint, iris, face, retina, signature, keystroke, and the like derived from the operation unique to the living body. The same processing is also possible in the authentication based on the point that the authentication is performed by one authentication.
[0102]
The authentication screen information registration unit 82 sends the authentication screen information to the storage unit 86. The input column information registration unit 83 sends the input column information to the storage unit 86. The password registration unit 84 sends the password to the storage unit 86. The personal authentication information registration unit 85 sends the personal authentication information to the storage unit 86. The storage unit 86 stores authentication screen information, input field information, password, and personal authentication information in association with each other.
[0103]
The monitor screen monitoring unit 87 monitors the screen displayed on the monitor screen, acquires screen information (monitor screen information) of the newly displayed application, and sends the screen information to the screen information comparison unit 88. The screen information comparison unit 88 acquires the authentication screen information registered by the authentication screen information registration unit 82 from the storage unit 86, and compares it with the monitor screen information sent from the monitor screen monitoring unit 87. If the two pieces of screen information are the same, it notifies the password erasing unit 89 and the authentication requesting unit 90 that the authentication screen registered by the user is displayed on the monitor screen.
[0104]
The password erasing unit 89 acquires input field information corresponding to the authentication screen displayed on the monitor screen from the storage unit 86, and erases (clears) the password in the password input field of the authentication screen displayed on the monitor screen. .
[0105]
The authentication request unit 90 requests the user to authenticate himself / herself. As an example of requesting personal authentication, an example in which another authentication screen (authentication screen for personal authentication) is newly displayed on the monitor screen can be considered. The authentication information input unit 91 acquires authentication information (input authentication information) input by the user to perform personal authentication, and sends it to the authentication unit 92. The authentication unit 92 compares the input authentication information obtained from the authentication information input unit 91 with the personal authentication information obtained from the storage unit 86. If the two pieces of authentication information are equal, it is determined that the user is the person, and the authentication screen information of the authentication screen displayed on the monitor screen is sent to the password acquisition unit 93.
[0106]
The password acquisition unit 93 acquires a password corresponding to the authentication screen displayed on the monitor screen from the storage unit 86 based on the authentication screen information acquired from the authentication unit 92, and sends the password to the password input unit 94. The password input unit 94 automatically inputs the obtained password into a password input field of the authentication screen displayed on the monitor screen.
[0107]
FIG. 20 is a flowchart of a password storage restriction process according to the sixth embodiment. First, the screen information (authentication screen information), the input field information, the password, and the personal authentication information of the authentication screen of the application for which login with the saved password is to be prohibited are registered in the storage unit 86 in association with each other (step S60). The screen displayed on the monitor screen is monitored by the monitor screen monitoring unit 87 (Step S61), and the authentication screen information registered as the screen information (monitor screen information) of the screen newly displayed by the screen information comparison unit 88. And whether the two pieces of screen information are equal is determined (step S62).
[0108]
When the monitor screen information is equal to the authentication screen information, the password erasing unit 89 acquires from the storage unit 86 the input field information corresponding to the authentication screen displayed on the monitor screen (step S63), and stores the input field information. Then, the password input field of the authentication screen displayed on the monitor screen is specified, and the password input in the password input field is automatically deleted (step S64).
[0109]
Further, the authentication requesting unit 90 requests the user for personal authentication (step S65). The authentication unit 92 compares the input authentication information input by the user obtained by the authentication information input unit 91 to perform personal authentication with the personal authentication information obtained from the storage unit 86, and performs personal authentication (step S66). If the personal authentication is successful, the password input unit 94 inputs the password corresponding to the authentication screen displayed on the monitor screen acquired by the password acquisition unit 93 from the storage unit 86 into the password of the authentication screen displayed on the monitor screen. A field is automatically entered (step S67).
[0110]
As described above, even if the user intentionally saves the password on the authentication screen of the application in the environment where the password entry proxy software is installed, the password is automatically erased when the next authentication screen is displayed. It is possible to prohibit the user from logging in with the password, and solve the problem of the password input agency software.
[0111]
The processing described in each of the above embodiments can be realized by a computer and a software program, and the program is stored in an appropriate recording medium such as a computer-readable portable medium memory, a semiconductor memory, and a hard disk. Then, by reading it out, it can be executed by a computer.
[0112]
The features of each of the above embodiments are listed below.
[0113]
(Appendix 1) A password storage restriction method for restricting authentication by a password stored in a computer system,
Registering the information on the authentication screen for entering the password,
Registering information for specifying a password input field in association with information on the authentication screen;
Monitoring a screen displayed on a monitor screen, and detecting that a screen having information of the registered authentication screen is displayed on the monitor screen;
Identifying a password input field of the authentication screen from information identifying the password input field associated with the authentication screen information;
Erasing the password entered in the input field of the specified password.
A method for restricting password storage, characterized in that:
[0114]
(Supplementary Note 2) A password storage restriction method for restricting authentication by a password stored in a computer system,
Registering the information of the file that stores the setting to save the password or the file that stores the saved password;
Identifying the file using information of the registered file;
Rewriting or deleting the specified file.
A method for restricting password storage, characterized in that:
[0115]
(Appendix 3) In the password storage restriction method described in Appendix 2,
The process of registering the information on the setting screen to save the password,
Monitoring a screen displayed on a monitor screen and detecting that a screen having information of the registered setting screen is displayed on the monitor screen;
Detecting that the setting screen is closed;
Having a process of rewriting or deleting the file after the setting screen is closed
A method for restricting password storage, characterized in that:
[0116]
(Supplementary Note 4) A password storage restriction method for restricting authentication by a password stored in a computer system,
The process of registering the information on the setting screen to save the password,
Monitoring a screen displayed on a monitor screen and detecting that a screen having information of the registered setting screen is displayed on the monitor screen;
Detecting whether a setting for saving a password is made on the setting screen;
Automatically canceling the setting for saving the password when the setting for saving the password is set.
A method for restricting password storage, characterized in that:
[0117]
(Appendix 5) A password storage restriction method for restricting authentication by a password stored in a computer system,
The process of registering the information on the setting screen to save the password,
Monitoring a screen displayed on a monitor screen and detecting that a screen having information of the registered setting screen is displayed on the monitor screen;
Registering the position or size of the setting field to save the password,
Displaying a separate screen at the position of the setting field for storing the registered password so as to overlap the setting field for setting the password.
A method for restricting password storage, characterized in that:
(Appendix 6) In the password storage restriction method described in Appendix 5,
Obtaining a position where the setting screen is displayed;
Detecting a change in the position of the setting screen;
Changing the display position of the another screen according to the change of the position of the setting screen.
A method for restricting password storage, characterized in that:
[0118]
(Supplementary Note 7) A password storage restriction method for restricting authentication by a password stored in a computer system,
The process of registering the information on the setting screen to save the password,
Monitoring a screen displayed on a monitor screen and detecting that a screen having information of the registered setting screen is displayed on the monitor screen;
A step of superimposing an alternative screen having no password storage setting field on the setting screen displayed on the monitor screen;
Transmitting information set in a setting field on the substitute screen to a corresponding setting field on the setting screen.
A method for restricting password storage, characterized in that:
[0119]
(Supplementary note 8) In the password storage restriction method described in Supplementary note 1,
Registering authentication information to identify the user;
Requesting the user to authenticate himself / herself;
Comparing the authentication information entered by the user with the registered authentication information to perform user authentication,
Registering a password to be entered in a password entry field of the authentication screen after the personal authentication;
Inputting the registered password into a password input field of the authentication screen.
A method for restricting password storage, characterized in that:
[0120]
(Supplementary Note 9) A password storage restriction program for causing a computer to execute the password storage restriction method described in any of Supplementary Notes 1 to 8.
[0121]
(Supplementary Note 10) A recording medium that records a password storage restriction program for causing a computer to execute the password storage restriction method described in any one of Supplementary Notes 1 to 8.
[0122]
【The invention's effect】
As described above, according to the present invention, it is possible to restrict login of an application with a stored password and storage of a password in the application. Furthermore, even in an environment in which password entry proxy software is installed, security problems can be solved by restricting login of an application using a stored password.
[Brief description of the drawings]
FIG. 1 is a diagram showing a configuration example of hardware for implementing the present invention.
FIG. 2 is a diagram showing a configuration example (1) of a password storage restriction device according to the present invention.
FIG. 3 is a diagram showing a configuration example (2) of the password storage restriction device according to the present invention.
FIG. 4 is a diagram showing a configuration example (3) of the password storage restriction device according to the present invention.
FIG. 5 is a diagram showing a configuration example (4) of the password storage restriction device according to the present invention.
FIG. 6 is a diagram showing a configuration example (5) of the password storage restriction device according to the present invention.
FIG. 7 is a flowchart of a password storage restriction process according to the first embodiment of the present invention.
FIG. 8 is a diagram illustrating a configuration example of a password storage restriction device according to a second embodiment of the present invention.
FIG. 9 is a diagram illustrating an example of setting file information according to the second embodiment of the present invention.
FIG. 10 is a flowchart of a password storage restriction process according to the second embodiment of the present invention.
FIG. 11 is a flowchart of a password storage restriction process according to the third embodiment of the present invention.
FIG. 12 is a diagram illustrating an example of setting column information according to a third embodiment of the present invention.
FIG. 13 is a diagram illustrating a configuration example of a password storage restriction device according to a fourth embodiment of the present invention.
FIG. 14 is a flowchart illustrating a password storage restriction process according to the fourth embodiment of the present invention.
FIG. 15 is a diagram illustrating an example of setting column information according to a fourth embodiment of the present invention.
FIG. 16 is a diagram illustrating an example of a setting screen in which password storage is prohibited according to the fourth embodiment of the present invention.
FIG. 17 is a flowchart of a password storage restriction process according to the fifth embodiment of the present invention.
FIG. 18 is a diagram illustrating an example of an alternative screen according to the fifth embodiment of the present invention.
FIG. 19 is a diagram illustrating a configuration example of a password storage restriction device according to a sixth embodiment of the present invention.
FIG. 20 is a flowchart of a password storage restriction process according to the sixth embodiment of the present invention.
FIG. 21 is a flowchart showing a procedure of automatic password input by conventional password input proxy software.
[Explanation of symbols]
1 Input device
2 Output device
3 Network connection device
4 memory
5 External storage device
6 CPU
7 bus
10,20,30,40,50,60,70,80 Password storage restriction device
11, 21, 31, 41, 51, 61, 71, 81 Input unit
12,82 Authentication screen information registration section
13,83 input field information registration section
14, 23, 34, 44, 54, 64, 74, 86 storage unit
15, 35, 45, 55, 65, 75, 87 Monitor screen monitoring unit
16, 36, 46, 56, 66, 76, 88 Screen information comparison unit
17,89 Password eraser
22, 63 setting file information registration section
24, 67 setting file specifying part
25, 68 setting release section
32, 42, 52, 62, 72 setting screen information registration section
33, 43, 73 setting column information registration section
37 Setting detector
38 Setting change section
47,77 Separate screen display
53 Alternative screen setting section
57 Alternative screen display
58 Setting information transmission section
78 Screen display position comparison unit
84 Password registration section
85 Authentication Information Registration Section
90 Authentication request section
91 Authentication information input section
92 Authentication Department
93 Password acquisition unit
94 Password input section

Claims (5)

A password storage restriction method for restricting authentication by a password stored in a computer system,
Registering the information on the authentication screen for entering the password,
Registering information for specifying a password input field in association with information on the authentication screen;
Monitoring a screen displayed on a monitor screen, and detecting that a screen having information of the registered authentication screen is displayed on the monitor screen;
Identifying a password input field of the authentication screen from information identifying the password input field associated with the authentication screen information;
Erasing the password entered in the input field of the specified password. The password storage restriction method according to claim 1,
Registering authentication information to identify the user;
Requesting the user to authenticate himself / herself;
Comparing the authentication information entered by the user with the registered authentication information to perform user authentication,
Registering a password to be entered in a password entry field of the authentication screen after the personal authentication;
Inputting the registered password into a password input field of the authentication screen. A password storage restriction method for restricting authentication by a password stored in a computer system,
Registering the information of the file that stores the setting to save the password or the file that stores the saved password;
Identifying the file using information of the registered file;
Rewriting or deleting the specified file. A password storage restriction method for restricting authentication by a password stored in a computer system,
The process of registering the information on the setting screen to save the password,
Monitoring a screen displayed on a monitor screen and detecting that a screen having information of the registered setting screen is displayed on the monitor screen;
Detecting whether a setting for saving a password is made on the setting screen;
Automatically canceling the setting for saving the password when the setting for saving the password is made. A password storage restriction method for restricting authentication by a password stored in a computer system,
The process of registering the information on the setting screen to save the password,
Monitoring a screen displayed on a monitor screen and detecting that a screen having information of the registered setting screen is displayed on the monitor screen;
Registering the position or size of the setting field to save the password,
Displaying a separate screen at the position of the setting field for storing the registered password so as to overlap the setting field for setting the password.

Images