WO2022097453A1

WO2022097453A1 - Authentication proxy device, authentication proxy method, and recording medium

Info

Publication number: WO2022097453A1
Application number: PCT/JP2021/038241
Authority: WO
Inventors: 明博寒河江
Original assignee: 日本電気株式会社
Priority date: 2020-11-04
Filing date: 2021-10-15
Publication date: 2022-05-12
Also published as: JP7521598B2; JPWO2022097453A1

Abstract

In order to make it possible to improve safety for the input of authentication information when using a web service, the present invention: relays communications between a server and a client; does not transmit, to the client, a response from the server to a request from the client to the server if the response includes an authentication information request requesting authentication information; if the response from the server includes the authentication information request, performs request processing for making a request to an input source other than the client for input of the authentication information; and transmits the authentication information input from the input source to the server.

Description

Authentication agency device, authentication agency method and recording medium

The present invention relates to an authentication agency device, an authentication agency method, and a recording medium.

The services provided on the website include services that can be used by the user entering authentication information (ID (identification), password, etc.) and logging in. In order to facilitate the input of the authentication information in this case, there is a method of storing the authentication information in the browser installed in the terminal.

In the method of storing the authentication information in the browser, there is a possibility that the authentication information will be stored in the terminal in a situation not intended by the user due to an operation error by the user. If the authentication information is stored in the terminal, the authentication information may be used illegally if the terminal is lost or stolen, or if the terminal is used by an unspecified number of people.

As a countermeasure against these problems, it is conceivable to set the security policy of the terminal to a policy that does not store the authentication information in the browser. However, the method of not storing the authentication information in the browser may reduce the convenience.

For example, you need to enter your authentication information every time you log in. In addition, since the user manages the authentication information, if he / she forgets, he / she may not be able to log in. In addition, if the password is complicated, even a legitimate user may have an account lock due to a password input error.

On the other hand, in the method described in Patent Document 1, the relay server that relays the communication between the terminal and the server stores the authentication information. Thereby, in this method, it is possible to reduce the possibility that the authentication information is illegally used in the case of the loss or theft of the terminal. Therefore, it is possible to improve the security as compared with the case where the browser of the terminal stores the authentication information.

Japanese Patent Application Laid-Open No. 2003-127233

However, in the method described in Patent Document 1, the terminal accepts the input of the authentication information. Therefore, the authentication information may remain on the terminal without the user being aware of it. As a result, if the terminal is lost or stolen, the authentication information remaining on the terminal may be misused. In addition, if software or hardware that monitors key input such as a keylogger is installed in the terminal, the authentication information may be eavesdropped. In particular, in the case of a terminal used by an unspecified number of people, these risks are high.

An object of the present invention is to provide an authentication agency device, an authentication agency method, and a recording medium that make it possible to improve the security in inputting authentication information when using a web service.

In one aspect of the present invention, the authentication agency device relays communication between a server and a client, and a response from the server to a request from the client to the server includes an authentication information request for requesting authentication information. In that case, a relay means that does not send the response to the client, and if the response from the server includes the authentication information request, a request process for requesting the input of the authentication information to an input source other than the client is performed. It is characterized by including an authentication information requesting means and an authentication processing means for transmitting the authentication information input from the input source to the server.

Further, in another aspect of the present invention, the authentication agency method relays communication between a server and a client, and requests authentication information in a response from the server to a request from the client to the server. When the request is included, the response is not sent to the client, and when the response from the server includes the authentication information request, the request processing for requesting the input of the authentication information to the input source other than the client is performed. It is characterized in that the authentication information input from the input source is transmitted to the server.

Further, in another aspect of the present invention, the authentication agency program recorded on a computer-readable recording medium relays the communication between the server and the client to the computer, and the request from the client to the server is described. When the response from the server includes an authentication information request requesting authentication information, the relay function does not send the response to the client, and when the response from the server includes the authentication information request, the authentication information. It is characterized by realizing an authentication information request function that performs request processing that requests an input source other than the client, and an authentication processing function that transmits the authentication information input from the input source to the server. ..

According to the present invention, it is possible to improve the security in inputting authentication information when using a web service.

It is a figure which shows the configuration example of the authentication agency apparatus of 1st Embodiment of this invention. It is a figure which shows the operation example of the authentication agency apparatus of 1st Embodiment of this invention. It is a figure which shows the configuration example of the system including the authentication agency apparatus of the 2nd Embodiment of this invention. It is a figure which shows the configuration example of the authentication agency apparatus of the 2nd Embodiment of this invention. It is a figure which shows the example of the authentication information input screen which the authentication agency apparatus of the 2nd Embodiment of this invention displays on a display means. It is a figure which shows the example of the information which the authentication agency apparatus of the 2nd Embodiment of this invention stores in an authentication information storage part. It is a figure which shows the example of the information which the authentication agency apparatus of the 2nd Embodiment of this invention stores in a qualification information storage part. It is a figure which shows the operation example of the authentication agency apparatus of the 2nd Embodiment of this invention. It is a figure which shows the operation example of the authentication agency apparatus of the 2nd Embodiment of this invention. It is a figure which shows the operation example of the authentication agency apparatus of the 2nd Embodiment of this invention. It is a figure which shows the operation example of the authentication agency apparatus of the 2nd Embodiment of this invention. It is a figure which shows the configuration example of the system including the authentication agency apparatus of the 3rd Embodiment of this invention. It is a figure which shows the configuration example of the authentication agency apparatus of the 3rd Embodiment of this invention. It is a figure which shows the operation example of the authentication agency apparatus of 3rd Embodiment of this invention. It is a figure which shows the hardware configuration example of each embodiment of this invention.

[First Embodiment]
The first embodiment of the present invention will be described.

FIG. 1 shows a configuration example of the authentication agency device 10 of the present embodiment. The authentication agency device 10 of the present embodiment includes a relay unit 11, an authentication information request unit 12, and an authentication processing unit 13.

The relay unit 11 relays the communication between the server and the client. Further, when the response from the server to the request from the client to the server includes the authentication information request requesting the authentication information, the relay unit 11 does not send the response to the client. When the response from the server includes an authentication information request, the authentication information request unit 12 performs request processing for requesting input of authentication information to an input source other than the client. The authentication processing unit 13 transmits the authentication information input from the input source to the server.

By configuring the authentication agent 10 in this way, when the response from the server includes an authentication information request, the authentication agent 10 does not send the response to the client and inputs the authentication information to the input source other than the client. Performs the request processing requested by. Then, the authentication agent 10 transmits the authentication information input from the input source to the server. As a result, the authentication agent 10 can obtain the authentication information without having the user input the authentication information to the client 50. Therefore, it is possible to improve the security in inputting the authentication information when using the web service.

Next, FIG. 2 shows an example of the operation of the authentication agency device 10 of the present embodiment.

The relay unit 11 relays the communication between the server and the client. Further, when the response from the server to the request from the client to the server includes the authentication information request requesting the authentication information, the relay unit 11 does not send the response to the client. When the response from the server includes the authentication information request, the authentication information request unit 12 performs a request process for requesting the input of the authentication information to the input source other than the client (step S101). The authentication processing unit 13 transmits the authentication information input from the input source to the server (step S102).

By operating in this way, when the response from the server includes an authentication information request, the authentication agent 10 does not send the response to the client and requests the input of the authentication information to the input source other than the client. I do. Then, the authentication agent 10 transmits the authentication information input from the input source to the server. As a result, the authentication agent 10 can obtain the authentication information without having the user input the authentication information to the client 50. Therefore, it is possible to improve the security in inputting the authentication information when using the web service.

As described above, in the first embodiment of the present invention, when the response from the server includes the authentication information request, the authentication agent 10 does not send the response to the client and inputs the authentication information to the client. Performs the request processing requested from the input source that is not. Then, the authentication agent 10 transmits the authentication information input from the input source to the server. As a result, the authentication agent 10 can obtain the authentication information without having the user input the authentication information to the client 50. Therefore, it is possible to improve the security in inputting the authentication information when using the web service.

[Second embodiment]
Next, a second embodiment of the present invention will be described.

First, FIG. 3 shows a configuration example of a system including the authentication agency device 20 of the present embodiment.

The client 50 is a device that serves as a client in a client-server system. The client 50 is, for example, an information terminal such as a PC (Personal Computer), a smartphone, or a tablet terminal. The client 50 is directly operated by the user. The client 50 is, for example, a terminal on which a web browser (HTTP (HyperTextTransferProtocol) / HTTPS (HypertextTransferProtocolSecure) client) operates.

The server 60 is a device that serves as a server in a client-server system, such as a web server. The server 60 has an authentication function for authenticating whether or not the client 50 that is the access request source is the client 50 for which access is permitted.

The authentication agency device 20 is a proxy device that relays communication between the client 50 and the server 60. The authentication agent 20 can communicate with one or more clients 50. Communication between the authentication agency device 20 and the client 50 is assumed to be communication based on TCP (Transmission Control Protocol) / IP (Internet Protocol) such as HTTP / HTTPS, but is not limited thereto. For example, the communication between the authentication agent 20 and the client 50 may be performed by a short-range wireless system or by USB (Universal Serial Bus). Further, the authentication agency device 20 can communicate with one or more two or more servers 60. Communication between the authentication agency device 20 and the server 60 is assumed to be communication based on TCP / IP such as HTTP / HTTPS, but is not limited to this.

When the client 50 sends a request to the server 60 and the server 60 requests the authentication information in response to the user's operation, the authentication agency device 20 sends the authentication information to the server 60 instead of the client 50.

The authentication agency device 20 can be realized as a dedicated device, a smartphone, or the like, for example. For example, it is conceivable that the client 50 is a terminal that can be used by an unspecified number of people, and the user possesses the authentication agent 20.

Next, FIG. 4 shows a configuration example of the authentication agency device 20 of the present embodiment. The authentication agency device 20 of the present embodiment includes a relay unit 21, an authentication information request unit 22, and an authentication processing unit 23. Further, the authentication agency device 20 may include a qualification information storage unit 24, an authentication information storage unit 25, and a display means 26. The qualification information storage unit 24, the authentication information storage unit 25, and the display means 26 may be outside the authentication agency device 20.

The authentication information storage unit 25 may be on a cloud service with strong security, for example. Further, the authentication information stored in the authentication information storage unit 25 may be encrypted. When the authentication information storage unit 25 is outside the authentication agent device 20, it is possible to clear or restrict the use of the authentication information of the authentication information storage unit 25 from a predetermined device other than the authentication agent device 20. Therefore, it is possible to reduce the risk of unauthorized use of the authentication information when the authentication agent 20 is stolen or lost. Further, even if the authentication agent used is changed due to damage or equipment replacement, the new authentication agent uses the authentication information stored in the authentication information storage unit 25 used in the old authentication agent. Therefore, the authentication information can be easily taken over.

The relay unit 21 relays the communication between the client 50 and the server 60. When the relay unit 21 receives the request from the client 50 to the server 60, the relay unit 21 transfers the request to the server 60. If the response from the server 60 to the request from the client 50 to the server 60 includes an authentication information request requesting authentication information, the relay unit 21 does not send the response to the client 50. If the response from the server 60 does not include the authentication information request, the relay unit 21 transmits the response to the client 50.

When the response from the server 60 includes an authentication information request, the authentication information request unit 22 performs request processing for requesting the input of authentication information to an input source other than the client 50. In the case of the present embodiment, the request process is a process of displaying a screen requesting input of authentication information on the display means 26. The display means 26 is an internal or external display of the authentication agency device 20 or the like.

In addition, the authentication information request unit 22 accepts the input of authentication information. Further, the authentication information request unit 22 stores the input authentication information in the authentication information storage unit 25. The authentication information requesting unit 22 may store the authentication information in the authentication information storage unit 25 when the authentication result received from the server 60 indicates the success of the authentication. The authentication information request unit 22 stores the authentication information in the authentication information storage unit 25 in association with the identification information of the server 60 to which the authentication information is requested. Further, in the case of the present embodiment, the authentication information is input via an input device such as a keyboard included in the authentication agent device 20 or a device for reading a fingerprint image or a face image.

FIG. 5 shows an example of an authentication information input screen that requests input of authentication information. Information indicating the display contents on the authentication information input screen is transmitted from the server 60. In the example of FIG. 5, the authentication information input screen shows the URL (Uniform Resource Locator) of the access request destination, the information of the client 50 of the access request transmission source (“request transmission terminal”), and the items of the authentication information requested from the server 60. including. The screen also includes screen items for prompting the user to enter authentication information. The example of FIG. 5 is an example in which the authentication information is a user ID, a password, and a one-time password, but the authentication information is not limited to these.

Further, FIG. 6 shows an example of authentication information stored in the authentication information storage unit 25. In the example of FIG. 6, the authentication information is an authentication user ID and an authentication password. The authentication information is associated with the server ID of the server 60 of the access request destination. Further, an authentication information ID that uniquely identifies the authentication information is assigned to each of the authentication information.

Further, the terminal user ID is further associated with the authentication information. The terminal user ID is a user ID that can use the authentication information. The terminal user ID is, for example, the ID of the user who is using the smartphone when the authentication agent 20 is a smartphone, or the ID of the user who is logged in to the PC when the authentication agent 20 is a PC. There may be. The terminal user ID is used when limiting the users who can use the authentication information. By limiting the users who can use the authentication information in this way, it is possible to reduce the possibility that the authentication information is used illegally when the client 50 is shared by a plurality of people.

When the authentication information is input to the authentication information request unit 22, the authentication processing unit 23 transmits the input authentication information to the server 60.

Further, when the response from the server 60 includes the authentication information request and the authentication information for the server 60 is stored in the authentication information storage unit 25, the authentication processing unit 23 acquires the authentication information from the authentication information storage unit 25. , The acquired authentication information is transmitted to the server 60. Further, in this case, the authentication information requesting unit 22 may display the authentication information input screen including the acquired authentication information on the display means 26. Then, when the user inputs the input according to the operation of confirming the authentication information, the authentication processing unit 23 may transmit the input authentication information to the server 60.

Further, when the authentication result received from the server 60 indicates the success of the authentication, the authentication processing unit 23 stores the credential information included in the authentication result in the credential information storage unit 24. The authentication processing unit 23 stores the credential information in the credential information storage unit 24 in association with the identification information of the client 50 to which the response is sent. The credential information is also called an access token. Credentials are information for the client 50 to access the protected resource.

FIG. 7 shows an example of information stored in the qualification information storage unit 24. In the example of FIG. 7, the credential information is associated with the server ID of the server 60 that is the source of the authentication result. The qualification information is also associated with the client ID of the client 50 to which the authentication result is sent. Each credential is given a credential ID that uniquely identifies the credential. The server ID is, for example, a host name or an IP (Internet Protocol) address of the server 60. The client ID is, for example, the terminal name of the client 50.

Further, the relay unit 21 assigns the qualification information to the communication from the client 50 to the server 60 based on the qualification information stored in the qualification information storage unit 24. As a result, the server 60 can grasp that the communication from the client 50 is the communication from the client 50 that has succeeded in authentication, that is, the client 50 that has the access authority.

Further, the relay unit 21 deletes the credential information from the authentication result received from the server 60, and sends the authentication result from which the credential information is deleted to the client 50.

By configuring the authentication agent 20 in this way, when the response from the server includes an authentication information request, the authentication agent 20 does not send the response to the client, and the input source of the authentication information is not the client. Performs the request processing requested by. Then, the authentication agent 20 transmits the authentication information input from the input source to the server. As a result, the authentication agent 20 can obtain the authentication information without having the user input the authentication information to the client 50. Therefore, it is possible to improve the security in inputting the authentication information when using the web service.

Next, an operation example of the authentication agency device 20 of the present embodiment will be described with reference to FIGS. 8 to 11. FIG. 8 is an operation example of the authentication agent 20 when a request to the server 60 is received from the client 50. Further, FIG. 9 is an operation example of the authentication agency device 20 when a response is received from the server 60. Further, FIG. 10 is an operation example of the authentication agency device 20 when the authentication information is input. Further, FIG. 11 is an operation example of the authentication agency device 20 when the authentication result is received from the server 60.

First, the relay unit 21 of the authentication agency device 20 receives the request to the server 60 from the client 50 (step S201 in FIG. 8). When the credential information between the client 50 and the server 60 is stored in the credential information storage unit 24 (YES in step S202), the relay unit 21 assigns the credential information to the received request (step S203). Then, the relay unit 21 transmits the request to the server 60 (step S204).

The relay unit 21 receives the response from the server 60 (step S301 in FIG. 9). When the response from the server 60 includes an authentication information request requesting authentication information (YES in step S302), the relay unit 21 does not send the response to the client 50. Further, the authentication information request unit 22 performs request processing for requesting the input of authentication information to an input source other than the client 50. In the case of the present embodiment, the request process is a process of displaying the authentication information input screen requesting the input of the authentication information on the display means 26 (step S303).

Further, when the authentication information for the server 60 that is the transmission source of the response is stored in the authentication information storage unit 25 (YES in step S304), the authentication information request unit 22 acquires the authentication information from the authentication information storage unit 25. .. Then, the authentication information requesting unit 22 causes the display means 26 to display the authentication information input screen including the acquired authentication information (step S305).

When the response received by the relay unit 21 does not include the authentication information request (NO in step S302), the relay unit 21 transmits the response to the client 50 (step S306). If the response includes the credential information, the relay unit 21 sends the response from which the credential information is deleted to the client 50.

When the input content on the authentication information input screen is confirmed by the user, the authentication information is input to the authentication information request unit 22 (step S401 in FIG. 10). The authentication information request unit 22 accepts the input of the authentication information, and when the same authentication information as the input authentication information is not stored in the authentication information storage unit 25 (step S402), the input authentication information is stored in the authentication information storage unit. It is stored in 25 (step S403). The authentication information request unit 22 stores the authentication information in the authentication information storage unit 25 in association with the identification information of the server 60 that requests the authentication information. Then, the authentication processing unit 23 transmits the input authentication information to the server 60 (step S404).

Further, the relay unit 21 receives the authentication result from the server 60 (step S405 in FIG. 11). Then, when the authentication result indicates the success of the authentication (YES in step S406), the authentication processing unit 23 stores the qualification information included in the authentication result in the qualification information storage unit 24 (step S407). The authentication processing unit 23 stores the qualification information in the qualification information storage unit 24 in association with the identification information of the server 60 that is the source of the authentication result and the identification information of the client 50 that is the destination. Then, the relay unit 21 deletes the credential information from the authentication result transmitted from the server 60, and transmits the authentication result from which the credential information is deleted to the client 50 (step S408).

Further, after the authentication is successful, the relay unit 21 assigns the credential information to the communication from the client 50 to the server 60 based on the credential information stored in the credential information storage unit 24. More specifically, when a request is received from the client 50 (step S201 in FIG. 8), the relay unit 21 transfers the credential information between the requesting client 50 and the requesting server 60 from the credential information storage unit 24. get. Further, the relay unit 21 assigns the acquired qualification information to the request (YES in step S202, step S203). Then, the relay unit 21 transmits a request to which the qualification information is given to the server 60 (step S204).

By operating in this way, when the response from the server includes an authentication information request, the authentication agent 20 does not send the response to the client and requests the input of the authentication information to the input source other than the client. I do. Then, the authentication agent 20 transmits the authentication information input from the input source to the server. As a result, the authentication agent 20 can obtain the authentication information without having the user input the authentication information to the client 50. Therefore, it is possible to improve the security in inputting the authentication information when using the web service.

As described above, in the second embodiment of the present invention, when the response from the server includes the authentication information request, the authentication agent 20 does not send the response to the client and inputs the authentication information to the client. Performs the request processing requested from the input source that is not. Then, the authentication agent 20 transmits the authentication information input from the input source to the server. As a result, the authentication agent 20 can obtain the authentication information without having the user input the authentication information to the client 50. Therefore, it is possible to improve the security in inputting the authentication information when using the web service.

Further, the authentication agent 20 of the present embodiment stores the authentication information in the authentication information storage unit 25, and transmits the authentication information stored in the authentication information storage unit 25 to the server 60. Therefore, it is possible to obtain the same convenience as when the authentication information is stored in the browser.

Further, the authentication agent 20 of the present embodiment stores the credential information not in the client 50 but in the credential information storage unit 24, deletes the credential information from the authentication result received from the server 60, and the authentication result in which the credential information is deleted. To the client 50. Therefore, it becomes possible to further improve the security when using the web service.

[Third embodiment]
Next, a third embodiment of the present invention will be described.

First, FIG. 12 shows a configuration example of a system including the authentication agency device 30 of the present embodiment. The system shown in FIG. 12 includes an authentication agent 30, a client 50, and a server 60.

In this embodiment, the server 60 has a function of issuing authentication information. The authentication agent 30 stores the authentication information issued by the server 60 in the authentication information storage unit 25.

More specifically, the server 60 receives, for example, a unique key from the authentication agent 30. The unique key is, for example, the ID of the SIM (Subscriber Identity Module) card of the client 50. The server 60 confirms the validity of the authentication agent 30 based on the unique key. Then, the server 60 generates the authentication information, and inputs the generated authentication information to the authentication agent 30.

In the method of inputting and storing the authentication information generated by the server 60 in the authentication agent device 30 as in the present embodiment, the user does not need to store the authentication information. Therefore, the server 60 can generate an ID or password having a large number of bits (for example, 100 bits or more). As a result, the server 60 can generate robust authentication information. In addition, the user can log in to the service without being aware of the authentication information.

Next, FIG. 13 shows a configuration example of the authentication agency device 30 of the present embodiment. The authentication agency device 30 of the present embodiment includes a relay unit 21, an authentication information request unit 32, and an authentication processing unit 33. Further, the authentication agency device 30 may include a qualification information storage unit 24 and an authentication information storage unit 25. Since the relay unit 21, the qualification information storage unit 24, and the authentication information storage unit 25 are the same as those in the second embodiment, the description thereof will be omitted. Further, the authentication information requesting unit 32 and the authentication processing unit 33 are the same as the authentication information requesting unit 22 and the authentication processing unit 23 of the second embodiment except for the items described below, and thus the description thereof will be omitted.

When the response from the server 60 includes an authentication information request, the authentication information request unit 32 performs request processing for requesting the input of authentication information to an input source other than the client 50. In the case of the present embodiment, the request process is a process of transmitting an authentication information issuance request requesting the issuance of the authentication information to the server 60. The authentication information request unit 32 performs request processing when the response includes an authentication information request and the authentication information of the server 60 is not stored in the authentication information storage unit 25.

The authentication processing unit 33 stores the authentication information input from the server 60 in the authentication information storage unit 25. Further, when the response includes the authentication information request and the authentication information for the server 60 is stored in the authentication information storage unit 25, the authentication processing unit 33 acquires the authentication information from the authentication information storage unit 25 and acquires the authentication. Information is transmitted to the server 60.

By configuring the authentication agent 30 in this way, when the response from the server includes an authentication information request, the authentication agent 30 does not send the response to the client and inputs the authentication information to the input source other than the client. Performs the request processing requested by. Then, the authentication agent 30 transmits the authentication information input from the input source to the server. As a result, the authentication agent 30 can obtain the authentication information without having the user input the authentication information to the client 50. Therefore, it is possible to improve the security in inputting the authentication information when using the web service.

Next, an operation example of the authentication agency device 30 of the present embodiment will be described with reference to FIGS. 14 and 10. Since the operation of the authentication agent 30 when the request to the server 60 is received from the client 50 is the same as that of the second embodiment (FIG. 8), the description thereof will be omitted. Further, since the operation example of the authentication agent device 30 when the authentication result is received from the server is the same as that of the second embodiment (FIG. 11), the description thereof will be omitted. FIG. 14 is an operation example of the authentication agency device 30 when a response is received from the server 60.

The relay unit 21 receives the response from the server 60 (step S501 in FIG. 14). When the response from the server 60 includes an authentication information request requesting authentication information (YES in step S502), the relay unit 21 does not send the response to the client 50. Further, the authentication information request unit 32 performs request processing for requesting the input of authentication information to an input source other than the client 50. In the case of the present embodiment, the request process transmits an authentication information issuance request to the server 60 when the authentication information for the server 60 that is the source of the response is not stored in the authentication information storage unit 25 (NO in step S503). This is a process (step S504).

Further, when the authentication information for the server 60 that is the transmission source of the response is stored in the authentication information storage unit 25 (YES in step S503), the authentication processing unit 33 acquires the authentication information from the authentication information storage unit 25. Then, the authentication processing unit 33 transmits the acquired authentication information to the server 60 (step S505).

When the response received by the relay unit 21 does not include the authentication information request (NO in step S502), the relay unit 21 transmits the response to the client 50 (step S506). At this time, if the response includes the credential information, the relay unit 21 transmits the response from which the credential information has been deleted to the client 50.

When the server 60 issues the authentication information, the relay unit 21 receives the authentication information from the server 60 (step S401 in FIG. 10). When the authentication information storage unit 25 does not store the same authentication information as the authentication information input from the server 60 (NO in step S402), the authentication information request unit 32 stores the input authentication information in the authentication information storage unit 25. Store it (step S403). The authentication information request unit 22 stores the authentication information in the authentication information storage unit 25 in association with the identification information of the server 60 that requests the authentication information. Then, the authentication processing unit 23 transmits the input authentication information to the server 60 (step S404).

By operating in this way, when the response from the server includes an authentication information request, the authentication agent 30 does not send the response to the client and requests the input of the authentication information to the input source other than the client. I do. Then, the authentication agent 30 transmits the authentication information input from the input source to the server. As a result, the authentication agent 30 can obtain the authentication information without having the user input the authentication information to the client 50. Therefore, it is possible to improve the security in inputting the authentication information when using the web service.

As described above, in the third embodiment of the present invention, when the response from the server includes the authentication information request, the authentication agent 20 does not send the response to the client and inputs the authentication information to the client. Performs the request processing requested from the input source that is not. Then, the authentication agent 30 transmits the authentication information input from the input source to the server. As a result, the authentication agent 30 can obtain the authentication information without having the user input the authentication information to the client 50. Therefore, it is possible to improve the security in inputting the authentication information when using the web service.

Further, the authentication agent 30 of the present embodiment sends an authentication information issuance request to the server 60, and stores the authentication information transmitted from the server 60 in the authentication information storage unit 25. This makes it possible to use more robust authentication information. In addition, the user does not need to input the authentication information. Therefore, it becomes possible to further improve the security in inputting the authentication information when using the web service.

[Hardware configuration example]
An example of a configuration of hardware resources for realizing the authentication agency device (10, 20) in each embodiment of the present invention described above by using one information processing device (computer) will be described. The authentication agency device may be realized by using at least two or more information processing devices physically or functionally. Further, the authentication agency device may be realized as a dedicated device, or a general-purpose device may be used. Further, only a part of the functions of the authentication agency device may be realized by using the information processing device.

FIG. 15 is a diagram schematically showing a hardware configuration example of an information processing device capable of realizing the authentication agency device of each embodiment of the present invention. The information processing device 90 includes a communication interface 91, an input / output interface 92, an arithmetic unit 93, a storage device 94, a non-volatile storage device 95, and a drive device 96.

For example, the relay unit 11 in FIG. 1 can be realized by the communication interface 91 and the arithmetic unit 93. Further, the authentication information request unit 12 and the authentication processing unit 13 can be realized by the arithmetic unit 93.

The communication interface 91 is a communication means for the authentication agent device of each embodiment to communicate with an external device at least one of wired and wireless. When the authentication agency device is realized by using at least two information processing devices, the devices may be connected so as to be able to communicate with each other via the communication interface 91.

The input / output interface 92 is a man-machine interface such as a keyboard as an example of an input device and a display as an output device.

The arithmetic unit 93 is realized by, for example, an arithmetic processing unit such as a CPU (Central Processing Unit) or a microprocessor, or a plurality of electric circuits. The arithmetic unit 93 can, for example, read various programs stored in the non-volatile storage device 95 into the storage device 94 and execute processing according to the read programs.

The storage device 94 is a memory device such as a RAM (RandomAccessMemory) that can be referred from the arithmetic unit 93, and stores programs, various data, and the like. The storage device 94 may be a volatile memory device.

The non-volatile storage device 95 is a non-volatile storage device such as a ROM (Read Only Memory), a flash memory, etc., and can store various programs, data, and the like.

The drive device 96 is, for example, a device that processes data reading and data writing recorded on a recording medium 97, which will be described later.

The recording medium 97 is an arbitrary recording medium capable of recording data, such as an optical disk, a magneto-optical disk, or a semiconductor flash memory.

In each embodiment of the present invention, for example, the information processing apparatus 90 illustrated in FIG. 15 constitutes an authentication agent, and the authentication agent is supplied with a program capable of realizing the functions described in each of the above embodiments. It may be realized by doing.

In this case, the embodiment can be realized by the arithmetic unit 93 executing the program supplied to the authentication agent. Further, it is also possible to configure some functions of the information processing apparatus 90, not all of the authentication agency apparatus.

Further, the program may be recorded in the recording medium 97, and the program may be appropriately stored in the non-volatile storage device 95 at the shipping stage, the operation stage, or the like of the authentication agency device. In this case, as the supply method of the above program, a method of installing the program in the authentication agency device by using an appropriate jig may be adopted at the manufacturing stage before shipment, the operation stage, or the like. Further, as the method of supplying the above program, a general procedure such as a method of downloading from the outside via a communication line such as the Internet may be adopted.

A part or all of the above embodiment may be described as in the following appendix, but is not limited to the following.

(Appendix 1)
A relay that relays communication between a server and a client and does not send the response to the client when the response from the server to a request from the client to the client includes an authentication information request requesting authentication information. Means and
When the response from the server includes the authentication information request, an authentication information requesting means that performs request processing for requesting the input of the authentication information to an input source other than the client.
An authentication agent device including an authentication processing means for transmitting the authentication information input from the input source to the server.

(Appendix 2)
When the authentication result received from the server indicates the success of the authentication, the authentication processing means stores the credential information included in the authentication result in the credential information storage unit.
The authentication agent according to Appendix 1, wherein the relay means imparts the qualification information to communication from the client to the server.

(Appendix 3)
The authentication agent according to Appendix 2, wherein the relay means transmits the authentication result from which the qualification information has been deleted to the client.

(Appendix 4)
The authentication information requesting means stores the input authentication information in the authentication information storage unit, and stores the input authentication information in the authentication information storage unit.
When the response includes the authentication information request and the authentication information for the server is stored in the authentication information storage unit, the authentication processing means acquires the authentication information from the authentication information storage unit and acquires the authentication information. The authentication information is transmitted to the server, and the authentication information is transmitted to the server.
The appendix 1 is characterized in that the authentication information requesting means performs the request processing when the response includes the authentication information request and the authentication information for the server is not stored in the authentication information storage unit. The authentication agency device according to any one of Appendix 3.

(Appendix 5)
The authentication agent according to any one of Supplementary note 1 to Supplementary note 4, wherein the request process is a process of displaying a screen requesting input of the authentication information on a display means.

(Appendix 6)
The authentication information requesting means stores the input authentication information in the authentication information storage unit, the response includes the authentication information request, and the authentication information for the server is stored in the authentication information storage unit. In this case, the authentication agency device according to Appendix 5, wherein the screen including the authentication information acquired from the authentication information storage unit is displayed on the display means.

(Appendix 7)
The authentication agency device according to any one of Supplementary note 1 to Supplementary note 4, wherein the request process is a process of transmitting an authentication information issuance request requesting issuance of the authentication information to the server.

(Appendix 8)
If the response from the server to the request from the client to the server includes an authentication information request requesting authentication information, the communication between the server and the client is relayed, and the response is not sent to the client. ,
When the response from the server includes the authentication information request, a request process for requesting the input of the authentication information to an input source other than the client is performed.
An authentication agency method comprising transmitting the authentication information input from the input source to the server.

(Appendix 9)
When the authentication result received from the server indicates the success of the authentication, the credential information included in the authentication result is stored in the credential information storage unit.
The authentication agency method according to Appendix 8, wherein the qualification information is given to the communication from the client to the server.

(Appendix 10)
The authentication agency method according to Appendix 9, wherein the authentication result from which the qualification information has been deleted is transmitted to the client.

(Appendix 11)
The input authentication information is stored in the authentication information storage unit, and the input is stored in the authentication information storage unit.
When the response includes the authentication information request and the authentication information for the server is stored in the authentication information storage unit, the authentication information is acquired from the authentication information storage unit, and the acquired authentication information is used as the authentication information. Send to the server
The response includes the authentication information request, and the request processing is performed when the authentication information for the server is not stored in the authentication information storage unit. The described authentication agency method.

(Appendix 12)
The authentication agency method according to any one of Supplementary note 8 to Supplementary note 11, wherein the request process is a process of displaying a screen requesting input of the authentication information on the display means.

(Appendix 13)
When the input authentication information is stored in the authentication information storage unit, the response includes the authentication information request, and the authentication information for the server is stored in the authentication information storage unit, the authentication information storage unit The authentication agency method according to Appendix 12, wherein the screen including the authentication information obtained from the above is displayed on the display means.

(Appendix 14)
The authentication agency method according to any one of Supplementary note 8 to Supplementary note 11, wherein the request process is a process of transmitting an authentication information issuance request requesting issuance of the authentication information to the server.

(Appendix 15)
On the computer
A relay that relays communication between a server and a client and does not send the response to the client when the response from the server to a request from the client to the client includes an authentication information request requesting authentication information. Functions and
When the response from the server includes the authentication information request, an authentication information request function that performs request processing for requesting the input of the authentication information to an input source other than the client, and an authentication information request function.
A computer-readable recording medium on which an authentication agency program is recorded, which realizes an authentication processing function of transmitting the authentication information input from the input source to the server.

(Appendix 16)
When the authentication result received from the server indicates the success of the authentication, the authentication processing function stores the credential information included in the authentication result in the credential information storage unit.
The relay function is a computer-readable recording medium recording the authentication agency program according to Appendix 15, characterized in that the credential information is given to the communication from the client to the server.

(Appendix 17)
The relay function is a computer-readable recording medium recording the authentication agency program according to Appendix 16, wherein the authentication result from which the credential information has been deleted is transmitted to the client.

(Appendix 18)
The authentication information request function stores the input authentication information in the authentication information storage unit.
When the response includes the authentication information request and the authentication information for the server is stored in the authentication information storage unit, the authentication processing function acquires the authentication information from the authentication information storage unit and acquires the authentication information. The authentication information is transmitted to the server, and the authentication information is transmitted to the server.
The appendix 15 is characterized in that the authentication information request function performs the request processing when the response includes the authentication information request and the authentication information for the server is not stored in the authentication information storage unit. A computer-readable recording medium on which the authentication agency program according to any one of Appendix 17 is recorded.

(Appendix 19)
The request process is a computer-readable record recording the authentication agent program according to any one of Supplementary note 15 to Supplementary note 18, characterized in that the screen for requesting the input of the authentication information is displayed on the display means. Medium.

(Appendix 20)
The authentication information request function stores the input authentication information in the authentication information storage unit, the response includes the authentication information request, and the authentication information for the server is stored in the authentication information storage unit. In this case, a computer-readable recording medium recording the authentication agency program according to Appendix 19, wherein the screen including the authentication information acquired from the authentication information storage unit is displayed on the display means.

(Appendix 21)
The request process is a process of transmitting an authentication information issuance request requesting the issuance of the authentication information to the server. Possible recording medium.

Although the invention of the present application has been described above with reference to the embodiment, the invention of the present application is not limited to the above embodiment. Various changes that can be understood by those skilled in the art can be made within the scope of the present invention in terms of the configuration and details of the present invention.

This application claims priority on the basis of Japanese application Japanese Patent Application No. 2020-184082 filed on November 4, 2020, and incorporates all of its disclosures herein.

10, 20, 30

Authentication agency device

11, 21

Relay unit

12, 22, 32 Authentication

information request unit

13, 23, 33 Authentication processing unit 24 Authentication information storage unit 25 Authentication information storage unit 26 Display means 50 Client 60 Server 90 Information processing Device 91 Communication interface 92 Information processing interface 93 Computing device 94 Storage device 95 Non-volatile storage device 96 Drive device 97 Recording medium

Claims

If the response from the server to the request from the client to the server includes an authentication information request requesting authentication information, the communication between the server and the client is relayed, and the response is not sent to the client. ,
When the response from the server includes the authentication information request, a request process for requesting the input of the authentication information to an input source other than the client is performed.
An authentication agency method comprising transmitting the authentication information input from the input source to the server.
When the authentication result received from the server indicates the success of the authentication, the credential information included in the authentication result is stored in the credential information storage unit.
The authentication agency method according to claim 1, wherein the qualification information is given to the communication from the client to the server.
The authentication agency method according to claim 2, wherein the authentication result from which the qualification information has been deleted is transmitted to the client.
The input authentication information is stored in the authentication information storage unit, and the input is stored in the authentication information storage unit.
When the response includes the authentication information request and the authentication information for the server is stored in the authentication information storage unit, the authentication information is acquired from the authentication information storage unit, and the acquired authentication information is used as the authentication information. Send to the server
Any of claims 1 to 3, wherein the request processing is performed when the response includes the authentication information request and the authentication information for the server is not stored in the authentication information storage unit. The authentication agency method described in Kana.
The authentication agency method according to any one of claims 1 to 4, wherein the request process is a process of displaying a screen requesting input of the authentication information on the display means.
When the input authentication information is stored in the authentication information storage unit, the response includes the authentication information request, and the authentication information for the server is stored in the authentication information storage unit, the authentication information storage unit The authentication agency method according to claim 5, wherein the screen including the authentication information obtained from the above is displayed on the display means.
The authentication agency method according to any one of claims 1 to 4, wherein the request process is a process of transmitting an authentication information issuance request requesting issuance of the authentication information to the server.
On the computer
A relay that relays communication between a server and a client and does not send the response to the client when the response from the server to a request from the client to the client includes an authentication information request requesting authentication information. Functions and
When the response from the server includes the authentication information request, an authentication information request function that performs request processing for requesting the input of the authentication information to an input source other than the client, and an authentication information request function.
A computer-readable recording medium on which an authentication agency program is recorded, which realizes an authentication processing function of transmitting the authentication information input from the input source to the server.
When the authentication result received from the server indicates the success of the authentication, the authentication processing function stores the credential information included in the authentication result in the credential information storage unit.
The relay function is a computer-readable recording medium recording the authentication agency program according to claim 8, wherein the credential information is given to the communication from the client to the server.
The relay function is a computer-readable recording medium recording the authentication agency program according to claim 9, wherein the authentication result from which the credential information has been deleted is transmitted to the client.
The authentication information request function stores the input authentication information in the authentication information storage unit.
When the response includes the authentication information request and the authentication information for the server is stored in the authentication information storage unit, the authentication processing function acquires the authentication information from the authentication information storage unit and acquires the authentication information. The authentication information is transmitted to the server, and the authentication information is transmitted to the server.
A claim characterized in that the authentication information request function performs the request processing when the response includes the authentication information request and the authentication information for the server is not stored in the authentication information storage unit. A computer-readable recording medium on which the authentication agency program according to any one of claims 8 to 10 is recorded.
The request process is a process of displaying a screen requesting input of the authentication information on the display means, and the computer can read the authentication agent program according to any one of claims 8 to 11. Recording medium.
The authentication information request function stores the input authentication information in the authentication information storage unit, the response includes the authentication information request, and the authentication information for the server is stored in the authentication information storage unit. In this case, a computer-readable recording medium recording the authentication agency program according to claim 12, wherein the screen including the authentication information acquired from the authentication information storage unit is displayed on the display means.
The authentication agency program according to any one of claims 8 to 11, wherein the request process is a process of transmitting an authentication information issuance request requesting issuance of the authentication information to the server. A computer-readable recording medium.
A relay that relays communication between a server and a client and does not send the response to the client when the response from the server to a request from the client to the client includes an authentication information request requesting authentication information. Means and
When the response from the server includes the authentication information request, an authentication information requesting means that performs request processing for requesting the input of the authentication information to an input source other than the client.
An authentication agent device including an authentication processing means for transmitting the authentication information input from the input source to the server.
When the authentication result received from the server indicates the success of the authentication, the authentication processing means stores the credential information included in the authentication result in the credential information storage unit.
The authentication agent according to claim 15, wherein the relay means imparts the qualification information to communication from the client to the server.
The authentication agent according to claim 16, wherein the relay means transmits the authentication result from which the qualification information has been deleted to the client.
The authentication information requesting means stores the input authentication information in the authentication information storage unit, and stores the input authentication information in the authentication information storage unit.
When the response includes the authentication information request and the authentication information for the server is stored in the authentication information storage unit, the authentication processing means acquires the authentication information from the authentication information storage unit and acquires the authentication information. The authentication information is transmitted to the server, and the authentication information is transmitted to the server.
A claim characterized in that the authentication information requesting means performs the request processing when the response includes the authentication information request and the authentication information for the server is not stored in the authentication information storage unit. The authentication agency device according to any one of 15 to 17.
The authentication agent according to any one of claims 15 to 18, wherein the request process is a process of displaying a screen requesting input of the authentication information on the display means.
The authentication information requesting means stores the input authentication information in the authentication information storage unit, the response includes the authentication information request, and the authentication information for the server is stored in the authentication information storage unit. The authentication agent according to claim 19, wherein the display means displays the screen including the authentication information acquired from the authentication information storage unit.
The authentication agency device according to any one of claims 15 to 18, wherein the request process is a process of transmitting an authentication information issuance request requesting the issuance of the authentication information to the server.