JP5377717B1 - Information processing apparatus, information processing system, information processing method, and program - Google Patents

Abstract

Communication security is improved even if a part of information used for authentication of a terminal device is not stored in advance in an information processing device such as a server.
An information processing apparatus according to the present invention uses a reception unit that receives a request message from a terminal device, an extraction unit that acquires predetermined extraction information included in the request message, and a predetermined number using the extraction information. Encryption means for calculating the first cipher value by the calculated algorithm, transmission means for transmitting a response message including cookie information describing the calculated first cipher value to the terminal device as a response to the request message, Collating means for collating the second cipher value and the first cipher value calculated using the extracted information extracted from the request message when the request message includes cookie information in which two cipher values are described; And executing means for executing processing based on the result of matching by the matching means.
[Selection] Figure 3

Description

  The present invention relates to a technique for improving communication security.

  It is desired to improve security by communication between a server and a client (terminal device) via a network such as the Internet. For example, when providing a service such as Internet banking or online shopping where money exchange occurs, the server generally uses a user-specific ID (hereinafter referred to as UID) and a password from the user himself / herself. Authenticate whether it is access. However, when the UID and password are leaked, access from other users is facilitated. Therefore, it has been studied to further improve security by using other information for user authentication.

  For example, in Patent Document 1, a cookie file is generated by combining a serial number of a CPU (Central Processing Unit) of a terminal device and a user-specific ID (hereinafter referred to as UID). The server can limit the terminal devices that can be used by the user by comparing the cookie received from the terminal device with the CPU serial number recorded based on the cookie already received by the server.

JP 2006-190059 A

  In the technique disclosed in Patent Document 1, it is necessary to store a CPU serial number in advance in a server in association with a UID for verification performed at the time of user authentication. Therefore, if data on the server is leaked or a cookie is read on the communication path, the CPU serial number described in the cookie is altered to impersonate the user from another terminal device. It becomes possible to do.

  An object of the present invention is to improve communication security even if part of information used for authentication of a terminal device is not stored in advance in an information processing device such as a server.

  According to an embodiment of the present invention, a receiving unit that receives a request message from a terminal device, an extracting unit that acquires predetermined extraction information included in the request message, and a predetermined number using the extraction information. Encryption means for calculating the first cipher value by the algorithm, and transmission means for transmitting a response message including cookie information in which the calculated first cipher value is described to the terminal device as a response to the request message. When the cookie information describing the second cipher value is included in the request message, the second cipher value and the first cipher value calculated using the extracted information extracted from the request message There is provided an information processing apparatus including a matching unit that matches the above and an execution unit that executes a process based on a result of the matching by the matching unit.

  According to an embodiment of the present invention, the information processing device includes a terminal device, the terminal device receiving a response message from the information processing device, and the response message included in the received response message A storage unit that stores cookie information; and a transmission unit that transmits a request message. When the cookie information included in the response message received from the transmission destination is stored in the storage unit, the cookie information is stored. There is provided an information processing system comprising transmission means for transmitting a request message including the information.

  According to an embodiment of the present invention, the first request message is received from the terminal device, the extraction information included in the first request message is acquired, and the extraction information acquired from the first request message is used in advance. A first encryption value is calculated by a determined algorithm, a response message including cookie information in which the calculated first encryption value is described is transmitted to the terminal device as a response to the first request message, and a second The second request message including the cookie information in which the encrypted value is described is received from the terminal device, the predetermined extracted information included in the second request message is acquired, and the extracted information acquired from the second request message A third cipher value is calculated by the algorithm, the second cipher value is compared with the third cipher value, and the second cipher value and the third cipher value An information processing method for executing processing based on the result of the matching is provided.

  According to an embodiment of the present invention, the computer uses a receiving unit that receives a request message from a terminal device, an extracting unit that acquires predetermined extraction information included in the request message, and the extraction information. An encryption unit for calculating the first cipher value by a predetermined algorithm and a response message including cookie information in which the calculated first cipher value is described are transmitted to the terminal device as a response to the request message. When the request message includes cookie information in which the transmission means and the second encrypted value are described, the first encrypted value is calculated using the second encrypted value and the extracted information extracted from the request message. A program for functioning as a collating unit that collates with an encrypted value and an execution unit that executes processing based on the result of collation by the collating unit There is provided.

  ADVANTAGE OF THE INVENTION According to this invention, even if some information used for the authentication of a terminal device is not memorize | stored beforehand in information processing apparatuses, such as a server, the security of communication can be improved.

It is the schematic which shows the structure of the information processing system 1000 which concerns on embodiment of this invention. It is a block diagram which shows the hardware constitutions of the information processing apparatus 1 which concerns on embodiment of this invention. It is a block diagram which shows the function structure of the information processing apparatus 1 which concerns on embodiment of this invention. It is a block diagram which shows the hardware constitutions of the terminal device 2 which concerns on embodiment of this invention. It is a block diagram which shows the function structure of the terminal device 2 which concerns on embodiment of this invention. It is a communication flow figure showing processing of information processor 1 and terminal unit 2 concerning an embodiment of the present invention. It is the schematic which shows the structure of information processing system 1000A which concerns on the modification 1 of this invention. It is a figure explaining the conversion table memorize | stored in the reference server 6 which concerns on the modification 1 of this invention. It is a figure explaining the address specification information memorize | stored in the reference server 6 which concerns on the modification 2 of this invention. It is a flowchart which shows the process which acquires the positional information which concerns on the modification 2 of this invention. It is a flowchart which shows the process which acquires the positional information which concerns on the modification 3 of this invention.

  Hereinafter, an information processing system according to an embodiment of the present invention will be described in detail with reference to the drawings. In addition, embodiment shown below is an example of embodiment of this invention, and this invention is not limited to these embodiment.

<Embodiment>
An information processing system according to an embodiment of the present invention will be described in detail with reference to the drawings.

[overall structure]
FIG. 1 is a schematic diagram showing a configuration of an information processing system 1000 according to an embodiment of the present invention. The information processing system 1000 includes an information processing device 1 connected to a network NW such as the Internet, and a terminal device 2 connected to the information processing device 1 via the network NW and the base station 5.

  The information processing device 1 is a server device that provides services such as Internet banking to the user of the terminal device 2. Various functions of the information processing apparatus 1 described below may be realized not only by one server apparatus but also by a plurality of server apparatuses in cooperation.

  The terminal device 2 is a device used by a user such as a mobile phone, a smartphone, or a laptop computer, and transmits and receives information to and from the information processing device 1 via the base station 5.

  In this example, the information processing apparatus 1 and the terminal apparatus 2 communicate information using a protocol that is compliant with HTTP (HyperText Transfer Protocol). When communicating this information, the information processing apparatus 1 issues a cookie (hereinafter referred to as cookie information) included in an HTTP response message (hereinafter simply referred to as a response message) to be transmitted to the terminal device 2. On the other hand, the terminal device 2 to which the cookie information is issued includes the cookie information in an HTTP request message (hereinafter simply referred to as a request message) transmitted to the information processing device 1. The present invention can improve security by using cookie information in which an encryption value described in detail below is described. Note that, as long as the request message is transmitted in such a manner as to include cookie information, a protocol based on HTTP may not be used.

  The base station 5 is a base station that performs communication according to a mobile phone information communication standard (non-IEEE standard) such as 3G (3rd Generation) or LTE (Long Term Evolution), and information communication used for a wireless LAN (Local Area Network). This is a concept including a base station called an access point that performs communication according to a standard (compliant with the IEEE standard), and performs wireless communication with the terminal device 2 to connect the terminal device 2 to the network NW.

  When the terminal device 2 communicates with the information processing device 1 via the base station 5, information for identifying the base station 5 is added to the data to be communicated on the communication path. For example, an IP (Internet Protocol) address assigned to the base station 5 is added to the IP header, or a MAC (Media Access Control) address assigned to the base station 5 is added to the MAC header. In the information communication standard for mobile phones, position information indicating the position of the base station 5 is added to the HTTP request body part.

[Configuration of Information Processing Apparatus 1]
FIG. 2 is a block diagram showing a hardware configuration of the information processing apparatus 1 according to the embodiment of the present invention. The information processing apparatus 1 includes a control unit 11, a storage unit 12, and a communication unit 13. The control unit 11 has a CPU and a memory. The control part 11 implement | achieves various functions, such as a communication control function mentioned later, by running the program memorize | stored in the memory | storage part 12 or memory. Each component of the information processing apparatus 1 is controlled by various functions realized by the control unit 11. The storage unit 12 is a hard disk or the like and stores information necessary for realizing various functions. The communication unit 13 transmits / receives information to / from other devices via the network NW.

  FIG. 3 is a block diagram showing a functional configuration of the information processing apparatus 1 according to the embodiment of the present invention. The information processing apparatus 1 implements a communication control function by the reception unit 110, the extraction unit 120, the encryption unit 130, the cryptographic function 140, the verification unit 150, the execution unit 160, and the transmission unit 170.

  The receiving unit 110 receives a request message from the terminal device 2. This request message may or may not include cookie information.

  The extraction unit 120 acquires extraction information from the received request message. In this example, the extracted information is a UID and position related information. The extracted information includes information that changes when the communication status changes, such as when the terminal device 2 that accesses the information processing device 1 changes, or when the base station 5 to which the terminal device 2 connects during communication changes. ing.

  The position related information is information related to the position of the base station 5 on the communication path, and in this example, is a MAC address or an IP address. Accordingly, the position-related information changes its address when the position of the terminal device 2 changes and is connected to another base station 5. The location-related information is acquired from the MAC header of the HTTP packet when it is a MAC address, and is acquired from the IP header when it is an IP address.

  The UID that is identification information for identifying the user is described in a part of the request message. For example, if the GET method is used as the HTTP method, the UID is described at the end of the URL (Uniform Resource Locator) described in the request line. It will be described as “https://www.xxx.yyy.jp/members.php?uid=aa12345”. In this case, the UID is “aa12345”.

  The encryption unit 130 uses the encryption function 140 to calculate an encryption value from the extracted information. The cryptographic function 140 is, for example, a hash function. In this case, the encryption value is a hash value calculated using the UID and MAC address acquired by the extraction unit 120 as keys. The calculated encryption value is described in the cookie information issued from the information processing device 1 to the terminal device 2. As a key, another element may be combined, or any one of UID and MAC address may be used. Further, a part of the UID and a part of the MAC address may be used as keys.

  The cryptographic function 140 is not limited to the hash function, and may be any other function as long as it specifies an algorithm for calculating another value using the extracted information as an input value. That is, the encryption value may be a value different from the input value calculated by a predetermined algorithm using the extracted information (input value). The encryption function is preferably a function that performs irreversible encryption that cannot be decrypted, but may be a function that performs reversible encryption that can be decrypted.

  When the request message received by the reception unit 110 includes cookie information, the collation unit 150 acquires an encrypted value described in the cookie information. The collation unit 150 collates the encryption value acquired from the cookie information with the encryption value calculated by the encryption unit 130, and determines whether the two encryption values match or do not match. If the cookie information is included in the request message but the encrypted value is not described in the cookie information, the collation unit 150 may determine that the encrypted values do not match.

  The execution unit 160 executes processing for determining the description content of the response message transmitted from the transmission unit 170 based on the collation result by the collation unit 150. For example, when the encryption value acquired from the cookie information matches the encryption value calculated by the encryption unit 130, the execution unit 160 authenticates the user who has accessed from the terminal device 2, A response message corresponding to the request message request is transmitted from the transmission unit 170 as a response to the request message.

  On the other hand, if the encryption values of the two do not match, the terminal device is different from the terminal device 2 that has been communicating until just before, such as when the UID matches but passes through another base station 5. There is a high possibility that the access is from 2 (the cookie information issued to the original terminal device 2 is impersonated by another terminal device 2). Therefore, the transmission unit 170 transmits a response message notifying that the accessing user is not authenticated and not accepting access from the terminal device 2 as a response to the request message. After that, access from the terminal device 2 may be blocked for a certain period. Further, information regarding unauthorized access may be notified to the administrator of the information processing apparatus 1. An administrator's notification destination (e-mail address or the like) may be set in the information processing apparatus 1 in advance. The information regarding unauthorized access may be information using a predetermined fixed sentence, or may include information regarding a request message that has caused a mismatch.

  When the cookie information is not included in the request message received by the reception unit 110, the transmission unit 170 issues cookie information in which the encrypted value calculated by the encryption unit 130 is described, and returns the cookie information as a response. Included in the message and sent as a response to the request message. In the cookie information, not only the encrypted value but also other known information may be described. If the request message received by the receiving unit 110 does not include cookie information, a response message is transmitted so that a predetermined URL (such as a service entrance) is guided to the same state as when the request message is requested. May be.

  When the request message received by the reception unit 110 includes cookie information, the transmission unit 170 transmits a response message as a response to the request message based on an instruction from the execution unit 160. At this time, the information processing device 1 may or may not newly issue cookie information to the terminal device 2.

[Configuration of Terminal Device 2]
FIG. 4 is a block diagram showing a hardware configuration of the terminal device 2 according to the embodiment of the present invention. The terminal device 2 includes a control unit 21, a storage unit 22, a communication unit 23, and a touch panel 24. The control unit 21 has a CPU and a memory. The control unit 21 realizes various functions such as a communication control function described later by executing a program stored in the storage unit 22 or the memory. Each component of the terminal device 2 is controlled by various functions realized by the control unit 21.

  The storage unit 22 is a semiconductor memory or the like, and stores information necessary for realizing various functions. The communication unit 23 is wirelessly connected to the base station 5 and transmits / receives information to / from other devices via the network NW. The touch panel 24 includes a display that displays a screen corresponding to the received response message, and a touch sensor that detects a user's contact with the display surface, accepts the user's operation, and outputs a signal corresponding to the operation. When an operation by the user is accepted by the touch panel 24, a request message is transmitted to the information processing apparatus 1 according to the content of the operation. Thus, the user's instruction is input to the terminal device 2 by an operation on the touch panel 24.

  FIG. 5 is a block diagram showing a functional configuration of the terminal device 2 according to the embodiment of the present invention. The terminal device 2 implements a communication control function by the reception unit 210, the cookie information storage unit 230, and the transmission unit 270.

  The receiving unit 210 receives a response message transmitted from the information processing apparatus 1. As a result, a screen corresponding to the received response message may be displayed on the touch panel 24.

  The cookie information storage unit 230 stores the cookie information when the cookie information issued to the terminal device 2 is included in the response message.

  The transmission unit 270 transmits a request message to the information processing apparatus 1 based on a user operation on the touch panel 24 or the like. When the cookie information corresponding to the URL specified by the request message is stored in the cookie information storage unit 230, the cookie information is included in the request message and transmitted.

[Communication flow]
FIG. 6 is a communication flow diagram showing processing of the information processing device 1 and the terminal device 2 according to the embodiment of the present invention. First, the terminal device 2 receives a request instruction for a specific service (such as Internet banking) from the user (step S101). The terminal device 2 generates and transmits a request message based on the request instruction (step S102). This request message includes a UID that identifies a user for receiving the service. Further, information (MAC address in this example) for identifying the base station 5 to which the terminal device 2 is connected wirelessly is added on the communication path.

  When receiving the request message, the information processing apparatus 1 acquires the MAC address from the MAC header (step S121), and acquires the UID from the request line (step S122). The information processing apparatus 1 uses the acquired MAC address and UID as keys to calculate a cryptographic value using a hash function (step S123). Since the request message received by the information processing device 1 does not include cookie information, the information processing device 1 generates the cookie information in which at least the calculated encryption value is described to be issued to the terminal device 2 (step) S124). The information processing device 1 generates a response message including the generated cookie information (step S125), and transmits the generated response message to the terminal device 2 as a response to the request message (step S126).

  When the terminal device 2 receives the response message, the terminal device 2 displays a screen corresponding to the response message on the touch panel 24, while storing the cookie information included in the response message (step S131). The terminal device 2 receives a request instruction from the user (step S132). The terminal device 2 generates and transmits a request message based on the request instruction (step S133). This request message includes a UID as described above, and a MAC address is added on the communication path.

  When receiving the request message, the information processing apparatus 1 acquires a MAC address from the MAC header (step S141), and acquires a UID from the request line (step S142). The information processing apparatus 1 calculates an encryption value using a hash function using the acquired MAC address and UID as a key (step S143). The information processing apparatus 1 acquires the encrypted value described in the cookie information included in the received request message, and collates it with the encrypted value calculated in step S143 (step S144).

  At this time, if the two encrypted values match, the terminal device 2 that transmitted the request message in step S102 (hereinafter referred to as terminal device 2a) and the terminal device 2 that transmitted the request message in step S133 (hereinafter referred to as “terminal device 2a”). The terminal device 2b) is likely to be the same. Therefore, the request message transmitted in step S133 is determined to be a message from the terminal device 2a, and the information processing device 1 generates a response message in response to the request message request (step S145), and the terminal device 2 As a response to the request message (step S146).

  On the other hand, if the two encryption values do not match, there is a high possibility that the terminal device 2a and the terminal device 2b are different. Therefore, it is determined that the request message transmitted in step S133 is a transmission from another terminal device 2 disguised as the terminal device 2a, and the information processing device 1 generates a response message notifying that access is not accepted. (Step S145), and is transmitted as a response to the request message (step S146).

  In the case where the two encrypted values do not match, for example, the cookie information included in the response message transmitted in step S126 is intercepted and the terminal device 2b uses the cookie information to impersonate the terminal device 2a. There is a case. Even in this case, when the terminal device 2b and the terminal device 2a are connected to different base stations 5 to access the information processing device 1, the MAC addresses acquired from the MAC header of the request message are different.

  Therefore, in the information processing device 1, based on the encrypted value (encrypted value described in the cookie information) calculated based on the request message transmitted from the terminal device 2a and the request message transmitted from the terminal device 2b. The calculated encryption value is different, and it can be determined that the terminal device 2a and the terminal device 2b are different. Therefore, the information processing apparatus 1 can be configured not to authenticate the user of the terminal device 2b.

  Further, the information processing apparatus 1 transmits and receives a message with the terminal apparatus 2 by including the encrypted value in the cookie information. Therefore, if the cryptographic function 140 is stored in the information processing apparatus 1, it is not necessary to store the encryption value for each terminal device 2, and the encryption value necessary as cookie information is stored in each terminal device 2. It only has to be.

  As described above, in the information processing system 1000 according to the embodiment of the present invention, the encryption value for authenticating the terminal device 2 is described in the cookie information issued to the terminal device 2 by the information processing device 1. deep. Thereby, even if the encryption value is not stored in the information processing apparatus 1, the information processing apparatus 1 can determine whether or not the terminal device 2 is impersonating another terminal device 2, thereby improving security. Is possible.

<Modification>
As mentioned above, although embodiment and the Example of this invention were described, this invention can be implemented in various aspects as follows.

[Modification 1]
In the embodiment described above, the IP address or the MAC address is used for the position related information in the extracted information. However, for example, the position information indicating the location of the base station 5 may be used. The position information may be, for example, information expressed by longitude and latitude, or may be information expressed by administrative divisions such as municipalities. In this case, position information converted from the IP address or MAC address may be used. Hereinafter, a specific configuration of the information system according to Modification 1 will be described.

  FIG. 7 is a schematic diagram showing a configuration of an information processing system 1000A according to the first modification of the present invention. In the information processing system 1000A, the reference server 6 connected to the network NW is added to the information processing system 1000 according to the embodiment. The reference server 6 stores a conversion table in which IP addresses or MAC addresses are associated with position information. Further, instead of the information processing apparatus 1 according to the embodiment, an information processing apparatus 1A that uses the reference server 6 when calculating an encryption value is connected to the network NW.

  FIG. 8 is a diagram for explaining a conversion table stored in the reference server 6 according to the first modification of the present invention. In the example of the conversion table shown in FIG. 8, the correspondence between the MAC address (addresses A, B, C,...) And the position information (positions A, B, C,...) Is defined.

  When acquiring the IP address or the MAC address from the request message, the extraction unit 120 of the information processing apparatus 1A refers to the conversion table stored in the reference server 6, acquires the position information, and uses it as position related information. The encryption unit 130 uses the position information acquired by the extraction unit 120 as position related information, and calculates an encryption value in the same manner as in the embodiment. After the encryption value is calculated, processing is performed as in the embodiment.

  Here, when the acquired position information is longitude and latitude, the position related information may be the same position related information for the base stations 5 within a predetermined range by using, for example, truncating the value of the second decimal place or less. It can be information. If the position information is the same, the calculated encryption value is also the same, so that it is possible to provide redundancy against the switching of the base station 5 that occurs when the terminal device 2 is moving. Similarly, even if the position information is an administrative section, for example, if the section smaller than the municipality is not used as the position related information, the same position related information can be obtained in the same municipality.

[Modification 2]
In the embodiment described above, the IP address or the MAC address is used for the position related information in the extracted information, but the position information may be the same as in the first modification. In this case, position information described in the HTTP request body part may be used.

  About the structure of the information system which concerns on the modification 2, it is the structure similar to the modification 1, and address designation information is memorize | stored in the reference server 6 in addition to the conversion table. Note that the conversion table and the addressing information may be stored in different servers.

  The address designation information is information for designating an address satisfying a predetermined condition, for example, information for designating the IP address of the base station 5 of the cellular phone information communication standard (non-IEEE standard).

  FIG. 9 is a diagram for explaining address designation information stored in the reference server 6 according to the second modification of the present invention. In the example of the address designation information shown in FIG. 9, the range of the IP address is designated by a combination of the IP address and the prefix value. The base station 5 to which the IP address included in this range is assigned communicates with the mobile phone information communication standard (non-IEEE standard). When a request message is transmitted via the base station 5, position information indicating the position of the base station 5 is added to the HTTP request body part. In this modification, the position information added in this way is used.

  FIG. 10 is a flowchart showing processing for acquiring position information according to the second modification of the present invention. First, the extraction unit 120 acquires an IP address from the request message, and refers to the address designation information to determine whether the acquired IP address is included (step S211). If the IP address is included (step S211; Yes), the position information described in the HTTP request body part is acquired (step S213). On the other hand, if the IP address is not included (step S211; No), the MAC address (or IP address) is acquired from the request message, and the location information is obtained by referring to the conversion table stored in the reference server 6. Is acquired (step S212). Then, the encryption unit 130 uses the position information acquired by the extraction unit 120 as position related information, and calculates an encryption value in the same manner as in the embodiment (step S214). After the encryption value is calculated, processing is performed as in the embodiment.

[Modification 3]
In the above-described embodiment, the IP address or the MAC address is used for the position related information in the extracted information. However, the position information may be the same as in the first and second modifications. In this case, position information described in the HTTP request body part may be used.

  The configuration of the information system according to Modification 3 is the same as that of Modification 1. Similarly to Modification 2, Modification 3 is added to the HTTP request body portion when a request message is transmitted via the base station 5 of the mobile phone information communication standard (non-IEEE standard). It uses location information. In the second modification, it is determined whether or not the base station 5 uses the mobile phone information communication standard using the addressing information. In the third modification, a case where the determination is made by another method will be described. .

  FIG. 11 is a flowchart showing processing for acquiring position information according to the third modification of the present invention. First, the extraction unit 120 refers to the MAC header of the request message and determines whether there is a description of the MAC address (step S311). When the MAC address is described (step S311; Yes), the MAC address (or IP address) is acquired from the request message, and the location information is acquired by referring to the conversion table stored in the reference server 6. (Step S312). On the other hand, when the MAC address is not described (step S311; No), the position information described in the HTTP request body part is acquired (step S313). Then, the encryption unit 130 uses the position information acquired by the extraction unit 120 as position related information, and calculates an encryption value in the same manner as in the embodiment (step S314). After the encryption value is calculated, processing is performed as in the embodiment.

[Modification 4]
In the above-described embodiment, the cryptographic function 140 uses one predetermined cryptographic function, but a plurality of cryptographic functions may be provided. In this case, the encryption unit 130 calculates a cryptographic value using any cryptographic function. The encryption unit 130 selects one of the cryptographic functions used for calculating the cipher location based on a predetermined calculation using information (for example, UID) included in the request message, cookie information issuance time, the number of characters of the password, and the like. Just decide.

[Modification 5]
In the embodiment described above, the UID and the position related information are used as the extraction information. However, other information may be used or a combination thereof may be used. Other information includes, for example, the content of the HTTP header, and terminal identification information (CPU serial number, terminal device 2 model, etc.) that is stored in the terminal device 2 and identifies the terminal device 2.

DESCRIPTION OF SYMBOLS 1,1A ... Information processing apparatus, 2 ... Terminal device, 5 ... Base station, 11 ... Control part, 12 ... Memory | storage part, 13 ... Communication part, 21 ... Control part, 22 ... Memory | storage part, 23 ... Communication part, 24 ... Touch panel, 110 ... receiving unit, 120 ... extracting unit, 130 ... encrypting unit, 140 ... cryptographic function, 150 ... collating unit, 160 ... executing unit, 170 ... transmitting unit, 210 ... receiving unit, 230 ... cookie information storage unit, 270: Transmitter, 1000, 1000A ... Information processing system

Claims (12)

Receiving means for receiving a request message from the terminal device;
Extraction means for acquiring predetermined extraction information included in the request message;
An encryption means for calculating a first encryption value by a predetermined algorithm using the extracted information;
Transmitting means for transmitting a response message including cookie information in which the calculated first encrypted value is described to the terminal device as a response to the request message;
When cookie information describing a second cipher value is included in the request message, the second cipher value and the first cipher value calculated using the extracted information extracted from the request message Matching means for matching;
An information processing apparatus comprising: execution means for executing processing based on a result of collation by the collation means.   The information processing apparatus according to claim 1, wherein the extracted information includes position related information related to a position of a base station on a communication path from the terminal apparatus. The extraction unit obtains the MAC address or IP address of the base station added to the request message on the communication path,
The information processing apparatus according to claim 2, wherein the position related information includes the acquired MAC address or the IP address. The extraction means refers to a table in which MAC addresses and position information are associated with each other, acquires position information corresponding to the MAC address of the base station added to the request message on the communication path,
The information processing apparatus according to claim 2, wherein the position related information includes the acquired position information. The extraction means refers to a table in which IP addresses and position information are associated with each other, acquires position information corresponding to the IP address of the base station added to the request message on the communication path,
The information processing apparatus according to claim 2, wherein the position related information includes the acquired position information. The extraction means refers to information designating an IP address that satisfies a predetermined condition, and when the IP address of the base station added to the request message on the communication path satisfies the predetermined condition, Get the position information described in the body part,
The information processing apparatus according to claim 2, wherein the position related information includes the acquired position information. When the MAC address is not described in the MAC header added to the request message on the communication path, the extraction unit acquires the position information described in the body part of the request message,
The information processing apparatus according to claim 2, wherein the position related information includes the acquired position information.   The information processing apparatus according to any one of claims 1 to 7, wherein the execution unit notifies the administrator of information related to unauthorized access when a result of verification by the verification unit does not match.   The information processing apparatus according to claim 1, wherein the extraction information includes user identification information that identifies a user of the terminal device. An information processing apparatus according to any one of claims 1 to 9,
The terminal device,
The terminal device
Receiving means for receiving a response message from the information processing apparatus;
Storage means for storing the cookie information included in the received response message;
A transmission means for transmitting a request message, wherein the cookie information included in the response message received from the transmission destination is stored in the storage means; and a transmission means for transmitting a request message including the cookie information; An information processing system comprising: Receiving the first request message from the terminal device;
Obtaining the extraction information contained in the first request message;
Using the extracted information acquired from the first request message, a first encryption value is calculated by a predetermined algorithm,
A response message including cookie information in which the calculated first encrypted value is described is transmitted to the terminal device as a response to the first request message;
Receiving a second request message including cookie information in which the second encrypted value is described from the terminal device;
Obtaining predetermined extraction information included in the second request message;
Using the extracted information acquired from the second request message, a third cipher value is calculated by the algorithm,
Collating the second cryptographic value with the third cryptographic value;
An information processing method for executing processing based on a result of collating the second encryption value and the third encryption value. Computer
Receiving means for receiving a request message from the terminal device;
Extraction means for acquiring predetermined extraction information included in the request message;
An encryption means for calculating a first encryption value by a predetermined algorithm using the extracted information;
Transmitting means for transmitting a response message including cookie information in which the calculated first encrypted value is described to the terminal device as a response to the request message;
When cookie information describing a second cipher value is included in the request message, the second cipher value and the first cipher value calculated using the extracted information extracted from the request message Matching means for matching;
The program for functioning as an execution means which performs the process based on the result of collation by the collation means.

Images