JP2011134252A - Unauthorized use determination server and method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an unauthorized use determination server and method, capable of easily attaining monitoring of unauthorized use. <P>SOLUTION: The unauthorized use determination server 1 includes a log-out history storage means 12 which stores, in response to receipt of a log-out request of a predetermined service containing a user ID, a log-out history in association with the user ID; a log-out history complement means 14 which determines, in response to receipt of a log-in request to the predetermined service, whether the latest log-out history is present by referring to a log-in/log-out history DB 21, takes an access history stored just before in association with the user ID related to the log-in request as the latest log-out history in reference to an access history DB 22 when the latest log-out history is absent, and complements it; an unauthorized use determination means 15 which checks for unauthorized use of the predetermined service based on the stored log-out history and the complemented access history; and a determination result output means 16 which outputs the determination result. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to an unauthorized use determination server and method for a predetermined service.

  Conventionally, on the Internet, various services that can be used by an unspecified number of users are provided by user authentication. When logging in to such a service, the service providing server, for example, often performs identity authentication using a unique ID and password for each user. By the personal authentication, the service providing server provides a service customized for each user, for example. A service refers to a function provided from one computer (service providing server) to another computer (user terminal) via a communication network. Under such circumstances, there is disclosed a journal management server that creates a log database by collecting logs by visiting a plurality of web servers set to provide services to users (customers) via the Internet. (For example, Patent Document 1).

  The journal management server described in Patent Literature 1 creates a database for analysis by extracting a user's behavior history from log data accumulated in a log database. The journal management server traces what operation is performed using the analysis database, and detects illegal operations.

JP 2002-41456 A

  The journal management server described in Patent Literature 1 extracts a large amount of various data acquired each time an operation is performed as a customer action history. In order to analyze such a large amount of various data, advanced technology is required.

  On the other hand, services via the Internet are used by an unspecified number of users. It is not easy to use the journal management server described in Patent Document 1 for services via the Internet used by an unspecified number of users. Moreover, monitoring against unauthorized use is an important issue for service providers.

  It is an object of the present invention to provide an unauthorized use determination server and method that can easily monitor unauthorized use.

  The inventors of the present invention have focused on a specific history that can be acquired by operating the user terminal, found a method for determining unauthorized use based on the tendency of the history, and have completed the present invention. Specifically, the present invention provides the following.

(1) logout history storage means for storing a logout history in association with the user ID in response to receiving a logout request for a predetermined service including a user ID;
An access history storage unit that stores an access history in association with the user ID in response to receiving an access request for the predetermined service;
In response to receiving a login request to the predetermined service including the user ID, it is determined whether or not there is a recent logout history with reference to the logout history stored in the logout history storage unit, When there is no latest logout history, the access history stored immediately before in association with the user ID related to the login request among the access history stored by the access history storage means is regarded as the latest logout history. Logout history complementing means,
Unauthorized use determination for determining whether or not the predetermined service is used illegally based on the logout history stored in the logout history storage unit and the access history regarded as the logout history by the logout history complementing unit Means,
A determination result output means for outputting a determination result by the unauthorized use determination means;
Comprising
Unauthorized use determination server.

  According to such a configuration of the present invention, the presence / absence of the latest logout history is determined in response to the reception of the login request, and when the latest logout history does not exist, the access history is used to determine the latest logout history. Complement the logout history. Therefore, even when the logout history does not exist, the logout history can be supplemented using the access history accumulated by the operation (access) on the user terminal. Then, by complementing the logout history, it is determined whether or not the predetermined service is illegally used based on the logout history, and the determination result is output. Based on the logout history that is simple history information, It can be determined whether or not unauthorized use is made at login. For example, in the case where the user who normally performs logout processing forcibly terminates by closing the web browser, unauthorized use can be determined based on whether or not the logout history is supplemented. In addition, since the said access history includes the thing by the access request at the time of login, when only logging in and doing nothing after that, the access history at the time of login may be regarded as the latest logout history. it can.

(2) The fraudulent use determination means is a relationship between the most recent logout history stored in association with the same user ID as the user ID included in the login request and the login history stored by the login request. To determine whether or not the predetermined service is illegally used,
The unauthorized use determination server according to (1).

  According to such a configuration of the present invention, whether or not unauthorized use is made based on the relationship between the most recent logout history associated with the same user ID as the user ID included in the login request and the login history. Can be determined. For example, it is possible to determine unauthorized use when trends such as the time between logout and login, and the time interval between logout and login are analyzed and a tendency different from normal is shown.

(3) The logout request includes a terminal ID that identifies a terminal that has transmitted the logout request,
The logout history storage means stores the logout history including the terminal ID,
The login request includes a terminal ID that identifies a terminal that has transmitted the login request;
The fraudulent use determination means includes a frequency of the logout history within a predetermined time stored including the same terminal ID as the terminal ID included in the login request and a login history stored by the login request. To determine whether or not the predetermined service is illegally used,
The unauthorized use determination server according to (1) or (2).

  According to such a configuration of the present invention, since the terminal ID is included in the logout history and the login history, unauthorized use is prevented based on the frequency of the logout history and the login history within the predetermined time of the same terminal ID. It can be determined whether or not. For example, if the frequency of logout and login using the same terminal ID is high, it can be determined that automatic login using a computer is being performed, and unauthorized use can be determined.

(4) The logout request includes position information that specifies a position of a terminal that has transmitted the logout request,
The logout history storage means stores the logout history including the position information,
The login request includes location information that specifies a location of a terminal that has transmitted the login request,
The fraudulent use determination means includes a frequency of the logout history within a predetermined time stored including the same location information as the location information included in the login request and a login history recorded by the login request. To determine whether or not the predetermined service is illegally used,
The unauthorized use determination server according to (1) or (2).

  According to such a configuration of the present invention, the location information is included in the logout history and the login history, so that unauthorized use is prevented based on the frequency of the logout history and the login history within the predetermined time of the same location information. It can be determined whether or not. For example, if the frequency of logout and log-in from the same IP address is high, there is a high possibility that automatic log-in using a computer is performed, and it can be determined that it is unauthorized use.

(5) storing a logout history in association with the user ID in response to receiving a logout request for a predetermined service including the user ID;
Storing an access history in association with the user ID in response to receiving an access request for the predetermined service;
In response to receiving a log-in request for the predetermined service including the user ID, it is determined whether or not there is a most recent log-out history with reference to the stored log-out history, and the most recent log-out history is If not, the step of complementing the stored access history as the most recent logout history with the access history stored immediately before being associated with the user ID associated with the login request;
Determining whether or not the predetermined service is illegally used based on the stored logout history and the access history regarded as the logout history;
Outputting a determination result; and
including,
Unauthorized use determination method.

  According to the present invention, it is possible to determine at the time of login whether or not a predetermined service is illegally used based on a logout history that is simple history information.

It is a figure which shows the whole structure of the service provision system which concerns on this embodiment, and the function structure of an unauthorized use determination server. It is a figure explaining the relationship between transmission of the logout request | requirement which concerns on this embodiment, and screen operation. It is a figure which shows the example of login / logout log | history DB which concerns on this embodiment. It is a flowchart of the main process of the unauthorized use determination server which concerns on this embodiment. It is a flowchart of the login process of the unauthorized use determination server which concerns on this embodiment. It is a figure which shows the example of a pattern of the unauthorized use determination process which concerns on this embodiment.

  DESCRIPTION OF EMBODIMENTS Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings. This is merely an example, and the technical scope of the present invention is not limited to this.

(Embodiment)
[Overall Configuration of Service Providing System 100 and Functional Configuration of Unauthorized Use Determination Server 1]
FIG. 1 is a diagram illustrating an overall configuration of a service providing system 100 and a functional configuration of an unauthorized use determination server 1 according to the present embodiment. FIG. 2 is a diagram for explaining the relationship between logout request transmission and screen operation according to the present embodiment. FIG. 3 is a diagram showing an example of the login / logout history DB 21 according to the present embodiment.

  The service providing system 100 includes an unauthorized use determination server 1, a service providing server 3, a user terminal 5, and a communication network 9.

  The unauthorized use determination server 1 is a server that determines whether or not the use of the user terminal 5 is unauthorized use when the user terminal 5 receives provision of a predetermined service. The unauthorized use determination server 1 serves as a front end of the service providing server 3. The unauthorized use determination server 1 accepts a login request for service provision from the user terminal 5 and determines whether the unauthorized use is based on the latest logout situation or the like. If not, the service providing server 3 is provided with a service. The unauthorized use determination server 1 includes a control unit 10 and a storage unit 20.

  The control unit 10 includes a logout request receiving unit 11, a logout history storage unit 12, a login request receiving unit 13, a logout history supplementing unit 14, an unauthorized use determining unit 15, a determination result output unit 16, and an access request receiving unit. Means 17 and access history storage means 18 are provided.

  The logout request receiving unit 11 is a control unit that receives a logout request transmitted from the user terminal 5. In the user terminal 5, when the user explicitly requests logout, for example, by selecting a “logout” link displayed on the screen, a logout request is transmitted from the user terminal 5. On the other hand, in the user terminal 5, for example, when the Web browser is forcibly terminated, a logout request is not transmitted from the user terminal 5.

  FIG. 2A shows an example in which the link 31 is selected by moving the pointer 32 to the “logout” link 31 in the web page displayed on the web browser 30. As described above, since the logout is explicitly requested by selecting the “logout” link 31, the user terminal 5 transmits a logout request to the unauthorized use determination server 1. The logout request receiving unit 11 receives a logout request transmitted from the user terminal 5.

  On the other hand, FIG. 2B is an example in which the Web browser itself is terminated by moving the pointer 36 to the “Close” button 35 of the Web browser 30 and selecting the button 35. Thus, when the Web browser 30 is forcibly terminated, the user terminal 5 does not transmit a logout request to the unauthorized use determination server 1.

  Returning to FIG. 1, the logout request includes a user ID (ID: identifier), a terminal ID, an IP (Internet Protocol) address (position information) of the user terminal 5, and the like. The user ID is a symbol that uniquely identifies the user. The terminal ID is an ID that uniquely identifies the user terminal 5, and is, for example, a MAC (Media Access Control) address. The IP address is information indicating a position where the user terminal 5 is connected.

  The logout history storage unit 12 is a control unit that stores a logout log (logout history) corresponding to the logout request received from the user terminal 5 in the login / logout history DB 21 (DB: database).

  The login / logout history DB 21 illustrated in FIG. 3 is a DB that accumulates logs (history) corresponding to login requests and logout requests received from the user terminal 5. The login / logout history DB 21 includes a history ID 21a, a user ID 21b, a login / logout flag 21c, a date 21d, a terminal ID 21e, and an IP address 21f.

  The history ID 21a is an ID that identifies one log, and stores, for example, an ascending number in the order in which the logs arrive at the unauthorized use determination server 1. The user ID 21 b stores a user ID that identifies the user of the user terminal 5. The login / logout flag 21c stores a flag indicating whether the log is a log-in log or a log-out log. Here, “1” indicates login and “0” indicates logout. The date and time 21d stores the date and time when the log is accumulated. The date and time 21d may be the date and time when the request included in the login request and the logout request is made. The terminal ID 21e stores a terminal ID that identifies the user terminal 5. The IP address 21f stores information indicating the position where the user terminal 5 is connected. The user ID 21b, the login / logout flag 21c, the terminal ID 21e, and the IP address 21f are stored using information included in the login request and the logout request received from the user terminal 5.

  Regarding the user whose user ID 21b is “abc” in FIG. 3, there is a record whose history ID 21a is “1” and a record whose history ID 21a is “6”. The log-in / log-out flag 21c indicates that log-out is forcibly performed between the two records because all records are log-in logs.

  On the other hand, for the user whose user ID 21b is “def”, there are records whose history ID 21a is “3” and “5”. Since the login / logout flag 21c is “0” and “1”, respectively, it can be seen that the user is explicitly logged out.

  Returning to FIG. 1, the login request receiving unit 13 is a control unit that receives the login request transmitted from the user terminal 5. The login request includes a user ID, a terminal ID, an IP address of the user terminal 5, and a password necessary for user authentication.

  The logout history complementing unit 14 is a control unit that complements a logout log that is not stored in the login / logout history DB 21 because a logout request has not been received. The logout log is generated and supplemented using, for example, an access history DB 22 described later.

  The unauthorized use determination unit 15 is a control unit that determines whether or not the logged-in user ID is illegally using a predetermined service based on the login and logout logs stored in the login / logout history DB 21.

  The determination result output unit 16 is a control unit that transmits the determination result by the unauthorized use determination unit 15 to the user terminal 5. The determination result output means 16 may control the service providing server 3 so as to rank the determination results and inhibit the service provided by the service providing server 3 according to the degree.

  The access request receiving unit 17 is a control unit that receives an access request from the user terminal 5 to the service providing server 3.

  The access history storage unit 18 is a control unit that stores an access log (access history) corresponding to an access request in the access history DB 22.

  The storage unit 20 includes a login / logout history DB 21 and an access history DB 22.

  The login / logout history DB 21 is a DB that stores a log corresponding to a login request and a logout request transmitted from the user terminal 5 in order to receive the service provided by the service providing server 3.

  The access history DB 22 is a DB that stores a log corresponding to an access request accessed at the user terminal 5 at the stage of receiving the service provided by the service providing server 3.

  The hardware of the unauthorized use determination server 1 of this embodiment may be configured by a general computer. For example, a general computer includes a central processing unit (CPU) as the control unit 10 and a memory (RAM, ROM), a hard disk (HDD), and an optical disk (CD, DVD, etc.) as a storage unit 20 in a network. As a communication device, various wired and wireless LAN devices, as a display device, for example, various displays such as a liquid crystal display and a plasma display, and as an input device, for example, a keyboard and a pointing device (mouse, tracking ball, etc.) are appropriately provided. These are connected by a bus line. In such a general computer, the CPU controls the unauthorized use determination server 1 in an integrated manner, and reads and executes various programs as appropriate, thereby cooperating with the hardware described above and various functions according to the present invention. Is realized.

  The service providing server 3 is a server that provides a predetermined service, and includes a storage unit that stores service providing content and a control unit that controls the entire service providing server 3. The hardware of the service providing server 3 may be configured by a general computer.

  The user terminal 5 is, for example, a personal computer (PC) or a mobile terminal such as a mobile phone. The user terminal 5 may be any device as long as it has a communication function and can receive a predetermined service.

  In the present embodiment, the unauthorized use determination server 1 and the service providing server 3 are described as separate devices. However, the unauthorized use determination server 1 also has the function of the service providing server 3, It may be realized by a computer. In this embodiment, the unauthorized use determination server 1 receives all requests from the user terminal 5 as receiving requests from the service providing server 3, but the service providing server 3 directly receives access requests. Thus, the unauthorized use determination server 1 may receive the access log stored in the access history DB 22 from the service providing server 3.

  The communication network 9 is a communication line such as the Internet for performing communication among the unauthorized use determination server 1, the service providing server 3, and the user terminal 5. The communication network 9 may be wired or part or all of it may be wireless.

[Processing of Unauthorized Use Determination Server 1]
Next, processing in the unauthorized use determination server 1 will be described. FIG. 4 is a flowchart of the main process of the unauthorized use determination server 1 according to the present embodiment. FIG. 5 is a flowchart of the login process of the unauthorized use determination server 1 according to this embodiment. FIG. 6 is a diagram illustrating a pattern example of the unauthorized use determination process according to the present embodiment.

  The main process of FIG. 4 starts when the unauthorized use determination server 1 receives data from the user terminal 5.

  S <b> 1 in FIG. 4: The control unit 10 (logout request receiving unit 11) determines whether or not a logout request has been received from the user terminal 5. When the logout request is received (S1: YES), the control unit 10 moves the process to S2. On the other hand, when the logout request is not received (S1: NO), the control unit 10 moves the process to S3.

  S2: The control unit 10 (logout history storage unit 12) stores a log corresponding to the logout request in the login / logout history DB 21. Then, the control part 10 complete | finishes this process.

  S3: The control unit 10 (access request receiving means 17) determines whether an access request has been received from the user terminal 5. When the access request is received (S3: YES), the control unit 10 moves the process to S4. On the other hand, when the access request is not received (S3: NO), the control unit 10 moves the process to S5.

  S4: The control unit 10 (access history storage means 18) causes the access history DB 22 to store a log corresponding to the access request. Then, the control part 10 complete | finishes this process.

  S5: The control unit 10 (login request receiving means 13) determines whether or not a login request has been received from the user terminal 5. If a login request has been received (S5: YES), the control unit 10 moves the process to S6, ends the process after executing the login process. On the other hand, when the login request has not been received (S5: NO), the control unit 10 ends this process.

  Here, the login process in S6 of FIG. 4 will be described with reference to FIG.

  S11 in FIG. 5: The control unit 10 stores a log corresponding to the login request in the login / logout history DB 21.

  S12: The control unit 10 (logout history complementing means 14) determines whether or not the most recent logout log exists in the login / logout history DB 21. This can be determined by searching the log-in / log-out history DB 21 and determining whether the latest log out of the logs with the same user ID is a log-in log or log-out log. For example, in the example of FIG. 3, there is no latest logout log for the record whose user ID 21b is “abc” and history ID 21a is “6”. On the other hand, regarding the record in which the user ID 21b is “def” and the history ID 21a is “5”, the most recent logout log is a record in which the history ID 21a is “3”.

  If the most recent logout log exists (S12: YES), the control unit 10 moves the process to S15. On the other hand, when there is no latest logout log (S12: NO), the control unit 10 moves the process to S13.

  S13: The control unit 10 (logout history complementing means 14) acquires the access log stored immediately before in association with the corresponding user ID from the access history DB22.

  S14: The control unit 10 (logout history complementing means 14) generates a logout log from the acquired access log and complements it.

  S15: The control unit 10 (unauthorized use determination unit 15) performs an unauthorized use determination process.

  Here, an example of the pattern of the unauthorized use determination process will be described with reference to FIG. As an unauthorized use determination pattern, for example, when a logout process is normally performed by selecting a “logout” link, but the Web browser is forcibly terminated and logged out (see FIG. 2B), It can be determined that there was a use (Pattern 1). In this case, the determination can be made based on whether or not the logout log is complemented.

  Further, when the same user terminal 5 repeats the login request and the logout request within a predetermined time (for example, 20 minutes), the login from the same terminal ID is a process that is difficult to consider in normal use. Since the request and the logout request are repeated, it is possible to determine unauthorized use (pattern 2). In this case, it can be determined by paying attention to the terminal ID.

  Furthermore, if a login request and a logout request are repeated within a predetermined time (for example, 20 minutes) from the same IP address, it can be determined as unauthorized use as in the case of the same terminal ID (pattern 3). In this case, it can be determined by paying attention to the IP address.

  Ordinarily, when the user is logged out within a certain time width, but is logged out at a time far from the time width, it can be determined as unauthorized use (pattern 4). In this case, it can be determined by extracting a record for the corresponding user ID and paying attention to the date and time of login and logout.

  Returning to FIG. 5, S16: The control unit 10 (unauthorized use determination means 15) determines whether or not the determination result is unauthorized use. When it determines with it being unauthorized use (S16: YES), the control part 10 moves a process to S17. On the other hand, if it is not determined to be unauthorized use (S16: NO), the control unit 10 moves the process to S18.

  S <b> 17: The control unit 10 (determination result output unit 16) performs processing for suppressing service provision so that service provision to the user terminal 5 is not performed. Thereafter, the control unit 10 ends this process and returns to the main process.

  S18: The control unit 10 requests the service providing server 3 to provide a service for the user terminal 5. Thereafter, the control unit 10 ends this process and returns to the main process.

  As described above, the unauthorized use determination server 1 determines whether or not the most recent logout history exists in response to the reception of the login request, and when the most recent logout history does not exist, the unauthorized use determination server 1 uses the access history. The logout history can be supplemented. Therefore, even if there is no logout history, the unauthorized use determination server 1 can supplement the logout history using the access history accumulated by the operation on the user terminal 5.

  Further, the unauthorized use determination server 1 complements the logout history, determines whether or not the predetermined service is illegally used based on the logout history, and outputs a determination result. Based on a certain logout history, it can be determined whether or not unauthorized use is made during login.

(Deformation)
In the present embodiment, when it is determined that the use is illegal, the process of uniformly suppressing the use of the service is performed. However, the present invention is not limited to this. For example, when it is determined to be unauthorized use, the degree of unauthorized use may be determined based on the number of appearances of the same terminal ID within a predetermined time, and the service to be suppressed may be determined according to the degree. As a result, the contents of the service can be changed such that a predetermined service is completely inhibited according to the degree of fraud, or only some functions are inhibited.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. The effects described in the embodiments of the present invention are only the most preferable effects resulting from the present invention, and the effects of the present invention are limited to those described in the embodiments of the present invention. is not.

DESCRIPTION OF SYMBOLS 1 Unauthorized use determination server 3 Service provision server 5 User terminal 10 Control part 11 Logout request receiving means 12 Logout history storage means 13 Login request receiving means 14 Logout history complementing means 15 Unauthorized use determining means 16 Determination result output means 17 Access request receiving means 18 Access history storage means 20 Storage unit 21 Login / logout history DB
22 Access history DB
100 Service providing system

Claims (5)

Logout history storage means for storing a logout history in association with the user ID in response to receiving a logout request for a predetermined service including a user ID;
An access history storage unit that stores an access history in association with the user ID in response to receiving an access request for the predetermined service;
In response to receiving a login request to the predetermined service including the user ID, it is determined whether or not there is a recent logout history with reference to the logout history stored in the logout history storage unit, When there is no latest logout history, the access history stored immediately before in association with the user ID related to the login request among the access history stored by the access history storage means is regarded as the latest logout history. Logout history complementing means,
Unauthorized use determination for determining whether or not the predetermined service is used illegally based on the logout history stored in the logout history storage unit and the access history regarded as the logout history by the logout history complementing unit Means,
A determination result output means for outputting a determination result by the unauthorized use determination means;
Comprising
Unauthorized use determination server. The unauthorized use determination means is based on the relationship between the most recent logout history stored in association with the same user ID as the user ID included in the login request and the login history stored by the login request. Determining whether the predetermined service is illegally used;
The unauthorized use determination server according to claim 1. The logout request includes a terminal ID that identifies a terminal that has transmitted the logout request;
The logout history storage means stores the logout history including the terminal ID,
The login request includes a terminal ID that identifies a terminal that has transmitted the login request;
The fraudulent use determination means includes a frequency of the logout history within a predetermined time stored including the same terminal ID as the terminal ID included in the login request and a login history stored by the login request. To determine whether or not the predetermined service is illegally used,
The unauthorized use determination server according to claim 1 or 2. The logout request includes location information that specifies a location of a terminal that has transmitted the logout request,
The logout history storage means stores the logout history including the position information,
The login request includes location information that specifies a location of a terminal that has transmitted the login request,
The fraudulent use determination means includes a frequency of the logout history within a predetermined time stored including the same location information as the location information included in the login request and a login history recorded by the login request. To determine whether or not the predetermined service is illegally used,
The unauthorized use determination server according to claim 1 or 2. Storing a logout history in association with the user ID in response to receiving a logout request for a predetermined service including the user ID;
Storing an access history in association with the user ID in response to receiving an access request for the predetermined service;
In response to receiving a log-in request for the predetermined service including the user ID, it is determined whether or not there is a most recent log-out history with reference to the stored log-out history, and the most recent log-out history is If not, the step of complementing the stored access history as the most recent logout history with the access history stored immediately before being associated with the user ID associated with the login request;
Determining whether or not the predetermined service is illegally used based on the stored logout history and the access history regarded as the logout history;
Outputting a determination result; and
including,
Unauthorized use determination method.

Images