Information Processing Using Fake Regions to Obscure User Registration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud service systems face security risks due to the ability of malicious users to determine whether a user ID is registered by analyzing the response from an integrated server, leading to potential brute force attacks on user passwords.
Innovation Solution
An information processing apparatus that manages user and region information associations, responds with actual or mendacious region information based on collation results, making it difficult to determine if a user ID is registered, and optionally uses pseudo authentication servers to further obscure registration status.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the integrated server returns accurate region information for registered user IDs, then users can access the correct data center, but malicious users can determine whether a user ID is registered leading to brute force attacks
Solution Approach 1:
The patent applies local quality by making the response characteristic dependent on the user ID status. Registered user IDs receive accurate region information enabling correct data center access, while unregistered user IDs receive mendacious (fake) region information that prevents brute force attacks. This differential response strategy locally optimizes each case: accuracy for legitimate users, obscurity for potential attackers.
Solution Approach 2:
The patent converts the harmful information leakage into a beneficial security feature. By intentionally providing mendacious region information for unregistered user IDs, the system transforms what could be useful attack intelligence into a protective measure. Attackers can no longer determine whether user IDs exist, thereby preventing brute force attacks while maintaining accurate service for registered users.
2Ease of operation
If the server provides clear feedback on user ID registration status, then user experience is improved, but security is compromised due to information leakage
Solution Approach 1:
The system applies local quality by tailoring the information provided based on user ID registration status. For registered users, the server provides accurate region information that enables proper service access, ensuring good user experience. For unregistered users, the server provides mendacious information that prevents security attacks, thereby protecting information security. Each user type receives locally optimized information appropriate to their status.
3Productivity
If the integrated server processes region specifying requests for all user IDs, then service availability is maintained, but authentication server load increases
Solution Approach 1:
The patent extracts the region specification function from the authentication server and implements it independently in the integrated server. The integrated server maintains a local mapping between user IDs and regions, allowing it to process region specifying requests without involving the authentication server. This extraction reduces authentication server load while maintaining service availability, as the integrated server can independently determine regions for both registered and unregistered users.
Data Source
AI summary
The present invention provides an information processing apparatus operable to send, to a client, region information in response to a region specifying request received from the client via the Internet, wherein the apparatus comprises a managing unit which manages mapping information in which user information and region information are associated, a collation unit which, in a case where a region specifying request is received from a client, collates the mapping information, and a response unit which, in a case where a collation result indicates that corresponding user information is present in the mapping information, sends, to the client, corresponding region information as a response, and in a case where a collation result indicates that corresponding user information is not present in the mapping information, sends, to the client, mendacious region information as a response.