JP7705305B2 - Information processing device, its control method, program, and system - Google Patents

Description

The present invention relates to a technology for responding to a region-specific request received from a client terminal via the Internet.

In recent years, the use of cloud services deployed on the Internet has been expanding. In cloud services, IT devices such as servers and network equipment are collected, installed, and operated in facilities called data centers, and web application services are provided to users. Data centers are set up in each country or region, and companies that provide services worldwide deploy the same type of service in multiple data centers as necessary.

From the perspective of protecting personal information, data such as a user's user ID, password, and email address is managed independently for each data center that the user accesses. Users decide which data center to access based on their physical region and legal system, but different data centers use different URLs to access the service sites deployed at those data centers.

In response to this issue, Patent Document 1 discloses a method in which an integrated server identifies the region in which a user is registered, and a web client sends an authentication request to an authentication server in the identified region, so that users can access a service using a common URL.

JP 2019-101668 A

As described above, the integrated server identifies the region in which the user ID is registered and responds to the web client. Furthermore, if the user ID is unregistered, the integrated server cannot identify the region and will return some kind of error. If a malicious person accesses the integrated server with an appropriate user ID, they will be able to determine whether the user ID used is registered or not based on the response from the integrated server. Therefore, if the user ID is registered, there is a security problem, as the user ID can be used in a brute force password attack.

The present invention has been made to solve the above-mentioned problems, and aims to provide a technology that makes it difficult to determine whether a user ID is registered or not based on the integrated server's region-specific response, thereby reducing security risks.

In order to solve this problem, for example, an information processing device of the present invention has the following arrangement.
An information processing device that transmits region information indicating a corresponding region to a client terminal in response to a region identification request received from the client terminal via the Internet,
A communication means for communicating with the Internet;
a management means for managing mapping information in which user information and region information are associated with each other;
a comparison means for comparing the mapping information of the management means when a region identification request including user information identifying a user is received from a client terminal via the communication means;
If the collation result of the collation means indicates that the corresponding user information exists in the mapping information, sending corresponding region information to the client terminal as a response;
The system further comprises a response means for transmitting false region information to the client terminal as a response when a result of the comparison by the comparison means indicates that the corresponding user information does not exist in the mapping information.

According to the present invention, it functions as an integrated server that manages mapping information between user IDs and regions, and makes it difficult for the requester of a region-specific request to determine whether or not a user ID is registered, thereby reducing security risks.

FIG. 1 is a diagram showing a network configuration of an information processing system according to a first embodiment. FIG. 2 is a block diagram showing an example of the hardware configuration of an information processing apparatus according to the first embodiment. FIG. 2 is a block diagram showing the functional configuration of a Web client according to the first embodiment. 5 is a flowchart showing an operation during login processing of a Web client according to the first embodiment. FIG. 4 is a diagram showing an example of a login screen according to the first embodiment. FIG. 2 is a block diagram showing the functional configuration of an integrated server according to the first embodiment. 10 is a flowchart showing an operation of the integrated server during region identification processing in the first embodiment. FIG. 13 is a diagram showing an example of mapping information between a hash value of a user ID and a region. 10 is a flowchart showing an operation of the integrated server in a false region determination process according to the first embodiment. 13 is a flowchart showing the operation of the integrated server during a false region determination process in the second embodiment. FIG. 13 is a diagram showing an example of mapping information between a hash value of a user ID and a false region. FIG. 13 is a diagram showing a network configuration of an information processing system according to a third embodiment. FIG. 13 is a block diagram showing the functional configuration of an integrated server according to a third embodiment. FIG. 13 is a block diagram showing the functional configuration of a pseudo authentication server according to the third embodiment. 13 is a flowchart showing the operation of a region identification process of an integrated server according to the third embodiment. FIG. 13 is a block diagram showing the functional configuration of an integrated server according to a fourth embodiment. FIG. 13 is a block diagram showing the functional configuration of an authentication server according to a fourth embodiment. 13 is a flowchart showing the operation of an authentication process of an authentication server according to the fourth embodiment. FIG. 13 is a block diagram showing the functional configuration of a Web client according to the fifth embodiment. 13 is a flowchart showing an operation at the time of login processing of a Web client according to the fifth embodiment. FIG. 13 is a block diagram showing the functional configuration of an authentication server according to the fifth embodiment. 13 is a flowchart showing an operation of an authentication process of an authentication server according to the fifth embodiment.

The following embodiments are described in detail with reference to the attached drawings. Note that the following embodiments do not limit the invention according to the claims. Although the embodiments describe multiple features, not all of these multiple features are necessarily essential to the invention, and multiple features may be combined in any manner. Furthermore, in the attached drawings, the same reference numbers are used for the same or similar configurations, and duplicate explanations are omitted.

[First embodiment]
An example of a network configuration of an information processing system according to this embodiment will be described with reference to the block diagram of FIG.

The system includes a Web client 101 connected to the Internet 100, an integrated server 130, and data centers 110 and 120. The Web client 101 is a client terminal equipped with a Web browser function, and is capable of using Web technologies such as cookies. The data centers 110 and 120 are independent of each other. For convenience, in the embodiment, the data centers are distinguished by identification names based on the regions in which they are installed, and hereinafter, the data center 110 is referred to as the US region and the data center 120 is referred to as the EU region.

A reverse proxy server 112, an authentication server 113, and a resource server 114 are connected to the computer network 111 in the US region 110. A reverse proxy server 122, an authentication server 123, and a resource server 124 are connected to the computer network 121 in the EU region 120. A region is a term that refers to a certain range such as a country or a region, and there is no limitation on the range of the region. The US region 110 and the EU region 120 have the same server configuration. The reverse proxy servers 112 and 122 have the role of distributing access requests from the outside to servers inside the network. For example, the reverse proxy server determines whether to distribute to the authentication server or the resource server based on the path name of the URL. The reverse proxy servers 112 and 122 are assigned different domain names specific to each region, and the domain names of the URLs are also different. Therefore, access is separated by region. Access from the Web client 101 to the reverse proxy server 112 is distributed to the authentication server 113 and the resource server 114. On the other hand, access from the Web client 101 to the reverse proxy server 122 is distributed to the authentication server 123 and the resource server 124. In addition, the reverse proxy servers 112 and 122 receive access requests. Therefore, the domain name and domain of the authentication server 113 and the resource server 114 are the same, and similarly, the domain name and domain of the authentication server 123 and the resource server 124 are also the same. The authentication servers 113 and 123 perform authentication in response to a request from the Web client 101. The resource server 114 provides a Web application service in response to being authenticated by the authentication server 113. In addition, the resource server 124 provides a Web application service in response to being authenticated by the authentication server 123.

The integrated server 130 is a server that is prepared to receive a common URL worldwide and can communicate with the Web client 101. The integrated server 130 may be deployed in a data center other than the US region 110 or the EU region 120, or may be deployed in the US region 110 or the EU region 120. The integrated server may also be deployed in multiple data centers and a common URL may be assigned using GeoDNS (not shown). GeoDNS is a mechanism for transferring a request from a client requesting access to a server that is close in network terms. For example, when the Web client 101 requests access to the common URL of the integrated server, and the location of the Web client 101 is close to the US region 110 on the network, the request is transferred to the integrated server 130 deployed in the US region 110.

The Web client 101 and various servers have a basic configuration as an information processing device. Figure 2 shows the hardware configuration of the information processing device.

The information processing device includes a CPU 200, a RAM 201, a ROM 202, a network interface 203, an external storage device 204, a display device 205, and an input device 206.

The CPU 200 controls the operation of each component of the information processing device, and is the main body that executes various processes described below as being performed by the information processing device. The RAM 201 is a memory that temporarily stores data and control information, and serves as a work area used by the CPU 200 when executing various processes. The ROM 202 stores fixed operating parameters, operating programs, etc. of the information processing device.

The network interface 203 provides the functionality for connecting to and communicating with the Internet 100, computer networks 111, and 121. The information processing device can transmit and receive data to and from external devices via this network interface 203.

The external storage device 204 is a device that stores data, and has an interface that accepts I/O commands for reading and writing data. The external storage device 204 may be a hard disk drive (HDD), a solid state drive (SSD), an optical disk drive, a semiconductor storage device, or other storage device. The external storage device 204 stores computer programs and data for causing the CPU 200 to execute each process described below as being performed by an information processing device.

The display device 205 is, for example, an LCD (Liquid Crystal Display) and displays information required by the user. The input device 206 is, for example, a keyboard, mouse, touch panel, etc. and accepts required input from the user. The display device 205 and the input device 206 constitute a user interface.

The web client 101 and various servers (112 to 114, 122 to 124, 130) have the basic configuration of FIG. 2 as described above, but may have a unique configuration according to the usage form of the device. For example, if the web client 101 is a smartphone, in addition to the configuration of FIG. 2, it will have an image sensor and a line connection configuration. However, a description of the unique configuration will be omitted here as it is outside the scope of this embodiment.

Next, the functional configuration of the Web client 101 according to this embodiment will be described with reference to the block diagram in FIG. 3. The configuration shown in FIG. 3 represents the functional configuration when the CPU 200 of the Web client 101 executes a program as a Web client.

The Web client 101 includes a display control unit 300, an input receiving unit 301, a region identification request transmitting unit 302, a region identification result receiving unit 303, an authentication server determination unit 304, an authentication request transmitting unit 305, and an authentication result receiving unit 306. For the sake of explanation, it is assumed that the hardware of the Web client 101 has the configuration shown in FIG. 2.

The display control unit 300 displays a login screen on the display device 205. The display control unit 300 also displays a login success screen and a login failure screen on the display device 205 depending on the authentication result described below.

The input reception unit 301 receives input of a user ID and password from the input device 206 on the login screen displayed by the display control unit 300.

The region identification request sending unit 302 sends a region identification request including the user ID accepted by the input accepting unit 301 as user information to the integrated server 130.

The region identification result receiving unit 303 receives the region identification result sent from the integrated server 130.

The authentication server determination unit 304 determines the authentication server to which to send the authentication request based on the region received by the region identification result receiving unit 303.

The authentication request sending unit 305 sends an authentication request based on the user ID and password accepted by the input accepting unit 301 to the authentication server determined by the authentication server determining unit 304.

The authentication result receiving unit 306 receives the authentication result sent from the authentication server.

Next, the processing procedure for the login process of the Web client 101 according to this embodiment will be described with reference to the flowchart in FIG.

First, in S400, the display control unit 300 obtains a login screen from the integrated server 130 and displays it on the display device 205. An example of the displayed login screen is shown in FIG. 5. The login screen 500 is composed of a user ID input area 501, a password input area 502, and a button 503 for confirming the information entered by the user. Note that the login screen does not necessarily have to be obtained from the integrated server 130, but may be obtained from, for example, the external storage device 204.

Next, in S401, the input reception unit 301 receives input of a user ID and a password from the user for the login screen (S401). Here, the user uses the input device 206 to input a user ID in the user ID input area 501 of the login screen 500 and a password in the password input area 502, and confirms the input by pressing a button 503.

In response to the input of the user ID and password being confirmed, in S402, the region identification request sending unit 302 sends a region identification request to the integrated server 130. Here, the region identification request includes at least the user ID accepted by the input accepting unit 301. The integrated server 130 identifies the region in which the user ID is registered based on the received region identification request, and responds to the Web client 101. The process of identifying the region by the integrated server 130 will be described later.

At S403, the region identification result receiving unit 303 receives the region identification result from the integrated server 130.

Next, in S404, the authentication server determination unit 304 determines the authentication server to which the authentication request is to be sent based on the received region identification result. For example, if the region identified as the region in which the user ID is registered is the US region 110, the authentication server determination unit 304 determines the authentication server 113 in the US region 110 as the target to which the authentication request is to be sent. Similarly, if the region identified as the region in which the user ID is registered is the EU region 120, the authentication server determination unit 304 determines the authentication server 123 in the EU region 120 as the target to which the authentication request is to be sent.

At S405, the authentication request sending unit 305 sends an authentication request to the authentication server determined as the transmission target. This authentication request includes at least the user ID and password received by the input receiving unit 301. If the authentication server 113 in the US region 110 is determined as the transmission target of the authentication request, the URL specified at the time of transmission will be a URL with a domain name unique to the US region 110. If the authentication server 123 in the EU region 120 is determined as the transmission target of the authentication request, the URL will be a URL with a domain name unique to the EU region 120. The authentication server authenticates the user based on the user ID and password included in the received authentication request, and responds with the authentication result to the requesting Web client 101.

In S406, the authentication result receiving unit 306 receives the authentication result sent from the authentication server. Then, in S407, the authentication result receiving unit 306 determines whether the received authentication result is "success" or "failure". If it is successful (YES in S407), in S408, the display control unit 300 displays a login success screen on the display device 205 (S408). The response from the authentication server also includes an instruction to set the authentication token in a cookie. On the other hand, if the authentication result is "failure" (NO in S407), in S409, the display control unit 300 displays a login failure screen on the display device 205.

Next, the functional configuration of the integrated server 130 according to this embodiment will be described with reference to the block diagram of FIG. 6. The configuration shown in FIG. 6 represents the functional configuration when the CPU 200 of the integrated server 130 executes a program for functioning as an integrated server. For the sake of explanation, it is assumed that the hardware of the integrated server 130 has the configuration shown in FIG. 2.

The integrated server 130 includes a region identification request receiving unit 600, a user ID conversion unit 601, a mapping information management unit 602, a mapping information matching unit 603, a region determination unit 604, and a region identification result transmission unit 605.

The region specific request receiving unit 600 receives a region specific request sent from the web client 101 via the network interface 203.

The user ID conversion unit 601 converts the user ID included in the region identification request into a hash value.

The mapping information management unit 602 stores and manages in the external storage device 204 the mapping information between the hash value of the user ID registered in each region and the region in which the user is registered. The hash value of the user ID is stored in order to protect the user ID, which may be personal information.

The mapping information matching unit 603 uses the hash value of the user ID calculated by the user ID conversion unit as a key to match (or search) in the mapping information management unit 602, determines whether or not the information exists (matching result), and if so, identifies the corresponding region.

The region determination unit 604 determines a false region based on the user ID included in the region identification request.

The region identification result transmission unit 605 transmits region information representing either the region identified by the mapping information matching unit 603 or the false region determined by the region determination unit 604 as a region identification result to the Web client 101 via the network interface 203.

Next, the region identification process of the integrated server 130 according to this embodiment will be explained using the flowchart in FIG.

First, in S700, the region identification request receiving unit 600 receives a region identification request sent from the Web client 101. Then, in S701, the user ID conversion unit 601 calculates a hash value of the user ID included in the received region identification request.

Next, in S702, the mapping information matching unit 603 matches the mapping information of the region from the mapping information management unit 602 based on the hash value of the user ID obtained in S701.

Figure 8 shows an example of mapping information between the hash value of a user ID and the region managed by the mapping information management unit 602. The first field "user_id_hash" is the hash value of the user ID, and the second field "region" is the region in which the user is registered. As mentioned above, the user ID is hashed and managed because the user ID may correspond to personal information.

In S703, the mapping information matching unit 603 determines whether a hash value matching the hash value calculated in S701 exists in the mapping information. In other words, the mapping information matching unit 603 determines whether the user ID is registered.

If a matching hash value is found (YES in S703), in S704, the region identification result sending unit 605 sends the region associated with the matching hash value to the Web client 101 as a region identification result.

On the other hand, if no mapping information is found (NO in S703), in S705, the region determination unit 604 determines a false region. Then, in S706, the region identification result transmission unit 605 transmits the false region to the Web client 101 as the region identification result.

Here, the method for determining the false region in S705 will be explained using the flowchart in Figure 9.

First, in S900, the region determination unit 604 assigns a salt (a specified value or a specified character string) to the user ID included in the region identification request. Then, in S901, the region determination unit 604 calculates a hash value by using the assigned character string as input and outputting the hash function. Then, in S902, the region determination unit 604 regards the calculated hash value as a numerical value, divides it by the total number of regions, and obtains the remainder. Next, in S903, the region determination unit 604 determines the region corresponding to the remainder as a false region.

For example, in this embodiment, the total number of regions is 2, and if the remainder value is 0, the US region is determined as the false region, and if the remainder value is 1, the EU region is determined as the false region. As a result, the false region is uniquely determined from the user ID, so even if a region identification request is sent multiple times for the same user ID, the same region identification result is returned each time. This makes it difficult to determine whether or not the user ID is registered in any region.

Note that the method of uniquely determining a false region from a user ID is not limited to this. For example, the addition of the salt in S900 may be omitted, and instead of calculating the hash value in S901, the hash value of the user ID calculated in S701 may be used instead. Also, when a user ID is registered in any region, the region identification result returned by the integrated server 130 before and after the registration changes from a false region to a true region, and this change may be used to determine the region in which the user ID is registered. To solve this, the salt, hash function, and hash value calculation algorithm may be periodically changed for some or all user IDs.

As described above, in this embodiment, the integrated server 130 responds to a region identification request for a user ID that is not registered in any region with a false region that is uniquely determined from the user ID. This makes it difficult for the requesting user (web client) to determine whether the user ID is registered or not based on a region identification request.

In this embodiment, the integrated server 130 transmits the region in which the user ID is registered as the region identification result, and the Web client 101 determines the authentication server from the region, but this is not limited to the above. For example, the integrated server 130 may transmit the URL and domain for accessing the authentication server in the region in which the user ID is registered as the region identification result. This makes it possible to omit the authentication server determination process by the Web client 101 and have the integrated server 130 control the destination of the authentication request.

In addition, in this embodiment, the region in which the user is registered is identified, but this is not limiting. For example, the region in which the device or client service is registered may be identified in order to determine the authentication/authorization server for the device or client service. Also, the organization or realm in which the user is registered may be identified in order to control the authentication target of the authentication request sent by the web client.

Second Embodiment
In the first embodiment, a method has been described in which, in the region identification process by the integrated server 130, a false region is determined that is unique every time a region identification request is received.

In this second embodiment, an example is described in which even if a region identification request is sent multiple times for the same user ID, the same region identification result is returned each time. In addition to the mapping information shown in the first embodiment, the integrated server 130 uses false mapping information that associates a user ID with false region information. Note that the network configuration example, hardware configuration example, functional configuration example, and login process by the Web client 101 are the same as those in the first embodiment, so descriptions are omitted.

The details of the false region determination process (S705 in FIG. 7) in this second embodiment will be described with reference to the flowchart in FIG. 10.

First, in S1000, the mapping information comparison unit 603 uses the hash value of the user ID calculated in S701 as a key to compare the false mapping information in the mapping information management unit 602. An example of the false mapping information (stored and held in the external storage device 204) managed by the mapping information management unit 602 is shown in FIG. 11. The first field "user_id_hash" is the hash value of the user ID, and the second field "fake_region" is false region information corresponding to the hash value of the user ID that responded in the past.

At S1001, the mapping information matching unit 603 determines whether or not there is a matching hash value in the false mapping information.

If it exists (S1001 is YES), the region determination unit 604 determines in S1002 that the region associated with the found hash value is a false region.

On the other hand, if no matching hash value exists (NO in S1001), the region determination unit 604 determines a region, for example, randomly, in S1003. Then, in S1004, the mapping information management unit 602 adds the false region determined in S1003 and the hash value of the user ID to the false mapping information.

As a result, a false region for a given user ID is uniquely determined, so even if a region identification request is sent multiple times for the same user ID, the same region identification result is returned each time. This makes it difficult to determine whether or not a user ID is registered in any region. Note that, although a method of randomly determining a region was described in S1003, this is not limiting.

For example, the source IP address of the region identification request received in S700 may be analyzed, and regions that are geographically far from the source may be stored as mapping information. Generally, communication speeds tend to decrease as physical distance increases, so this can reduce the frequency with which attackers send authentication requests to the authentication server.

In this way, according to the information processing system of this embodiment, in response to a region identification request for a user ID that is not registered in any region, the integrated server 130 responds with a false region that is uniquely determined from the user ID. This makes it difficult to determine whether the user ID is registered or not based on a region identification request.

[Third embodiment]
In the first embodiment, a method has been described in which, in the region identification process by the integrated server 130, a false region is determined that is unique every time a region identification request is received.

In this third embodiment, a method is described in which the integrated server returns the region of a pseudo authentication server that does not perform authentication processing as a false region. Note that the hardware configuration example is the same as in the first embodiment, so a description thereof is omitted.

An example of the network configuration of an information processing system according to this embodiment will be described with reference to the block diagram in FIG. 12.

In this embodiment, a data center 1240 is added to the network configuration of the first embodiment, and hereafter, the data center 1240 is referred to as the AN region. A pseudo authentication server 1242 is connected to a computer network 1241 in the AN region 1240.

In this embodiment, the pseudo authentication server exists only in AN region 1240, but this is not limited to this. The pseudo authentication server may exist in multiple regions, and may also be located in the region where the authentication server exists.

Next, the functional configuration of the integrated server 130 according to this embodiment will be described with reference to the block diagram of FIG. 13. The configuration shown in FIG. 13 represents the functional configuration when the CPU 200 of the integrated server 130 executes a program for functioning as an integrated server. For the sake of explanation, it is assumed that the hardware of the integrated server 130 has the configuration shown in FIG. 2.

In addition to the configuration of the first embodiment, the integrated server 130 includes an attacker determination unit 1306. 1300 to 1305 are similar to 600 to 605, so the explanation will be omitted. The attacker determination unit 1306 determines whether the Web client is an attacker based on the region identification request sent from the Web client 101 and its associated information.

Next, the functional configuration of the pseudo authentication server 1242 according to this embodiment will be described with reference to the block diagram of FIG. 14. The configuration shown in FIG. 14 represents the functional configuration when the CPU 200 of the pseudo authentication server 1242 executes a program for functioning as a pseudo authentication server. For the sake of explanation, it is assumed that the hardware of the pseudo authentication server 1242 has the configuration shown in FIG. 2.

The pseudo authentication server 1242 includes an authentication request receiving unit 1400, a pseudo authentication unit 1401, an issuing unit 1402, and an authentication result transmitting unit 1403.

The authentication request receiving unit 1400 receives an authentication request sent from the web client 101 via the network interface 203.

The pseudo-authentication unit 1401 performs pseudo-authentication for the authentication request received by the authentication request receiving unit 1400. The pseudo-authentication may be a process that always returns authentication failure, or it may be a process that verifies only whether the authentication request is formatted correctly, in the same way as normal authentication processing.

For example, suppose that authentication servers 113 and 114 have a constraint that the user ID of an authentication request must contain a specific character, and if the user ID of the authentication request does not contain the specific character, they respond to the Web client with an error message indicating that the format is invalid. In this case, the pseudo-authentication unit 1401, like the authentication server, verifies whether the user ID of the authentication request contains the specific character, and if it does not, responds to the Web client with an error message indicating that the format is invalid.

The issuing unit 1402 issues a pseudo authentication result based on the result of the pseudo authentication unit 1401. If authentication fails, a pseudo authentication result that is the same as the authentication result when authentication fails in the authentication servers 113 and 114 is issued. Alternatively, as the pseudo authentication result, a pseudo authentication token having the same format as the authentication token issued when authentication is successful in the authentication servers 113 and 114 may be issued. The pseudo authentication token is set in a cookie in the Web client 101 in the same way as a normal authentication token, but is a token that cannot be used.

The authentication result transmission unit 1403 transmits the pseudo authentication result issued by the issuing unit 1402 to the Web client 101 via the network interface 203.

Next, the region identification process of the integrated server 130 according to this embodiment will be explained using the flowchart in FIG. 15.

Steps S1500 to S1502 are the same as steps S700 to S702 in the first embodiment, so the explanation will be omitted.

At S1503, the attacker determination unit 1306 determines whether the Web client 101 is an attacker. The determination process uses the additional information received along with the region identification request. For example, the IP address, which is the sender information of the region identification request, is obtained as additional information, and if it is a specific IP address or IP address range, it is determined to be an attacker. In addition, it is also possible to have only legitimate Web clients 101 send a specific character string as additional information along with the region identification request, and determine whether or not the client is an attacker based on the presence or absence of the additional information.

Furthermore, the attacker determination unit 1306 may associate the matching result of the mapping information matching unit 1303 with the additional information of the region identification request, save it as a region identification request history, and use it for attacker determination. The matching result may be associated with the additional information, that is, an IP address, and saved, and if there is a history of matching failures a certain number of times or more within a specified period of time for the same IP address, the region identification request from that IP address may be determined to be an attacker's.

If it is determined that the attacker is not present (NO in S1503), in S1504, the mapping information matching unit 1303 determines whether the hash value calculated in S1501 exists in the mapping information, as in S703.

If a matching hash value is found (YES in S1504), in S1505, the region identification result sending unit 1305 sends the region identification result to the Web client 101, similar to S704.

On the other hand, if it is determined that the user is an attacker (YES in S1503) or if no mapping information is found (NO in S1504), then in S1506, the region determination unit 1304 determines a false region. Then, in S1507, the region identification result sending unit 1305 sends the false region to the Web client 101 as the region identification result, similar to S706.

The method for determining the false region in S1506 is the same as in the flowchart of FIG. 9. However, in S902 and S903, the region of the pseudo authentication server is used instead of the region of the authentication server.

In S902, the region determination unit 1304 regards the calculated hash value as a numerical value, divides it by the total number of regions of the pseudo authentication server, and obtains the remainder. Next, in S903, the region determination unit 1304 determines the region of the pseudo authentication server corresponding to the remainder as the false region.

As described above, the integrated server 130 of this embodiment responds to a region identification request for a user ID that is not registered in any region with a false region that is uniquely determined from the user ID. Furthermore, it also responds with a false region to a requester (Web client) that has been determined to be an attacker. At that time, the false region is selected from the regions of the pseudo authentication server. Therefore, it is made difficult for the user of the requester (Web client) to determine whether the user ID is registered or not based on a region identification request, and the burden on the authentication server can be reduced by using the pseudo authentication server.

[Fourth embodiment]
In the third embodiment, a method has been described in which the region of a pseudo authentication server that does not perform authentication processing is returned as a false region in the region identification processing by the integrated server 130.

In this fourth embodiment, the integrated server determines whether or not a web client is an attacker and notifies the authentication server, thereby skipping the authentication process of the authentication server. Note that the network configuration and hardware configuration are the same as those in the first embodiment, so their explanations are omitted.

Next, the functional configuration of the integrated server 130 according to this embodiment will be described with reference to the block diagram of FIG. 16. The configuration shown in FIG. 16 represents the functional configuration when the CPU 200 of the integrated server 130 executes a program for functioning as an integrated server. For the sake of explanation, it is assumed that the hardware of the integrated server 130 has the configuration shown in FIG. 2.

In addition to the configuration of the third embodiment, the integrated server 130 includes an attacker information notification unit 1607. 1600 to 1606 are similar to 1300 to 1306, so the explanation will be omitted. The attacker information notification unit 1307 notifies each authentication server of information on the Web client that has been determined to be an attacker by the attacker determination unit 1606. The notified information only needs to be information that can identify the attacker, and can be information such as the IP address of the Web client.

Next, the region identification process of the integrated server 130 according to this embodiment is similar to that shown in the flowchart in FIG. 15, but since there are some differences in the process, only those differences will be explained.

In S1503, the attacker determination unit 1606 determines whether the Web client 101 is an attacker. The determination method is the same as in the third embodiment, but if it is determined to be an attacker, the attacker information notification unit 1607 notifies each authentication server of the attacker information.

The method for determining the false region in S1506 is the same as that shown in the flowchart in FIG. 9, and the false region is determined from among the authentication servers in the same manner as in the first embodiment.

Next, the functional configuration of the authentication servers 113 and 114 according to this embodiment will be described with reference to the block diagram in FIG. 17.

The authentication servers 113 and 123 each include an authentication request receiving unit 1700, an authentication information management unit 1701, an authentication unit 1702, an issuing unit 1703, an attacker information utilization unit 1704, a pseudo authentication unit 1705, and an authentication result transmission unit 1706.

The authentication request receiving unit 1700 receives an authentication request sent from the web client 101 via the network interface 203.

The authentication information management unit 1701 stores and manages authentication information that associates the user ID and password of a user registered in each authentication server in the external storage device 204.

The authentication unit 1702 authenticates the user by comparing the authentication request received by the authentication request receiving unit 1700 with the authentication information managed by the authentication information management unit 1701.

The issuing unit 1703 issues an authentication token indicating that the user has been authenticated.

The attacker information utilization unit 1704 stores and holds the attacker information notified by the integrated server 130. In addition, it determines whether the Web client 101 that sent the authentication request is an attacker based on the stored attacker information.

The pseudo authentication unit 1705 performs pseudo authentication for an authentication request determined to be from an attacker by the attacker information utilization unit 1704, in the same manner as the pseudo authentication unit 1401 of the integrated server in the third embodiment. In this case, the issuing unit 1703 issues a pseudo authentication result based on the result of the pseudo authentication unit 1705, in the same manner as the issuing unit 1402 of the integrated server in the third embodiment.

The authentication result transmission unit 1706 transmits the authentication token or pseudo authentication result issued by the issuing unit 1703 to the Web client 101 via the network interface 203.

Next, the authentication process of the authentication servers 113 and 123 according to this embodiment will be explained using the flowchart in FIG.

First, in S1800, the authentication request receiving unit 1700 receives an authentication request sent from the web client 101.

Next, in S1801, the attacker information utilization unit 1704 determines whether the Web client 101 that sent the authentication request is an attacker. If it is determined that it is an attacker (YES in S1801), the process proceeds to S1807. If it is determined that it is not an attacker (NO in S1801), the process proceeds to S1802.

Next, in S1802, the authentication unit 1702 compares the user ID and password included in the authentication request received in S1800 with the authentication information managed by the authentication information management unit 1701.

If the user ID is registered in the authentication information management unit 1701 and the password also matches (if S1803 is YES), the issuing unit 1703 issues an authentication token in S1804. Then, in S1805, the authentication result sending unit 1706 sends the authentication token to the Web client 101 as the authentication result. On the other hand, if the password does not match (if S1803 is NO), in S1806, the authentication result sending unit 1706 sends the authentication result to the Web client 101 as an authentication failure.

Next, in S1807, the pseudo authentication unit 1705 performs pseudo authentication, and the issuing unit 1703 issues a pseudo authentication result. Since the pseudo authentication and the issuance of the pseudo authentication result are the same as in the third embodiment, a description thereof will be omitted.

Next, in S1808, the authentication result transmission unit 1706 transmits the pseudo authentication result issued by the issuing unit 1402 to the Web client 101 via the network interface 203.

As described above, in this embodiment, the integrated server 130 determines whether the Web client 101 is an attacker and notifies the authentication servers 113 and 123, thereby performing pseudo-authentication instead of the authentication process of the authentication servers. This makes it possible to reduce the load on each authentication server in response to an attacker's request without having to install a pseudo-authentication server.

[Fifth embodiment]
In the first embodiment, a method has been described in which, in the region identification process by the integrated server 130, a false region is determined that is unique every time a region identification request is received.

In this fifth embodiment, an example will be described in which an authentication server identifies and responds to a region instead of an integrated server. Note that an example network configuration and an example hardware configuration are similar to those in the first embodiment, so their explanations will be omitted.

First, the functional configuration of the Web client 101 according to the fifth embodiment will be described with reference to the block diagram in FIG. 19. The configuration shown in FIG. 19 represents the functional configuration when the CPU 200 of the Web client 101 executes a program as a Web client.

The Web client 101 includes a display control unit 1900, an input receiving unit 1901, an authentication server determination unit 1902, an authentication request transmission unit 1903, an authentication result reception unit 1904, and an authentication request retransmission unit 1905. For the sake of explanation, it is assumed that the hardware of the Web client 101 has the configuration shown in FIG. 2.

The display control unit 1900 displays a login screen on the display device 205. The display control unit 1900 also displays a login success screen and a login failure screen on the display device 205 depending on the authentication result described below.

The input reception unit 1901 receives input of a user ID and password from the input device 206 on the login screen displayed by the display control unit 1900.

The authentication server determination unit 1902 determines the first authentication server and the second authentication server to which the authentication request is sent.

The authentication request sending unit 1903 sends a first authentication request based on the user ID and password accepted by the input accepting unit 1901 to the first authentication server determined by the authentication server determining unit 1902.

The authentication result receiving unit 1904 receives the authentication result sent from the authentication server.

The authentication request retransmission unit 1905 transmits a second authentication request based on the user ID and password accepted by the input acceptance unit 1901 to the second authentication server determined by the authentication server determination unit 1902.

Next, the processing procedure for the login process of the Web client 101 according to the fifth embodiment will be described with reference to the flowchart in FIG. 20.

First, in S2000, the display control unit 1900 acquires a login screen from the integrated server 130 and displays it on the display device 205. The login screen that is displayed is the same as in the first embodiment, so a description thereof will be omitted.

Next, in S2001, the input reception unit 1901 receives input of a user ID and password from the user on the login screen. Here, the user uses the input device 206 to input a user ID in the user ID input area 501 of the login screen 500 and a password in the password input area 502, and confirms the input by pressing the button 503.

In response to the confirmation of the input of the user ID and password, in S2002, the authentication server determination unit 1902 determines the first authentication server to which the authentication request is to be sent. For example, if the IP address of the Web client 101 is close to the US region 110, the authentication server determination unit 1902 determines the authentication server 113 in the US region 110 as the first authentication server. Similarly, if the IP address of the Web client 101 is close to the EU region 120, the authentication server determination unit 1902 determines the authentication server 123 in the EU region 120 as the first authentication server. In this way, by determining an authentication server close to the Web client used by the user as the first authentication server, the possibility of authenticating the user in the first authentication request described below increases.

Next, in S2003, the authentication request sending unit 1903 sends a first authentication request to the first authentication server determined as the transmission target. This authentication request includes at least the user ID and password received by the input receiving unit 1901. If the authentication server 113 in the US region 110 is determined as the transmission target of the authentication request, the URL specified at the time of transmission will be a URL with a domain name unique to the US region 110. Also, if the authentication server 123 in the EU region 120 is determined as the transmission target of the authentication request, the URL will be a URL with a domain name unique to the EU region 120. The authentication server authenticates the user or determines the region based on the user ID and password included in the received authentication request, and responds to the requesting Web client 101 with the authentication result. User authentication by the authentication server and region determination processing will be described later.

In S2004, the authentication result receiving unit 1904 receives the authentication result transmitted from the first authentication server. Then, in S2005, the authentication result receiving unit 1904 determines whether the received authentication result is an authentication token or a region. If it is an authentication token (if S2005 is YES), in S2006, the display control unit 1900 displays a login success screen on the display device 205. On the other hand, if the authentication result is a region (if S2005 is NO), in S2007, the authentication server determination unit 1902 determines a second authentication server to which the authentication request is to be retransmitted based on the received region. For example, if the received region is the US region 110, the authentication server determination unit 1902 determines the authentication server 113 of the US region 110 as the second authentication server. Similarly, if the received region is the EU region 120, the authentication server determination unit 1902 determines the authentication server 123 of the EU region 120 as the second authentication server.

Next, in S2008, the authentication request retransmission unit 1905 transmits a second authentication request to the second authentication server determined as the transmission target. This authentication request includes at least the user ID and password received by the input reception unit 1901. If the authentication server 113 in the US region 110 is determined as the transmission target of the authentication request, the URL specified at the time of transmission will be a URL with a domain name unique to the US region 110. Also, if the authentication server 123 in the EU region 120 is determined as the transmission target of the authentication request, the URL will be a URL with a domain name unique to the EU region 120. The authentication server authenticates the user or determines the region based on the user ID and password included in the received authentication request, and responds to the requesting Web client 101 with the authentication result.

In S2009, the authentication result receiving unit 1904 receives the authentication result sent from the second authentication server. Then, in S2010, the authentication result receiving unit 1904 determines whether the received authentication result is an authentication token or a region. If it is an authentication token (YES in S2010), in S2006, the display control unit 1900 displays a login success screen on the display device 205. On the other hand, if the authentication result is a region (NO in S2010), in S2011, the display control unit 1900 displays a login failure screen on the display device 205.

Next, the functional configuration of the authentication servers 113, 123 according to the fifth embodiment will be described with reference to the block diagram of FIG. 21. The configuration shown in FIG. 21 represents the functional configuration when the CPU 200 of the authentication servers 113, 123 executes a program for functioning as an authentication server. For the sake of explanation, it is assumed that the hardware of the authentication servers 113, 123 has the configuration shown in FIG. 2.

The authentication servers 113 and 123 each include an authentication request receiving unit 2100, an authentication information management unit 2101, an authentication unit 2102, an issuing unit 2103, a user ID conversion unit 2104, a mapping information management unit 2105, a mapping information matching unit 2106, a region determination unit 2107, and an authentication result transmission unit 2108.

The authentication request receiving unit 2100 receives an authentication request sent from the web client 101 via the network interface 203.

The authentication information management unit 2101 stores and manages authentication information that associates the user ID and password of a user registered in each authentication server in the external storage device 204.

The authentication unit 2102 compares the authentication request received by the authentication request receiving unit 2100 with the authentication information managed by the authentication information management unit 2101 to authenticate the user.

The issuing unit 2103 issues an authentication token indicating that the user has been authenticated.

The user ID conversion unit 2104 converts the user ID included in the authentication request into a hash value.

The mapping information management unit 2105 stores and manages in the external storage device 204 the mapping information between the hash value of the user ID registered in each region and the region in which the user is registered. The hash value of the user ID is stored in order to protect the user ID, which may be personal information.

The mapping information matching unit 2106 uses the hash value of the user ID calculated by the user ID conversion unit as a key to match (or search) in the mapping information management unit 2105, determines whether or not the information exists (matching result), and if so, identifies the corresponding region.

The region determination unit 2107 determines a false region based on the user ID included in the authentication request.

The authentication result sending unit 2108 sends an authentication result representing either the authentication token issued by the issuing unit 2103, the region identified by the mapping information matching unit 2106, or the false region determined by the region determination unit 2107 to the Web client 101 via the network interface 203.

Next, the authentication process of the authentication servers 113 and 123 according to the fifth embodiment will be described with reference to the flowchart in FIG. 22.

First, in S2200, the authentication request receiving unit 2100 receives an authentication request sent from the web client 101.

Next, in S2201, the authentication unit 2102 compares the user ID and password included in the authentication request received in S2200 with the authentication information managed by the authentication information management unit 2101.

If the user ID is registered in the authentication information management unit 2101 (if S2202 is YES) and the passwords match (if S2203 is YES), the issuing unit 2103 issues an authentication token in S2204. Then, in S2205, the authentication result sending unit 2108 sends the authentication token to the Web client 101 as the authentication result. On the other hand, if the passwords do not match (if S2203 is NO), in S2206, the region determination unit 2107 determines a false region. Then, in S2207, the authentication result sending unit 2108 sends the false region to the Web client 101 as the authentication result. Note that the method of determining the false region is the same as S705 in the first embodiment, so a description thereof will be omitted.

If the user ID is not registered in the authentication information management unit 2101 (if S2202 is NO), in S2208, the user ID conversion unit 2104 calculates a hash value of the user ID included in the authentication request received in S2200.

Next, in S2209, the mapping information matching unit 2106 matches the region mapping information from the mapping information management unit 2105 based on the hash value of the user ID obtained in S2208. The region mapping information is the same as in the example of the first embodiment, so a description thereof is omitted.

If mapping information matching the hash value is found (YES in S2210), in S2211, the authentication result sending unit 2108 sends the region associated with the matching hash value to the Web client 101 as the authentication result.

On the other hand, if no mapping information is found (NO in S2210), in S2212, the region determination unit 2107 determines a false region. Then, in S2213, the authentication result sending unit 2108 sends the false region to the Web client 101 as the authentication result. Note that the method of determining the false region is the same as S705 in the first embodiment, and therefore will not be described here.

As described above, the authentication servers 113 and 123 of the fifth embodiment respond with an authentication token in response to an authentication request including a correct user ID and password. When the Web client 101 determines the authentication server in which the user ID is registered as the first authentication server and sends the first authentication request, login is completed with one communication between the Web client and the authentication server, improving usability. Furthermore, in response to an authentication request for a user ID that is not registered in any region and an authentication request for an incorrect password, a false region that is uniquely determined from the user ID is responded to, making it difficult to determine whether the user ID is registered or not.

In the fifth embodiment, the authentication servers 113 and 123 determine and respond with a false region that is uniquely determined from the user ID, but this determination method may be common between authentication servers. This makes it possible to make it even more difficult to determine whether a user ID is registered or not, since the region responded to for each user ID is unique for each authentication server.

Other Examples
The present invention can also be realized by a process in which a program for implementing one or more of the functions of the above-described embodiments is supplied to a system or device via a network or a storage medium, and one or more processors in a computer of the system or device read and execute the program. The present invention can also be realized by a circuit (e.g., ASIC) that implements one or more of the functions.

The invention is not limited to the above-described embodiment, and various modifications and variations are possible without departing from the spirit and scope of the invention. Therefore, the following claims are appended to disclose the scope of the invention.

100...Internet, 101...Web client, 110...US region, 120...EP region, 112, 122...reverse proxy server, 113, 123...authentication server, 114, 124...resource server, 130...integration server, 600...region identification request receiver, 601...user ID conversion unit, 602...mapping information management unit, 603...mapping information comparison unit, 604...region determination unit, 605...region identification result transmitter

Claims (29)

An information processing device that transmits region information indicating a corresponding region to a client terminal in response to a region identification request received from the client terminal via the Internet,
A communication means for communicating with the Internet;
a management means for managing mapping information in which user information and region information are associated with each other;
a comparison means for comparing the mapping information of the management means when a region identification request including user information identifying a user is received from a client terminal via the communication means;
If the collation result of the collation means indicates that the corresponding user information exists in the mapping information, sending corresponding region information to the client terminal as a response;
and a response means for transmitting false region information to the client terminal as a response when the result of the comparison by the comparison means indicates that the corresponding user information does not exist in the mapping information. The user information includes a user ID that identifies a user,
The management means manages information in which a hash value of a user ID and region information are paired as the mapping information,
The information processing device according to claim 1 , wherein the matching unit performs matching by obtaining a hash value from a user ID included in the received region identification request and searching the mapping information using the hash value as a key. The information processing device according to claim 1, characterized in that, when the comparison result of the comparison means indicates that a value matching the hash value of the corresponding user ID does not exist in the mapping information, the response means transmits as a response false region information that is uniquely determined by a numerical value represented by the hash value of the user ID. The information processing device according to claim 3, characterized in that the response means responds as the false region information information representing a region identified by a remainder value when a numerical value represented by a hash value of the user ID is divided by the number of regions managed by the management means. The management means further manages false mapping information that pairs a hash value of a user ID not existing in the mapping information with the false region information,
The response means is
If the collation result of the collation means indicates that there is no value matching the hash value of the user ID corresponding to the mapping information and that there is a value matching the false mapping information, respond with the corresponding false region information in the false mapping information;
The information processing device according to claim 1, characterized in that if the comparison result of the comparison means indicates that there is no value that matches the hash value of the user ID corresponding to the mapping information and that there is no value that matches the false mapping information, a pair of the hash value of the user ID and new false region information is registered in the false mapping information and the new false region information is responded to. The method further comprises: an attacker determination means for determining whether the client terminal is an attacker;
The information processing device according to any one of claims 1 to 5, characterized in that the response means sends false region information as a response not only when the corresponding user information does not exist in the mapping information, but also when the attacker determination means determines that the client terminal is an attacker. 7. The information processing apparatus according to claim 6, wherein said attacker determination means determines whether or not a client terminal is an attacker based on a region identification request and its associated information sent from the client terminal. The information processing device according to claim 6, characterized in that the attacker determination means stores the region identification request sent from the client terminal and its associated information as a region identification request history associated with the result of the comparison means, and uses the region identification request history to determine whether or not the client is an attacker. A method for controlling an information processing device, comprising: a communication means for communicating with the Internet; and a management means for managing mapping information in which user information and region information are associated with each other; and, in response to a region identification request received from a client terminal via the communication means, transmitting region information indicating a corresponding region to the client terminal, the method comprising:
a comparison step of comparing mapping information of the management means when a region identification request including user information identifying a user is received from a client terminal via the communication means;
If the result of the matching step indicates that the corresponding user information exists in the mapping information, sending corresponding region information to the client terminal as a response;
and a response step of sending false region information to the client terminal as a response if the result of the comparison step indicates that the corresponding user information does not exist in the mapping information. A program that, when read and executed by a computer, causes the computer to execute each step of the method according to claim 9. A system including an integrated server deployed in one or more regions, an authentication server deployed in one or more regions, and a pseudo authentication server deployed in one or more regions,
The integrated server includes:
A communication means for communicating with the Internet;
a management means for managing mapping information in which user information and region information are associated with each other;
a comparison means for comparing the mapping information of the management means when a region identification request including user information identifying a user is received from a client terminal via the communication means;
an attacker determination means for determining whether the client terminal is an attacker;
If the collation result of the collation means indicates that the corresponding user information exists in the mapping information, sending corresponding region information to the client terminal as a response;
a response means for transmitting region information of a pseudo authentication server not only when the collation result of the collation means indicates that the corresponding user information does not exist in the mapping information, but also when the attacker determination means determines that the client terminal is an attacker,
The authentication server,
A communication means for communicating with the Internet;
an authentication means for authenticating a user when an authentication request is received from the client terminal via the communication means;
a response means for transmitting an authentication token as a response to the client terminal when the authentication result of the authentication means indicates that the authentication is successful, and transmitting an authentication failure as a response to the client terminal when the authentication result of the authentication means indicates that the authentication is unsuccessful,
The pseudo authentication server includes:
A communication means for communicating with the Internet;
a pseudo-authentication means for pseudo-authenticating a user when an authentication request is received from the client terminal via the communication means;
and a response means for transmitting a pseudo-authentication result of the pseudo-authentication means to the client terminal as a response. The system according to claim 11, wherein the attacker determination means in the integrated server determines whether or not a client terminal is an attacker based on a region identification request and its associated information sent from the client terminal. The system described in claim 11, characterized in that the attacker determination means in the integrated server stores the region identification request sent from the client terminal and its accompanying information as a region identification request history associated with the result of the comparison means, and uses this to determine whether or not the client is an attacker. the pseudo authentication means in the pseudo authentication server determines that the authentication has failed regardless of the contents of the authentication request sent from the client terminal,
12. The system according to claim 11, wherein the response means in the pseudo authentication server responds with a result simulating an authentication failure transmitted by the authentication server when authentication fails as a pseudo authentication result. the pseudo authentication means in the pseudo authentication server determines that the authentication is successful regardless of the content of the authentication request sent from the client terminal,
12. The system according to claim 11, wherein the response means in the pseudo authentication server responds as a pseudo authentication result by sending a pseudo authentication token simulating an authentication token transmitted by the authentication server when authentication is successful. A system including an integration server deployed in one or more regions and an authentication server deployed in one or more regions,
The integrated server includes:
A communication means for communicating with the Internet;
a management means for managing mapping information in which user information and region information are associated with each other;
a comparison means for comparing the mapping information of the management means when a region identification request including user information identifying a user is received from a client terminal via the communication means;
an attacker determination means for determining whether the client terminal is an attacker;
an attacker information notifying means for notifying an authentication server of attacker information indicating that the client terminal is an attacker via the communication means when the attacker determination means determines that the client terminal is an attacker;
If the collation result of the collation means indicates that the corresponding user information exists in the mapping information, sending corresponding region information to the client terminal as a response;
a response means for transmitting region information of a pseudo authentication server not only when the collation result of the collation means indicates that the corresponding user information does not exist in the mapping information, but also when the attacker determination means determines that the client terminal is an attacker,
The authentication server,
A communication means for communicating with the Internet;
an attacker information utilization means for storing attacker information notified from the integrated server via the communication means, and for determining whether the client terminal is an attacker based on the attacker information when an authentication request is received from the client terminal;
an authentication means for authenticating a user by utilizing an authentication request received from the client terminal when the attacker information utilization means determines that the client terminal is not an attacker;
a pseudo-authentication means for pseudo-authenticating a user when the attacker information utilization means determines that the client terminal is an attacker;
a response means for transmitting an authentication token to the client terminal when the authentication means indicates that the authentication is successful, or a response indicating an authentication failure when the authentication is unsuccessful, and a response indicating a pseudo-authentication result of the pseudo-authentication means when the pseudo-authentication means is used,
A system characterized by: 17. The system according to claim 16, wherein the attacker determination means in the integrated server determines whether or not a client terminal is an attacker based on a region identification request and its associated information sent from the client terminal. The system described in claim 16, characterized in that the attacker determination means in the integrated server stores the region identification request sent from the client terminal and its associated information as a region identification request history associated with the result of the comparison means, and uses this region identification request history to determine whether or not the client is an attacker. the pseudo-authentication means in the authentication server determines that the authentication has failed regardless of the contents of the authentication request sent from the client terminal,
17. The system according to claim 16, wherein the response means in the authentication server responds with a result simulating an authentication failure that is transmitted when the authentication fails as a pseudo authentication result. the pseudo-authentication means in the authentication server determines that the authentication is successful regardless of the contents of the authentication request sent from the client terminal;
17. The system according to claim 16, wherein the response means in the authentication server responds with a pseudo authentication token that imitates an authentication token that is transmitted when authentication is successful, as a pseudo authentication result. 1. An information processing device that transmits an authentication result to a client terminal in response to an authentication request received from the client terminal via the Internet,
A communication means for communicating with the Internet;
an authentication means for authenticating a user when an authentication request including user information identifying the user is received from the client terminal via the communication means;
a management means for managing mapping information in which user information and region information are associated with each other;
a verification means for verifying the mapping information of the management means when the authentication result of the authentication means indicates that the authentication has failed due to an error in the user information;
If the authentication result of the authentication means indicates that the authentication is successful, an authentication token is sent to the client terminal as a response;
If the matching result of the matching means indicates that the corresponding user information exists in the mapping information, sending corresponding region information to the client terminal as a response;
and a response means for sending false region information to the client terminal as a response when the authentication result of the authentication means indicates that the authentication has failed regardless of an error in the user information, or when the comparison result of the comparison means indicates that the corresponding user information does not exist in the mapping information. The user information includes a user ID that identifies a user,
The management means manages information in which a hash value of a user ID and region information are paired as the mapping information,
22. The information processing apparatus according to claim 21, wherein the matching means performs matching by obtaining a hash value from a user ID included in a received authentication request and searching the mapping information using the hash value as a key. The information processing device according to claim 21, characterized in that, when the comparison result of the comparison means indicates that a value matching the hash value of the corresponding user ID does not exist in the mapping information, the response means transmits as a response false region information that is uniquely determined by a numerical value represented by the hash value of the user ID. The information processing device according to claim 23, characterized in that the response means responds as the false region information information representing a region identified by a remainder value when a numerical value represented by a hash value of the user ID is divided by the number of regions managed by the management means. A method for controlling an information processing device, comprising: a communication means for communicating with the Internet; and a management means for managing mapping information in which user information and region information are associated with each other; and, in response to an authentication request received from a client terminal via the Internet, transmitting an authentication result to the client terminal, the method comprising:
an authentication step of authenticating a user when an authentication request including user information identifying the user is received from the client terminal via the communication means;
a verification step of verifying the mapping information of the management means when the authentication result of the authentication step indicates that the authentication has failed due to an error in the user information;
If the authentication result of the authentication step indicates that the authentication is successful, an authentication token is sent to the client terminal as a response;
If the result of the matching step indicates that the corresponding user information exists in the mapping information, sending corresponding region information to the client terminal as a response;
and a response step of sending false region information to the client terminal as a response if the authentication result of the authentication step indicates that authentication has failed despite an error in the user information, or if the comparison result of the comparison step indicates that the corresponding user information does not exist in the mapping information. A program that, when read and executed by a computer, causes the computer to execute each step of the method according to claim 25. A system including an authentication server deployed in one or more regions and a client terminal having a web browser,
The authentication server,
A communication means for communicating with the Internet;
an authentication means for authenticating a user when an authentication request including user information identifying the user is received from the client terminal via the communication means;
a management means for managing mapping information in which user information and region information are associated with each other;
a verification means for verifying the mapping information of the management means when the authentication result of the authentication means indicates that the authentication has failed due to an error in the user information;
If the authentication result of the authentication means indicates that the authentication is successful, an authentication token is sent to the client terminal as a response;
If the matching result of the matching means indicates that the corresponding user information exists in the mapping information, sending corresponding region information to the client terminal as a response;
a response means for transmitting false region information to the client terminal as a response when the authentication result of the authentication means indicates that the authentication has failed regardless of an error in the user information, or when the comparison result of the comparison means indicates that the corresponding user information does not exist in the mapping information,
The client terminal includes:
an authentication request sending means for sending a first authentication request to any one of the authentication servers deployed in one or more regions;
and an authentication request retransmission means for transmitting a second authentication request to an authentication server of a region when region information is received in response to the authentication request. The system according to claim 27, characterized in that the response means determines false region information using a method common to all authentication servers deployed in one or more regions, and transmits the false region information to the client terminal as a response. The authentication request sending means includes:
The system according to claim 27, characterized in that an authentication server is determined from among authentication servers deployed in one or more regions based on proximity to the client terminal, and a first authentication request is transmitted to the authentication server.

Images