JP7225965B2 - Information processing device, proxy login system, proxy login method, and proxy login program - Google Patents

Description

The present invention relates to an information processing device, a proxy login system, a proxy login method, and a proxy login program.

A single sign-on (English: Single Sign-On, abbreviation: SSO) technology that enables login access to a plurality of business applications with one-time authentication is conventionally known. The single sign-on technology is roughly classified into the following three methods.

The first is a method in which each business application does not have an authentication function, and all authentications are performed by a single sign-on system. The second is a method in which a single sign-on system inputs authentication information on behalf of the authentication function of each business application. A third method is to send information indicating that the single sign-on system has authenticated to each business application, and trust it on the business application side.

By the way, when trying to introduce the first single sign-on system, it is often the case that business applications in operation already have individual authentication functions, and this method cannot be adopted. In addition, as in the third case above, in order to send information indicating that authentication has been performed to each business application, the business application must support a special protocol such as SAML or OpenID, and this method cannot be adopted. There is

On the other hand, the second proxy login method, single sign-on, has no difference from the user's operation of logging in from the business application side, so it can be introduced without modifying the business application for single sign-on. There are advantages.

Further, the single sign-on of the proxy login method is further divided into two types according to the method of proxy login. The first is a method of inputting authentication information to a business application by proxy on a client terminal. The second method is to relay the communication of the business web application on the reverse proxy or business web server, and send the authentication header (BASIC authentication, integrated Windows authentication) and POST data (FORM authentication) to the business application. be.

The latter method of logging in on behalf of a reverse proxy or a business web server can only be used for web-type business applications. On the other hand, in the former method of proxy input on the client terminal, when the window of the business application is displayed, the proxy login software on the terminal performs proxy input for some reason. It is possible to correspond to the application.

Further, the method of performing proxy input on the client terminal can be divided into a method in which proxy login software resides in the client terminal and a method in which it does not reside.

In the resident system, proxy login software is introduced into the client terminal, and the window displayed on the screen is constantly monitored by the proxy login software. Then, when the login window of the business application is activated, the substitute login software detects the login window and substitutes the authentication information to the login form. As a result, the user can log in to the business application without performing any operation other than the operation of the business application.

On the other hand, in the non-resident system, the user activates substitute login software installed in the client terminal at any timing. Then, after starting the login window of the business application, the proxy login software is operated, and the authentication information is entered in the login form on behalf of the user. In this method, the user must operate proxy login software in addition to operating the business application.

Japanese Patent Application Laid-Open No. 2002-200003 discloses a method in which proxy login software is downloaded when a user accesses a business application, and the proxy login software inputs authentication information to the business application as a proxy. In this method, the user can log in as a substitute just by activating the business application, as in the case of the resident method.

Japanese Patent Application Laid-Open No. 2007-200217

It should be noted that the disclosure of the prior art document mentioned above is incorporated herein by reference. The following analysis was made by the inventors.

The resident proxy log-in software does not require user operation, and allows proxy input to any business application window, but it must always monitor the window. As a result, resources (mainly CPU) of the client terminal are consumed. In order to log in as an agent, the value to be entered as an agent differs for each business application type and window type (login window, password change window, etc.), so it is necessary to accurately specify the window displayed on the screen. be.

SUMMARY OF THE INVENTION It is an object of the present invention to provide an information processing apparatus, proxy login system, proxy login method, and proxy login program that contribute to reducing the load on a client terminal.

According to a first aspect of the present invention, an authentication unit that performs single sign-on authentication for accessing usage authentication information in which ID information and password information for logging into an application and definition information of a login window are associated; , a screen detection unit that detects whether or not a window corresponding to the login window definition information is displayed on a screen at a predetermined frequency; and the login window definition information for the window detected by the screen detection unit. a proxy input unit for proxy input of associated ID information and password information; an operation event acquired from an operating system; An information processing apparatus is provided, comprising: an event detection unit that notifies, and a frequency change unit that changes the predetermined frequency in the screen detection unit for a certain period of time based on the notification from the event detection unit. be.

According to a second aspect of the present invention, use authentication information in which ID information and password information for logging in to an application and definition information of a login window are associated, and personal authentication information for accessing the use authentication information and an authentication information storage unit that stores the received authentication information and the authentication information stored in the authentication information storage unit, and if the matching is successful, the authentication information distribution that distributes the use authentication information. and an authentication information server having an authentication information server, and an authentication unit that performs single sign-on authentication by transmitting the entered personal authentication information to the authentication information server and receiving the use authentication information from the authentication information server. , a screen detection unit that detects whether or not a window corresponding to the login window definition information is displayed on a screen at a predetermined frequency; and the login window definition information for the window detected by the screen detection unit. a proxy input unit for proxy input of associated ID information and password information; an operation event acquired from an operating system; An information processing apparatus comprising: an event detection unit that notifies, and a frequency change unit that changes the predetermined frequency in the screen detection unit for a certain period of time based on the notification from the event detection unit. A surrogate login system is provided.

According to a third aspect of the present invention, an authentication step of performing single sign-on authentication for accessing usage authentication information in which ID information and password information for logging into an application and definition information of a login window are associated; , a screen detection step of detecting whether or not a window corresponding to the login window definition information is displayed on the screen at a predetermined frequency; an alternate input step of alternately inputting associated ID information and password information; and obtaining operation events from an operating system, and detecting the predetermined operation event when a predetermined operation event is detected among the obtained operation events. and a frequency change step of changing the predetermined frequency in the screen detection step for a certain period of time based on the notification in the event detection step. be.

According to a fourth aspect of the present invention, an authentication step of performing single sign-on authentication for accessing usage authentication information in which ID information and password information for logging into an application and definition information of a login window are associated; , a screen detection step of detecting whether or not a window corresponding to the login window definition information is displayed on the screen at a predetermined frequency; an alternate input step of alternately inputting associated ID information and password information; and obtaining operation events from an operating system, and detecting the predetermined operation event when a predetermined operation event is detected among the obtained operation events. An information processing device for operating the application executes an event detection step of notifying, and a frequency changing step of changing the predetermined frequency in the screen detection step for a certain period of time based on the notification in the event detection step. There is provided a proxy login program characterized by allowing

According to each aspect of the present invention, an information processing apparatus, proxy login system, proxy login method, and proxy login program that contribute to reducing the load on a client terminal are provided.

FIG. 1 is a diagram for explaining a mode of single sign-on of the substitute login method. FIG. 2 is a diagram illustrating a schematic configuration of the information processing apparatus according to the embodiment; FIG. 3 is a diagram showing an example of changing the detection frequency. FIG. 4 is a flow diagram showing a proxy login method according to an embodiment of the present invention. FIG. 5 is a diagram illustrating an example of a hardware configuration of an information processing apparatus; FIG. 6 is a diagram showing a schematic configuration of the proxy login system according to the embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention is not limited by the embodiments described below. Moreover, in each drawing, the same or corresponding elements are given the same reference numerals as appropriate. Furthermore, it should be noted that the drawings are schematic, and the dimensional relationship of each element, the ratio of each element, and the like may differ from the actual ones. Even between the drawings, there are cases where portions with different dimensional relationships and ratios are included.

FIG. 1 is a diagram for explaining a mode of single sign-on of the substitute login method. FIG. 1 shows a login window 110 for A system and a login window 120 for B system. As shown in FIG. 1, in single sign-on using proxy login software, proxy login software inputs a login ID and a password to a login window of a business application. In the example shown in FIG. 1, the proxy login software enters the login ID and password in response to a so-called login dialog. Proxy login software may substitute the login ID and password in the input form.

The resident proxy login software monitors a specific window on the client terminal. Generally, in order to perform this monitoring, proxy login software calls an API (Application Programming Interface) of an OS (Operating System) to acquire window information. If only the window title information is obtained through the API, the processing load can be low.

However, it may not be possible to uniquely identify a window with title information alone. For example, as shown in FIG. 1, in the login window 120 for the B system, the title 121 of the window is only "login", and the title information alone cannot exclude the possibility that the login window is for a system other than the B system. Further, in the login window 110 for the A system, the title 111 of the window is only "A system", and the possibility that it is another window in the A system cannot be ruled out only by the title information.

Therefore, the resident proxy login software acquires not only the title information of the window but also the information of the interiors 112 and 122 of the window to determine the login window. The information in the interiors 112, 122 of this window includes many parts such as edit boxes, buttons, texts, etc., and thus the load is high. Moreover, obtaining information on the inside of not only the login window but also all the windows displayed on the screen results in a high load and is inefficient.

Therefore, the embodiment of the present invention contributes to reducing the load by having the following configuration.

FIG. 2 is a diagram showing a schematic configuration of the information processing apparatus according to the embodiment of the present invention. As shown in FIG. 2, the information processing apparatus 200 is for operating a business application 201 and includes, for example, a keyboard 202 and a mouse 203 for operating the business application 201 . Operation devices such as the keyboard 202 and mouse 203 are controlled and monitored by an operating system (OS) 204 , and operations performed by the user on the operation devices are transmitted to the business application 201 via the operating system 204 . Therefore, the user's operation to cause a new display or transition of the window of the business application 201 can be acquired via the operating system (OS) 204 .

The business application 201 may be of a stand-alone type, a server client type, or a web application type. Also, the business application 201 does not have to adopt a special authentication protocol and does not need to be specially modified.

As shown in FIG. 2, the information processing apparatus 200 further comprises a proxy input agent 210 and a proxy input hook module 220. FIG. These proxy input agent 210 and proxy input hook module 220 can be configured as programs executed on the operating system 204 . Proxy input agent 210 registers proxy input hook module 220 with operating system 204 when activated.

The substitute input hook module 220 is a module for performing so-called hook processing, and acquires operation event information from the operating system 204 . The proxy input hook module 220 has an event detection unit 221, and when a predetermined operation event is detected among the operation event information acquired from the operating system 204, it notifies the proxy input agent 210 to that effect. .

An operation event detected by the event detection unit 221 is an operation by the user of the information processing apparatus 200 to newly display or transition the window of the business application 201 . For example, operation events that generate a new window display or transition include mouse 203 click, enter key input on keyboard 202, space key input, backspace key input, “Alt+←” key input, and “Alt+→” key input. etc.

Proxy input agent 210 includes authentication unit 211 , screen detection unit 212 , proxy input unit 213 , and frequency change unit 214 .

The authentication unit 211 performs single sign-on authentication for accessing usage authentication information in which ID information and password information for logging in to the business application 201 and definition information of a login window are associated. Here, the usage authentication information can be stored in a storage device included in the information processing apparatus 200, but can also be stored in an external server as in an embodiment described later. In single sign-on authentication, input personal authentication information and stored personal authentication information are collated. The storage location of the personal authentication information used for this single sign-on authentication can also be stored in the storage device provided in the information processing apparatus 200, but it is possible to store it in an external server as in an embodiment described later. It is also possible to leave

The screen detection unit 212 detects at a predetermined frequency whether or not a window corresponding to the login window definition information stored as part of the usage authentication information is displayed on the screen of the information processing apparatus 200 . The screen detection unit 212 acquires the title information of the window displayed on the screen of the information processing device 200, determines whether or not the window is a login window based only on the acquired title information, and determines if the window is the login window. If it is possible to determine which business application 201 the login window is, the window displayed on the screen is determined from the acquired title information. On the other hand, if the acquired title information alone cannot be used for determination, not only the window title information but also the information inside the window is acquired to determine the login window. The information inside the window in this case includes, for example, edit boxes, buttons, and text.

The proxy input unit 213 inputs ID information and password information associated with the definition information of the login window to the window determined to be the login window by the screen detection unit 212 .

Based on the notification from the event detection unit 221, the frequency change unit 214 changes the frequency of detection performed by the screen detection unit 212 for a certain period of time. The frequency of detection performed by the screen detection unit 212 refers to the detection of whether or not the window displayed on the screen of the information processing apparatus 200 corresponds to the login window definition information stored as part of the usage authentication information. It is the frequency of execution. The notification from the event detection unit 221 is an operation by the user of the information processing apparatus 200 to newly display or transition the window of the business application 201 .

In the resident proxy login method, not only the title information of the window but also the information inside the window is acquired to determine the login window, so the load is heavy. However, the situations in which the login window is displayed on the screen of the information processing apparatus 200 are limited. The scene is when the user of the information processing apparatus 200 causes the window of the business application 201 to be newly displayed or transitioned. Operation events such as input, backspace key input, “Alt+←” key input, and “Alt+→” key input are performed.

Therefore, the frequency change unit 214 learns from the notification from the event detection unit 221 the scene in which the login window is likely to be displayed on the screen of the information processing apparatus 200, and the screen detection unit 212 executes increase the detection frequency. As a result, the display of the window for proxy input is intensively monitored at the timing when the window for proxy input is likely to be displayed.

FIG. 3 is a diagram showing an example of changing the detection frequency. In the example shown in FIG. 3, the frequency of detection performed by the screen detection unit 212 is changed in two stages. In the normal state, it is unlikely that the window display subject to proxy input will be displayed on the screen of the information processing apparatus 200, so the frequency of detection performed by the screen detection unit 212 is also set to be low. On the other hand, when the user of the information processing apparatus 200 detects an operation event that causes a new display or transition of the window of the business application 201, the frequency of detection performed by the screen detection unit 212 is also high for a certain period of time thereafter. do. The frequency change unit 214 changes the frequency of detection performed by the screen detection unit 212 in conjunction with the possibility that the window display subject to proxy input will be displayed on the screen of the information processing apparatus 200 . In the example shown in FIG. 3, the frequency of detection performed by the screen detection unit 212 is two stages, but it may be changed in multiple stages according to the notification from the event detection unit 221. FIG.

In the normal state, even if the possibility that the window display for proxy input is displayed on the screen of the information processing apparatus 200 is low, the possibility is not zero. For example, the scheduler of the operating system 204, JavaScript (registered trademark) on the browser, etc. may display a login window over time. Therefore, it is preferable that the low state detection frequency be set to a frequency that does not give excessive stress to the user. If the detection frequency is set in this way, it takes a little longer to detect the login window, but it is possible to detect the login window and perform substitute input within a certain amount of time.

FIG. 4 is a flow diagram showing a proxy login method according to an embodiment of the present invention. Although the configuration of the information processing apparatus 200 is referred to below for ease of explanation, the substitute login method according to the embodiment of the present invention is not limited to the configuration of the information processing apparatus 200. FIG.

As shown in FIG. 4, the proxy login method of the embodiment of the present invention first accesses use authentication information in which ID information and password information for logging in to an application and definition information of a login window are associated. single sign-on authentication is performed (step S1).

Then, the screen detection unit 212 is initialized to a low detection frequency (step S2). This is because, in the normal state, there is a low possibility that the window display for proxy input will be displayed on the screen of the information processing apparatus 200 .

Normally, the screen detection unit 212 detects whether or not a window corresponding to the definition information of the login window is displayed on the screen when the detection frequency is set low (step S3).

On the other hand, the event detection unit 221 acquires operation events from the operating system 204, and when detecting a predetermined operation event among the acquired operation events, notifies the detection of the predetermined operation event (step S4). Note that this step continues until a predetermined operation event is detected, and when it is detected, the process proceeds to the next step.

The frequency changing unit 214 increases the frequency of detection performed by the screen detecting unit 212 based on the notification from the event detecting unit 221 (step S5).

Then, the screen detection unit 212 detects whether or not a window corresponding to the definition information of the login window is displayed on the screen with the detection frequency set high (step S6).

The frequency changing unit 214 monitors whether a predetermined time has passed since the detection frequency was changed to a higher value (step S7). (step S8).

Then, the above procedure is repeated until the end (step S9).

FIG. 5 is a diagram illustrating an example of a hardware configuration of an information processing apparatus; The proxy login method according to the embodiment of the present invention described above can also be implemented as a proxy login program that causes the information processing apparatus 200 to execute the hardware configuration 20 shown in FIG. However, the hardware configuration 20 shown in FIG. 5 is an example of a hardware configuration that implements the functions of the information processing device 200 and is not intended to limit the hardware configuration of the information processing device 200 . Moreover, the hardware configuration for realizing the proxy login method of the embodiment of the present invention as a proxy login program is not limited to the hardware configuration 20 shown in FIG. The information processing device 200 can include hardware not shown in FIG.

As shown in FIG. 5, the hardware configuration 20 includes a CPU (Central Processing Unit) 21, a main storage device 22, an auxiliary storage device 23, and a communication interface NIC (Network Interface), which are interconnected by, for example, an internal bus. Card) 24 .

The CPU 21 processes an operating system 204 and business applications 201 executed by the information processing device 200 . Further, the CPU 21 executes the proxy login program of the embodiment of the present invention by processing the proxy input agent 210 and the proxy input hook module 220 . The main storage device 22 is, for example, a RAM (Random Access Memory), and temporarily stores a proxy login program and the like executed by the information processing device 200 for the CPU 21 to process.

The auxiliary storage device 23 is, for example, an HDD (Hard Disk Drive), and is capable of medium- to long-term storage of a proxy login program executed by the information processing device 200 . In addition, the auxiliary storage device 23 stores user authentication information used for single sign-on authentication, and use authentication information in which the ID information and password information for logging in to the business application 201 and the definition information of the login window are associated with each other. can be stored in These programs or authentication information may be distributed from an external server, but it is also possible to temporarily store the programs or authentication information distributed from the external server in the auxiliary storage device 23 .

NIC 24 provides an interface to external servers over the network. Some functions of the business application 201 may be executed on an external server, such as a server-client type or a web application type. The NIC 24 provides an interface for the business application 201 to communicate with an external server. Also, as noted above, the program or credentials may be distributed from an external server. The program or authentication information in this case is distributed from an external server via the NIC24.

FIG. 6 is a diagram showing a schematic configuration of the proxy login system according to the embodiment of the present invention. As shown in FIG. 6, proxy login system 300 includes information processing device 200 and authentication information server 310 . The authentication information server 310 functions as an external server for the information processing device 200 . Further, since the information processing apparatus 200 can be regarded as having substantially the same configuration as already described, detailed description thereof will be omitted.

As shown in FIG. 6 , the authentication information server 310 includes an authentication information storage unit 311 and an authentication information distribution unit 312 .

The authentication information storage unit 311 stores use authentication information in which ID information and password information for logging in to an application and definition information of a login window are associated, and personal authentication information for accessing the use authentication information. It is for The authentication information storage unit 311 can be configured by, for example, an HDD (Hard Disk Drive).

The authentication information distributing unit 312 compares the personal authentication information received from the information processing apparatus 200 with the personal authentication information stored in the authentication information storage unit 311, and if the verification is successful, the authentication information is stored in the authentication information storage unit 311. The obtained usage authentication information is distributed to the information processing apparatus 200 . On the other hand, the information processing apparatus 200 transmits the input personal authentication information to the authentication information server 310 and receives the use authentication information from the authentication information server 310 . Thus, in the proxy login system 300, single sign-on authentication is performed through communication between the information processing device 200 and the authentication information server 310. FIG.

As described above, in the proxy login system 300, the authentication information and the user authentication information are centrally managed by the authentication information server 310. Therefore, even if the user replaces the information processing device 200, single sign-on authentication can be performed. environment can be maintained.

Although the present invention has been described above based on the embodiments, modifications and examples of the embodiments and examples can be made within the framework of the full disclosure of the present invention (including the scope of claims) and further based on the basic technical idea thereof. Adjustment is possible. Also, various combinations or selections of various disclosure elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) within the framework of the full disclosure of the present invention (including at least partial deselection). That is, the present invention naturally includes all disclosures and modifications including the scope of claims. In particular, any numerical range recited herein should be construed to specifically recite any numerical value or subrange within that range, even if not otherwise specified. In addition, the disclosures of the cited patent documents and the like are incorporated herein by reference.

110, 120 login window 111, 121 window title 112, 122 window interior 200 information processing device 201 business application 202 keyboard 203 mouse 204 operating system 210 proxy input agent 211 authentication unit 212 screen detection unit 213 proxy input unit 214 frequency change unit 220 proxy input hook module 221 event detector 20 hardware configuration 21 CPU
22 main storage device 23 auxiliary storage device 24 NIC
300 proxy login system 310 authentication information server 311 authentication information storage unit 312 authentication information distribution unit

Claims (10)

an authentication unit that performs single sign-on authentication for accessing usage authentication information in which ID information and password information for logging into an application and definition information of a login window are associated;
a screen detection unit that detects whether or not a window corresponding to the definition information of the login window is displayed on the screen at a predetermined frequency;
a proxy input unit for proxy input of ID information and password information associated with the definition information of the login window to the window detected by the screen detection unit;
an event detection unit that acquires operation events from an operating system and notifies detection of the predetermined operation event when a predetermined operation event is detected among the acquired operation events;
a frequency changing unit that changes the predetermined frequency in the screen detection unit for a certain period of time based on the notification from the event detection unit;
An information processing device comprising: 2. The method according to claim 1, wherein said use authentication information is stored in an external server, and said use authentication information is distributed from said external server when single sign-on authentication in said authentication unit is successful. Information processing equipment. 3. The authentication unit performs single sign-on authentication by comparing the personal authentication information input to the authentication unit with the personal authentication information stored in the external server. The information processing device according to . 4. The information processing apparatus according to any one of claims 1 to 3, wherein the predetermined operation event is an operation by a user to cause a new display or transition of a window. an authentication information storage unit that stores use authentication information in which ID information and password information for logging into an application and definition information of a login window are associated with each other, and personal authentication information for accessing the use authentication information;
an authentication information distribution unit that compares the received personal authentication information with the personal authentication information stored in the authentication information storage unit, and distributes the use authentication information when the verification is successful;
a credential server having
an authentication unit that performs single sign-on authentication by transmitting the entered personal authentication information to the authentication information server and receiving the use authentication information from the authentication information server;
a screen detection unit that detects whether or not a window corresponding to the definition information of the login window is displayed on the screen at a predetermined frequency;
a proxy input unit for proxy input of ID information and password information associated with the definition information of the login window to the window detected by the screen detection unit;
an event detection unit that acquires operation events from an operating system and notifies detection of the predetermined operation event when a predetermined operation event is detected among the acquired operation events;
a frequency changing unit that changes the predetermined frequency in the screen detection unit for a certain period of time based on the notification from the event detection unit;
an information processing device having
A substitute login system characterized by comprising: 6. The proxy login system according to claim 5, wherein the predetermined operation event is an operation by the user to cause a new display or transition of a window. A proxy login method performed in an information processing device executing a proxy input agent and a proxy input hook module,
an authentication step in which the proxy input agent performs single sign-on authentication for accessing usage authentication information in which ID information and password information for logging into an application and definition information of a login window are associated;
a screen detection step in which the substitute input agent detects whether or not a window corresponding to the definition information of the login window is displayed on the screen at a predetermined frequency;
a proxy input step in which the proxy input agent inputs ID information and password information associated with the definition information of the login window to the window detected in the screen detection step;
an event detection step of, when the proxy input hook module acquires operation events from an operating system and detects a predetermined operation event among the acquired operation events, notifying the detection of the predetermined operation event to the proxy input agent; ,
a frequency changing step in which the substitute input agent changes the predetermined frequency in the screen detection step for a certain period of time based on the notification in the event detection step;
A proxy login method, comprising: 8. The proxy login method according to claim 7, wherein said predetermined operation event detected by said proxy input hook module is an operation by a user to cause a new display or transition of a window. an authentication step of performing single sign-on authentication for accessing usage authentication information in which ID information and password information for logging into an application and definition information of a login window are associated;
a screen detection step of detecting whether or not a window corresponding to the definition information of the login window is displayed on the screen at a predetermined frequency;
a proxy input step of proxy input of ID information and password information associated with the definition information of the login window to the window detected in the screen detection step;
an event detection step of acquiring operation events from an operating system and notifying detection of the predetermined operation event when a predetermined operation event is detected among the acquired operation events;
a frequency change step of changing the predetermined frequency in the screen detection step for a certain period of time based on the notification in the event detection step;
is executed by an information processing device for operating the application. 10. The proxy log-in program according to claim 9, wherein the predetermined operation event is an operation by the user to newly display a window or cause a transition.

Images