JP2006065708A - Password information update system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an updated information notification system by which no unauthorized use for a system is immediately related even when periodically automatically updated password information is notified to the past user in the worst case in notifying a user of the periodically automatically updated password information. <P>SOLUTION: The updated information notification system involves: preparing a random character string 32 as a password used in user authentication processing (31); dividing the prepared password character string information 32 into a plurality of portions (33); registering the respective divided partial password character string information on a WEB 36; sending respective URL (Uniform Resource Locator) address information used for referring to the divided partial password character string information 34a, 35a to a registered mail address (L3); and conducting authentication for the user by obtaining the input of other password character string information obtained by asking a group manager involving the user to refer to in reference on the WEB 36 (36). <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an update system for password information used in user authentication processing, and more particularly to an automatic / periodic automatic password update system.

  At present, in order to enhance security in daily operations and electronic commerce, it is generally performed to perform password authentication and periodically update the password. Conventionally, for example, a technique described in Patent Document 1 below is known as a technique for periodically updating a password for the purpose of ensuring security. The device described in Patent Document 1 is a current password information area, a means for automatically creating updated password information, a seed information input device for creating an updated password, and the only absolute input to the device. And an absolute password storage area. This apparatus automatically generates a new password based on seed information for creating an updated password, and realizes automatic update of the password information based on the current password information and the updated password information. More specifically, the absolute password information is automatically generated using the absolute password information as seed information by inputting the absolute password, and the user's burden is reduced by automatically updating the terminal password.

JP-A-11-203247

  However, the technique described in Patent Document 1 can prevent damage to unauthorized use of the system when password information is leaked to a third party by updating the password information automatically by updating the password. it can. However, since users who have been using the system in the past know the normal absolute password of the device, it is necessary to change the absolute password when revoking the use authority.

  In this way, if the absolute password information is not updated when the system user is changed, it can be used illegally by all users who have used the system in the past. There is a problem that the system operation becomes complicated because the absolute password information must be manually updated every time the system user changes.

  An object of the present invention is to prevent unauthorized use of a system without realizing password password update operation even when system use members are changed, while realizing automatic password update.

  The password information update notification system of the present invention creates a random character string as a password used in the user authentication process, and divides the created password character string information into a plurality of parts. The divided partial password character string information is divided into a place to contact the user and a place to contact at least one group to which the user belongs, and each is registered in a state that can be referred to on the web server. To do. Each of the URL address information for referring to the divided partial password character string information is obtained by contacting the user and a plurality of groups to which the user belongs individually by e-mail notification, for example. Only part of the column information can be referenced.

  When the user needs to obtain the character string information of the remaining password from the group to which the user belongs, the user needs to obtain it from the administrator. At that stage, it can be determined whether or not the administrator is still a regular user. Character string information is not sent to past users who have lost their eligibility, but partial password character string information is sent to authorized users as proof of approval. Authentication can be passed on condition that the sent partial password is entered, the final partial password can be obtained, and thus the entire password can be obtained.

  Alternatively, when acquiring / updating a password that is common to multiple members of a group, at least when acquiring the last partial password information, obtain the remaining partial passwords of other members of the group. So that you need to. Thus, the final partial password of the entire password can be obtained only after approval by all the other members is obtained, and a certain system can be used.

  According to the present invention, when a user belonging to one or more groups loses the user authentication qualification, the partial password information is not notified to the user whose each group has lost the use qualification. The user cannot obtain complete password information and can prevent unauthorized use.

  In addition, when a user refers to password information divided on the Web server, partial password information from the group to which the user belongs must be provided in order to request input of partial password information possessed by multiple groups to which the user belongs. It is possible to prevent information leakage of partial password information addressed to the user himself / herself to a user who cannot be received.

  Alternatively, when acquiring / updating a password that is common to multiple members of a group, at least when acquiring the last partial password information, obtain the remaining partial passwords of other members of the group. By making it necessary to do so, it is possible to build a mechanism that can obtain the last partial password of the entire password only after the authentication by all other members is obtained, further improving the security in the system Can be made.

  Hereinafter, a password information update system according to an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a diagram showing an example of the overall configuration of a password information update system according to this embodiment. As shown in FIG. 1, the password information update system A according to the present embodiment includes a plurality of terminals 1-1, 1-2,... 1 -m (m is an integer of 2 or more) and a web server 2-2. 1 to n (n is an integer of 1 or more), a network 3 that connects them to each other, and a terminal that connects the terminals 1-1, 1-2,. And a management server 5 to be managed.

  In the system configuration shown in FIG. 1, the user of each terminal 1 can access the web server 2, enter a password, perform authentication processing, and then perform operations related to actual work. Become. The management server 5 is a server of an administrator who manages each terminal. When there is a person who is no longer a regular user, the management server 5 performs a password update process related to this.

  The password information update system according to the first embodiment of the present invention will be specifically described below with reference to the drawings. Reference is also made to FIG. 1 as appropriate.

  FIG. 2A is a system configuration showing in more detail the configuration of the processing unit among each terminal 1, web server 2, and management server 5 in the password information update system according to the present embodiment shown in FIG. FIG. FIG. 2B is a diagram exemplarily showing a relationship between the user and the group. FIG. 3A is a diagram showing a data configuration example of a password used in the password information update system according to the present embodiment. FIG. 3B will be described later in the second embodiment. FIG. 4 is a flowchart showing the flow of update processing in the password update system.

  As shown in FIG. 2A, the password information update system according to the present embodiment includes a random character string generation mechanism 31 that generates a random character string 11 and a random character string generation mechanism 31 shown in FIG. The generated password character string information 32, which is the character string 11 shown in FIG. 3A, is divided by a broken line, for example, and is indicated by the password portion information 34 for the administrator (for example, reference numeral 15 in FIG. 3A). Character string), user password partial information 34 (for example, a character string indicated by reference numeral 17 in FIG. 3), a character string dividing mechanism 33 that forms a file, a user password partial information 34, and, for example, 1 Alternatively, a plurality of password partial information files (for groups) 35-1 to 35-n (35) are registered, for example, the web server 36 and a group password described later. The authentication mechanism 40 to perform user authentication based on the distribution, and is configured to include a utilization system 41 be used under the updated password, the.

  As an example of the relationship between a group and an individual, for example, as shown in FIG. 2B, a user individual 17a in a company and a hierarchy such as a department, a department, a section, a staff (small group) to which the user belongs A typical group 15a is conceivable. Therefore, the administrator password area 15 shown in FIG. 3A is actually divided into areas corresponding to the group hierarchy.

  Processing in the above system will be described with reference to FIG. First, when the process is started in step S1, it is determined in step S2 whether or not it is a password update time. If it is not time to update the password, wait until it is time to update. When it is time to update the password, in step S3, the random character string generation mechanism 31 generates random character string information 32 randomly arranged so that it cannot be inferred as password information used in the user authentication process. . Using this random character string information 32 as the updated password, the password in the password update target system is updated.

  In step S4, the character string dividing mechanism 33 divides the generated random character string information 32 into a password part information (for user) part 34 and a password part information (for group) part 35 to create a file. The password portion information (for group) portion 35 is further divided for a plurality of groups if there are a plurality of groups to which the user belongs. The divided password portion information 34 and 35 are filed and registered in the Web server 36 (L2: Step S5), and the password portion information in the Web server 36 is sent to the user and the manager of the group to which the user belongs. The registration URL information is notified by e-mail (L1: Step S6).

  Here, the following explanation will be given on the assumption that the user belongs to a group (for example, department and section) consisting of two layers. By connecting to the notified URL (L3-1, L3-2), managers (for example, general managers and section managers) 38, 39 of each group to which the user belongs are used, and password partial information 35a-1, 35-n. Can be obtained respectively (L3-1, L3-2: Step S7). However, the entire password information (see FIG. 3) remains unknown. Here, when the user 37 makes an inquiry about the password partial information to the department manager 38 and the section manager 39 who are managers of the group to which the user belongs (L3: step S8), the department manager 38 and the section manager 39 are obtained. It is determined whether or not the partial information 35a-1 and 35-n of the password is still a regular user (step S9). If the partial information is not a regular user, the partial password is not notified (step S10). A notification is sent to a legitimate person (L3-3, L4-3; Step S11). At this time, the password partial information 34a is not notified to those who are past users but are not current users. As a result, a user who is a past user but is not a current user is excluded from the subject of the automatically updated password.

  The user 37 acquires a plurality of password partial information (for group) 35a ′ obtained from each of the group managers (department 38 / section 39) to which the user belongs, and obtains password partial information (for user) on the Web server 36. The user authentication can be obtained by inputting to the authentication mechanism 40 (L5: Step S12). The password partial information (for user) acquisition authentication mechanism 40 compares the input information 35a ′ from the user 37 with the partial information 35 on the Web server 36 (in the case of a plurality of characters, a character string connecting a plurality) ( In step S13), the password partial information (for user) 34a can be obtained for the first time when it is determined that the same information is input (L6: step S15). If the authentication cannot be obtained, the password part information for the user is not notified (step S14). As a result, the updated password is input to the usage system 41 (L7), and only the authorized user 37 can use the usage system 41.

  As described above, by combining with a plurality of pieces of password partial information (for group) 5 obtained in advance, it is determined by at least one administrator of the group to which the user belongs to that it is still valid, and It is devised so that only users who pass the authentication process of the authentication mechanism can obtain correct password information. If there are multiple group managers, the user must enter his / her partial password unless approval is obtained from all managers and the respective partial password information is entered, that is, unless the user passes this authentication process. It cannot be obtained. Therefore, security in the system to be used is strengthened. Further, a certain time limit may be set as a time limit from when the group administrator acquires the password partial information (for group) 35a ′ until the user 37 acquires the password partial information (for user) 34a. . In this case, if the user 37 does not acquire the password partial information (for user) 34a within the time limit, all the password partial information (for group) acquired so far becomes invalid, and group management is performed. The person must obtain the updated password again. Accordingly, by leaving the password part information for a long time, the risk that the password part information is leaked to an unauthorized user and the entire password is acquired is reduced.

  In the password information update system shown in FIG. 2, the authentication mechanism provided in the Web server 36 may be independent from the Web server. In addition, the password update process may be performed periodically or as needed.

  Next, a password information update system according to a second embodiment of the present invention will be described with reference to the drawings. FIG. 5 is a diagram showing a configuration example of the password information update system according to the present embodiment. Unlike the password information update system according to the first embodiment, the password information update system according to the present embodiment is not based on the relationship between the user and the manager of the group, for example, the concept of a common password that is commonly used in the group It is a system including

  FIG. 3B is a diagram showing a configuration example of the entire password used in the password information update system according to the present embodiment. As shown in FIG. 3B, the entire password 21 according to the present embodiment is divided into areas for the number of members of a certain group, for example. In the figure, the area is divided into three areas 23, 25, and 27 for three persons, but the number of persons is not limited here. In FIG. 5, the difference from the password information update system shown in FIG. 2 other than the reference sign is that there are users 2 to n (n is an integer of 2 or more) in addition to user (1) 57, and these persons However, it is the point which performs the authentication regarding utilization of the utilization system 61 using a common password. That is, the random character string generation mechanism 51 generates password character string information 21 as shown in FIG. 3B (52), and divides this into character strings of the number divided by the number of users n (53). ), A character string from 1 to n obtained by dividing the password portion information 54 for the user 1, the password portion information 54-1 for the user 2, and the password portion information 54-n for the user n into n parts. Are registered in the Web server 56 (password partial information 54a, 54a-1, 54a-n).

  For example, when the user 1 requests other users 2 to n for password partial information of other users, the other users are still regular users who belong to the group regarding the user 1. After confirming whether or not it is a legitimate user, the password partial information is notified from each in response to a request. Only the last password part information cannot be requested from other users, and it is necessary to obtain the password part information registered in the Web server by yourself. In this case, it is necessary to receive authentication by an authentication mechanism, and in order to receive authentication, it is necessary to acquire and present all other password partial information. For example, in FIG. 6, the user (1) 57 is mainly described. The user (1) 57 gives password partial information 54a-1 and 54a-n to the other users (2) 58 and (3) 59. When requested, since the other requested users (2) 58 and (3) 59 are not the last acquisition requesters regarding the password partial information, the password partial information 54a-1 registered in the Web server 56, 54a-n can be obtained.

  If the acquired password partial information 54a-1, 54a-n is qualified after it is checked whether there is a current usage qualification regarding the user (1) 57 of another user (2) 58 / (3) 59 If judged, it is provided to the user (1) 57 who is the requester. When the user (1) 57 acquires the last piece of password part information registered in the Web server 56, the user (1) 57 sends the acquired password part information 54a-1 and 54a-n to the authentication mechanism 60. By presenting, it is possible to obtain the last password partial information 54a from the Web server 56 for the first time, and to know the entire password. Similarly, when the main user is another user, it is necessary to obtain authentication by obtaining other password part information in advance when the last password is obtained.

  By constructing such a mechanism, when each user obtains a common overall password within a certain group, confirmation by other users is required when obtaining partial password information other than the last partial password information. In addition, since the last partial password needs to be authenticated by the Web server by entering the partial password obtained from another user, security for obtaining the entire password can be secured and unauthorized users can be eliminated. Also, a certain time limit may be provided as a time limit from when any of the users 2 to n acquires the password partial information until the user 1 finally acquires the password partial information. In this way, if the user 1 does not acquire the password partial information (for user 1) within the time limit, the password partial information (for users 1 to n) acquired so far is invalidated. Therefore, the other users 2 to n must obtain the updated password again. Accordingly, by leaving the password part information for a long time, the risk that the password part information is leaked to an unauthorized user and the entire password is acquired is reduced.

  The password character string described in the present embodiment is a broad concept including, for example, pictograms that can be input by operation in addition to general characters.

  The present invention is useful for improving security in a system that requires password authentication. Further, the present invention includes a method used in the password information update system in the above system and a program for causing a computer to execute the process.

It is a figure which shows the structural example of the password information update system by embodiment of this invention. It is a figure which shows the structure of each process part in the password information update system by the 1st Embodiment of this invention. FIG. 3A is a diagram illustrating a configuration example of a password string according to the first embodiment of the present invention, and FIG. 3B is a diagram illustrating a configuration example of a password string according to the second embodiment. . It is a flowchart figure which shows the flow of a process in the password information update system by the 1st Embodiment of this invention. It is a figure which shows the structure of each process part in the password information update system by the 2nd Embodiment of this invention.

Explanation of symbols

A ... password information update system, 1 ... terminal, 2 ... web server, 3 ... network, 4 ... LAN, 5 ... management server, 11 ... password, 15, 17 ... partial password, 31 ... random character string generation mechanism, 32 ... Password character string information, 33 ... Character string dividing mechanism, 34 ... Password partial information file (for user), 35 ... Password partial information file (for group), 36 ... Web server, 37 ... User, 38 ... User's Group 1, 39 belonging to group n, 40a belonging to user, authentication mechanism.

Claims (4)

A password character string generating means for generating a password character string;
A character string dividing means for dividing the generated password character string into a plurality of partial password character string information;
Registration means for registering each of the divided partial password character string information at different addresses of a web server;
Notifying means for individually notifying address information for referring to each of the divided partial password character string information on the web server;
One of the divided partial password character string information includes an authentication mechanism that permits a reference on the web server on condition that other partial password character string information is input. Password information notification system. A string generation means for creating a password string;
A character string dividing means for dividing the created password character string into partial password character string information for each of a user and an administrator;
Registration means for registering each of the divided partial password character string information at different addresses on a web server;
Notification means for notifying the user and the administrator of address information for referring to each of the divided partial password character string information on the web server;
Other than the partial password character string information of the divided partial password character string information, the administrator is notified and refers to the remaining partial password character string information on the web server. In such a case, the password information notification system includes an authentication mechanism that is conditional on input of partial password character string information acquired from the administrator. A character string generating means for creating a password character string used for a password used by a plurality of users;
A character string dividing means for dividing the created password character string into partial password character string information;
Registration means for registering each of the divided partial password character string information at different addresses on a web server;
Notification means for notifying each of the users of address information for referring to each of the divided partial password character string information on the web server;
When referring to at least the last one of the divided partial password character string information on the web server, the partial password character string information acquired from another user is used as a condition. A password information notification system comprising an authentication mechanism. The password information notification system according to any one of claims 1 to 3, further comprising a password update processing unit that executes the password notification periodically or at an arbitrary time.

Images