JP2022166964A - Password management system, password management device, password management method, password management program and recording medium - Google Patents

Abstract

To provide a password management system capable of performing high-accuracy password authentication.SOLUTION: A management server 12 included in a password management system 11 comprises: a password issuing unit 28 which issues a password, when receiving a request of issue of the password via a password issue request screen; a cookie issuing unit 29 which issues a cookie including ID information based on connection between a browser of a terminal device 13a and the management server 12, when the request of the issue of the password is received; a first transmission control unit 31 which controls to transmit the issued password and issued cookie information to the terminal device 13a; a first determination unit 33 which determines whether or not the accessing terminal device 13a has the cookie including the ID information, when there is access to a password input URL; a second determination unit 35 which determines whether or not the inputted password matches; and an authentication unit 36 which authenticates that the accessing terminal device 13a is the terminal device owned by a legitimate user, when it is determined the inputted password matches.SELECTED DRAWING: Figure 2

Description

The present invention relates to a password management system, password management device, password management method, password management program and recording medium.

For example, it may be desired to deliver electronic files to authorized users via a network such as the Internet. In such a case, it is required to deliver the electronic file safely, that is, to prevent the electronic file from being acquired by a malicious third party. Here, Japanese Patent Application Laid-Open No. 2017-10494 (Patent Document 1) discloses a technique that uses a session ID when connecting to a network.

JP 2017-10494 A

As a method of handing over electronic files only to authorized users who are authorized users, there is a method of using password authentication. In other words, it is a method of authenticating an entered password and judging whether or not to hand over the electronic file according to the authentication result. Here, if the password is stolen by a malicious third party, there is a risk that authentication will succeed by entering the stolen password, and the electronic file will be illegally acquired by the malicious third party. It is required to avoid such situations as much as possible. That is, it is required to improve the accuracy of password authentication using passwords.

An object of the present invention is to provide a password management system capable of highly accurate password authentication.

A password management system according to the present invention is a password management system that includes a management server connectable to a network to which a terminal device is connected, and manages passwords. The management server has an access detection unit that detects access to the password issuance request URL of the web page used for password issuance, and if the access detection unit detects access to the password issuance request URL, the password is issued. and a password issuance request screen displayed by the display control unit. If a password issuance request is accepted via the password issuance request screen displayed by the password issuing unit and the display control unit, a cookie containing ID information is issued based on the connection between the browser of the terminal device and the management server. A cookie issuing unit, a first transmission control unit that controls transmission of the password issued by the password issuing unit and the cookie information issued by the cookie issuing unit to the terminal device, and a web page used when entering the password A notification control unit that controls to notify the information of the password input URL to the terminal device, and a cookie containing the ID information sent by the first transmission control unit to the accessed terminal device when the password input URL is accessed. and a first reception for accepting input of a password if the terminal device accessed by the first determination unit is judged to have a cookie containing ID information. a second judging unit for judging whether or not the inputted password matches the password issued by the password issuing unit when the input of the password is accepted by the first accepting unit; an authentication unit that authenticates that the accessed terminal device is a terminal device owned by an authorized user if it is determined that they match.

For example, when an electronic file is to be handed over to another user via a network, the following method may be adopted. The electronic file to be delivered is encrypted as a Zip format file with a password. Then, the encrypted electronic file is attached to an e-mail using the previously notified e-mail address of another user and sent. After that, the password necessary for decryption is separately sent by e-mail to the same e-mail address. The other user who is the recipient decrypts the previously received Zip format electronic file using the received password, and acquires the electronic file.

However, according to this method, depending on the anti-virus software, Zip-format electronic files are often excluded from exclusion, so it is possible that Zip-format electronic files attached to e-mails may contain so-called malware. cannot avoid malware attacks. In addition, since an e-mail is basically composed of so-called plain text, it can be decrypted by brute force (brute force attack) against an electronic file in Zip format. That is, even without obtaining a password, by performing such brute force, a malicious third party who has obtained a Zip format electronic file may be able to decrypt and obtain the Zip format electronic file. Furthermore, in such a method, an e-mail is sent to another user twice. Decryption becomes easier. This risk is extremely high especially when a system for sending e-mails by automatic distribution is constructed. Such a problem is also called a PPAP (Pre send Password After send Password) problem, and should be avoided.

Here, for example, when handing over an electronic file, the electronic file is stored in advance in a database server connected to the network, permission is given to other users to download this electronic file, and only authorized users who are authorized can access the database server and download electronic files. Such a configuration is also called a download URL (Uniform Resource Locator) type, and it is more difficult for a malicious third party to obtain an electronic file than sending an electronic file in Zip format attached to an e-mail. From a certain point of view, it is more secure.

Regarding granting permission to download or not, let other users know your password and use the password entered by the other user to authenticate that you are a legitimate user who is allowed to download, then allow download can be considered. From the viewpoint of convenience, this password may also be handed over by e-mail. However, if e-mail communication is intercepted, a malicious third party will obtain the password. Then, the electronic file can be downloaded. I don't like this situation. Construction of a system that can perform highly accurate password authentication is desired.

According to the password management system according to the present invention, when a legitimate user who owns a terminal device requests the issuance of a password, the password is issued and ID information is included based on the connection between the browser of the terminal device and the management server. Issue a cookie. Then, the issued password and the issued cookie information are transmitted to the terminal device. Then, information of the password input URL of the web page used for inputting the password is notified to the terminal device. Next, when the password input URL is accessed, the first determination unit first determines whether or not the accessed terminal device has a cookie containing ID information. By doing so, it is possible to determine whether or not the user is a legitimate user who owns the terminal device, based on whether or not the access is from the terminal device having the cookie containing the ID information described above. Here, if the access to the password input URL is from a terminal device owned by a malicious third party who simply stole the password by intercepting the e-mail, it does not have the cookie containing the ID information described above. Therefore, it can be determined that the accessed terminal device is not owned by the authorized user, and for example, it is possible to prevent the subsequent processing from proceeding.

If it is determined that the access is from a terminal device that has a cookie containing the ID information, then a password input is accepted, and the accepted password matches the password issued by the password issuing unit. It is possible to judge whether or not Therefore, it can be determined whether or not the user is authorized. Here, for example, even if a malicious third party accesses the password input URL using a terminal device owned by an authorized user, if the password does not match, the access is not from an authorized user. A decision can be made, for example, to prevent further processing.

As described above, according to such a password management system, highly accurate password authentication can be performed.

In the above password management system, if the first determination unit determines that the accessed terminal device does not have a cookie containing ID information when the password input URL is accessed, the management server performs processing. may be terminated. By doing so, for example, when the password input URL is accessed, it can be determined that the access is by a terminal device owned by a malicious third party. Therefore, by interrupting the continuation of the subsequent processing, it is possible to reduce the possibility that the electronic file is acquired by a malicious third party.

In the above password management system, the management server may terminate the process if the second determination unit determines that the input password and the password sent to the terminal device do not match. By doing so, for example, even if the input of the password is accepted, it is possible to prevent a malicious third party from acquiring the electronic file due to the mismatch of the password. Therefore, by interrupting the continuation of the subsequent processing, it is possible to reduce the possibility that the electronic file is acquired by a malicious third party.

In the above password management system, the management server may further include a permission control section that controls to permit downloading of the electronic file if authenticated by the authentication section. By doing so, it is possible to safely hand over the electronic file to the authorized user, since it is determined that the user is authorized by the above-mentioned password authentication.

The password management system may further comprise a database server including a storage unit for storing downloaded electronic files. By doing so, when downloading an electronic file, it can be safely downloaded and handed over by an authorized user.

In the password management system described above, the first transmission control unit may perform control so that an e-mail containing password information is transmitted to the terminal device. By doing so, password information can be easily transmitted via the network even when the terminal device is located remotely.

The above-mentioned password management system comprises a second receiving unit for receiving a request to send information of a password issuance request URL to a terminal device; and a second transmission control unit for controlling to transmit an e-mail containing the information of the password issuance request URL to. By doing so, the information of the password issue request URL can be easily transmitted to the terminal device using e-mail. Therefore, it is possible to improve the convenience when notifying the authorized user who owns the terminal device of the password issue request URL information.

In the above password management system, the notification control unit may display information of the password input URL when the password issuance request screen is displayed by the display control unit, and control to notify the password input URL to the terminal device. By doing so, the user can know the password input URL through the password issuance request screen at the time of password authentication. By doing so, it is possible to reduce the possibility that the user will mistakenly access the password input URL. Therefore, convenience can be improved.

In the above password management system, the password issuance request URL and the password input URL may be the same. By doing so, it is possible to reduce the risk of the user mistaking the access destination in password authentication by using only one URL for access. Therefore, convenience can be improved.

A password management device according to the present invention is connectable to a network to which a terminal device is connected, and manages passwords. The password management device includes an access detection unit that detects whether or not there is an access to the password issuance request URL of a web page used when issuing a password, and if access to the password issuance request URL is detected by the access detection unit, a display control unit for controlling display of a password issuance request screen for accepting a password issuance request; If a password issuance request is accepted via the password issuance request screen displayed by the password issuance unit and the display control unit, a cookie containing ID information is issued based on the connection between the browser of the terminal device and the management server. a first transmission control unit for controlling transmission of the password information issued by the password issuing unit and the cookie information issued by the cookie issuing unit to the terminal device; A notification control unit that controls to notify the information of the password input URL of the web page to the terminal device, and ID information transmitted by the first transmission control unit to the accessed terminal device when the password input URL is accessed. a first determination unit for determining whether or not a cookie containing ID information is present, and if the first determination unit determines that the accessed terminal device has a cookie containing ID information, accepts input of a password a first accepting unit, a second judging unit for judging whether or not the inputted password matches the password issued by the password issuing unit when the first accepting unit accepts input of a password; an authentication unit that authenticates that the accessed terminal device is a terminal device owned by an authorized user if the determination unit determines that they match.

According to such a password management device, highly accurate password authentication can be performed.

A password management method according to the present invention is used in a password management system that includes a management server connectable to a network to which terminal devices are connected and manages passwords. The password management method consists of a step of detecting access to a password issuance request URL of a web page used for password issuance, and a password issuance request if access to the password issuance request URL is detected. a step of controlling to display a password issuance request screen to be accepted; a step of issuing a password if a password issuance request is accepted via the displayed password issuance request screen; If a request for issuance of a password is received via the terminal, a step of issuing a cookie including ID information based on the connection between the browser of the terminal device and the management server, and transmitting the issued password information and the issued cookie information to the terminal A step of controlling transmission to the device, a step of controlling to notify the terminal device of the information of the password input URL of the web page used when entering the password, and when the password input URL is accessed, determining whether or not the accessed terminal device has the cookie containing the transmitted ID information; and inputting a password if it is determined that the accessed terminal device has the cookie containing the ID information. a step of accepting the input of the password, a step of determining whether or not the input password and the password issued by the password issuing unit match each other when the input of the password is received, and a terminal device accessed when it is determined that the input password matches the password issued by the password issuing unit. and authenticating that the is a terminal device owned by an authorized user.

According to such a password management method, highly accurate password authentication can be performed.

A password management system program according to the present invention is used in a password management system that includes a management server connectable to a network to which a terminal device is connected and that manages passwords. The password management system program includes an access detection unit that detects access to the password issuance request URL of the web page used for password issuance, and the access detection unit that detects access to the password issuance request URL. If the password issuance request is received through the display control unit that controls to display the password issuance request screen that accepts the password issuance request, and the password issuance request is received via the password issuance request screen displayed by the display control unit, the password is issued. If a password issuance request is accepted through the password issuance request screen displayed by the password issuance unit that issues the cookie A cookie issuing unit that issues a password, a first transmission control unit that controls transmission of password information issued by the password issuing unit and cookie information issued by the cookie issuing unit to the terminal device, used when entering a password A notification control unit that controls to notify the information of the password input URL of the web page to the terminal device, and when the password input URL is accessed, the accessed terminal device receives the ID information transmitted by the first transmission control unit a first judging unit for judging whether or not a cookie containing ID information exists; When the input of the password is received by the receiving unit and the first receiving unit, the second determining unit and the second determining unit for determining whether the input password and the password issued by the password issuing unit match. It is a password management system program for functioning as an authentication unit that authenticates that the accessed terminal device is a terminal device owned by an authorized user if it is determined that it is.

According to such a password management system program, highly accurate password authentication can be performed.

A recording medium according to the present invention is a computer-readable recording medium used in a password management system for managing passwords, including a management server connectable to a network to which terminal devices are connected. The recording medium is an access detection unit that detects access to the password issuance request URL of the web page used for password issuance, and if access to the password issuance request URL is detected by the access detection unit. , a display control unit for controlling to display a password issuance request screen for accepting a password issuance request; If a password issuance request is accepted via the password issuance request screen displayed by the password issuing unit and the display control unit, a cookie containing ID information based on the connection between the browser of the terminal device and the management server is issued. Cookie issuing section, password information issued by the password issuing section and cookie information issued by the cookie issuing section are controlled to be sent to the terminal device; A notification control unit that controls to notify the information of the password input URL to the terminal device, and when the password input URL is accessed, the accessed terminal device receives the cookie containing the ID information transmitted by the first transmission control unit. a first judging unit for judging whether or not it has a cookie, a first accepting unit for accepting input of a password if the terminal device accessed by the first judging unit is judged to have a cookie containing ID information; When the input of the password is accepted by the first accepting unit, the second judging unit for judging whether or not the inputted password matches the password issued by the password issuing unit, and the second judging unit judges that they match. If so, it is a computer-readable recording medium recording a password management system program for functioning as an authentication unit that authenticates that an accessed terminal device is a terminal device owned by an authorized user.

According to such a recording medium, highly accurate password authentication can be performed.

According to such a password management system, highly accurate password authentication can be performed.

FIG. 1 is a diagram schematically showing the appearance of a password management system according to one embodiment of the invention. FIG. 2 is a block diagram showing the configuration of the password management system shown in FIG. 1. As shown in FIG. FIG. 3 is a flow chart showing the overall flow of processing when password authentication is performed using the password management system and the user is allowed to obtain an electronic file. FIG. 4 is a diagram showing an example of a password issue request screen. FIG. 5 is a diagram showing an example of a display screen for receiving input of a password. FIG. 6 is a diagram showing another example of the password issue request screen.

Embodiments of the present invention will be described below. In the drawings below, the same or corresponding parts are denoted by the same reference numerals, and the description thereof will not be repeated.

FIG. 1 is a diagram schematically showing the appearance of a password management system according to one embodiment of the invention. FIG. 2 is a block diagram showing the configuration of the password management system shown in FIG. 1. As shown in FIG. 1 and 2, a password management system 11 according to one embodiment of the present invention includes a management server 12 connectable to a network 14 to which a terminal device 13a owned by a user 15a is connected. The password management system 11 manages, for example, passwords used for authentication of the user 15a. Networks 14 include the Internet and intranets. In this embodiment, the management server 12 functions as a web server and database server. The management server 12 functions as a password management device.

The user 15a can access the management server 12 via the network 14 using the terminal device 13a owned by the user 15a. Access of the terminal device 13a to the management server 12 is via a path 24a between the terminal device 13a and the network 14 and a path 24d between the management server 12 and the network 14. FIG. The user 15a can perform various operations, for example, download electronic files stored in the management server 12, by using the terminal device 13a when password authentication by the management server 12 is successful. In other words, the user 15a can obtain the electronic file from the management server 12 by using the terminal device 13a when the password authentication is successful. An example of the terminal device 13a is a desktop personal computer (PC) owned by the user 15a. terminal device. A display 16a is connected to the terminal device 13a, and the user 15a can view data through a display screen 41a of the display 16a. Although not shown, a mouse and keyboard are connected to the terminal device 13a, and the user 15a can use the mouse and keyboard to input data to the terminal device 13a. When the terminal device 13a is a smart phone, a touch panel included in the smart phone serves as an interface for data input/output.

The terminal device 13a includes a terminal device control section 17a for controlling the terminal device 13a itself, a terminal device network interface section 18a for connecting to the network 14, and a terminal device hard disk 19a for storing various data. The terminal device 13a can transmit data to and receive data from other electronic devices connected to the network 14 via the network 14 using the terminal device network interface section 18a. Various data received via the network 14 are stored in the terminal device hard disk 19a.

A terminal device 13b owned by another user 15b and a terminal device 13c owned by another user 15c can also be connected to the network 14 via the network 14. FIG. That is, terminal devices 13b and 13c owned by other users 15b and 15c can also access the management server 12 via the network . Access of the terminal device 13b to the management server 12 is via a path 24b between the terminal device 13b and the network 14 and a path 24d between the management server 12 and the network . Access of the terminal device 13c to the management server 12 is via a path 24c between the terminal device 13c and the network 14 and a path 24d between the management server 12 and the network . The configurations and connected devices of the terminal devices 13b and 13c owned by the other users 15b and 15c are the same as in the case of the terminal device 13a, so description thereof will be omitted.

Next, the configuration of the management server 12 will be described. The management server 12 includes a management server control unit 21 for controlling the management server itself, a management server network interface unit 22 for connecting to the network 14, and a management server hard disk 23 for storing various data. The management server 12 can transmit data to and receive data from other electronic devices connected to the network 14 via the network 14 by the management server network interface unit 22 .

The management server control unit 21 includes an access detection unit 26, a display control unit 27, a password issuing unit 28, a cookie issuing unit 29, a first transmission control unit 31, a notification control unit 32, and a first determination unit 33. , a first reception unit 34 , a second determination unit 35 , an authentication unit 36 , a permission control unit 37 , a second reception unit 38 , and a second transmission control unit 39 . The access detection unit 26 detects whether a password issuance request URL of a web page used for password issuance is accessed. When the access detection unit 26 detects access to the password issuance request URL, the display control unit 27 controls to display a password issuance request screen for accepting a password issuance request. The password issuing unit 28 issues a password upon receiving a password issuing request via the password issuing request screen displayed by the display control unit 27 . When the cookie issuing unit 29 receives a password issuing request via the password issuing request screen displayed by the display control unit 27, the cookie issuing unit 29 includes ID information based on the connection between the browser of the terminal device 13a and the management server 12. Issue cookies. The first transmission control unit 31 controls transmission of the password issued by the password issuing unit 28 and the cookie information issued by the cookie issuing unit 29 to the terminal device 13a. The notification control unit 32 controls to notify the terminal device 13a of the information of the password input URL of the web page used when inputting the password. When the password input URL is accessed, the first determination unit 33 determines whether or not the accessed terminal device 13a has a cookie containing ID information. If the first determination unit 33 determines that the accessed terminal device 13a has a cookie containing ID information, the first reception unit 34 receives input of a password. When the password input is received by the first receiving unit 34, the second determining unit 35 determines whether the input password matches the password issued by the password issuing unit 28 or not. If the second judgment unit 35 judges that they match, the authentication unit 36 authenticates that the accessed terminal device 13a is a terminal device owned by an authorized user. The permission control unit 37 controls to permit the download of the electronic file if the authentication unit 36 authenticates. The second accepting unit 38 accepts a request to send the password issue request URL information to the terminal device 13a. The second transmission control unit controls to transmit an e-mail including the information of the password issuance request URL to the terminal device when the second reception unit accepts the request to send the information of the password issuance request URL. These configurations will be described in detail later.

Next, a flow of managing passwords using the password management system 11 and allowing the user 15a to acquire an electronic file by password authentication will be described. FIG. 3 is a flow chart showing the overall flow of processing when password authentication is performed using the password management system 11 and the user 15a acquires an electronic file. Here, the user 15b, who is the sender of the electronic file _F1 , transmits and stores the electronic file F1 in the management server hard disk 23 of the management server ₁₂ , and uses password authentication to allow the recipient, who is the authorized user, to receive the electronic file F1. _A case will be described in which the electronic file F1 is downloaded and handed over to the user 15a.

Referring to FIG. 3, _first , user 15b, who is the sender, accesses management server ₁₂ from terminal device 13b owned by user 15b, transmits electronic file F1, and registers electronic file F1. . At this time, it is registered as _an electronic file F1 subject to password authentication (step S11 in FIG. 3, hereinafter "step is omitted"). This electronic file F1 is _an electronic file that the user 15a wants to acquire by downloading. Specifically, the user 15 b accesses the management server 12 from the terminal device 13 b and transmits the electronic file F ₁ to the management server hard disk 23 . _At this time, the electronic file F1 is registered to be subject to password authentication. _The management server 12 registers and manages the electronic file F1 stored in the management server hard disk 23 so that it cannot be downloaded unless password authentication succeeds. Here, the user 15b is the _sender of the electronic file F1. The user 15b also transmits to the management server 12 the e-mail address of the e-mail application installed in the terminal device 13a owned by the user 15a who is the authorized recipient. In this manner, the second receiving unit 38 of the management server 12 receives a request to send the password issue request URL information to the terminal device 13a.

The second transmission control unit 39 of the management server 12 transmits an e-mail including the information of the password issuance request URL to the terminal device 13a when the second reception unit 38 accepts the request to send the information of the password issuance request URL. to control. That is, after receiving the e-mail address of the terminal device 13a, the second transmission control unit 39 of the management server 12 sends the e-mail to the terminal device 13a owned by the user 15a who is the authorized recipient (S12). In this embodiment, this is the first transmission of e-mail from the management server 12 to the terminal device 13a. This e-mail contains the URL information of the web page requesting password issuance. That is, in issuing the password necessary for downloading the electronic file F1, information of the URL of the web _page requesting the issue of the password is included in the text of the e-mail, for example. Here, it is assumed that the URL of the web page requesting password issuance is "xxxyyyzzz".

Next, the terminal device 13a receives the e-mail (S13). When the e-mail is opened, the user 15a can know the URL "xxxyyyzzz" to be accessed when requesting the issuance of the password. Then, the user 15a launches a browser on the terminal device 13a and accesses the password issuance request URL "xxxyyyzzz" (S14).

Here, the access detection unit 26 detects whether or not the password issuance request URL of the web page used for password issuance is accessed. In this case, the access detection unit 26 detects that the password issuance request URL has been accessed from the terminal device 13a. If access to the password issue request URL is detected by the access detection unit 26, the display control unit 27 controls to display a password issue request screen for accepting a password issue request (S15).

FIG. 4 is a diagram showing an example of a password issue request screen. Referring to FIG. 4, on the display screen 41a of the display 16a of the terminal device 13a, the URL information 42a, which is the password issuance request URL "xxxyyyzzz", and the inquiry message "Would you like to request the issuance of the password?" 43a and "Yes" are written, and a button 44a that accepts a password issuance request by detecting a click and "No" is written and a password issuance request is made by detecting a click. A button 45a for terminating the process without accepting is displayed. That is, the display control unit 27 controls to display the password issue request screen by displaying the URL information 42a, the message 43a, and the buttons 44a and 45a on the display screen 41a of the display 16a of the terminal device 13a. .

After that, by detecting a click on the button 44a labeled "yes" (S16), the password issuance request is accepted. Then, the password issuing unit 28 of the management server 12 issues a password (S17). Regarding password issuance, for example, a random number may be generated at the timing when a button is pressed, and based on this random number, a password composed of multiple numbers and alphabets may be generated and issued. A password may be selected from a plurality of passwords created by the administrator stored in 23 and issued. Here, the issued password is assumed to be "abc123". The issued password "abc123" is stored in the management server hard disk 23 in association with the information of the terminal device 13a as a password requested to be issued by the terminal device 13a.

Here, if the password issuance request is accepted, the cookie issuing unit 29 issues a cookie containing ID information based on the connection between the browser of the terminal device 13a and the management server 12 (S17). A cookie is data containing ID information that is uniquely determined when connected via a browser.

Then, the first transmission control unit 31 controls to transmit the information of the password "abc123" issued by the password issuing unit 28 and the cookie information issued by the cookie issuing unit 29 to the terminal device 13a (S18). In this embodiment, the first transmission control unit 31 generates an e-mail with the e-mail address as the terminal device 13a, and transmits the password "abc123" by sending this e-mail to the terminal device 13a. In this embodiment, this is the second e-mail transmission from the management server 12 to the terminal device 13a. The terminal device 13a receives the e-mail containing the password and password input URL information (S19). Note that the first transmission control unit 31 transmits the cookie information to the terminal device 13a when communication between the terminal device 13a and the management server 12 is established and the depression of the button 44a is detected. The cookie information transmitted to the terminal device 13a is received and held by the terminal device 13a (S19).

Here, the notification control unit 32 controls to notify the terminal device 13a of the information of the password input URL of the web page used when inputting the password. In this embodiment, the notification control unit 32 includes the information of the password input URL in the text of the e-mail transmitted by the first transmission control unit 31, and the e-mail is transmitted by the first transmission control unit 31. , is opened, the password input URL information is notified. In this case, the e-mail is opened by the user 15a, and is notified by displaying the password input URL on the display screen 41a of the terminal device 13a. That is, the password input URL is visually notified. In this embodiment, the password input URL is assumed to be "uuuvvvwww", which is different from the above-described password issuance request URL "xxxyyyzzz". It should be noted that the information of the password input URL may be notified by voice or together with the voice when the package is opened.

Next, the user 15a accesses the password input URL "uuuvvvwww" to issue a password. Then, when the password input URL “uuuvvvwww” is accessed (S20), the first determination unit 33 determines whether or not the accessed terminal device 13a has a cookie containing ID information (S21). ). In this case, since the access is from the terminal device 13a, the first determination unit 33 determines that there is a cookie containing ID information (YES in S21).

If the first determining unit 33 determines that the accessed terminal device 13a has a cookie containing ID information, the first accepting unit 34 accepts input of a password (S23). Specifically, for example, a password input reception screen is displayed on the display screen 41a to receive the password input. FIG. 5 is a diagram showing an example of a display screen for receiving input of a password. Referring to FIG. 5, a display screen 41a displays URL information 42b, which is a password input URL "uuuvvvwww", a message 43b "Please enter your password", a password input field 44b, and "Send". is displayed, and a button 45b that is clicked to transmit the password entered in the password input field 44b to the management server 12 and a button 46b that is displayed as "Cancel" and is clicked to terminate the process are displayed.

The user 15a enters the password "abc123" notified by e-mail into the password entry field 44b. Then, click the button 45b. Then, the entered password "abc123" is accepted (S24) and sent to the management server 12. FIG. Then, if the input of the password is accepted by the first accepting unit 34, the second judging unit 35 matches the input and transmitted password "abc123" with the password "abc123" issued by the password issuing unit 28. (S25). Then, if the second determination unit 35 determines that they match (YES in S25), the authentication unit 36 authenticates that the accessed terminal device 13a is owned by a legitimate user. That is, the terminal device 13a is authenticated by the password as the terminal device owned by the authorized user 15a to be authenticated. _The permission control unit 37 performs control to permit downloading of the electronic file F1 if authenticated by the authentication unit 36 (S27). _The user _15a acquires the electronic file F1 by downloading the electronic file F1 from the management server hard disk 23 using the terminal device 13a.

As described above, according to the password management system 11, when the legitimate user 15a who owns the terminal device 13a requests a password issuance, the password is issued, and the connection between the browser of the terminal device 13a and the management server 12 is performed. Issue a cookie containing ID information based on Then, the issued password and the issued cookie information are transmitted to the terminal device 13a. Then, the terminal device 13a is notified of the information of the password input URL of the web page used when inputting the password. Next, when the password input URL is accessed, the first determination unit 33 first determines whether or not the accessed terminal device 13a has a cookie containing ID information. By doing so, it is possible to determine whether or not the user 15a is the authorized user 15a who owns the terminal device 13a, based on whether or not the access is from the terminal device 13a having the cookie containing the above ID information. can. Here, if the access to the password input URL is from a terminal device owned by a malicious third party who has simply stolen the password, it does not have the above-described cookie containing the ID information. Therefore, it can be determined that the accessed terminal device is not owned by the authorized user, and for example, it is possible to prevent the subsequent processing from proceeding.

In this embodiment, the management server 12 includes _a permission control section 37 that controls to permit downloading of the electronic file F1 if authenticated by the authentication section 36 . Therefore, since it is determined that the user is a legitimate user based on the above password authentication, the electronic file can be safely handed over to the legitimate user.

In this embodiment, the first transmission control unit 31 performs control so that an e-mail including password information is transmitted to the terminal device 13a. Therefore, password information can be easily transmitted via the network 14 even when the terminal device 13a is located remotely.

Here, in S21, if the management server 12 determines by the first determination unit 33 that the accessed terminal device does not have a cookie containing ID information when the password input URL is accessed, (NO in S21), for example, an error is displayed, the line is immediately locked, and the process is terminated (S22).

Specifically, for example, the user 15c who is not the authorized recipient of the user 15a obtains an e-mail containing the information of the password input URL "uuuvvvwww" sent from the management server 12 to the terminal device 13a by some method. and the password input URL "uuuvvvwww" is known. The user 15c launches a browser using the terminal device 13c owned by the user 15c and accesses the password input URL "uuuvvvwww". Here, if a cookie has already been issued by the operation of the terminal device 13a, the terminal device 13c is the terminal device that requested the password issuance, that is, the terminal device that clicked the button 44a for accepting the password issuance request. Therefore, it does not have cookie information including ID information based on the connection between the browser of the terminal device 13 a and the management server 12 . Therefore, the first determination unit 33 determines that the accessed terminal device 13c does not have a cookie containing ID information, and thus the process is terminated. As _a result, it is possible to prevent the user 15c from acquiring the electronic file F1 using the terminal device 13c. That is, by doing so, for example, when the password input URL is accessed, it can be determined that the access is by a terminal device owned by a malicious third party. Therefore, by interrupting the continuation of subsequent processing, it is possible to reduce the risk of a malicious _third party acquiring the electronic file F1. _In this case, by locking the download of the electronic file F1, nobody, that is, the authorized user 15a may be prevented from downloading. By doing so, it is possible to reliably prevent a malicious _third party from acquiring the electronic file F1. _In this case, the authorized user 15a contacts the administrator to request setting of password authentication again, and if this password authentication succeeds, the electronic file F1 can be obtained.

Further, in S25, if the second determination unit 35 determines that the input password and the password transmitted from the terminal device do not match (NO in S25), the management server 12 terminates the process. control (S26). Specifically, for example, after displaying an error and repeating trial and error for a certain number of _times , the download of the electronic file F1 is locked if the password authentication is not successful. The user 15c who is not the authorized recipient may access the password input URL using the terminal device 13a of the user 15a who is the authorized recipient. In this case, since it is determined that the accessed terminal device 13a has a cookie containing ID information (YES in S21), it is possible to proceed to the display screen for accepting password input, but the user 15c cannot enter the password. If you don't know it, password authentication will never succeed. As _a result, it is possible to prevent the user 15c from acquiring the electronic file F1. That is, by doing so, for example, even if the input of the password is accepted, it is possible to prevent a malicious _third party from acquiring the electronic file F1 due to the mismatch of the password. Therefore, by interrupting the continuation of subsequent processing, it is possible to reduce the risk of a malicious _third party acquiring the electronic file F1.

In the above embodiment, the password management system 11 may further include a database server including _a storage unit for storing the electronic file F1 to be downloaded. Specifically, it includes a database server connected to the network 14 and different from the management server 12 . _The electronic file F1 is sent to this database server to be stored and registered. By doing so, when downloading an electronic file, it can be safely downloaded and handed over by an authorized user.

Further, in the above-described embodiment, the case where password authentication is performed by the password management system 11 and an electronic file is downloaded and acquired has been described, but the present invention is not limited to this. For example, password authentication when determining whether to allow access to a certain web page, and password authentication when performing user registration when browsing membership sites and pages on SNS (Social Networking Service), etc. Effectively utilized.

In the above embodiment, if there is unauthorized access such as access from the terminal device 13c, whether the terminal device 13c that made the unauthorized access is from a country other than the country to which the management server 12 belongs. If it is determined that the access is from a country other than the country to which the management server ₁₂ belongs, the process may be terminated immediately and control may be performed to completely disallow downloading of the electronic file F1. . By doing so, it is possible to more reliably prevent acquisition of the electronic file F1 by unauthorized access from _a country other than the country to which the management server 12 belongs.

In the above embodiment, the display control unit 27 may be controlled to display a message "Please enable cookies" when performing a series of processes. By doing so, the password authentication using the cookie can proceed more smoothly.

In addition, in consideration of the case where a different browser is launched in the terminal device 13a to access the password input URL, the display control unit 27 is configured such that "when inputting a password, Please access the URL using the same browser and enter the password." message may be displayed. By doing so, it is possible to easily avoid failure of password authentication for authorized users.

In the above embodiment, the first transmission control unit 31 controls to transmit the password itself to the terminal device 13a. Information, that is, information that enables the recipient to derive the password, for example, "Your password is your date of birth expressed as an 8-digit number including the Christian year." .

In the above embodiment, the notification control unit 32 controls to display the password input URL information when the password issuance request screen is displayed by the display control unit 27, and to notify the terminal device of the password input URL. You may By doing so, the user can know the password input URL through the password issuance request screen at the time of password authentication. By doing so, it is possible to reduce the possibility that the user will mistakenly access the password input URL. Therefore, convenience can be improved.

Further, in the above embodiment, the password issuance request URL and the password input URL may be the same. By doing so, it is possible to reduce the risk of the user mistaking the access destination in password authentication by using only one URL for access. Therefore, convenience can be improved.

FIG. 6 is a diagram showing another example of the password issue request screen. Referring to FIG. 6, on the display screen 41a of the display 16a of the terminal device 13a, URL information 42a, a message 43a, a button 44a, a button 45a, and "The password entry URL when entering the password is It is the same as the issue request URL." message 43c is displayed. In this case, the password issuance request URL and the password input URL are both "xxxyyyzzz" and are the same. In this way, by setting the URL to be accessed to one and displaying the information of the password input URL when the password issuance request screen is displayed, it is possible to prevent the access destination from being mistaken or forgotten. In addition, convenience can be improved.

Also, the password management device according to the present invention is connectable to a network to which terminal devices are connected, and manages passwords. The password management device includes an access detection unit that detects whether or not there is an access to the password issuance request URL of a web page used when issuing a password, and if access to the password issuance request URL is detected by the access detection unit, a display control unit for controlling display of a password issuance request screen for accepting a password issuance request; If a password issuance request is accepted via the password issuance request screen displayed by the password issuance unit and the display control unit, a cookie containing ID information is issued based on the connection between the browser of the terminal device and the management server. a first transmission control unit for controlling transmission of the password information issued by the password issuing unit and the cookie information issued by the cookie issuing unit to the terminal device; A notification control unit that controls to notify the information of the password input URL of the web page to the terminal device, and ID information transmitted by the first transmission control unit to the accessed terminal device when the password input URL is accessed. a first determination unit for determining whether or not a cookie containing ID information is present, and if the first determination unit determines that the accessed terminal device has a cookie containing ID information, accepts input of a password a first accepting unit, a second judging unit for judging whether or not the inputted password matches the password issued by the password issuing unit when the first accepting unit accepts input of a password; an authentication unit that authenticates that the accessed terminal device is a terminal device owned by an authorized user if the determination unit determines that they match.

According to such a password management device, highly accurate password authentication can be performed. The management server 12 corresponds to a password management device.

The password management method according to the present invention is used in a password management system that includes a management server connectable to a network to which terminal devices are connected and manages passwords. The password management method consists of a step of detecting access to a password issuance request URL of a web page used for password issuance, and a password issuance request if access to the password issuance request URL is detected. a step of controlling to display a password issuance request screen to be accepted; a step of issuing a password if a password issuance request is accepted via the displayed password issuance request screen; If a request for issuance of a password is received via the terminal, a step of issuing a cookie including ID information based on the connection between the browser of the terminal device and the management server, and transmitting the issued password information and the issued cookie information to the terminal A step of controlling transmission to the device, a step of controlling to notify the terminal device of the information of the password input URL of the web page used when entering the password, and when the password input URL is accessed, determining whether or not the accessed terminal device has the cookie containing the transmitted ID information; and inputting a password if it is determined that the accessed terminal device has the cookie containing the ID information. a step of accepting the input of the password, a step of determining whether or not the input password and the password issued by the password issuing unit match each other when the input of the password is received, and a terminal device accessed when it is determined that the input password matches the password issued by the password issuing unit. and authenticating that the is a terminal device owned by an authorized user.

According to such a password management method, highly accurate password authentication can be performed.

Also, the password management system program according to the present invention is used in a password management system that includes a management server connectable to a network to which a terminal device is connected and manages passwords. The password management system program includes an access detection unit that detects access to the password issuance request URL of the web page used for password issuance, and the access detection unit that detects access to the password issuance request URL. If the password issuance request is received through the display control unit that controls to display the password issuance request screen that accepts the password issuance request, and the password issuance request is received via the password issuance request screen displayed by the display control unit, the password is issued. If a password issuance request is accepted through the password issuance request screen displayed by the password issuance unit that issues the cookie A cookie issuing unit that issues a password, a first transmission control unit that controls transmission of password information issued by the password issuing unit and cookie information issued by the cookie issuing unit to the terminal device, used when entering a password A notification control unit that controls to notify the information of the password input URL of the web page to the terminal device, and when the password input URL is accessed, the accessed terminal device receives the ID information transmitted by the first transmission control unit a first judging unit for judging whether or not a cookie containing ID information exists; When the input of the password is received by the receiving unit and the first receiving unit, the second determining unit and the second determining unit for determining whether the input password and the password issued by the password issuing unit match. It is a password management system program for functioning as an authentication unit that authenticates that the accessed terminal device is a terminal device owned by an authorized user if it is determined that it is.

According to such a password management system program, highly accurate password authentication can be performed.

A recording medium according to the present invention is a computer-readable recording medium that includes a management server connectable to a network to which terminal devices are connected, is used in a password management system that manages passwords, and is computer-readable. The recording medium includes an access detection unit that detects whether or not there is an access to the password issuance request URL of a web page used when issuing a password, and if access to the password issuance request URL is detected by the access detection unit, A display control unit that controls to display a password issuance request screen that accepts a password issuance request, and if a password issuance request is received via the password issuance request screen displayed by the display control unit, the password is issued. A cookie that issues a cookie containing ID information based on the connection between the browser of the terminal device and the management server when the password issuance request is accepted via the password issuance request screen displayed by the password issuing unit and the display control unit. The issuing unit, the password information issued by the password issuing unit and the cookie information issued by the cookie issuing unit are controlled to be sent to the terminal device, the password of the web page used when entering the password A notification control unit that controls to notify the information of the input URL to the terminal device, and when the password input URL is accessed, the accessed terminal device has a cookie containing the ID information transmitted by the first transmission control unit. a first judging unit for judging whether or not the terminal device accessed has a cookie containing ID information, a first accepting unit for accepting input of a password; 1 If the input of the password is accepted by the accepting unit, a second judging unit for judging whether or not the inputted password and the password issued by the password issuing unit match. For example, it is a computer-readable recording medium recording a password management system program for functioning as an authentication unit that authenticates that an accessed terminal device is a terminal device owned by an authorized user.

According to such a recording medium, highly accurate password authentication can be performed.

It should be understood that the embodiments and examples disclosed this time are illustrative in all respects and not restrictive in any aspect. The scope of the present invention is defined by the scope of the claims rather than the above description, and is intended to include all modifications within the meaning and range of equivalents of the scope of the claims.

INDUSTRIAL APPLICABILITY The password management system, password management device, password management method, password management program, and recording medium according to the present invention are particularly effectively used when highly accurate password authentication is required.

11 password management system, 12 management server, 13a, 13b, 13c terminal device, 14 network, 15a, 15b, 15c user, 16a display, 17a terminal device control unit, 18a terminal device network interface unit, 19a terminal device hard disk, 21 management Server control unit, 22 management server network interface unit, 23 management server hard disk, 24a, 24b, 24c, 24d path, 26 access detection unit, 27 display control unit, 28 password issuing unit, 29 cookie issuing unit, 31 first transmission control 32 notification control unit 33 first determination unit 34 first reception unit 35 second determination unit 36 authentication unit 37 permission control unit 38 second reception unit 39 second transmission control unit 41a display screen , 42a, 42b information, 43a, 43b, 43c message, 44a, 45a, 45b, 46b button, 44b password entry field.

Claims (13)

A password management system for managing passwords, including a management server connectable to a network to which a terminal device is connected,
The management server is
an access detection unit that detects whether or not a password issuance request URL of a web page used for issuance of the password is accessed;
a display control unit that controls to display a password issuance request screen for accepting a request for issuance of a password when access to the password issuance request URL is detected by the access detection unit;
a password issuance unit that issues the password upon receipt of the password issuance request via the password issuance request screen displayed by the display control unit;
If the password issuance request is accepted via the password issuance request screen displayed by the display control unit, a cookie including ID information based on the connection between the browser of the terminal device and the management server is issued. a cookie issuer;
a first transmission control unit that controls transmission of the password information issued by the password issuing unit and the cookie information issued by the cookie issuing unit to the terminal device;
a notification control unit that controls to notify the terminal device of the information of the password input URL of the web page used when inputting the password;
A first determination unit that determines, when the password input URL is accessed, whether or not the accessed terminal device has the cookie containing the ID information transmitted by the first transmission control unit. When,
a first accepting unit that accepts input of the password if the first determining unit determines that the accessed terminal device has the cookie containing the ID information;
a second determination unit configured to determine, when the input of the password is received by the first receiving unit, whether the input password matches the password issued by the password issuing unit;
an authentication unit that authenticates that the accessed terminal device is owned by an authorized user if the second determination unit determines that the passwords match. If the first determination unit determines that the accessed terminal device does not have the cookie containing the ID information when the password input URL is accessed, the management server performs processing 2. The password management system of claim 1, terminating the. 3. The management server according to claim 1 or 2, wherein the management server ends the process when the second determination unit determines that the input password and the password sent to the terminal device do not match. Described password management system. 4. The password management system according to any one of claims 1 to 3, wherein said management server further comprises a permission control unit that controls to permit download of an electronic file if authenticated by said authentication unit. . 5. The password management system of claim 4, further comprising a database server including a storage unit for storing the downloaded electronic files. 6. The password management system according to any one of claims 1 to 5, wherein said first transmission control unit controls transmission of an e-mail containing said password information to said terminal device. a second receiving unit that receives a request for sending information of the password issuance request URL to the terminal device;
a second transmission control unit configured to control transmission of an e-mail containing the information of the password issuance request URL to the terminal device when the request for transmission of the information of the password issuance request URL is received by the second reception unit; 7. The password management system of any one of claims 1-6, further comprising: 2. The notification control unit controls to display the information of the password input URL when the password issuance request screen is displayed by the display control unit, and to notify the terminal device of the password input URL. Password management system according to claim 7 . 9. The password management system according to claim 1, wherein said password issuance request URL and said password input URL are the same. A password management device that is connectable to a network to which a terminal device is connected and manages passwords,
an access detection unit that detects whether or not a password issuance request URL of a web page used for issuance of the password is accessed;
a display control unit that controls to display a password issuance request screen for accepting a request for issuance of a password when access to the password issuance request URL is detected by the access detection unit;
a password issuance unit that issues the password upon receipt of the password issuance request via the password issuance request screen displayed by the display control unit;
If the password issuance request is accepted via the password issuance request screen displayed by the display control unit, a cookie including ID information based on the connection between the browser of the terminal device and the management server is issued. a cookie issuer;
a first transmission control unit that controls transmission of the password information issued by the password issuing unit and the cookie information issued by the cookie issuing unit to the terminal device;
a notification control unit that controls to notify the terminal device of the information of the password input URL of the web page used when inputting the password;
A first determination unit that determines, when the password input URL is accessed, whether or not the accessed terminal device has the cookie containing the ID information transmitted by the first transmission control unit. When,
a first accepting unit that accepts input of the password if the first determining unit determines that the accessed terminal device has the cookie containing the ID information;
a second determination unit configured to determine, when the input of the password is received by the first receiving unit, whether the input password matches the password issued by the password issuing unit;
an authentication unit that authenticates that the accessed terminal device is owned by an authorized user if the second determination unit determines that the passwords match. A password management method used in a password management system for managing passwords, including a management server connectable to a network to which a terminal device is connected,
a step of detecting whether or not a password issuance request URL of a web page used when issuing the password is accessed;
a step of controlling to display a password issuance request screen for accepting a request for issuance of the password when access to the password issuance request URL is detected;
a step of issuing the password if the password issuance request is received through the displayed password issuance request screen;
issuing a cookie containing ID information based on the connection between the browser of the terminal device and the management server when the password issuance request is received through the displayed password issuance request screen;
a step of controlling transmission of the issued password information and the issued cookie information to the terminal device;
a step of controlling to notify the terminal device of the information of the password input URL of the web page used when inputting the password;
a step of determining whether or not the accessed terminal device has the cookie including the transmitted ID information when the password input URL is accessed;
accepting input of the password if it is determined that the accessed terminal device has the cookie containing the ID information;
determining whether or not the input password matches the password issued by the password issuing unit, if the input of the password is accepted;
and authenticating that the accessed terminal device is owned by an authorized user if it is determined that the two passwords match each other. A password management system program for use in a password management system that manages passwords and includes a management server connectable to a network to which a terminal device is connected,
the computer,
an access detection unit that detects whether or not a password issuance request URL of a web page used when issuing the password is accessed;
a display control unit that controls to display a password issuance request screen for accepting a request for issuance of a password when access to the password issuance request URL is detected by the access detection unit;
a password issuance unit that issues the password when the password issuance request is accepted via the password issuance request screen displayed by the display control unit;
If the password issuance request is accepted via the password issuance request screen displayed by the display control unit, a cookie including ID information based on the connection between the browser of the terminal device and the management server is issued. cookie issuer,
a first transmission control unit for controlling transmission of the password information issued by the password issuing unit and the cookie information issued by the cookie issuing unit to the terminal device;
A notification control unit that controls to notify the terminal device of the information of the password input URL of the web page used when inputting the password;
A first determination unit that determines, when the password input URL is accessed, whether or not the accessed terminal device has the cookie containing the ID information transmitted by the first transmission control unit. ,
a first reception unit that receives input of the password if the first determination unit determines that the accessed terminal device has the cookie containing the ID information;
a second determination unit that, when the input of the password is received by the first reception unit, determines whether the input password matches the password issued by the password issuing unit;
A password management system program for functioning as an authentication unit that authenticates that the accessed terminal device is owned by an authorized user if the second determination unit determines that the terminal device matches. A computer-readable recording medium used for a password management system for managing passwords, including a management server connectable to a network to which a terminal device is connected,
the computer,
an access detection unit that detects whether or not a password issuance request URL of a web page used when issuing the password is accessed;
a display control unit that controls to display a password issuance request screen for accepting a request for issuance of a password when access to the password issuance request URL is detected by the access detection unit;
a password issuance unit that issues the password when the password issuance request is accepted via the password issuance request screen displayed by the display control unit;
If the password issuance request is accepted via the password issuance request screen displayed by the display control unit, a cookie including ID information based on the connection between the browser of the terminal device and the management server is issued. cookie issuer,
a first transmission control unit for controlling transmission of the password information issued by the password issuing unit and the cookie information issued by the cookie issuing unit to the terminal device;
A notification control unit that controls to notify the terminal device of the information of the password input URL of the web page used when inputting the password;
A first determination unit that determines, when the password input URL is accessed, whether or not the accessed terminal device has the cookie containing the ID information transmitted by the first transmission control unit. ,
a first reception unit that receives input of the password if the first determination unit determines that the accessed terminal device has the cookie containing the ID information;
a second determination unit that, when the input of the password is received by the first reception unit, determines whether the input password matches the password issued by the password issuing unit;
A computer reading recording a password management system program for functioning as an authentication unit that authenticates that the accessed terminal device is a terminal device owned by an authorized user if the second determination unit determines that there is a match. Possible recording media.

Images