JP5576005B2 - Authentication agent device - Google Patents

Description

BACKGROUND OF THE INVENTION
The present invention relates to an authentication agent device .

  When accessing any site on the network, authentication information consisting of a combination of a normal user ID and password is input according to the instruction screen of the site, and matches the authentication information of the user registered on the site side. Login authentication is generally performed in which login is permitted.

Problems to be solved by the invention

  However, as the number of sites that are frequently used increases, there is a problem that each site requires different authentication methods, and different authentication information is required. .

  On the other hand, portal sites focused on specific services have been launched, making it even more convenient for users. However, if the authentication operation as described above is required every time the portal site is linked to a related site, the convenience is reduced due to its complexity.

  In particular, there is a portal site with a completely new function that has never been seen before, such as creating a new target service by linking services provided for individual sites. When raised, the trend becomes even more pronounced.

The present invention has been made in view of problems as described above, for occupying become feces site access Internet users, on behalf of the user, can be performed on behalf of the certification to a specific site certification It is intended to provide a substitute device .

Means for solving the problem

The configuration of the authentication agent device according to the present invention is as follows:
Link destination information registration means for registering link destination information;
Authentication information storage means for storing the authentication information of the user at the registered link destination and the authentication information notified to the user;
A template script storage means for storing a template script for authentication processing for embedding the authentication information in a screen configuration prepared for each link destination and displayed in the authentication processing executed at the link destination;
Means for receiving information on designation of a link destination from the information browsing means of the user via the Internet;
When the link destination where the user's authentication information is registered is designated by the received information relating to the designation of the link destination, the corresponding link destination information is read from the link destination information registration means, and the user's The authentication information at the link destination is read from the authentication information storage means, the corresponding template script is read from the template script storage means, and the authentication information at the link destination is designated as a variable of the template script. An authentication processing script for embedding the authentication information in a screen configuration displayed in the authentication processing executed at the link destination is created, and the link destination information and the authentication processing script are used as the information browsing means of the user. And an authentication agent processing means for transferring data via the Internet .

  The above configuration provides an apparatus configuration that performs an authentication operation proxy when authentication is performed for a site that does not involve screen transition using only authentication information such as a user D and a password. According to such a configuration, when the user selects a link destination in which his / her authentication information is registered, the authentication agent processing means reads the corresponding link destination information from the link destination information registration means, and The authentication information at the link destination of the user is read from the authentication information storage means, and the template script at the corresponding link destination is read from the template script storage means to create an authentication processing script, and the link destination information and The authentication processing script is transferred to the information browsing means of the user.

  Accordingly, the information browsing means such as the browser on the user side links to the link destination of the target site or the like with the received link destination information, and the information browsing means based on the authentication processing script The above authentication information is automatically embedded in the screen configuration displayed in the authentication process executed earlier, so the user can automatically perform the authentication process without performing any operation on the selected link destination. Will be executed automatically.

  In particular, in this configuration, there is no need for a special configuration for authentication processing at the selected link destination, or there is no need to change the configuration of the link destination, and authentication processing is performed in a normal procedure. The authentication agent process according to this configuration has an advantage that it is executed with a minimum configuration.

According to the configuration of the authentication proxy device of claim 3, an authentication process for executing a predetermined operation or input is performed in accordance with a normal interactive screen transition (for example, the screen is changed in addition to the input of the user ID and the password, and new information is added). A device configuration that performs an authentication operation on the site is provided. As a more specific configuration,
Link destination information registration means for registering link destination information;
The first authentication information and the second authentication information of the user to be input before and after the screen transition at the registered link destination, and the first authentication information and the second authentication information notified to the user Authentication information storage means for storing authentication information;
Means for receiving information on designation of a link destination from information browsing means operating on the user's terminal device via the Internet;
Module storage means for storing a module for authentication processing prepared for each link destination;
Information related to the designation of the received link destination where the user's authentication information is registered, the screen transitions after the first authentication based on the first authentication information is completed, and the link destination for the second authentication information is requested. if specified by, reading the link destination information corresponding from the link destination information registration means, linked to the link destination, the authentication information in the link destination of the user from the authentication information storage means and corresponding The authentication processing module at the link destination is read from the module storage unit, and the authentication processing module is executed based on the authentication information, thereby performing the first authentication processing based on the first authentication information at the link destination. Next, when the screen transitions and the second authentication information is requested, the next authentication processing based on the second authentication information is performed, and the session session established last is performed. Information, and transferred via the Internet to the information browsing means of the user, it is characterized by having the authentication proxy processing unit to take over the connection with the destination.

In a configuration in which authentication is performed for a site that does not involve screen transition using only authentication information such as a user ID and password, an authentication processing script is created as in claim 1 and the user's By transferring to the information browsing means, the information browsing means automatically embeds the authentication information in the screen configuration displayed in the authentication process executed at the link destination based on the authentication processing script. Therefore, the authentication process is automatically executed. However, if the authentication process involves screen transition, such a process cannot be used. In claim 3 , in order to be able to cope with the authentication process accompanied by such a screen transition, once all the authentication processes are performed on behalf of the user and the session with the link destination is established, the session is transmitted to the user. The information browsing means can be handed over.

According to such a configuration, the authentication information of the user is registered, and after the first authentication based on the first authentication information is finished, the screen transitions and the link destination for the second authentication information is used. be chosen by the user, the authentication proxy processing unit reads the destination information corresponding from the link destination information registration means, linked to the link destination, authenticate authentication information in the link destination of the user information The authentication processing module at the link destination is read out from the storage means and the corresponding authentication processing module at the link destination from the module storage means, and the authentication processing module is executed based on the authentication information. make the first authentication process based on the next screen performs the following authentication processing based on the second authentication information when asked the second authentication information transits, established session Session information, and transfers the information browsing means of said user, thereby to take over the connection with the destination.

  Accordingly, since the information browsing means such as the browser on the user side takes over the session information of the session established by the processing of the authentication proxy processing means as it is, the user does not need to perform any operation on the selected link destination. The authentication process is automatically executed, and when the authentication process is completed, the user can log in to the link destination.

  Similarly to the above configuration, this configuration does not require a special configuration for authentication processing at the selected link destination, or it is not necessary to change the configuration of the link destination, and the authentication processing is performed in a normal procedure. Therefore, there is an advantage that the authentication proxy process according to this configuration is executed with a minimum configuration.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
Example 1
FIG. 1 shows a case where the user U selects a link destination site as a function in the portal site P provided with the authentication agent device 1 according to the present invention on the Internet 400. It is a conceptual diagram which shows the whole framework in the case of performing the authentication proxy process by the authentication proxy apparatus 1 which makes it possible to log in and perform an authentication process instead of.

  As shown in FIG. 1, the user U has a personal computer 200, and a browser 210 functioning as information browsing means on the personal computer 200 gives predetermined connection destination information (URL information) to the user U. By acquiring such connection destination information at another site, it is possible to connect to the portal site P (web server 100 described later) via the Internet 400. In this embodiment, the portal site P is set as a portal site to a site that provides financial services.

  The portal site P includes a web server 100, an application server 120, a database server 130, and an authentication server 140.

  Here, when the browser 210 of the personal computer 200 is connected to the web server 100, the user U can receive various services presented there or link destinations presented on the portal site P (on the drawing). Only site A and site B are shown, and it is possible to connect to A link destination and B link destination hereinafter. However, as will be described later, the authentication agent device 1 causes the authentication method determination means 6 described later to determine the difference in the authentication method at the time of login at the link destination, and accordingly, the authentication agent processing corresponding to each authentication method. Is running.

  In addition, in order to receive such a service of the portal site P, it is necessary for the user U to register in advance authentication information on link destinations that can be selected on the portal site P. Is stored in authentication information storage means 3 to be described later.

  Further, when using such a portal site service, the user U has already been registered as an official user of the portal site P, and the information is stored in the authentication server 140. When the user U uses the portal site P, at the portal site P, the authentication server 140 verifies the identity of the user U for each use.

  FIG. 2 shows a device outline of the web server 100, application server 120, database server 130, and authentication server 140 constituting the portal site P.

As shown in FIG. 2, the web server 100 includes a CPU 102, an internal storage device such as a RAM 103 and a ROM 104 , an external storage device such as a hard disk drive 105 and a CD-ROM drive 106 , the Internet, etc. A specific communication device 107 configured with a dedicated line connection adapter, an input device such as a keyboard 108 and a mouse 109, and an output device such as a display 110 and a printer 111 , via the system bus 101. Necessary data and commands are exchanged between them.

  The application server 120, the database server 130, and the authentication server 140 also have the same configuration as described above, and details thereof are omitted.

  Further, the link destination A and the link destination B are also configured by web servers 300a and 300, application servers 320a and 320b, and authentication servers 340a and 340b, respectively, and these configurations also have the same configuration as described above. Description is omitted.

  As shown in FIG. 3, the authentication agent device 1 of the present invention formed on the portal site P includes a link destination information registration unit 2, an authentication information storage unit 3, a template script / module storage unit 4, The authentication proxy processing unit 5 includes the web server 100, the application server 120, and the database server 130.

  The link destination information registration means 2 is constituted by the database server 130 and has a function of registering link destination information (URL information, etc.) for sites that can be linked to the portal site P. As will be described later, authentication method type data for determining the authentication method of the link destination by the authentication method determination means 6 is stored as a part of the link destination information. A method of registering these link destination information will be described later.

  The authentication information storage means 3 is also composed of the database server 130 and has a function of storing authentication information of each user at the link destination registered in the link destination information registration means 2. The authentication information at each link destination of each user is sent in writing or the like, and may be input to the authentication information storage means 3 by an administrator on the portal site P side or an operator who inputs it under the instruction. However, in a state where security by SSL 128 or the like is applied, the authentication information storage unit 3 may be input and stored from a browser or the like.

  The template script / module storage means 4 is also configured by the database server 130, and is prepared for each link destination and a template script for authentication processing (for single screen authentication) prepared for each link destination. The module for authentication processing (for multi-screen authentication) is stored.

  Acquisition of the template script is performed as follows. That is, a separate agent program is prepared for acquiring the template script, and when the program is executed by the application server 120, the link destination information and the portal site of the link destination information registration means 2 are obtained by the network agent function. Access to any link destination periodically while referring to the authentication information for operation check (authentication information that has been requested from each site and specially set by each site for operation check of this device). The authentication process procedure there is acquired as a script file. Along with the acquisition of such a script file, authentication method type data, which is a discrimination result of the authentication method of the collected link destination site, is stored in the link destination information registration means 2 as a part of link destination information. This authentication method type data is input together when each user inputs his / her authentication information to the authentication information storage means 3 via an administrator or operator, and is stored as a part of link destination information. Anyway.

  Regarding the authentication processing module, the administrator of the portal site P directly accesses the link destination, tries the authentication method there, and later creates and registers the authentication processing module by himself. . Then, the administrator registers the authentication method type data of the link destination site in the link destination information registration means 2 as a part of the link destination information. The module may be automatically created by the agent program.

  The authentication agent processing means 5 is constituted by the application server 120. When the link destination where the authentication information of the user U is registered is selected by the user U, the authentication method described later In accordance with the link destination authentication method determined by the determination means 6, the link destination authentication process is performed on behalf of the user U.

  That is, when the authentication method determining means 6 determines that the link destination authentication method is based on the single screen authentication method, (1) the corresponding link destination information is read from the link destination information registration means 2, and the user The authentication information at the link destination of U is read out from the authentication information storage means 3 and the template script at the corresponding link destination is read out from the template script / module storage means 4 to create an authentication processing script. A process of transferring the destination information and the authentication processing script to the browser 210 of the user U is performed. Therefore, the user U himself does not operate, but the browser 210 links to the link destination according to the given link destination information and executes the authentication processing script, whereby the authentication processing is automatically performed. It will be.

  When it is determined that the authentication method is based on the multiple-screen authentication method, (2) the corresponding link destination information is read from the link destination information registration means 2, linked to the link destination, and the user U's The authentication information at the link destination is read out from the authentication information storage means 3, and the corresponding authentication processing module at the link destination is read out from the template script / module storage means 4, and the authentication processing module is based on the authentication information. Is executed to perform authentication processing at the link destination (proxy processing of authentication processing), transfer the session information of the established session to the browser 210 of the user U, and take over the connection with the link destination. Process (session takeover).

  Furthermore, the authentication agent device 1 of the present embodiment is provided with authentication method determination means 6 in addition to the above configuration. This is because the authentication processing method at the link destination to be accessed is not uniform and the screen configuration is different, and the authentication processing procedure in the authentication proxy processing means 5 is broadly divided into single screen authentication according to the link destination. This is a configuration for discriminating the authentication method before handing over the processing to the authentication method judging means 6 because it is divided into multi-screen authentication. The authentication method determination means 6 is composed of the application server 120, reads out the authentication method type data which is a part of the link destination information stored in the link destination information registration means 2, and the user U The authentication method of the selected link destination is determined, and the determination result is passed to the authentication proxy processing means 5.

  As shown in FIG. 1, when the user U accesses the portal site P by the browser 210, the user U is first connected to the authentication server 140 via the web server 100. As shown in FIG. Authentication is performed. Here, the user U inputs the already registered user ID and password as his / her authentication information in the portal site P. Thereafter, even when the user U accesses another linked site via the portal site P, the user U does not need to input authentication information for the site.

  When the authentication to the portal site P is correctly performed, the top menu is displayed by the application server 120 as shown in FIG. Here, when “connection to other WEB server” is selected, a link destination site group accessible on the portal site P as shown in FIG. 6 is displayed. Here, the user U designates a link destination that the user U intends to use.

  Then, as shown in FIG. 3, the user information of the user U and information related to the designation of the link destination are passed from the browser 210 to the authentication proxy device 1. The authentication method determination means 6 determines the authentication method for the link destination designated by the user U with reference to the link destination information (authentication method type data) of the link destination information registration means 2.

  This discrimination method is performed as shown in FIG. That is, the authentication method determination means 6 obtains the link destination designation information designated by the user U who has logged into the portal site P (step S101), and the link destination information stored in the link destination information registration means 2 is stored. A part of the authentication method type data is read (step S102), and the authentication method of the link destination selected by the user U is determined. That is, it is checked whether or not the authentication method is a single screen authentication method (step S103). If it is not a single screen authentication method (step S103; No), it is further determined whether or not it is a multiple screen authentication method. A check is made (step S104). These determination results are passed to the authentication proxy processing means 5.

  FIG. 8 shows the process from the designation of the link destination by the user U until the authentication method of the link destination is determined and the determination result is passed to the authentication proxy processing means 5. Is shown. That is, the authentication method determination means 6 acquires the authentication method type data of the link destination from the link destination information registration means 2 based on the link destination designation information, and is determined according to the flow of FIG. The determination result is passed to the authentication proxy processing means 5.

  Here, it is assumed that the link destination A performed by the single screen authentication method is selected by the user U. Therefore, the authentication method determination means 6 is determined to be based on the single screen authentication method, and the determination result is passed to the authentication proxy processing means 5.

  FIG. 9 shows the data exchange between each means in the portal site P after the link destination A is determined to be based on the single screen authentication method by the authentication method determination and the processing contents by the authentication proxy processing means 5. . That is, the authentication agent processing means 5 receives the designation information of the link destination A by the user U and the user information, and sends the corresponding link destination information (URL information, etc.) from the link destination information registration means 2. The authentication information at the link destination A of the user U (user ID, password, etc. of the user U at the link destination A) is read from the authentication information storage means 3 and from the template script / module storage means 4. , Read the template script of the corresponding link destination A, and the authentication processing script for the link destination A (the processing for automatically starting the connection processing to the target link destination A is described in HTML and JavaScript) The link destination information and the authentication processing script are created and transferred to the browser 210 of the user U. In the authentication processing script, the authentication information is specified as a Hidden variable to be posted.

  Accordingly, the browser 210 on the user U side links to the target link destination A with the received link destination information, and the browser 210 is executed at the link destination A based on the authentication processing script. As shown in FIG. 10, the authentication information is automatically embedded in the screen configuration displayed in the authentication process, so that the user U does not need to perform any operation on the selected link destination A. The authentication process is automatically executed.

  FIG. 11 is an explanatory diagram showing the flow of the above-described processing from when the user U accesses the portal site P until the authentication processing (authentication proxy processing by the authentication proxy device 1) at the designated link destination A ends. It is. Here, finally, the browser 210 on the user U side directly executes the authentication process for the designated link destination A. However, the user U only selects the link destination A, and the link destination A The authentication processing script for performing the above authentication processing is created by the authentication proxy device 1 and sent to the browser 210, and the script is automatically executed by the browser 210. The authentication process is performed on behalf of the person U.

  FIG. 12 shows a menu screen displayed on the browser 210 of the user U at the link destination A when the authentication process at the link destination A is completed and logged in.

  On the other hand, when the user U designates the link destination B and the link destination is determined to adopt the multi-screen authentication method in the authentication method determination of FIG. 7, as shown in FIGS. 13 and 14, The authentication agent processing means 5 first reads the link destination information of the link destination B from the link destination information registration means 2 and links to the link destination B. In addition, the user U's authentication information at the link destination B (a user ID and password prompted for input in FIG. 15 to be described later, as well as a variable PIN number prompted for input from the link destination B as shown in FIG. 16 together with the screen transition) Are read from the authentication information storage means 3. Further, the authentication processing module of the link destination B is read out from the template script / module storage means 4 and the authentication processing module is executed based on the authentication information, thereby performing the authentication processing at the link destination B. The browser 210 takes over the session with the link destination B that is finally established. In order to take over this session, the session information of the established session (HTML and JavaScript for starting the session based on the information sent by the browser 210 together with the URL argument and the Hidden variable, etc.) By transferring to the browser 210, JavaScript is executed on the browser 210, and the session is started between the browser 210 of the user U and the web server 300b of the link destination B.

By executing the authentication processing module, the user ID and password input screen of FIG. 15 to be displayed to the original user U from the link destination B on the way is the user U as the first authentication information . The user ID and password are automatically entered. When the input user ID and password are authorized, a variable PIN number input screen as shown in FIG. 16 is displayed. In addition, the data of the number table table composed of a plurality of rows and columns displayed on the card already passed to the user U is already part of the authentication information (second authentication information). Since it is passed to the authentication agent processing means 5, numbers, characters, etc. in the @ line # column designated on the input screen are automatically input. If the input variable PIN number matches the specified one, the browser 210 of the user U changes the screen and displays the menu screen shown in FIG.

  Here, the authentication agent processing means 5 itself performs the authentication process with the screen transition as shown in FIGS. 15 and 16 on behalf of the user U, and at the stage where the session is finally established, the user Since the browser 210 on the U side can take over the session, the user U can log in to the link destination B only by selecting the link destination A.

  According to the configuration of the present embodiment, the authentication method of the link destination selected by the user U is determined by the authentication method determination means 6. As a result of the determination, if it is determined that a link destination not accompanied by a screen transition is selected using only authentication information such as a user ID and a password, the authentication proxy processing means 5 performs the link destination information registration means. The corresponding link destination information is read from 2, and the authentication information of the user U at the link destination is read from the authentication information storage means 3, and the corresponding link destination template is read from the template script / module storage means 4. The form script is read to create an authentication process script, and the link destination information and the authentication process script are transferred to the browser 210 of the user U.

  Accordingly, the browser 210 on the user U side links to the target link destination with the received link destination information, and the authentication processing executed by the browser 210 at the link destination based on the authentication processing script. Since the authentication information is automatically embedded in the screen configuration displayed in the above, the user U can automatically execute the authentication process without performing any operation on the selected link destination. become.

In addition, the authentication method determining means 6 determines whether the authentication method of the link destination selected by the user U is the link destination that requests the second authentication information by changing the screen in addition to the first authentication information such as the user ID and the password. If it is determined that there is, the authentication proxy processing means 5 reads the corresponding link destination information from the link destination information registration means 2, links to the link destination, and at the link destination of the user U The authentication information is read from the authentication information storage means 3 and the corresponding link destination authentication processing module is read from the template script / module storage means 4, respectively, and the authentication processing module is executed based on the authentication information. As a result, the authentication process at the link destination is executed (all authentication processes are performed once), and the session information of the established session is It is transferred to the browser 210 of the user U, so that the connection with the destination is taken over.

  Therefore, since the browser 210 on the user U side takes over the session information of the session established by the processing of the authentication proxy processing means 5 as it is, the user U does not perform any operation on the selected link destination. The authentication process is automatically executed, and when the authentication process is completed, the user can log in to the link destination.

( Reference example )
The service of the “integrated information management screen” shown in FIG. 5 is installed at a link destination that can be accessed by each user (in this example , an institution such as a financial institution, a securities company, or an insurance company that can set an account). Web server (account balance) and financial information such as insurance / securities are collected by accessing all of these links in order, and integrating those information. It is a service that allows you to grasp at a glance the diversification status of deposits and savings assets, loan information, securities assets, etc. scattered across institutions.

  The service is provided using the configuration shown in FIG. That is, when the service of the “integrated information management screen” is selected in FIG. 5, the screen changes to the screen of FIG. 19. In this state, the user U can display X: total asset information display service, Y: total asset details. Information display service and Z: asset management status “portfolio creation” service can be selected.

  When any one of these services is selected, the portal site P uses the configuration shown in FIG. 18 so that the template sequence storing means 7 prepared for each service is used. Each program to be executed according to the sequence is generated in the program generation means 8 with reference to the model sequence (the following template sequence for X service), and stored in the execution program storage means 9 for each link destination. These programs are executed according to the sequence in the sequence processing by the sequence processing means 10. The program generated and executed here is a program for executing an authentication process and an arbitrary process after login for each link destination.

  The model sequence storage means 7 is constituted by the database server 130, and the program generation means 8, the execution program storage means 9 and the sequence processing means 10 are constituted by the application server 120.

  The program defined in each sequence is a link destination information registration unit for link destinations accessible to the user U (link destinations for which the authentication information of the user U is set). 2, the authentication information of the user U at the link destination is read from the authentication information storage means 3, and the authentication processing module at the link destination is read from the template script / module storage means 4. The proxy processing means 5 is set so that authentication processing is executed on behalf of the user U, and further processing for the link destination after login (for example, processing for acquiring balance information by referring to the balance of a predetermined account) Are also stipulated. Of course, when it is necessary to access a plurality of link destinations and perform each process, authentication processing is sequentially performed for each link destination, and other necessary processes such as balance inquiry are performed. It is set to be executed.

  Here, when the user U selects the X: total asset information display service, the service providing screen shown in FIG. 20 is displayed after the processing as described above is performed. This figure is a total asset information display screen that displays the total assets of the user U at a glance.

  The first stage shown in the figure is the total column of assets, of which “total assets {circle over (1)}” indicates the financial asset balance that the portal site P deposits as a financial business. “Total assets (2)” indicates the balance of financial assets held by other financial institutions operating these sites as a result of searching for other sites and collecting information according to the above configuration of the portal site P. ing. Further, “total asset (3)” is the sum of the above (1) total asset + (2) total asset, and the total assets of user U can be managed in a unified manner.

  The next row in FIG. 20 is the total borrowing balance column, and “total borrowing balance (1)” indicates the amount financed by the portal site P as a financial business. In addition, as a result of searching for other sites and collecting information based on the above-described configuration of the portal site P, the “total borrowing balance (2)” is obtained from other financial institutions that operate these sites. Indicates the sum of the loan balances that have received loans. Further, the portion of “debt details display (3)” is set to display details of the borrowing amount by clicking there.

  In the lower row of FIG. 20, the deposit total value of the portal site P and other sites (other financial institutions) is displayed in a centralized manner, and the deposit amount is displayed by clicking the corresponding location. “Deposit details display {circle over (2)}” for displaying details is shown.

  Furthermore, in the lower row, “Investment trust total (1)”, which displays the deposits for investment trusts of this portal site P and other sites (other financial institutions) in a unified manner, and click on the corresponding part to invest “Investment trust statement display (2)” which displays details of the deposit of the trust is shown.

  In the bottom row, the total investment amount of the portal site P and other sites (other financial institutions) is displayed in a centralized manner, and the total investment amount is clicked by clicking on the corresponding part. “Stock details display {circle over (2)}” displaying the details of the value is shown.

  On the other hand, FIGS. 21 and 22 are service provision screens when the display service of Y: total asset detailed information is selected in the screen display of FIG. 21 and 22 basically show the same contents as those shown in FIG. 20, but the “deposit details display (2)” portion in the deposit total column of FIG. Also, it corresponds to the state where the “Investment Trust Details Display (2)” portion in the Investment Trust Total column is clicked.

  In the detailed display of the deposit total column of FIG. 21, “Portal site financial service deposit (3)” is a list of deposits that the portal site P deposits as a financial service, “△△△ Bank deposit (4)”. "XX" indicates a list of deposits to be deposited by the bank, and "XX" indicates deposits to be deposited by the bank (5) indicates a list of deposits to be deposited by the bank.

  In the detailed display of the investment trust total column in FIG. 22, “Portal site financial services saw investment (3)” is a list of investment amounts that this portal site P deposits as financial services. “Denoco investment (4)” shows a list of investment amounts deposited by XX financial institutions.

  FIG. 23 is a service providing screen when Z: asset management status “portfolio creation” service is selected in the screen display of FIG. As shown in the figure, the asset status of the user U who has collected information as described above is displayed as a portfolio.

  According to the configuration as described above, in a series of sequence processes executed on the portal site P, links to a plurality of link destinations A, B,. Service that can manage the assets distributed by the user U in an integrated manner by linking the balance inquiry service provided by the link destinations A, B. Can be provided with an excellent effect.

The authentication agent device of the present invention is not limited to the above-described embodiment, and various changes can be made without departing from the scope of the present invention.

Effect of the invention

As described above, according to the configuration of the authentication proxy device according to claims 1 to 4 of the present invention, the user simply selects a link destination on a portal site or the like, and the link destination is Even if no special operation is performed, since the authentication process is automatically executed, it is possible to obtain an excellent effect that login to the link destination becomes possible when the authentication process is completed.

In addition, according to the configuration of the reference example , in a series of sequence processes executed on a portal site or the like, it is linked to a plurality of link destinations, and the authentication processing to each link destination is automatically performed by these configurations. It is possible to receive individual services across multiple links, and to link these services together to provide new services to users. The excellent effect of becoming can be achieved.

  The portal site P connected on the Internet 400 is provided with the authentication agent device 1 according to the present invention that enables the user U to authenticate to another site on behalf of the user U and log in. It is a conceptual explanatory drawing of the whole structure shown.   FIG. 2 is an explanatory diagram showing an overview of devices of a web server 100, an application server 120, a database server 130, and an authentication server 140 that constitute a portal site P.   1 is a configuration explanatory diagram of an authentication agent device 1 according to the present invention.   It is screen structure explanatory drawing which shows the authentication process execution screen to this portal site P.   It is explanatory drawing which shows the screen structure of the top menu after the login to this portal site P. FIG.   It is a screen configuration explanatory view showing a selection screen of a link destination site group that can be accessed in the portal site P displayed when “Connect to other WEB server” is selected in the top menu.   It is a flowchart which shows the determination procedure of an authentication method.   It is explanatory drawing which shows the process until the authentication method of this link destination is discriminate | determined from designation | designated of a link destination, and the discrimination | determination result is passed to the authentication surrogate processing means 5 by a functional block structure.   It is explanatory drawing which shows the exchange of the data between each means in the portal site P after it determines with the link destination A being based on a single screen authentication method, and the processing content by the said authentication surrogate processing means 5. FIG.   FIG. 6 is an explanatory diagram showing a state in which the browser 210 automatically embeds the authentication information in the screen configuration displayed in the authentication process executed at the link destination A based on the sent authentication process script. is there.   It is explanatory drawing which shows the flow of the process mentioned above after the user U accesses this portal site P until the authentication process in the designated link destination A is complete | finished.   It is screen structure explanatory drawing which shows the menu screen displayed on the browser 210 of the user U in the link destination A at the stage where the authentication process in the link destination A was completed and logged in.   It is explanatory drawing which shows the exchange of the data between each means in the portal site P after it determines with the link destination B being based on a multiple screen authentication method, and the processing content by the said authentication surrogate processing means 5. FIG.   It is explanatory drawing which shows the flow of the process mentioned above until the authentication process in the designated link destination B is complete | finished after the user U accesses this portal site P, and the session is handed over to the browser 210.   It is explanatory drawing which shows the input screen of the user ID in the said link destination B, and a password.   FIG. 16 is an explanatory diagram showing a screen for entering a variable PIN number after screen transition from FIG. 15.   It is explanatory drawing which shows the menu screen after the login in the link destination B where the authentication process accompanied by a screen transition is performed. It is explanatory drawing which shows the functional block structure of this portal site P which concerns on a reference example .   It is explanatory drawing which shows the service selection screen in an "integrated information management screen".   It is explanatory drawing which shows the service provision screen of the display service of total asset information.   It is explanatory drawing which shows the service provision screen of the display service of total asset detailed information.   It is explanatory drawing which similarly shows the service provision screen of the display service of total asset detailed information.   It is explanatory drawing which shows the service provision screen of asset management condition "portfolio creation" service.

DESCRIPTION OF SYMBOLS 1 Authentication agency device 2 Link destination information registration means 3 Authentication information storage means 4 Model script / module storage means 5 Authentication agency processing means 6 Authentication method determination means 7 Model sequence storage means 8 Program generation means 9 Execution program storage means 10 Sequence Processing means 100, 300a, 300b Web server 101 System bus 102 CPU
103 RAM
104 ROM
105 Hard Disk Drive 106 CD-ROM Drive 107 Communication Device 108 Keyboard 109 Mouse 110 Display 111 Printer 120 Application Server 130 Database Server 140 Authentication Server 200 Personal Computer 210 Browser 400 Internet

Claims (4)

Link destination information registration means for registering link destination information;
Authentication information storage means for storing the authentication information of the user at the registered link destination and the authentication information notified to the user;
A template script storage means for storing a template script for authentication processing for embedding the authentication information in a screen configuration prepared for each link destination and displayed in the authentication processing executed at the link destination;
Means for receiving information on designation of a link destination from the information browsing means of the user via the Internet;
When the link destination where the user's authentication information is registered is designated by the received information relating to the designation of the link destination, the corresponding link destination information is read from the link destination information registration means, and the user's The authentication information at the link destination is read from the authentication information storage means, the corresponding template script is read from the template script storage means, and the authentication information at the link destination is designated as a variable of the template script. An authentication processing script for embedding the authentication information in a screen configuration displayed in the authentication processing executed at the link destination is created, and the link destination information and the authentication processing script are used as the information browsing means of the user. And an authentication agent processing means for transferring the data via the Internet .
Authentication method type data is stored in the link destination information registration unit, and the authentication method type data is read from the link destination information registration unit according to the user's selection. It is provided with an authentication method determination means for determining whether it is a single screen authentication method or a multiple screen authentication method,
If it is determined by the authentication method determining means that it is a single screen authentication method, the determination result is transmitted to the authentication proxy processing means, and the authentication method determining means is determined to be a multi-screen authentication method In this case, the authentication processing module is read out and executed based on the authentication information, the authentication processing at the link destination is performed, and the established session information is transferred to the information browsing means of the user. The authentication agent device according to 1.
Link destination information registration means for registering link destination information;
The first authentication information and the second authentication information of the user to be input before and after the screen transition at the registered link destination, and the first authentication information and the second authentication information notified to the user Authentication information storage means for storing authentication information;
Means for receiving information on designation of a link destination from information browsing means operating on the user's terminal device via the Internet;
Module storage means for storing a module for authentication processing prepared for each link destination;
Information related to the designation of the received link destination where the user's authentication information is registered, the screen transitions after the first authentication based on the first authentication information is completed, and the link destination for the second authentication information is requested. if specified by, reading the link destination information corresponding from the link destination information registration means, linked to the link destination, the authentication information in the link destination of the user from the authentication information storage means and corresponding The authentication processing module at the link destination is read from the module storage unit, and the authentication processing module is executed based on the authentication information, thereby performing the first authentication processing based on the first authentication information at the link destination. Next, when the screen transitions and the second authentication information is requested, the next authentication processing based on the second authentication information is performed, and the session session established last is performed. Information, and transferred via the Internet to the information browsing means of the user, the authentication agent apparatus characterized by having the authentication proxy processing unit to take over the connection with the destination.
Authentication method type data is stored in the link destination information registration unit, and the authentication method type data is read from the link destination information registration unit according to the user's selection. It is provided with an authentication method determination means for determining whether it is a single screen authentication method or a multiple screen authentication method,
When the authentication method determining means determines that the authentication method is a multi-screen authentication method based on the authentication method type data, the authentication method determining means transmits the determination result to the authentication agent means, When the authentication method determination means determines that the authentication method is a single screen authentication method based on the authentication method type data, the template script of the corresponding link destination is read out as a variable of the template script. An authentication processing script for embedding the authentication information in a screen configuration displayed by the authentication processing executed at the link destination by specifying the authentication information at the link destination is created, and the link destination information and the authentication processing script are The authentication agent device according to claim 3, wherein the authentication agent device is transferred to the information browsing means of the user.

Images