System and method for providing user with services
Improper communication using modified software is inhibited without checking game data itself. A system according to one embodiment realizes provision of an online game to a login user with HTTP communication between the server and the client terminal. The HTTP communication includes transmitting, by a terminal device, a HTTP request to which signature information generated based on the HTTP request and terminal-side key information is attached; checking, by the server, validity of the HTTP request based on comparison between the signature information attached to the HTTP request and signature information generated based on the HTTP request and the server-side key information of the login user; updating, by the server, the key information based on the HTTP request and the server-side key information; transmitting, by the server, a HTTP response; and updating, by the terminal device, the key information based on the HTTP request and the terminal-side key information.
1. A system for providing a predetermined service to a user through a predetermined program executed on a client terminal, comprising:
a server; and
a client terminal communicatively coupled to the server,
wherein the system realizes provision of the predetermined service to a login user who is logged in to the server through the predetermined program with predetermined communication between the server and the client terminal,
the client terminal includes a terminal-side storage storing key information in a dedicated region of the predetermined program,
the server includes a server-side storage storing the key information of each user,
wherein the predetermined communication includes:
generating, by the client terminal, signature information according to a predetermined generation rule and based on a request to be sent to the server and the key information stored in the terminal-side storage, and transmitting, to the server, the request to which the generated signature information is attached;
generating, by the server, in response to the request from the client terminal, signature information according to the predetermined generation rule and based on the request and the key information of the login user stored in the server-side storage, and checking validity of the request based on comparison between the generated signature information and the signature information attached to the request;
updating, by the server, the key information of the login user according to a predetermined update rule and based on the request and the key information of the login user stored in the server-side storage;
transmitting, by the server, a response to the request to the client terminal; and
updating, by the client terminal, in response to the response from the server to the request, the key information stored in the terminal-side storage according to the predetermined update rule and based on the request and the key information.
2. The system of claim 1 , wherein the server-side storage stores, as the key information of each user, first key information which is current key information, and second key information which is previous key information before updated to the current key information, and
the checking validity includes checking validity of the request based on comparison between the signature information attached to the request and first signature information generated based on the request and the first key information of the login user, and based on comparison between the signature information attached to the request and second signature information generated based on the request and the second key information of the login user.
3. The system of claim 1 , wherein the predetermined update rule is a rule to update the key information such that the signature information generated according to the predetermined generation rule is set as newly updated key information.
4. The system of claim 1 , wherein
the predetermined communication is communication in accordance with HTTP,
the request is a HTTP request, and
the response is a HTTP response.
5. The system of claim 1 , wherein the dedicated region of the predetermined program in the terminal-side storage is a non-volatile region.
6. The system of claim 1 , wherein the dedicated region of the predetermined program in the terminal-side storage is a region where access by programs other than the predetermined program is restricted.
7. The system of claim 1 , wherein the predetermined rule is a rule according to HMAC.
8. A method of providing a predetermined service to a user through a predetermined program executed on a client terminal communicatively coupled to a server, wherein
the method realizes provision of the predetermined service to a login user who is logged in to the server through the predetermined program with a predetermined communication between the server and the client terminal,
the client terminal includes a terminal-side storage storing key information in a dedicated region of the predetermined program,
the server includes a server-side storage storing the key information of each user,
wherein the predetermined communication includes:
generating, by the client terminal, signature information according to a predetermined generation rule and based on a request to be sent to the server and the key information stored in the terminal-side storage, and transmitting, to the server, the request to which the generated signature information is attached;
generating, by the server, in response to the request from the client terminal, signature information according to the predetermined generation rule and based on the request and the key information of the login user stored in the server-side storage, and checking validity of the request based on comparison between the generated signature information and the signature information attached to the request;
updating, by the server, the key information according to a predetermined update rule and based on the request and the key information of the login user stored in the server-side storage;
transmitting, by the server, a response to the request to the client terminal; and
updating, by the client terminal, in response to the response to the request from the server, the key information stored in the terminal-side storage according to the predetermined update rule and based on the request and the key information.