JP2003122717A - Device and method for permitting access, access permission program and recording medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce communication sequence to an Origin server to discriminate whether or not an authentication/access permission processing to the Origin server is necessary and to reduce a distribution burden of the server without changing the conventional distributing operation of the Origin server. SOLUTION: When the authentication/access permission processing of the Origin server is judged to be necessary, an input of authentication information can be directly prompted from a mirror server to a requesting origin without inquiring the Origin server whether or not the authentication information is necessary to a request without the authentication information by providing a means for confirming whether or not the authentication information is included in the request, a means for prompting the input of the authentication information when no authentication information is judged to be included in the request and a means for requesting the authentication/access permission processing to the Origin server when the authentication information is judged to be included.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an access permission technology, and more specifically, to a content that requires authentication / access permission processing of an Origin server (a server serving as a content distribution source (see RFC1945 and RFC2068)). The present invention relates to an access permission technology applied in advance by a distribution device other than a server.

[0002]

2. Description of the Related Art HTTP / 1.1 compliant Proxy / Cache technology is a conventional technology that reduces the load when distributing content that requires authentication and access permission from an Origin server under the following conditions. Condition 1 The Origin server does not provide the password information to the distribution device that is not the Origin server (hereinafter referred to as the mirror server). Condition 2 The Origin server does not provide access permission information to the mirror server or client terminal.

This conventional technique reduces the distribution load of content that requires authentication / access permission of the Origin server.
Especially noteworthy operation is the Caché corresponding to the above content.
It is an operation sequence when delivering e. The operation sequence is shown in FIG.

The operation shown in FIG. 1 is an operation for relaying a content acquisition request from a request source to the Origin server. In operation, when providing the requested content, it is determined that authentication / access permission processing of the Origin server is necessary, and the Origin server prompts the Proxy / Cache device to input authentication information. In operation, the Proxy / Cache device relays the authentication information of the request source together with the content acquisition request to the Origin server, and acquires the entity code of the content held by the Origin server or its date. Then, if the entity code and the entity code of Cache are compared and they are the same, or if date comparison is performed and the time transition is within a specified range, Cache
To deliver.

In this prior art, in order for the Proxy / Cache server to hold and distribute the content that requires authentication / access permission of the Origin server as a cache,
Must contain a Cache control header within. In order to include the Cache control header in the Cache, when the Origin server distributes the content, the Cache
The control header must be delivered together.

As described above, there are two operational characteristics to be noted in this prior art. 1. The decision to deliver the cache should be made by comparing the origin code of the origin server-side content corresponding to the cache with the entity code of the cache, or by comparing the dates. 2. The Proxy / Cache Server can deliver the cache only if the cache contains a cache control header.

[0007]

DISCLOSURE OF THE INVENTION Problems to be Solved by the Invention
When delivering a cache that requires authentication and access permission of the igin server (see FIG. 1), compared to a cache that does not require the above processing (see FIG. 2), the communication sequence to the Origin server that is required for cache delivery determination is Increase by one. This sequence is for the Proxy / Cache server to inform the content requester that the authentication information is required to provide the content. It is desirable to reduce the number of communication sequences to the Origin server as much as possible in order to reduce the distribution load of the Origin server.

In order to include the cache control header in the cache, the Origin server must be able to deliver the content to be cached together with the cache control header. Origin without this feature
The server had to change the conventional distribution process due to the introduction of this technology.

The present invention solves the above problems, and
It is an object to reduce the communication sequence to the Origin server for determining whether server authentication / access permission is necessary, and to reduce the distribution load of Origin server without changing the conventional distribution process.

In summary, there are two problems to be solved by the present invention. Problem 1 To reduce the communication sequence to the Origin server to determine whether authentication / access permission processing of the Origin server is necessary. Problem 2 To reduce the distribution load on the origin server without changing the conventional distribution operation.

[0011]

Therefore, according to the present invention, in a conventional device, an identifier of an Origin server, content distributed by the Origin server, first means for accumulating authentication / access permission settings thereof, and the content are stored. Orig on request
Second means for determining whether or not in-server authentication / access permission processing is necessary based on the existence of the setting, and authentication to the request if it is determined that Origin server authentication / access permission processing is required Third means for confirming whether the information is included, fourth means for prompting the input of the authentication information when the third means determines that the authentication information is not included, and the fourth means Authentication when it is determined that the authentication information is included by
Fifth means for requesting an Origin server for access permission processing, wherein the fifth means uses the authentication information to request the response header of the requested content to the Origin server, and sixth means, Seventh means for obtaining a delivery status code from a response header, eighth means for holding a list in which the delivery status code and its corresponding access permission are stored, and access permission corresponding to the delivery status code in the list It is characterized by adding a ninth means for obtaining and implementing more.

By means of the first to fifth means, the apparatus determines whether or not the authentication information is necessary for the request without the authentication information.
It is possible to prompt the requester to enter the authentication information directly from the mirror server without contacting the origin server. By the above operation, this device can determine whether or not the content should be authenticated / access permitted, and can reduce the communication sequence (to the Origin server) for determining whether the authentication / access permission of the Origin server is necessary. .

Further, by the sixth to ninth means,
Since the access permission is performed based on the delivery status code of the in server (result of the Origin server processing the request), it is not necessary for the Origin server to respond with control information such as a cache control header for introducing the mirror server. With the above operation, the mirror server can be installed without changing the conventional distribution processing of the Origin server.

[0014]

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. (Embodiment 1) A first embodiment will be described based on an example of reducing the distribution load of content that requires basic authentication (RFC1945) of the Origin server.

The access permission device is implemented by activating a program based on the implementation method described below on a computer equipped with a network interface. The access permission device is equipped with an auxiliary storage device such as a hard disk, and the content distributed from the Origin server and its basic authentication setting file, and the UR of the Origin server.
The Origin server address setting file in which the L character string is described is stored in the auxiliary storage device. The disk area provided by the auxiliary storage device is the first means.

The basic authentication setting file includes an authentication method to be applied, a realm of the authentication method, an account information storage path, and an access permission setting. The apparatus of the present invention refers only to the authentication method and the realm thereof. And

The Origin server address setting file is a text file in which the host name and port number of the host on which the HTTP server process of the Origin server is activated are described as follows. Host name (multiple spaces or TAB) Port number (CR /
LF) An example of the configuration of the address setting file is shown below. www.ntt.co.jp 80 Next, start the HTTP server process in the access permission device. The access permission device acquires the authentication information of the user based on the basic authentication method.

The HTTP server process handles an authentication process handler function that handles the authentication process activated by the existence of the basic authentication setting file of the Origin server in the directory storing the requested content, and the access activated after the authentication process. It has a permission processing handler function. The authentication processing handler function is the second means.

In the authentication processing handler function, the user is an authenticated user from the user information (user information obtained by basic authentication) contained in the structure, with the structure storing the contents of the requested request as an argument. If it is determined that it is not an authenticated user, "declined" is returned. The structure has a working storage area, and variables can be created in the area.

The authentication processing handler function acquires the request header from the requested request and retrieves the Authorization header from the request header. The request header has the following format. URI indicating the method request content HTTP version Generic header Request header Entity header (CR / LF) The Authorization header is classified into the above request headers. So, after getting the request header line, I get the header name and that name is the Authorization
Let's search for what is.

The Authorization header is a header having the authentication information of the user as a value, and it is possible to determine whether or not the request includes the authentication information by the presence or absence of this header. This process is the third means.

As a result of the search, if the Authorization header does not exist, the following HTTP header is returned to the request source, and "declined" is returned in the authentication processing handler function. HTTP / 1.1 401 Unauthorized Date: Response date and time Server: HTTP server program name WWW-Authenticate: "Authentication method" realm = "Authentication method realm name" The WWW-Authenticate header above is the setting item in the basic authentication setting file. Create more. By the above operation, it is possible to prompt the user to re-enter the authentication information.
This operation is the fourth means.

In the fourth means, if an Authorization header exists in the request, the header and its value are acquired. Then, it requests the Origin server for the requested content. The Origin server address is acquired from the Origin server address setting file.

When requesting the origin server for the requested content, a TCP connection is created between the mirror server and the origin server, and the following request is transmitted. In the request, the Authorization header is used and the request method is HEAD. HEAD Request source content URI HTTP / 1.0 Authorization: Authentication type Authentication information ← Said Authoriza
Use the option header and its value (CR / LF) By sending the above request, it is possible to obtain only the content response header of the content on the Origin server side. The above operation is the sixth means.

Next, the content response header obtained by the request is obtained. The content response header has the following format. HTTP version Status code Explanatory text General purpose header Response header Entity header (CR / LF) The above status code is a 3-digit number from 100 to 500 that uniquely indicates the result of request processing by the Origin server. In the present invention, the status code is treated as a synonym for the delivery status code.

The access permission program acquires the first line of the content response header and acquires only the status code. This status code acquisition operation is the seventh means.

Next, it is assumed that the auxiliary storage device also holds, as a file, a list in which status codes and access permissions corresponding to the status codes are described. The access permission indicates two states of "ok" / "denied", "ok" is permission, "
"Denied" indicates rejection. The list is saved as a text file in the following format: Status code (multiple spaces or TAB) Access permission (CR / LF) Next, a list configuration example is shown below. (Status code access permission) ← Not actually described in the file 200 ok 401 denied The eighth means is to hold the list having the above format as a file in the auxiliary storage device.

Next, the access permission corresponding to the status code obtained by the sixth means is acquired from the list. If the corresponding access permission is "ok", an access permission variable is created in the working storage area included in the request structure, and the character string "ok" is stored in the variable. Then, the authentication processing handler function returns "ok" and ends the processing in the function. When the authentication processing handler function returns ok, the HTTP server process activates the access permission processing handler function. The access permission processing handler function has the request structure as an argument. The function acquires the access permission variable included in the request structure, and if the value is “ok”, permits the content response to the corresponding request and returns the content to the request source.

If the corresponding access permission is "denied",
The authentication processing handler function returns "declined" and ends the processing in the function. The authentication processing handler function is decl
By returning ined, the HTTP server process responds with the following message prompting the requester to re-enter the authentication information. HTTP / 1.1 401 Unauthorized Date: Response date and time Server: HTTP server program name WWW-Authenticate: "Authentication method" realm = "Realm name of authentication method" With the above operations, access permission according to the status code can be implemented. . This operation is the ninth means. The sixth to ninth means become the fifth means.

In summary, FIG. 3 shows an operation sequence when a request source makes a GET request to a HTTP server process equipped with the device of the present invention without authentication information for content requiring basic authentication of the Origin server.

(Embodiment 2) A second embodiment will be described based on an example of reducing the distribution load of contents requiring CGI authentication of the Origin server. The account information required for this CGI authentication exists on the Origin server and cannot be accessed from the mirror server. Also, the only parameters required by the CGI authentication program for user authentication are the user name and password. Then, the CGI authentication program does not generate distribution contents.

The access permitting device is realized by activating a program based on the realizing method described below on a computer having a network interface. In addition, the access permission device has an auxiliary storage device such as a hard disk, and the content distributed from the Origin server, the CGI authentication setting file, and the URL of the Origin server
An Origin server address setting file in which a character string is described is stored in the auxiliary storage device. The disk area provided by the auxiliary storage device is the first means.

In the CGI authentication setting file, the CGI authentication realm (AuthName) and the CGI authentication program URI (AuthCG
I), a variable name (AuthUse) for providing the user name and password name required for CGI authentication to the CGI authentication program.
r, AuthPasswd), and the method of providing the above parameters to the CGI authentication program (PutAuthParam). The format of the CGI authentication setting file is shown below. AuthName (Authentication realm) AuthCGI (CGI authentication program URI) AuthUser (Variable name for passing the user name required for CGI authentication to the CGI program) AuthPasswd (Variable for passing the password variable required for CGI authentication to the CGI program) Name) PutAuthParam (Providing parameters to CGI authentication program)

FIG. 4 shows a description example of the CGI authentication setting file. In the above setting example, the user name variable is "user", the password variable is "passwd", the realm is "NTT Directory", and the authentication CGI.
Set program URI as "/cgi-bin/auth.cgi" and parameter provision method as "POST".

Hereinafter, an embodiment will be described based on the description example of FIG. Next, the address setting file of the origin server is a text file in which the host name and port number of the host on which the HTTP server process of the origin server is activated are described as follows. Host name (multiple spaces or TAB) Port number (CR /
LF) An example of the configuration of the address setting file is shown below. www.ntt.co.jp 80 Next, the HTTP server process is started in the access permission device. The access permission device acquires the authentication information of the user based on the basic authentication method.

The HTTP server process handles an authentication process handler function that handles the authentication process activated by the existence of the basic authentication setting file in the directory storing the requested content, and the access permission process handler activated after the authentication process. Function and.
The authentication processing handler function is the second means to be described.

The authentication processing handler function uses the structure storing the contents of the requested request as an argument, and the user is an authenticated user from the user information (user information obtained by basic authentication) contained in the structure. If it is judged to be present, "ok" is returned, and if it is judged not to be an authenticated user, "declined" is returned. The structure has a working storage area, and variables can be created in the area.

The authentication processing handler function acquires the request header from the requested request and retrieves the Authorization header from the request header. The Authorization header is a header that has the authentication information of the user as a value. The request header has the following format. URI indicating method request content HTTP version Generic header Request header Entity header (CR / LF) The Authorization header is classified into the above request headers. So, after getting the request header line, I get the header name and that name is the Authorization
Let's search for what is. This process is the third means.

As a result of the search, if there is no Authorization header, the following HTTP header is returned to the request source, and "declined" is returned in the authentication processing handler function. HTTP / 1.1 401 Unauthorized Date: Response date and time Server: HTTP server program name WWW-Authenticate: BASIC realm = "value of AuthName" Note that the realm of the WWW-Authenticate header above is
Use AuthName value in CGI authentication configuration file. With the above operation, when the user's authentication information is not included, it is possible to prompt the user to re-enter the authentication information. This behavior is
It becomes the fourth means.

In the fourth means, if the Authorization header exists in the request, the header is obtained and the Authorization header set value is obtained. Then, after decrypting the Authorization setting value by base64, the user name and password are obtained. The user name is test1 and the password is pass1. Then, it requests the Origin server for the requested content. The Origin server address is acquired from the Origin server address setting file.

When requesting the requested content to the Origin server, a TCP connection is created between the mirror server and the Origin server, and the following request is transmitted. The request is created based on the values of AuthUser and AuthPasswd in the CGI authentication setting file description example of FIG. 4, and the user name (test1) and password (pass1). POST CGI authentication program URI (/cgi-bin/auth.cgi) HTTP / 1.0 (CR / LF) user = test1 & passwd = pass1 Send the above request and acquire only the content response header of the Origin server side content. (The entity body is not received.) The above operation is the sixth means.

Next, the content response header obtained by the request is obtained. The content response header has the following format. HTTP version status code Description General-purpose header Response header Entity header (CR / LF) The above status code is a 3-digit numerical value from 100 to 500 that uniquely indicates the result of request processing by the Origin server. In the present invention, the status code is treated as a synonym for the delivery status code. The permission program is
The first line of the content response header is acquired, and only the status code is acquired. The seventh means is the operation of acquiring this status code.

Next, it is assumed that the auxiliary storage device also holds, as a file, a list in which status codes and access permissions corresponding to the status codes are described. The access permission indicates two states of "ok" / "denied", "ok" is permission, and "de"
"nied" indicates rejection. The list is saved as a text file in the following format: Status code (multiple spaces or TAB) Access permission (CR / LF) Next, a list configuration example is shown below. (Status code access permission) ← Not actually described in the file 200 ok 401 denied The eighth means is to hold the list having the above format as a file in the auxiliary storage device.

Next, the access permission corresponding to the status code obtained by the sixth means is acquired from the list. If the corresponding access permission is "ok", an access permission variable is created in the working storage area included in the request structure, and the character string "ok" is stored in the variable. Then, the authentication processing handler function returns "ok" and ends the processing in the function. When the authentication processing handler function returns ok, the HTTP server process activates the access permission processing handler function. The access permission processing handler function takes the request structure as an argument. The function acquires the access permission variable included in the request structure, and its value is "ok".
If so, the content response to the corresponding request is permitted, and the content is responded to the request source.

If the corresponding access permission is "denied",
The authentication processing handler function returns "declined" and ends the processing in the function. The authentication processing handler function is decl
By returning ined, the HTTP server process responds with the following message prompting the requester to re-enter the authentication information. HTTP / 1.1 401 Unauthorized Date: Response date and time Server: HTTP server program name WWW-Authenticate: BASIC realm = "AuthName value" By the above operation, the access permission corresponding to the delivery status code can be applied to delivery. This operation is the ninth means. The sixth to ninth means are the fifth means.

As a summary, the request source is the CG of the Origin server.
FIG. 5 shows an operation sequence when a GET request is made to an HTTP server process in which the device of the present invention is installed, without authentication information for content that requires I authentication.

As described above, the inventions made by the present inventor are
Although the present invention has been specifically described based on the above-mentioned embodiments, the present invention is not limited to the above-mentioned embodiments, and it goes without saying that various modifications can be made without departing from the scope of the invention.

[0048]

According to the first to fourth means, the present apparatus allows a request without authentication information to input the authentication information from the mirror server to the request source without inquiring the Origin server as to whether the authentication information is necessary. Can be urged. Through the above operation, the device can confirm whether the content is for authentication / access permission.

By the fifth to ninth means, since the origin server performs access permission based on the result of request processing, it is necessary for the origin server to respond with control information such as a cache control header for introducing the mirror server. There is no. With the above operation, the mirror server can be installed without changing the conventional distribution processing of the Origin server.

[Brief description of drawings]

FIG. 1 is a diagram showing cache distribution that requires authentication and access permission.

FIG. 2 is a diagram showing cache distribution that does not require authentication / access permission.

FIG. 3 is a diagram showing an operation sequence of the first embodiment.

FIG. 4 is a diagram illustrating a description example of a CGI authentication setting file according to the second embodiment.

FIG. 5 is a diagram showing an operation sequence according to the second embodiment.

   ─────────────────────────────────────────────────── ─── Continued front page    F-term (reference) 5B017 AA03 BB09 CA16                 5B082 EA11 HA05 HA08                 5B085 AE01 BC01 BG03 BG07

Claims (4)

[Claims] 1. A device for determining access permission when distributing content that requires origin server authentication / access permission processing from a distribution device that is not the origin server, wherein the origin server identifier and the origin server distribute the content. Content, and first means for accumulating authentication / access permission settings for the content, and second means for determining whether or not origin server authentication / access permission processing is required for the request for the content, based on the existence of the setting. And a third means for confirming whether or not the request includes the authentication information when the Origin server authentication / access permission processing is determined by the determination, and the authentication information by the third means. The fourth means for prompting the user to enter the authentication information when it is determined that the authentication information is not included, and the authentication information by the third means. And a fifth means for requesting the origin server to perform the authentication / access permission processing using the identifier of the origin server when it is determined that the authentication information is included, and the fifth means includes the authentication information. A sixth means for requesting a response header of the requested content to the Origin server by using it, a seventh means for obtaining a distribution status code from the response header, and a list describing the distribution status code and the corresponding access permission An access permission device comprising: an eighth means for holding the above; and a ninth means for obtaining and executing an access permission corresponding to the distribution status code from the list. 2. A method of determining access permission when distributing content that requires origin server authentication / access permission processing from a distribution device that is not the origin server, wherein the origin server identifier and the origin server distribute the content. The content and the authentication / access permission setting for the content are executed. The Origin server authentication / access permission processing is required for the request for the content in the state in which the authentication / access permission setting is stored by executing the first step. A second step of determining whether or not the setting is present, and a step of checking whether or not the request includes the authentication information when it is determined that the Origin server authentication / access permission processing is necessary Third step, if the third means determines that the authentication information is not included, The fourth step that prompts you to enter the information,
And when the third means determines that the authentication information is included, the authentication / access permission processing is performed on the Orig.
A fifth step of requesting an Origin server using the identifier of the in server is an access permission method, wherein the fifth step uses the authentication information to request a response header of the requested content to the Origin server. A sixth step of performing, a seventh step of obtaining a delivery status code from the response header, an eighth step of holding a list describing the delivery status code and corresponding access permission, and the delivery status code A ninth step of obtaining and implementing a corresponding access permission from the list, the access permission method. 3. An origin server identifier and the origin server distribute a computer to determine access permission when distributing content that requires origin server authentication / access permission processing from a distribution device that is not the origin server. Content, and first means for accumulating authentication / access permission settings for the content, second means for determining whether or not Origin server authentication / access permission processing is required for the request for the content, based on the existence of the setting, A third means for confirming whether or not the request includes the authentication information when it is determined that the Origin server authentication / access permission processing is necessary by the determination, and the authentication information is included by the third means. If it is determined that the authentication information is not entered, the fourth means for prompting the user to enter the authentication information and the third means are used. Access authorization program that functions as a fifth means for requesting the origin server for the authentication / access permission processing by using the identifier of the origin server when it is determined that the authentication information is included. The program for functioning as means of, a sixth means for requesting the Origin server for a response header of the requested content by using the authentication information, a seventh means of obtaining a delivery status code from the response header, the delivery status code And a ninth means for holding a list in which the access permission corresponding thereto is stored, and a ninth means for obtaining and executing the access permission corresponding to the delivery status code from the list. A featured permission program. 4. A computer-readable storage medium recording the program according to claim 3.