JP2016151942A - Authentication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an automatic creation password and automatic authentication system that can log into a slave system not via a master system.SOLUTION: An authentication system comprises: a password conversion definition information file 14 in which the minimum number of characters of a password having a rule of the password to be applied to each slave system preliminarily defined, the maximum number of characters thereof, allowable character category thereof and essential character category thereof are preliminarily described; a password conversion system 10 that converts a password input to a master system when users firstly access the slave system via the master system into a password to be allowed by a system at a transition destination on the basis of information on the password conversion definition information file 14, and outputs the password after converted into a client PC11 and the system at the transition destination; and a slave log-in authentication processing unit 19 that registers the converted password input in a slave system use database 21 when the first access is implemented via the master system.SELECTED DRAWING: Figure 2

Description

  The present invention relates to an authentication system including an automatic password conversion system at the time of single sign-on in a Web system.

  With the development and popularization of the Internet, computer security has become a very important issue. Internet communication is not encrypted, and a malicious person intentionally destroys the computer, alters the data, sends a large amount of junk mail, or fictional fraud mail because the computer is connected to the outside It has become possible to deceive money.

  Generally, security and convenience are contradictory properties. Current computers mainly authenticate users with user IDs and passwords, but the system becomes difficult to use if users frequently enter passwords to ensure security. But if you don't require a password, your information could be misused by others. There is a need to develop technologies that increase security without reducing convenience.

  As background art of this technical field, there is JP-A-2004-78539 (Patent Document 1). In this publication, “in a privacy protection system for a hard disk that locks the hard disk by setting a password input by a user by a system BIOS on a hard disk such as a PC having a password setting function in conformity with the ATA standard”. , A password automatic generation module that automatically generates a password to be set in the hard disk by the system BIOS, a password setting module that sets the automatically generated password in the hard disk, registers it in the nonvolatile RAM, and automatically locks the hard disk, and the hard disk And an unlocking module that automatically unlocks the password by setting a password set in the hard disk. "

JP 2004-78539 A

  In the password generation and authentication system disclosed in Patent Document 1, since the password of the HDD being used does not appear outside, the security is improved so that no one (regular user) can know, but the higher system No assumption is made when accessing a lower system (hereinafter referred to as a child system) from a device other than (hereinafter referred to as the parent system). Therefore, means for acquiring the automatically generated password and direct authentication to the child system are impossible.

  Therefore, in the present invention, it is possible to output the automatically generated password to the user's PC and the child system use database, and to log in to the child system without going through the parent system using the password automatically generated by the user. An object is to provide an automatically generated password and an automatic authentication system.

  In order to solve the above problems, in the present invention, an authentication system that simplifies login to a web application system comprising an arbitrary parent system and one or more child systems mounted on a web server connected to a network, Password conversion definition information file in which the minimum number of passwords, maximum number of characters, allowable character types, and required character types are defined in advance, and the user defines the password rules to be applied to the child system. When the system is accessed for the first time, the password input to the parent system is converted into a password allowed by the transition destination system based on the information in the password conversion definition information file, and is transferred to the client PC and the transition destination system. Password conversion system that outputs password after conversion and parent system In the case of the first access to, and configured to include a registration child system login authentication processing unit the converted password entered into the database.

  In order to solve the above problem, in the present invention, in the authentication system, the password conversion system is configured such that when the number of characters of the input password is smaller than the minimum password number of characters described in the password conversion definition information file, The character “1” is added until the minimum number of characters is reached.

  In order to solve the above problem, in the present invention, in the authentication system, the password conversion system includes the password conversion in the characters of the password that is input or partially converted and stored in the memory. If there is a character with a character type (not allowed) whose password allowed character type flag described in the definition information file is “0”, the password with the allowed character type stored in memory as a conversion candidate It was configured to replace the corresponding characters.

  Further, in order to solve the above-mentioned problem, in the present invention, in the authentication system, the password conversion system is configured to input all characters of a password that is input or partially converted and stored in a memory. If the password required character type flag described in the password conversion definition information file counts the number of characters with a character type of 1, and there is a required character type that does not exist, there must be multiple characters. Any character of the character type is replaced with a character of the required character type that does not exist at all.

According to the present invention, it is possible to access a device subject to automatic password conversion without going through a device that originally inputs a password.
Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments.

FIG. 2 is an example of a hardware configuration diagram when the present invention is applied to a plurality of Web application systems. It is a schematic diagram showing a flow of processing of login from a parent system to a child system when the present invention is applied to a plurality of Web application systems. It is a flowchart which shows the whole process of a password conversion system. It is a flowchart of the initial setting process of a password conversion system initial setting part. It is a flowchart of the minimum character number conversion process of a password conversion system password conversion process part. It is a flowchart of the maximum character number conversion process of a password conversion system password conversion process part. It is a flowchart of the allowable character classification conversion process of a password conversion system password conversion process part. It is a flowchart (the first half) of the essential character classification conversion process of a password conversion system password conversion process part. It is a flowchart (second half) of the essential character classification conversion process of a password conversion system password conversion process part. It is a flowchart of the password output process after conversion of a password conversion system password output process part. 6 is a flowchart of logging in to a child system without going through the parent system after logging in to the child system once through the parent system according to the present invention. It is a figure which shows the format of a password conversion definition information file, and the example of data stored.

  Hereinafter, embodiments will be described with reference to the drawings.

  FIG. 1 is a hardware configuration diagram when the present invention is applied to a plurality of Web application systems. A web server 12, a database server 13, and a plurality of client PCs 11 are connected via a network 25. It is assumed that a plurality of web application systems are activated on the web server 12.

FIG. 2 is a schematic diagram showing a flow of processing of login from the parent system to the child system when the present invention is applied to a plurality of Web application systems.
In step S 001, the user inputs a login ID and password on the login screen 31 of the client PC 11 and transmits them to the login authentication processing unit 15 of the parent system on the Web server 12.
In step S002, the login authentication processing unit 15 of the parent system accesses the database 20 owned by itself, confirms whether the login ID and the password match, and returns success or failure. The databases 20 and 21 may exist on either the Web server 12 or the database server 13.

In step S003, when the login is successful, the top screen 32 of the parent system is displayed on the client PC 11.
In step S 004, the user selects and inputs the “system name” of the child system to be used on the parent system top screen 32 on the client PC 11, and transmits it to the password conversion system initial setting unit 16 on the Web server 12. .

In step S005, the password conversion system password conversion processing unit 17 stores a password conversion definition information file 14 (detailed example will be described later) in which password rules allowed for each registered system are described in advance, for example, the Web server 12 Get password from above database and convert password. (Detailed logic is described in steps S101 to S704)
In step S006, the password conversion system password output processing unit 18 displays the converted password on the converted password display screen 33 on the client PC 11.

In step S007, the password conversion system password output processing unit 18 transmits the login ID and the converted password to the login authentication processing unit 19 of the child system.
In step S008, the login authentication processing unit 19 of the child system accesses the database 21 owned by itself to check whether the login ID and the converted password match. If the user logs in to the child system for the first time via the parent system, there is no login ID and converted password that match the database 21, so the child system login authentication processing unit 19 enters the database 21. Register login ID and password after conversion.
In step S 009, after registration for the first login, if the login is successful for other logins, the child system 19 displays the top screen 34 of the child system on the client PC 11.

  FIG. 12 shows a format and description example of the password conversion definition information file 14 that is referred to when the password conversion system 10 converts a password. The file is in CSV file format. The password conversion definition information file 14 describes password rules that are allowed or restricted by each system regarding the description of the password used for each system to be logged in. By writing password rules in a file registered in the database without writing them inside the program, it is possible to respond to changes to system password rules and additions and deletions of systems without changing the program. it can.

The “system name” column 801 describes a unique name that can distinguish the system name to be logged in.
The “login authentication processing unit URL” column 802 describes a URL to which a login ID and a password are transmitted when the system login button is pressed.
The “minimum number of characters” column 803 describes the minimum number of password characters allowed by the system.
The “maximum number of characters” column 804 describes the maximum number of password characters allowed by the system.
In the “allowable character type” column 805, the passwords of each system are allowed for each of the five character types (full-width characters, half-width large alphabets, half-width small alphabets, half-width symbols, numbers) shown on the right. Describe a 5-digit character string in which a flag of 0 is placed on an unacceptable object.
In the “required character type” field 806, the password characters of each system are required for each of the five character types (full-width characters, half-width upper-case letters, half-width lower-case letters, half-width symbols, numbers) shown on the right. Describe a 5-digit character string with a flag set to 1 and a non-essential set with a 0 flag.

FIG. 3 is a flowchart showing the entire processing of the password conversion system 10. As shown in FIG. 2, the password conversion system 10 includes a password conversion system initial setting unit 16, a password conversion system password conversion processing unit 17, and a password conversion system password output processing unit 18.
The process flow of the password conversion system 10 shown in FIG. 3 includes an initial setting process S100, a minimum character number conversion process S200, a maximum character number conversion process S300, an allowable character type conversion process S400, an essential character type conversion process S500, and a converted password output process S600. Consists of.

Next, the initial setting process S100 of the password conversion system initial setting unit 16 will be described with reference to the flowchart of FIG.
In step S101, the password conversion system initial setting unit 16 acquires “login ID”, “password”, and “system name” from the session of the Web server 12, and stores them in the memory.
In step S <b> 102, the password conversion system initial setting unit 16 acquires the password conversion definition information file 14 from the disk of the Web server 12.
In step S103, the data record of the corresponding row of the password conversion definition information file 14 in which the “system name” acquired from the session matches the “system name” of the password conversion definition information file 14 is stored in the memory.

Next, the minimum character number conversion process S200 of the password conversion system password conversion processing unit 17 will be described with reference to the flowchart of FIG.
In step S201, the number of characters of “password” acquired from the session is compared with the “minimum number of characters” of the password conversion definition information file 14 stored in the memory.
In step S202, if the number of characters of “password” is smaller than the minimum number of characters, “1” is added to the end of “password” and the converted “password” is stored in the memory. The maximum character number conversion process S300 of the password conversion system password conversion processing unit 17 will be described with reference to the flowchart.
In step S301, the number of characters “password” stored in the memory is compared with the maximum number of characters in the password conversion definition information file 14.
If the number of characters of “password” is larger than the maximum number of characters in the password conversion definition information file 14 in step S302, characters are deleted from the end of “password” so that the number of characters of the password fits in the maximum number of characters, and the converted “password” Is stored in the memory.

Next, the allowable character type conversion processing S400 of the password conversion system password conversion processing unit 17 will be described with reference to the flowchart of FIG.
In step S401, the processing up to step S408 is repeated for each character from the first character of all the characters of “password”.
In step S402, the processing up to step S407 is repeated for each of the five character types (full-width characters, half-width English letters, half-width chapter letters, half-width symbols, numbers) described on the right.

In step S403, it is confirmed whether the flag of the corresponding character type described in the “allowable character type” column 805 of the password definition file 14 corresponding to the character type to be checked selected in S402 is “1”.
If the allowable character type flag is “1” in step S404, the character of the corresponding character type (a predetermined character is prepared) is stored in the memory as a conversion candidate.
In step S405, it is confirmed using a regular expression whether the character to be checked is a character of the character type to be checked.
In step S406, if the character to be checked is the character type to be checked, the conversion candidate character stored in the memory in S404 is replaced with the character to be checked for “password”. (However, only the first time is replaced with a numerical value)
Next, the essential character type conversion processing S500 of the password conversion system password conversion processing unit 17 will be described with reference to the flowcharts of FIGS.
In step S501, it is checked whether each flag of the required character type described in the “essential character type” column 806 of the password conversion definition information file 14 is “0”. If YES, the required character type conversion process S500 is terminated.
In step S502, the processing up to step S510 is repeated for each of the five character types (full-width characters, half-width large alphabets, half-width small alphabets, half-width symbols, numbers) described on the right.

In step S503, it is confirmed whether the flag of the required character type described in the “essential character type” column 806 of the password definition file 14 corresponding to the character type to be checked selected in S502 is “1”.
In step S504, the processing up to step S509 is repeated for each character from the first character of all the characters of “password”.
In step S505, it is confirmed using a regular expression whether the character of the “password” to be checked is a character of the required character type to be checked.

In step S506, if the check target character is the check target character type, the required flag of the check target character type is incremented by one in the character type array variable held in the memory.
In step S507, it is checked whether the required flag for the character type to be checked in the character type array variable held in the memory is 2 or more.
In step S508, if the required flag for the check target character type is 2 or more, the position of the check target character is recorded in the convertible list.

Following the flowchart of FIG. 8, description will be made with reference to the flowchart of FIG.
In step S511, the processing up to step S516 is repeated for each of the five character types (full-width character, half-width large alphabet, half-width small alphabet, half-width symbol, number) described on the right.
In step S512, it is confirmed whether the flag of the required character type described in the “required character type” field 806 of the password conversion definition information file 14 corresponding to the character type to be checked selected in S511 is “1”. .

In step S513, whether or not the “required flag” of the check target character type recorded in the character type array variable stored in the memory is “0” (in the character of “password”, the check target character type is required Confirm that there is no character of the character type.
In step S514, the character position of the convertible “password” is extracted from the convertible list stored in the memory in step S508, and the character at that position is prepared as a character of the check target character type prepared in advance. replace.
In step S515, the character position data used to replace the “password” character in S514 is deleted from the convertible list.

Next, the post-conversion password output processing S600 of the password conversion system password output processing unit 18 will be described with reference to the flowchart of FIG.
In step S601, the converted password is displayed on the converted password display screen 33 of the client PC 11.
In step S602, “login ID” and “post-conversion password” are transmitted to the login authentication processing unit URL of the child system described in the password conversion definition information file 14 to execute login processing.

The login authentication processing unit 19 of the child system accesses the database 21 owned by itself and checks whether the login ID and the converted password match. If the user logs in to the child system for the first time via the parent system, there is no login ID and converted password that match the database 21, so the child system login authentication processing unit 19 enters the database 21. Register login ID and password after conversion.
Thereafter, the login authentication processing unit 19 of the child system displays the child system top screen 34 on the client PC 11.

  In the process of the password conversion system 10 from step S201 to step S516, only the “password” character that is not permitted in the child system is replaced with the permitted character, and the originally permitted character is not converted. As a result, the converted “password” is not converted at all even if password conversion processing for the password rule of the child system is executed, and the child system alone can log in.

FIG. 11 is a flowchart for logging in to the child system without going through the parent system after logging in to the child system once through the parent system. As a precondition, it is necessary to execute login from the parent system to the child system shown in FIG. 2 once and obtain a password after conversion.
In step S <b> 701, “login ID” and “post-conversion password” are input from the client PC on the login screen 35 of the child system, and the login information is transmitted to the password conversion system 10.

In step S <b> 702, the password conversion system initial setting unit 16 acquires the password conversion definition information of the child system from the password conversion definition information file 14.
In step S703, the password conversion system password conversion processing unit 17 shown in the flowcharts of FIGS. 5 to 9 is executed. (In actuality, the “converted password” entered is based on the child system password definition, so the password is never changed.)
In step S <b> 704, the password conversion system password output processing unit 18 displays the converted password on the converted password display screen 33 of the client PC 11.

In step S705, the converted password input with the login ID is transmitted to the login authentication processing unit 19 of the child system.
In step S706, the login authentication processing unit 19 of the child system accesses the database 21 owned by itself, confirms whether the login ID and the password match, and returns success or failure.
In step S707, if the login is successful, the top screen 34 of the child system is displayed on the client PC 11.

  In addition, this invention is not limited to an above-described Example, Various modifications are included. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. It is also possible to add the configuration of another embodiment to the configuration of one embodiment. Further, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment. Each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. Each of the above-described configurations, functions, and the like may be realized by software by interpreting and executing a program that realizes each function by the processor. Information such as programs, tables, and files for realizing each function can be stored in a recording device such as a memory, a hard disk, or an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

10 Password conversion system 11 Client PC
12 Web Server 13 Database Server 14 Password Conversion Definition Information File 15 Parent System Login Authentication Processing Unit 16 Password Conversion System Initial Setting Unit 17 Password Conversion System Password Conversion Processing Unit 18 Password Conversion System Password Output Processing Unit 19 Child System Login Authentication Processing Part 20 Parent system login authentication database 21 Child system login authentication database 25 Network 31 Parent system login screen 32 on client PC Parent system top screen 33 Conversion password display screen 34 Child system top screen 35 Child system top screen 35 Login screen 801 “System name” field 802 “Login authentication processing unit URL” field 803 “Minimum number of characters” field 804 “Maximum number of characters” field 805 “Allowable character type” field 806 “Required character type” field 806

Claims (6)

An authentication system that simplifies login to a web application system consisting of an arbitrary parent system and one or more child systems implemented on a web server connected to a network,
A password conversion definition information file in which the minimum number of passwords, the maximum number of characters, the allowed character types, and the required character types are defined in advance, and the password rules to be applied to each child system;
When the user first accesses the child system via the parent system, the password input to the parent system is converted into a password allowed by the transition destination system based on the information in the password conversion definition information file. A password conversion system that outputs the converted password to the client PC and the destination system;
An authentication system comprising: a child system login authentication processing unit for registering an input converted password in a database in the case of first access through a parent system.   When the number of characters of the input password is smaller than the minimum password number described in the password conversion definition information file, the password conversion system adds a character “1” until the minimum number of characters is reached at the end of the password. The authentication system according to claim 1.   When the number of characters of the password that has been input or partially converted and stored in the memory is greater than the maximum number of characters of the password described in the password conversion definition information file, the password conversion system determines the number of characters from the end of the password. The authentication system according to claim 1, wherein characters are deleted until the maximum number of characters is reached.   In the password conversion system, the password allowable character type flag described in the password conversion definition information file is “0” in the password characters that are input or partially converted and stored in the memory. 2. The authentication system according to claim 1, wherein when a character of a character type (not permitted) exists, the corresponding character of the password is replaced with a character of the permitted character type held in the memory as a conversion candidate. .   In the password conversion system, the flag of the password required character type described in the password conversion definition information file is 1 for all characters of the password that is input or partially converted and stored in the memory. If there is a required character type that does not exist even if there is a required character type that counts the number of characters of a certain character type, any one of the required character types that have multiple characters will be The authentication system according to claim 1, wherein the authentication system is replaced with a character.   The password conversion system displays the password that has been converted on the client PC, and sends the login ID and the converted password to the login authentication processing unit of the transition destination child system to automatically authenticate the password. The authentication system according to claim 5.

Images