JP2010026889A - Web application server, terminal, and web application system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a Web application server, a terminal, and a Web business application system in which the terminal automatically generates authentication information to ask the server for authentication and a user is free from troublesome input of an ID and a password, for example. <P>SOLUTION: The terminal 1, which includes a Web business start terminal application 2, automatically generates the authentication information 5 encrypted using a built-in identification key and business start time and sends use-requesting information including the authentication information 5 to a Web business application 8 of the Web application server 6. The Web business application 8 transfers the authentication information 5 to an unauthorized use checking common function 7 to ask for decryption and verification of the authentication information 5. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a web / application server, a terminal, and a web / application system connecting these.

  In a conventional Web business application system, as a method for preventing unauthorized use, a user inputs a user ID, a password, and the like when starting a Web application, and user identification information is created and determined on the server side based on the input information. Yes. For example, Patent Document 1 requires a password input when starting a Web application, and Patent Document 2 requires a user ID and password when starting a Web application.

JP 2006-40145 A (paragraph 0035) JP 2001-249892 A (paragraph 0044)

In a conventional Web business application system, a terminal generates user identification information based on user information (user ID or password) input by a user. If the user information is stolen by another person, the terminal can be used from any environment. There was a problem of illegal use.
In addition, after logging in by entering a user ID and password in Windows (registered trademark) (domain), it is necessary to input the user ID and password again when starting the Web application. Entering the same user ID and password when logging in to Windows (registered trademark) (domain) and starting the Web application is cumbersome for the user, and entering a different user ID and password is forgotten or wrong by the user. There was a problem.

  The present invention has been made to solve the above problems, and provides a Web application server, a terminal, and a Web application system that can prevent unauthorized use without requiring a user ID or password input by a user. is there.

A web application server according to the present invention is a web application server having a web business application connected to a terminal,
When it is determined whether the usage request information of the Web business application including the authentication information having the secret key concealed from the terminal user and the authentication information creation time sent from the terminal is valid, and is determined to be valid This is provided with a common function for checking unauthorized use that enables a Web business application to be used on a terminal.

A terminal according to the present invention is a terminal connected to a Web application server having a Web business application,
The user is provided with a Web business activation terminal application that creates usage request information for a Web business application including authentication information having a concealed secret key and authentication information creation time, and transmits the request information to the Web application server.
When the usage request information is determined to be valid by the Web application server, the Web business application can be used.

A web application system according to the present invention includes a web application server having a web business application,
A web application system comprising a terminal that connects to a web application server and uses a web business application,
The terminal has a Web business activation terminal application that creates use request information of a Web business application including authentication information having a secret key concealed from the user and an authentication information creation time, and transmits the request information to the Web application server.
Unauthorized use that enables the Web application server to determine whether the usage request information of the Web business application sent from the terminal is valid, and to use the Web business application on the terminal when it is determined to be valid It has a check common function.

A web application server according to the present invention is a web application server having a web business application connected to a terminal,
When it is determined whether the usage request information of the Web business application including the authentication information having the secret key concealed from the terminal user and the authentication information creation time sent from the terminal is valid, and is determined to be valid Since it is a Web application server that has a common function for checking unauthorized use that enables Web business applications to be used on terminals, it is not necessary to input user IDs and passwords, but only valid usage requests Can be used.

A terminal according to the present invention is a terminal connected to a Web application server having a Web business application,
The user is provided with a Web business activation terminal application that creates usage request information for a Web business application including authentication information having a concealed secret key and authentication information creation time, and transmits the request information to the Web application server.
This is a terminal characterized by being able to use a Web business application when the usage request information is determined to be valid by the Web / application server. Use can be requested from the Web application server.

A web application system according to the present invention includes a web application server having a web business application,
A web application system comprising a terminal that connects to a web application server and uses a web business application,
The terminal has a Web business activation terminal application that creates use request information of a Web business application including authentication information having a secret key concealed from the user and an authentication information creation time, and transmits the request information to the Web application server.
Unauthorized use that enables the Web application server to determine whether the usage request information of the Web business application sent from the terminal is valid, and to use the Web business application on the terminal when it is determined to be valid Since it is a Web application system characterized by having a common check function, it is possible to ask the Web application server for proper use without requiring the user to input an ID or password from the terminal. Web business applications can be used only for usage requests.

Embodiment 1 FIG.
Embodiment 1 of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram showing the configuration of a Web business application system according to the present invention.
The terminal 1 is loaded with an operating system such as Windows (registered trademark), and the web business activation terminal application 2 is activated. Further, browser software 3 is incorporated in the terminal 1.
A Web business application 8 and an unauthorized use check common function 7 are incorporated in the Web application server 6.
As shown in FIG. 4, the database server 9 incorporates an authentication database 10 (described later) that is a database for managing the terminal information 13 and user information 12 of the terminal 1. A terminal 1, a web / application server 6, and a database server 9 are connected to each other via a network 4.

FIG. 2 shows the flow of processing of the Web business activation terminal application 2.
When the user selects the business A in the Web business activation terminal application 2 of FIG. 1, the Web business activation terminal application 2 checks whether the user is logged in to Windows (registered trademark) (domain) (S14) and logs in. If so, the user information 12 and the terminal information 13 are acquired from Windows (registered trademark) (S15). If the user information 12 and the terminal information 13 cannot be acquired for some reason when the user is not logged in to the domain, an error is returned and a screen informing the browser of the error is displayed (S17).

When the user information 12 and the terminal information 13 can be acquired normally, the current time held by the terminal is acquired and used as the authentication information creation time (S16), the user information 12, the terminal information 13, the authentication information creation time, The authentication information 5 is encrypted and generated with a hash function MD5 (Message Digest Algorithm 5)) based on a personal identification key (a character string, which will be described later) (S18). Next, the Web business activation terminal application 2 starts the browser 3 on the terminal 1, and requests the Web application server 6 to start the Web business application 8 with the authentication information 5 attached (S19). Specifically, this request is sent with POST with the authentication information 5 attached as an argument to the URL of the Web business application 8. The URL of the Web business application 8 to which the authentication information 5 is attached is usage request information.
Note that the secret key is held in the Web application starting terminal application 2 in a state not disclosed to the user. Further, user information 12 and terminal information 13 acquired from Windows (registered trademark) are a user ID, a workstation ID, an IP address, and the like, and these information are used to generate authentication information 5.

Next, the flow of processing of the unauthorized use check common function 7 is shown in FIG.
Upon receiving a use request from the Web application starting terminal application 2 of the terminal 1, the Web application 8 of the Web application server 6 shown in FIG. 1 is activated and receives the authentication information 5 at the same time. The authentication information 5 is passed to the common function 7. In the unauthorized use check common function 7, the encrypted authentication information 5 is decrypted (S20), and the user information 12, the terminal information 13, the authentication information creation time, and the password are obtained. It is verified whether the user information 12 and the terminal information 13 are registered in the authentication database 10 of the database server 9 (S21). In consideration of the case where the times of the terminal 1 and the Web / application server 6 are slightly different, the authentication information creation time is confirmed to be within a predetermined time of the current time held by the server (S22). It is confirmed whether the personal identification key is the same as that held by the unauthorized use check common function 7 (S23). If all confirmations are successful, the authentication information 5 is returned to the Web business application 8 as valid (S24). If the confirmation fails in any one of S21 to S23, the authentication information 5 is returned to the Web business application 8 as invalid (S25).

An example of the authentication database 10 is shown in FIG.
The authentication database 10 of the database server 9 is a database that manages user information 12 and terminal information 13. The user information 12 is account information such as a user ID when the user logs in to Windows (registered trademark) (domain), and the Windows (registered trademark) account information is linked to the authentication database in batch, or Windows (registered trademark). ) Account information can be used directly as an authentication database. In the terminal information 13, a workstation ID, an IP address, and the like are registered.
In addition, without preparing the authentication database 10, it is also possible to delete the user information 12 and the terminal information 13 from the authentication information 5, and generate and determine the authentication information 5 based on the authentication information creation time and the password. is there. There are no particular restrictions on the combination of the components of the authentication information 5 other than the password and authentication information creation time, and they may be combined according to the required security environment.

The Web business application 8 displays the screen of the business A on the browser 3 of the terminal 1 only when the authentication information 5 is valid. If the authentication information 5 is invalid, an error is returned, and the terminal displays a screen notifying that an error has occurred. Then, the Web business application 8 ends.
By confirming the user information 12 and the terminal information 13 with the authentication database 10, it is possible to prevent unauthorized users and terminals from using the terminal. Further, the encryption method / decryption method and the secret key of the authentication information 5 are concealed by the Web business activation terminal application 2 and the unauthorized use check common function 7 and cannot be known from the user or the Web business application 8. Thereby, it is possible to prevent the user from generating unauthorized authentication information 5. Further, since the authentication information creation time is provided, even if the authentication information is stolen, if the predetermined time elapses, the authentication information is not used illegally.

  As described above, according to the present embodiment, the user is not required to input the user ID and password for the Web business activation terminal application 2. User information 12, terminal information 13, and authentication information 5 including authentication information creation time previously stored in the terminal 1 can be automatically generated and the Web business application 8 can be activated, thereby reducing the load on user operations and preventing unauthorized use. it can. Further, by holding the authentication information creation time, it is possible to prevent the Web business application 8 from being executed when old authentication information is illegally used.

Embodiment 2. FIG.
In the first embodiment, a system configuration has been described in which it is possible to prevent unauthorized use while making it unnecessary to input a user ID or password when starting a Web business application.

  Conventionally, when a plurality of Web business applications are started, the user ID and password are input every time each Web business application is started, so that the user operation is complicated, or after starting one Web business application, 2 When starting up subsequent Web business applications, the user ID and password input for the first time input are stored in the Web business application, and a mechanism such as single sign-on linkage is considered when developing individual Web business applications. There was a problem such as necessity.

Therefore, in the second embodiment, the cooperation of authentication information when a new function is added to the function described in the first embodiment and a plurality of Web business applications are continuously executed will be described.
If the Web application start terminal application 2 of the first embodiment is used, the user can request the Web application server 6 to start a new Web application at any time. However, if you want to quickly start another Web business application that is closely related to a specific Web business application, or because of the effective use of the screen area of the terminal, etc. There is a case where it is desired to request activation of a Web business application.
When the browser 3 is used as the software on the terminal 1 side that uses the Web business application, the authentication information 5 generated by the Web business activation terminal application 2 cannot be generated by the browser 3. This is because the browser 3 cannot store the secret key and cannot provide the browser 3 with a special function of generating the authentication information 5.
Therefore, the start request for the Web business application to be used first must be made from the Web business start terminal application 2, but the second and subsequent Web business applications are started to the currently executing Web business application. It is possible to link.

As this linkage method, in the second embodiment, authentication information is generated in advance on the Web / application server 106 side, embedded in screen data to be displayed on the browser 3 of the terminal 1, and transmitted. A method used as authentication information for Web business applications is adopted.
FIG. 5 shows an example of the system configuration when the second Web business application 208 is activated following the first Web business application 108, and FIG. 6 shows the processing flow of the main part.
Hereinafter, the numbers “first” and “second” used in this specification when referring to “first web business application” and “second web business application” indicate individual specific web business applications. Instead, the web business application first started from the web business activation terminal application 2 is the “first” web business application, and the web business application subsequently launched from the browser 3 is the “second” web. A business application. That is, in this embodiment, it is assumed that the second and subsequent Web business applications are all requested to be started from the browser 3, and when the Web business application is started from the Web business start terminal application 2, the Web business application is It is always the first Web business application.
For the first and second authentication information, the first authentication information is generated by the Web business activation terminal application 2 of the terminal 1, whereas all the authentication information after the second authentication information is a Web application. There are differences generated by the server 106.
The handling in the unauthorized use check common function 107 is slightly different depending on which authentication information is generated. This point will be described later.

After the user selects the business A as the first web business application 108 in the web business activation terminal application 2, the unauthorized use check common function 107 displays the authenticity determination result of the first authentication information 105 as the first web business. The flow until returning to the application 108 is the same as in the first embodiment.
In the first embodiment, the Web business application 8 displays the screen of the business A on the browser 3 of the terminal 1 only when the authentication information 5 is valid according to the determination of the authentication information 5, and when the authentication information 5 is invalid, the terminal The browser 3 of No. 1 displayed a screen notifying that an error has occurred and ended.

Also in the second embodiment, when the first authentication information 105 is invalid, the first Web business application 108 displays a screen informing the browser 3 of the terminal 1 that an error has occurred and ends.
If the authentication information 105 is valid, it instructs the unauthorized use check common function 107 to prepare the second authentication information 205 to be used when the second Web business application 208 is started after the first Web business application 108. (S39).
The unauthorized use check common function 107 replaces the authentication information creation time with the current time among the user information 12, the terminal information 13, the authentication information creation time, and the personal identification key included in the authentication information 105, and sets the second authentication information 205. It is generated by encrypting with MD5 or the like (S40-S42) and returned to the first Web business application 108 (S43).
Then, the first Web business application 108 incorporates the second authentication information 205 into the screen display data for the terminal 1 of the business A as the first Web business application, and transmits it to the terminal 1 (S44).
When the terminal 1 receives the screen display data for the business A and the operation screen of the business A is displayed on the browser 3, the user can use the business A.

The business B button on the screen of the business A as the first Web business application 108 is embedded with a URL for linking to the business B and authentication information for POST transmission as an argument.
When the user selects the business B, the terminal 1 requests the web application server 106 to activate the second web business application 208 (S45).

The processing after receiving the second authentication information 205 in the second Web application 208 is partially different from the processing after receiving the first authentication information 105 described above.
Upon receiving the second authentication information 205, the second Web business application 208 passes the second authentication information 205 to the unauthorized use check common function 107. In the unauthorized use check common function 107, the encrypted second authentication information 205 is decrypted, and the user information 12, the terminal information 13, the authentication information creation time, and the password are obtained. It is confirmed whether the user information 12 and the terminal information 13 are registered in the authentication database 10 of the database server 9. It is confirmed whether the secret key is the same as the one held in the unauthorized use check common function 107. It is confirmed whether the authentication information creation time is within a predetermined time from the current time.

In the processing after the authentication information 5 in the first embodiment and the authentication information 105 in the first embodiment are received by the Web application servers 6 and 106, the verification of the authentication information creation time is performed using the time held by the terminal 1 It was performed in a range that allows an error in time held by the Web application servers 6 and 106, for example, in an allowable range of 5 to 10 seconds. This is because the authentication information 5 and 105 are both created by the terminal 1 and are sent to the Web application servers 6 and 106 immediately after creation.
However, the time from when the second authentication information 205 is created by the Web application server 106 until it is returned to the Web application server 106 via the terminal 1 greatly depends on the terminal usage status of the user.
Therefore, the verification of the authentication information creation time of the second authentication information 205 is regarded as valid within a predetermined range, for example, within 30 minutes. If all the confirmations are successful, the authentication information 205 to the second Web business application 208 is returned as valid. If any one of the confirmations fails, the authentication information 205 is returned to the second Web business application 208 as invalid.
For example, when a predetermined time such as 30 minutes elapses after starting the business A as the first Web business application 108, the second Web business application from the business A as the first Web business application 108 Even if the service B 208 is started, it cannot be started. In this case, returning to the beginning, the business B as the first Web business application 108 is started from the Web business startup terminal application 2.

If the second authentication information 205 is invalid, the second Web business application 208 displays a screen informing the terminal that an error has occurred and ends.
If the second authentication information 205 is valid, it instructs the common illegal use check common function 107 to prepare the third authentication information 305 to be used when the next Web next business application is started.
The unauthorized use check common function 107 replaces the authentication information creation time with the current time held by the Web application server 106 among the user information 12, the terminal information 13, the authentication information creation time, and the personal identification key, and the third authentication information 305. Is encrypted with MD5 or the like, and returned to the second Web business application 208.
Then, the second Web business application 208 incorporates the third authentication information 305 into the screen display data for the terminal 1 of the business B as the second Web business application 208 and transmits it to the terminal 1.
When the terminal 1 receives the screen display data for the business B and the operation screen of the business B is displayed on the browser 3, the user can use the business B.

As described above, in the present embodiment, when the Web business activation terminal application 2 first generates the first authentication information 105 and starts the arbitrary first Web business application 108 on the Web application server 106, The first Web business application is prepared so that the second authentication information 205 used when starting the second Web business application 208 is transmitted to the terminal 1 and the browser 3 can directly request the start of the second Web business application. Keep it.
When the Nth Web business application screen is displayed on the browser 3 of the terminal 1, the terminal 1 holds the (N + 1) th authentication information.
In the second embodiment, the example has been described in which the Web application server 106 creates one second authentication information 205 to be used by the terminal 1 next time. When providing links to B and business C, it is also possible to generate a plurality of second authentication information 205 at the same time, incorporate them into business A screen data displayed by the browser 3 of the terminal 1, and send them to the terminal 1. It is.

As described above, in the second embodiment, as in the first embodiment, the user is not required to input a user ID or password when logging in to the Web business application to be started first.
In addition, the authentication information generated by the unauthorized use check common function 107 is sent to the terminal 1 side, and the authentication information is used when starting another Web business application, thereby starting each Web business application. At this time, there is no need to input the user ID and password every time.
Further, it is not necessary to consider a mechanism such as single sign-on linkage when developing an individual Web business application.
Since the creation time of the authentication information is updated every time the Web business application is started, even when three or more Web business applications are started at intervals within a predetermined time such as 30 minutes, the first 30 times from the start of the Web business application. Even when a time longer than a predetermined time such as minutes elapses, another Web business application can be started from the Web business application. In addition, since the authentication information creation time is checked, even if the authentication information is stolen, the Web business application cannot be used with the authentication information after a predetermined time has elapsed, so that security can be improved.
Further, since it is possible to safely request the use of a new Web business application directly from the browser without using the Web business start terminal application, there is also an advantage that the screen displayed on the terminal of the Web business application system can be flexibly configured.

FIG. 7 shows a case where the user directly inputs the URL of the Web business application 8 using the browser 3.
The unauthorized use check common function 7 incorporated in the first Web business application 8 returns an evaluation of unauthorized in the determination of the authentication information 5 and displays an error screen on the terminal 1. As a result, it is possible to prevent the Web business application 8 from being activated when the user directly inputs the URL.

1 is a configuration diagram of a Web business application unauthorized use prevention system according to Embodiment 1. FIG. FIG. 3 is a flowchart of the Web business activation terminal application according to the first embodiment. FIG. 3 is a flowchart of the unauthorized use check common function according to the first embodiment. 6 is a configuration diagram of an authentication database according to Embodiment 2. FIG. FIG. 3 is a system configuration diagram of a second embodiment. FIG. 10 is a main part flow diagram of the second embodiment. FIG. 10 is a diagram showing an example of error occurrence in the first and second embodiments.

Explanation of symbols

1,101 terminal, 2 Web business start terminal application,
3,103 browser, 4 network, 5,105,205,305 authentication information,
6,106 Web application server,
7,107 Unauthorized use check common function,
8, 108, 208 Web business application, 9 Database server,
10 authentication database, 12 user information, 13 terminal information.

Claims (11)

A web application server to which a terminal is connected and has a web business application,
It is determined whether or not the use request information of the Web business application including authentication information having a secret key concealed for the user of the terminal and authentication information creation time sent from the terminal is valid, and is determined to be valid A Web application server having a common function for checking unauthorized use that enables the terminal to use the Web business application when the terminal is used. The common function of the unauthorized use check is that the personal identification key included in the authentication information matches the personal identification key stored in the common unauthorized use check function, and the authentication information creation time included in the authentication information is stored in the server. 2. The Web application server according to claim 1, wherein the Web application server is determined to be valid when the current time is within a predetermined range from the current time, and unjust otherwise. The authentication information includes at least one of terminal information regarding the terminal or user information regarding a user using the terminal;
The at least one of the terminal information or the user information included in the authentication information with reference to an authentication database that stores at least one of the terminal information or the user information to be authenticated by the common function of the unauthorized use check. 3. The Web application server according to claim 1, wherein it is determined whether or not the use request information is valid by checking whether or not the request is valid. 4. When the unauthorized use check common function determines that the use request information is valid, the authentication information creation time included in the authentication information is replaced with a current time held by the server, and new authentication information is created. 4. The Web application server according to claim 1, wherein new authentication information is transmitted to the terminal as a part of data of the Web business application that can be used. A terminal connected to a web application server having a web business application,
The user includes a Web business activation terminal application that creates use request information of the Web business application including authentication information having a concealed personal identification key and authentication information creation time, and transmits the request information to the Web application server.
A terminal capable of using the Web business application when the use request information is determined to be valid by the Web application server. The terminal according to claim 5, wherein the Web business activation terminal application creates the authentication information including at least one of terminal information related to the terminal and user information related to a user who uses the terminal. The terminal according to claim 5 or 6 connected to the web application server according to claim 4, wherein the web business application that can be used by the web application server is connected to the terminal. When a request for use of another Web business application is input from the user, use request information for another Web business application requested using the authentication information stored as part of the data of the Web business application is displayed. A terminal created and transmitted to the web application server. A web application server having a web business application;
A web application system comprising a terminal that connects to the web application server and uses the web business application,
The terminal has a Web business activation terminal application that creates use request information for the Web business application including authentication information having a secret key and authentication information creation time concealed by the user and transmits the request information to the Web application server. And
The Web application server determines whether the use request information of the Web business application sent from the terminal is valid, and uses the Web business application at the terminal when it is determined to be valid Web application system characterized by having an illegal use check common function that enables The common function of the unauthorized use check is that the personal identification key included in the authentication information matches the personal identification key stored in the common unauthorized use check function, and the authentication information creation time included in the authentication information is stored in the server. 9. The Web application system according to claim 8, wherein when the current time is within a predetermined range from the current time, it is determined to be valid, and otherwise, it is determined to be inappropriate. The Web business activation terminal application creates the authentication information including at least one of terminal information related to the terminal or user information related to a user using the terminal,
The at least one of the terminal information or the user information included in the authentication information with reference to an authentication database that stores at least one of the terminal information or the user information to be authenticated by the common function of the unauthorized use check. 10. The Web application system according to claim 8, wherein whether or not the use request information is valid is determined by checking whether or not the request is valid. When the unauthorized use check common function determines that the use request information is valid, the authentication information creation time included in the authentication information is replaced with a current time held by the server, and new authentication information is created. Send new authentication information created as part of the data of the Web business application that can be used to the terminal,
In the terminal, the Web business application that can be used by the Web application server is stored as part of the data of the Web business application when a use request for another Web business application is input from a user. 11. The usage request information of another Web business application requested using the authentication information generated is generated and transmitted to the Web application server. The web application system described.

Images