Account lock control device, account lock control method, and account lock control program

Abstract

To perform account lock so that a security level of a system and convenience to users are appropriately balanced.SOLUTION: An account lock control device 30 comprises: a receiving unit 31 which receives a log-in request 310 to a system from a user; an acquisition unit 32 which acquires state information 320 representing a state of the user; a determination unit 33 which determines a probability 331 that the log-in request 310 is valid, on the basis of a determination reference 330 for determining the probability 331 from the state information 320, the state information 320, and the log-in request 310; and a setting unit 34 which more severely sets an execution reference 340 of account lock according to successive authentication failures in the login request 310 when the determined probability 331 is lower.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention relates to an account lock control device, an account lock control method, and an account lock control program. [Background technology]

[0002] In recent years, there have been numerous security incidents, including system downtime and information leaks, caused by malware infections such as ransomware. For example, as a countermeasure against attacks that attempt to infiltrate a system by brute-force login attempts, account locking is used, which disables logins from an account after a certain number of consecutive failed login attempts. Therefore, there is a need for technology to effectively implement such account locking.

[0003] In relation to the above-mentioned technology, Patent Document 1 discloses a device that acquires the number of authorized users in a specific area including the installation location of the device, compares the acquired number of authorized users with a preset threshold, and authenticates users. If the number of authorized users is equal to or greater than the threshold, this device locks the account when the number of consecutive authentication failures of the user exceeds a preset first set value, and if the number of authorized users is less than the threshold, the device locks the account when the number of consecutive authentication failures of the user exceeds a second set value that is smaller than the first set value. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Publication No. 2017-034523 Summary of the Invention [Problem to be solved by the invention]

[0005] If the execution criteria (execution policy) for account locking are tightened in order to enhance system security, user convenience will decrease, and conversely, if the execution criteria for account locking are loosened in order to enhance user convenience, system security will decrease. Therefore, the challenge is to perform account locking in a way that appropriately balances high system security and user convenience. The technology in Patent Document 1 cannot be said to be sufficient to solve this challenge.

[0006] A primary object of the present invention is to perform account locking so as to appropriately achieve both high system security and user convenience. [Means for solving the problem]

[0007] An account lock control device according to one aspect of the present invention comprises: a receiving means for receiving a login request to a system from a user; an acquisition means for acquiring status information representing the status of the user; a judgment criterion for judging the probability that the login request is legitimate from the status information; a judgment means for judging the probability based on the status information and the login request; and a setting means for setting stricter standards for executing account locking in response to consecutive authentication failures in the login request, the lower the judged probability.

[0008] In another aspect of achieving the above object, an account lock control method according to one aspect of the present invention receives, by an information processing device, a login request to a system from a user, obtains status information representing the status of the user, determines the probability that the login request is legitimate based on a determination criterion for determining the probability from the status information, and based on the status information and the login request, and sets stricter criteria for executing account locking in response to consecutive authentication failures in the login request the lower the determined probability.

[0009] In addition, in a further aspect of achieving the above-mentioned object, an account lock control program according to one aspect of the present invention causes a computer to execute a reception process for receiving a login request to a system from a user, an acquisition process for acquiring status information representing the status of the user, a judgment criterion for judging the probability that the login request is legitimate from the status information, a judgment process for judging the probability based on the status information and the login request, and a setting process for setting stricter execution criteria for account locking in response to consecutive authentication failures in the login request, the lower the judged probability.

[0010] Furthermore, the present invention can also be realized by a computer-readable, non-volatile recording medium on which such an account lock control program (computer program) is stored. [Effects of the Invention]

[0011] The present invention can perform account locking so as to appropriately achieve both high system security and user convenience. [Brief explanation of the drawings]

[0012] [Figure 1] 1 is a block diagram showing a configuration of an account lock control system 1 according to the present disclosure. [Figure 2] 4 is a flowchart showing the operation of the account lock control system 1 according to the present disclosure. [Figure 3] 2 is a block diagram showing the configuration of an account lock control device 30 according to the present disclosure. FIG. [Figure 4] 4 is a flowchart showing the operation of the account lock control device 30 according to the present disclosure. [Figure 5] FIG. 9 is a block diagram showing a configuration of an information processing device 900 that can realize an account lock control device according to the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0013] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[0014] First Embodiment 1 is a block diagram showing the configuration of an account lock control system 1 according to the present disclosure. The account lock control system 1 is a system that appropriately controls the strictness of the account lock execution standard (execution policy) applied when a user (employee, staff, etc.) logs into a business system in, for example, a company or a government office.

[0015] The account lock control system 1 broadly includes an account lock control device 10, a user management system 21, an authentication system 22, an entrance / exit gate 23, and one or more terminals 24. The account lock control device 10, the user management system 21, the authentication system 22, the entrance / exit gate 23, and the one or more terminals 24 are communicably connected to one another via a communication network 20. The communication network 20 is, for example, a communication network such as the Internet or an intranet.

[0016] The user management system 21 includes an information processing device such as a server and manages information representing the status of a user. The information representing the user's status may indicate, for example, whether the user is currently working at the workplace or whether the user is teleworking from home. The information representing the user's status may include, for example, information representing the time and location associated with the user's ID, which is collected when the user holds an identification (ID) card over an ID card reader installed in one or more predetermined locations at the workplace (e.g., a room or floor entrance / exit). The information representing the user's status may include, for example, a business system usage schedule indicated by the user's registered work schedule (working at the workplace, teleworking, going out, vacation, etc.). Furthermore, the user management system 21 may be, at least in part, a system implemented using cloud computing.

[0017] The authentication system 22 includes an information processing device such as a server and authenticates a user when the user logs in to a business system or the like at the workplace. The authentication system 22 may perform authentication using a password, biometric authentication such as facial recognition, or a combination of these. The authentication system 22 also authenticates the user's ID, which is collected when the user holds their ID card over the entrance / exit gate 23 when entering the workplace through the entrance / exit gate 23 installed at the workplace entrance / exit. If the collected ID is unregistered, the authentication system 22 notifies the entrance / exit gate 23 of information indicating that authentication has failed. In response to this notification, the entrance / exit gate 23 notifies the user and a security guard or the like near the entrance / exit gate 23 of the authentication failure. Note that information indicating that the user has entered or exited the workplace through the entrance / exit gate 23 is notified to the user management system 21 by the entrance / exit gate 23. Based on the notification from the entrance / exit gate 23, the user management system 21 manages information indicating whether the user is at work or not.

[0018] Furthermore, when a user fails authentication repeatedly when logging into a business system, the authentication system 22 executes account locking for that user based on the execution criteria 220. The execution criteria 220 are criteria that indicate the strictness (looseness) of account locking, and are set by the account lock control device 10, which will be described later. Furthermore, at least a part of the authentication system 22 may be a system built using cloud computing.

[0019] The terminal 24 is an information processing device such as a server, personal computer, smartphone, tablet terminal, etc., that is used by a user in the course of business. The terminal 24 is installed, for example, at a predetermined location in the workplace and used by the user who performs business at the workplace. The terminal 24 is installed, for example, at the user's home and used by the user who performs business from home by telework.

[0020] The account lock control device 10 is an information processing device such as a server. The account lock control device 10 may be, for example, a device included in a business system at a workplace, or may be a device independent of the business system. Furthermore, at least a part of the account lock control device 10 may be a device constructed using cloud computing.

[0021] The account lock control device 10 includes a reception unit 11, an acquisition unit 12, a determination unit 13, a setting unit 14, a performance management unit 15, and a memory unit 16. The reception unit 11, the acquisition unit 12, the determination unit 13, the setting unit 14, and the performance management unit 15 are examples of a reception means, an acquisition means, a determination means, a setting means, and a performance management means, respectively.

[0022] The storage unit 16 is, for example, a storage device such as a RAM (Random Access Memory) 903 or a hard disk 904, which will be described later with reference to Fig. 5. The storage unit 16 stores a login request 161, status information 162, judgment criteria 163, setting criteria 164, and performance management information 165. The above-mentioned information stored in the storage unit 16 will be described in detail later.

[0023] The reception unit 11 receives a login request 161 from a user to a business system from a terminal 24 used by the user. The login request 161 includes the user's ID and password, and information that can identify the terminal 24. The information that can identify the terminal 24 may include, for example, at least one of an IP (Internet Protocol) address, a MAC (Media Access Control) address, etc. The reception unit 11 stores the received login request 161 in the storage unit 16.

[0024] The acquisition unit 12 acquires status information 162 representing the status of a user, for example, from the user management system 21. As described above with respect to the user management system 21, the status information 162 represents, for example, whether the user is currently working at the workplace, or whether the user is working remotely from home. The status information 162 represents, for example, the user's current location at the workplace based on information collected from an ID card reader or the like. The status information 162 represents, for example, the user's planned use of the business system. The acquisition unit 12 stores the acquired status information 162 in the memory unit 16.

[0025] The determination unit 13 determines the likelihood that the login request 161 is valid (not an unauthorized access) based on the login request 161 accepted by the acceptance unit 11, the state information 162 acquired by the acquisition unit 12, and the determination criterion 163. The determination criterion 163 is a criterion for determining the likelihood that the login request 161 is valid from the state information 162, and is provided by, for example, an administrator of the account lock control device 10. Alternatively, the determination criterion 163 may be acquired by the account lock control device 10 from an external device.

[0026] The determination criterion 163 indicates that, for example, when the login request 161 is issued from a terminal installed in a location that can only be entered if the user is authenticated by the authentication system 22 (i.e., the floor of the workplace entered through the entrance / exit gate 23), the likelihood that the login request 161 is legitimate is higher than a predetermined reference value. This is based on the fact that only users who are authenticated when passing through the entrance / exit gate 23 can operate the terminal 24 installed on the workplace floor, and therefore, it is highly likely that the login request 161 from the terminal 24 installed on the workplace floor is legitimate. Note that information that associates the information that can identify the terminal 24 included in the login request 161 with the information indicating the installation location of the terminal 24 is assumed to be provided to the account lock control device 10, and the determination unit 13 may make the above-mentioned determination using this information.

[0027] The determination criterion 163 indicates that the likelihood that the login request 161 is legitimate is lower than a predetermined reference value, for example, when the login request 161 is issued from a terminal 24 installed in a location different from the location of the user registered in advance, which is indicated by the status information 162. For example, suppose that the status information 162 indicates that the user is scheduled to work at his or her workplace, but the login request 161 including the ID of the user is issued from an external terminal 24 that is not installed at the workplace and is accepted by the accepting unit 11. In this case, the content indicated by the status information 162 and the content indicated by the accepted login request 161 do not match, and therefore the likelihood that the login request 161 is legitimate is considered to be low. In the above-mentioned case, if the terminal 24 that issued the login request 161 is a terminal 24 installed in the user's home, taking into account the possibility that the user has suddenly changed from working at the office to teleworking, the judgment criterion 163 may indicate that the probability that the login request 161 is legitimate is higher than a predetermined reference value.

[0028] The determination criterion 163 indicates, for example, that if the login request 161 is issued from a terminal 24 installed in a location different from the user's current location represented by the status information 162, the likelihood that the login request 161 is legitimate is lower than a predetermined value. In this case, the acquisition unit 12 may estimate the user's current location from information necessary for estimating the user's current location, which is included in the status information 162. The information necessary for estimating the user's current location, which is included in the status information 162, may include, for example, information indicating the time and location associated with the user's ID, which is collected when the user holds their ID card over an ID card reader. The information necessary for estimating the user's current location, which is included in the status information 162, may include, for example, information indicating the time and location associated with the user, which is represented by the result of facial recognition of the user's facial image included in an image captured by a surveillance camera installed in one or more predetermined locations at the workplace. In this case, however, the user's facial image necessary for facial recognition is managed, for example, in the user management system 21.

[0029] For example, suppose that the acquisition unit 12 estimates that the user's current location is floor A at the workplace, but the reception unit 11 receives a login request 161 including the user's ID, which is issued from a terminal 24 installed on floor B, which is different from floor A. In this case, the user's current location estimated from the status information 162 does not match the content indicated by the received login request 161, so it is considered that the login request 161 is unlikely to be legitimate.

[0030] The setting unit 14 sets an execution standard 220 for account locking in response to consecutive authentication failures of the login request 161 based on the probability that the login request 161 is legitimate determined by the determination unit 13 and the setting standard 164. The setting standard 164 indicates that the lower the probability that the login request 161 is legitimate, the stricter the account lock execution standard 220 is set. The setting standard 164 is provided, for example, by an administrator of the account lock control device 10. Alternatively, the setting standard 164 may be acquired by the account lock control device 10 from an external device.

[0031] The setting unit 14 sets the execution standard 220 for account locking so that, for example, the lower the probability determined by the determination unit 13, the fewer the number of consecutive authentication failures allowed for the login request 161 before executing account locking. More specifically, for example, when the probability determined by the determination unit 13 is equal to or greater than the reference value indicated by the setting standard 164, the setting unit 14 sets the number of consecutive authentication failures allowed N in the execution standard 220 to N1 (N, N1 are natural numbers). Then, when the probability determined by the determination unit 13 is less than the reference value indicated by the setting standard 164, the setting unit 14 sets the number of consecutive authentication failures allowed N in the execution standard 220 to N2 (N2 is a natural number) that is smaller than N1.

[0032] In this case, when the number of consecutive authentication failures in the login request 161 reaches the allowable number N based on the execution criteria 220, the authentication system 22 executes account locking for the user who made the login request 161. As a result, the user is unable to log in to the business system for a predetermined time indicated by the execution criteria 220.

[0033] The setting unit 14 may set the execution criteria 220 for account locking so that, for example, the lower the probability determined by the determination unit 13, the longer the time until the account is unlocked. More specifically, for example, when the probability determined by the determination unit 13 is equal to or greater than the reference value indicated by the setting criteria 164, the setting unit 14 sets the time until the account is unlocked in the execution criteria 220 to half a day. Then, when the probability determined by the determination unit 13 is less than the reference value indicated by the setting criteria 164, the setting unit 14 sets the time until the account is unlocked in the execution criteria 220 to one day.

[0034] In this case, the authentication system 22 keeps the account locked for half a day for a user whose probability determined by the determination unit 13 based on the execution standard 220 is equal to or greater than the standard value indicated by the set standard 164, and keeps the account locked for one day for a user whose probability is less than the standard value indicated by the set standard 164.

[0035] The result management unit 15 manages result management information 165 that indicates the number of times account locking has been executed for each user up to now. Every time the authentication system 22 executes account locking for a certain user in relation to login to a business system, the result management unit 15 increments the number of times account locking has been executed for that user in the result management information 165 by one.

[0036] The setting unit 14 sets the execution standard 220 based on the setting standard 164, which indicates that the account locking execution standard 220 should be set stricter for a user who has had a greater number of account locking attempts indicated by the performance management information 165. Note that, as described above, setting the account locking execution standard 220 stricter means, for example, reducing the number of consecutive authentication failures N allowed or lengthening the time until the account is unlocked.

[0037] Next, the operation (processing) of the account lock control system 1 according to the present disclosure will be described in detail with reference to the flowchart of FIG.

[0038] The reception unit 11 receives a login request 161 to the business system from the terminal 24 (step S101). The acquisition unit 12 acquires, from the user management system 21, status information 162 related to a user identified by the user ID included in the login request 161 received by the reception unit 11 (step S102). The determination unit 13 determines the likelihood that the login request 161 received by the reception unit 11 is valid, based on the status information 162 acquired by the acquisition unit 12 and a determination criterion 163 (step S103).

[0039] If the probability of being a valid user is equal to or greater than the reference value indicated by the setting standard 164 (Yes in step S104), the setting unit 14 sets the allowable number N of consecutive authentication failures in the execution standard 220 to N1 (N1>N2) (step S105). If the probability of being a valid user is not equal to or greater than the reference value indicated by the setting standard 164 (i.e., less than the reference value) (No in step S104), the setting unit 14 sets the allowable number N of consecutive authentication failures in the execution standard 220 to N2 (N1>N2) (step S106).

[0040] The authentication system 22 performs authentication for the login request 161 (step S107). If the authentication for the login request 161 is successful (Yes in step S108), the authentication system 22 permits access to the system by the login request 161 (step S109), and the entire process ends. If the authentication for the login request 161 is not successful (i.e., fails) (No in step S108), the process proceeds to step S110.

[0041] If the number of consecutive authentication failures for login request 161 reaches the allowable number N (Yes in step S110), authentication system 22 executes account locking for the user identified by the user ID included in login request 161 in accordance with execution standard 220, notifies terminal 24 that issued login request 161 that the account locking has been executed (step S111), and the entire process ends. If the number of consecutive authentication failures for login request 161 does not reach the allowable number N (No in step S110), authentication system 22 does not execute account locking for the user identified by the user ID included in login request 161, but notifies terminal 24 that issued login request 161 that authentication of login request 161 has failed (step S112), and the entire process ends.

[0042] The account lock control device 10 according to the present disclosure can lock an account so as to appropriately achieve both high system security and user convenience. This is because the account lock control device 10 determines the likelihood that a login request 161 is legitimate based on status information 162 related to the user who made the login request 161, and sets stricter account lock execution criteria 220 as the likelihood decreases.

[0043] The effects achieved by the account lock control device 10 according to the present disclosure will be described in detail below.

[0044] If the account locking criteria are tightened in order to improve system security, user convenience will decrease, and conversely, if the account locking criteria are relaxed in order to improve user convenience, system security will decrease. Therefore, the challenge is to perform account locking in a way that appropriately balances high system security and user convenience.

[0045] To address this problem, the account lock control device 10 according to the present disclosure accepts a login request 161 from a user to a system and acquires state information 162 indicating the state of the user. The account lock control device 10 determines the likelihood that the login request 161 is legitimate based on a determination criterion 163 for determining the likelihood from the state information 162 and the login request 161. The account lock control device 10 then sets a stricter execution criterion 220 for account locking in response to consecutive authentication failures in the login request 161 the lower the determined likelihood. In other words, the account lock control device 10 flexibly sets the strictness (looseness) of the execution criterion 220 for each user based on the idea that there is no problem even if the account lock execution criterion 220 is relaxed if the likelihood that the login request 161 is legitimate based on the user's state information 162 is high. This allows the account lock control device 10 to lock accounts in a way that appropriately balances high system security with user convenience.

[0046] The account lock control device 10 according to the present disclosure also manages the number of times that account locking has been performed for a user up to now, and sets stricter execution criteria 220 as the number of times increases. This allows the account lock control device 10 to perform account locking in a way that appropriately balances high system security with user convenience.

[0047] Furthermore, the account lock control device 10 according to the present disclosure sets the execution standard 220 so that the lower the determined probability, the fewer consecutive authentication failures in the login request 161 are permitted before locking the account. Also, the account lock control device 10 sets the execution standard 220 so that the lower the determined probability, the longer the time until the account is unlocked. In this way, the account lock control device 10 can flexibly set the strictness of the execution standard 220 using various methods.

[0048] The determination criterion 163 used by the account lock control device 10 according to the present disclosure indicates that the probability that the login request 161 is issued from a terminal 24 installed in a location that can only be accessed if the user is authenticated by the authentication system 22 is higher than a predetermined value. The determination criterion 163 also indicates that the probability that the login request 161 is issued from a terminal 24 installed in a location different from the user's pre-registered location is lower than a predetermined value. The account lock control device 10 estimates the user's current location from information necessary for estimating the user's current location. In this case, the determination criterion 330 indicates that the probability that the login request is issued from a terminal 24 installed in a location different from the estimated user's current location is lower than a predetermined value. In this way, the account lock control device 10 determines the probability that the login request 161 is legitimate from various perspectives, thereby enabling account locking to more appropriately achieve both high system security and user convenience.

[0049] <Second embodiment> 3 is a block diagram showing the configuration of an account lock control device 30 according to the present disclosure. The account lock control device 30 includes a reception unit 31, an acquisition unit 32, a determination unit 33, and a setting unit 34. The reception unit 31, the acquisition unit 32, the determination unit 33, and the setting unit 34 are examples of a reception means, an acquisition means, a determination means, and a setting means, respectively.

[0050] The reception unit 31 receives a login request 310 from a user to the system. The login request 310 is, for example, information similar to the login request 161 related to the account lock control device 10. The reception unit 31 operates in the same manner as the reception unit 11 related to the account lock control device 10, for example.

[0051] The acquisition unit 32 acquires state information 320 that indicates the state of the user. The state information 320 is, for example, information similar to the state information 162 related to the account lock control device 10. The acquisition unit 32 operates in the same manner as the acquisition unit 12 related to the account lock control device 10, for example.

[0052] The determination unit 33 determines the probability 331 based on a determination criterion 330 for determining the probability 331 that the login request 310 is valid from the state information 320, and on the state information 320 and the login request 310. The determination criterion 330 is, for example, information similar to the determination criterion 163 related to the account lock control device 10. The probability 331 is, for example, information similar to the probability determined by the determination unit 13 related to the account lock control device 10. The determination unit 33 operates in the same manner as the determination unit 13 related to the account lock control device 10, for example.

[0053] The lower the determined probability 331, the stricter the setting unit 34 sets the execution standard 340 for account locking in response to consecutive authentication failures in the login request 310. The execution standard 340 is, for example, information similar to the execution standard 220 related to the account lock control device 10. The setting unit 34 operates in the same manner as the setting unit 14 related to the account lock control device 10, for example.

[0054] Next, the operation (processing) of the account lock control device 30 according to the present disclosure will be described in detail with reference to the flowchart of FIG.

[0055] The accepting unit 31 accepts a login request 310 from a user to the system (step S201). The acquiring unit 32 acquires state information 320 indicating the state of the user (step S202). The determining unit 33 determines the probability 331 that the login request 310 is valid based on the state information 320, the determination criteria 330 for determining the probability 331, and the state information 320 and the login request 310 (step S203). The setting unit 34 sets stricter criteria for locking an account in response to consecutive authentication failures in the login request 310 as the determined probability 331 becomes lower (step S204), and the entire process ends.

[0056] The account lock control device 30 according to the present disclosure can lock an account so as to appropriately achieve both high system security and user convenience. This is because the account lock control device 30 determines the probability 331 that the login request 310 is legitimate based on the status information 320 related to the user who made the login request 310, and sets the account lock execution criteria 220 stricter the lower the probability 331.

[0057] <Hardware configuration example> In each of the above-described embodiments, each unit in the account lock control device shown in Figures 1 and 3 can be realized by dedicated HW (Hardware) (electronic circuitry). In Figures 1 and 3, at least the following components can be considered as functional (processing) units (software modules) of a software program that includes instructions executed by a processor. Reception desks 11 and 31, Acquisition units 12 and 32, Determination units 13 and 33, Setting units 14 and 34, · Performance Management Department 15, ·Memory control function in the memory unit 16.

[0058] However, the division of the various components shown in these drawings is for the sake of convenience, and various configurations may be envisioned for implementation. An example of the hardware environment in this case will be described with reference to FIG. 5.

[0059] Fig. 5 is a diagram illustrating an example of the configuration of an information processing device 900 (computer) capable of realizing the account lock control device according to the present disclosure. That is, Fig. 5 shows the configuration of a computer (information processing device) capable of realizing the account lock control device shown in Figs. 1 and 3, and represents a hardware environment capable of realizing each function in the above-described embodiment. However, each unit in the above-described account lock control device may be distributed among multiple information processing devices 900, or at least some of the functions may be provided in a server or the like that constitutes a cloud computing environment.

[0060] The information processing device 900 shown in FIG. 5 includes the following components. ·CPU(Central Processing Unit)901, ·ROM (Read Only Memory) 902, ·RAM(Random Access Memory)903, Hard disk (storage device) 904, a communication interface 905; Bus 906 (communication line), A reader / writer 908 capable of reading and writing data stored in a recording medium 907 such as a CD-ROM (Compact Disc Read Only Memory), · Input / output interface 909 such as a monitor, speaker, keyboard, etc.

[0061] That is, the information processing device 900 having the above-mentioned components is a general computer in which these components are connected via a bus 906. The information processing device 900 may have multiple CPUs 901, or may have a CPU 901 configured with multiple cores. The information processing device 900 may also not have some of the above-mentioned components.

[0062] The present invention, explained using the above-mentioned embodiment as an example, supplies a computer program capable of realizing the following functions to the information processing device 900 shown in FIG. 5. The functions are the functions described above in the block diagrams (FIGS. 1 and 3) or flowcharts (FIGS. 2 and 4) referred to in the description of the embodiment. The present invention is then achieved by reading the computer program into the CPU 901 of the hardware, interpreting it, and executing it. The computer program supplied to the device may be stored in a readable / writable volatile memory (RAM 903) or a non-volatile storage device such as a ROM 902 or hard disk 904.

[0063] In the above case, the method of supplying the computer program to the hardware can be a currently common procedure, such as installing the program in the device via a recording medium 907 such as a CD-ROM, or downloading the program from an external source via a communication line such as the Internet. In such a case, the present invention can be considered to be constituted by the code constituting the computer program or the recording medium 907 on which the code is stored.

[0064] The present invention has been described above using the above-described embodiments as exemplary examples. However, the present invention is not limited to the above-described embodiments. In other words, the present invention can be applied in various aspects that can be understood by a person skilled in the art within the scope of the present invention.

[0065] Note that part or all of the above-described embodiments can also be described as follows: However, the present invention, which has been exemplarily described using the above-described embodiments, is not limited to the following.

[0066] (Appendix 1) A receiving means for receiving a login request to the system from a user; acquiring means for acquiring status information representing the status of the user; a determination criterion for determining the likelihood that the login request is valid based on the status information, and a determination means for determining the likelihood based on the status information and the login request; a setting means for setting stricter standards for locking an account in response to successive authentication failures in the login request as the determined probability becomes lower; An account lock control device comprising:

[0067] (Appendix 2) the login request includes information capable of identifying a terminal that has issued the login request; the status information represents at least one of the user's location and the user's planned use of the system; 2. The account lock control device according to claim 1.

[0068] (Appendix 3) further comprising a record management means for managing the number of times that account locking has been executed for the user up to now; The setting means sets the execution standard to be stricter as the number of times increases. 10. An account lock control device according to claim 1 or 2.

[0069] (Appendix 4) the setting means sets the execution standard so that the lower the determined probability, the fewer consecutive authentication failures allowed in the login request before executing account locking. 4. An account lock control device according to claim 1, wherein the account lock control device is a device for controlling an account lock.

[0070] (Appendix 5) The setting means sets the execution standard so that the lower the determined probability, the longer the time until the account lock is released. 5. An account lock control device according to claim 1, wherein the account lock control device is a device for controlling an account lock.

[0071] (Appendix 6) the determination criterion indicates that the probability is higher than a predetermined value if the login request is issued from the terminal installed in a location where the user can enter only if authenticated by an authentication system; 3. The account lock control device according to claim 2.

[0072] (Appendix 7) the determination criterion indicates that the probability is lower than a predetermined value when the login request is issued from the terminal installed in a location different from the location of the user registered in advance; 3. The account lock control device according to claim 2.

[0073] (Appendix 8) the acquisition means estimates the current location of the user from information necessary for estimating the current location of the user; the determination criterion indicates that the probability is lower than a predetermined value when the login request is issued from the terminal installed in a location different from the estimated current location of the user. 3. The account lock control device according to claim 2.

[0074] (Appendix 9) By the information processing device, Accepts a user's request to log in to the system, acquiring status information representing the status of the user; determining the likelihood that the login request is valid based on a determination criterion for determining the likelihood from the status information, the status information, and the login request; the lower the determined probability, the stricter the criteria for locking the account in response to consecutive authentication failures in the login requests is set. Account lock control method.

[0075] (Appendix 10) the login request includes information capable of identifying a terminal that has issued the login request; the status information represents at least one of the user's location and the user's planned use of the system; 10. The account lock control method according to claim 9.

[0076] (Appendix 11) Manage the number of times that account locking has been performed on the user up to now; The more the number of times, the stricter the execution standard is set. 11. An account lock control method according to claim 9 or 10.

[0077] (Appendix 12) The execution standard is set so that the lower the determined probability, the fewer consecutive authentication failures allowed in the login requests before executing account locking. 12. An account lock control method according to any one of Supplementary Note 9 to Supplementary Note 11.

[0078] (Appendix 13) The execution standard is set so that the lower the determined probability, the longer the time until the account is unlocked. 13. An account lock control method according to any one of Supplementary Note 9 to Supplementary Note 12.

[0079] (Appendix 14) the determination criterion indicates that the probability is higher than a predetermined value if the login request is issued from the terminal installed in a location where the user can enter only if authenticated by an authentication system; 11. The account lock control method according to claim 10.

[0080] (Appendix 15) the determination criterion indicates that the probability is lower than a predetermined value when the login request is issued from the terminal installed in a location different from the location of the user registered in advance; 11. The account lock control method according to claim 10.

[0081] (Appendix 16) Estimating the current location of the user from information necessary for estimating the current location of the user; the determination criterion indicates that the probability is lower than a predetermined value when the login request is issued from the terminal installed in a location different from the estimated current location of the user. 11. The account lock control method according to claim 10.

[0082] (Appendix 17) A reception process for receiving a login request to the system from a user; an acquisition process for acquiring status information representing the status of the user; a determination criterion for determining the likelihood that the login request is valid based on the status information, and a determination process for determining the likelihood based on the status information and the login request; a setting process for setting stricter standards for locking an account in response to consecutive authentication failures in the login request as the determined probability becomes lower; An account lock control program that causes a computer to execute the above.

[0083] (Appendix 18) the login request includes information capable of identifying a terminal that has issued the login request; the status information represents at least one of the user's location and the user's planned use of the system; 18. The account lock control program according to claim 17.

[0084] (Appendix 19) a program for causing a computer to further execute a performance management process for managing the number of times that account locking has been executed for the user up to now, the setting process sets the execution standard to be stricter as the number of times increases, 19. An account lock control program according to claim 17 or 18.

[0085] (Appendix 20) the setting process sets the execution standard so that the lower the determined probability, the fewer consecutive authentication failures allowed in the login request before executing account locking. 19. An account lock control program according to claim 17.

[0086] (Appendix 21) The setting process sets the execution standard so that the lower the determined probability, the longer the time until the account lock is released. 21. An account lock control program according to claim 17.

[0087] (Appendix 22) the determination criterion indicates that the probability is higher than a predetermined value if the login request is issued from the terminal installed in a location where the user can enter only if authenticated by an authentication system; 19. The account lock control program according to claim 18.

[0088] (Appendix 23) the determination criterion indicates that the probability is lower than a predetermined value when the login request is issued from the terminal installed in a location different from the location of the user registered in advance; 19. The account lock control program according to claim 18.

[0089] (Appendix 24) The acquisition process estimates the current location of the user from information necessary for estimating the current location of the user; the determination criterion indicates that the probability is lower than a predetermined value when the login request is issued from the terminal installed in a location different from the estimated current location of the user. 19. The account lock control program according to claim 18. [Explanation of symbols]

[0090] 1. Account Lock Control System 10 Account lock control device 11 Reception 12 Acquisition Department 13 Judgment section 14 Setting section 15 Performance Management Department 16 Memory section 161 Login Request 162 Status Information 163 Criteria 164 Setting Standards 20. Communication Networks 21 User Management System 22 Authentication System 220 Execution Standards 23 Entrance / Exit Gate 24 terminals 30 Account lock control device 31 Reception 310 Login Request 32 Acquisition Department 320 Status Information 33 Judgment section 330 Criteria 331 Probability 34 Setting section 340 Execution Standards 900 Information Processing Equipment 901 CPU 902 ROM 903 RAM 904 Hard disk (storage device) 905 Communication Interface 906 Bus 907 Recording Media 908 Reader / Writer 909 Input / Output Interface

Claims

1. A receiving means for receiving a login request to the system from a user; acquiring means for acquiring status information representing the status of the user; a determination criterion for determining the likelihood that the login request is valid based on the status information, and a determination means for determining the likelihood based on the status information and the login request; a setting means for setting stricter standards for locking an account in response to successive authentication failures in the login request as the determined probability becomes lower; An account lock control device comprising:

2. the login request includes information capable of identifying a terminal that has issued the login request; the status information represents at least one of the user's location and the user's planned use of the system; The account lock control device according to claim 1 .

3. further comprising a record management means for managing the number of times that account locking has been executed for the user up to now; The setting means sets the execution standard to be stricter as the number of times increases.

3. The account lock control device according to claim 1 or 2.

4. the setting means sets the execution standard so that the lower the determined probability, the fewer consecutive authentication failures allowed in the login request before executing account locking.

3. The account lock control device according to claim 1 or 2.

5. The setting means sets the execution standard so that the lower the determined probability, the longer the time until the account lock is released.

3. The account lock control device according to claim 1 or 2.

6. the determination criterion indicates that the probability is higher than a predetermined value if the login request is issued from the terminal installed in a location where the user can enter only if authenticated by an authentication system; The account lock control device according to claim 2 .

7. the determination criterion indicates that the probability is lower than a predetermined value when the login request is issued from the terminal installed in a location different from the location of the user registered in advance; The account lock control device according to claim 2 .

8. the acquisition means estimates the current location of the user from information necessary for estimating the current location of the user; the determination criterion indicates that the probability is lower than a predetermined value when the login request is issued from the terminal installed in a location different from the estimated current location of the user. The account lock control device according to claim 2 .

9. By the information processing device, Accepts a user's request to log in to the system, acquiring status information representing the status of the user; determining the likelihood that the login request is valid based on a determination criterion for determining the likelihood from the status information, the status information, and the login request; the lower the determined probability, the stricter the criteria for locking the account in response to consecutive authentication failures in the login requests is set. Account lock control method.

10. A reception process for receiving a login request to the system from a user; an acquisition process for acquiring status information representing the status of the user; a determination criterion for determining the likelihood that the login request is valid based on the status information, and a determination process for determining the likelihood based on the status information and the login request; a setting process for setting stricter standards for locking an account in response to consecutive authentication failures in the login request as the determined probability becomes lower; An account lock control program that causes a computer to execute the above.

Images