JP2015007859A - Authentication method, authentication program, computer readable recording medium having authentication program recorded thereon, and information processing device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent the occurence of damage caused by a man-in-the-middle attack by enhancing an authentication function necessary when data communication, transaction, service and the like via a communication network such as the Internet are provided.SOLUTION: An information processing device: sets a specific ID obtainable by a referrer and a non-display ID comparable with the specific ID, in communication data to be transmitted by a server; communicates with a client; compares the specific ID with the non-display ID from communication data including a request from the client; and thereby performs authentication. Particularly, the information processing device: sets a session ID obtainable by a referrer and a non-display ID comparable with the session ID, in a hidden field in communication data to be transmitted by the server; communicates with the client; reads out the session ID and the non-display ID from communication data including a request from the client; compares them; and thereby performs authentication.

Description

  The present invention relates to an apparatus and method for performing authentication, and relates to, for example, an authentication technique required for providing transactions or services performed via a communication network such as the Internet.

  With the deep penetration of the Internet into social life, users of the Internet can access websites using computers and various terminal devices and receive various services. Among them, as represented by mail order and Internet banking, there are many things that require personal authentication for the provision of services including information on money transfer and privacy.

  However, in reality, computers connected to a communication network such as the Internet are exposed to various threats in exchange for the benefits of convenience. For example, an eavesdropper where a malicious third party impersonates a legitimate user by eavesdropping on communication between a user terminal on the guest side and a server on the host side. Attack is one of the typical threats.

  Several patterns are known for man-in-the-middle attacks. For example, there is DNS cash poisoning that spoofs a communication destination on the Internet. As shown in FIG. 5 (A), the malicious third party X rewrites the contents of the cache held by the domain name server (DNS) on the Internet, and the bona fide A goes to B. The communication that intercepted was taken.

  In addition, as shown in FIG. 5B, a man-in-the-middle attack called Cross Site Request Forgeries (CSRF) is known. This is because when an Internet user browses a website set by an attacker using the Web browser of his / her terminal device, the user tries to click a malicious link without the user's knowledge. As a result, it is an attack technique that is performed without knowing writing on a bulletin board or the like of another website unintended by the user, shopping application, change or deletion of user registration information, and the like.

  It is practically impossible for legitimate users to investigate and avoid whether or not a dangerous trap has been placed on the browsing site when using a web browser. It is. If you get caught in such traps, it will be very troublesome because an unauthorized request will be executed before the user can do it.

  Even in a normal case, in order to ensure the safety of the provision of transactions and services via the Internet, an operation for selecting legitimate users on the server side is performed. Users are required to enter a user ID and password to access a website and receive service. The server manages the user by checking the entered user ID and password. The technique to take is taken. For example, a method is considered in which only legitimate users can log in by taking into account date information acquired from a URL requested to be accessed by a user, and information related to a user ID and password (see Patent Document 1).

JP 2006-163582 A

  However, in order to cope with man-in-the-middle attacks, if an attempt is made to strengthen the authentication function at the time of login, the burden of system management of the server etc. increases for the service provider, and many passwords and personal The complexity of having to disclose information increases. In addition, the user ID and password may be deciphered, and personal information may be accidentally leaked from the operator's database, so safety is not necessarily guaranteed.

  Therefore, an embodiment of the present invention strengthens an authentication function necessary for providing data communication, transactions, services, etc. via a communication network such as the Internet, and prevents the occurrence of damage due to man-in-the-middle attacks. For the purpose.

  One embodiment of the present invention is an authentication method in an information processing apparatus (server) connected to a client via a communication network, and a predetermined parameter when a parameter generation unit of the information processing apparatus transmits communication data to the client. A communication data generation unit generates communication data in which a value corresponding to the session ID is set as a non-display ID that is not displayed on the Web browser of the client while the communication data generation unit adds the parameter value as a session ID to the URL. When the unit transmits the communication data including the session ID and the non-display ID and receives the return communication data (return message) for the communication data, the authentication unit sets the session ID value and the non-display ID value of the return communication data. The session ID value and the non-display ID value of the acquired return communication data Comparison is a method of evaluation.

  According to this authentication method, the session ID and the non-display ID are included in the communication data, the session ID value and the non-display ID value are read from the return communication data (return message) from the client side, By comparing and evaluating, it is possible to easily and reliably perform the authentication work on the information processing apparatus (server) side.

  As another preferable aspect of this authentication method, the non-display ID set by the communication data generation unit in the communication data is set in the hidden field, the authentication unit acquires the session ID of the return communication data from the referrer, and the non-display ID May be obtained from the hidden field. Further, the communication data generation unit may set the session ID and the non-display ID as the same value.

  In this way, by using the referrer and hidden functions of the server, it is possible to authenticate whether or not the request from the client is illegal without special preparation. Further, by setting the session ID and the non-display ID to the same value, it is possible to simply and reliably authenticate whether or not the request from the client is illegal.

  As another aspect of this authentication method, the communication data generation unit preferably sets the session ID and / or the non-display ID to different values for each communication with the client. By setting one or both of the session ID and the non-display ID to a different value for each communication with the client, it becomes difficult to decipher the ID, and the reliability of authentication can be improved.

  One embodiment of the present invention includes a parameter generation unit that generates a predetermined parameter value when transmitting communication data to a client, a parameter ID that is added to a URL as a session ID, and is not displayed on the client's Web browser. A communication data generation unit that creates communication data in which a value corresponding to a session ID is set as a display ID, a transmission / reception unit that transmits communication data including a session ID and a non-display ID, and receives return communication data for the communication data; The information processing apparatus (server) includes an authentication unit that acquires a session ID and a non-display ID from return communication data and compares and evaluates the session ID value and the non-display ID value of the acquired return communication data.

  According to this information processing apparatus, the communication data generation unit adds a predetermined parameter value as a session ID to the URL of the communication data, sets a non-display ID that is not displayed on the client Web browser, and authenticates the communication data. By reading the session ID and the non-display ID and comparing and evaluating them in the section, authentication can be easily performed on the information processing apparatus (server) side.

  As another preferred mode of this information processing apparatus, the communication data generation unit sets a non-display ID to be set in communication data in the hidden field, the authentication unit acquires the session ID of the return communication data from the referrer, and sets the non-display ID. It may have a function of acquiring from the hidden field. Further, the communication data generation unit may have a function of setting the session ID and the non-display ID as the same value.

  The hidden ID in the communication data is set in the hidden field, the session ID of the return communication data (return message) is acquired from the referrer, the hidden ID is read from the hidden field, and the values of both IDs are compared. Thus, it is possible to authenticate whether or not the request from the client is illegal. By setting the session ID and the non-display ID to the same value, it is possible to simply and reliably authenticate whether or not the request from the client is illegal.

  As another aspect of the information processing apparatus, the communication data generation unit preferably has a function of setting a session ID and / or a non-display ID to a different value for each communication with a client. By setting one or both of the session ID and the non-display ID to a different value for each communication with the client, it becomes difficult to decipher the ID, and the reliability of authentication can be improved.

  In one embodiment of the present invention, an information processing apparatus that transmits and receives a communication message to and from a client through a telecommunication line, a parameter generation unit that generates a predetermined parameter value when transmitting communication data to the client, and the parameter value in the URL Communication data generation means for creating communication data that is added as a session ID and set a value corresponding to the session ID as a non-display ID that is not displayed on the browser, transmits communication data including the session ID and the non-display ID, and communication data Transmitting / receiving means for receiving return communication data for the authentication, authentication means for obtaining a session ID and a non-display ID from a referrer of the return communication data, and comparing and evaluating the session ID value and the non-display ID value of the acquired return communication data It is an authentication program to make it function as.

  According to this authentication program, the information processing apparatus (server) can have an authentication function. The authentication function reads and compares the session ID added to the URL of the communication data and the non-display ID that is not displayed on the client's Web browser from the communication data (return message) from the client side. The authentication function of the information processing apparatus (server) can be enhanced.

  As another preferred mode, this authentication program sets a non-display ID to be set in communication data in the hidden field, acquires a session ID of return communication data from the referrer, and acquires a non-display ID from the hidden field. You may add to a processing apparatus (server). In this case, the session ID and the non-display ID may be set as the same value.

  As another aspect, it is preferable that the communication data generation means has a function of setting the session ID and / or the non-display ID to different values for each communication with the client. By setting one or both of the session ID and the non-display ID to a different value for each communication with the client, it becomes difficult to decipher the ID, and the reliability of authentication can be improved.

  Further, an embodiment of the present invention may be a computer-readable recording medium on which such an authentication program is recorded.

  According to one embodiment of the present invention, a predetermined parameter value is generated on the server side, this parameter value is set as a session ID that can be added to the URL of communication data, and is not visible on the Web browser By performing authentication in association with the ID, it is possible to easily authenticate whether the request from the client is legitimate or illegal.

  That is, the communication data transmitted by the server is set with a specific ID that can be acquired by the referrer and a non-display ID that can be compared with the specific ID, and communicates with the client. By comparing the ID and the non-display ID, the authentication can be performed easily and reliably without special preparation.

The block diagram explaining the function of the information processor (server) concerning one embodiment of the present invention. The figure which shows the relationship of the communication data between the information processing apparatus which has a function as a server, and a client. The flowchart explaining the authentication method which concerns on one Embodiment of this invention. The flowchart explaining the authentication method which concerns on one Embodiment of this invention. The schematic diagram explaining the aspect of a man-in-the-middle attack.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention can be implemented in many different modes, and should not be construed as being limited to the description of the embodiments exemplified below.

  Note that, for the contents of the invention described below, the same reference numerals are used in common in different drawings for the same parts or parts having similar functions, and repeated explanation is omitted unless there are special circumstances in that case. .

<About functions of information processing device (server) for authentication>
In this embodiment, an example of an information processing apparatus (server) that aims to strengthen an authentication function in communication between a client and a server using the Internet and prevent a man-in-the-middle attack will be described.

  FIG. 1 is a block diagram showing functions of an information processing apparatus 102 according to an embodiment of the present invention. An information processing apparatus 102 illustrated in FIG. 1 is connected to a client (user) 102 via a communication network 112 and has a function as a server. The client 114 is configured by an electronic device that can be connected to a communication network such as a personal computer, a tablet computer, a mobile phone, a smartphone, or a television device, and has a function of acquiring resources by communicating with a server based on HTTP or the like. Yes.

  The information processing apparatus 102 includes a parameter generation unit 104, a communication data generation unit 106, an authentication unit 110, and a transmission / reception unit 108. The parameter generation unit 104 generates a parameter used for a session ID (unique key) used when transmitting communication data to the client 114. The parameter value is preferably a random and unique value that is difficult to guess. In the case of text data, it can be expressed as a character string of an arbitrary length combining a plurality of characters, symbols, numbers, and the like.

  The communication data generation unit 106 generates a URL, a communication sentence, an icon, image data, and the like that are displayed on the Web browser of the client 114. For example, when using the GET method, communication data is created by adding the parameter value generated by the parameter generation unit 104 to the URL as a session ID. In this communication data, a value corresponding to the session ID is set as a non-display ID that is not displayed on the screen of the Web browser of the client 114. As the non-display ID, for example, the same value as the session ID can be set as a hidden parameter in the hidden field.

  The transmission / reception unit 108 transmits the communication data created by the communication data generation unit 106 to the client 114 via the communication network 112. Further, the transmission / reception unit 108 receives communication data (return communication data) returned from the client 114 side.

  The authentication unit 110 reads the session ID value acquired by the referrer and the non-display ID included in the communication data (return message) from the communication data (return message) sent from the client 114 side, and both Authentication is performed by comparing and evaluating the value of. When the non-display ID is written in the hidden field, the value of the hidden field of the communication data (return message) returned from the client is read, and the value is compared with the value of the session ID acquired from the referrer. Then, the session ID value obtained from the referrer is compared with the non-display ID value (hidden parameter), and if the identity or relevance is confirmed, it is determined that an appropriate request has been made, and there is a discrepancy. If no relevance is confirmed, it is determined that an inappropriate request has been made.

  FIG. 2 shows a communication data relationship between the information processing apparatus 102 having a function as a server and the client 114. In the example shown in FIG. 2, a parameter value “ABC123” is added to the URL as a session ID, and the same parameter value is also set as a non-display ID. The hidden ID is set in the hidden field by the hidden object. Then, a session ID that can be displayed on the Web browser of the client 114 and a non-display ID that is not displayed on the screen of the Web browser are transmitted as communication data.

  Authentication performed by the information processing apparatus 102 is performed by reading specific information from communication data (return message) returned from the client 114. The communication data (return message) returned from the client 114 includes a portion corresponding to the session ID and information corresponding to the non-display ID. The session ID value can be read by the referrer, and the non-display ID is a value read from the hidden field.

  In the authentication, the value of the session ID acquired from the communication data (return message) returned from the client 114 is compared with the value of the non-display ID. For example, when the same value is set for the session ID and the non-display ID when transmitting the communication data, the session ID read from the returned communication data is compared with the non-display ID.

  In normal transmission / reception between the information processing apparatus as a server and the client, the value of the session ID and the value of the non-display ID do not change. Therefore, if the identity or relationship between the two is confirmed, the server side is normal. It can be determined that a simple request has been made.

  On the other hand, when a cross-site request forgery (CSRF) attack is present, the hidden parameter is cleared, and the session ID value and the non-display ID value do not match. At the time of CSRF attack, an arbitrary HTTP request prepared by the CSRF attacker is sent from the client 114. At this time, since the same parameter as the hidden parameter set by the communication data generation unit 106 cannot be set, the hidden parameter of the communication data transmitted by the CSRF attacker is null or the hidden ID set on the server side. And a different value is set. Since the CSRF attacker generally cannot know that the referrer and the hidden function are used to recognize each message as a legitimate message, this authentication method works extremely effectively. That is, if the attacker recognizes the session ID set in the URL and the non-display ID set in the hidden field and does not make a malicious request, the request becomes invalid, and the attack difficulty level is further increased. It will increase.

  As described above, the information processing apparatus 102 according to the present embodiment can perform simple and reliable authentication by comparing and evaluating the session ID set in the URL and the non-display ID set in the hidden field. The session ID set in the URL can be acquired by referring to the referrer of the communication data (return message) returned by the client, and does not require special preparation. The referrer is originally intended to refer to the URL of the transition source. However, since the parameter value of the GET method can be set to the URL, no special coding is required when adding the session ID. That is, this embodiment uses the original purpose of the referrer (referring to the URL of the transition source) as a different application, so that it is not necessary to secure a special storage area for storing the session ID in the server. In addition, it is possible to reliably eliminate unauthorized requests.

  In this way, by setting the same value as the session ID added to the URL as a non-display ID in the hidden field, at the authentication stage, only the parameters of the referrer and the hidden function are compared on the server side. It becomes possible to confirm the presence of a man-in-the-middle attack. This authentication method is sent from the client side because it is not necessary to manage which session ID is set every time the server side receives communication data sent from the client side. Even if communication data increases, it is possible to cope with an increase in the load on the server.

  According to this embodiment, the communication data transmitted by the server is set with a specific ID that can be acquired by the referrer and a non-display ID that can be compared with this specific ID, and communicates with the client. Authentication can be performed by comparing the specific ID and the non-display ID from the communication data accompanied by.

<About authentication method>
Next, an authentication method according to an embodiment of the present invention will be described with reference to the flowchart of FIG. The flowchart shown in FIG. 3 shows a series of processes performed by the information processing apparatus 102 having the function as the server shown in FIG.

  First, a predetermined parameter value is generated by the parameter generation unit 104 (S201). The predetermined parameter value is preferably a random and unique value that is difficult to guess. When text data is used, it can be expressed as a character string of any length combining multiple characters, symbols, numbers, etc. It becomes. This parameter value is generated when a predetermined request is made from the client to the server.

  The generated parameter value is set as a non-display ID that is not visually recognized in the communication data (S202). In this process, the communication data generation unit 106 of the information processing apparatus 102 acquires a parameter value from the parameter generation unit 104 and sets the value as a non-display ID. For example, the parameter value is set as a non-display ID in the hidden field.

  This parameter value is set as a session ID to be displayed on the screen of the client Web browser in the communication data (S203). For example, when using the GET method, communication data is created by adding the parameter value generated by the parameter generation unit 104 as a session ID after the URL.

  When communication data including such a session ID and non-display ID is created, the transmission / reception unit 108 transmits the communication data to the client (S204). Then, the transmission / reception unit 108 receives the communication data (return message) transmitted from the client side (S205).

  The authentication unit 110 acquires a non-display ID from the received communication data (return message) (S206). For example, the parameter value read from the hidden field is acquired as a non-display ID. The acquired value is held (A = hidden parameter value). If the communication data (return message) received at this time is authentic, the value of the hidden parameter is the same value as the non-display ID set before transmission.

  If the same value as the session ID is written as the non-display ID, the same value as the session ID is read from the hidden field. On the other hand, when a man-in-the-middle attack is present, the value read from the hidden field is different as described above.

  Further, the authentication unit 110 acquires the value of the session ID from the URL referrer (S207). The acquired value is held (B = session ID value).

  Next, the authentication unit 110 performs authentication by comparing the non-display ID value (A) read from the hidden field with the session ID value (B) acquired by the referrer (S208). The comparison between the session ID and the non-display ID may determine whether or not both values are the same, or can a certain result be obtained by performing some arithmetic processing using both values? You may judge by whether or not. In addition, one or both of the session ID and the non-display ID may be encrypted and decipherable using an encryption key.

  For example, when the same parameter is set for the session ID and the non-display ID, the non-display ID value (A) read in the hidden field matches the session ID value (B) obtained by the referrer. Then, it can be determined that the communication between the server and the client is normal.

  On the other hand, when a man-in-the-middle attack is present, the value (A) read from the hidden field is different from the value before transmission, so the values of A and B do not match. In other words, by comparing and evaluating the value (A) and the value (B) of the session ID to the non-display ID acquired from the received communication data (return message), it is an appropriate request or an unauthorized request Can be determined.

  As a result of the determination, if the identity or relationship between the non-display ID value (A) read from the hidden field and the session ID value (B) obtained by the referrer is confirmed, an appropriate request is issued. As a result of the authentication, the authentication process ends (S209). On the other hand, if the values of A and B do not match, it is determined that the request is invalid and the authentication process is terminated (S210).

  In the above, since both the session ID set in the URL and the non-display ID embedded in the hidden field can be read on the server side, no special creation is required for authentication.

  Further, since this authentication method only needs to refer to communication data (return message) transmitted from the client side, it is not necessary to secure a storage area for storing the session ID in the server. Since the session ID is used only on the spot, the server side can authenticate the client request without requiring complicated ID management.

  According to the authentication method according to the present embodiment, by using the referrer function for a purpose different from the original purpose (referring to the transition source URL), the authentication process can be performed extremely simply and reliably.

  In the authentication process, when an unauthorized request is suspected, additional authentication may be performed for the sake of convenience while ensuring the security of the client. An example thereof will be described with reference to FIG.

  The authentication unit 110 compares the value (A) read from the hidden field with the value (B) of the session ID obtained by the referrer (S208). A mail with a URL is transmitted to the client (S211).

  The client that has received the mail with the additional authentication guidance URL confirms the contents of the mail, and if necessary, clicks the URL displayed in the mail to perform login processing or password authentication (S212). In this case, the client uses the password and personal information managed on the server side to access the server service request.

  Then, it is determined whether the client is a legitimate client (S213). If it is determined that the client is a legitimate client, the authentication process is terminated as a request is accepted (S209). On the other hand, if there is no reply from the client, or if the login process or password authentication is not properly performed, the reception of the request is stopped and the authentication process is terminated (S210).

  In this way, by combining the authentication process using the referrer and the authentication process performed by the client, the authentication process can be performed more reliably.

<About the certification program>
The program for executing the authentication method described with reference to FIG. 3 generates a parameter value used for authentication when transmitting communication data to the client, using an information processing device that transmits / receives a message to / from the client via a communication line such as the Internet. A parameter generation unit that adds a parameter value to the URL as a session ID and creates communication data in which a value corresponding to the session ID is set as a non-display ID that is not displayed on the Web browser. Transmission / reception means for transmitting communication data including a display ID and receiving return communication data for the communication data, acquiring a session ID and non-display ID from the return communication data, and obtaining a session ID and non-display ID of the acquired return communication data To function as an authentication means for comparative evaluation It can be.

<Parameter setting method>
In this embodiment, a method for generating a predetermined parameter value, setting it as a session ID in the URL (set as a referrer in the HTTP header), and embedding a non-display ID in the hidden field has been exemplified. The authentication ID corresponding to the ID may be set using the Cookie function. Further, an authentication ID may be set in any area of the TCP / IP header, IP header, and HTTP header. By setting an ID value of an arbitrary length in an arbitrary area of these headers, it is possible to make it difficult to decipher the ID for authentication. Further, in addition to the session ID referenced in the referrer and the non-display ID set in the hidden field, authentication may be performed by combining a cookie or an authentication ID set in the various headers. In any case, at least two IDs of the session ID value acquired by the referrer and the corresponding ID for authentication are read from the communication data (return message) and compared and evaluated, so that it is simple and reliable. Authentication can be performed.

  Note that the value of one or both of the session ID and the non-display ID may be changed to be different for each communication with the client (every request is made). For example, by differentiating the value of one or both of the session ID and the non-display ID for each communication with the client, the decipherability of the authentication ID value is reduced for a person other than the server administrator. Therefore, it is preferable.

  As described above, according to one embodiment of the present invention, the communication data transmitted by the server is set with the specific ID that can be acquired by the referrer and the non-display ID that can be compared with the specific ID, and communicates with the client. When a request is made from the client, the specific ID and the non-display ID are acquired from the communication data and compared, so that authentication can be performed easily and reliably.

102 Information processing device (server)
104 Parameter generation unit 106 Communication data generation unit 108 Transmission / reception unit 110 Authentication unit 112 Communication network 114 Client

Claims (13)

An authentication method in an information processing apparatus connected to a client via a communication network,
The parameter generation unit of the information processing device generates a parameter value used for authentication when transmitting communication data to the client,
The communication data generation unit of the information processing apparatus adds the parameter value to the URL as a session ID and creates communication data in which a value corresponding to the session ID is set as a non-display ID that is not displayed on the client Web browser And
The transmission / reception unit of the information processing device transmits the communication data including the session ID and the non-display ID, receives return communication data for the communication data,
An authentication method, wherein the authentication unit of the information processing apparatus acquires a session ID and a non-display ID from the return communication data, and compares and evaluates the session ID and the non-display ID of the acquired return communication data. The communication data generation unit sets a non-display ID to be set in the communication data in the hidden field,
The authentication method according to claim 1, wherein the authentication unit acquires a session ID of the return communication data from a referrer and acquires a non-display ID from a hidden field.   The authentication method according to claim 1 or 2, wherein the communication data generation unit sets the session ID and the non-display ID as the same value.   The authentication according to any one of claims 1 to 3, wherein the communication data generation unit sets the session ID and / or non-display ID to a different value for each communication with a client. Method. An information processing apparatus connected to a client via a communication network,
A parameter generation unit that generates a parameter value used for authentication when transmitting communication data to the client;
A communication data generating unit that adds the parameter value as a session ID to a URL and creates communication data in which a value corresponding to the session ID is set as a non-display ID that is not displayed on the client Web browser;
A transmission / reception unit for transmitting communication data including the session ID and the non-display ID and receiving return communication data for the communication data;
An information processing apparatus comprising: an authentication unit that acquires a session ID and a non-display ID from the return communication data, and compares and evaluates the session ID and the non-display ID of the acquired return communication data. The communication data generation unit sets a non-display ID to be set in the communication data in a hidden field,
The information processing apparatus according to claim 5, wherein the authentication unit acquires a session ID of the return communication data from a referrer, and acquires a non-display ID from a hidden field.   The information processing apparatus according to claim 5, wherein the communication data generation unit sets the session ID and the non-display ID as the same value.   8. The information according to claim 5, wherein the communication data generation unit sets the session ID and / or the non-display ID to a different value for each communication with the client. Processing equipment. An information processing device that sends and receives communication messages with clients over telecommunication lines.
Parameter generation means for generating a parameter value used for authentication when transmitting communication data to the client;
A communication data generating unit that adds the parameter value as a session ID to a URL and creates communication data in which a value corresponding to the session ID is set as a non-display ID that is not displayed on a Web browser;
Transmitting / receiving means for transmitting communication data including the session ID and the non-display ID, and receiving return communication data for the communication data;
An authentication program that acquires a session ID and a non-display ID from the return communication data and functions as an authentication unit that compares and evaluates the session ID and the non-display ID of the acquired return communication data. The communication data generation means sets a non-display ID to be set in the communication data in a hidden field,
The authentication program according to claim 9, wherein the authentication unit acquires a session ID of the return communication data from a referrer, and acquires a non-display ID from a hidden field.   The authentication program according to claim 9 or 10, wherein the communication data generation means sets the session ID and the non-display ID as the same value.   12. The authentication according to claim 9, wherein the communication data generation unit sets the session ID and / or the non-display ID to a different value for each communication with a client. program.   A computer-readable recording medium on which the authentication program according to any one of claims 9 to 12 is recorded.

Images