An object is to reduce the loads on resources and to flexibly handle increase in access. An access control apparatus 1a includes: session data 21a in which an identifier of a user terminal, session information, and an update time are associated with each other; update means 12 for, upon receipt of an update request, storing updated [0]session information into the session data 21a in association with an update time, and broadcasting, to the other access control apparatuses, an synchronous update request that requests update of the session information of the identifier of the update-target user terminal; and synchronous update means 11 for, upon receipt of the synchronous update request from another access control apparatus, updating the session data 21a on the basis of the synchronous update request in association with the update time.