Information processing device and information processing program

Abstract

To provide an information processing apparatus configured to maintain security level of each of groups even when a user belongs to the multiple groups, and an information processing program.SOLUTION: An information processing apparatus 30 includes a CPU 31. The CPU 31 receives authentication information for using groups which manage use of services, and presents information to prompt modification of the authentication information when the received authentication information does not satisfy a condition of the highest security level out of conditions of the authentication information which are determined for each of groups that the user belongs to.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present invention relates to an information processing device and an information processing program. [Background technology]

[0002] Patent Document 1 discloses an information processing device that includes an authentication means for authenticating a user so that the user can access a plurality of resources on a network, and an acquisition means for acquiring a condition related to the strength of authentication information that is differently set for each of the resources. Note that this information processing device also includes a control means for controlling access to one resource of the plurality of resources based on the condition related to the strength of the one resource and strength information related to the strength of the authentication information of the user when the user accesses the one resource. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2020-042502 A Summary of the Invention [Problem to be solved by the invention]

[0004] There is a technology that allows a user to use services corresponding to all groups to which the user belongs, among groups that manage the use of services, by a single authentication process. In this technology, when a user belongs to multiple groups and authentication information conditions are defined for each group, the user needs to comply with the authentication information conditions defined for the group to which the user first belongs or the authentication information conditions defined by default, in the authentication process. Since authentication information conditions are defined for each group, a security level is also defined for each group. Therefore, when a user uses a group that has authentication information conditions with a higher security level than the authentication information conditions that the user needs to comply with, there is a problem that the security level cannot be maintained because the user does not need to comply with the higher conditions.

[0005] An object of the present invention is to be able to maintain the security level defined for each group even when a user belongs to multiple groups. [Means for solving the problem]

[0006] In order to achieve the above-mentioned object, an information processing device according to a first aspect includes a processor, which accepts authentication information for using a group that manages the use of a service, and if the accepted authentication information does not satisfy the highest security level condition among the authentication information conditions defined for each of the groups to which the user belongs, presents a message urging the user to change the authentication information.

[0007] In addition, in the information processing device of the second aspect, in the information processing device of the first aspect, when the processor receives authentication information from a user who does not belong to the group, if the received authentication information does not satisfy the conditions for the authentication information defined in the group with which the company to which the user belongs has a contract, the processor presents a message urging the user to change the authentication information.

[0008] In addition, in an information processing device according to a third aspect, in the information processing device according to the first or second aspect, the condition with the highest security level is an authentication information condition that includes the largest number of items with the highest security level by item among the authentication information conditions defined for each of the groups to which the information processing device belongs.

[0009] In addition, in the information processing device of the fourth aspect, in the information processing device of the first or second aspect, the condition with the highest security level is the condition in which the value obtained by multiplying each of the values ​​representing the items of the condition by a predetermined multiplier and adding them up for each item is the highest, among the conditions of the authentication information set for each of the groups to which the information processing device belongs.

[0010] In addition, in an information processing device according to a fifth aspect, in the information processing device according to any one of the first to fourth aspects, the processor accepts a selection of a condition to be applied as a condition for determining whether or not to present a prompt to change the authentication information when there are multiple conditions with the highest security level.

[0011] In addition, in the information processing device according to a sixth aspect, in the information processing device according to the fourth aspect, the processor accepts a change to the predetermined multiplier when there are a plurality of conditions with the highest security level.

[0012] Furthermore, in order to achieve the above-mentioned object, an information processing program according to a seventh aspect causes a computer to execute a process of accepting authentication information for using a group that manages the use of a service, and if the accepted authentication information does not satisfy the highest level of security among the conditions for the authentication information defined for each of the groups to which the user belongs, presenting a message urging the user to change the authentication information. Effect of the Invention

[0013] According to the first and seventh aspects, even if a user belongs to a plurality of groups, the security level defined for each group can be maintained.

[0014] According to the second aspect, even when authentication information is received from a user who does not belong to a group, it is possible to maintain the security level determined for the group with which the company to which the user belongs has a contract.

[0015] According to the third aspect, it is possible to more easily derive the security level compared to a case in which the security level is derived without using the number of items with the highest security level.

[0016] According to the fourth aspect, it is possible to derive, as the security level, values ​​obtained by multiplying the values ​​representing the respective condition items of the authentication information by different multipliers.

[0017] According to the fifth aspect, it is possible to select a condition to be applied for determining whether or not to present a message prompting a user to change authentication information from among conditions with the highest security level.

[0018] According to the sixth aspect, when there are a plurality of conditions with the highest security level, the multiplier for calculating the security level can be changed. [Brief description of the drawings]

[0019] [Figure 1] FIG. 2 is a schematic diagram illustrating an example of a hardware configuration of an information processing system according to an embodiment. [Diagram 2] FIG. 2 is a schematic diagram illustrating an example of a hardware configuration of an information processing apparatus according to an embodiment. [Diagram 3] FIG. 2 is a schematic diagram illustrating an example of a configuration of a tenant database according to the embodiment. [Figure 4] FIG. 4 is a schematic diagram illustrating an example of a configuration of a user database according to the embodiment. [Diagram 5] 10 is a flowchart illustrating an example of information processing according to the embodiment. [Figure 6] FIG. 11 is a schematic diagram showing an example of a first authentication information change screen according to the embodiment. [Figure 7]FIG. 13 is a schematic diagram showing an example of a second authentication information change screen according to the embodiment. [Figure 8] 13 is a schematic diagram showing an example of a third authentication information change screen according to the embodiment. FIG. [Figure 9] FIG. 13 is a schematic diagram showing an example of a fourth authentication information change screen according to the embodiment. [Figure 10] 13 is a flowchart showing an example of a home policy derivation process according to the first embodiment. [Figure 11] FIG. 13 is a schematic diagram illustrating an example of a home tenant selection screen according to the embodiment. [Figure 12] 10 is a flowchart illustrating an example of a user setting process according to the embodiment. [Figure 13] FIG. 13 is a schematic diagram illustrating an example of a user setting screen according to the embodiment. [Figure 14] 10 is a flowchart illustrating an example of a policy setting process according to the embodiment. [Figure 15] FIG. 13 is a schematic diagram illustrating an example of an applicable policy screen according to the embodiment. [Figure 16] FIG. 13 is a schematic diagram illustrating an example of a policy setting screen according to the embodiment. [Figure 17] 11 is a flowchart illustrating an example of a policy change process according to the embodiment. [Figure 18] FIG. 13 is a schematic diagram illustrating an example of a policy change screen according to the embodiment. [Figure 19] 13 is a flowchart showing an example of a home policy derivation process according to the second embodiment. [Figure 20] FIG. 11 is a schematic diagram showing an example of a multiplier change screen according to the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0020] Hereinafter, an example of an embodiment of the present disclosure will be described with reference to the drawings. In each drawing, the same or equivalent components and parts are given the same reference numerals. In addition, the dimensional ratios of the drawings are exaggerated for the convenience of explanation and may differ from the actual ratios.

[0021] 1, an information processing system 100 according to this embodiment includes a plurality of user terminal devices 10A, 10B, 10C, etc., and a tenant server 20. In the following, when the plurality of user terminal devices 10A, 10B, 10C, etc. are described without distinction, they will be collectively referred to simply as "user terminal device 10."

[0022] The user terminal device 10 and the tenant server 20 are capable of communicating with each other via a communication means N. In this embodiment, an in-company communication line such as a LAN (Local Area Network) or a WAN (Wide Area Network) is applied as the communication means N. However, a public communication line such as the Internet or a telephone line may be applied as the communication means N, or a combination of an in-company communication line and a public communication line may be applied. In this embodiment, a wired communication line is applied as the communication means N. However, a wireless communication line may be applied as the communication means N, or a combination of wired and wireless communication lines may be applied.

[0023] The user terminal device 10 according to this embodiment is an information processing terminal that can connect to the tenant server 20 via a communication means N and use the services described below. In this embodiment, a personal computer is applied as the user terminal device 10. However, any information processing terminal such as a tablet terminal or a smartphone may be applied as the user terminal device 10.

[0024] The user terminal device 10 according to this embodiment includes an input unit 12 and a display unit 14.

[0025] The input unit 12 includes a pointing device such as a mouse, and a keyboard, and is used to receive various types of input information.

[0026] The display unit 14 is, for example, a liquid crystal display, and displays various information. The display unit 14 may function as the input unit 12 by adopting a touch panel system.

[0027] The tenant server 20 according to this embodiment is a server that manages the authority for a user to use a service on the communication means N using a user terminal device 10 by a multi-tenant management method. In this embodiment, a cloud service or a web service is applied as a service on the communication means N (hereinafter, simply referred to as a "service"). However, any service provided by resources such as hardware, software, or data that the user can use via the communication means N may be applied as the service.

[0028] The multi-tenant management method is a management method in which a plurality of tenants (tenant A and tenant B in the example shown in FIG. 1) representing a group that manages the use of a service are set, and the authority to use the service is managed for each of the tenants. In this embodiment, the management of the use of the service applies to the management of users who can use the service and the management of the authority of the users.

[0029] A user belonging to a tenant can use a service corresponding to the tenant he or she belongs to. In this embodiment, a case will be described in which one tenant manages one service.

[0030] A company that has a contract with a tenant appoints an administrator (hereinafter referred to as the "administrator") to manage the tenant. The administrator registers and deletes users who belong to the managed tenant, and sets the conditions for authentication information for the users to use the corresponding services.

[0031] Moreover, the tenant server 20 according to this embodiment has an information processing device 30 built in. In this embodiment, a server computer is applied as the information processing device 30. However, any information processing device such as a personal computer may be applied as the information processing device 30. Moreover, the tenant server 20 and the information processing device 30 may be configured separately.

[0032] 2, the information processing device 30 according to this embodiment includes a CPU 31, a memory 32 as a temporary storage area, a non-volatile storage unit 33, and a communication I / F unit 38. Each component is connected to each other via a bus B3.

[0033] The storage unit 33 is realized by a storage device such as an HDD, an SSD, or a flash memory. The storage unit 33 as a storage medium stores an information processing program 33A, a user setting program 33C, a policy setting program 33D, and a policy change program 33E. The CPU 31 reads these programs from the storage unit 33, expands them in the memory 32, and sequentially executes the processes contained in the programs. The execution of each program will be described in detail later. The storage unit 33 also stores various databases such as a tenant database 33F and a user database 33G.

[0034] The communication I / F unit 38 is an interface for the information processing device 30 to communicate with an external device such as the user terminal device 10. For this communication, for example, a wired communication standard such as Ethernet (registered trademark) or FDDI, or a wireless communication standard such as 4G, 5G, or Wi-Fi (registered trademark) is used.

[0035] Next, the tenant database 33F according to this embodiment will be described with reference to Fig. 3. The tenant database 33F shown in Fig. 3 stores tenant information, which is information about tenants managed by the tenant server 20. In Fig. 3, each row represents a piece of tenant information. Each piece of tenant information is associated with information about a tenant ID, a password policy, and a contracted company.

[0036] The tenant ID is information for individually identifying a tenant, and is an ID that is assigned in advance as information that differs for each tenant.

[0037] The password policy is information indicating conditions for authentication information for a user to use a service corresponding to a corresponding tenant. In this embodiment, the password policy applies a minimum length of authentication information (hereinafter referred to as a "minimum password length") and whether or not to use uppercase alphabetical characters (hereinafter referred to as "whether or not to use uppercase alphabetical characters"). Furthermore, in this embodiment, the password policy applies whether or not to use lowercase alphabetical characters (hereinafter referred to as "whether or not to use lowercase alphabetical characters"), whether or not to use numbers (hereinafter referred to as "whether or not to use numbers"), and the expiration date of authentication information (hereinafter simply referred to as "expiration date"). However, the password policy may apply conditions such as whether or not to use symbols and an upper limit on the number of times the same authentication information is repeatedly used, or a single or multiple combinations of these conditions may be applied.

[0038] The contracting company is information indicating the name of the company that contracts with the corresponding tenant.

[0039] Next, the user database 33G according to the present embodiment will be described with reference to FIG. 4. In the user database 33G shown in FIG. 4, user information, which is information about a user who uses a service using a user terminal device 10, is stored. In FIG. 4, each row represents user information. In each piece of user information, information on a user ID, a tenant to which the user belongs, a company to which the user belongs, and a home tenant is associated. In addition, in each piece of user information, information indicating authentication information as a hash value, information indicating the date and time when the authentication information was set, and a change history of the authentication information are also associated. In addition, in each piece of user information, information indicating the name of the user, information indicating the name of the organization to which the user belongs, and information indicating the user's email address are also associated. However, in order to avoid confusion, illustration and explanation of these pieces of information are omitted.

[0040] The user ID is information for individually identifying a user, and is an ID that is assigned in advance as information that differs for each user.

[0041] The above-mentioned "tenant" is information indicating the tenant ID of the tenant to which the corresponding user belongs. As shown in Fig. 4, "none" is stored as the tenant to which the user belongs for a user who does not belong to a tenant.

[0042] The company is information indicating the name of the company to which the corresponding user belongs.

[0043] The home tenant is a tenant to which the user belongs that corresponds to a home policy, which is a password policy with the highest security level among the password policies defined for the corresponding tenants to which the user belongs. The home tenant does not necessarily have to match the home policy, and may be, for example, the tenant to which the user first belonged or a tenant set as the home tenant by an administrator. Even in this case, a home policy is set for each user, and the same invention as below can be applied. In addition, the home tenant of a user who does not belong to a tenant stores a contract tenant, which is a tenant with which the corresponding company to which the user belongs has a contract.

[0044] Next, the operation of the information processing device 30 according to this embodiment will be described with reference to Fig. 5 to Fig. 18. First, the operation of the information processing device 30 when executing information processing will be described with reference to Fig. 5 to Fig. 11. When a user issues an instruction to start execution of the information processing program 33A via the input unit 12, the CPU 31 of the information processing device 30 executes the information processing program 33A, thereby executing the information processing shown in Fig. 5.

[0045] In step 100, the CPU 31 waits until it receives authentication information (hereinafter simply referred to as "password") for using services corresponding to all tenants to which the user belongs from the input unit 12 via the communication I / F unit 38.

[0046] In step 102, the CPU 31 executes a home policy derivation process for deriving a home policy corresponding to the user. The home policy derivation process according to this embodiment will be described later with reference to FIG.

[0047] In step 104, the CPU 31 determines whether or not the password received in step 100 satisfies the home policy derived in step 102. If the determination in the process of step 104 is affirmative, the CPU 31 proceeds to step .

[0048] Alternatively, CPU 31 may not execute step 100, but may determine in step 104 whether the password pre-stored in storage unit 33 satisfies the home policy derived in step 102, and proceed to step 106 if the determination is affirmative. Alternatively, CPU 31 may determine in step 104 whether the home policy pre-stored in storage unit 33 has a higher security level than the home policy derived in step 102, and proceed to step 106 if the determination is affirmative.

[0049] In step 106, the CPU 31 permits the login and ends this information processing. In other words, the CPU 31 enables the user to use all services corresponding to the tenant to which the user belongs, and ends this information processing.

[0050] On the other hand, if the determination in the process of step 104 is negative, the CPU 31 proceeds to step 108. In step 108, the CPU 31 reads the tenant to which the user belongs from the user database 33G, and determines whether the user belongs to a tenant. In other words, the CPU 31 determines whether the home policy is the maximum tenant. The maximum tenant will be described later. If the determination in the process of step 108 is negative, the CPU 31 proceeds to step 110.

[0051] In step 110, the CPU 31 displays a first authentication information change screen on the display unit 14 in a predetermined format.

[0052] As shown in FIG. 6, the first authentication information change screen according to this embodiment displays a message indicating that the password accepted in step 100 does not satisfy the password policy defined by the contract tenant. The first authentication information change screen according to this embodiment also displays a message urging the user to change the password so as to satisfy the password policy defined by the contract tenant. The first authentication information change screen according to this embodiment also displays the password policy defined by the contract tenant. The user inputs the changed password into the password input field 14A via the input unit 12.

[0053] In step 112, CPU 31 waits until the password received in the process of step 110, step 118, step 122, or step 124 satisfies the home policy corresponding to the user.

[0054] In step 114, the CPU 31 stores the password received in the process of step 110, step 118, step 122, or step 124 in the storage unit 33 as a password corresponding to the user.

[0055] On the other hand, if the determination in the process of step 108 is affirmative, the CPU 31 proceeds to step 116. In step 116, the CPU 31 reads the storage unit 33, and determines whether or not the home policy has been changed because the user has newly belonged to a tenant in the user setting process described below. In other words, in step 116, the CPU 31 determines whether or not the password policy defined for the tenant to which the user has newly belonged has a higher security level than the home policy that was previously stored. If the determination in the process of step 116 is affirmative, the CPU 31 proceeds to step 118.

[0056] In step 118, the CPU 31 displays a second authentication information change screen on the display unit 14 in a predetermined format.

[0057] As shown in Fig. 7, the second authentication information change screen according to the present embodiment displays a message indicating that the home tenant has been changed because the user has newly joined a tenant, and a message prompting the user to change the password so as to satisfy the home policy. The second authentication information change screen according to the present embodiment also displays the home policy. The user inputs the changed password into the password input field 14B via the input unit 12.

[0058] On the other hand, if the determination in the process of step 116 is negative, the CPU 31 proceeds to step 120. In step 120, the CPU 31 reads the storage unit 33 and determines whether or not the home policy has been changed because the user has been deleted from the tenant to which the user belongs in the user setting process described below. If the determination in the process of step 120 is positive, the CPU 31 proceeds to step 122.

[0059] In step 122, the CPU 31 displays on the display unit 14 a third authentication information change screen in accordance with a predetermined format.

[0060] As shown in Fig. 8, the third authentication information change screen according to the present embodiment displays a message indicating that the home tenant has been changed due to deletion from the belonging tenant, and a message prompting the user to change the password so as to satisfy the home policy. The third authentication information change screen according to the present embodiment also displays the home policy. The user inputs the changed password in the password input field 14C via the input unit 12.

[0061] On the other hand, if the determination is negative in the process of step 120, the CPU 31 proceeds to step 124. In step 124, the CPU 31 displays on the display unit 14 a fourth authentication information change screen that conforms to a predetermined format.

[0062] As shown in Fig. 9, the fourth authentication information change screen according to the present embodiment displays a message indicating that the home policy has been changed due to a change in the password policy corresponding to the tenant to which the user belongs, and prompts the user to change the password to satisfy the home policy. The fourth authentication information change screen according to the present embodiment also displays the home policy. The user inputs the changed password into the password input field 14D via the input unit 12.

[0063] In step 110, step 118, step 122, or step 124, the CPU 31 may present the message and home policy displayed on the screen by voice through the speaker of the user terminal device .

[0064] In the present embodiment, a case has been described in which, when the password accepted by CPU 31 satisfies the home policy (step 104: Y), a message prompting the user to change the password is not displayed. However, when the password accepted by CPU 31 satisfies the home policy, a message may be displayed prompting the user to change the password to one that has a lower security level than the currently set password and satisfies the home policy.

[0065] Next, details of the home policy derivation process according to this embodiment will be described with reference to FIG.

[0066] In step 200, the CPU 31 reads out the tenant corresponding to the user from the user database 33G, and determines whether or not there is a tenant to which the user belongs. If the determination in the process of step 200 is affirmative, the CPU 31 proceeds to step 202.

[0067] In step 202, the CPU 31 reads out the password length lower limit value corresponding to the belonging tenant from the tenant database 33F, and identifies the belonging tenant having the longest password length lower limit value.

[0068] In step 204, the CPU 31 reads out the information on whether or not capital letters are required for the associated tenant from the tenant database 33F, and identifies the associated tenant for which the use of capital letters is mandatory.

[0069] In step 206, the CPU 31 reads out the information on whether or not lowercase letters are required for the associated tenant from the tenant database 33F, and identifies the associated tenant for which the use of lowercase letters is mandatory.

[0070] In step 208, the CPU 31 reads out the number requirement corresponding to the associated tenant from the tenant database 33F, and identifies the associated tenant for which the use of numbers is mandatory.

[0071] In step 210, the CPU 31 reads the expiration date corresponding to the belonging tenant from the tenant database 33F, and identifies the belonging tenant with the shortest expiration date.

[0072] In step 212, the CPU 31 identifies the largest tenant that is the tenant that belongs to the largest number of items identified in steps 202 to 210. Specifically, the CPU 31 identifies the largest tenant that is the tenant that belongs to the largest number of items with the highest security level.

[0073] In step 214, the CPU 31 determines whether or not there is a plurality of maximum tenants. If the determination in the process of step 214 is negative, the CPU 31 proceeds to step 216, and if the determination is positive, the CPU 31 proceeds to step 218.

[0074] In step 216, the CPU 31 sets the password policy corresponding to the maximum tenant as the home policy, and proceeds to step 104 of information processing.

[0075] In step 218, the CPU 31 displays a home tenant selection screen in accordance with a predetermined format on the display unit 14 of the user terminal device 10 owned by the administrator.

[0076] 11, the home tenant selection screen according to this embodiment displays a message indicating that there are multiple largest tenants and the password policies defined for the multiple largest tenants. The administrator inputs the largest tenant to be applied as the home tenant in the home tenant selection field 14E via the input unit 12.

[0077] In step 220, the CPU 31 sets the password policy corresponding to the maximum tenant input in the home tenant selection field 14E as the home policy, and proceeds to step 104 of the information processing.

[0078] On the other hand, if the determination in step 200 is negative, the CPU 31 proceeds to step 222. In step 222, the CPU 31 sets the password corresponding to the contract tenant as the home policy, and proceeds to step 104 of the information processing.

[0079] Next, details of the user setting process according to this embodiment will be described with reference to Fig. 12 and Fig. 13. When an instruction to start execution of the user setting program 33C is given by the administrator via the input unit 12, the CPU 31 of the information processing device 30 executes the user setting program 33C, thereby executing the user setting process shown in Fig. 12.

[0080] In step 300, the CPU 31 displays on the display unit 14 a user setting screen page that conforms to a predetermined format.

[0081] 13, the user setting screen according to this embodiment displays a message prompting the user to input a user ID and to select a process to make the input user ID belong to a managed tenant or a process to delete the user from the managed tenant. The administrator first inputs a user ID into a user ID input field 14F via the input unit 12. Next, if the administrator wants to make the user ID input into the user ID input field 14F belong to a managed tenant, the administrator selects an affiliation button 14G via the input unit 12, and if the administrator wants to delete the user ID from the managed tenant, the administrator selects a deletion button 14H via the input unit 12.

[0082] In step 302, the CPU 31 determines whether or not the affiliation button 14G is selected on the user setting screen. If the determination in the process of step 302 is affirmative, the CPU 31 proceeds to step 304, and if the determination is negative, the CPU 31 proceeds to step 306.

[0083] In step 304, the CPU 31 adds the tenant managed by the administrator to the belonging tenant corresponding to the user ID entered in the user ID entry field 14F in the user database 33G, and ends this user setting process.

[0084] In step 306, the CPU 31 deletes the tenant managed by the administrator from the belonging tenant in the user database 33G corresponding to the user ID entered in the user ID entry field 14F, and ends this user setting process.

[0085] Next, details of the policy setting process according to this embodiment will be described with reference to Fig. 14 to Fig. 16. When an instruction to start execution of the policy setting program 33D is given by an administrator via the input unit 12, the CPU 31 of the information processing device 30 executes the policy setting program 33D, thereby executing the policy setting process shown in Fig. 14.

[0086] In step 400, the CPU 31 reads the tenant database 33F and determines whether there is a tenant contracted by the same company as the company that contracts the tenant to be managed. If the determination in the processing of step 400 is affirmative, the CPU 31 proceeds to step 402, and if the determination is negative, the CPU 31 proceeds to step 408.

[0087] In step 402, the CPU 31 displays an applicable policy screen on the display unit 14 in a predetermined format.

[0088] 15, the applicable policy screen according to this embodiment displays a message indicating that there is a tenant contracted by the same company as the company contracting the tenant to be managed, and a password policy defined for the tenant contracted by the same company. The administrator selects, via the input unit 12, an apply button 14I if the administrator wishes to apply the password policy defined for the tenant contracted by the same company as the password policy for the tenant to be managed as is, or a do not apply button 14J if the administrator wishes to not apply the password policy.

[0089] In step 404, the CPU 31 determines whether or not the apply button 14I is selected on the applicable policy screen. If the determination in the process of step 404 is affirmative, the CPU 31 proceeds to step 406, and if the determination is negative, the CPU 31 proceeds to step 408.

[0090] In step 406, the CPU 31 stores the password policy defined for the tenant with which the same company has a contract as the password policy of the tenant under management in the tenant database 33F, and ends this policy setting process.

[0091] In step 408, the CPU 31 displays a policy setting screen on the display unit 14 in accordance with a predetermined format.

[0092] 16, a message prompting input of a password policy is displayed on the policy setting screen according to the present embodiment. The administrator inputs the password policy of the tenant to be managed in the password policy input field 14K via the input unit 12.

[0093] In step 410, the CPU 31 stores the password policy entered in the password policy entry field 14K on the policy setting screen as the password policy of the managed tenant in the tenant database 33F, and ends this policy setting process.

[0094] When the CPU 31 sets a password policy by the process of step 406, if the applied password policy is changed by a policy change process described later, the set password policy may be changed accordingly.

[0095] Next, details of the policy change process according to this embodiment will be described with reference to Fig. 17 and Fig. 18. When an instruction to start execution of the policy change program 33E is given by the administrator via the input unit 12, the CPU 31 of the information processing device 30 executes the policy change program 33E, thereby executing the policy change process shown in Fig. 17.

[0096] In step 500, the CPU 31 displays a policy change screen on the display unit 14 in a predetermined format.

[0097] 18, a message prompting input of a changed password policy is displayed on the policy change screen according to the present embodiment. The administrator inputs the changed password policy of the managed tenant in the changed password policy input field 14L via the input unit 12.

[0098] In step 502, the CPU 31 overwrites the password policy of the managed tenant in the tenant database 33F with the password policy entered in the post-change password policy entry field 14L on the policy change screen, and ends this policy change process.

[0099] The CPU 31 may execute information processing after executing the user setting process or the policy change process. In this case, the CPU 31 derives a home policy without executing step 100 in the information processing, and when the password pre-stored in the storage unit 33 does not satisfy the derived home policy, the CPU 31 may present a message prompting the user to change the password when the password policy pre-stored in the user database 33G corresponding to the home tenant has a lower security level than the derived home policy.

[0100] Furthermore, if all items in the current password policy have a lower security level than the item in the home policy with the lowest security level, the CPU 31 may present a message urging the user to change the password.

[0101] [Second embodiment] The second embodiment differs from the first embodiment in that the tenant that is applied as the maximum tenant is the one that corresponds to the password policy with the highest policy score, which is a value obtained by multiplying each of the items of the password policy by a predetermined multiplier and adding up the values ​​for each item. This will be described in detail below.

[0102] It should be noted that the hardware configuration of the information processing device 30 according to this embodiment is the same as the configuration according to the first embodiment (see FIGS. 1 to 4), and therefore a description thereof will be omitted here.

[0103] Next, the operation of the information processing device 30 when executing the home policy derivation process will be described with reference to Fig. 19. Note that the process of step 600 and the process of steps 630 to 638 of the information processing shown in Fig. 19 are the same as the process of step 200 and the process of steps 214 to 222 of the information processing shown in Fig. 10, and therefore the description thereof will be omitted.

[0104] 19, the CPU 31 reads out a password length lower limit value corresponding to the tenant from the tenant database 33F, normalizes the value to a value between 0 and 1, and multiplies the normalized value by a predetermined multiplier A to derive a password length score. The CPU 31 stores the derived password length score in the storage unit 33.

[0105] In step 604, the CPU 31 reads out the information on whether or not to use uppercase letters from the tenant database 33F, and determines whether or not the use of uppercase letters is required. If the determination in step 604 is affirmative, the CPU 31 proceeds to step 606, and if the determination is negative, the CPU 31 proceeds to step 608.

[0106] In step 606, the CPU 31 derives the English uppercase letter score by multiplying 1 by a predetermined multiplier B, which is a value between 0 and 1. The CPU 31 stores the derived English uppercase letter score in the storage unit 33.

[0107] In step 608 , the CPU 31 sets the English uppercase letter score to 0, and stores the English uppercase letter score in the storage unit 33 .

[0108] In step 610, the CPU 31 reads out the lowercase alphabet requirement corresponding to the tenant from the tenant database 33F and determines whether the use of lowercase alphabet is mandatory. If the determination in step 610 is affirmative, the CPU 31 proceeds to step 612, and if the determination is negative, the CPU 31 proceeds to step 614.

[0109] In step 612, CPU 31 derives the lowercase English letter score by multiplying 1 by a predetermined multiplier C that is a value between 0 and 1. CPU 31 stores the derived lowercase English letter score in storage unit 33.

[0110] In step 614 , the CPU 31 sets the English lower case score to 0, and stores the English lower case score in the storage unit 33 .

[0111] In step 616, the CPU 31 reads out the number requirement corresponding to the tenant from the tenant database 33F and determines whether the use of numbers is mandatory. If the determination in step 616 is affirmative, the CPU 31 proceeds to step 618, and if the determination is negative, the CPU 31 proceeds to step 620.

[0112] In step 618, CPU 31 derives the numerical score by multiplying 1 by a predetermined multiplier D, which is a value not less than 0 and not more than 1. CPU 31 stores the derived numerical score in storage unit 33.

[0113] In step 620 , the CPU 31 sets the numerical score to 0, and stores the numerical score in the storage unit 33 .

[0114] In step 622, the CPU 31 reads out the expiration date corresponding to the tenant from the tenant database 33F, and derives the expiration date score by multiplying the reciprocal of the expiration date by a predetermined multiplier E. The CPU 31 stores the derived expiration date score in the storage unit 33.

[0115] In step 624 , the CPU 31 derives the policy score as the sum of the password length score, the uppercase letter score, the lowercase letter score, the numeric score, and the expiration date score, and stores the policy score in the storage unit 33 .

[0116] In step 626, the CPU 31 determines whether or not the policy scores of all tenants to which the target user belongs have been derived. If the determination in step 626 is affirmative, the CPU 31 ends this policy score derivation process, and if the determination is negative, the CPU 31 returns to step 602.

[0117] In step 628, the CPU 31 determines the tenant corresponding to the password policy with the highest policy score as the maximum tenant.

[0118] In this embodiment, the CPU 31 derives each score so that it has a value between 0 and 1. However, the CPU 31 may derive each score so that it has a value outside the above range.

[0119] Furthermore, when there are multiple maximum tenants (step 630: Y), the CPU 31 may accept a change from the multiplier A to the multiplier E without executing steps 634 and 636, and may re-derive the policy score using the accepted multiplier.

[0120] Specifically, the CPU 31 displays a multiplier change screen according to a predetermined format on the display unit 14 of the user terminal device 10 owned by the administrator, instead of the home tenant selection screen.

[0121] 20, the multiplier change screen according to this embodiment displays a message indicating that there are multiple maximum tenants and a message prompting the user to change the multipliers A to E. The administrator inputs values ​​to be applied as the multipliers A to E in the multiplier input field 14M via the input unit 12.

[0122] Next, the CPU 31 returns to step 602 and re-derives the policy score using the value entered in the multiplier entry field 14M.

[0123] Although the embodiments have been described above, the technical scope of the present invention is not limited to the scope described in the above embodiments. Various modifications or improvements can be made to the above embodiments without departing from the gist of the invention, and such modifications or improvements are also included in the technical scope of the present invention.

[0124] Furthermore, the above-mentioned embodiments do not limit the inventions described in the claims, and not all of the combinations of features described in the embodiments are necessarily essential to the solution of the invention. The above-mentioned embodiments include inventions at various stages, and various inventions are extracted by combining the multiple constituent elements disclosed. Even if some constituent elements are deleted from all the constituent elements shown in the embodiments, as long as the effect is obtained, the configuration from which these several constituent elements are deleted can be extracted as an invention.

[0125] In addition, in each of the above embodiments, the term "processor" refers to a processor in a broad sense, and includes general-purpose processors (e.g., CPU: Central Processing Unit, etc.) and dedicated processors (e.g., GPU: Graphics Processing Unit, ASIC: Application Specific Integrated Circuit, FPGA: Field Programmable Gate Array, programmable logic device, etc.).

[0126] In addition, the operations of the processor in each of the above embodiments may be performed not only by one processor, but also by multiple processors located at physically separate locations working together. Furthermore, the order of the operations of the processor is not limited to the order described in each of the above embodiments, and may be changed as appropriate.

[0127] In the present embodiment, the information processing program 33A is installed in the storage unit 33, but the present invention is not limited to this. The information processing program 33A according to the present embodiment may be provided in a form recorded in a computer-readable storage medium. For example, the information processing program 33A according to the present embodiment may be provided in a form recorded in an optical disc such as a CD (Compact Disc)-ROM and a DVD (Digital Versatile Disc)-ROM, or in a semiconductor memory such as a USB (Universal Serial Bus) memory and a memory card. The information processing program 33A according to the present embodiment may be obtained from an external device via the communication I / F unit 38.

[0128] In the above embodiment, the information processing is realized by a software configuration using a computer by executing a program, but the present invention is not limited to this. For example, the information processing may be realized by a hardware configuration or a combination of a hardware configuration and a software configuration.

[0129] In addition, the configuration of the information processing device 30 described in the above embodiment is just one example, and it goes without saying that unnecessary parts may be deleted and new parts may be added without departing from the spirit of the present invention.

[0130] Furthermore, the processing flow of the information processing program described in the above embodiment (see FIG. 5) is also one example, and it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be rearranged, without departing from the spirit of the present invention. [Explanation of symbols]

[0131] 10 User terminal device 12 Input section 14 Display section 20 Tenant Server 30 Information processing device 31 CPU 32 Memory 33 Storage section 33A Information Processing Program 33C User setting program 33D Policy Setting Program 33E Policy Change Program 33F Tenant Database 33G User Database 33D History Database 38 Communication I / F section 100 Information Processing Systems N. Means of communication

Claims

1. A processor is provided. The processor, Accepts authentication information to use the group that manages the use of the service, If the received authentication information does not satisfy the highest security level condition among the conditions for the authentication information defined for each group to which the user belongs, a message is displayed urging the user to change the authentication information. Information processing device.

2. When the processor receives the authentication information from a user who does not belong to the group, if the received authentication information does not satisfy a condition for the authentication information defined in a group with which a company to which the user belongs has a contract, the processor presents a message urging the user to change the authentication information. The information processing device according to claim 1 .

3. The condition with the highest security level is an authentication information condition that includes the most items with the highest security level among the authentication information conditions defined for each of the groups to which the user belongs.

3. The information processing device according to claim 1 or 2.

4. The condition with the highest security level is a condition in which a value obtained by multiplying a value representing each item of the condition of the authentication information defined for each of the groups to which the user belongs by a predetermined multiplier and adding up the values, for each item, is the highest.

3. The information processing device according to claim 1 or 2.

5. the processor accepts selection of a condition to be applied as a condition for determining whether to present a notification prompting the user to change the authentication information when there are a plurality of conditions having the highest security level; The information processing device according to any one of claims 1 to 4.

6. the processor accepts a change to the predetermined multiplier when a plurality of conditions having the highest security level exist; The information processing device according to claim 4.

7. Accepts authentication information to use the group that manages the use of the service, If the received authentication information does not satisfy the highest security level condition among the conditions for the authentication information defined for each group to which the user belongs, a message is displayed urging the user to change the authentication information. An information processing program for causing a computer to execute processing.

Images