JPH11167551A - Server and its access control method and information record medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce the possibility of leakage of the authentication information when the access control is performed between the client servers. SOLUTION: When the access control is performed between a client 10 kept in a connection-less environment and a server 12, the server 12 generates and sends the connection information to the client 10 that succeeded to authenticate its user via a password table 24. At the same time, the connection information is stored in a connection information table 26 of the server 12. Receiving the connection information corresponding to a request signal from the client 10, the server 12 authenticates the user of the client 10 based on the said connection information and the connection information stored in the table 26. When the user can be authenticated, the server information corresponding to the request signal corresponding to the connection information is acquired from a server program 22 and sent back to the client 10.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a server, a server access control method, and an information recording medium, and more particularly, to a server access control technique for a client.

[0002]

2. Description of the Related Art In a connectionless environment in which a server returns server information corresponding to a request signal from a client to the client, a communication connection is not maintained between the client and the server. Therefore, if the client program attempts to acquire information on the server whose access is controlled, even if the user authentication has already been successful, each time the client sends a request signal to the server, the user name and password are transmitted. Authentication is required by inputting a password. Therefore, when transmitting a request signal to the server, the user must input a user name and a password on the client and transmit them to the server.
There was a problem that the operation became complicated.

[0003] On the other hand, a user name and a password are stored in a memory on a client machine, and once user authentication using a user name and a password succeeds once in accessing a certain server, the same server is accessed. In the access, it is possible to avoid such a problem by automatically transmitting the user name and the password on the memory every time.

[0004]

However, in access control between a client and a server, authentication information such as a user name and a password is often transmitted as simple text data. Transmitting the password every time the access is performed increases the risk of eavesdropping and has a problem that unauthorized access is likely to occur due to impersonation of the user.

On the other hand, in the security system according to Japanese Patent Laid-Open No. 4-182768, in a communication environment for establishing a connection, confidential inquiry information is changed each time access is made. That is, in this method, the user authentication of the client is performed by using a combination of fixed password information and confidential inquiry information that changes each time in order to establish a connection with the host computer. However, even in this technology, the password is frequently transmitted and received between the client and the host computer.
There is a high risk of eavesdropping on this information. Furthermore, since the confidential inquiry information is stored in the client, there is a problem that only the client can access the host computer.

The present invention has been made in view of the above problems, and has as its object to provide a server, a server access control method, and a server capable of reducing the possibility of leakage of authentication information in access control between client servers. An object of the present invention is to provide an information recording medium on which a program for realizing the above is recorded.

[0007]

According to a first aspect of the present invention, there is provided a server for returning server information corresponding to a request signal transmitted from a client to a client by using a password for user authentication. Connection information transmission means for generating and transmitting connection information to a successful client; connection information storage means for storing connection information transmitted to the client by the connection information transmission means;
An authentication unit that, when receiving connection information associated with a request signal from a client, performs user authentication of the client based on the connection information and the connection information stored in the connection information storage unit; And server information returning means for returning server information corresponding to the request signal associated with the connection information to the client when the user authentication of the client is successful.

According to a second aspect, in the first aspect, when the same connection information is received from the client a predetermined number of times or more, new connection information is generated and transmitted to the client, and the new connection information is transmitted to the client. The apparatus further includes first connection information updating means stored in the connection information storage means.

[0009] In a third aspect based on the first or second aspect, when a predetermined time has elapsed from the generation of the connection information by the connection information transmitting means, new connection information is generated and transmitted to the client. And second connection information updating means for storing the new connection information in the connection information storage means.

According to a fourth aspect of the present invention, in any one of the first to third aspects of the present invention, when there is no access from the same client again after a predetermined time has elapsed from the time of the previous access, And a first authentication canceling means for temporarily canceling the user authentication of the above.

According to a fifth aspect of the present invention, in any one of the first to fourth aspects, after the client has been authenticated by the password, if the client has accessed the client more than a predetermined number of times, the authentication means may identify the client. It further includes a second authentication canceling means for temporarily canceling the user authentication.

According to a sixth aspect of the present invention, in any one of the first to fifth aspects, when a predetermined time has elapsed after the user authentication of the client by the password, the user authentication of the client by the authentication means is temporarily stopped. It further includes a third authentication suspension means.

According to a seventh aspect of the present invention, in any one of the first to sixth aspects, when a predetermined request signal for invalidating the connection information is received from the client, the user authentication of the client by the authentication means is performed. It further includes a fourth authentication canceling means for canceling.

An eighth invention according to any one of the first to seventh inventions, further comprises a client-server access generating means for generating a client-to-server access at regular time intervals using the connection information.

In a ninth aspect based on the eighth aspect, the client-server access generation means controls the client so that the client accesses the server using the connection information at regular intervals. It includes an execution module transmitting means for transmitting a module.

In a tenth aspect based on the eighth aspect, the server information is hypertext information, and the client-server access generating means should access the server using the connection information after a predetermined time. The tag information to the effect is included in the server information.

According to an eleventh aspect, in any one of the first to ninth aspects, when an encrypted password is transmitted from a client, the client further comprises a decryption means for decrypting the password. .

A twelfth invention is a server access control method for returning server information corresponding to a request signal transmitted from a client to the client, wherein connection information is generated for a client that has succeeded in user authentication using a password. Transmitting connection information, transmitting the connection information to the client in the connection information transmitting step, storing the connection information, and receiving the connection information associated with the request signal from the client, the connection, Based on the information and the connection information stored in the connection information storage step, an authentication step of performing user authentication of the client, and when the user authentication of the client succeeds in the authentication step, the connection information is associated with the connection information. Server that returns server information corresponding to the request signal to the client Is intended to include boric reply step, the.

A thirteenth invention is an information recording medium which records a program for causing a computer to operate as a server which returns server information corresponding to a request signal transmitted from a client to the client,
A connection information transmission step of generating and transmitting connection information to a client that has succeeded in user authentication with a password,
A connection information storage step of storing connection information to be transmitted to the client in the connection information transmission step, and, when connection information associated with a request signal is received from the client, the connection information and the connection information are stored in the connection information storage step. An authentication step of performing user authentication of the client based on the connection information, and, when the user authentication of the client is successful in the authentication step, server information corresponding to the request signal associated with the connection information to the client. A program for causing a computer to execute a server information return step for returning is recorded.

[0020]

Embodiments of the present invention will be described below in detail with reference to the drawings.

Embodiment 1 FIG. 1 is a functional block diagram showing a communication system according to Embodiment 1 of the present invention.
Hereinafter, through the disclosure of the communication system, a server, a client, an access control method for a server according to the present invention, and an embodiment of an information recording medium on which a program for realizing the method is recorded will be described.

As shown in FIG. 1, in the communication system, a client 10 and a server 12 are communicably connected to each other by communication means 14 such as the Internet. In the present communication system, the client 10 and the server 12 are communicatively connected in a connectionless environment, and the client 10 transmits a request signal for requesting server information to the server 12. On the other hand, the server 12
Returns server information corresponding to the request signal received from the client 10 to the client 10. Such a configuration is generally used in a WWW (World Wide Web) system or the like. In this case, the request signal is sent to a URL (Uniform Resource Solution).
urce Locator), and the server information corresponds to hypertext information.

The client 10 is constituted by an information processing device such as a PC, and includes a client program 16 loaded into a main storage device and executed by the CPU. In particular, the connection information is stored in the storage means 18 such as a memory. Such a client program 16
Transmits a request signal to the server 12 via the communication means 14 and, when server information is received from the server 12 in response to the request signal, performs a display display based on the server information by a display device (not shown). When the connection information is stored in the storage unit 18, the client program 16 transmits the connection information to the server 12 together with the request signal.

The server 12, like the client 10,
The authentication / connection information generation program 20 and the server program 22 are configured by an information processing device such as a PC, and are loaded into the main storage device and executed by the CPU. In particular, a password table 24 and a connection information table 26 are stored in the external storage device.

First, when a user name and a password are transmitted from the client program 16, the authentication / connection information generation program 20 performs user authentication of the client 10 based on the information and the password table 24. When the user authentication of the client 10 is successful, the connection information for the client 10 is generated and transmitted to the client 10, and the information is stored in the connection information table 26 in association with the user name.

The authentication / connection information generation program 20
When connection information is transmitted together with a request signal from the client program 16, user authentication of the client 10 is performed based on the connection information and the connection information table 26. When the user authentication of the client 10 is successful, the server 10 requests the server program 22 to transmit the server information requested by the client 10 to the server program 22, and transmits the server information received from the server program 22 to the client 10. .

Here, the server program 22 is a program for returning corresponding server information when a request signal is received. Further, in the password table 24, a user name (ID) of a user who is scheduled to access the server 12 and a password given to the user are stored in association with each other. Further, the connection information table 26 stores the authentication / connection information generation program 2
0 is a table in which the connection information generated by the server 10 is stored, the user name of the client 10 accessing the server 12, the connection information generated for the user name,
Are stored in association with each other.

In the server 12 included in the communication system described above, the authentication / connection information generation program 20
Functions as connection information transmitting means for generating and transmitting connection information to the client 10 that has succeeded in user authentication using a password. The connection information table 26 functions as connection information storage means for storing connection information transmitted to the client 10 by the connection information transmission means. Further, when receiving the connection information associated with the request signal from the client 10, the authentication / connection information generation program 20 generates the client 10 based on the connection information and the connection information stored in the connection information storage means. Functions as an authentication unit for performing user authentication of the client 10, and when the user authentication of the client 10 is successfully performed by the authentication unit,
It functions as server information return means for transmitting server information corresponding to the request signal associated with the connection information to the client 10.

The operation of the communication system having the above configuration will be described below with reference to the flowcharts shown in FIGS.

As shown in FIG. 2, first, in the server 12, the authentication / connection information generation program 20 receives a request signal from the client 10 (S101). And
It is determined whether or not the received request signal includes connection information (S102). If the connection signal is not included, a request for a user name and password is made to the client 10 (S103). On the other hand, if the user name and the password are received from the client 10 (S104), the authentication / connection information generation program 20 then generates the user of the client 10 based on the received user name and password and the password table 24. Perform authentication. If the user authentication of the client 10 using the password table 24 fails (S105), the client 1
The communication process between the server 0 and the server 12 ends.

If the authentication / connection information generation program 20 succeeds in the user authentication of the client 10 using the password table 24 in S105, the connection information is generated (S106), and the connection information is stored in the connection information table 2.
6 is additionally recorded together with the user name (S107). This connection information is generated by encryption using a random combination of numbers, symbols, and characters. Next, the authentication / connection information generation program 20 transmits user information such as a user name to the server program 22 (S108), and transmits a request signal for acquiring server information (S10).
9). The user information transmitted to the server program 22 can be used by the server program 22 if necessary. Then, the authentication / connection information generation program 2
0 indicates that the connection information generated in S106 is
(S110) and the server program 2
The server information transmitted from the client 2 is transmitted to the client 10 (S111).

On the other hand, if the authentication / connection information generation program 20 determines in the step S102 that the request signal received from the client 10 includes the connection information, the authentication / connection information generation program 20 next executes the connection The user authentication of the client 10 is performed by checking whether the information is the same as that already recorded in the connection information table 26 (S112). And the client 10
If the user authentication is successful (S113), the process proceeds to S108, and a process for returning server information to the client 10 is performed. If the user authentication of the client 10 fails in S113, the client 10
The communication between the server and the server 12 ends.

According to the above-described embodiment, the number of times passwords are exchanged between the client 10 and the server 12 can be reduced, so that unauthorized access due to password leakage can be prevented. In addition, the connection information can be frequently changed to function as a dynamic password, so that the leakage of the connection information situation can be prevented, and the unauthorized access can be more reliably prevented. .

Embodiment 2 FIG. 4 is a functional block diagram showing a communication system according to Embodiment 2 of the present invention.
The communication system shown in FIG.
And the contents of the connection information table 26a and the processing of the authentication / connection information generation program 20a. The client 10, the internal configuration thereof, and the server program 22 of the server 12a are the same as those of the first embodiment.
Since the communication system is the same as that of the communication system according to the first embodiment, the same reference numerals are given here and the description is omitted.

First, the password table 24a of the communication system according to the present embodiment stores the number of times connection information has been changed for each user in association with a user name and a password. The number of times this connection information has been changed is set in connection information table 2
6a is a setting value for determining the update condition of the connection information stored in the client 6a.
Alternatively, the setting is input in advance by the user of the server 12.

The connection information table 26a of the communication system according to the present embodiment stores the number of times of access for each user in association with the user name and the connection information.
The number of accesses is determined by the client 1 after the connection information is generated and stored in the connection information table 26a.
0 represents the number of accesses.

On the other hand, the authentication / connection information generation program 20a of the communication system increments and updates the access frequency column of the connection information table 26 every time the client 10 accesses. When the access count reaches the value of the connection information change count stored in the password table 24a, new connection information is generated and transmitted to the client 10, and the connection information already recorded in the connection information table 26a is generated. Update the value of the information with a new one. At this time, the value of the access count is reset to zero.

That is, in the present embodiment, when the authentication / connection information generation program 20a receives the same connection information from the client a predetermined number of times or more, it generates new connection information and transmits it to the client 10. , Also functions as first connection information updating means for storing the new connection information in the connection information table 26a.

The operation of the communication system having the above configuration will be described below with reference to the flowcharts shown in FIGS. Here, the flowchart shown in FIG. 5 is different from the flowchart shown in FIG. 2 in that a processing flow S200 for resetting the number of accesses of the connection information table 26a to 0 is added between S107 and S108. The processes are denoted by the same reference numerals as in FIG. 2 and will be described only briefly here.

First, in the flowchart shown in FIG. 5, the authentication / connection information generation program 20a receives a request signal from the client 10 (S101), and when the request signal includes connection information (S102). As shown in FIG. 6, the user authentication of the client 10 is performed based on the connection information and the connection information table 26 (S20).
1). If the user authentication of the client 10 using the connection information fails, the client 10 and the server 12
Ends communication with.

On the other hand, the client 10 using the connection information
If the user authentication is successful, the authentication / connection information generation program 20 then increments the value of the number of accesses stored in the connection information table 26a and updates the value n of the number of accesses in the connection information table 26a ( S20
2). Further, the authentication / connection information generation program 20 reads the value K of the number of times of connection information change from the password table 24a (S203), and compares the value with the value of the number of times of access (S204). If the value n of the number of accesses is smaller than the value K of the number of connection information changes, S1
08 (FIG. 5), and access processing to the server program 22 is performed as usual (S108). On the other hand, if the access count value n is equal to or greater than the connection information change count value K, the authentication / connection information generation program 20 generates new connection information (S205) and stores it in the connection information table 26.
And the connection information is updated (S206). further,
The authentication / connection information generation program 20 resets the value n of the number of accesses in the connection information table 26 to 0 (S20).
0, FIG. 5). Thereafter, access processing to the server program 22 is performed as usual (S108). At this time, S110
The connection information transmitted to the client 10 in S2 is S2
05 is newly generated. The client program 16 sends the new connection information to the server 12
And updates the old connection information already stored in the storage means 18.

According to the embodiment described above, the connection information is updated when the number of accesses exceeds a certain number. As a result, the possibility that the connection information is eavesdropped can be reduced, and even if the connection information is eavesdropped, unauthorized access due to impersonation using the connection information can be restricted.

Embodiment 3 FIG. 7 is a functional block diagram showing a communication system according to Embodiment 3 of the present invention.
The communication system shown in the figure has features in the contents of the password table 24b and the connection information table 26b and the processing of the authentication / connection information generation program 20b, as compared with the communication system according to the first or second embodiment. Things. The configuration of the client 10 and the server program 22 of the server 12b are the same as those of the communication system according to the first or second embodiment.

First, the connection information change elapsed time of each user is stored in the password table 24b of the communication system according to the present embodiment in association with the user name and the password. The connection information change elapsed time is a set value for determining the update condition of the connection information stored in the connection information table 26b, and is set and input in advance by the user of the client 10 or the server 12b by an input unit (not shown).

Further, the connection information generation time of each user is stored in the connection information table 26b of the communication system according to the present embodiment in association with the user name and the connection information. This connection information generation time indicates the time at which the connection information was generated.

On the other hand, the authentication / connection information generation program 20b of the communication system calculates the elapsed time from the connection information generation time of the connection information table 26b every time the client 10 accesses. When the calculated elapsed time reaches the value of the connection information change elapsed time stored in the password table 24b, new connection information is generated and transmitted to the client 10, and the new connection information is already recorded in the connection information table 26b. Update the connection information value that has been updated. At this time, the connection information generation time is reset and updated to the time at that time.

That is, in the present embodiment, when a predetermined time has elapsed from the generation of the connection information, the authentication / connection information generation program 20b generates new connection information and transmits it to the client 10, and It also functions as second connection information updating means for storing new connection information in the connection information table 26b.

Hereinafter, the operation of the communication system having the above configuration will be described with reference to the flowcharts shown in FIGS. Here, the flowchart shown in FIG. 8 differs from the flowchart shown in FIG. 2 in that a processing flow S300 for updating the connection information generation time of the connection information table 26b is added between S107 and S108. The processes are denoted by the same reference numerals as in FIG. 2 and will be described only briefly here.

First, in the flowchart shown in FIG. 8, the authentication / connection information generation program 20b receives a request signal from the client 10 (S101), and when the request signal includes connection information (S102). As shown in FIG. 9, user authentication of the client 10 is performed based on the connection information and the connection information table 26b (S30).
1). If the user authentication of the client 10 using the connection information fails, the client 10 and the server 12
The communication with b is terminated.

On the other hand, the client 10 using the connection information
If the user authentication is successful, the authentication / connection information generation program 20b then subtracts the connection information generation time stored in the connection information table 26b from the current time output from an internal clock (not shown), and The elapsed time t from the time of generation to the present is derived (S302).
Further, the authentication / connection information generation program 20 reads the connection information change elapsed time T from the password table 24a (S303), and compares the value with the value of the elapsed time t derived in S302 (S304).

If the elapsed time t is smaller than the connection information change elapsed time T, the processing shifts to S108 (FIG. 8), and access processing to the server program 22 is performed as usual (S108). On the other hand, if the elapsed time t is equal to or longer than the connection information change elapsed time T, the authentication / connection information generation program 20b generates new connection information (S305), stores it in the connection information table 26b, and updates the connection information. (S306). Further, the authentication / connection information generation program 20b resets the value of the connection information generation time in the connection information table 26b to the current time output from an internal clock (not shown) (S300, FIG. 8). Thereafter, access processing to the server program 22 is performed as usual (S10).
8). At this time, the connection information transmitted to the client 10 in S111 is newly generated in S305. The client program 16 receives the new connection information from the server 12b and updates old connection information already stored in the storage unit 18.

According to the above-described embodiment, the connection information is updated when a certain time has elapsed from the time when the connection information was generated. That is, the period during which the server can receive user authentication based on the same connection information is limited to a certain period. As a result, the possibility that the connection information is eavesdropped can be reduced, and even if the connection information is eavesdropped, unauthorized access due to impersonation using the connection information can be restricted.

Embodiment 4 FIG. 10 is a functional block diagram showing a communication system according to Embodiment 4 of the present invention. The communication system shown in the figure is based on a combination of the technology of the communication system according to the second embodiment and the technology of the communication system according to the third embodiment, and includes the contents of a password table 24c and a connection information table 26c. And the processing of the authentication / connection information generation program 20c. Then, the client 10 and its internal configuration and the server program 2 of the server 12c
2 is the same as the communication system according to the first embodiment, so the same reference numerals are given here and the description is omitted.

First, the password table 24c of the communication system according to the present embodiment stores the number of times of connection information change and the elapsed time of connection information change for each user in association with the user name and the password. The connection information change count is set in the connection information table 26c as in the second embodiment.
Are set values for determining the update condition of the connection information stored in the client 10 or the user of the client 10 or the server 12c by an input unit (not shown). Further, the connection information change elapsed time is a set value for determining the update condition of the connection information stored in the connection information table 26c, as in the third embodiment, and the user of the client 10 or the server 12c is operated by an input unit (not shown). Is set and input in advance.

Further, the connection information table 26c of the communication system according to the present embodiment stores the number of accesses of each user and the connection information generation time in association with the user name and the connection information. As in the second embodiment, connection information is generated and the connection information table 26
c represents the number of accesses of the client 10 after being stored in c. The connection information generation time indicates the time when the connection information was generated, as in the third embodiment.

On the other hand, the authentication / connection information generation program 20c of the communication system increments and updates the access frequency column of the connection information table 26c every time the client 10 accesses. When the access count reaches the value of the connection information change count stored in the password table 24c, new connection information is generated and transmitted to the client 10, and the connection information already recorded in the connection information table 26c is generated. Update the value of the information with a new one. At this time, the value of the access count is reset to zero. Further, the authentication / connection information generation program 20c calculates the elapsed time from the connection information generation time in the connection information table 26c every time the client 10 accesses. If the calculated elapsed time reaches the value of the connection information change elapsed time stored in the password table 24c, new connection information is generated and transmitted to the client 10, and the connection information table 26c
Is updated to a new value of the connection information already recorded in the. At this time, the connection information generation time is reset and updated to the time at that time.

The operation of the communication system having such a configuration will be described below with reference to the flowcharts shown in FIGS. Here, the flow chart shown in FIG. 11 is a processing flow S400 for resetting the number of accesses of the connection information table 26c to 0 between S107 and S108 in the flow chart shown in FIG. 2, and a connection information generation time of the connection information table 26c. Is added to the processing flow S401, and the other processes are denoted by the same reference numerals as in FIG. 2 and will be described only briefly here.

First, in the flowchart shown in FIG. 5, the authentication / connection information generation program 20c receives a request signal from the client 10 (S101), and when the request signal includes connection information (S102). 12, the user authentication of the client 10 is performed based on the connection information and the connection information table 26c (S40).
2). If the user authentication of the client 10 using the connection information fails, the client 10 and the server 12
The communication with c is terminated.

On the other hand, the client 10 using the connection information
If the user authentication is successful, the authentication / connection information generation program 20c then increments the value of the number of accesses stored in the connection information table 26c and updates the value n of the number of accesses in the connection information table 26c ( S4
03). Further, an authentication / connection information generation program 20c
Reads the value K of the number of connection information changes from the password table 24c (S404), and compares the value with the value of the number of accesses (S405).

If the value n of the number of times of access is equal to or more than the value K of the number of times of change of connection information, the authentication / connection information generation program 20c generates new connection information (S40).
9), and stores it in the connection information table 26c to update the connection information (S410). Further, the authentication / connection information generation program 20c resets the value n of the number of accesses in the connection information table 26c to 0 (S40).
0), the value of the connection information generation time in the connection information table 26 is reset to the current time output from an internal clock (not shown) (S401). Thereafter, access processing to the server program 22 is performed as usual (S108). On this occasion,
The connection information transmitted to the client 10 in S111 is the one newly generated in S409. The client program 16 receives the new connection information from the server 12b and updates old connection information already stored in the storage unit 18.

On the other hand, if it is determined in S405 that the value n of the number of times of access is smaller than the value K of the number of times of change of connection information, then the authentication / connection information generation program 20c
Subtracts the connection information generation time stored in the connection information table 26c from the current time output from an internal clock (not shown) to derive the elapsed time t from the time when the connection information was generated to the present (S406). Further, the authentication / connection information generation program 20c stores the password table 2
4c is read from the connection information change elapsed time T (S40).
7) The value is compared with the value of the elapsed time t derived in S406 (S408).

If the elapsed time t is smaller than the connection information change elapsed time T, the process shifts to S108 to perform the access process to the server program 22 as usual. On the other hand, if the elapsed time t is equal to or longer than the connection information change elapsed time T, the authentication / connection information generation program 20c generates new connection information (S409), stores the new connection information in the connection information table 26c, and updates the connection information. (S410).
Then, the authentication / connection information generation program 20 resets the value n of the number of accesses in the connection information table 26 to 0 (S400), and outputs the value of the connection information generation time in the connection information table 26 from an internal clock (not shown). The current time is reset (S401). Thereafter, access processing to the server program 22 is performed as usual (S1).
08).

According to the present embodiment described above, when a certain time has elapsed from the time when the connection information was generated, or when the same connection information has been accessed more than a predetermined number of times since the connection information was generated, The connection information is updated. That is, the number of times and the period during which the server can receive user authentication by the same connection information are limited to a certain range. As a result, the possibility that the connection information is eavesdropped can be reduced, and even if the connection information is eavesdropped, unauthorized access due to impersonation using the connection information can be restricted.

In the above description, the case where the number of accesses n is equal to or greater than the number of times of connection information change K or the elapsed time t
Is greater than or equal to the connection information change elapsed time T, the connection information is updated. However, the access count n is equal to or greater than the connection information change count K, and the elapsed time t is equal to the connection information change elapsed time. The connection information may be updated only when it is T or more.

Embodiment 5 FIG. 13 is a functional block diagram showing a communication system according to Embodiment 5 of the present invention. The communication system shown in the figure is characterized in that the contents of the password table 24d and the connection information table 26d and the processing of the authentication / connection information generation program 20d are different from the communication systems according to the above embodiments. It is. The configuration of the client 10 and the server program 22 of the server 12d are the same as those of the communication system according to each of the above-described embodiments.

First, the password table 24d of the communication system according to the present embodiment stores a timeout period of each user in association with a user name and a password. This timeout time is set in the connection information table 2
This is a set value for determining a condition for deleting the connection information stored in 6d, and is set in advance by the user of the client 10 or the server 12d by an input unit (not shown).

The connection information table 26d of the communication system according to the present embodiment stores the last access time of each user in association with the user name and the connection information. This last access time indicates the last time the client 10 accessed the server 12d.

On the other hand, the authentication / connection information generation program 20d of the communication system calculates the elapsed time from the previous access time in the connection information table 26d every time the client 10 accesses. When the calculated elapsed time reaches the value of the timeout time stored in the password table 24d, the connection information of the user is deleted from the connection information table 26d, and the client 1
Requests transmission of the user name and password to 0. On the other hand, the calculated elapsed time is the password table 24d.
If the timeout time stored in the connection information has not been reached, new connection information is generated and transmitted to the client 10, and the value of the connection information already recorded in the connection information table 26d is updated to a new value. At this time, the previous access time is reset to the time at that time and updated.

That is, in the present embodiment, the authentication / connection information generation program 20d executes the authentication / connection information generation program if there is no access from the same client again after a predetermined time has elapsed from the time of the previous access. It also functions as a first authentication canceling unit that temporarily cancels the user authentication of the client 10 by the program 20d (authentication unit).

The operation of the communication system having the above configuration will be described below with reference to the flowcharts shown in FIGS. Here, the flowchart shown in FIG. 14 differs from the flowchart shown in FIG. 2 in that a processing flow S500 for updating the previous access time of the connection information table 26d is added between S107 and S108, and other processing is performed. Are given the same reference numerals as in FIG. 2 and will be described only briefly here.

First, in the flowchart shown in FIG. 14, the authentication / connection information generation program 20d
(S101), and when the request signal includes the connection information (S102), as shown in FIG. 15, based on the connection information and the connection information table 26d, the client 10 Perform user authentication (S5
01). If the user authentication of the client 10 using the connection information fails, the client 10 and the server 1
The communication with 2d is terminated.

On the other hand, the client 10 using the connection information
If the user authentication is successful, the authentication / connection information generation program 20d then subtracts the previous access time stored in the connection information table 26d from the current time output from an internal clock (not shown), and
Derives the elapsed time t from the time of last access to the server 12 to the present (S502). Further, the authentication / connection information generation program 20d stores the password table 24d
Is read out (S503), and the value is compared with the value of the elapsed time t derived in S502 (S504).

The elapsed time t is equal to the timeout time T.
If it is smaller, the authentication / connection information generation program 20d generates new connection information (S505), stores it in the connection information table 26d, and updates the connection information (S506). Further, the authentication / connection information generation program 20d resets the value of the previous access time in the connection information table 26d to the current time output from an internal clock (not shown) (S500). Thereafter, access processing to the server program 22 is performed as usual (S108). At this time, the connection information transmitted to the client 10 in S111 is the one newly generated in S505. The client program 16 receives the new connection information from the server 12d, and updates the old connection information already stored in the storage unit 18.

On the other hand, if the elapsed time t is equal to or longer than the timeout time T, the authentication / connection information generation program 20d
Deletes the connection information of the client 10 from the connection information table 26d (S507). Then, the client 10 is again requested to transmit the user name and the password (S103).

According to the above-described embodiment, when the access interval from the client 10 exceeds a certain time, the connection information registered at that time is deleted from the connection information table 26d. That is, client 1
In the case of 0, the connection information becomes invalid unless the server 12d is sequentially accessed within a predetermined time, and user authentication with a user name and a password is required again. Thus, according to the present embodiment, wiretapping of the connection information can be prevented, and as a result, unauthorized access due to impersonation can be prevented.

As is apparent from S504 to S506 in FIG. 15, the connection information is updated every time the client 10 accesses the server 12d, so that the possibility of wiretapping of the connection information can be reduced. Also, unauthorized access due to impersonation can be prevented.

Embodiment 6 FIG. FIG. 16 is a functional block diagram showing a communication system according to Embodiment 6 of the present invention. The communication system shown in the figure is characterized in that the contents of the password table 24e and the connection information table 26e and the processing of the authentication / connection information generation program 20e are different from the communication systems according to the above embodiments. It is. The configuration of the client 10 and the server program 22 of the server 12e are the same as those of the communication system according to each of the above-described embodiments.

First, the password table 24e of the communication system according to the present embodiment stores the number of times connection information has been deleted for each user in association with a user name and a password. This connection information deletion count is set in the connection information table 2
This is a set value for determining a condition for deleting the connection information stored in 6e, and is set and input in advance by the user of the client 10 or the server 12e by an input unit (not shown).

Further, in the connection information table 26e of the communication system according to the present embodiment, the number of accesses of each user is stored in association with the user name and the connection information, similarly to the communication system according to the second embodiment. I have. The number of accesses is determined by generating new connection information in the connection information table 26e.
Represents the number of accesses of the client 10 after being stored in the client 10.

On the other hand, the authentication / connection information generation program 20e of the communication system increments and updates the number of times of access in the connection information table 26e every time the client 10 accesses. When the access count reaches the value of the connection information deletion count stored in the password table 24e, the connection information of the user is deleted from the connection information table 26e, and the client 1
Requests transmission of the user name and password to 0. On the other hand, if the access count has not reached the connection information deletion count stored in the password table 24e, new connection information is generated and transmitted to the client 10, and the connection information already recorded in the connection information table 26e is generated. Is updated to a new value.

In the present embodiment, the authentication / connection information generation program 20e is activated by the authentication / connection information generation program 20e when the client 10 accesses the client 10 a predetermined number of times after the user is authenticated by the password. Client 10 by (authentication means)
It also functions as a second authentication canceling unit for temporarily canceling the user authentication.

Hereinafter, the operation of the communication system having the above configuration will be described with reference to the flowcharts shown in FIGS. Here, the flowchart shown in FIG. 17 is different from the flowchart shown in FIG. 2 in that a processing flow S600 for resetting the number of accesses of the connection information table 26e to 0 is added between S107 and S108. The processes are denoted by the same reference numerals as in FIG. 2 and will be described only briefly here.

First, in the flowchart shown in FIG. 17, the authentication / connection information generation program 20e
(S101), and if the request signal does not include the connection information (S102), the user of the client 10 is authenticated with a password (S1).
03 to S105). Then, if the user authentication by the password is successful, the connection information is generated and registered in the connection information table 26e (S106, S107), and the access count of the connection information table 26e is reset to 0 (S600).

If the request signal received from the client 10 includes connection information (S102),
As shown in FIG. 18, user authentication of the client 10 is performed based on the connection information and the connection information table 26e (S601). If the user authentication of the client 10 using the connection information fails, the communication between the client 10 and the server 12e ends.

On the other hand, the client 10 using the connection information
If the user authentication is successful, the authentication / connection information generation program 20e then increments the value of the number of accesses stored in the connection information table 26e to update the value n of the number of accesses in the connection information table 26e ( S6
02). Furthermore, an authentication / connection information generation program 20e
Reads the connection information change count value K from the password table 24e (S603), and compares the read value with the access count value (S604). If the value n of the number of times of access is smaller than the value K of the number of times of change of connection information, the authentication / connection information generation program 20e generates new connection information (S605), and stores it in the connection information table 2 (S605).
6e and updates the connection information (S606). Thereafter, access processing to the server program 22 is performed as usual (S108). At this time, the connection information transmitted to the client 10 in S111 is newly generated in S605. Client program 16
Receives the new connection information from the server 12e and updates the old connection information already stored in the storage unit 18.

On the other hand, if the value n of the number of times of access is equal to or more than the value K of the number of times of change of connection information, the authentication / connection information generation program 20e deletes the connection information of the client 10 from the connection information table 26e (S607). And then
The client 10 is again requested to transmit the user name and the password (S103).

According to the present embodiment described above, the client 10 after performing the user authentication with the password.
The number of times of access between the server 10 and the server 12e is counted, and when the number of times exceeds a predetermined number, the client 10 is again required to perform user authentication using a password. That is, according to the present embodiment, the user authentication using the password is performed between the client 10 and the server 12e every time the access is performed a predetermined number of times. As a result, even if the connection information leaks to another user, unauthorized access can be restricted within a predetermined number of times.

Embodiment 7 FIG. 19 is a functional block diagram showing a communication system according to Embodiment 7 of the present invention. The communication system shown in the figure is characterized in that the contents of the password table 24f and the connection information table 26f and the processing of the authentication / connection information generation program 20f are different from the communication systems according to the above embodiments. It is. The configuration of the client 10 and the server program 22 of the server 12f are the same as those of the communication system according to each of the above-described embodiments.

First, in the password table 24f of the communication system according to the present embodiment, the connection information deletion elapsed time of each user is stored in association with the user name and the password. The connection information deletion elapsed time is a set value that determines a condition for deleting the connection information stored in the connection information table 26f, and is set and input in advance by the user of the client 10 or the server 12f by an input unit (not shown).

Further, similarly to the communication system according to the third embodiment, the connection information generation time of each user is stored in the connection information table 26f of the communication system according to the present embodiment in association with the user name and the connection information. Have been. This connection information generation time indicates the time at which the connection information was generated.

On the other hand, the authentication / connection information generation program 20f of the communication system calculates the elapsed time from the connection information generation time of the connection information table 26f to the access time every time the client 10 accesses. Then, the calculated elapsed time is stored in the password table 24f.
When the value of the connection information deletion elapsed time stored in the connection information has been reached, the connection information of the user is deleted from the connection information table 26f, and the client 10 is again requested to transmit the user name and the password. On the other hand, if the calculated elapsed time has not reached the connection information deletion elapsed time stored in the password table 24f, new connection information is generated and transmitted to the client 10, and the new connection information is already recorded in the connection information table 26f. Update the connection information value that has been updated.

In the present embodiment, a third authentication suspension in which the user authentication of the client 10 by the authentication / connection information generation program 20f is temporarily stopped when a predetermined time has elapsed after the user authentication of the client 10 by the password. It also functions as a means.

The operation of the communication system having the above configuration will be described below with reference to the flowcharts shown in FIGS. Here, the flowchart shown in FIG. 20 differs from the flowchart shown in FIG. 2 in that a processing flow S700 for updating the connection information generation time of the connection information table 26f to the current time is added between S107 and S108. , And other processes are denoted by the same reference numerals as in FIG. 2 and will be described only briefly here.

First, in the flowchart shown in FIG. 20, the authentication / connection
(S101), and if the request signal does not include the connection information (S102), the user of the client 10 is authenticated with a password (S1).
03 to S105). If the user authentication with the password succeeds, the connection information is generated and registered in the connection information table 26f (S106, S107), and the value of the connection information generation time in the connection information table 26f is output from an internal clock (not shown). Is reset to the value of the current time (S700).

If the request signal received from the client 10 contains connection information (S102),
As shown in FIG. 21, user authentication of the client 10 is performed based on the connection information and the connection information table 26f (S701). If the user authentication of the client 10 using the connection information fails, the communication between the client 10 and the server 12f ends.

On the other hand, the client 10 using the connection information
If the user authentication is successful, the authentication / connection information generation program 20f then subtracts the connection information generation time stored in the connection information table 26f from the current time output from an internal clock (not shown), and The elapsed time t from the time of generation to the present is derived (S702).
Further, the authentication / connection information generation program 20f reads the connection information change elapsed time T from the password table 24f (S703), and compares the value with the elapsed time t derived in S702 (S704).

If the elapsed time t is smaller than the connection information change elapsed time T, the authentication / connection information generating program 20f generates new connection information (S705).
It is stored in the connection information table 26f to update the connection information (S706). Thereafter, access processing to the server program 22 is performed as usual (S108). On this occasion,
The connection information transmitted to the client 10 in S111 is the one newly generated in S705. The client program 16 receives the new connection information from the server 12f, and updates the old connection information already stored in the storage unit 18.

On the other hand, if the elapsed time t is equal to or greater than the connection information change elapsed time T, the authentication / connection information generation program 20f
Deletes the connection information of the client 10 from the connection information table 26f (S707). Then, the client 10 is again requested to transmit the user name and the password (S103).

According to the above-described embodiment, after a certain period of time has elapsed after the user authentication using the password is performed, the client 10 is again required to perform the user authentication using the password. That is, according to the present embodiment, user authentication using a password is performed every time a predetermined time elapses. As a result, even if the connection information leaks to another user, unauthorized access can be restricted within a predetermined time.

Embodiment 8 FIG. FIG. 22 is a functional block diagram showing a communication system according to Embodiment 8 of the present invention. The communication system shown in the figure is based on a combination of the technology of the communication system according to the sixth embodiment and the technology of the communication system according to the seventh embodiment. The contents of the password table 24g and the connection information table 26g And the processing of the authentication / connection information generation program 20g. Then, the client 10 and its internal configuration and the server program 2 of the server 12g
2 is the same as the communication system according to the first embodiment, so the same reference numerals are given here and the description is omitted.

First, in the password table 24g of the communication system according to the present embodiment, the connection information deletion count and the connection information deletion elapsed time of each user are stored in association with the user name and the password. The connection information deletion count and the connection information deletion elapsed time are set values that determine conditions for deleting the connection information stored in the connection information table 26g, and are set and input in advance by the user of the client 10 or the server 12g by input means (not shown). You.

Also, in the connection information table 26g of the communication system according to the present embodiment, the number of accesses of each user is stored in association with the user name and the connection information, as in the communication system according to the sixth embodiment. In addition, similarly to the communication system according to the seventh embodiment, the connection information generation time of each user is stored. The number of accesses is determined after new connection information is generated and stored in the connection information table 26g.
It represents the number of accesses of the client 10. The connection information generation time indicates the time at which the connection information was generated.

On the other hand, the authentication / connection information generation program 20g of the communication system increments and updates the access count value of the connection information table 26g every time the client 10 accesses. When the access count reaches the value of the connection information deletion count stored in the password table 24g, the connection information of the user is deleted from the connection information table 26g, and the client 1
Requests transmission of the user name and password to 0.

Even when the access count has not reached the connection information deletion count stored in the password table 24g, the elapsed time from the connection information generation time in the connection information table 26g to the access point is calculated. If the calculated elapsed time has reached the value of the connection information deletion elapsed time stored in the password table 24g,
The connection information of the user is deleted from the connection information table 26g, and the client 10 is again requested to transmit the user name and the password.

On the other hand, if the access count has not reached the connection information deletion count stored in the password table 24g and the elapsed time has not reached the connection information deletion elapsed time stored in the password table 24g, a new The connection information is generated and transmitted to the client 10, and the value of the connection information already recorded in the connection information table 26g is updated to a new value.

The operation of the communication system having such a configuration will be described below with reference to the flowcharts shown in FIGS. Here, the flow chart shown in FIG. 23 is a processing flow S800 for resetting the access count of the connection information table 26g to 0 between S107 and S108 in the flow chart shown in FIG. 2, and a connection information generation time of the connection information table 26g. To update the time to the current time S80
1 are added, and the other processes are denoted by the same reference numerals as in FIG. 2 and will be described only briefly here.

First, in the flowchart shown in FIG. 23, the authentication / connection
(S101), and if the request signal does not include the connection information (S102), the user of the client 10 is authenticated with a password (S1).
03 to S105). Then, if the user authentication by the password is successful, connection information is generated and registered in the connection information table 26g (S106, S107). In addition, the number of accesses in the connection information table 26g is reset to 0 (S800), and the value of the connection information generation time in the connection information table 26e is reset to the value of the current time output from an internal clock (not shown) (S801). .

When the request signal received from the client 10 includes connection information (S102),
As shown in FIG. 24, user authentication of the client 10 is performed based on the connection information and the connection information table 26g (S802). If the user authentication of the client 10 using the connection information fails, the communication between the client 10 and the server 12g ends.

On the other hand, the client 10 using the connection information
If the user authentication is successful, the authentication / connection information generation program 20g then increments the value of the number of accesses stored in the connection information table 26g and updates the value n of the number of accesses in the connection information table 26g ( S8
03). In addition, authentication / connection information generation program 20g
Reads the value K of the number of times of connection information deletion from the password table 24g (S804), and compares the value with the value of the number of times of access (S805).

If the value n of the number of accesses is smaller than the value K of the number of times of deletion of connection information, the authentication / connection information generation program 20g then proceeds to the connection information table 26g.
Is subtracted from the current time output from the internal clock (not shown), and the elapsed time t from the time when the connection information was generated to the present time is derived (S
806). In addition, authentication / connection information generation program 20g
Reads the connection information deletion elapsed time T from the password table 24g (S807), and compares the value with the value of the elapsed time t derived in S806 (S808).

If the elapsed time t is smaller than the connection information deletion elapsed time T, the authentication / connection information generation program 20g generates new connection information (S809).
It is stored in the connection information table 26g to update the connection information (S810). Thereafter, access processing to the server program 22 is performed as usual (S108). On this occasion,
The connection information transmitted to the client 10 in S111 is the one newly generated in S809. The client program 16 receives the new connection information from the server 12g and updates the old connection information already stored in the storage unit 18.

On the other hand, if the access count value n is equal to or greater than the connection information deletion count value K, or if the elapsed time t is equal to or greater than the connection information deletion elapsed time T, the authentication / connection information generation program 20g executes the connection information table. The connection information of the client 10 is deleted from 26g (S811). Then, the client 10 is again requested to transmit the user name and the password (S103).

According to the above-described embodiment, when a predetermined time has passed since the user authentication using the password, or when a predetermined number of accesses have occurred since the user authentication using the password, the client is re-established. For 10, user authentication using a password is required. As a result, even if the connection information leaks to another user, unauthorized access can be restricted within a predetermined number of times and within a predetermined time.

In the above description, the case where the access count n is equal to or greater than the connection information deletion count K or the elapsed time t
Is greater than or equal to the connection information deletion elapsed time T, the connection information is deleted. However, the access count n is equal to or greater than the connection information deletion count K, and the elapsed time t is equal to the connection information deletion elapsed time T. The connection information may be deleted only when the value is T or more.

Embodiment 9 FIG. The communication system according to the ninth embodiment of the present invention has the same configuration as the communication system according to the first embodiment, except that a part of the operation of the authentication / connection information generation program 20 is different. Specifically, the communication system according to the present embodiment
2 and 3 showing the operation of the communication system according to the second embodiment, the authentication / connection information generation program 20 executes the processing shown in the flow chart of FIG. 25 instead of the processing shown in the flow chart of FIG. is there. Thereby, in the communication system according to the present embodiment, the user of the client 10 can forcibly invalidate the connection information issued to itself.

That is, in the present embodiment, when the authentication / connection information generation program 20 receives a predetermined request signal from the client 10 to invalidate the connection information, the authentication / connection information program 20 d (authentication means) )
Also functions as a fourth authentication canceling unit for canceling the user authentication of the client 10 by the user.

The operation of the communication system having such a configuration will be described below with reference to the flowcharts shown in FIGS.

First, in the flowchart shown in FIG. 2, the authentication / connection information generation program 20 receives a request signal from the client 10 (S101), and when the request signal includes connection information (S102). 25, the user of the client 10 is authenticated based on the connection information and the connection information table 26 (S90).
1). If the user authentication of the client 10 using the connection information fails, the client 10 and the server 12
Ends communication with.

On the other hand, the client 10 using the connection information
Is successful, the authentication / connection information generation program 20 determines whether the request signal received from the client 10 includes a connection information deletion request (S90).
2). If it is included, the connection information of the user is deleted from the connection information table 26 (S903), and the communication between the client 10 and the server 12 is terminated. On the other hand, if the request signal received from the client 10 does not include the connection information deletion request, access processing to the server program 22 is performed as usual (S108).

According to the present embodiment described above, the user can forcibly invalidate the connection information by himself / herself. As a result, when the user determines that the connection information is unnecessary, the user can invalidate the connection information. Thus, unauthorized access due to impersonation can be prevented.

Embodiment 10 FIG. FIG. 26 is a functional block diagram showing a communication system according to Embodiment 10 of the present invention. The communication system shown in the figure is characterized in that the client 10 is provided with an automatic access program 28 as compared with the communication systems according to the above embodiments. The automatic access program 28 transmits the authentication / connection information generation program 20 to the client program 16
Is an execution program (applet) to be received, which automatically accesses the server 12 at regular intervals by controlling the communication function of the client program 16. Since the configurations of the client program 16 and the server are the same as those of the communication system according to each of the above-described embodiments, the same reference numerals are given and the description will be omitted.

In the present embodiment, the automatic access program 28 and the authentication / connection information generation program 2 for transmitting the automatic access program 28 to the client 10
0 is the client 1 at regular time intervals using the connection information.
It functions as a client-server access generating means for generating an access from 0 to the server 12.

The operation of the communication system having the above configuration will be described below with reference to the flowcharts shown in FIGS. 27 and 28. Here, the flowchart illustrated in FIG. 27 is obtained by adding a processing flow S112 of transmitting the automatic access program 28 to the client 10 after S111 in the flowchart illustrated in FIG. 2. The same reference numerals are given, and only a brief description is given here.

As shown in FIG. 27, first, in the server 12, if the connection signal is not included in the request signal received from the client 10, the authentication / connection information generation program 20 sends the user and password to the client 10. Is requested (S103). Client 1
If the user name and password are received from 0 (S10)
4) Next, the authentication / connection information generation program 20 performs user authentication of the client 10 based on the received user name and password and the password table 24. If the authentication / connection information generation program 20 succeeds in the user authentication of the client 10 by the password table 24 (S105), it generates connection information (S10).
6) The connection information is additionally recorded in the connection information table 26 together with the user name (S107). Next, the authentication / connection information generation program 20 transmits user information such as a user name to the server program 22 (S10).
8) A request signal for acquiring server information is transmitted (S109). Then, the authentication / connection information generation program 20 transmits the connection information generated in S106 to the client 1
0 (S110), and transmits the server information received from the server program 22 to the client 10 (S111). If the client program 16 has not received the automatic access program 28 when receiving the server information, it requests the server 12 to transmit the automatic access program 28. In contrast,
The server 12 transmits the requested automatic access program 28 to the client 10 (S112). For example,
In the WWW system, the client program 1
When the hypertext that is the server information includes tag information indicating that an applet should be obtained from the server 12, the applet that is the automatic access program 28 is obtained from the server 12 according to the tag information.

The automatic access program 28 accesses the server 12 at regular intervals by controlling the communication function of the client program 16. At this time, the automatic access program 28 sends a request signal for requesting server information to the client 12 together with a request signal. The connection information stored in the memory 10 is transmitted to the server 12.

When the server 12 receives the request signal accompanied by the connection information from the automatic access program 28,
The authentication / connection information generation program 20 performs user authentication of the client 10 using the connection information table 26 (S
1001). If the user authentication of the client 10 fails, the communication between the client 10 and the server 12 ends. On the other hand, the authentication / connection information generation program 2
0, if the user authentication of the client 10 by the connection information table 26 succeeds, new connection information is generated (S
1002) The new connection information is overwritten and stored in the connection information table 26 in order to update the connection information (S100).
3).

According to the present embodiment described above, the access between the client 10 and the server 12 occurs at regular time intervals by the automatic access program 28.
For example, by updating the connection information at each access, the possibility of wiretapping of the connection information can be reduced, and even if the connection information is leaked, the unauthorized access by the connection information can be suppressed. it can.

The communication system described above can be variously modified. For example, by combining the technology of the communication system according to the fifth embodiment, the client 1
If there is an access from 0, it is also possible to delete the connection information of the client 10 from the connection information table 26 and request the user again for the user name and password. Also, if a certain period of time has passed since the last access time,
The connection information of the user may be automatically deleted from the connection information table 26. In any case, if a certain time or more has passed since the last access time, if the user is again authenticated with a user name and a password, unauthorized access such as impersonation can be prevented more reliably.

In the communication system described above, the automatic access program 28 is transmitted from the server 12 to the client 10. In a WWW system, for example, a hypertext (server information) transmitted from the server 12 to the client 10 is transmitted. ) Includes tag information indicating that the same hypertext is to be acquired again after a predetermined time, while the client 10 interprets the tag information and outputs the same hypertext as the hypertext received immediately before after a predetermined time. You may make it acquire from the server 12 again. Even in this case, access between the client 10 and the server 12 can be generated at predetermined time intervals, and unauthorized access such as spoofing can be prevented.

Embodiment 11 FIG. FIG. 29 is a functional block diagram showing a communication system according to Embodiment 11 of the present invention. The communication system shown in FIG.
Client program 16 and the client program 16
a, and the automatic access program 28 uses the communication function of the client program 16a to communicate with the server 12
It is characterized in that it automatically accesses Other configurations are the same as those of the communication system according to each of the above-described embodiments, and therefore, the same reference numerals are given here, and description thereof will be omitted.

FIGS. 30 and 28 are flow charts for explaining the operation of the communication system according to the present embodiment. Here, the flow chart shown in FIG. 30 is different from the flow chart shown in FIG. 27 in that a processing flow S113 of transmitting the automatic access program 28 to the client 10 after S111 and transmitting an activation instruction of the client program 16a to the client 10 is added. The other processes are denoted by the same reference numerals as in FIG. Also, S1
02, when the authentication / connection information generation program 20 determines that the connection information is not included in the request signal received from the client 10, the authentication / connection information generation program 20 executes the processing shown in the flowchart of FIG. Migrate.

As shown in these figures, the authentication / connection information generation program 20 of the server 12 determines whether the user authentication of the client 10 by the password table 24 has succeeded (S105), or the user of the client 10 by the connection information table 26. If the authentication is successful (S10
01), the requested server information is transmitted to the client 10 (S111), and at this time, the automatic access program 28 and the activation instruction of the client program 16a are transmitted to the client 10 (S113). Then, in the client 10, these automatic access programs 2
8 and the start instruction of the client program 16a, the client program 16 starts the client program 16a, and the received automatic access program 28 is transmitted to the client program 16a.
Execute as a child process of a. Then, after a predetermined time, the automatic access program 28 transmits to the server 12 a request signal indicating that the client program 16 requests the same server information as the server information received immediately before using the communication function of the client program 16a. I do.

When the server 12 receives the request signal accompanied by the connection information from the automatic access program 28,
The authentication / connection information generation program 20 performs user authentication of the client 10 using the connection information table 26 (S
1001). If the user authentication of the client 10 fails, the communication between the client 10 and the server 12 ends. On the other hand, the authentication / connection information generation program 2
0, if the user authentication of the client 10 by the connection information table 26 succeeds, new connection information is generated (S
1002) The new connection information is overwritten and stored in the connection information table 26 in order to update the connection information (S100).
3).

According to the present embodiment described above, the client program actually operated by the user can be separated from the client program used for automatic access by the automatic access program 28. As a result, the user can operate the automatic access program by the automatic access. Locking of the client program to be locked can be prevented. Therefore, according to the present embodiment, for example, when the user wants to transmit a new request signal to the server 12 requesting other server information, the automatic access program 28 uses the client program 16 and immediately It is possible to avoid the situation that transmission cannot be performed.

Embodiment 12 FIG. FIG. 31 is a functional block diagram showing a communication system according to Embodiment 12 of the present invention. The communication system shown in the figure is different from the communication system according to the first embodiment in that the client 10 is provided with the encryption program 30 and the authentication / connection information generation program 20h is encrypted by the encryption program 30. Is characterized in that it has a function of decoding. Here, the encryption program 30 is a program for encrypting a user name and a password when transmitting the user name and the password to the server 12. That is, in the present embodiment, the authentication / connection information generation program 20h
When an encrypted password is transmitted from the client 10, it also functions as a decryption unit for decrypting the password. The other configuration is the same as that of the communication system according to the first embodiment.

FIGS. 32 and 3 are flowcharts for explaining the operation of the communication system according to the present embodiment. here,
The flowchart shown in FIG. 32 is different from the flowchart shown in FIG. 2 in that a processing flow S120 for receiving a user name and a password encrypted by the encryption program 30 instead of S104.
0, and a processing flow S1201 for decrypting the user name and the password is added. Other processes are denoted by the same reference numerals as those in FIG. Further, in S102, if the authentication / connection information generation program 20h of the server 12 determines that the request signal received from the client 10 does not include the connection information, the authentication / connection information generation program 20h shown in FIG. The processing shifts to the flowchart of FIG.

In these figures, if the connection information is not included in the request signal received from the client 10,
The authentication / connection information generation program 20h of the server 12 transmits a signal requesting a user name and a password to the client 10 (S103). On the other hand, in the client 10, the client program 16 encrypts the user name and the password using the encryption program 30. Then, the client program 16 sends the encrypted user name and password to the server 12.

When the encrypted user name and password are received (S1200), the authentication / connection information generation program 20h of the server 12 performs a decryption process on the information to obtain the user name and password (S1200). S120
1). And these information and the password table 24
Is used to perform user authentication of the client 10 (S1).
05).

According to the present embodiment described above, since the user name and the password used as the first-stage authentication information can be transmitted and received after being encrypted, the leakage of the password can be more reliably prevented.

The communication system according to the present embodiment described above can be variously modified. For example, in the above description, both the user name and password of the client 10 are encrypted by the encryption program 30, but only the password may be encrypted.

[0141]

According to the present invention, when the user authentication using the password is successful, the user authentication based on the connection information can be performed thereafter, so that the chance of transmitting the password over the network can be reduced. The possibility of unauthorized access due to password leakage can be reduced.

According to the present invention, the connection information is updated when the same connection information is received from the client a predetermined number of times or more, or when a predetermined time has elapsed since the generation of the connection information. In the event that the eavesdropping is performed, it is possible to seize the opportunity of unauthorized access using the connection information.

Further, according to the present invention, 1) when there is no access from the same client again after a lapse of a predetermined time from the time of the previous access, 2) after the user authentication with a password, the client is not less than a predetermined number of times. 3) When a predetermined request signal indicating that connection information should be invalidated is received from a client when an access is made from the client or when a predetermined time has elapsed, the generated connection information is invalidated. The possibility of eavesdropping on the connection information can be reduced, and even when the connection information is eavesdropped, an opportunity for unauthorized access using the connection information can be deprived.

Further, according to the present invention, the client accesses the server using the connection information at regular intervals, so that the connection information can be updated without waiting for the access by the user. Thereby, the possibility of connection information leakage can be reduced. At this time, according to the present invention, the client accesses the server at regular time intervals using the connection information in a process different from the process of the main client, so that the operation of the process of the main client is performed. Can be secured.

Furthermore, according to the present invention, when a password is transmitted from a client to a server, it can be transmitted and received after being encrypted, so that leakage of the password can be prevented.

[Brief description of the drawings]

FIG. 1 is a functional block diagram showing a communication system according to a first embodiment of the present invention.

FIG. 2 is a flowchart illustrating an operation of the communication system according to the first embodiment of the present invention.

FIG. 3 is a flowchart illustrating an operation of the communication system according to the first embodiment of the present invention.

FIG. 4 is a functional block diagram showing a communication system according to a second embodiment of the present invention.

FIG. 5 is a flowchart illustrating an operation of the communication system according to the second embodiment of the present invention.

FIG. 6 is a flowchart illustrating an operation of the communication system according to the second embodiment of the present invention.

FIG. 7 is a functional block diagram showing a communication system according to a third embodiment of the present invention.

FIG. 8 is a flowchart illustrating an operation of the communication system according to the third embodiment of the present invention.

FIG. 9 is a flowchart illustrating an operation of the communication system according to the third embodiment of the present invention.

FIG. 10 is a functional block diagram showing a communication system according to a fourth embodiment of the present invention.

FIG. 11 is a flowchart illustrating an operation of the communication system according to the fourth embodiment of the present invention.

FIG. 12 is a flowchart illustrating an operation of the communication system according to Embodiment 4 of the present invention.

FIG. 13 is a functional block diagram showing a communication system according to Embodiment 5 of the present invention.

FIG. 14 is a flowchart illustrating an operation of the communication system according to the fifth embodiment of the present invention.

FIG. 15 is a flowchart illustrating an operation of the communication system according to the fifth embodiment of the present invention.

FIG. 16 is a functional block diagram showing a communication system according to Embodiment 6 of the present invention.

FIG. 17 is a flowchart illustrating an operation of the communication system according to the sixth embodiment of the present invention.

FIG. 18 is a flowchart illustrating an operation of the communication system according to the sixth embodiment of the present invention.

FIG. 19 is a functional block diagram showing a communication system according to Embodiment 7 of the present invention.

FIG. 20 is a flowchart illustrating an operation of the communication system according to the seventh embodiment of the present invention.

FIG. 21 is a flowchart illustrating an operation of the communication system according to the seventh embodiment of the present invention.

FIG. 22 is a functional block diagram showing a communication system according to Embodiment 8 of the present invention.

FIG. 23 is a flowchart illustrating an operation of the communication system according to the eighth embodiment of the present invention.

FIG. 24 is a flowchart illustrating an operation of the communication system according to the eighth embodiment of the present invention.

FIG. 25 is a flowchart illustrating an operation of the communication system according to Embodiment 9 of the present invention.

FIG. 26 is a functional block diagram showing a communication system according to Embodiment 10 of the present invention.

FIG. 27 is a flowchart illustrating an operation of the communication system according to Embodiment 10 of the present invention.

FIG. 28 is a flowchart illustrating an operation of the communication system according to Embodiment 10 of the present invention.

FIG. 29 is a functional block diagram showing a communication system according to Embodiment 11 of the present invention.

FIG. 30 is a flowchart illustrating an operation of the communication system according to Embodiment 11 of the present invention.

FIG. 31 is a functional block diagram showing a communication system according to Embodiment 12 of the present invention.

FIG. 32 is a flowchart illustrating an operation of the communication system according to Embodiment 12 of the present invention.

[Explanation of symbols]

10 clients, 12, 12a to 12g servers,
14 communication means, 16, 16a client program, 18 storage means, 20, 20a-20h authentication / connection information generation program, 22 server program, 24,
24a-24g Password table, 26, 26a-
26g connection information table, 28 automatic access program, 30 encryption program.

Claims (13)

[Claims] A connection information transmitting means for generating and transmitting connection information to a client that has successfully authenticated a user with a password in a server that returns server information corresponding to a request signal transmitted from the client to the client; Connection information storage means for storing connection information to be transmitted to the client by the connection information transmission means; and when connection information associated with a request signal is received from the client, the connection information and the connection information are stored in the connection information storage means. An authentication unit for performing user authentication of the client based on the connection information, and, if the authentication unit succeeds in authenticating the user of the client, server information corresponding to the request signal associated with the connection information to the client. A server comprising: a server information returning unit that returns a response. 2. When the same connection information is received a predetermined number of times or more from a client, new connection information is generated and transmitted to the client, and the new connection information is stored in the connection information storage means. 2. The server according to claim 1, further comprising a connection information updating unit. 3. When a predetermined time has elapsed from the generation of the connection information by the connection information transmitting means, new connection information is generated and transmitted to the client, and the new connection information is stored in the connection information storage means. 3. The server according to claim 1, further comprising a second connection information updating unit for storing. 4. A first authentication stopping means for temporarily stopping the client user authentication by the authentication means when there is no access from the same client again even if a predetermined time has elapsed from the time of the previous access. The server according to any one of claims 1 to 3, wherein: 5. A second authentication stopping means for temporarily stopping the client authentication by the authentication means when the client has been accessed by the password more than a predetermined number of times after the user authentication of the client by the password. The server according to any one of claims 1 to 4, wherein: 6. The method according to claim 1, further comprising a third authentication canceling unit for temporarily canceling the user authentication of the client by the authentication unit when a predetermined time has elapsed after the user authentication of the client by the password. 6. The server according to any one of 1 to 5. 7. A method according to claim 7, further comprising: a fourth authentication canceling unit for canceling the user authentication of the client by the authentication unit when a predetermined request signal for invalidating the connection information is received from the client. Claims 1 to 6
The server according to any one of the above. 8. The server according to claim 1, further comprising a client-server access generating means for generating a client-to-server access at predetermined time intervals using the connection information. 9. The client-server access generating means includes an execution module transmitting means for transmitting an execution module for controlling the client so that the client accesses the server using the connection information at regular time intervals. 9. The server according to claim 8, wherein: 10. The server information is hypertext information, and the client-server access generating means includes tag information indicating that access to a server using connection information should be performed after a predetermined time. 9. The server according to claim 8, wherein: 11. The server according to claim 1, further comprising a decryption unit that decrypts the encrypted password when the encrypted password is transmitted from the client. 12. A server access control method for returning server information corresponding to a request signal transmitted from a client to the client, wherein the connection information is generated and transmitted to a client that has successfully authenticated a user with a password. A connection information transmitting step, a connection information storing step of storing connection information to be transmitted to the client in the connection information transmitting step, and, when receiving connection information associated with a request signal from the client, the connection information and the connection An authentication step for performing user authentication of the client based on the connection information stored in the information storage step; and, when the user authentication of the client is successful in the authentication step, a request signal associated with the connection information. Server information reply switch that returns server information to the client Server access control method characterized by comprising Tsu and up, the. 13. An information recording medium recording a program for causing a computer to operate as a server for returning server information corresponding to a request signal transmitted from a client to the client, wherein the user authentication with a password is successful. A connection information transmitting step of generating and transmitting connection information to the client, a connection information storing step of storing connection information transmitted to the client in the connection information transmitting step, and a connection information associated with a request signal from the client. When receiving, based on the connection information and the connection information stored in the connection information storage step, an authentication step of performing client user authentication, and, if the client user authentication is successful in the authentication step, the Corresponding to the request signal associated with the connection information Information recording medium characterized by recording a program for executing the server information reply step of replying the server information to the client, to the computer.