JP2015072527A - Information processing system, information processing device and method of controlling the same, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To solve a problem that a user is inadvertently locked out of an information processing system with a frequency of authentication procedures which the user himself/herself has really done fewer than a predetermined frequency of the authentication procedures to lock out the user.SOLUTION: An information processing device and a method of controlling the same, are provided with a lock out function for rejecting a user authentication procedure performed by the user when a frequency of failures of the user authentication exceeds a predetermined frequency. In the case of the failure in the user authentication, when a time interval between date of the last failure in user authentication and date of a current failure in user authentication is equal to or larger than a predetermined time period, the failure is counted as a frequency of failure in the user authentication. When the time interval is less than the predetermined time period, the failure is not counted as a frequency of failure in the user authentication.

Description

  The present invention relates to an information processing system, an information processing apparatus, a control method thereof, and a program.

  In a system for authenticating a user (hereinafter referred to as an authentication system), a malicious user may be attacked by repeatedly attempting authentication while guessing a user ID and password for the purpose of unauthorized use. There is a lockout function as a function for avoiding such unauthorized use. Such a lockout function limits the number of times that a malicious user searches for a password corresponding to the user ID, thereby reducing the risk of unauthorized use of the authentication system.

  However, depending on the authentication method, the user may be locked out with a number of times smaller than the number of times the user intends to perform the authentication. In this case, the user performs authentication by a server via a network using client software (hereinafter referred to as a client). Some clients perform a retry process in which, when authentication fails, the same user ID and password are transmitted again and authentication is attempted again. This is a process performed in preparation for a case where the user ID or password input by the user is not correctly transmitted due to some trouble in the network environment. This process is necessary for improving convenience by eliminating the need for the user to perform the authentication process again when the authentication fails despite the input of the correct user ID and password.

  However, since this retry process is executed even when the user inputs an incorrect password, the lockout function is activated less than the number of times the user intends to authenticate. Generally, in order to release such a lockout, it is necessary to wait for a preset time or have the server administrator release the lockout. For us, it will be inconvenient.

  In order to solve such a problem, Patent Document 1 requires waiting for a set time and release by an administrator when correct user information that is successfully authenticated is sent in the lockout state. Instead, it describes a method of automatically releasing the lockout. This is to send the one-time information to the client when the correct password is entered for the user ID and the authentication is successful, and to release the lockout when the one-time information is returned from the client to the server. It is a method. If this method is used, it is possible to reduce a decrease in convenience due to lockout.

Japanese Patent No. 4894241

  The conventional technique needs to support both the client and the server, and there is a problem that the lockout cannot be released when the client cannot handle the one-time information. In addition, the conventional technique is a means for easily releasing the lockout once it has been locked out, and is locked by a number of times less than the number of authentications the user intends to perform by the client process. The problem of going out has not been solved.

  An object of the present invention is to solve the above-mentioned problems of the prior art.

  A feature of the present invention is to provide a technique for preventing the occurrence of a situation in which lockout is performed less than the number of authentications that the user intends to perform.

In order to achieve the above object, an information processing apparatus according to an aspect of the present invention has the following arrangement. That is,
An authentication means for authenticating the user;
Lockout means for rejecting authentication by the user when the number of failed user authentications by the authentication means exceeds a predetermined number of times;
If the authentication unit fails to authenticate the user, and if the time interval between the date and time the user authentication failed immediately before and the date and time the user failed to authenticate the user is a predetermined time or more, Control means for counting the number of times that the user authentication has failed and controlling so as not to count the number of times the user has failed if the time interval is less than the predetermined time. .

  According to the present invention, there is an effect that it is possible to prevent the occurrence of a situation where lockout is performed with a number of times smaller than the number of authentications that the user intends to perform.

The block diagram explaining the hardware constitutions of the server and PC which comprise the information processing system which concerns on embodiment of this invention. The block diagram which shows schematic structure of the function relevant to control of lockout of PC and a server in the information processing system which concerns on embodiment. In the information processing system which concerns on this embodiment, the sequence diagram explaining the flow of a process when a user inputs an incorrect password and authenticates. The flowchart explaining the process performed by the lockout determination part of the server which concerns on embodiment. The figure which shows an example of the lockout table which concerns on embodiment. The figure which shows the example of the content of the authentication failure table concerning embodiment. The figure which shows an example of the setting screen which sets authentication failure tolerance time in embodiment. The figure which shows the example of the content of the protocol table which concerns on embodiment.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. The following embodiments do not limit the present invention according to the claims, and all combinations of features described in the embodiments are not necessarily essential to the solution means of the present invention. .

  FIG. 1 is a block diagram illustrating a hardware configuration of a server and a PC (client) that configure an information processing system according to an embodiment of the present invention.

  The information processing system according to the embodiment includes a personal computer (PC) 101 that is an example of an information processing apparatus, a server 108, and a network 107 that connects these to each other. Note that the devices configuring the information processing system are not limited to the configuration illustrated in FIG. 1, and a plurality of devices other than the illustrated devices may be connected to the network 107.

  In the PC 101, the network communication unit 102 communicates with an external device via the network 107. The CPU 103 executes various controls of the PC 101 by expanding the OS and programs installed in the storage device 106 in the RAM 104 and executing them. The RAM 104 temporarily stores program codes executed by the CPU 104 and various information. The storage device 106 is a storage device that stores program codes, data, and the like, and is, for example, a hard disk drive (HDD) or a memory card. The input unit 105 is an input unit that receives input from the user to the PC 101. The input unit 105 includes an operation unit and a display unit that include keys, a pointing device, and the like.

  Similarly, the configuration of the server 108 is such that the network communication unit 111 communicates with an external device via the network 107. The CPU 109 executes various controls of the server 108 by expanding the OS and programs installed in the storage device 112 in the RAM 110 and executing them. The RAM 110 temporarily stores program codes executed by the CPU 109 and various information. The storage device 112 is a storage device that stores program codes, data, and the like, and is, for example, a hard disk drive (HDD) or a memory card.

  FIG. 2 is a block diagram illustrating a schematic configuration of functions related to lockout control of the PC 101 and the server 108 in the information processing system according to the embodiment. In the present embodiment, the illustrated function is configured by software, and it is assumed that the CPU 103 of the PC 101 and the CPU 109 of the server 108 execute the software. However, these functions are realized by hardware. May be.

  Lockout records the number of times an illegal password is entered for a specific user ID. If the number exceeds a preset threshold (predetermined number), even if the correct password is entered This is a function for rejecting the user's authentication for a certain period of time.

  The SMB client unit 201 performs SMB communication with the server 108 via the network communication unit 102 and the network 107 from the PC 101. SMB is an abbreviation for Server Message Block and is a type of communication protocol used for file sharing and the like. The SMB client unit 201 communicates with the server 108 via the network communication unit 102 and the network 107 in response to a user operation using the input unit 105. The contents of this communication include negotiation of SMB communication, transmission / reception of authentication information, transmission / reception of SMB commands for performing file and folder operations, and the like.

  Next, the function of the server 108 will be described.

  The SMB authentication unit 202 authenticates a user during SMB communication. The SMB processing unit 203 processes information related to SMB communication sent from the SMB client unit 201 of the PC 101 to the network communication unit 111. The lockout determination unit 204 performs determination regarding the count of the number of failed authentications and a lockout during the authentication of SMB communication.

  FIG. 3 is a sequence diagram illustrating a processing flow when the user performs authentication by inputting an incorrect password in the information processing system according to the present embodiment. In the present embodiment, the following data will be described as being stored in the storage device 112 of the server 108. It is assumed that the IP address of the server 108 is “192.168.1.1”, “Username” is stored as the user ID, and “Pass” is stored as the password in the storage device 112 of the server 108. Further, it is assumed that the threshold for the number of authentication failures to be locked out is set to “3”, and the time until the authentication is accepted again after the lockout (hereinafter, lockout time) is set to “30 minutes”.

  The SMB client unit 201 that is activated when the user inputs with the input unit 105 on the PC 101 displays a request for input of the IP address, user ID, and password of the server 108 that is a communication destination via the input unit 105 to the user. .

  First, at 301, the user inputs an IP address “192.168.1.1.1”, a user ID “Username”, and an incorrect password “Password” to the input unit 105 to instruct the start of communication. As a result, the SMB client unit 201 stores the input content in the RAM 104. In step 302, the SMB client unit 201 negotiates via the network communication unit 102 and the network 107 with the server 108 having the IP address stored in the RAM 104 as to whether or not there is support for SMB or authentication.

  When the SMB processing unit 203 of the server 108 receives this negotiation via the network communication unit 111, the support indicating that the range supported by the SMB communication or authentication is required is sent to the network communication unit 102 of the PC 101 in 303. Send information. As a result, the network communication unit 102 of the PC 101 receives this support information, and the SMB client unit 201 stores the support information in the RAM 104.

  Next, in 304, the SMB client unit 201 determines that authentication information is necessary based on the support information. Then, the user ID “Username” and the password “Password” stored in the RAM 104 are transmitted to the network communication unit 111 of the server 108 via the network communication unit 102.

  In step 305, when the SMB processing unit 203 of the server 108 receives the user ID and password via the network communication unit 111, the SMB processing unit 203 stores the received user ID “Username” and password “Password” in the RAM 110. At this time, “SMB” is stored as the protocol used for authentication. Further, the date and time when the user ID and password are saved (hereinafter referred to as authentication date and time) is saved in the RAM 110.

  Thereafter, the SMB processing unit 203 instructs the lockout determination unit 204 to perform lockout determination. The lockout determination unit 204 notifies the SMB authentication unit 202 of the lockout determination result. If the authentication has already failed three or more times, the lockout determination unit 204 notifies the SMB authentication unit 202 of the lockout as a lockout determination result. Here, since the authentication has not failed three times or more, the lockout from the lockout determination unit 204 is not notified. The SMB authentication unit 202 determines whether or not the user ID and password matching the user ID and password received from the PC 101 and stored in the RAM 110 are stored in the storage device 112, that is, whether or not the authentication is successful. After this determination, the SMB authentication unit 202 notifies the lockout determination unit 204 and the SMB processing unit 203 of the determination result.

  In the present embodiment, since an incorrect password is input in 301, the user ID and password stored in the RAM 110 and the storage device 112 do not match, so that it is NG is notified. Processing when this NG is notified to the lockout determination unit 204 will be described later.

  When the SMB processing unit 203 is notified that the user authentication is NG from the SMB authentication part 202, the authentication result (NG) is sent to the network communication unit 102 of the PC 101 via the network communication unit 111 of the server 108 in 306. Send.

  The following processes 307 to 309 are retry processes executed by the SMB client unit 201 when the network communication unit 102 receives NG, and are the same processes as the above-described 304 to 306. Omitted. As a result of the retry processing, when the network communication unit 102 of the PC 101 receives NG, the SMB client unit 201 displays 310 as NG on the input unit 105 and notifies the user at 310.

  In the prior art, since the server cannot distinguish between the first authentication based on the data input by the user and the authentication by the retry process after the authentication failure, the number of lockout determinations is 305 and 308 in FIG. Two were counted.

  On the other hand, in the embodiment, whether the authentication is the first authentication based on the data input by the user or the authentication by the retry process by the PC after the authentication fails by the processing of 305 and 308 by the lockout determination unit 204. Count the number of authentication failures.

  Next, processing of the lockout determination unit 204 according to the present embodiment will be described with reference to FIGS.

  FIG. 4 is a flowchart illustrating processing executed by the lockout determination unit 204 of the server 108 according to the embodiment. Note that the flowchart of FIG. 4 is achieved by the CPU 109 executing a program loaded in the RAM 110.

  5A to 5C store data on the number of authentication failures and the date and time of failure of final authentication, which are stored in the storage device 112 by the lockout determination unit 204 of the server 108 according to the embodiment. It is a figure which shows an example of the lockout table to be performed.

  FIG. 5A shows the content of the lockout table when the user ID “Username” has already failed authentication once and the user ID “shimizu” has failed authentication three times.

  Here, as described with reference to FIG. 3, when the user ID “Username” and the password “Password” are input on the PC 101, the lockout table is in the state shown in FIG. In the process 304 in FIG. 3, the process executed in 305 when the authentication date and time saved in the RAM 110 is “2012/1/1 14:30:01” will be described.

  When receiving the lockout determination instruction from the SMB processing unit 203, the lockout determination unit 204 proceeds to S401. In S401, the lockout determination unit 204 determines whether the number of user ID authentication failures stored in the RAM 110 exceeds the threshold (“3”) (a predetermined number of times or more) based on the lockout table of FIG. Determine whether or not. The lockout determination unit 204 exceeds the threshold value “3” stored in the storage device 112 because the number of authentication failures of the user ID “Username” stored in the RAM 110 is “1” from FIG. If it is not determined, the process proceeds to S405. On the other hand, if the number of authentication failures exceeds the threshold, the process proceeds to S402.

  In S402, the lockout determination unit 204 determines whether or not it is within the lockout time stored in the storage device 112 based on the authentication date and time stored in the RAM 110 and the last authentication failure date and time stored in the lockout table. judge. The lockout time is a time during which the lockout determination unit 204 determines that the authentication should be locked out and turns on the lockout function. Accordingly, within this time, even if correct user authentication information is input, the SMB authentication unit 202 does not authenticate the user. Therefore, if it is determined in S402 that it is within the lockout time, the process proceeds to S403, and the lockout determination unit 204 notifies the SMB authentication unit 202 that the authentication is locked out. This process ends. Here, the processing after the SMB authentication unit 202 receives the lockout notification from the lockout determination unit 204 is the same as described in 306 of FIG. 3, the network communication unit 102 of the PC 101 via the network communication unit 111 of the server 108. To NG.

  On the other hand, if the lockout determination unit 204 determines in S402 that it is outside the lockout time, the process proceeds to S404. In S <b> 404, the lockout determination unit 204 sets the number of user ID authentication failures in the lockout table that match the user ID stored in the RAM 110 to “0”, and proceeds to S <b> 405. In S405, the lockout determination unit 204 instructs the SMB authentication unit 202 to authenticate the user. In step S406, the lockout determination unit 204 determines whether the user authentication has failed based on the notification from the SMB authentication unit 202. Here, as described in 304 and 305 in FIG. 3, if it is determined that the user authentication has failed, the process proceeds to S407. On the other hand, if it is determined in S406 that the user authentication is successful, the process proceeds to S413. In S413, the lockout determination unit 204 sets the number of authentication failures of the user ID in the lockout table (FIG. 5) that matches the user ID stored in the RAM 110 to “0”, and ends this process.

  If the user authentication fails in S406, the process proceeds to S407, and the lockout determination unit 204 stores the user ID and password that are stored in the RAM 110 and are the same as the user ID and password that have failed in authentication, in the authentication failure table. It is determined whether or not. If it is determined in S407 that it is not stored in the authentication failure table (FIG. 6), the process proceeds to S412 and the lockout determination unit 204 authenticates the user ID and password that failed in authentication and the authentication failure date and time stored in the RAM 110. Register in the failure table and proceed to S410.

  On the other hand, if the user ID and password identical to the user ID and password that failed authentication are stored in the authentication failure table in S407, the process of the lockout determination unit 204 transitions to S408.

  FIG. 6 shows an example of the contents of an authentication failure table that is schematically stored in the storage device 112 of the server 108 according to the embodiment, and represents the data for the authentication failure for each user ID and the data of the last authentication failure date and time. FIG.

  For example, in FIG. 6A, the password “321” is input with the user ID “Username”, and it is registered that the date and time of the last authentication failure is “2012/1/1 9:30:00”. ing. In the processing of 305 in FIG. 3, description will be made assuming that the authentication failure table shown in FIG. 6A is stored in the storage device 112 of the server 108. In the process of 305 in FIG. 3, the lockout determination unit 204 stores the user ID “Username” and password “Password” stored in the RAM 110 and the authentication failure table stored in the storage device 112 (FIG. 6A). And compare. In this case, since the set of the user ID “Username” and the password “Password” is not stored, it is determined that they are not stored in the authentication failure table, and the process proceeds from S407 to S412. In S412, the lockout determination unit 204 stores the user ID, password, and authentication date / time stored in the RAM 110 in the authentication failure table of the storage device 112, and proceeds to S410. By the process of S412, the authentication failure table in FIG. 6A is updated to an authentication failure table as shown in FIG. 6B. Therefore, in the process of 308 in FIG. 3, the authentication failure table shown in FIG. 6B is used.

  On the other hand, if the lockout determination unit 204 determines in S407 that the same user ID and password as those in the RAM 110 are stored in the authentication failure table, the process proceeds to S408. In step S <b> 408, the lockout determination unit 204 determines the authentication date / time of the user ID and password stored in the RAM 110 and the last authentication failure date / time of the row that matches the user ID / password stored in the authentication failure table of the storage device 112. And compare. That is, the time interval between the previous user authentication based on the user ID and the current user authentication based on the user ID is obtained. As a result, when the time interval from the last authentication failure date and time to the user ID and password authentication date and time stored in the RAM 110 exceeds the preset authentication failure allowable time, a predetermined time or more has passed. judge. In this case, it is determined that the retry is not performed by the PC 101, and the process of the lockout determination unit 204 transitions to S409. That is, in S409, the lockout determination unit 204 updates the last authentication failure date and time in the lockout table that matches the user ID stored in the RAM 110. In step S410, the lockout determination unit 204 adds 1 to the number of authentication failures of the user ID in the lockout table that matches the user ID stored in the RAM 110. Then, this process ends.

  On the other hand, if it is determined in S408 that the predetermined time has not elapsed (less than the predetermined time), it is determined that the automatic retry is performed by the PC 101, and the process proceeds to S411. In this case, the date and time of the corresponding authentication failure is updated, but this processing is terminated without counting as the number of authentication failures.

  FIG. 7 is a diagram illustrating an example of a setting screen for setting the allowable authentication failure time in the embodiment.

  FIG. 7 shows an example in which 2 seconds is set as the authentication failure allowable time. In this case, if authentication of a user using the same user ID and password is entered again within 2 seconds after the previous authentication failure, the authentication failure is not counted as the number of authentication failures. Yes. In FIG. 7, a desired authentication failure allowable time can be set by inputting a desired time (second) in the time setting field 701 and instructing an “OK” button 702. The authentication failure allowable time set in this way is stored in the storage device 112. Note that the allowable authentication failure time is a time used to identify an authentication failure by the user and an authentication failure by the retry processing by the PC 101. For this reason, if it is not set appropriately, it is necessary to be careful because it will allow an unlimited number of authentication retries by malicious users.

  In this way, the authentication allowable time from the previous user authentication failure to the next user authentication until the authentication failure is set, and if it is within the authentication allowable time, it is counted as an authentication failure. By not doing so, it is possible to avoid counting of authentication retry errors by the PC. In general, when a user manually performs authentication retry, the retry time interval requires at least several seconds. On the other hand, in the automatic authentication retry by the computer, it seems that the retry time interval does not exceed 1 second. Therefore, by setting the time interval on the screen as shown in FIG. 7, it is possible to distinguish between a manual authentication retry by the user and an authentication retry by the PC.

  FIG. 8 is a diagram showing an example of the contents of a predefined protocol table when counting the number of authentication failures for each authentication protocol in S410 of FIG.

  In FIG. 8, when authentication by “SMB” fails, “1” is added as the number of authentication failures in the process of S410. On the other hand, when authentication fails due to “Local”, “0.5” is added as the number of authentication failures in the process of S410. “Local” indicates authentication to the server 108 using an input unit (not shown) of the server 108. In the process of 305 in FIG. 3, “1” is acquired from the authentication protocol “SMB” stored in the RAM 110 as the number to which the number of authentication failures is added, and as shown in FIGS. 5A to 5B, The lockout table stored in the storage device 112 is updated. In FIG. 5B, authentication failed with the same user ID 10 minutes after the failure of authentication with “2012/1/1 14:20” with the user ID “Username” last time (more than 2 seconds). doing. Therefore, in this case, the last authentication failure time corresponding to the user ID “Username” is “2012/1/1 14:30”, and the number of authentication failures is updated to “3”.

  In S411 of FIG. 4, the lockout determination unit 204 updates the last authentication failure date and time of the line that matches the user ID and password stored in the RAM 110 in the authentication failure table of FIG. To do. Here, since the user ID “Username” and the password “Password” are input as described with reference to FIG. 3, the user ID “Username”, the password “Password”, and the last authentication failure date and time as shown in FIG. Is added to the authentication failure table.

  For example, assuming that the authentication date and time stored in the RAM 110 of the server 108 is “2012/1/1 14:30:01” in the process 307 of FIG. 3, the process executed in 308 of FIG. explain. At this time, it is assumed that the lockout table to be used is updated by the processing of 305 in FIG. 3 and is as shown in FIG. The authentication failure table at this time is shown in FIG. The processing in S401 and S405 in FIG. 4 in 308 in FIG. 3 is the same as that in 305 in FIG.

  In S407 of FIG. 4, the lockout determination unit 204 determines that the same user ID and password are already stored because the user ID and password stored in the RAM 110 are stored in the lockout table of FIG. Then, the process proceeds to S408. In S <b> 408, the lockout determination unit 204 obtains the last authentication failure date “2012/1/1 14:30: 00” from the authentication failure table of FIG. 6B using the user ID and password stored in the RAM 110. To do. Next, the lockout determination unit 204 determines that the current authentication date / time is “2012/1/1 14:30:02” from the authentication failure allowable time “2” (seconds) acquired from the storage device 112 and the last authentication failure date / time. If it is before, it is determined in S408 that the predetermined time has not elapsed. Here, since the authentication date and time stored in the RAM 110 is “2012/1/1 14:30:01”, the lockout determination unit 204 determines that the predetermined time has not elapsed and shifts to S411. In S411, the lockout determination unit 204 sets the last authentication failure date and time of the row of the authentication failure table that matches the user ID “Username” and the password “Password” stored in the RAM 110 to “2012/1/1 14:30:01”. Update to In the process of S411, the authentication failure table is updated as shown in FIGS. 6B to 6C. In this case, the lockout table shown in FIG. 5B is updated as shown in FIG. That is, the last authentication failure date and time of the user ID “Username” is updated to “2012/1/1 14:31”, but the number of authentication failures remains “2” as in FIG. 5B.

  As described above, according to the present embodiment, authentication failures due to the same user ID and the same password within a certain time are not counted as the number of lockout authentication failures. Thereby, the authentication failure by the retry process performed by the client PC can be distinguished from the number of authentication failures by the user authentication process. In this way, since the number of times the user actually failed to authenticate the user and the number of times counted for lockout match, it is possible to prevent the user from unexpected lockout.

  In addition, when counting the number of authentication failures by the user, it is checked whether the password entered by the user matches, so that the security against attacks that search for the password carried by the lockout function is reduced without reducing the convenience. Can be improved.

  In addition, if the device has a plurality of authentication means and attempts to perform lockout using the conventional technique, it is necessary to appropriately set the number of authentication failures to be locked out for each authentication means. There was a problem that it took time to set up. If the number of authentication failures until the lockout is made the same between the authentication means that performs the retry process and the authentication means that does not perform the retry process, only the former authentication means is immediately locked out, which increases the convenience of the user. It is because it is damaged.

  On the other hand, in the embodiment, since the number of authentication failures in the retry process is not counted, the number of authentication failures until the lockout can be set to the same regardless of the authentication means, so that the setting time of the administrator is reduced. can do.

  In the present embodiment, the SMB is used as an example of a protocol for performing authentication via a network, but other protocols may be used.

  In the embodiment, the case where authentication is performed via a network between different devices such as a server and a client PC has been described. However, a configuration in which authentication is performed by a single device may be used.

  In the embodiment, the lockout table in FIG. 5 and the authentication failure table in FIG. 6 have been described as separate, but may be managed by a single DB or the like.

  In the embodiment, the example in which the addition number of the number of authentication failures is changed according to the authentication protocol using the protocol table as shown in FIG. 8 is described. However, the same addition value is set for all the authentication protocols. Also good.

  As described above, according to the present embodiment, it is possible to prevent a user's unexpected lockout due to processing of the client only by handling the server without performing any special handling at the client.

  In addition, the number of authentication failures due to retry processing performed by the client is not counted as the number of remaining determinations as to whether or not to execute the lockout function. For this reason, the number of authentication failures until lockout coincides with the number of authentication failures performed by the user, and lockout unexpected by the user can be prevented.

  In addition, when counting the number of authentication failures by the user, the security against attacks that search for the password intended by the lockout function is maintained in order to check the number of failures by the combination of the user ID of the user and the password entered by the user. it can.

(Other embodiments)
The present invention can also be realized by executing the following processing. That is, software (program) that realizes the functions of the above-described embodiments is supplied to a system or apparatus via a network or various storage media, and a computer (or CPU, MPU, etc.) of the system or apparatus reads the program. It is a process to be executed.

Claims (10)

An authentication means for authenticating the user;
Lockout means for rejecting authentication by the user when the number of failed user authentications by the authentication means exceeds a predetermined number of times;
If the authentication unit fails to authenticate the user, and if the time interval between the date and time the user authentication failed immediately before and the date and time the user failed to authenticate the user is a predetermined time or more, Control means for counting as the number of times the user authentication has failed, and so as not to count as the number of times the user authentication has failed if the time interval is less than the predetermined time;
An information processing apparatus comprising:   The information processing apparatus according to claim 1, further comprising setting means for allowing the user to set the predetermined time. Further comprising a counting means for counting the number of times the user authentication failed by the authentication means,
2. The counting means counts the number of times the user authentication has failed in association with a set of user ID and password input to authenticate the user by the authentication means. Or the information processing apparatus of 2.   The information processing apparatus according to claim 1, wherein the predetermined time is a time interval in which authentication retry by an operation of a user and authentication retry automatically executed by a computer can be identified.   The information processing apparatus according to claim 3, further comprising a plurality of authentication units, wherein the counting unit counts the number of times the user authentication corresponding to each of the plurality of authentication units has failed.   6. The storage device according to claim 1, wherein the control unit includes a storage unit that stores the date and time when the authentication unit fails to authenticate the user in association with the input user ID and password pair. The information processing apparatus according to item 1. An information processing system including a server and a client,
The server
Authentication means for authenticating a user in accordance with authentication information from the client;
Notification means for notifying the client of an authentication result by the authentication means;
Lockout means for rejecting authentication by the user when the number of failed user authentications by the authentication means exceeds a predetermined number of times;
If the authentication unit fails to authenticate the user, and if the time interval between the date and time the user authentication failed immediately before and the date and time the user failed to authenticate the user is a predetermined time or more, A control unit that counts as the number of times that the user authentication has failed, and controls so as not to count as the number of times that the user authentication has failed if the time interval is less than the predetermined time;
The client
An information processing system comprising: a retry unit that transmits the authentication information to the server when the authentication result notified by the notification unit is NG.   The information processing system according to claim 7, wherein the control unit changes an addition value when counting the number of times the user authentication has failed according to an authentication protocol with the client. A control method for controlling an information processing apparatus,
An authentication step in which the authentication means authenticates the user;
When the number of times that the lockout means fails to authenticate the user in the authentication step is a predetermined number or more, a lockout step of rejecting authentication by the user,
When the control unit fails to authenticate the user by the authentication step, the time interval between the date and time when the user authentication failed immediately before and the date and time when the user authentication failed by the authentication step is a predetermined time or more. If so, a control step of counting as the number of times the user authentication has failed, and controlling so as not to count as the number of times the user authentication has failed if the time interval is less than the predetermined time;
A method for controlling an information processing apparatus, comprising:   The program for functioning a computer as an information processing apparatus of any one of Claims 1 thru | or 6.

Images