JP2002007346A - Communication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a system provided with an integrated server for controlling communications between each of plural Web servers and a browser. SOLUTION: This system is provided with the integrated server for controlling the communications between each of plural Web servers and the browser and an authentication server having the identification information and access right information of a user having a right to access at least one of files provided in the plural Web servers, and the integrated server has a dynamic menu preparing function for acquiring the access right information of the user by communicating with the authentication server corresponding to an access request from the user, preparing a menu page, which contains menu items, corresponding to the access right and returning it to the user. The menu items are constituted to designate the plural Web servers as low-order files of the integrated server, for example, and corresponding to one of menu items selected by the user, the integrated server accesses the server corresponding to the menu item and returns the file to the user.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention
It relates to user authentication and access control in a system.

[0002]

2. Description of the Related Art Generally, in a network system, user authentication is realized on a server basis. When a plurality of servers are provided for business, user registration and setting of access authority are performed for each server. In this method, it is not clear from the user's perspective what access authority he has on what server,
In some cases, an attempt was made to access by inputting D and a password, and it was found that the user was denied access and did not have access authority. Further, there is a problem that the user ID and the password are required to be input for each server and the usability is poor.

[0003] Japanese Patent Application Laid-Open No. 10-269184 describes a system in which an integrated authentication server checks a user's access authority to a DB server and a business server using a certificate.

[0004] In Japanese Patent Application Laid-Open No. H11-25048, an integrated authentication server checks an access right with respect to an integrated certificate sent from a client, and if valid, sends a certificate to a communication party. Establishing communication is described.

[0005]

The technology described in these publications integrates user authentication for a plurality of servers, but does not present a list of user access rights to the user. Therefore, when the access authority is set in a complicated manner, the user has to memorize the range of the access authority set to himself, which includes a problem that the user needs to refer to the memo at every access. I have.

Further, in the publications described above, after the authentication is performed by the authentication server, the communication between the client and the business server is directly performed, so that a plurality of business servers are required depending on the type of business. When used, there is a problem that the user is confused about which business server to access.

[0007]

In order to solve the above problems, a communication system according to the present invention includes an integrated server for controlling communication between a plurality of web servers and a browser, and a file provided in the plurality of web servers. An authentication server having identification information of a user who has authority to access at least one of the above, and access authority information, wherein the integrated server communicates with the authentication server in response to an access request from the user, and obtains access authority information of the user. And a dynamic menu creation function that creates a menu page including a menu item corresponding to the access right and returns it to the user.

According to one aspect of the present invention, the menu item is configured to designate a plurality of web servers as lower files of the integrated server, and the integrated server is selected in response to the user selecting one of the menu items. Accesses the server corresponding to the menu item and returns the specified file to the user.

[0009] In this manner, a user's access request to a plurality of web servers is made via the integrated server, and the user's terminal device, typically a browser, is directly connected to the web server. Since a plurality of web servers are hidden from the user, unauthorized access can be made difficult. Also, do not change the web server itself,
The invention can be implemented in a form in which an integrated server is added.

According to still another aspect of the present invention, when returning the file read from the web server to the user, the integrated server converts the URL of this file into a URL as a lower-level file of the integrated server, and converts the converted URL. To the user. Therefore, the user appears to be communicating with the integrated server alone, and the plurality of web servers are invisible to the user.

[0011]

Embodiments of the present invention will now be described with reference to the drawings. FIG. 1 is a block diagram showing an overall configuration of a computer network according to an embodiment of the present invention.

The browsers 11 and 12 are realized by browsing software typically incorporated in a personal computer, for example, Netscape (trademark) or Internet Explorer (trademark).
13 or connected to the integration server 14 via the intranet via the Internet protocol. Communication between the browser and the integrated server 14 is performed using the SSL encryption function.

The integrated server 14 has an authentication function 14B for sending an authentication cookie or a user ID and a password transmitted from a browser to the authentication server 15 and authenticating the access authority of the user.

A transaction database server 16, an information providing server 17, and a host connection server 18 are connected to the network as a plurality of web servers. For example, in the insurance business, the transaction database server 16
Is a web server for the agency-related transaction data database 16A. The information providing server 17 is a web server for providing information such as manuals and new products to agents and employees. The host connection server 18 is a web server for connecting to the contract management system 18A.

These web servers are browsers 11 and 12
What was designed so that it can be directly accessed from is used in accordance with the present invention. As described below, according to the embodiment of the present invention, the browser 1
1 and 12 do not have direct access to these servers. However, when implementing the present invention in an application field in which there is no need to worry about security issues, in addition to the functions provided by the present invention, the servers 16, 17, and 18 can be directly transmitted from the browsers 11 and 12 as before. Can be accessible.

The integrated server 14 is apparently the web server 1
Treats 6, 17, and 18 as trees below their own. That is, an access request for a specific file from the browser, for example, an access request for a specific file included in the contract management system 18A is transmitted in the form of an access request for a file of the integrated server 14. Integrated server
When receiving the access request, the server 14 converts the URL included in the access request into the URL of the host connection server 18, accesses the contract management system 18A, and extracts the requested file. This function is reverse proxy function 14C
Call.

The file thus taken out is converted into the URL of the integrated server 14 and returned to the browser. Figure 1
The URL conversion 14E indicates this function.

The forwarding function 14A of the integrated server 14
Is a function for communicating with the browsers 11 and 12 via the Internet 13. When the access from the browser 11 is authenticated by the authentication server 15 and is determined to be normal,
The menu creation function 14C reads out the menu items corresponding to the access authority of the user accessing from the browser 11, and embeds the menu items in the menu stencil to create a menu page as an html document. Thus, the menu page is dynamically created according to the access authority of the user accessing the system. The created menu page is
Sent to the browser 11 by the forwarding function 14A.

Thus, the user is presented with a menu of only the items to which he has access authority. A hyperlink to the integrated server 14 is provided on the menu, and when the user clicks on an item desired to be accessed, an access request is transmitted to the integrated server 14.

User Authentication Next, a user authentication process will be described with reference to FIG.
Browser 11 is integrated server 14 according to http protocol.
When the access request is sent to the server (101), the integrated server 14, more specifically, the forwarding function 14A in FIG. 1 receives the request and checks the presence or absence of the authentication cookie (10).
2). Cookies are small files used in the http protocol, and are sent to the browser by filling arbitrary information from a script on the server side. The authentication cookie in this embodiment is set in block 123 and sent to the browser 11 when authentication is successful, as described later.

If there is no authentication cookie, the integrated server 14 reads the html file of the login page and sends it to the browser (104). When the user inputs a user ID and a password on the login page displayed on the browser 11 and transmits the same, the integrated server 14 creates a user authentication message using the transmitted information and sends the message to the authentication server 15 (10
6). In response, the authentication server 15 checks the consistency between the user ID and user password stored in the storage device 15A and the transmitted user ID and user password (107). A response message is returned to the integration server (108). In response, the integration server 14 generates a login error page and sends it to the browser 11. If the cause of the NG is that the password has expired, the integrated server 14 displays the password change page in the browser.
Send to 11 (109).

The login error page or the password change page is displayed on the browser 11 (110), and the user can try again to log in or change the password.

Returning to block 107, user authentication is OK.
In the case of (1), the authentication server 15 creates an authentication cookie containing data indicating that the authentication is OK (121), and sends it together with the OK message to the integrated server 14 (122). Integrated server 1
4 sets an authentication cookie, moves to the access control process of FIG. 3, and sends the authentication cookie to the browser 11 (12
3). The browser 11 stores the authentication cookie as information unique to the user, and transmits the authentication cookie to the integrated server 14 when accessing the integrated server 14 next time. Returning to block 102,
The integrated server 14 authenticates the access request from the browser
If okie is on, move on to the access control process of FIG.

The authentication server holds the user ID of the user connected to the integrated server 14, monitors the service selection status from connection to disconnection, and records the log (log). Also,
The authentication server 15 is configured on the premise of non-stop,
New users can be registered and deleted while the system is running.

Referring to reverse proxy Figure 3, the user sends a request to access any page from the browser 11 to the integrated server http protocol (201), integration server authentication Cookie to the request
It checks whether or not it is attached, and if it is, performs reverse proxy processing (211). If the authentication cookie is not attached, the processing shifts to the authentication sequence starting from block 104 in FIG.

As described above, the integrated server communicates with the browser in the form of the content file of the web server 20 as a file in a lower directory of the integrated server. For this purpose, the integrated server is provided with a conversion table or conversion program for converting the address of the content of the web server 20 based on the http protocol and the apparent address of the content in the integrated server 14.

For example, it is assumed that the URL of the page of the sales material X provided by the information providing server 17 (FIG. 1) which is one of the web servers 20 is as follows. http://www.joho.abc.com/eigyo/shiryo_x.html (1)

The integrated server 14 treats this page as a file in its own lower directory, and the browser 11 requests access to this page with the following URL. http://www.togo.abc.com/joho/eigyo/shiryo_x.html (2)

When the integrated server 14 receives the access request for the URL (2), the integrated server 14 converts the URL into the form (1) and accesses the web server 20. This processing is called reverse proxy processing (211). In this way, the user sends a request to the integrated server to access a lower file of the integrated server, and in response, the integrated server reads the corresponding file from one of the web servers and returns it to the browser. Therefore, the URL of the html document of the web server is shielded from the browser, and the user cannot directly access the web server. As a result, the security of the information stored in the web server is improved.

The access control integration server 14 performs a reverse proxy process and sends an access request message to the authentication server 15 (204). In response to this, the authentication server 15 checks the authentication cookie. If the authentication cookie is valid, the authentication server 15 checks whether or not this user has the access right to the requested file by referring to the access right table (206). When it is confirmed that this user has the access right, the authentication server 15
An OK message is sent to the integration server 14 (207). The access authority table is described as, for example, the following config information.

[0031]

[Table 1] Config1 (URL information) URL01, grp01 URL02, grp02 URL03, grp01, grp02 URL04, grp02, grp03 Cinfig2 (user and group information) grp01, UID = A1 * grp01, UID = A2001 grp01, UID = A3009 grp02, DESCRIPTION = * 0101 grp03, DESCRIPTION = * 1010

Here, "*" means that an arbitrary number of arbitrary characters may be present at this position by a wild card. The UID is a user ID, and the DESCRIPTION is a code representing a user attribute other than the user ID, such as a manager code, a professional code, and a department code in a company. When the Config expression of Table 1 is displayed as a table, it becomes as shown in Table 2 below.

[0033]

[Table 2]

In Table 2, B0101 and C0101 are attribute codes corresponding to DESCRIPTION = * 0101.
It is assumed that C1010 is an attribute code corresponding to ION = * 1010. As described above, the access authority can be set for each URL document and each group.

Upon receiving the OK message from the authentication server 15, the integration server 14 creates an http request header (220), and converts the URL in (1) converted by the above-described reverse proxy processing.
To access. Thus, the content is sent from the web server 20, in this example, the information providing server 17, to the integrated server (221). The integration server 14 sends the U
The RL is converted into a URL ((1) above) in the form of a file in a lower directory of the integrated server 14 (222), and the browser 11
(223). The requested content is displayed on the browser 11 (224).

If the authentication cookie is invalid or expired in block 205, the authentication server 15 sends an NG message to the integration server 14 (208), and the integration server 14
A re-login page or an error page is sent to the browser 11 according to the reason of G (209). In this way, a re-login page or an error page is displayed on the browser 11 (21
0), the user can retry the login or correct the error.

The process of confirming the access right from the integrated server to the authentication server uses the standard LDAP protocol, but it goes without saying that other protocols can be used.

Dynamic Menu (Dynamic Menu) Next, generation of a dynamic menu (dynamic menu) will be described with reference to FIG. When a user requests a dynamic menu from the browser 11 to the integrated server 14 (301),
The integrated server 14 checks whether the request has an authentication cookie (302), and if not, returns a login error page to the browser 11 (303), and proceeds from login to the authentication sequence (FIG. 2). If the authentication cookie is attached to the request for the dynamic menu, the integrated server 14 sends a menu request message to the authentication server 15 (304).
In response, the authentication server 15 checks the access right (305) and returns a response message indicating the access right of the user to the integrated server 14 (305).

In response, the integration server 14 reads the menu template and embeds the menu item corresponding to the access authority of this user specified in the response message from the authentication server 15 in the menu template (30).
9). The dynamic menu page thus generated is sent to the browser 11, and the dynamic menu is displayed on the browser 11. A hyperlink is generated for the menu item of this dynamic menu, and when the user clicks the menu item, a request for access to the corresponding page is sent from the browser 11 to the integrated server 14, and FIG.
Enters the access control sequence described in connection with.

Although the present invention has been described with reference to specific embodiments, the present invention is not limited to such embodiments.

[Brief description of the drawings]

FIG. 1 is a block diagram showing the overall configuration of a network system according to an embodiment of the present invention.

FIG. 2 is a flowchart illustrating a user authentication process.

FIG. 3 is a flowchart showing a process of access control.

FIG. 4 is a flowchart showing a dynamic menu generation process.

[Explanation of symbols]

 11, 12 Browser 14 Integrated server 15 Authentication server 16, 17, 18 Web server

 ──────────────────────────────────────────────────続 き Continued from the front page F term (reference) 5B085 AE06 BG07 CE01 5E501 AB15 AC25 AC33 AC42 CA02 CB02 CB09 DA02 EA02 EB05 FA05

Claims (6)

[Claims] An integrated server for controlling communication between a plurality of web servers and a browser, and identification information and access right information of a user who has access to at least one of the files of the plurality of web servers. The integrated server, in response to an access request from a user, communicates with the authentication server to obtain the access right information of the user, and includes a menu item corresponding to the access right. A communication system having a dynamic menu creation function for creating a menu page and returning it to a user. 2. The integrated server according to claim 1, wherein the menu items are configured to designate the plurality of web servers as lower files of the integrated server, and the user selects one of the menu items. 2. The communication system according to claim 1, wherein the server accesses the server corresponding to the menu item and returns the specified file to the user. 3. The integrated server according to claim 2, wherein, when returning the file to the user, the integrated server converts a URL of the file into a URL as a lower file of the integrated server, and returns the converted URL to the user. Communications system. 4. An integrated server for controlling communication between a plurality of web servers and a browser; and identification information and access right information of a user who has access to at least one of the files provided in the plurality of web servers. A communication server configured to provide the browser with files owned by the plurality of web servers in the form of files in its lower directory. 5. The communication system according to claim 4, wherein the integrated server has a reverse proxy function of reading a file of the web server based on a URL requested to access the integrated server from the browser. 6. The communication system according to claim 5, wherein the integrated server has a URL conversion function of converting the URL of the file read from the web server into a URL as a lower file of the integrated server.