JP5569284B2 - Information processing apparatus, authentication control method, and authentication control program - Google Patents

Description

  The present invention relates to an information processing apparatus, an authentication control method, and an authentication control program, and more particularly, to an information processing apparatus, an authentication control method, and an authentication control program that control an authentication process that allows omission of password input.

  2. Description of the Related Art Conventionally, various computer systems have an authentication function and are configured to give use authority only to authenticated users. Specifically, an authentication screen is displayed first. On the authentication screen, the user inputs a user name (or user ID) and password. When the user name and password input on the screen match the user name and password stored in advance, the use authority is given to the user. According to the authentication function, the users to whom the use authority is given can be limited in advance, and the safety of the computer system can be improved.

  On the other hand, in recent years, one PC (Personal Computer) or the like is rarely shared by a plurality of users. In other words, each user often has a dedicated PC. In each PC, authentication is performed when logging in to an OS (Operating System). In this case, the fact that the operator of the PC is a legitimate user of the PC is secured to some extent by being able to log in to the OS. Nevertheless, when using a site on the Internet or another computer system, it may be bothersome for the user to be required to input a user name and password again.

  Therefore, conventionally, the user name and password input operation can be omitted by displaying the user name and the masked password in advance on the authentication screen.

  FIG. 1 is a diagram for explaining a mechanism for omitting a user name and password input operation. In the figure, an authentication server 510 is a computer having an authentication function. The authentication screen 610 is a screen displayed on a computer connected to the authentication server 510 via a network.

  In step S <b> 1, the authentication screen 610 transmits user identification information to the authentication server 510. For example, if the authentication server 510 is a computer that provides a website, the user identification information corresponds to cookie information for the website.

  Subsequently, the authentication server 510 returns the user name and password associated with the user identification information to the authentication screen 610 (S2). The authentication screen 610 displays the received user name and password. At this time, the authentication screen 610 displays the masked result such as “****” regarding the password. When the OK button 611 is pressed on the authentication screen 610, the authentication screen 610 transmits the user name and password displayed by itself to the authentication server 510 (S3). The authentication server 510 authenticates the user by comparing the received user name and password with the user name and password registered in the database.

  According to the mechanism shown in FIG. 1, the user can simply authenticate simply by pressing the OK button 611.

  However, the conventional mechanism has disadvantages from the viewpoint of security. As an example, there is an increase in the chance that the user name and password are distributed on the network. That is, it is necessary to transfer the user name and password from the authentication server 510 to the authentication screen 610. As a result, the possibility of eavesdropping on the user name and password may increase.

  The present invention has been made in view of the above points, and it is an object of the present invention to provide an information processing apparatus, an authentication control method, and an authentication control program capable of improving the deterioration of security caused by omitting the input of a password. And

  Therefore, in order to solve the above-described problem, the present invention receives user identification information from a client device, and uses a first character string different from all passwords stored in user information storage means for storing a password for each user. A character string transmitting means for transmitting to the client device; a collating means for determining whether at least a part of the first character string is included in the second character string received as a password from the client device; Selecting means for selecting, as a password used for authentication, a password stored in association with the user identification information when the determination result by the collating means is affirmative.

  In such an information processing apparatus, it is possible to improve the deterioration of security caused by omitting the password input.

  According to the present invention, it is possible to improve the deterioration of security caused by omitting the input of a password.

It is a figure for demonstrating the mechanism for abbreviate | omitting input operation of a user name and a password. It is a figure which shows the structural example of the information processing system in 1st embodiment. It is a figure which shows the hardware structural example of the information processing server in embodiment of this invention. It is a figure for demonstrating an example of the process sequence of the authentication process in the information processing system of a 1st form. It is a figure which shows the structural example of the cache information storage part in 1st embodiment. It is a figure which shows the example of a display of an authentication screen. It is a figure which shows the structural example of the information processing system in 2nd embodiment. It is a figure for demonstrating an example of the process sequence of the authentication process in the information processing system of a 2nd form. It is a figure for demonstrating the structural example of the information processing system in 3rd embodiment, and its process sequence.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 2 is a diagram illustrating a configuration example of the information processing system according to the first embodiment. In the information processing system 1 in FIG. 1, the information processing server 10 and the authentication server 20 can communicate with each other via a network such as a LAN (Local Area Network) or the Internet. The information processing server 10 and the client device 30 can communicate with each other via a network such as a LAN or the Internet.

  The client device 30 is a computer such as a PC (Personal Computer) used by a user to receive a service provided by the information processing server 10 via a network. A mobile phone, a PDA (Personal Digital Assistance), a smartphone, or the like may be used as the client device 30.

  The information processing server 10 is a computer that provides a predetermined service via a network. One form of the information processing server 10 is a Web server. However, the service provided by the information processing server 10 may be realized by a server program that requires a dedicated client application.

  The authentication server 20 is a computer that authenticates a user who intends to receive a service provided by the information processing server 10 via the client device 30.

  In the figure, the client device 30 has a UI control unit 31. The UI control unit 31 performs display control of a screen for receiving a service provided by the information processing server 10. One of the screens displayed by the UI control unit 31 is an authentication screen. The authentication screen is generally called a login screen or the like, and is a screen for allowing a user to input a user name (also called a user ID), a password, and the like. When the information processing server 10 is a Web server, the UI control unit 31 corresponds to a Web browser.

  The information processing server 10 includes a character string transmission unit 11, a collation unit 12, a selection unit 13, an authentication control unit 14, a cache information storage unit 15, a service providing unit 16, and the like. Each of these units is realized by processing that a program (authentication control program) installed in the information processing server 10 causes the CPU of the information processing server 10 to execute.

  The character string transmission unit 11 transmits a character string displayed as a user name and a password on the authentication screen to the client device 30. This is to enable the user name and password to be omitted from the authentication screen. However, the character string transmission unit 11 transmits a dummy password (hereinafter referred to as “dummy password”) instead of a true password.

  The collation unit 12 collates a password (hereinafter referred to as “reception password”) included in the authentication request received from the client device 30 with a dummy password, and the reception password includes a part of the dummy password. It is determined whether or not.

  The selection unit 13 selects a password used for authentication based on the determination result by the verification unit 12. Specifically, when the determination result by the collation unit 12 is affirmative (when the received password includes at least a part of the dummy password), the selection unit 13 sets the password cached in the cache information storage unit 15. Is selected as the password used for authentication. On the other hand, when the determination result by the collation unit 12 is negative (when the reception password does not include at least a part of the dummy password), the selection unit 13 selects the reception password as a password used for authentication.

  The authentication control unit 14 performs authentication based on the user name included in the authentication request received from the client device 30 or the user name stored in the cache information storage unit 15 and the password selected by the selection unit 13. The authentication server 20 is made to execute. The cache information storage unit 15 caches the user name and password managed in the authentication server 20 using, for example, an auxiliary storage device of the information processing server 10. The service providing unit 16 provides a predetermined service when a user who uses the client device 30 is authenticated.

  The authentication server 20 includes an authentication processing unit 21 and a user information storage unit 22. The authentication processing unit 21 performs authentication by checking the user name and password included in the authentication request from the authentication control unit 14 of the information processing server 10 with the user name and password recorded in the user information storage unit 22. I do. The user information storage unit 22 stores a user name, a password, and the like for each user who is permitted to use the service provided by the information processing server 10.

  FIG. 3 is a diagram illustrating a hardware configuration example of the information processing server according to the embodiment of the present invention. The information processing server 10 in FIG. 3 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a CPU 104, and an interface device 105 that are connected to each other via a bus B.

  A program for realizing processing in the information processing server 10 is provided by a recording medium 101 such as a CD-ROM. When the recording medium 101 on which the program is recorded is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, the program need not be installed from the recording medium 101 and may be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program and also stores necessary files and data.

  The memory device 103 reads the program from the auxiliary storage device 102 and stores it when there is an instruction to start the program. The CPU 104 executes functions related to the information processing server 10 in accordance with a program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network.

  Hereinafter, a processing procedure of the information processing system 1 will be described. FIG. 4 is a diagram for explaining an example of a processing procedure of authentication processing in the information processing system according to the first embodiment.

  In response to a predetermined input by the user to the UI control unit 31 in the client device 30, the UI control unit 31 transmits an access request to the information processing server 10 (S101). The access request includes user identification information for identifying the user of the client device 30. User identification information is stored in the auxiliary storage device 102 in advance. For example, when the information processing server 10 is a Web server, the user identification information may be cookie information for the Web server. The user identification information may be the same value as the user name or may be different.

  Alternatively, the UI control unit 31 may display a screen for inputting a user name and input the user name via the screen. In this case, the UI control unit 31 transmits the input user name to the information processing server 10 as user identification information.

  In the information processing server 10, when the access request is received, the character string transmission unit 11 searches the cache information storage unit 15 for the user name based on the user identification information included in the access request (S102). .

  FIG. 5 is a diagram illustrating a configuration example of the cache information storage unit in the first embodiment. As shown in the figure, the cache information storage unit 15 stores user identification information, a user name, a password, and the like in association with each user.

  Therefore, in step S102, the character string transmission unit 11 searches for a user name associated with the user identification information included in the access request. If the user name is also used as user identification information, step S102 does not necessarily have to be executed.

  Subsequently, the character string transmission unit 11 generates a dummy password (S103). The character string transmission unit 11 records the dummy password in the memory device 103, for example, in association with the user name searched in step S102.

  The dummy password may be an arbitrary character string that is different from the passwords of all the users stored in the user information storage unit 22. For example, the character string transmission unit 11 generates a character string randomly or based on a predetermined naming rule. The character string transmission unit 11 inquires of the authentication processing unit 21 of the authentication server 20 whether or not the character string is registered as a password. The authentication processing unit 21 confirms whether or not the character string is stored in the user information storage unit 22 as a password, and returns a confirmation result.

  Alternatively, the character string may be fixedly determined in advance. It may be fixed for each user, or may be a value common to all users. Further, the character string may be periodically transferred from the authentication server 20. That is, the authentication processing unit 21 may generate a character string that is not stored as a password in the user information storage unit 22 and transfer it to the information processing server 10.

  Note that the number of characters in the dummy password is preferably different from the number of characters in the true password. When the dummy password is displayed on the authentication screen 310 described later, the masked character string may be displayed with the same number of characters as the dummy password depending on the implementation contents of the UI control unit 31. Then, the number of characters in the true password is specified, and the possibility that the true password will be broken increases.

  Subsequently, the character string transmission unit 11 returns the user name and the dummy password to the client device 30 in a response to the access request (S104). When the user name and the dummy password are received by the client device 30, the UI control unit 31 displays an authentication screen in which the user name and the dummy password are input (set) on the display device of the client device 30. (S105).

  FIG. 6 is a diagram illustrating a display example of the authentication screen. In the figure, the authentication screen 310 has a user name input area 311, a password input area 312, an OK button 313 and the like. The user name input area 311 is an area for inputting a user name. The password input area 312 is an area for inputting a password. However, the user name returned from the information processing server 10 is set in the user name input area 311 in the initial state displayed on the authentication screen 310 of the present embodiment. In the password input area 312, a dummy password returned from the information processing server 10 is set as a password.

  Therefore, the user can omit the user name and password input operation. In the figure, the password input area 312 shows a state where the password is masked and displayed. However, the password set in the password input area 312 is a dummy password. Therefore, it may be displayed without being masked.

  Note that the user can edit the user name or password in the user name input area 311 or the password input area 312 as necessary. In this case, the user name and password values set in the authentication screen 310 are updated.

  Subsequently, when the OK button 313 is clicked by the user, the UI control unit 31 transmits an authentication request including the user name and password set on the authentication screen 310 to the information processing server 10 (S106).

  When the authentication request is received by the information processing server 10, the collation unit 12 acquires a dummy password recorded in the memory device 103 in association with the user name (reception user name) included in the authentication request, The dummy password is compared (or compared) with the password (received password) included in the authentication request (S107). Specifically, the collation unit 12 determines whether or not the received password includes at least a part of the dummy password. This is a process for determining the user's intention. That is, when the user re-enters the password in the password input area 312 of the authentication screen 310, it is considered that the user desires authentication based on the input password. On the other hand, if the user clicks the OK button 313 without editing the password in the password input area 312, the user is considered to desire authentication based on the cached password. Then, it is considered that the collation unit 12 may determine whether or not the received password completely matches the dummy password.

  However, there may be a case where the user desires authentication based on the cached password after deleting several characters in the password input area 312. Therefore, in the present embodiment, the collation unit 12 determines whether or not at least part of the dummy password is included in the received password.

  However, if the user wishes to authenticate with a newly entered password and re-enters the password, a part of the dummy password may be accidentally included in the received password. If it does so, possibility that the newly input password will be handled as an effective thing will become low. In particular, as the number of characters in the dummy password increases, the types of characters included in the dummy password increase, and the possibility that a part of the dummy password is accidentally included in the newly input password increases.

  Therefore, a further restriction may be provided on the conditions for the positive determination by the collation unit 12. For example, the dummy password and the reception password may be added on condition that a common character string having a predetermined number of characters or more is included. Furthermore, it may be added on condition that the position of the matching character string (for example, the position from the beginning) matches. For example, the condition may be that character strings of a predetermined number of characters from the beginning match.

  Note that the case where the user wishes to authenticate with a newly entered password means, for example, that the password stored in the cache information storage unit 15 matches the password stored in the user information storage unit 22. This is the case when the user knows that it is not. Specifically, as an example, from the viewpoint of security, the password in the user information storage unit 22 is periodically and forcibly changed in the authentication server 20, and a new password is notified to the user by e-mail or the like. Can be mentioned. Alternatively, the case where the password in the user information storage unit 22 is changed in the authentication server 20 in response to a request from the client device 30 based on a user operation without going through the information processing server 10 is also applicable.

  Or, if the user wishes to authenticate based on the cached password after deleting a few characters in the password input area 312, as the user can take action, enter the true password for the deleted amount Can be considered. This is because when the dummy password is masked and displayed, the user thinks that the true password is set on the authentication screen 310.

  Therefore, the received password includes at least a part of the dummy password, and the difference between the two corresponds to the password cached in the cache information storage unit 15 (that is, the true password). It is good also as conditions where the determination result by collation part 12 becomes affirmative. The cached password may be specified using the cache information storage unit 15 based on the user name included in the authentication request.

  Alternatively, the dummy password may include characters (hereinafter, referred to as “prohibited characters”) that cannot be input in the password input area 312 (the input is restricted). In other words, in step S103, the character string transmission unit 11 may include prohibited characters in the dummy password. In other words, there are generally restrictions on the characters that can be used in passwords. In many cases, the UI control unit 31 is implemented so as to reject the entry of prohibited characters in the password input area 312. Then, if the received password includes at least part of the dummy password and part of it includes prohibited characters, it is guaranteed that the prohibited characters are not input by the user. . Therefore, in this case, the validity of making the determination result of the collation unit 12 positive is recognized. A dummy password may be configured only by prohibited characters (by a set of prohibited characters). By doing so, it is possible to improve the accuracy (certainty) of the determination result as to whether or not at least part of the dummy password is included in the received password. In this case, unless all dummy passwords are deleted in the password input area 312, the received password includes prohibited characters that are likely not to be input by the user.

  Note that the determination result by the collation unit 12 is affirmative on the assumption that a dummy password associated with the received user name is recorded in the memory device 103. That is, it is assumed that the user name has not been changed in the user name input area 311 of the authentication screen 310. Therefore, if the dummy password associated with the received user name is not recorded in the memory device 103, the determination result by the collation unit 12 is negative.

  Subsequently, the selection unit 13 selects a password or the like used for authentication based on the determination result by the collation unit 12 (S108). Specifically, when the determination result by the collation unit 12 is positive, the selection unit 13 selects a cached password. In this case, the selection unit 13 acquires the password related to the received user name from the cache information storage unit 15, and the received user name (or the same user name as the received user name stored in the cache information storage unit 15). The password is selected as the user name and password used for authentication. On the other hand, when the determination result by the collation unit 12 is negative, the selection unit 13 selects the received user name and received password as the user name and password used for authentication.

  Subsequently, the authentication control unit 14 transmits an authentication request including the user name and password selected by the selection unit 13 to the authentication server 20 (S109). When the authentication request is received by the authentication server 20, the authentication processing unit 21 of the authentication server 20 includes the user name and password included in the authentication request and the user name and password stored in the user information storage unit 22. Is verified (S110). Subsequently, the authentication processing unit 21 returns an authentication result to the information processing server 10 (S111).

  When the authentication result is received by the information processing server 10, the service providing unit 16 determines whether or not to provide the service according to the authentication result.

  In the above, an example in which the information processing server 10 and the authentication server 20 are separate devices has been described, but the information processing server 10 may also serve as the authentication server 20. Specifically, the information processing server 10 may include an authentication processing unit 21 and a user information storage unit 22. In this case, the cache information storage unit 15 is not always necessary. This is because the function of the cache information storage unit 15 may be replaced by the user information storage unit 22. However, in this case, association information between each record in the user information storage unit 22 and the user identification information needs to be stored in the auxiliary storage device 102.

  As described above, according to the present embodiment, it is possible to reduce the chance that a true password is distributed on the network. Specifically, in step S104, a dummy password is transferred instead of a true password. If the user desires authentication using a cached password, the dummy password is also transferred in step S106. Therefore, it is possible to improve the deterioration of security caused by omitting the password input.

  In addition, it is also mentioned as an advantage of the present embodiment that basically no modification is required on the client device 30 side (that is, the UI control unit 31) when implementing the present embodiment. In other words, the UI control unit 31 is different in that a dummy password is transmitted instead of a true password, but both are simply character strings. Therefore, the UI control unit 31 is not affected by such a difference. Therefore, basically, the difference from the conventional method (for example, the method described in FIG. 1) is not exposed to the user. As a result, security can be improved while the user does not know (or without being noticed by the user).

  In addition, according to the present embodiment, it is possible to significantly reduce the risk of a password being viewed. That is, the conventional method (the method described with reference to FIG. 1) has a problem that a true password may be detected. For example, although the password displayed on the authentication screen 610 is masked, it is an actual value. Therefore, the last character is deleted, and the deleted character is input appropriately. Authentication is received in this state. Repeat the same if authentication fails. At this time, it is assumed that one character to be input is different from the previous one. If the authentication succeeds, the last character of the password is known. Subsequently, by repeating the same thing one character at a time from the second to the third, there is a possibility that all the character strings of the password will eventually be ignored.

  On the other hand, in the present embodiment, the password displayed on authentication screen 310 is a dummy password. Therefore, it is possible to prevent the password from being broken.

  In view of the above password detection method, when the password is edited, it is considered preferable in terms of security to avoid authentication using the cached password. In particular, when a part of the password is edited, there is a possibility that the above-mentioned password is attempted to be viewed.

  Therefore, a condition that the determination by the collation unit 12 is affirmative may be that the dummy password and the received password completely match. However, even this cannot completely guarantee that the password has not been edited. This is because the last part of the password is deleted and the part newly added may coincide with the dummy password by chance. Therefore, from this point of view, the advantage of configuring the dummy password only with the prohibited characters is recognized. This is because, when all of the dummy passwords are prohibited characters, the possibility that a part newly added coincides with the dummy password by chance can be reduced. That is, on the authentication screen 310, it is often impossible to input prohibited characters.

  However, even if the dummy password is configured only by the prohibited characters, it is difficult to detect an action (edit) of adding or deleting some characters after the dummy password.

  Therefore, the number of characters of the dummy password may be the maximum number of characters that can be input in the password input area 312 of the authentication screen 310. By doing so, it is possible to prevent the act of adding or deleting some characters after the dummy password. This is also effective when the dummy password is not composed of only prohibited characters.

  Next, a second embodiment will be described. FIG. 7 is a diagram illustrating a configuration example of an information processing system according to the second embodiment. In FIG. 7, the same parts as those of FIG. In the second embodiment, differences from the first embodiment will be described. Therefore, the points not particularly mentioned may be the same as those in the first embodiment.

  In the information processing system 2 shown in FIG. 1, the client device 30 a has a cache information storage unit 32. On the other hand, the information processing server 10 a does not have the cache information storage unit 15. That is, the second embodiment is an embodiment for explaining that the location where the user name and password are cached is not limited to the information processing server 10.

  The contents of the cache information storage unit 32 may be the same as those shown in FIG. However, the user identification information column is not necessarily required. In addition, the cache information storage unit 32 basically stores only the user name and password related to the login user of the client device 30.

  Hereinafter, the processing procedure of the information processing system 2 will be described. FIG. 8 is a diagram for explaining an example of a processing procedure of authentication processing in the information processing system according to the second embodiment. In response to a predetermined input from the user to the UI control unit 31 in the client device 30, the UI control unit 31 transmits an access request to the information processing server 10 (S201). The access request includes the user name and password stored in the cache information storage unit 32 as user identification information. When the information processing server 10 is a Web server, the cache information storage unit 32 may be a storage unit that stores cookie information for the Web site of the Web server.

  In the information processing server 10, when the access request is received, the character string transmission unit 11 of the information processing server 10 extracts the user name and password from the user identification information included in the access request (S202).

  Step S203 and subsequent steps may be the same as step S103 and subsequent steps in FIG. However, the user name password extracted in step S202 may be used instead of the user name or password stored in the cache information storage unit 15 in FIG.

  As described above, the user name and password may be cached in the client device 30.

  The information processing server 10 or the like is not necessarily a general-purpose computer. In recent years, devices such as multifunction peripherals, copiers, printers, and facsimile machines can function as servers such as Web servers. Therefore, such a device may be used as the information processing server 10 or the like.

  Here, an example in which the multifunction machine has the functions of the information processing server 10 or 10a and the client device 30 or 30a will be described as a third embodiment.

  FIG. 9 is a diagram for explaining a configuration example of an information processing system and a processing procedure thereof in the third embodiment. 9, the same parts as those in FIG. 2 or FIG. 7 are denoted by the same reference numerals, and the description thereof is omitted.

  In the information processing system 3 in the figure, the multi-function device 40 and the authentication server 20 can communicate via a network such as a LAN (Local Area Network) or the Internet.

  The multifunction peripheral 40 has a touch panel 41 in addition to hardware as shown in FIG. 3 and hardware (printer, scanner, etc.) as image forming means. The touch panel 41 is a touch-type liquid crystal panel that displays an operation screen and receives an input from the user via the operation screen. An IC card reader 42 is also connected to the multi-function device 40. The IC card reader 42 is hardware that reads information recorded on the IC card 50. A plurality of IC cards 50 are distributed to each user, and the user name and password of the user are recorded. The user name and password in the IC card 50 cannot be corrected without using a dedicated tool.

  Furthermore, the multifunction device 40 includes software of each unit included in the information processing server 10 or 10a and the client device 30 or 30a in FIG. 2 or FIG.

  When using a part or all of the functions of the multi-function device 40, the user is required to present the IC card 50. When the IC card 50 is set in the IC card reader 42 by the user, the user name and password recorded in the IC card 50 are read by the IC card reader 42 (S301). The character string transmission unit 11 of the multi-function device 40 generates a dummy password, and transmits the user name read from the IC card 50 and the dummy password to the touch panel 41 (S302). The UI control unit 31 of the touch panel 41 causes the touch panel 41 to display an authentication screen 310 (see FIG. 6) in which the user name and the dummy password are set.

  The user edits the user name or password as necessary. When the OK button 313 is clicked by the user, the UI control unit 31 transmits an authentication request including the user name and password set on the authentication screen 310 to the multi-function device 40 (S303). Thereafter, processing similar to that in steps S107 and S108 is executed in the multi-function device 40, and an authentication request is transmitted to the authentication server 20 (S304). The authentication processing unit 21 of the authentication server 20 performs authentication, and returns an authentication result to the multi-function device 40 (S305). The multi-function device 40 determines whether the function can be provided according to the authentication result.

  As described above, the same processing procedure as that of the first or second embodiment can be applied to the multi-function device 40. Further, security can be improved without adding a special function to the IC card 50.

  In the third embodiment, a case where a legitimate user edits a password on the login screen 310 may be, for example, a case where the user loses one of a plurality of IC cards 50 owned by the user. . Here, the same user name and password are recorded in a plurality of IC cards 50. In this case, the user updates the password stored in the user information storage unit 22 of the authentication server 20 in order to prevent unauthorized use of the lost IC card. However, for the remaining IC card 50 on hand, the password is not always updated immediately. This is because it is difficult to quickly update the password in the IC card 50 using a dedicated tool.

  When such a user uses the multi-function device 40, the user sets the IC card 50 on hand in the IC card reader 42. Since the user knows that the password recorded in the IC card 50 is not valid, the user edits the password on the login screen 310.

  As mentioned above, although the Example of this invention was explained in full detail, this invention is not limited to such specific embodiment, In the range of the summary of this invention described in the claim, various deformation | transformation・ Change is possible.

1, 2, 3 Information processing system 10, 10a Information processing server 11 Character string transmission unit 12 Collation unit 13 Selection unit 14 Authentication control unit 15 Cache information storage unit 16 Service provision unit 20 Authentication server 21 Authentication processing unit 22 User information storage unit 30, 30a Client device 31 UI control unit 32 Cache information storage unit 40 Multifunction device 41 Touch panel 42 IC card reader 50 IC card 100 Drive device 101 Recording medium 102 Auxiliary storage device 103 Memory device 104 CPU
105 Interface device B bus

Japanese Patent Laid-Open No. 7-093073

Claims (7)

Character string transmitting means for receiving user identification information from the client device and transmitting to the client device a first character string different from all passwords stored in user information storage means for storing passwords for each user;
Collating means for determining whether the second character string received as a password from the client device includes at least a part of the first character string;
An information processing apparatus comprising: a selecting unit that selects a password stored in association with the user identification information as a password used for authentication when a determination result by the collating unit is positive.   The information processing apparatus according to claim 1, wherein the collating unit determines whether the second character string and the first character string include a common character string having a predetermined number of characters or more.   3. The information processing apparatus according to claim 1, wherein the character string transmission unit transmits the first character string including a character whose input is restricted on an authentication screen displayed by the client apparatus to the client apparatus. The information processing apparatus according to claim 3, wherein the character string transmitting unit transmits the first character string including only characters restricted in input on the authentication screen to the client apparatus. The character string transmitting means transmits the first character string having the maximum number of characters that can be input on the authentication screen displayed by the client device to the client device,
The information processing apparatus according to claim 1, wherein the matching unit determines whether the second character string matches the first character string. A character string transmission procedure for receiving user identification information from the client device and transmitting to the client device a first character string different from all passwords stored in the user information storage means for storing a password for each user;
A verification procedure for determining whether the second character string received as a password from the client device includes at least a part of the first character string;
Wherein when verification procedure of the determination result is affirmative, the authentication control method and a selection procedure for selecting a password stored in association with the user identification information as the password used for authentication computer executes. A character string transmission procedure for receiving user identification information from the client device and transmitting to the client device a first character string different from all passwords stored in the user information storage means for storing a password for each user;
A verification procedure for determining whether the second character string received as a password from the client device includes at least a part of the first character string;
Wherein when verification procedure of the determination result is affirmative, the authentication control program for executing a selection procedure for selecting a password stored in association with the user identification information as the password used for authentication to the computer.

Images