JP2016146068A - Information processing system and information processing method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an information processing system capable of reducing a possibility of leakage of authentication information to the outside by reducing such an opportunity that authentication information like passwords is transmitted on the network.SOLUTION: In an information processing system 100 which includes a screen generation part 110 generating screen information in accordance with a prescribed transition rule and a storage part 120 storing an input value input to the input column on an input screen, the screen generation part 110 displays the specific input column of the input screen as the already-input column in response to a screen transition request to the input screen, and generates a response screen corresponding to the input screen not including the input value of the specific input column.SELECTED DRAWING: Figure 4

Description

  The present invention relates to a security technique in an information processing system.

  In recent years, there has been an increasing need to ensure the safety of information exchanged over a network. For this reason, access-restricted websites that can be accessed only by authenticated users are widely used. In order to access such a website, the user is typically required to enter a registered user ID and password.

  For example, in a website for corporate users, a user (department manager, administrator, etc.) who has authority to access the website in the corporation can also access other websites (subordinates, staff, etc.). , You may set up accounts for other users on the website. Specifically, an authorized user enters his / her user ID and password to access a website, and then opens a registration screen for registering another user's account.

  For example, as shown in FIG. 1, the registration screen requests input of each item of “user ID”, “login password”, “registrant name”, and “registration mail address” of the user who wants to register. It may be. As shown in FIG. 1A, an authorized user inputs “user001”, “yamada”, “Taro Yamada”, and “yamama@xyz.com” to input each of these items. It is assumed that the “input complete” button is pressed. At this time, characters and symbols entered in the “login password” are typically displayed as “●●●●●●” so as not to be looked into by others.

  When the “Send” button is pressed, the input data is transmitted to the server of the site operator via the network, and the server receiving the input data returns a confirmation screen as shown in FIG. 1B to the user. It is assumed that the authorized user who confirmed the confirmation screen noticed that “registered mail address” was erroneously input “yamama@xyz.com” and pressed the “correct” button.

  When the “modify” button is pressed, the server transmits a modification screen as shown in FIG. 1C to the user. In this correction screen, the “user ID” and the “login password” are set in the web page in a state in which previously input data has been input in order to reduce the input burden on the user. At this time, the “login password” is hidden from the user, but “yamada” that has been previously input is normally embedded in the web page.

JP-A-9-265443

  By repeating such input and correction, the “user ID” and the “login password” are exchanged over and over the network, which is not desirable from the viewpoint of security.

  In view of the above-described problems, an object of the present invention is to provide an information processing system capable of reducing the chance that authentication information such as a password is transmitted on a network and reducing the possibility of authentication information leaking to the outside. Is to provide.

  In order to solve the above-described problem, an aspect of the present invention provides information including a screen generation unit that generates screen information according to a predetermined transition rule, and a storage unit that stores an input value input in an input field on the input screen. In the processing system, in response to a screen transition request to the input screen, the screen generation unit displays a specific input field of the input screen as input and displays an input value of the specific input field. The present invention relates to an information processing system that generates a response screen corresponding to the input screen not included.

  Another aspect of the present invention is an information processing method executed by an information processing system, storing an input value input in an input field on an input screen, and receiving a screen transition request to the input screen In response to the screen transition request, a specific input field of the input screen is displayed as input, and a response screen corresponding to the input screen not including the input value of the specific input field is generated And a step comprising:

  According to the present invention, it is possible to reduce the chance that authentication information such as a password is transmitted on the network, and to reduce the possibility that the authentication information is leaked to the outside.

FIG. 1 is a screen transition diagram showing a processing sequence for registering authentication information according to the prior art. FIG. 2 is a schematic diagram showing a client / server system according to an embodiment of the present invention. FIG. 3 is a block diagram showing a hardware configuration of the information processing system according to the embodiment of the present invention. FIG. 4 is a block diagram showing a functional configuration of the information processing system according to the embodiment of the present invention. FIG. 5 is a screen transition diagram showing a processing sequence for registering authentication information according to an embodiment of the present invention. FIG. 6 is a screen transition diagram showing a processing sequence for registering authentication information according to another embodiment of the present invention. FIG. 7 is a sequence diagram showing authentication information registration processing according to an embodiment of the present invention.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  In an embodiment described later, an information processing system that provides access-restricted information is disclosed. In summary, in order to reduce the chance that authentication information such as a password is exchanged via the network, a confirmation screen for confirming the input content in the client device is generated without including the entered authentication information, and the client Send to device. Accordingly, it is possible to reduce the possibility that the authentication information is leaked to the outside by minimizing the chance that the authentication information is transmitted to the network.

  First, a client / server system according to an embodiment of the present invention will be described with reference to FIG. FIG. 2 is a schematic diagram showing a client / server system according to an embodiment of the present invention.

  As illustrated in FIG. 2, the client / server system 10 includes an information processing system 100, a client device 200, and a network 300. In the client / server system 10, a processing request from the client apparatus 200 is transmitted to the information processing system 100 via the network 300, and the information processing system 100 that has received the processing request executes the requested processing, and the processing result is It is returned to the client device 200 via the network 300.

  The information processing system 100 functions as a server device in the client / server system 10, processes a processing request received from the client device 200, and returns a processing result to the client device 200. The information processing system 100 provides an access-restricted service. Typically, a user is required to input authentication information such as a user ID and a password before using the service.

  The information processing system 100 may have a hardware configuration as shown in FIG. 3, for example. That is, the information processing system 100 includes a drive device 101, an auxiliary storage device 102, a memory device 103, a CPU (Central Processing Unit) 104, an interface device 105, and a communication device 106 that are interconnected via a bus B.

  Various computer programs including various functions and processes to be described later in the information processing system 100 may be provided by a recording medium 107 such as a CD-ROM (Compact Disk-Read Only Memory). When the recording medium 107 storing the program is set in the drive device 101, the program is installed from the recording medium 107 to the auxiliary storage device 102 via the drive device 101. However, it is not always necessary to install the program using the recording medium 107, and the program may be downloaded from any external device via the network 300 or the like. The auxiliary storage device 102 stores the installed program and also stores necessary files and data.

  The memory device 103 reads the program and data from the auxiliary storage device 102 and stores them when there is an instruction to start the program. The CPU 104 executes various functions and processes of the information processing system 100 as described later according to various data such as programs stored in the memory device 103 and parameters necessary for executing the programs. The interface device 105 is used as a communication interface for connecting to the network 300 or an external device. The communication device 106 executes various communication processes for communicating with an external device such as the client device 200 or another server.

  However, the information processing system 100 is not limited to the hardware configuration described above, and may be realized by any suitable information processing system, for example.

  As illustrated, the client device 200 is any information processing device capable of communicating with the information processing system 100 via the network 300, such as a personal computer (PC), a mobile phone, a smartphone, or a tablet. In response to an input operation from the user, the client device 200 transmits a processing request corresponding to the operation to the information processing system 100 and receives a processing result by the information processing system 100.

  The network 300 includes a wired network such as the Internet and / or a wireless network such as a mobile phone network, a wireless LAN, and WiFi (registered trademark).

  Next, the configuration of an information processing system according to an embodiment of the present invention will be described with reference to FIG. FIG. 4 is a block diagram showing a functional configuration of the information processing system according to the embodiment of the present invention.

  As illustrated in FIG. 4, the information processing system 100 includes a screen generation unit 110 and a storage unit 120.

  The screen generation unit 110 generates screen information according to a predetermined transition rule. Specifically, when the information processing system 100 provides an access-restricted service, the screen generation unit 110 first generates a login screen that requests the user to input a user ID and a password, and transmits the login screen to the client device 200. . When the input login screen is received from the client device 200, the screen generation unit 110 compares the registered user ID and password of the user stored in the storage unit 120, and if they match, a menu of services that can be used. Returns the screen. On the other hand, if they do not match, the screen generator 110 resends the login screen to the client device 200.

  The storage unit 120 stores the input value input in the input field on the input screen. Specifically, the storage unit 120 stores the user ID and password input in the user ID input field and password input field on the input screen.

  Hereinafter, the information processing system 100 according to the present invention will be described with reference to an embodiment related to a registration process for a logged-in user to register another user in the information processing system 100.

  With reference to FIG. 5, the registration process by the information processing system 100 according to an embodiment will be described.

  When the logged-in user requests the information processing system 100 to perform a registration process for newly registering another user, the screen generation unit 110 specifies a session identifier for the registration process, and the user ID of the user to be registered, A registration screen requesting input of a login password and user information (registrant name, registration email address, etc.) is generated and transmitted to the client device 200. The screen generation unit 110 generates a registration screen as shown in FIG. 5A, for example, and displays input fields for “user ID”, “login password”, “registrant name”, and “registration email address”. The registered screen is transmitted to the client device 200. Here, a flag (flag = false) indicating that the password is not registered may be embedded in the registration screen information. The flag is used to indicate that the password is registered (true) or not registered (false). In the registration screen generated initially, the flag is set to “false”.

  When the registration screen is received, the client device 200 displays the received registration screen and requests to input each input field. Here, the logged-in user enters “user001”, “yamada”, “Yamada” in the input fields of “user ID”, “login password”, “registrant name”, and “registration mail address” of the user to be registered. Suppose that “Taro” and “yamama@xyz.com” are input. At this time, “yamada” input to “login password” is typically displayed with a symbol such as “●●●●●●” to prevent peeping by other users. Thereafter, the user presses the “Send” button.

  In response to pressing of the “Send” button, the client apparatus 200 transmits the input registration screen to the information processing system 100. When the input registration screen is received, the information processing system 100 stores each input value that has been input in association with the session identifier in the storage unit 120. After that, the screen generation unit 110 returns a confirmation screen as shown in FIG. 5B to the client device 200, and the “user ID”, “login password”, “registrant name” described in the confirmation screen, and The client apparatus 200 is notified that the “registered mail address” has been registered. In this embodiment, the screen generation unit 110 does not include the input “yamada” in the “login password” on the confirmation screen in order to prevent the “login password” from being stolen on the network. Is displayed. For example, a specific character or symbol such as dummy data may be set in the input field. Further, based on a flag (flag = true) indicating that the password embedded in the confirmation screen has already been registered, the input field of “login password” is input by the user as shown in FIG. Configured to be disabled.

  If there is no problem in the contents of the confirmation screen, the registration of the registration target user is completed. On the other hand, if there is an error in the confirmation screen, the user can correct the error by pressing the “correct” button. In this example, it is assumed that the user notices that the “registered mail address” to be entered as “yamada@xyz.com” is mistakenly typed as “yayama@xyz.com”, and presses the “correct” button. .

  In response to pressing of the “modify” button, the client device 200 changes the flag from “true” to “false”, and transmits a modification request including the session identifier to the information processing system 100.

  Upon receiving the modification request including “flag = false” and the session identifier, the information processing system 100 invalidates or discards the input value associated with the session identifier and stored in the storage unit 120, and “flag = false”. A registration screen as shown in FIG. 5C is transmitted to the client apparatus 200.

  Alternatively, in response to pressing of the “modify” button, the client apparatus 200 changes the flag from “true” to “false”, and transmits the modification request to the information processing system 100 without changing the flag to FIG. A registration screen for correction as shown in FIG. In this case, each input value and “flag = false” input on the corrected registration screen are transmitted to the information processing system 100 in association with the session identifier. The information processing system 100 rewrites the input value associated with the session identifier and stored in the storage unit 120 with the corrected input value received, and changes the flag to “true”.

  Note that the registration screen shown in FIG. 5C is an initial registration screen in which the input columns of “user ID”, “login password”, “registrant name”, and “registration mail address” are blank. However, the present invention is not limited to this. For example, similarly to the confirmation screen, a registration screen in which “user ID”, “login password”, “registrant name”, and “registration mail address” have already been input may be transmitted. Thus, the user only has to correct the input field that needs to be corrected.

  When the correction is completed and the “Send” button is pressed, the client apparatus 200 transmits the input registration screen to the information processing system 100. When the input registration screen is received, the information processing system 100 stores each input value that has been input in association with the session identifier in the storage unit 120. After that, the screen generation unit 110 returns a confirmation screen as shown in FIG. 5B to the client device 200, and the “user ID”, “login password”, “registrant name” described in the confirmation screen, and Notify that "Registered email address" has been registered. At this time, the screen generation unit 110 sets the input “login password” with dummy data, and embeds a flag (flag = true) indicating that the login password has been registered in the confirmation screen. Thereafter, the above-described processing is repeated until there are no correction items.

  Next, a registration process by the information processing system 100 according to another embodiment of the present invention will be described with reference to FIG. In the present embodiment, as shown in FIG. 6B, a correction request can be made for each input field. In the following, a case where the user corrects the password, that is, a case involving a flag change will be described. Since FIG. 6A is the same as FIG. 5A, description thereof is omitted.

  When the input registration screen as shown in FIG. 6A is received from the client device 200, the information processing system 100 stores each input value that has been input in association with the session identifier in the storage unit 120. After that, the screen generation unit 110 returns a confirmation screen as shown in FIG. 6B to the client device 200, and the “user ID”, “login password”, “registrant name” described in the confirmation screen, and Notify that "Registered email address" has been registered. In the confirmation screen shown in FIG. 6B, “user ID correction” and “password correction” for individually correcting “user ID”, “login password”, “registrant name”, and “registration mail address”. , “Registrant name correction” and “Registered mail address correction” buttons are set. At this time, in order to prevent the “login password” from being stolen on the network, the screen generation unit 110 does not include “yamada” input on the received registration screen in the “login password” on the confirmation screen. , It is displayed that the input field has been input. For example, a specific character or symbol such as dummy data may be set in the input field. Further, based on a flag (flag = true) indicating that the password embedded in the confirmation screen has already been registered, the input field of “login password” is input by the user as shown in FIG. Configured to be disabled.

  If there is no problem in the contents of the confirmation screen, the registration of the registration target user is completed. On the other hand, if there is an error in the confirmation screen, the user can correct the error by pressing the “correct” button. In this example, it is assumed that the user presses the “correct password” button to correct the login password.

  In response to pressing the “correct password” button, the client device 200 changes the flag from “true” to “false”, and transmits a correction request including the session identifier to the information processing system 100. When another correction button is pressed, the client device 200 transmits a correction request including the session identifier to the information processing system 100 without changing the flag.

  Upon receiving the modification request including “flag = false” and the session identifier, the information processing system 100 invalidates or discards the input value associated with the session identifier and stored in the storage unit 120, and “flag = false”. The registration screen including the session identifier and the input field of “login password” as shown in FIG. 6C is transmitted to the client apparatus 200. In the registration screen shown in FIG. 6C, the input fields of “user ID”, “registrant name”, and “registration mail address” are already entered. However, if the user wants to correct other input fields at the same time, the corresponding input field may be overwritten with the corrected contents.

  Alternatively, in response to pressing of the “correct password” button, the client device 200 changes the flag from “true” to “false”, and transmits a correction request to the information processing system 100 without changing the flag to FIG. A registration screen for correction as shown in FIG. In this case, each input value and “flag = false” input on the corrected registration screen are transmitted to the information processing system 100 in association with the session identifier. The information processing system 100 rewrites the input value associated with the session identifier and stored in the storage unit 120 with the corrected input value received, and changes the flag to “true”.

  When the correction is completed and the “Send” button is pressed, the client apparatus 200 transmits the input registration screen to the information processing system 100. When the input registration screen is received, the information processing system 100 stores each input value that has been input in association with the session identifier in the storage unit 120. Thereafter, the screen generation unit 120 similarly returns a confirmation screen as shown in FIG. 6B to the client device 200, and the “user ID”, “login password”, “registrant” described in the confirmation screen are returned. “Name” and “Registered mail address” are notified. At this time, the screen generation unit 110 sets the input “login password” with dummy data and embeds a flag (flag = true) indicating that the login password has been registered. Thereafter, the above-described processing is repeated until there are no correction items.

  Next, an authentication information registration process by the information processing system according to an embodiment of the present invention will be described with reference to FIG. FIG. 7 is a flowchart showing authentication information registration processing according to an embodiment of the present invention.

  In step S <b> 101, the client device 200 transmits a new user registration request for registering a new user to the information processing system 100.

  In step S102, the information processing system 100 assigns a session identifier to the requested user registration process, and inputs each of the "user ID", "login password", "registrant name", and "registration email address" fields. Is sent to the client apparatus 200. Here, a flag (flag = false) indicating that the login password is not registered may be embedded in the registration screen information. The flag is used to indicate that the login password is registered (true) or not registered (false). In the registration screen generated initially, the flag is set to “false”.

  In step S <b> 103, the client device 200 displays the received registration screen to the user and accepts input values input in the input fields of the registration screen. Note that the input value input in the “login password” may be displayed with another symbol such as “●” in order to prevent peeping by other users.

  In step S <b> 104, the client device 200 returns the input registration screen to the information processing system 100.

  In step S105, the information processing system 100 stores the input value received in association with the session identifier. When the login password is stored, the flag is changed to “true”.

  In step S <b> 106, the information processing system 100 transmits a confirmation screen that does not include a login password to the client device 200. For example, the information processing system 100 may transmit a confirmation screen in which dummy data is set in the login password to the client device 200. In the confirmation screen, “flag = true” is set.

  In step S107, the client device 200 displays the received confirmation screen to the user. In one embodiment, as shown in FIG. 5 (b), in the confirmation screen, a “correct” button may be set for the entire input field, and as shown in FIG. An individual “modify” button may be set for the input field. In addition, the “login password” input field may indicate only that it has been input, and may not be operated. When the user desires correction, the client device 200 transmits a correction request to the information processing system 100. If there is a possibility that the “login password” may be corrected, the client device 200 changes the flag to “false” and transmits a correction request to the information processing system 100 together with the session identifier.

  In step S <b> 108, the information processing system 100 transmits a correction screen to the client device 200. If the correction request flag received in step S107 is “true”, the information processing system 100 determines that correction of the “login password” is not requested, and retains the stored “login password”. On the other hand, when the flag is changed to “false”, the information processing system 100 may determine that the “login password” may be corrected, and invalidate or discard the stored “login password”.

  Although the information processing system 100 according to the present invention has been described using an embodiment in which a registered user newly registers another user, the present invention is not limited to this. For example, the present invention may be applied to a case where an unregistered user newly registers himself / herself in the information processing system 100. In addition, in order to newly register a user, four input items of “user ID”, “login password”, “registrant name”, and “registration email address” are required, but these are merely examples, Other input items may be required. For example, only two input items of “user ID” and “login password” may be used.

  As mentioned above, although the Example of this invention was explained in full detail, this invention is not limited to the specific embodiment mentioned above, In the range of the summary of this invention described in the claim, various deformation | transformation・ Change is possible.

DESCRIPTION OF SYMBOLS 10 Client server system 100 Information processing system 110 Screen generation part 120 Storage part 200 Client apparatus

Claims (7)

A screen generator that generates screen information in accordance with a predetermined transition rule;
A storage unit for storing the input value input in the input field on the input screen;
An information processing system having
In response to the screen transition request to the input screen, the screen generation unit displays the specific input field of the input screen as input completed, and displays the input screen that does not include the input value of the specific input field. An information processing system that generates a corresponding response screen.   The information processing system according to claim 1, wherein the screen generation unit generates the screen information by setting a flag indicating whether or not an input value of the specific input field is stored in the storage unit.   The information processing system according to claim 2, wherein the response screen is configured such that an input to the specific input field is not permitted based on the flag.   The information processing system according to claim 2, wherein the response screen is configured to display a specific character or symbol in the specific input field based on the flag.   The information processing system according to any one of claims 1 to 4, wherein the response screen is configured to include an operator for changing an input value of the specific input field.   The information processing system according to claim 1, wherein the storage unit stores an input value input in an input field on the input screen in association with a session identifier at the time of input. An information processing method executed by an information processing system,
Storing the input value input in the input field on the input screen;
Receiving a screen transition request to the input screen;
In response to the screen transition request, displaying a specific input field of the input screen as already input, and generating a response screen corresponding to the input screen not including the input value of the specific input field;
Having a method.

Images