Apparatus, method, and program for validating user

• US 9,021,555 B2
• Filed: 11/16/2012
• Issued: 04/28/2015
• Est. Priority Date: 03/29/2006
• Status: Active Grant

• Current Assignee: Takaya Kato
• Original Assignee: Bank of Tokyo-Mitsubishi UFJ Limited (Mitsubishi UFJ Financial Group Incorporated)
• Inventors: Kato, Takaya
• Primary Examiner(s): WANG, HARRIS C
• Application Number:
  US13/679,401
• Publication Number:
  US 20130081107A1
• Time in Patent Office: 893 Days
• Field of Search: 726/3
• US Class Current: 726/3
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

User validation accuracy is improved without inconveniencing a user. When an authentication request packet is received from a terminal and the authentication is successful based on a user ID and a password, an HTTP header, user-agent information, and access source IP address are extracted from the packet, and user authentication is performed by verifying the IP address and the user-agent information against usage history information where at most two sets of the IP address and the user-agent information extracted from the authentication request packet which is received from the same user previously are registered. When the set of the IP address and the UA information corresponding to the new extracted IP address and the new extracted UA information is registered in the usage history information, the authentication is successful, and the usage history information is overwritten with the new IP address and the new UA information.

Claims

1. A user validation apparatus comprising:

a memory configured to store instructions; and

a controller that is configured to execute the instructions to;

extract user-agent information about an individual user and a user access source IP address in a hyper-text transfer (HTTP) header of a packet received from a terminal device, which is operated by the individual user, by applying HTTP as a protocol of an application layer;

verify;

(i) whether or not the extracted user-agent information corresponds to each user-agent information in two sets of user-agent information stored in a storage unit, and (ii) whether or not the extracted IP address corresponds to each IP address in two access source IP addresses stored in the storage unit;

determine the user is a valid user, based at least in part on the verification result when;

(a) the extracted user-agent information corresponds to each of the two sets of user-agent information and the extracted access source IP address corresponds to any of the two sets of access source IP addresses, or (b) the extracted access source IP address corresponds to each of the two access source IP addresses and the extracted user-agent information corresponds to any of the two sets of user-agent information;

determine the user is an invalid user, based at least in part on the verification result, when;

(a) the extracted user-agent information does not correspond to any of the two sets of user-agent information and the extracted access source IP address does not correspond to each of the two access source IP addresses, or (b) the extracted source IP address does not correspond to any of the two access source IP addresses and the extracted user-agent information does not correspond to each of the two sets of user-agent information;

determine the individual user is a conditionally valid user, based at least in part on the verification result, when the extracted user-agent information corresponds to each set of the two sets of user-agent information, and the extracted user IP address does not correspond to either of the stored sets of IP addresses; and

when the individual user is a conditionally valid user, request re-authentication to the individual user operating the terminal device.

2. The user validation apparatus of claim 1, wherein

the controller is further configured to execute the instructions to:

extract an access source internet protocol (IP) address from the HTTP header; and

verify whether or not the extracted access source IP address corresponds to two access source IP addresses stored in the storage unit; and

the determination includes determining that the individual user is a conditionally valid user when the extracted access source IP address corresponds to each of the two access source IP addresses and the extracted user-agent information does not correspond to any of the two sets of user-agent information.

3. The user validation apparatus of claim 1, wherein the user-agent information comprises at least one of:

a version of the operating system (OS) of the terminal device, a browser of the terminal device, a number of patches of the browser of the OS and a number of updates of the browser.