Apparatus, method, and program for validating user

Abstract

User validation accuracy is improved without inconveniencing a user. When an authentication request packet is received from a terminal and the authentication is successful based on a user ID and a password, an HTTP header, user-agent information, and access source IP address are extracted from the packet, and user authentication is performed by verifying the IP address and the user-agent information against usage history information where at most two sets of the IP address and the user-agent information extracted from the authentication request packet which is received from the same user previously are registered. When the set of the IP address and the UA information corresponding to the new extracted IP address and the new extracted UA information is registered in the usage history information, the authentication is successful, and the usage history information is overwritten with the new IP address and the new UA information.

1 . A user validation apparatus comprising:
 an extraction unit configured to extract user-agent information set in an HTTP header of a packet received from a terminal device by applying HTTP as a protocol of an application layer;   an information management unit configured to store a plurality of sets of user-agent information extracted by the extraction unit from a packet received from the terminal device, which is operated by an individual user, in a storage unit so as to correspond to user identification information of the individual user; and   a determination unit configured to determine whether or not a user operating a given terminal device is a valid user by verifying user-agent information extracted by the extraction unit from a packet received from the given terminal device, against a plurality of sets of user-agent information stored in the storage unit so as to correspond to user identification information of the user operating the given terminal device.