Information processing device and information processing program

Abstract

To provide an information processing device and an information processing program which can perform unauthorized login measures, without impairing user convenience.SOLUTION: An information processing device comprises a first acquisition unit, a second acquisition unit, a calculation unit, and an operation determination unit. The first acquisition unit acquires login information. The second acquisition unit acquires user information on a user. The calculation unit calculates a login denial number, on the basis of the login information and the user information. The operation determination unit determines login permission / denial, on the basis of the login denial number and a failure number.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] Embodiments of the present invention relate to an information processing apparatus and an information processing program.

Background Art

[0002] In recent years, when using e-commerce transactions, e-mails, etc., personal authentication using a user ID and password has become the norm. In such personal authentication, using a web browser or the like enables access from anywhere, providing high convenience. However, there have also been reports of damage caused by unauthorized logins where accounts are stolen.

[0003] In particular, cases where passwords are cracked through brute force attacks, such as brute force attacks, are also seen, and service providers are struggling to deal with them. On the service provider side, for example, methods such as detecting a certain number of password input errors or login challenges within a short time and temporarily suspending the account, or even when the correct password is entered, rejecting the login under certain conditions to prevent malicious attackers from guessing the correct password are used as countermeasures against unauthorized logins.

[0004] However, the method of temporarily suspending the account is only a time-saving measure, and the effect of repelling brute force attacks is limited. Also, even when rejecting logins under certain conditions, since the number of login rejections is fixed, it impairs the convenience of the user.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0006] The problem that the embodiments of the present invention aim to solve is to provide an information processing device and an information processing program that can implement measures against unauthorized logins without impairing user convenience. [Means for solving the problem]

[0007] In one embodiment, the information processing device comprises a first acquisition unit, a second acquisition unit, a calculation unit, and an operation determination unit. The first acquisition unit acquires login information. The second acquisition unit acquires user information of the user. The calculation unit calculates the number of login rejections based on the login information and the user information. The operation determination unit determines whether to allow or deny login based on the number of login rejections and the number of failures. [Brief explanation of the drawing]

[0008] [Figure 1] Figure 1 is a block diagram illustrating an information processing system according to an embodiment. [Figure 2] Figure 2 is a diagram illustrating the data structure of user information according to the embodiment. [Figure 3] Figure 3 is a flowchart showing an example of the information processing procedure performed by the server according to this embodiment. [Figure 4] Figure 4 is a flowchart showing an example of the procedure for information processing related to the server's decision-making process according to this embodiment. [Modes for carrying out the invention]

[0009] Embodiments will be described below with reference to the drawings. In each drawing, the same reference numerals are used for identical components whenever possible, and redundant explanations are omitted. Figure 1 is a block diagram illustrating an information processing system 100 according to an embodiment. The information processing system 100 includes a server 1 and an information processing terminal 2. The server 1 and the information processing terminal 2 are connected to each other via a network so as to be able to communicate with each other. For example, the network consists of one or more networks from among various networks such as the Internet, a mobile communication network, and a LAN (Local Area Network). The one or more networks may include a wireless network or a wired network.

[0010] Server 1 is an electronic device that collects and processes data. For example, Server 1 is a server for e-commerce or email that requires login authentication. Electronic devices include computers. Server 1 is freely connected to information processing terminal 2 via a network. Server 1 receives various data from information processing terminal 2 and outputs various data to information processing terminal 2. An example configuration of Server 1 will be described later.

[0011] Information processing terminal 2 is an electronic device capable of communicating with other electronic devices. Information processing terminal 2 is, for example, a device used by a user performing login authentication. For example, information processing terminal 2 may be a PC (Personal Computer), a smartphone, or a tablet device. "User" can be interpreted as "person." An example configuration of information processing terminal 2 will be described later.

[0012] This section describes an example configuration for Server 1. Server 1 is an electronic device that includes a processor 11, main memory 12, auxiliary storage device 13, and communication interface 14. Each component of Server 1 is connected to the others so that signals can be input and output. In Figure 1, the interface is labeled "I / F".

[0013] The processor 11 is the central part of the server 1. The processor 11 is an element that makes up the computer of the server 1. For example, the processor 11 is a CPU (Central Processing Unit), but is not limited to this. The processor 11 may be composed of various circuits. The processor 11 loads a program that is pre-stored in the main memory 12 or auxiliary storage device 13 into the main memory 12. The program is a program that causes the processor 11 of the server 1 to realize or execute the various parts described later. The processor 11 performs various operations by executing the program loaded into the main memory 12. The processor 11 is an example of a processing circuit.

[0014] Main memory 12 corresponds to the main memory portion of server 1. Main memory 12 is an element that constitutes the computer of server 1. Main memory 12 includes non-volatile memory areas and volatile memory areas. In the non-volatile memory area of ​​main memory 12, the operating system or programs are stored. Main memory 12 uses the volatile memory area as a work area where data is rewritten as needed by the processor 11. For example, main memory 12 includes ROM (Read Only Memory) as a non-volatile memory area. For example, main memory 12 includes RAM (Random Access Memory) as a volatile memory area. Main memory 12 stores programs.

[0015] The auxiliary storage device 13 corresponds to the auxiliary storage portion of server 1. The auxiliary storage device 13 is an element that constitutes the computer of server 1. The auxiliary storage device 13 is an EEPROM (registered trademark) (Electric Erasable Programmable Read-Only Memory), HDD (Hard Disk Drive), or SSD (Solid State Drive), etc. The auxiliary storage device 13 stores the above-mentioned program, data used by the processor 11 in performing various processes, and data generated by the processing of the processor 11. The auxiliary storage device 13 stores the above-mentioned program.

[0016] The auxiliary storage device 13 stores user information of the user of the information processing terminal 2. User information includes information related to the user's login to the information processing terminal 2. User information includes user identification information, password, last login date and time, number of logins in d days (d is a natural number of 1 or more), current access failure count, previous access time, previously entered password, packet volume per hour, etc. User identification information is unique identification information assigned to each user to identify them individually. User identification information includes, for example, user ID and username. The password is a password arbitrarily set by the user and used for login. The last login date and time indicates the date and time when the user last logged in. The number of logins in d days indicates the number of times the user was authenticated to log in during d days. Login authentication includes successful logins. The number of logins in d days includes, for example, the number of logins in the past 5 days, the number of logins in the past week, etc.

[0017] The current access failure count indicates the number of access failures at this time. The access failure count indicates the number of times login authentication failed. The current access failure count indicates the number of user access attempts made by the user in the past for the current login attempt. The current login attempt refers to the input of login information after logging out following the previous login authentication and attempting to log in again. Access refers to the user inputting login information. Access may also refer to the user inputting a password. The current access failure count is also simply called the failure count. The failure count indicates the number of times the user has entered login information from the previous login authentication to the current login information input. The failure count does not include the current login information input. The failure count is the sum of the number of times login failed due to password invalidation by Server 1 in the past for the current login attempt and the number of times login failed due to login rejection by Server 1 in the past for the current login attempt. For example, let's consider a case where a user has entered their password twice in the past for this login attempt, and is now attempting to enter their password a third time. If Server 1 has flagged the password as false twice in the past, the current number of access failures is 2. False password flagging indicates that Server 1 has determined the password is incorrect due to incorrect password entry, etc. Determining a password as incorrect includes determining that the password is not valid. If Server 1 flagged the password as false once and denied login once, the current number of access failures is 2. Login denial indicates that even though the user entered the correct password and Server 1 flagged the password as true once, Server 1 did not permit the login and denied it. Password true flagging indicates that Server 1 determined the password was correct. If Server 1 flagged the password as true twice, and denied login both times, the current number of access failures is 2.

[0018] The previous access time indicates the time when the user entered the previous login information. The previously entered password indicates the password entered by the user last time. The packet volume for one hour is the packet volume for the past one hour associated with the access from the user identified by the user name to Server 1. The user information may include the identification information of Information Processing Terminal 2. The identification information of Information Processing Terminal 2 is unique identification information assigned to each information processing terminal for individually identifying the information processing terminal. The identification information of the information processing terminal includes the IP address of the information processing terminal, etc.

[0019] The communication interface 14 includes various interfaces that connect Server 1 to other electronic devices via a network in accordance with a predetermined communication protocol so as to enable communication.

[0020] Note that the hardware configuration of Server 1 is not limited to the above-described configuration. Server 1 can appropriately omit and change the above-described components and add new components.

[0021] Each part realized in the above-described processor 11 will be described. The processor 11 realizes a first acquisition unit 110, a second acquisition unit 111, a authenticity determination unit 112, a calculation unit 113, an operation determination unit 114, and an output unit 115. Each part realized in the processor 11 can also be referred to as each function. Each part realized in the processor 11 can also be said to be realized in a control unit including the processor 11 and the main memory 12.

[0022] The first acquisition unit 110 acquires login information from the information processing terminal 2 via the communication interface 14. The login information includes a user name and a password.

[0023] The second acquisition unit 111 acquires the user information of the user of the information processing terminal 2 stored in the auxiliary storage device 13. The second acquisition unit 111 acquires the user information corresponding to the user of the information processing terminal 2 based on the user name.

[0024] The authenticity determination unit 112 determines the authenticity of a password based on login information and user information. The authenticity determination includes determining whether the password is true or false. The authenticity determination unit 112 determines the authenticity of a password by comparing the password entered by the user of the information processing terminal 2 with the password included in the user information. The authenticity determination of a password can be implemented using known technology.

[0025] The calculation unit 113 calculates the number of login rejections N based on the login information and user information. The number of login rejections N is a threshold that Server 1 compares to the number of failures in order to allow a login for which the password has been verified as true for the current login attempt. If the number of failures is greater than the number of login rejections N, Server 1 allows the login for which the password has been verified as true for the current login attempt. The operation determination unit 114 rejects the login for which the password has been verified as true for the current login attempt if the number of failures is N or less. For example, let's consider the case where the number of login rejections N is "3". If the password entered by the user is verified as true 3 times from a state where the number of failures is 0, Server 1 rejects the login 3 times. If the password entered by the user in the past 2 times was judged as false from a state where the number of failures is 0, and the user enters the correct password on the 3rd attempt and the password is verified as true by Server 1, the 3rd login will be rejected.

[0026] The calculation unit 113 may calculate the number of login denials N based on the user's usage frequency. Usage frequency indicates how often the user has been authenticated to log in. The calculation unit 113 may set N=0 if the user's usage frequency is high, and increase the value of N if the usage frequency is low. For example, if the usage frequency is 10 times or more per day, the calculation unit 113 may calculate N=0. If the usage frequency is less than once every two days, the calculation unit 113 may increase the value of N. The calculation unit 113 may also calculate the number of login denials N as, for example, N=K / (number of logins in d days). K represents a hyperparameter. Usage frequency is also called login frequency.

[0027] The calculation unit 113 may calculate the number of login denials N based on the user's access volume. The calculation unit 113 may increase the value of N when the user's access volume is high, and decrease the value of N when the access volume is low. For example, the calculation unit 113 may calculate the number of login denials N as N = packet volume per hour / K, where K represents a hyperparameter. According to this example, if the access volume increases due to brute-force attacks, etc., the number of login denials N can be increased to deal with unauthorized logins.

[0028] The calculation unit 113 may calculate the number of login denials N based on the difference between the user's previous access time and the current access time. The calculation unit 113 may increase the value of N if the difference from the user's previous access time is large, and decrease the value of N if the difference from the user's previous access time is small. For example, the calculation unit 113 may calculate the number of login denials N as N = K / (current time - previous access time), where K represents a hyperparameter. According to this example, if access occurs continuously in a very short time due to automated attacks, etc., the number of login denials N can be increased to deal with unauthorized logins.

[0029] The calculation unit 113 may calculate the number of login rejections N based on the similarity between the previously entered password and the currently entered password. The calculation unit 113 may increase the value of N if the similarity between the previously entered password and the currently entered password is high, and decrease the value of N if the similarity between the previously entered password and the currently entered password is low. The calculation unit 113 may, for example, calculate the number of login rejections N as N = distance between strings (current input password, previous input password) / K, where K represents a hyperparameter. According to this example, in cases where passwords are changed sequentially one character at a time, such as in a brute-force attack, the number of login rejections N can be increased to deal with unauthorized logins. The calculation unit 113 may, for example, calculate the similarity between the previously entered password and the currently entered password based on the distance between the password strings. The distance between the password strings can be calculated by known techniques for quantifying string similarity, such as the Levenshtein distance method.

[0030] The operation decision unit 114 determines whether to allow or deny login based on the number of login rejections N and the number of failures. The operation decision unit 114 compares the number of login rejections N calculated by the calculation unit 113 with the number of failures included in the user information. If the number of failures is greater than the number of login rejections N, the operation decision unit 114 allows login. If the number of failures is less than or equal to the number of login rejections N, the operation decision unit 114 denies login.

[0031] The output unit 115 outputs information to the information processing terminal 2 indicating the result of the operation decision unit 114's login permission or denial. The output unit 115 outputs permission information to the information processing terminal 2 indicating that the operation decision unit 114 has permitted login. The output unit 115 outputs denial information to the information processing terminal 2 indicating that the operation decision unit 114 has denied login. Based on the information indicating the result of the login permission or denial, the information processing terminal 2 displays a login permission notification or a login denial notification on the display device 26.

[0032] This section describes an example configuration for information processing terminal 2. The information processing terminal 2 is an electronic device that includes a processor 21, main memory 22, auxiliary storage device 23, communication interface 24, input / output interface 25, display device 26, speaker 27, and input device 28. Each component of the information processing terminal 2 is connected to each other so that signals can be input and output.

[0033] The processor 21 is the central part of the information processing terminal 2. The processor 21 is an element that constitutes the computer of the information processing terminal 2. The processor 21 has the same hardware configuration as the processor 11 described above. The processor 21 performs various operations by executing programs that are pre-stored in the main memory 22 or the auxiliary storage device 23.

[0034] Main memory 22 corresponds to the main memory portion of the information processing terminal 2. Main memory 22 is an element that constitutes the computer of the information processing terminal 2. Main memory 22 has the same hardware configuration as main memory 12 described above. Main memory 22 stores programs.

[0035] The auxiliary storage device 23 corresponds to the auxiliary storage portion of the information processing terminal 2. The auxiliary storage device 23 is an element that constitutes the computer of the information processing terminal 2. The auxiliary storage device 23 has the same hardware configuration as the auxiliary storage device 13 described above. The auxiliary storage device 23 stores the program described above.

[0036] The auxiliary storage device 23 stores user information of the information processing terminal 2.

[0037] The communication interface 24 includes various interfaces that enable the information processing terminal 2 to communicate with other devices via a network, in accordance with a predetermined communication protocol.

[0038] The input / output interface 25 is an interface for connecting the information processing terminal 2 to external devices. External devices include external microphones and external speakers capable of receiving audio input. The input / output interface 25 is, for example, USB (Universal Serial Bus).

[0039] The display device 26 is a device capable of displaying various screens under the control of the processor 21. For example, the display device 26 may be a liquid crystal display or an electroluminescent (EL) display.

[0040] Speaker 27 is a device capable of outputting sound under the control of the information processing terminal 2. Speaker 27 is an example of an output device.

[0041] The input device 28 is a device capable of inputting data or instructions to the information processing terminal 2. For example, the input device 28 includes a built-in microphone capable of inputting voice, and a built-in camera capable of acquiring image data of the shooting range. The input device 28 may also include a keyboard or a touch panel.

[0042] The hardware configuration of information processing terminal 2 is not limited to the configuration described above. Information processing terminal 2 may, as appropriate, omit or change the above-described components and add new components.

[0043] This section describes an example of the data structure configuration for user information stored in the auxiliary storage device 13 of server 1. Figure 2 is a diagram illustrating the data structure of user information according to the embodiment. User information includes, for each user, data such as username, password, last login date and time, number of logins in the past d days, current access failure count, last access time, last entered password, and data volume per hour, all of which are linked together.

[0044] For example, Figure 2 shows user information when a user with username "XXX" enters their login information at 8:00 AM on November 15, 2022. User "XXX" has the password "aaaaa". The last login time for user "XXX", indicating the date and time of the last successful login, is "November 11, 2022, 8:10:00 AM". In this example, the number of logins over d days is explained as the number of logins over 5 days (d=5). User "XXX" has logged in 2 times over 5 days.

[0045] User "XXX" has currently attempted to log in twice, resulting in two failed attempts. This example assumes that user "XXX" is attempting to log in for the third time. Let's assume that user "XXX" failed to log in on their last attempt, for example, because their previous password attempt was flagged as false.

[0046] User "XXX"'s last access time was "November 15, 2022, 7:59:00 AM". This indicates that User "XXX" last entered their login information at "November 15, 2022, 7:59:00 AM". It can be seen that User "XXX" entered their login information for the third time, one minute after the time of the current login information entry.

[0047] The password previously entered by user "XXX" was "aaaab". The amount of data used in the last hour was "YYY".

[0048] The procedure for processing by the information processing system 100 will be explained. In the following explanation, which focuses on Server 1, you may substitute Server 1 with Processor 11. The processing procedure described below is merely an example, and each process may be modified as much as possible. Furthermore, depending on the embodiment, steps in the processing procedure described below may be omitted, replaced, or added as appropriate.

[0049] Figure 3 is a flowchart showing an example of the information processing procedure performed by Server 1 according to this embodiment. The first acquisition unit 110 acquires login information from the information processing terminal 2 (ACT1). In ACT1, for example, the username and password entered by the user of the information processing terminal 2 via the input device 28 are acquired from the information processing terminal 2 via the communication interface 14.

[0050] After ACT1, the second acquisition unit 111 acquires the user information of the information processing terminal 2 stored in the auxiliary storage device 13 (ACT2). In ACT2, for example, the second acquisition unit 111 refers to the user information and acquires at least the password associated with the username of the information processing terminal 2.

[0051] The authenticity determination unit 112 determines the authenticity of the password based on the login information and user information (ACT3). In ACT3, for example, the authenticity determination unit 112 compares the password obtained by the first acquisition unit 110 with the password associated with the username of the information processing terminal 2 obtained by the second acquisition unit 111. If the password obtained by the first acquisition unit 110 and the password obtained by the second acquisition unit 111 match, the authenticity determination unit 112 determines that the password is authentic. If the password obtained by the first acquisition unit 110 and the password obtained by the second acquisition unit 111 do not match, the authenticity determination unit 112 determines that the password is fake. If the authenticity determination unit 112 determines that the password is authentic (ACT3:YES), the process transitions from ACT3 to ACT4. If the authenticity determination unit 112 determines that the password is fake (ACT3:NO), the process transitions from ACT3 to ACT7.

[0052] The operation decision unit 114 makes an action decision regarding login permission or denial based on the number of login rejections N and the number of failures (ACT4). In ACT4, for example, the operation decision unit 114 decides whether to allow or deny login based on the number of login rejections N calculated by the calculation unit 113.

[0053] After determining whether to allow or deny login in ACT4, the operation decision unit 114 determines whether to allow login based on the operation decision result (ACT5). If the operation decision unit 114 determines to allow login (ACT5: YES), the process transitions from ACT5 to ACT6. If the operation decision unit 114 determines not to allow login (ACT5: NO), the process transitions from ACT5 to ACT7.

[0054] The output unit 115 outputs login permission information indicating the result of login permission to the information processing terminal 2 based on the determination result by the operation determination unit 114 (ACT6). In ACT6, for example, the output unit 115 outputs login permission information to the information processing terminal 2 based on the determination result by the operation determination unit 114 that grants login permission. The information processing terminal 2 displays a login permission notification on the display device 26 based on the login permission information. The information processing terminal 2 may also output the login permission notification via the speaker 27 based on the login permission information. The login permission notification may include text information, video, audio, etc.

[0055] The output unit 115 outputs rejection information indicating the result of login rejection to the information processing terminal 2 based on the determination result by the truth / false determination unit 112 or the determination result by the action determination unit 114 (ACT7). In ACT7, for example, the output unit 115 outputs login rejection information to the information processing terminal 2 based on the password invalidation determination by the truth / false determination unit 112. The output unit 115 outputs login rejection information to the information processing terminal 2 based on the determination result of the action determination unit 114 to reject login. The information processing terminal 2 displays a login rejection notice on the display device 26 based on the login rejection information. The information processing terminal 2 may also output the login rejection notice via the speaker 27 based on the login rejection information. The login rejection notice may include text information, video, audio, etc.

[0056] Figure 4 is a flowchart showing an example of the procedure for processing information regarding the operation decision by Server 1 according to this embodiment. Figure 4 shows an example of the procedure for processing information regarding the operation decision based on ACT4.

[0057] The calculation unit 113 calculates the number of login denials N (where N is a natural number greater than or equal to 0) based on the login information and user information (ACT11). In ACT11, for example, the calculation unit 113 dynamically calculates the number of login denials N based on one of the following methods.

[0058] In the first method, the calculation unit 113 calculates the number of login denials N based on the user's login frequency. The calculation unit 113 refers to the user information and calculates the login frequency, which indicates how often the user logged in over a certain period, based on the "number of logins in d days". For example, the calculation unit 113 calculates the number of login denials N as N = K / (number of logins in d days).

[0059] In the second method, the calculation unit 113 calculates the number of login denials N based on the user's access volume. The calculation unit 113 refers to user information and calculates the access volume based on the "packet volume per hour". For example, the calculation unit 113 calculates the number of login denials N using N = packet volume per hour / K. The calculation unit 113 also calculates the number of login denials N based on the communication load from the information processing terminal 2.

[0060] In the third method, the calculation unit 113 calculates the number of login denials N based on the difference between the user's access time, which is determined by the acquisition of login information, and the previous access time included in the user information. For example, the calculation unit 113 refers to the user information and calculates the difference between the previous access time and the current access time based on the difference between the "previous access time" and the current time. The calculation unit 113 calculates the number of login denials N as, for example, N = K / (current time - previous access time). The calculation unit 113 calculates the number of login denials N inversely proportional to the difference between the previous access time and the current access time.

[0061] In the fourth method, the calculation unit 113 calculates the number of login attempts N based on the similarity between the login information and the previous login information contained in the user information. For example, the calculation unit 113 calculates the number of login attempts N based on the similarity between the password string contained in the login information and the password string contained in the previous login information. The calculation unit 113 refers to the user information and calculates the distance between the "previously entered password" and the currently entered password string. The calculation unit 113 calculates the number of login attempts N, for example, as N = string distance (currently entered password, previous entered password) / K. Note that if the current entered password and the previous entered password are exactly the same and the string distance is 0, a predetermined value may be used. The calculation unit 113 calculates the number of login attempts N in proportion to the similarity between the previously entered password and the currently entered password.

[0062] The operation decision unit 114 determines whether to allow login based on the number of login rejections N and the number of failures (ACT12). In ACT12, for example, the operation decision unit 114 compares the number of login rejections N calculated by the calculation unit 113 with the "current access failure count" included in the user information. The operation decision unit 114 determines whether the number of failures is greater than the number of login rejections N. If the operation decision unit 114 determines that the number of failures is greater than the number of login rejections N (ACT12: YES), the process transitions from ACT12 to ACT13. If the operation decision unit 114 determines that the number of failures is not greater than the number of login rejections N (ACT12: NO), the process transitions from ACT12 to ACT14.

[0063] The operation determination unit 114 makes a permission decision to allow login (ACT13).

[0064] The operation determination unit 114 makes a rejection decision to reject the login (ACT14).

[0065] (effect) The server 1 according to this embodiment can acquire login information, acquire user information of the user, calculate the number of login rejections based on the login information and user information, and decide whether to allow or deny login based on the number of login rejections and failures. For example, Server 1 can set a limit on the number of login attempts that can be denied, and by denying logins under certain conditions, it can prevent malicious attackers from guessing the correct password. Since Server 1 can dynamically change the number of login attempts that can be denied based on login information and user information, it can set a limit on the number of login attempts that does not impair user convenience, based on the login information entered by the user this time and their login history. In this way, Server 1 can implement measures against unauthorized logins without compromising user convenience.

[0066] The server 1 according to this embodiment can calculate the number of login attempts that have been denied based on the difference between the user's access time, which is determined by the acquisition of login information, and the previous access time included in the user information. Therefore, the server 1 can increase the number of login attempts denied in response to automated attacks that involve a series of accesses in a short period of time. This allows the server 1 to implement effective countermeasures against unauthorized logins against automated attacks without compromising user convenience.

[0067] The server 1 according to this embodiment can calculate the number of login attempts that have been denied based on the similarity between the login information and the previous login information included in the user information. Therefore, if similar login information is entered consecutively, the server 1 can increase the number of login attempts that have been denied. This allows the server 1 to implement effective countermeasures against unauthorized logins that are carried out by mechanically changing login information without impairing user convenience.

[0068] The server 1 according to this embodiment can calculate the number of login attempts that will be rejected based on the similarity between the password string included in the login information and the password string included in the previous login information. Therefore, the server 1 can increase the number of login attempts that will be rejected when sequentially similar login information is entered, such as in a brute-force attack. This allows the server 1 to implement effective countermeasures against unauthorized logins that are carried out by mechanically changing login information without compromising user convenience.

[0069] The above-described embodiments may be represented as follows: [1] A first acquisition unit for obtaining login information, A second acquisition unit that acquires user information of the user, A calculation unit that calculates the number of login rejections based on the login information and user information, An operation determination unit that determines whether to allow or deny login based on the number of login rejections and failures, An information processing device equipped with the following features. [2] The calculation unit calculates the number of login denials based on the difference between the user's access time, which is determined by the acquisition of the login information, and the previous access time included in the user information. [1] The information processing device described above. [3] The calculation unit calculates the number of login denials based on the similarity between the login information and the previous login information included in the user information. [1] The information processing device described above. [4] The similarity is the similarity between the password string included in the login information and the password string included in the previous login information. [3] The information processing device described above. [5] Computers, The first acquisition function retrieves login information, A second acquisition function to retrieve user information, A calculation function that calculates the number of login rejections based on the aforementioned login information and user information, An action determination function that determines whether to allow or deny login based on the number of login denials and failures, An information processing program to execute an action.

[0070] [Other embodiments] The information processing device may be implemented as a single device, such as Server 1, or as multiple devices with distributed functions.

[0071] The embodiments described above may apply not only to the apparatus but also to the methods performed by the apparatus. The embodiments described above may also apply to a program that can cause the computer of the apparatus to perform each function.

[0072] The program may be transferred while stored in the device, or it may be transferred without being stored in the device. In the latter case, the program may be transferred via a network, or it may be transferred while recorded on a recording medium. The recording medium is a non-temporary tangible medium. The recording medium is a computer-readable medium. The recording medium can be any medium that is capable of storing a program and is readable by a computer, such as a CD-ROM or memory card, and its form is not limited.

[0073] In addition, several embodiments of the present invention have been described, but these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be carried out in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their variations are included in the scope and spirit of the invention, as well as in the claims of the invention and its equivalents. [Explanation of symbols]

[0074] 1...Server, 2...Information processing terminal, 11...Processor, 12...Main memory, 13...Auxiliary storage device, 14...Communication interface, 21...Processor, 22...Main memory, 23...Auxiliary storage device, 24...Communication interface, 25...Input / output interface, 26...Display device, 27...Speaker, 28...Input device, 100...Information processing system, 110...First acquisition unit, 111...Second acquisition unit, 112...True / False determination unit, 113...Calculation unit, 114...Operation determination unit, 115...Output unit.

Claims

1. The first acquisition unit obtains login information, A second acquisition unit that acquires user information of the user, A calculation unit that calculates the number of login rejections based on the login information and user information, An operation determination unit that determines whether to allow or deny login based on the number of login rejections and failures, Equipped with, The calculation unit calculates the number of login denials based on the similarity between the password string included in the login information and the password string included in the previous login information, and reduces the number of login denials if the similarity is low. Information processing device.

2. The calculation unit calculates the number of login denials based on the difference between the user's access time, which is determined by the acquisition of the login information, and the previous access time included in the user information. The information processing apparatus according to claim 1.

3. On the computer, The first acquisition function retrieves login information, A second acquisition function to obtain user information of the user, A calculation function that calculates the number of login rejections based on the aforementioned login information and user information, An action determination function that determines whether to allow or deny login based on the number of login denials and failures, An information processing program for executing, The calculation function calculates the number of login attempts denied based on the similarity between the password string included in the login information and the password string included in the previous login information, and reduces the number of login attempts denied if the similarity is low. Information processing program.

Images