JP2016152042A - Information processing device, and authentication processing method and program in the same - Google Patents

Abstract

PROBLEM TO BE SOLVED: To facilitate management while achieving the function of a signal signature.SOLUTION: In an information processing device 1, such as a portable terminal, a personal computer, or the like, a secure browser program is installed, success/failure authentication to a primary server 2p that is mainly used is managed according to the secure browser program. When the authentication is successful, an automatic log-in by auto-complete to another authentication web server is caused to be available, and if authentication of the primary server 2p fails the prescribed number of times, setting data for automatic log-in is initialized.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an information processing apparatus, an authentication processing method therefor, and a program.

  A system (single sign-on system) that performs authentication in a plurality of servers with one representative account and password is known. Specifically, in the case of a conventional single sign-on system compatible with a plurality of authenticated web servers (hereinafter referred to as “authenticated web servers”), the single sign-on management server holds a representative account and password and authenticates. Authentication information such as an account and password of an authentication Web server to be substituted is managed in association with this representative authentication information.

  For this reason, when a company or the like introduces a single sign-on system, account information of the single sign-on system itself is newly prepared and managed in addition to account information of a plurality of existing authentication Web servers.

  Japanese Patent Application Laid-Open No. 2004-133867 discloses a technique for managing a plurality of existing authentication Web server accounts and a main account of a single sign-on management server in a linked manner.

JP2013-250875A

  As described above, the conventional single sign-on system has to prepare and manage the accounts for the single sign-on system for all users. In addition, if the account data of the single sign-on system is leaked, the risk of hacking into the related existing authentication Web server increases, so that security management must be tightened and the management load increases. It was.

  The present invention has been made in view of the above circumstances, and provides an information processing apparatus capable of reducing the management load while realizing the same function as a conventional single sign-on system, and an authentication processing method and program therefor Is one of its purposes.

  The present invention for solving the problems of the above-described conventional example is an information processing apparatus, which accesses a primary server that is a predetermined authentication web server and determines the success or failure of authentication in the primary server; Means for managing the success or failure of authentication at the primary server, and changing the information transmission / reception mode with a web server that requires authentication based on the success or failure. .

  According to the present invention, the management load can be reduced while realizing a function equivalent to that of a conventional single sign-on system.

  It is a block diagram showing the example of a structure of the information processing apparatus which concerns on embodiment of this invention, and a connection example.   It is explanatory drawing showing the example of the setting data which the information processing apparatus which concerns on embodiment of this invention hold | maintains.   It is a functional block diagram showing the example of the information processing apparatus which concerns on embodiment of this invention.

  Embodiments of the present invention will be described with reference to the drawings. As illustrated in FIG. 1, the information processing apparatus 1 according to the embodiment of the present invention includes a control unit 11, a storage unit 12, an operation unit 13, a display unit 14, and a communication unit 15. Are connected to the web servers 2a, 2b,... Via a communication means such as a network. Furthermore, the information processing apparatus 1 according to an example of the present embodiment may be communicably connected to the activation management server 3 via a communication unit such as a network. The information processing apparatus 1 may be realized by a personal computer (PC) or a mobile terminal such as a smartphone or a tablet terminal.

  The control unit 11 is a program control device such as a CPU, and operates according to a program stored in the storage unit 12. If the information processing apparatus 1 is a PC, for example, the control unit 11 according to the present embodiment is an operating system stored in the storage unit 12 or a browser program (hereinafter referred to as a secure browser program) according to the embodiment of the present invention. The processing of various application programs including the above is executed. Moreover, the control part 11 of this Embodiment investigates the success or failure state of the authentication with the web server 2 (henceforth a primary server) which performs user authentication predetermined as an authentication process, and makes the said success or failure state Perform appropriate processing. Specific contents of the authentication process by the control unit 11 will be described in detail later.

  The storage unit 12 includes a storage device such as a hard disk drive or a flash memory. The storage unit 12 stores a program executed by the control unit 11. This program may be provided by being stored in a computer-readable non-transitory storage medium such as a DVD-ROM and installed in the storage unit 12. Further, this program may be provided via communication means such as a network and installed in the storage unit 12. Further, in the present embodiment, the storage unit 12 also operates as a work memory of the control unit 11 and stores authentication information. An example of this authentication information will also be described later.

  The operation unit 13 is a keyboard, a mouse, a keypad, a touch panel, or the like. The operation unit 13 receives a user operation and outputs information representing the content of the operation to the control unit 11. The display unit 14 is a liquid crystal display, for example, and displays information according to an instruction input from the control unit 11.

  The communication unit 15 is a wired or wireless network interface or the like, and transmits / receives information to / from an external communication destination according to an instruction input from the control unit 11. The communication unit 15 receives information output from the external communication destination and addressed to the information processing apparatus 1 to the control unit 11 and outputs the information to the control unit 11, and in accordance with an instruction input from the control unit 11. The instructed information is sent to the instructed destination via the network or the like.

  When the web server 2 receives a request for a web page and image information together with a URL (Uniform Resource Locator) designation from the information processing apparatus 1 or the like, the web server 2 executes a process of sending information such as the web page specified by the URL. Yes. Further, at least a part of the web server 2 operates as a web server requiring authentication (authentication web server), and authentication information such as a user name and a password for the user (or the information processing apparatus 1 used by the user) A web page or the like for requesting input is sent out, and the authentication information sent from the information processing apparatus 1 used by the user is compared with the authentication information held in advance on the web server 2 side, and until the two match, predetermined The user authentication process is performed such that the web page is not transmitted.

  Further, on the information processing apparatus 1 side of the present embodiment, one of such authentication web servers 2 is determined in advance as the primary server 2p. Information such as the URL of the primary server 2p is stored in the storage unit 12 in advance. Note that the user authentication method in the primary server 2p also allows the accessing user to input a user name and password, and whether or not the set of the input user name and password matches a preset one. It doesn't matter what you judge.

  In addition, the information processing apparatus 1 according to the present embodiment has information for identifying an authentication web server 2 other than the primary server 2p (information about the web) with respect to information for identifying the primary server 2p (information such as the URL of the primary server 2p). A list of server homepage URLs is stored in the storage unit 12 (FIG. 2). Each piece of information specifying the authentication web server 2 included in this list is associated with authentication information to be sent to the corresponding authentication web server 2 (S). The information stored in the storage unit 12 is hereinafter referred to as setting data. It should be noted that what kind of information is held as this authentication information (user name only, password only, or user name and password type information) can be arbitrarily set by the administrator. Good. The information processing apparatus 1 acquires and holds authentication information according to the setting of the administrator.

  In the present embodiment, the control unit 11 functionally executes a secure browser program stored in the storage unit 12 to functionally display a browser processing unit 21, a login trial unit 22, as illustrated in FIG. 3. The device operates as a device including a success / failure management unit 23 and a setting data initialization unit 24.

  The browser processing unit 21 basically executes processing as a general web browser, accepts an input of a URL from a user, and transmits a web page identified by the URL from a web server identified by the URL. Get information. Then, based on the information on the web page (generally, information described in HTML, image data, etc.), display screen information is generated and the display unit 14 is controlled to generate the generated screen information. Is displayed and output. In the present embodiment, the browser processing unit 21 instructs the login trial unit 22 to start processing when the browser processing unit 21 is activated (or when the user first specifies a URL after activation). Then, it waits until there is an input of processing completion from the login trial unit 22, and when there is an input of processing completion, processing as a general web browser is started.

  If the URL input by the user is an authentication web server 2 other than the primary server 2p, the browser processing unit 21 performs so-called autocomplete and automatic login processing. Specifically, when the URL input from the user is a URL such as a web page provided by the authentication web server 2 other than the primary server 2p, the browser processing unit 21 displays information on the web page identified by the URL. When the information is acquired, it is checked whether or not a description for inputting authentication information is included in the information on the web page. This process is a well-known process such as checking whether or not there is an input field (part identified by the input tag) whose attribute is set as “password”, so detailed description thereof is omitted here. To do.

If there is a description for requesting input of authentication information, the browser processing unit 21 refers to the authentication result information stored in the storage unit 12 by the success / failure management unit 23 described later. When the authentication result information is information indicating that the authentication has failed, the browser processing unit 21
(A) Without auto-complete processing, display the screen based on the web page while leaving the authentication information input field blank.
(B) Making the input field of authentication information unusable (set to reject acceptance of information related to authentication in the process of the secure browser program, such as the same as when a disabled or readonly attribute is added) ,
(C) Display that the web page provided from the authentication web server 2 cannot be displayed (deny access to the website in the process of the secure browser program)
(D) End processing related to the program that operates as the browser processing unit 21 (end processing of the secure browser program)
Do one of the following. When the process of the secure browser program is terminated as shown in (d), the secure browser program process is not permitted to be activated again (for example, by deleting a part of the module of the secure browser program). It may be set.

  On the other hand, when the authentication result information stored in the storage unit 12 is referred to by the success / failure management unit 23 to be described later, the browser processing is performed when the authentication result information is information indicating that the authentication is successful. The unit 21 reads out the authentication information recorded in the setting data in association with the information specifying the authentication web server 2 specified by the URL input by the user from the storage unit 12.

  Then, the read authentication information is included as a default value in the authentication information input field, and a screen based on the web page received from the authentication web server 2 is displayed. This process may be the same as the so-called autocomplete process.

  In this case, the user sees the web page in which the authentication information has already been input, and can issue an instruction to send the authentication information to the authentication web server 2 as it is (automatic login). That is, according to the present embodiment, automatic login to an authentication web server 2 other than the primary server 2p is permitted only when the authentication to the primary server 2p is successful.

  When the browser processing unit 21 gives an instruction to start processing, the login trial unit 22 tries to log in to a predetermined primary server 2p. Specifically, the login trial unit 22 reads the URL of the primary server 2p stored in the storage unit 12, and sends the URL to the web server 2 (primary server 2p) specified by the URL with the read URL. Request a specified web page.

  Then, the web page information transmitted from the primary server 2p is received as a response to the request, and based on the received information, the login trial unit 22 generates screen information (authentication screen) of the web page and displays it. 14 is output. In an example of the present embodiment, the screen information of the web page displayed here includes a user name and password input field (authentication information input field).

  When the user inputs a user name and a password in these input fields and gives a transmission instruction, the login trial unit 22 sends the input user name and password to the primary server 2p. In the primary server 2p, it is checked whether or not the set of the sent user name and password matches the set of the user name and password stored in advance on the primary server 2p side. If it is determined that the combination of the user name and password sent out by the login trial unit 22 of the information processing apparatus 1 matches the combination of the user name and password stored in advance on the primary server 2p side, the primary server 2p Sends information indicating that the authentication has succeeded to the information processing apparatus 1.

  On the other hand, if it is determined that the combination of the user name and password sent by the login trial unit 22 of the information processing apparatus 1 and the combination of the user name and password stored in advance on the primary server 2p side do not match, The server 2p sends information indicating that the authentication has failed to the information processing apparatus 1. Here, specifically, information indicating that the authentication has failed is information on a web page representing an authentication screen that prompts the user to log in again. When the login trial part 22 sends out the authentication information and then again sends out the web page including the input field of the authentication information, that is, as a result of executing the authentication process, the login trial part 22 includes the HTML included in the information received from the primary server 2p. If there is a character string specified in advance in the source code (here, an HTML character string representing an input field for authentication information), it is determined that information indicating that the authentication has failed has been received. Specifically, when an HTML character string representing an input tag including a password attribute is included and a password field exists, it can be determined that the login is failed and the login is prompted again, so the primary server 2p It can be determined that the authentication has failed.

  The login trial unit 22 accepts the authentication result information (information indicating that the authentication has been successful or information indicating that the authentication has failed) sent from the primary server 2p. The login trial unit 22 outputs the authentication result information received from the primary server 2p to the success / failure management unit 23 and also outputs processing completion information to the browser processing unit 21.

  The success / failure management unit 23 accepts the authentication result information in the primary server 2p from the login trial unit 22 and stores it in the storage unit 12. The success / failure management unit 23 instructs the setting data initialization unit 24 to initialize the setting data if the authentication result information input from the login trial unit 22 is information indicating that the authentication has failed. .

  When the setting data initialization unit 24 receives an instruction to initialize the setting data from the success / failure management unit 23, the setting data initialization unit 24 stores the setting data stored in the storage unit 12 (information specifying the authentication web server 2 illustrated in FIG. 2). Delete a pair with authentication information).

  In the above example, when the login trial unit 22 determines whether or not the authentication is successful in the primary server 2p, the HTML source code included in the information output by the primary server 2p as a response after sending the authentication information It is supposed to check whether or not there is a character string designated in advance. In particular, in the above example, authentication fails when there is information (for example, an HTML character string representing an input tag including a password attribute) indicating an input field of authentication information in the HTML source code included in the above information. It was decided to judge.

  However, this embodiment is not limited to this. For example, if there is an HTML character string defining a logout button in the HTML source code included in the information, the login trial unit 22 may determine that the authentication has succeeded.

  In addition, the login trial unit 22 may determine whether or not the authentication is successful depending on whether or not there is a code designated in advance in the HTTP response included in the response information received from the primary server 2p after sending the authentication information. Specifically, when the status code included in the HTTP response indicates that authentication has not been performed, such as “401” (Unauthorized), it may be determined that the authentication has failed. Further, when the code included in the HTTP response is “200” (OK) or the like indicating that the request has been successfully processed, it may be determined that the authentication has been successful.

  Further, the login trial unit 22 includes a redirect instruction in the HTML source code included in the information output from the primary server 2p as a response after the authentication information is transmitted, and the redirect destination specified in the redirect instruction is The success or failure of the authentication may be determined based on whether or not the destination is a predetermined redirect destination. For example, if the redirect destination is the home page of the primary server 2p (a page accessible before authentication in the primary server 2p), it may be determined that the authentication has failed.

  The login trial unit 22 does not depend on the information received from the primary server 2p, but, for example, until the primary server 2p sends out information as a response after sending the authentication information (until the information is received from the primary server 2p). ) May be measured by the login trial unit 22 and whether or not the authentication is successful may be determined based on whether or not the time satisfies a predetermined condition. In this example, for example, when a predetermined time is exceeded, it is determined that the authentication has failed.

  The method for determining the success or failure of the authentication of the login trial unit 22 is made selectable according to how the primary server 2p actually responds, and the result of the selection is stored for each primary server 2p. In this case, the setting may be performed using the stored contents.

  Furthermore, in an example of the present embodiment, the login trial unit 22 counts the number of authentication failures when authentication in the primary server 2p fails, and if the count value is less than a predetermined number, the login management unit 23 On the other hand, the login to the primary server 2p may be attempted again without outputting the authentication result and without outputting the processing completion information to the browser processing unit 21.

  Further, in this example, when the number of authentication failures reaches a predetermined number, the login trial unit 22 outputs information on the result of authentication (information indicating that the authentication has failed) to the success / failure management unit 23 and completes the processing. Is output to the browser processing unit 21. The predetermined number of times (threshold value) may be set arbitrarily by an administrator or the like.

  Further, as already described, in the information processing apparatus 1 of the present embodiment, the setting data illustrated in FIG. 2 should be transmitted to the corresponding authentication web server 2 in association with the information specifying the authentication web server 2. It stores authentication information. The authentication information in the setting data may be the authentication information input when the corresponding authentication web server 2 is accessed for the first time (or at the time of setting the authentication information) in the past, but may be stored at a higher security level, for example. It may be preferable that the authentication information for the authentication web server is in a format that the user inputs every time.

  Therefore, in an example of the present embodiment, the administrator may previously set the authentication web server 2 that should be controlled so as not to store the authentication information in the setting data. In this example, the administrator generates a list of information (for example, the URL) for specifying the authentication web server to be controlled so as not to store the authentication information in the setting data, and stores it in the storage unit 12 as a restriction list. .

  Thereafter, the authentication information entered by the user when accessing the authentication web server 2 for the first time (or when setting the authentication information) is sent to the authentication web server 2 and the restriction list is referred to. It is checked whether or not the information specifying the authentication web server 2 is included in the restriction list. If the restriction list includes information for specifying the authentication web server 2, the information processing apparatus 1 does not store the information for specifying the authentication web server 2 and the input authentication information in the setting data. .

  If the restriction list includes information for specifying the authentication web server 2, the information processing apparatus 1 adds the information for specifying the authentication web server 2 and the input authentication information in association with the setting data. To do.

  Furthermore, in an example of the present embodiment, the authentication information stored in the setting data may be encrypted. In this case, when the success / failure management unit 23 accepts the authentication result information in the primary server 2p from the login trial unit 22, the authentication result information is information indicating that the authentication is successful. Information may be decrypted. In this example, for example, when the browser processing unit 21 accesses a certain authentication web server 2, the authentication information corresponding to the accessed authentication web server 2 is read, but the authentication in the primary server 2 p is not successful. Cannot be used because the authentication information is encrypted. Further, when the authentication in the primary server 2p is successful, the authentication information is decrypted, so that the authentication processing in the authentication web server 2 can be performed using the decrypted authentication information.

  In this case, when an instruction to end the processing as the browser processing unit 21 (end the web browser) is given, the authentication information included in the setting data is encrypted again. The encryption key for this encryption may be authentication information itself such as a password to be transmitted when logging in to the primary server 2p, or information related to the authentication information (for example, authentication information such as a password). May be encoded by a predetermined method).

  In the present embodiment, the information processing apparatus 1 may execute activation of the secure browser program. Specifically, the activation code information is notified in advance to a user who is permitted to use (execute) the secure browser program, and the activation management server 3 holds the activation code information. . In an example of the present embodiment, the information processing apparatus 1 requests the user to input activation code information at a predetermined timing such as when the user gives an instruction to start execution of the secure browser program in the information processing apparatus 1. . When the user inputs information in response to this request, the information processing apparatus 1 sends the input information to the activation management server 3 as authentication information.

  The activation management server 3 receives the authentication information from the information processing apparatus 1 and checks whether or not the activation code information that matches the received authentication information is held. Information to be permitted is sent to the information processing apparatus 1.

  When the information processing apparatus 1 receives the information that permits activation, the information processing apparatus 1 starts execution of the secure browser program and enables access to the web server 2 (including the primary server 2p) that requires authentication. Further, when the information permitting activation cannot be received, the secure browser program is not executed.

  The activation management server 3 may use not only the activation code information input by the user but also information related to the information processing apparatus 1 used by the user. In this case, in the activation management server 3, for each user, in addition to the activation code information previously notified to the user, the information is information related to at least one information processing apparatus 1 used by the user. Model information of the device 1, operating system information, individual identifier (if the information processing device 1 is a mobile phone, contractor-specific information, etc.) are associated with the activation code information of the corresponding user as activation policy information. Remember.

  The activation code information may be any information as long as it is announced by the user. For example, the user's own employee number or student ID number is well known and used in the organization to which the user belongs. However, a value that is difficult to identify an individual may be used for a third party outside the organization.

  In this example, the user instructs the activation management server 3 to start execution of the secure browser program using the information processing apparatus 1 that holds the information in advance for use by the user.

  Then, the information processing apparatus 1 requests the user to input activation code information. When the user inputs information in response to this request, the information processing apparatus 1 sends information related to the predetermined information together with the input information to the activation management server 3 as authentication information.

  The activation management server 3 receives the authentication information from the information processing apparatus 1 and checks whether or not the activation code information matching the received authentication information is held. The activation policy information associated with the code information is compared with the information related to the information processing device 1 received from the information processing device 1. If they match, information for permitting activation is sent to the information processing apparatus 1.

  When the information processing apparatus 1 receives the information that permits activation, the information processing apparatus 1 starts execution of the secure browser program and enables access to the web server 2 (including the primary server 2p) that requires authentication. Further, when the information permitting activation cannot be received, the secure browser program is not executed.

  In this way, the activation management server 3 receives the permission condition (activation policy information) related to the information processing apparatus 1 associated with the activation code information (employee number, etc.) and the information processing apparatus 1 operated by the user. The information is collated, and it is confirmed whether the information received from the information processing apparatus 1 that has requested activation matches the activation policy information. If they match, execution (activation) of the secure browser program in the information processing apparatus 1 is permitted, and the user is permitted to use the secure browser program on the information processing apparatus 1.

  According to this example, since information related to the information processing device 1 is also used at the time of activation, when the information processing device 1 is lost, the administrator deactivates the information related to the information processing device 1 (deletes it from the activation policy information). To use the secure browser program in the information processing apparatus 1.

  Further, as the activation policy information, information unique to each information processing apparatus 1 may be used, or information common to a plurality of information processing apparatuses 1 may be used. When information unique to the information processing apparatus 1 is used, for example, a range of serial numbers may be used. In this case, when the user using the information processing apparatus 1 having the serial number within the range inputs corresponding activation code information, the secure browser program can be used in the information processing apparatus 1.

  The activation management server 3 may be set with information that limits the number of information processing apparatuses 1 that can be activated at one time. In this case, the information processing apparatus 1 may notify the activation management server 3 of the end of the process when the secure browser program ends.

  The activation management server 3 increments a counter that counts the number of information processing devices 1 that are permitted to be activated (set to “0” at initialization) by “1” each time the information that permits activation is sent. To do. Further, when the activation management server 3 is notified of the end of the process from the information processing apparatus 1, the activation management server 3 decrements the counter by “1”.

  When the activation management server 3 receives an activation request (information entered by the user as activation code information, etc.) from any of the information processing apparatuses 1, the activation management server 3 activates the value of this counter and the set one time. When the number of possible information processing apparatuses 1 is compared and they match, the activation permission information is not transmitted even if the input activation code information is valid. As a result, the administrator can limit the number of information processing apparatuses 1 that can be activated by the user.

  In this example, the activation code information and the like are sent to the activation management server 3 at the start of execution of the secure browser program. However, the present embodiment is not limited to this, and the secure browser It may be during program installation. In this case, the information processing apparatus 1 prompts the user for activation code information when starting the installer, and confirms whether activation is possible by communicating with the activation management server 3 in the same manner as in the above example. I decided to.

  Further, when setting information for the activation management server 3, preset information including the model of the information processing device 1 that permits activation, the type and version of the operating system, the number of information processing devices 1 that can be activated at one time, and the like. By setting multiple activation policy information and setting activation policy information of one of the presets according to the organizational attributes such as the user's job title, department, organization, etc., settings for each user can be simplified It is good to do.

  Further, in the present embodiment, the information processing apparatus 1 may hold a plurality of setting data in association with the activation code information of each user. In this case, when the activation management server 3 permits the activation, the activation code information entered by the user when starting the secure browser program is referred to, and after the authentication in the primary server 2p is successful, the activation code information It is good also as performing the automatic login process of the authentication information with respect to authentication web server 2 other than the primary server 2p using the setting data memorize | stored in relation to.

  In this example, one information processing apparatus 1 is shared by a plurality of users, and each user inputs his / her activation code information when starting the secure browser program so that his / her authentication information is used. It is set, and automatic login to the authentication web server 2 with its own account becomes possible.

  As described above, according to the information processing apparatus 1 of the present embodiment, the proxy authentication to the other authentication web server 2 with the success or failure of the authentication to the primary server 2p while realizing the single sign-on by executing the secure browser program. It can be performed. For this reason, it is not necessary to additionally manage an account for the single sign-on system as in the prior art. As a result, the operation management cost of the system administrator when introducing single sign-on can be greatly reduced.

  In addition, according to the present embodiment, the system administrator can manage the terminal registration using a value that is normally used by a user such as an employee number but is difficult for a person outside the company to identify the person as an activation code. That is, the activation management server stores only activation codes that are difficult to identify individuals, and does not store information related to business system authentication. For this reason, security against external hacking can be kept robust.

  Furthermore, the authentication information for the authentication web server 2 used for single sign-on stored in the secure browser can be encrypted, and at the time of the encryption, authentication such as the password of the primary server 2p that only the user can know. Information can be an encryption key. Furthermore, since it is possible to set the data (setting data) for single sign-on used in the secure browser program to be deleted if the authentication of the primary server 2p fails for a certain number of times or more, the terminal can be lost when it is lost. Security against impersonation authentication can be kept robust.

  The information processing apparatus 1 of the present embodiment includes the above-described configuration, and operates as follows when a secure browser program is installed in the information processing apparatus 1 that is, for example, a mobile terminal or a personal computer.

  This secure browser program includes a browser module that displays content received from a web server, and an authentication module that manages the success or failure of authentication in the primary server 2p. The information processing apparatus 1 connects to the primary server 2p and other authentication web servers 2 via the Internet by executing this secure browser program.

  When the secure browser program is activated, the information processing apparatus 1 accesses the primary server 2p and displays a login screen to the primary server 2p according to the content data received from the primary server 2p. The information processing apparatus 1 checks whether or not the login on the login screen is successful, for example, by checking whether or not a password input field is further included in the response transmitted from the primary server 2p after sending the authentication information. Thus, information on the success or failure of authentication in the primary server 2p is acquired. The information processing device 1 initializes the setting data of the secure browser program when the login to the primary server 2p has failed for a certain number of times, and controls so that the registered authentication web server 2 cannot be accessed.

  Also, when the login to the primary server 2p is successful, the authentication information sent in the past to the authentication web server 2 is read from the setting data when another authentication web server 2 is accessed by the user's instruction. And sent to the authentication web server 2. Thereby, so-called single sign-on is realized.

DESCRIPTION OF SYMBOLS 1 Information processing apparatus, 2 Web server, 3 Activation management server, 11 Control part, 12 Storage part, 13 Operation part, 14 Display part, 15 Communication part, 21 Browser processing part, 22 Login trial part, 23 Success / failure management part, 24 Setting data initialization section,

Claims (8)

Means for accessing a primary server, which is a predetermined authentication web server, and determining success or failure of authentication in the primary server;
Means for managing the success or failure of authentication at the primary server, and changing the information transmission / reception mode with the web server that requires authentication based on the success or failure;
An information processing apparatus including: The information processing apparatus according to claim 1,
An information processing apparatus that requests the primary server to start authentication processing when a user activates a browser program or when an instruction to access the primary server is given. The information processing apparatus according to claim 1, wherein:
Means for receiving, from the primary server, information of a web page for inputting information for authentication;
Means for sending authentication information input from a user based on information on the web page to the primary server and requesting execution of authentication processing;
Based on information received from the primary server as an execution result of the authentication process,
1. Whether there is a character string specified in advance in the HTML source code included in the information,
2. Whether there is a pre-specified code in the HTTP response included in the information,
3. Whether the redirect destination specified in the redirect instruction included in the information is a predetermined redirect destination,
4). Whether the time until the information is received satisfies a predetermined condition,
An information processing apparatus further comprising: a determination unit that determines at least one of the determinations and determines the success or failure of authentication based on a result of the determination. An information processing apparatus according to any one of claims 1 to 3,
The means for determining success or failure of the authentication, as authentication failure when authentication in the primary server has failed a predetermined number of times,
1. Refusal to accept information related to authentication in browser program processing;
2. Denying access to websites in browser program processing,
3. An information processing apparatus that executes at least one process of initializing predetermined setting information. An information processing apparatus according to any one of claims 1 to 4,
This information processing apparatus holds activation code information notified in advance to a user who is permitted to use the browser program, and determines whether or not activation is possible using the held activation code information. Are communicably connected,
At a predetermined timing, the user is requested to input the activation code information, and the information input by the user in response to the request is sent to the activation management server to receive information on whether or not activation is possible,
An information processing apparatus that enables access to a web server that requires authentication when receiving information that permits activation. The information processing apparatus according to claim 5,
The activation management server is an activation management server that determines whether activation is possible using the activation code information and information specific to an information processing device used by a user,
When sending information input by the user to the activation management server, the information processing apparatus sends out predetermined information related to the information processing apparatus and receives information related to whether or not activation is possible . An authentication processing method in an information processing apparatus,
The control unit of the information processing apparatus accesses a primary server that is a predetermined authentication web server and determines the success or failure of authentication in the primary server, and manages the success or failure of authentication in the primary server, A step of changing an information transmission / reception mode with a web server that requires authentication based on success or failure,
Authentication processing method to execute. Computer
Means for accessing a primary server, which is a predetermined authentication web server, and determining success or failure of authentication in the primary server;
Means for managing the success or failure of authentication at the primary server, and changing the information transmission / reception mode with the web server that requires authentication based on the success or failure;
Program to function as.

Images