JP5278816B2 - Information processing apparatus, control method therefor, program, and recording medium. - Google Patents

Description

  The present invention relates to an authentication method in a Web mail system.

  Currently, there is a web mail system that makes it possible to use an electronic mail system by using a web browser.

  This web mail system has an advantage that new mail creation and confirmation of received mail can be performed only by a web browser. In addition, unlike ordinary mail applications, all mail is managed on the server side, so if you have a computer with a browser, you can use the e-mail system from anywhere via the network. is there.

  However, the availability of an electronic mail system from anywhere increases the risk of unauthorized access.

  Therefore, in order to prevent unauthorized access, it is conceivable to introduce an authentication method having a high security function. However, in general, if an authentication method having a high security function is introduced, the user's convenience is impaired. is there.

  Patent Document 1 confirms whether a registered PC terminal, such as a company-owned mobile terminal, is registered in Web mail, and for PC terminals, virus detection software, P2P detection is performed before connection to the mail server. Disclosed a technology related to a mail server access system that checks the operating status of software, confirms that there are no security problems, and allows only registered PC terminals and registered mobile terminals that have been confirmed to have security access to the mail server. Has been.

JP 2008-217712 A

  However, the invention described in Patent Document 1 requires that the unique information of the PC terminal or mobile terminal that uses the Web mail system be registered in advance in the authentication server, so the terminal that is not registered uses the Web mail system. There is a restriction that it cannot be done. In addition, when a new terminal is purchased or a terminal is discarded, maintenance work is required, which takes time for management. Furthermore, since it is necessary to check the operation status of the virus detection software for the PC terminal, there is also a problem that processing takes time.

  SUMMARY OF THE INVENTION The present invention solves the above-described problems, and an object thereof is to provide an authentication method that ensures security by a simple method without greatly impairing user convenience.

The present invention is an information processing apparatus capable of communicating with a client terminal and an authentication server via a network, the receiving unit receiving an access request from the client terminal, and the client according to the access request received by the receiving unit A first authentication screen data transmitting means for transmitting first authentication screen data for allowing a user operating the client terminal to input first authentication information to log the terminal into the information processing apparatus; A first authentication information receiving means for receiving the first authentication information input at the client terminal via the first authentication screen data, transmitted by one authentication screen data transmitting means; As a result of authentication by authentication processing performed using the first authentication information received by the authentication information receiving means, When authenticated as an appropriate user, a determination unit that determines whether to perform second authentication according to the port number of the access request destination received by the reception unit, and a result of determination by the determination unit, In order to make the user operating the client terminal input the second authentication information for causing the authentication server to perform the authentication in order to log the client terminal into the information processing apparatus. Second authentication screen data transmitting means for transmitting the second authentication screen data, and input at the client terminal via the second authentication screen data transmitted by the second authentication screen data transmitting means. The second authentication information receiving means for receiving the second authentication information and the second authentication information receiving means by the second authentication information receiving means, Respect testimony server, and having an authentication request unit which requests the authentication process using the second authentication information obtained by the received.

  It is possible to provide an authentication method that ensures security by a simple method without greatly impairing user convenience.

It is a figure which shows the structure of the web mail system which concerns on this Embodiment. It is a block diagram which shows the hardware structural example of the information processing apparatus applicable to a web mail server. It is a figure which shows the flow of the authentication at the time of accessing a webmail server from the client terminal of an internal network. It is a figure which shows the flow of authentication at the time of accessing a web mail server from the client terminal or portable terminal of an external network. It is a figure which shows the port number set to a webmail server. It is a figure which shows the 1st authentication screen displayed on a client terminal. It is a figure which shows the screen after login displayed on a client terminal. It is a figure which shows the 2nd authentication screen displayed on a client terminal. It is a figure which shows the initial registration screen of the authentication server displayed on a client terminal. It is a figure which shows the 1st authentication screen displayed on a portable terminal. It is a figure which shows the 2nd authentication screen displayed on a portable terminal. It is a figure which shows the screen after login displayed on a portable terminal. It is a flowchart which shows the flow of the process concerning embodiment of this invention. It is a flowchart which shows the flow of the process concerning embodiment of this invention.

  DESCRIPTION OF EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

  FIG. 1 is a diagram showing a configuration of a Web mail system (information processing system) according to the present embodiment.

  As shown in FIG. 1, a Web mail server 101 (information processing apparatus) communicates with an authentication server 102 and a client terminal 104 connected to an in-house network via a local area network (communication medium). The Web mail server 101 communicates with the client terminal 105 connected to the external network via the firewall 103 via the Internet, and communicates with the mobile terminal 106 via the telephone network or the Internet.

  The web mail server 101 is a server that provides an electronic mail system that can be used by a web browser. For each user, browsing of received mail, creation / transmission of a new message, etc. can be used only by a Web browser.

  The authentication server 102 is a server that authenticates a user who uses the Web mail system. In the embodiment of the present invention, authentication of a user who accesses the Web mail server 101 from an external network is mainly performed. Note that this user authentication is different from the authentication in the normal Web mail system. The method for authenticating the user is not particularly limited, but a method of ensuring security by a simple method without impairing the convenience of the user is desirable. Therefore, in the embodiment of the present invention, an explanation will be given using an example of authentication using the method described in Japanese Patent Laid-Open No. 2003-256373.

  The firewall 103 is a system for detecting and blocking unauthorized access from an external network to the internal network. In the embodiment of the present invention, it is assumed that a function of blocking access by a port number is provided.

  The client terminals 104 and 105 are personal computers operated by a user who uses the Web mail system, and a Web browser for accessing the Web mail server 101 is installed.

  The mobile terminal 106 is a mobile phone (including a PDA or other mobile terminal) operated by a user who uses the Web mail system, and has a Web browser function for accessing the Web mail server 101.

  Next, the hardware configuration of the Web mail server 101 (including the authentication server 102) shown in FIG. 1 will be described with reference to FIG.

  FIG. 2 is a block diagram illustrating a hardware configuration example of an information processing apparatus applicable to the Web mail server 101. Note that the block diagram of FIG. 2 can also be applied to the client terminals 104 and 105.

  As shown in FIG. 2, the Web mail server 101 includes a central processing unit (CPU) 201, a random access memory (RAM) 203, a read only memory (ROM) 202, an input controller 205, and a video controller 206 via a system bus 204. The memory controller 207, the communication I / F controller 208, and the like are connected.

  The CPU 201 comprehensively controls each device and controller connected to the system bus 204.

  Further, the ROM 202 or the external memory 211 will be described later, which is necessary for realizing the functions executed by each server or each PC, such as BIOS (Basic Input / Output System) and OS (Operating System) which are control programs of the CPU 201. Various programs are stored. Further, information necessary for carrying out the present invention is stored. The external memory may be a database.

  The RAM 203 functions as a main memory, work area, and the like for the CPU 201. The CPU 201 implements various operations by loading a program or the like necessary for executing the processing from the ROM 202 or the external memory 211 to the RAM 203 and executing the loaded program.

  The input controller 205 controls input from a keyboard (KB) 209 or a pointing device such as a mouse (not shown).

  The video controller 206 controls display on a display device such as the display 210. The display device may be a display device such as a liquid crystal display. These are used by the administrator as needed.

  The memory controller 207 is an external storage device (hard disk (HD)), flexible disk (FD), or PCMCIA (Personal Computer) that stores a boot program, various applications, font data, user files, editing files, various data, and the like. Controls access to an external memory 211 such as a Compact Flash (registered trademark) memory connected to a Memory Card International Association (Card Memory) card slot via an adapter.

  The communication I / F controller 208 is connected to and communicates with an external device via a network (for example, the LAN 400 shown in FIG. 1), and executes communication control processing in the network. For example, communication using TCP / IP (Transmission Control Protocol / Internet Protocol) is possible.

  The CPU 201 can display on the display 210 by executing an outline font rasterization process on a display information area in the RAM 203, for example. Further, the CPU 201 enables a user instruction using a mouse cursor (not shown) on the display 210.

  Various programs to be described later for realizing the present invention are recorded in the external memory 211 and executed by the CPU 201 by being loaded into the RAM 203 as necessary. Furthermore, definition files and various information tables used when executing the program are also stored in the external memory 211, and a detailed description thereof will be described later.

  Next, referring to FIGS. 3 and 4, the authentication procedure when the client terminal 104 on the in-house network accesses the Web mail server 101, and the client terminal 105 or the portable terminal 106 on the outside network accesses the Web mail server 101. An authentication procedure in this case will be described.

  FIG. 3 is a diagram showing a flow of authentication when the Web mail server 101 is accessed from the client terminal 104 in the internal network.

  The user operates the client terminal 104 to perform an operation for accessing the Web mail server 101 via the Web browser. The client terminal 104 (1) accesses the URL of the Web mail server 101.

  When receiving the access request, the Web mail server 101 transmits (2) screen data (first authentication screen data) for performing user authentication of the Web mail system managed by the Web mail server 101 to the client terminal 104. FIG. 6 is a diagram showing a first authentication screen. This is an example displayed on the Web browser in the client terminal 104.

  The user presses the login button 603 after inputting the user ID and password (first password) as the first authentication information in the user ID column 601 and the password column 602. When an input mistake is made, the reset button 604 is pressed to perform input again. The client terminal 104 (3) transmits the user ID and password, which are the first authentication information input by the user, to the Web mail server 101.

  When the Web mail server 101 receives the user ID and password, it performs user authentication (first authentication). When it is determined that the user is a valid user, the Web mail server 101 transmits (4) screen data after login to the client terminal 104. FIG. 7 shows a screen after login. This is an example displayed on the Web browser in the client terminal 104. For example, when the user selects the inbox 701 and selects an arbitrary mail from the received mail list 702, the user can view the mail text displayed in the mail text column 703.

  The authentication procedure is not different from an authentication procedure in a general Web mail system. As described above, the normal authentication procedure when accessing from the client terminal 104 in the company is the access from the in-house network in consideration of security, because security is ensured, so a more advanced authentication procedure is required. Because there is no. If a more advanced authentication procedure is performed, the user's convenience is adversely affected.

  FIG. 4 is a diagram showing a flow of authentication when the Web mail server 101 is accessed from the client terminal 105 or the portable terminal 106 in the external network.

  The user operates the client terminal 105 or the portable terminal 106 to perform an operation for accessing the Web mail server 101 via the Web browser. The client terminal 105 or the mobile terminal 106 (1) accesses the URL of the Web mail server 101.

  When the Web mail server 101 accepts the access request, (2) screen data (first authentication screen data) for performing user authentication of the Web mail system managed by the Web mail server 101 is sent to the client terminal 105 or the portable terminal 106. Send to. 6 and 10 are diagrams showing a first authentication screen. This is an example displayed on the Web browser in the client terminal 105 or the mobile terminal 106.

  The user inputs the user ID and password (first password) in the user ID column 601 (1001) and password column 602 (1002), and then presses the login button 603 (1003). When an input mistake is made, the reset button 604 is pressed to perform input again. The client terminal 105 or the portable terminal 106 transmits (3) the user ID and password input by the user to the Web mail server 101.

  When the Web mail server 101 receives the user ID and password, it performs user authentication (first authentication). When it is determined that the user is a valid user, the Web mail server 101 requests (4) the authentication server 102 to generate a random number unique to the user determined to be valid by the first authentication. .

  Upon receiving the random number generation request, the authentication server 102 (5) transmits the generated random number information to the Web mail server 101.

  The Web mail server 101 uses the random number information received from the authentication server 102 to (6) screen data (second authentication screen data) for performing user authentication of the Web mail system managed by the authentication server 102 as a client terminal 105 or the portable terminal 106. 8 and 11 are diagrams showing a second authentication screen. This is an example displayed on the Web browser in the client terminal 105 or the mobile terminal 106. The user uses the random number table 801 (1101) displayed on the Web browser as a password for a number registered in advance (for example, a six-digit number) in the password field 802 (1102) as the second authentication. Enter the information password (second password).

  The “arbitrary position registered in advance” is one registered as the “first extraction position” at the time of initial registration with the authentication server, or the “extraction position” arbitrarily set by the user thereafter.

  FIG. 9 is a diagram showing an initial registration screen of the authentication server 102. After accessing the initial registration URL 901 of the authentication server 102, the user presses a registration button 903 to perform initial registration. Specifically, when the URL 901 is clicked, a window screen (not shown) is displayed, and contents indicating that registration with the authentication server 102 is completed are displayed. Thereafter, an initial registration is completed by pressing a registration completion button 903.

  Next, the initial extraction position will be described. In this example, in the 4 × 12 random number table 902, “1” in the first row and the first column, “2” in the first row and the second column, “3” in the first row and the third column, “3” in the first row and the fourth column “4” is displayed in the first row and the fifth column, and “6” is displayed in the first row and the sixth column. The displayed numbers indicate the order of extraction. Therefore, taking the random number table in FIG. 8 as an example, the initial password is “691238”.

  Reference numeral 805 denotes a URL for directly accessing the second authentication screen while omitting the first authentication screen. If this URL is registered in the bookmark, the user can log in to the Web mail system only with the second authentication. However, since it is necessary to display a random number table for each user on the second authentication screen, user-specific information is added to the URL. When the authentication server 102 receives an access request, the authentication server 102 can generate a random number table for each user by reading user-specific information.

  The user inputs the password field 802 (1102) and then presses the login button 803 (1103). If there is an input mistake, the user presses the reset button 804 to input again. The client terminal 105 or the mobile terminal 106 transmits (7) the password, which is the second authentication information input by the user, to the Web mail server 101.

  When the Web mail server 101 receives the password that is the second authentication information, (8) the received password is transferred to the authentication server 102 to request user authentication.

  Upon receiving the user authentication request, the authentication server 102 performs user authentication (second authentication) using the password that is the received second authentication information, and (9) is determined to be a valid user. In such a case, the Web mail server 101 is notified to that effect.

  When the Web mail server 101 receives a notification that it is a valid user, (10) the screen data after login is transmitted to the client terminal 105 or the portable terminal 106. FIG. 7 or 12 shows a screen after login. This is an example displayed on the Web browser in the client terminal 105 or the mobile terminal 106. FIG. 7 is as described above. In FIG. 12, the user selects an arbitrary menu from the menu list 1201 and performs an operation. The bookmark 1202 is a bookmark for directly accessing the second authentication screen.

  As described above, the authentication procedure performs not only an authentication procedure in a general Web mail system but also user authentication using an authentication server. As described above, the user authentication using the authentication server as well as the normal authentication procedure at the time of access from the client terminal 105 outside the company is performed by the malicious user during the access from the outside network. This is because there is a risk of access and it is necessary to perform a more advanced authentication procedure. For this reason, an advanced authentication procedure (in this embodiment, a one-time password is used) is performed as compared with access from an in-house network.

  Next, the overall processing flow will be described with reference to FIGS.

  13 and 14 are flowcharts showing the flow of processing according to the embodiment of the present invention.

  A user performs an operation of accessing a Web mail server via a Web browser that operates on a client terminal (including a mobile terminal; the same applies hereinafter).

  First, in step 1301, the client terminal activates the Web browser according to an instruction from the user.

  In step 1302, the client terminal makes an access request to the Web mail server at the URL specified by the user.

  In step S1303, the Web mail server accepts an access request from the client terminal.

  In step S1304, the Web mail server acquires the access destination port number and temporarily stores it in the memory. For example, when an access request is made as “http://www.ninsyo.co.jp:8080” from the client terminal, “8080” is acquired as the access destination port number. Note that the Web mail server manages session information of each connected user in a memory, and stores the acquired port number and the user in association with each other.

  In step S1305, the Web mail server transmits first authentication screen data to be displayed on the Web browser of the client terminal to the client terminal.

  In step S1306, the client terminal receives the first authentication screen data. Then, the received first authentication screen data is displayed on the Web browser. FIG. 6 is an example showing a first authentication screen. In the case of a portable terminal, the screen of FIG. 10 is displayed.

  Here, the user inputs the user ID and password as the first authentication information in the user ID field 601 (1001) and the password field 602 (1002), and presses the login button 603 (1003).

  In step S1307, the client terminal acquires the user ID and password that are the first authentication information input by the user.

  In step S1308, the client terminal transmits the acquired first authentication information, which is the user ID and password, to the Web mail server.

  In step S1309, the Web mail server receives the user ID and password that are the first authentication information.

  In step S1310, the Web mail server authenticates the user from the user information managed by the Web mail server using the user ID and password that are the received first authentication information, and determines whether or not the user is a valid user. Determine. If it is determined that the user is not a valid user, the process advances to step S1310, and first authentication screen data to which information indicating that user authentication has failed is added is transmitted to the client terminal. If it is determined that the user is a valid user, the process advances to step S1311.

  In S1311, the Web mail server determines the validity of the authentication server cooperation option. If it is determined that it is not valid, the process proceeds to S1312, and if it is determined that it is valid, the process proceeds to S1314. Here, whether or not the authentication server cooperation option is used is determined by referring to the description content of the setting file read into the internal memory when the Web mail server is activated. Specifically, if the host name of the authentication server to be used (other identification information can be included) is described in the setting file, it is determined that the authentication server cooperation option is valid.

  In step S1312, the Web mail server transmits mail list screen data (screen data after login) to the client terminal.

  In step S1313, the client terminal receives the mail list screen data. Then, the received mail list screen data is displayed on the Web browser. FIG. 7 is an example showing a mail list screen. In the case of a portable terminal, the screen of FIG. 12 is displayed.

  In step S1314, the Web mail server determines whether the port number temporarily acquired in the memory in step S1304 is a port number for authentication by the authentication server. If it is determined that the port number is not to be authenticated, the process proceeds to S1312, and if it is determined to be the port number to be authenticated, the process proceeds to S1315.

  Here, in order to determine whether authentication by the authentication server is a port number, a preset port number setting is used. A specific example will be described with reference to FIG. First, as a premise, the port number used by the Web mail server is set. Here, port numbers “80” and “8080” are set in 501. Therefore, the Web mail server accepts a connection request only when the connection destination port number is any port number. Next, “8080” is set in 502 as a port number that does not use the authentication server. Therefore, when the access destination port number is “80”, the Web mail server determines that authentication by the authentication server is performed, and when the access destination port number is “8080”, the Web mail server determines that authentication by the authentication server is not performed. can do.

  In addition, by setting the firewall to block communication that specifies the access port number “8080” from the external network, you can use the authentication server with or without the internal network and access from the external network. It can be used properly. That is, when accessing the Web mail server from the in-house network, it is possible to designate “8080” as the access destination port number, so that the Web mail server can be authenticated by the authentication of the conventional Web mail server alone without using the authentication server. You can log in to

  Therefore, when using from an in-house network where relatively high security measures are taken, the Web mail server can be used without any change from the conventional one, so that the convenience of the user is not impaired. On the other hand, when accessing the Web mail server from an external network, it is possible to specify “80” as the access port number (“80” is specified by default for access to the Web server even if not specified). In addition to authenticating the Web mail server alone, authentication using an authentication server is performed. Thereby, unauthorized access from an external network can be prevented. Here, even if the user designates “8080” as the access destination port number, since communication is blocked by the firewall, authentication from the external network cannot avoid authentication by the authentication server.

  In step S1315, the Web mail server includes individual information (system information such as disk capacity that can be used by the user, mail related information such as an address book, user ID on the authentication server, etc.) from the external storage device or the like. User information in the authentication server is acquired from (information).

  In step S1316, the Web mail server determines the validity of the user information acquired in step S1315. If it is determined that it is not valid, the process proceeds to step S1305. If it is determined that it is valid, the process proceeds to (A) of FIG. The method for determining the validity may be any form. As an example, there is a method for confirming whether the user ID on the authentication server exists in the acquired user information. If this user ID does not exist, it can be determined that the user ID is not valid.

  In step S1401, the Web mail server determines whether the initial registration in the authentication server has been completed. If it is not registered for the first time, the process proceeds to step S1402. If it is registered for the first time, the process proceeds to step S1413. This determination is based on this information because the user information acquired in step S1315 includes information on whether or not the initial registration has been completed.

  In step S1402, the Web mail server requests initial registration information from the authentication server.

  In step S1403, the authentication server receives a request for initial registration information.

  In step S1404, the initial registration information is transmitted to the Web mail server.

  In step S1405, the Web mail server receives the initial registration information.

  In step S1406, the Web mail server transmits the initial registration screen data generated using the received initial registration information to the client terminal.

  In step S1407, the client terminal receives initial registration screen data.

  In step S1408, the client terminal displays the received initial registration screen data on the Web browser. FIG. 9 is an example showing an initial registration screen. As described above, in this example, it is indicated that the initial extraction position of the one-time password is the position from the first row and the first column to the first row and the sixth column. After confirming the initial extraction position, the user clicks the URL 901 to perform initial registration, and presses a registration completion button 903.

  In step S1409, the client terminal instructs the authentication server to register.

  In step S1410, the authentication server receives a registration request from the client terminal.

  In step S1411, the authentication server performs user registration in accordance with the received registration request, and proceeds to step S1401.

  In step S1412, the Web mail server requests the authentication server for random number information for the user authenticated by the first authentication in step S1310.

  In step S1413, the authentication server receives a request for random number information from the Web mail server.

  In step S1414, the authentication server generates random number information unique to the user who has received the request. In the present embodiment, random numbers arranged in a 4 × 12 table format are generated.

  In step S1415, the authentication server transmits the generated random number information to the Web mail server in the XML format that defines the data format.

  In step S1416, the Web mail server receives the random number information in the XML format from the authentication server.

  In step S1417, the Web mail server generates second authentication screen data using the received random number information in the XML format.

  In step S1418, the generated second authentication screen data is transmitted to the client terminal.

  In step S1419, the client terminal receives the second authentication screen data.

  In step S1420, the client terminal displays the received second authentication screen data on the Web browser. FIG. 8 is an example showing a second authentication screen. In the case of a portable terminal, the screen of FIG. 11 is displayed. For example, the number extraction position set for the user is 1st row 1st column, 1st row 2nd column, 1st row 3rd column, 1st row 4th column, 1st row 5th column, 1st row 6th column If they are set in order, the password is “691238” when the random number table in FIG. 8 is taken as an example. The user inputs the password in the password 802 and presses the login button 803.

  In step S1421, the client terminal transmits the input password to the Web mail server.

  In step S <b> 1422, the Web mail server transmits a password for requesting user authentication to the authentication server, using the password received from the client terminal.

  In step S1423, the authentication server receives a password from the Web mail server.

  In step S1424, the authentication server determines the validity of the received password.

  In step S1425, the authentication server transmits the authentication result determined in step S1424 to the Web mail server.

  In step S1426, the Web mail server receives the authentication result.

  In step S1427, if the authentication result indicates that the authentication result is a valid user and the authentication is successful, the Web mail server proceeds to step S1428, and the authentication result that the authentication has failed because the authentication result is not a valid user. In the case, proceed to S1412. If the authentication fails and the process proceeds to S1412, after the processing of S1412 to S1417 is performed, the second authentication screen data transmitted in S1418 includes information for displaying an error message indicating that the authentication has failed. By including, it notifies the user that the authentication in the authentication server has failed.

  In step S1428, the Web mail server transmits mail list screen data (screen data after login) to the client terminal.

  In step S1429, the client terminal receives the mail list screen data. Then, the received mail list screen data is displayed on the Web browser.

  As described above, it is possible to provide an authentication method that ensures security by a simple method without greatly impairing user convenience.

  It should be noted that the configuration and contents of the various data described above are not limited to this, and it goes without saying that the various data and configurations are configured according to the application and purpose.

  Although one embodiment has been described above, the present invention can take an embodiment as, for example, a system, apparatus, method, program, or recording medium, and specifically includes a plurality of devices. The present invention may be applied to a system including a single device.

  Further, the program according to the present invention is a program capable of executing the processing method of FIGS. 13 to 14, and the storage medium of the present invention stores a program capable of executing the processing method of FIGS. . The program in the present invention may be a program for each processing method of each of 13 to 14 devices.

  As described above, a recording medium that records a program that implements the functions of the above-described embodiments is supplied to a system or apparatus, and a computer (or CPU or MPU) of the system or apparatus stores the program stored in the recording medium. It goes without saying that the object of the present invention can also be achieved by executing the reading.

  In this case, the program itself read from the recording medium realizes the novel function of the present invention, and the recording medium storing the program constitutes the present invention.

  As a recording medium for supplying the program, for example, a flexible disk, hard disk, optical disk, magneto-optical disk, CD-ROM, CD-R, DVD-ROM, magnetic tape, nonvolatile memory card, ROM, EEPROM, silicon A disk or the like can be used.

  Further, by executing the program read by the computer, not only the functions of the above-described embodiments are realized, but also an OS (operating system) operating on the computer based on an instruction of the program is actually It goes without saying that a case where the function of the above-described embodiment is realized by performing part or all of the processing and the processing is included.

  Furthermore, after the program read from the recording medium is written to the memory provided in the function expansion board inserted into the computer or the function expansion unit connected to the computer, the function expansion board is based on the instructions of the program code. It goes without saying that the case where the CPU or the like provided in the function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing.

  Further, the present invention may be applied to a system composed of a plurality of devices or an apparatus composed of a single device. Needless to say, the present invention can be applied to a case where the present invention is achieved by supplying a program to a system or apparatus. In this case, by reading a recording medium storing a program for achieving the present invention into the system or apparatus, the system or apparatus can enjoy the effects of the present invention.

  Furthermore, by downloading and reading a program for achieving the present invention from a server, database, etc. on a network by a communication program, the system or apparatus can enjoy the effects of the present invention.

101 Web mail server 102 Authentication server 103 Firewall 104 Client terminal 105 Client terminal 106 Portable terminal

Claims (12)

An information processing apparatus capable of communicating with a client terminal and an authentication server via a network,
Accepting means for accepting an access request from the client terminal;
In accordance with the access request received by the receiving means, first authentication screen data for allowing a user operating the client terminal to input first authentication information is transmitted in order to log the client terminal into the information processing apparatus. A first authentication screen data transmission means;
A first authentication information receiving means for receiving the first authentication information transmitted at the client terminal via the first authentication screen data transmitted by the first authentication screen data transmitting means;
The first authentication information receiving unit first authentication information results in authentication with the authentication process performed using the received result, if it is authenticated as a valid user, the access request destination port received by said receiving means Determining means for determining whether to perform the second authentication according to the number;
As a result of determination by the determination means, in order to cause the user operating the client terminal to perform authentication to the authentication server in order to log in the client terminal to the information processing apparatus when it is determined to perform second authentication Second authentication screen data transmitting means for transmitting second authentication screen data for inputting the second authentication information of
Second authentication information receiving means for receiving the second authentication information input at the client terminal via the second authentication screen data transmitted by the second authentication screen data transmitting means;
Authentication request means for requesting the authentication server to perform authentication processing using the received second authentication information when the second authentication information is received by the second authentication information receiving means. An information processing apparatus characterized by the above. If it is determined that the second authentication is performed as a result of the determination by the determination means, the random number information used for the second authentication generated by the authentication server corresponding to the authenticated user is stored in the client. Further comprising generating means for generating the second authentication screen data including screen information for display in a tabular format on the terminal;
The information processing apparatus according to claim 1, wherein the second authentication screen data transmission unit transmits the second authentication screen data generated by the generation unit. The second authentication information is a combination of random numbers arranged in a pre-registered arrangement order in a random number table displayed in a tabular format by the second authentication screen data. 2. The information processing apparatus according to 2. The generation unit obtains an authentication result for the user from the authentication server in response to a request from the authentication request unit, and when the authentication result is a result indicating that the authentication has failed, The second authentication screen data including screen information is regenerated to display the newly generated random number information used in the second authentication in a tabular format on the client terminal. 4. The information processing apparatus according to any one of items 1 to 3. When the authentication result for the user is obtained from the authentication server in response to the request by the authentication request means, if the authentication result is a result indicating that the authentication is successful, the screen data after logging in to the client terminal The information processing apparatus according to claim 1, further comprising post-login screen data transmission means for transmitting. A management unit that manages a port number that is not subjected to second authentication by the authentication server;
The determination unit determines that the second authentication is not performed when the port number of the access request destination received by the reception unit corresponds to the port number managed by the management unit;
If it is determined that the second authentication is not performed as a result of the determination by the determination unit, the post-login screen data transmission unit does not perform the second authentication by the authentication server, but after the login to the client terminal 6. The information processing apparatus according to claim 1, wherein screen information is transmitted. 7. The information according to claim 6, wherein the port number managed by the management unit and not subjected to second authentication is a number other than a port number designated by default as the port number of the access request destination. Processing equipment. If the access request received by the receiving means includes user-specific information, the second authentication screen is transmitted without transmitting the first authentication screen data by the first authentication screen data transmitting means. The data transmission means transmits second authentication screen data for allowing the user to input second authentication information for causing the authentication server to perform authentication. The information processing apparatus according to item 1. A control method in an information processing apparatus capable of communicating with a client terminal and an authentication server via a network,
An accepting step of accepting an access request from the client terminal;
In accordance with the access request received in the receiving step, first authentication screen data for allowing a user operating the client terminal to input first authentication information is transmitted to log the client terminal into the information processing apparatus. A first authentication screen data transmission step;
A first authentication information receiving step for receiving the first authentication information input at the client terminal via the first authentication screen data transmitted by the first authentication screen data transmitting step;
The port of the access request destination accepted by the accepting step when it is authenticated as a valid user as a result of authentication by the authentication process performed using the first authentication information received by the first authenticating information receiving step A determination step of determining whether to perform the second authentication according to the number;
As a result of the determination in the determination step, in order to cause the user operating the client terminal to authenticate the authentication server to log in the client terminal to the information processing apparatus when it is determined to perform the second authentication A second authentication screen data transmission step of transmitting second authentication screen data for inputting the second authentication information of
A second authentication information receiving step for receiving the second authentication information input in the client terminal via the second authentication screen data, transmitted by the second authentication screen data transmitting step;
An authentication requesting step for requesting an authentication process using the received second authentication information to the authentication server when receiving the second authentication information in the second authentication information receiving step;
A control method characterized by comprising: Client terminal, authentication server, and information processing device can communicate via network
Information processing system,
Accepting means for accepting an access request from the client terminal;
In accordance with the access request received by the receiving means, first authentication screen data for allowing a user operating the client terminal to input first authentication information is transmitted in order to log the client terminal into the information processing apparatus. A first authentication screen data transmission means;
A first authentication information receiving means for receiving the first authentication information transmitted at the client terminal via the first authentication screen data transmitted by the first authentication screen data transmitting means;
The port of the access request destination accepted by the accepting means when authenticated as a valid user as a result of authentication by the authentication process performed using the first authentication information received by the first authentication information receiving means Determining means for determining whether to perform the second authentication according to the number;
As a result of determination by the determination means, in order to cause the user operating the client terminal to perform authentication to the authentication server in order to log in the client terminal to the information processing apparatus when it is determined to perform second authentication Second authentication screen data transmitting means for transmitting second authentication screen data for inputting the second authentication information of
Second authentication information receiving means for receiving the second authentication information input at the client terminal via the second authentication screen data transmitted by the second authentication screen data transmitting means;
An authentication requesting unit that requests the authentication server to perform an authentication process using the received second authentication information when the second authentication information is received by the second authentication information receiving unit;
An information processing system comprising: A program executable in an information processing apparatus capable of communicating with a client terminal and an authentication server via a network,
Accepting means for accepting an access request from the client terminal;
In accordance with the access request received by the receiving means, first authentication screen data for allowing a user operating the client terminal to input first authentication information is transmitted in order to log the client terminal into the information processing apparatus. First authentication screen data transmission means,
First authentication information receiving means for receiving the first authentication information transmitted at the client terminal via the first authentication screen data transmitted by the first authentication screen data transmitting means;
The port of the access request destination accepted by the accepting means when authenticated as a valid user as a result of authentication by the authentication process performed using the first authentication information received by the first authentication information receiving means Determining means for determining whether to perform the second authentication according to the number;
As a result of determination by the determination means, in order to cause the user operating the client terminal to perform authentication to the authentication server in order to log the client terminal into the information processing apparatus when it is determined to perform second authentication Second authentication screen data transmitting means for transmitting second authentication screen data for inputting the second authentication information of
Second authentication information receiving means for receiving the second authentication information input by the client terminal via the second authentication screen data, transmitted by the second authentication screen data transmitting means;
Authentication request means for requesting authentication processing using the received second authentication information to the authentication server when the second authentication information is received by the second authentication information receiving means.
A program for causing the information processing apparatus to function. The recording medium which recorded the program of Claim 11 so that computer reading was possible.

Images