JP2000322381A - Device and method for controlling homepage access - Google Patents

Abstract

PROBLEM TO BE SOLVED: To change authentication types in each prescribed group such as a homepage content by providing an authentication allowance information storing part in which an access control ID and an authentication type are associated and stored. SOLUTION: In an authentication server part 112, an authentication deciding part 115 receives authentication information, an access control ID and an authentication client ID transmitted from an authentication client part 110 and detects an authentication type corresponding to a user ID, the access control ID and the authentication client ID included in the authentication information from an authentication allowance information storing part 114. The part 114 stores authentication allowance information obtained by making the access control ID correspond to the authentication type used for authentication processing. Grouping is performed by combining the user ID, the authentication client ID and the access control ID, and authentication types can be changed in accordance with the group.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a homepage access control device comprising a WWW server for publishing a homepage, a user terminal for accessing the homepage, and an authentication server for authenticating a user for accessing the homepage. The present invention relates to a homepage access control method using the homepage access control device.

[0002]

2. Description of the Related Art FIG. 10 is, for example, issued by Nikkei BP.
FIG. 1 is a configuration diagram showing a homepage access control device based on a conventional WWW system shown on pages 278 to 290 of “Complete Intranet Construction Guide” (1996), edited by NEC Intranet Project.

In FIG. 10, reference numeral 101 denotes a user terminal unit;
102 is a WWW browser, 1001 is a WWW server unit 1
06 from the WWW server unit 106 to the user terminal unit 101 to access the private information (homepage)
The user authentication page 1002 is downloaded from the WWW server 106 according to the result of the authentication.
Reference numeral 03 denotes an access control processing unit for controlling access to non-public information (homepage) on the WWW server unit 106; 1004, a non-public information (homepage) storage unit;
Reference numeral 005 denotes an authentication processing unit for authenticating the user, 1006 denotes a user management information storage unit that holds pre-registered authentication information required for user authentication, and 1007 denotes non-public information published as the reply homepage 1002. Other non-public information (homepage) linked from (homepage)
Is a link part that displays.

Next, the operation will be described. User is WW
When accessing the private information (homepage) on the W server unit 106, first, a user authentication page 1001 for performing user authentication is downloaded to the user terminal unit 101 and displayed on the WWW browser 102. The user inputs predetermined authentication information such as a user ID and a password to the user authentication page 1001,
The information is transmitted to the WW server unit 106. WWW server unit 106
Then, the access control processing unit 1003 receives the authentication information transmitted from the user terminal unit 101, and requests the authentication processing unit 1005 to authenticate the user.

[0005] The authentication processing unit 1005 collates authentication information such as a user ID and password registered in advance in the user management information storage unit 1006 with authentication information transmitted from the user terminal unit 101. The user is authenticated, and the authentication result is sent to the access control processing unit 1003. The access control processing unit 1003 determines that the authentication result is
In the case of K, the above-mentioned private information (homepage) intended by the user is sent to the WWW browser 102, and the authentication NG
In the case of, information such as an error message is sent to the WWW browser 1
02 and displayed as a reply homepage 1002. Here, a token indicating authentication is set in the reply homepage 1002. When the above user follows the link of the non-public information (homepage) displayed as this reply homepage and refers to the next non-public information (homepage), the token and the next non-public information intended by the user (Homepage) designation information is sent to the link unit 1007. The link unit 1007 checks the validity of the token, and if it is valid, sends the designated non-public information (homepage) as a return homepage to the browser 102 for display.

As described above, in the conventional homepage access control apparatus and control method using the WWW system, when the user accesses the non-public information on the WWW server section, the user transmits the user's private information transmitted from the user terminal section. By authenticating the user by comparing the authentication information with authentication information registered in the user management information storage unit in advance, it is possible to perform control to limit the users who can open the information.

[0007]

However, in the conventional homepage access control, since the authentication processing unit performs authentication using a predetermined authentication type, for example, authentication is performed according to the contents of non-public information (homepage). There was a problem that the type of can not be changed.

Further, once the authentication is performed and the non-public information (homepage) is accessed, the next non-public information (homepage) linked from the non-public information (homepage) is changed to the non-public information (homepage). Regardless of the contents of the (homepage), there is a problem that access is possible without performing new authentication.

The present invention has been made to solve the above-described problems. For example, it is possible to change the type of authentication for each predetermined group such as the contents of a home page, and to access a home page with high security. It is an object to obtain a control device and a homepage access control method.

[0010]

SUMMARY OF THE INVENTION A homepage access control device according to the present invention comprises a WW for opening a homepage.
What is claimed is: 1. A homepage access control device comprising a W server unit, a user terminal unit accessing the homepage, and an authentication server unit performing authentication of a user accessing the homepage, wherein the user terminal unit is a WWW displaying the homepage. A browser, an authentication information acquisition unit that acquires the authentication information of the user, an authentication screen processing unit that sends the authentication information acquired by the authentication information acquisition unit and the page ID of the homepage desired by the user to the WWW server unit. A WWW server unit, wherein the WWW server unit is grouped into a predetermined group, and stores a plurality of homepages that are open only to specific users.
A non-disclosed homepage management information storage unit in which the page IDs of the plurality of homepages and the access control IDs of the groups to which the homepages respectively belong are stored in association with each other; Receiving the page ID of the homepage and the authentication information of the user, detecting the access control ID associated with the page ID of the homepage desired by the user from the closed homepage management information storage unit,
The detected access control ID and the authentication information of the user are sent to the authentication server unit to make an authentication request, and when the authentication result is OK, the homepage desired by the user is detected from the closed homepage storage unit. An authentication unit for sending to the user terminal, an authentication server unit, a personal information storage unit in which authentication information registered in advance of the user is stored, an access control ID and authentication used for authentication processing. And the access control ID and the user authentication information sent from the WWW server unit, and the access control ID is received from the authentication permission information storage unit. The type of authentication associated with the ID is detected, and the authentication information of the user corresponding to the detected type of authentication is detected from the personal information storage unit. Out, and the detected authentication information and by comparing the authentication information received from the WWW server section authentication decision, in which the authentication result and a authentication determination unit for sending to the WWW server section.

In the homepage access control apparatus according to the next invention, the access unit of the WWW server unit transmits an access control ID of a group to which the homepage belongs to the user terminal when sending the homepage to the user terminal. The user terminal unit is configured to transmit the page ID of the next homepage desired by the user linked to the homepage transmitted from the access unit and the access control I transmitted from the access unit.
And D to the WWW server unit,
Further, the WWW server unit receives the page ID of the next homepage and the access control ID sent from the user terminal unit, and receives the page ID of the next homepage from the closed homepage management information storage unit.
Is detected, and the detected access control ID is compared with the access control ID sent from the user terminal unit. If the access control ID matches, the next homepage is stored in the closed homepage storage unit. And an authentication link section for detecting the above and sending it to the user terminal section.

Further, a homepage access control method according to the next invention comprises a WWW server unit for publishing a homepage, a user terminal unit for accessing the homepage, and an authentication server unit for authenticating a user for accessing the homepage. A homepage access control method using a homepage access control device, comprising displaying the homepage on the user terminal unit.
A browser step, an authentication information obtaining step of obtaining the user authentication information, and an authentication screen processing step of transmitting the authentication information obtained in the authentication information obtaining step and the page ID of the homepage desired by the user to the WWW server unit. And a WWW receiving step of receiving, by the WWW server unit, the page ID of the homepage desired by the user and the authentication information of the user sent from the user terminal unit. The page ID of the homepage desired by the user is stored from a private homepage management information storage unit in which the page IDs of a plurality of homepages opened to the user only and the access control IDs of the groups to which the homepages belong are stored in association with each other. The above access system associated with A WWW detecting a ID, access control I detected in the WWW detecting step
An authentication requesting step of sending D and the user's authentication information to the authentication server unit to request authentication; and detecting the user's desired homepage from the closed homepage storage unit when the authentication result is authentication OK. Executing a WWW sending step of sending to the user terminal by using the authentication server unit. The authentication server unit receives the access control ID and the user authentication information sent from the WWW server unit. The authentication type corresponding to the access control ID received in the authentication receiving step is detected from the authentication permission information storage unit in which the ID and the type of authentication used for the authentication process are stored in association with each other, and The user according to the type of authentication detected from the personal information storage unit in which authentication information registered in advance is stored. An authentication detecting step of detecting the authentication information; an authentication determining step of comparing the authentication information detected in the authentication detecting step with the authentication information received from the WWW server unit to determine the authentication; and determining an authentication result of the authentication determining step. And an authentication sending step for sending to the WWW server unit.

[0013]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiment 1 Hereinafter, a first embodiment of a homepage access control device and a homepage access control method according to the present invention will be described. FIG. 1 is a configuration diagram illustrating a configuration of the homepage access control device according to the first embodiment. In FIG. 1, reference numeral 101 denotes a user terminal unit for a user to access a homepage. 10
Reference numeral 2 denotes a WWW browser for displaying the homepage. Reference numeral 103 denotes an authentication page which is downloaded from the WWW server unit 106 to the user terminal unit 101 and displayed on the WWW browser 102 in order to access a home page opened only to a specific user. Is set to a page ID corresponding to a closed homepage that the user wants to access. Reference numeral 105 denotes an authentication information acquisition unit that acquires the authentication information of the user. The authentication information acquisition unit 105 includes, for example, a keyboard, a fingerprint reader, and the like, and acquires user ID, password, and authentication information of fingerprint information. Reference numeral 104 denotes an authentication screen processing unit defined in the authentication page 103 and downloaded from the WWW server unit 106 to the user terminal unit 101. The authentication screen processing unit 104 stores the authentication information acquired by the authentication information acquisition unit 105 and the homepage desired by the user. The page ID and the page ID are sent to the WWW server unit 106 described later.

Reference numeral 106 denotes a WW for publishing the homepage.
It is a W server unit. Reference numeral 107 denotes a non-disclosed homepage storage unit that stores a plurality of homepages that are grouped into a predetermined group and are open to only specific users. The homepage is, for example, an electronic file. 109 is a page ID of each of the plurality of homepages and an access control I of a group to which each of the homepages belongs.
D is a closed homepage management information storage unit stored in association with the homepage. Here, the path name where the homepage exists is stored in the closed homepage storage unit 107 in association with the page ID of the homepage. Have been.

[0018] 108 receives the page ID of the user-desired homepage and the authentication information of the user sent from the authentication screen processing unit 104 of the user terminal unit 101, and stores the user ID from the private homepage management information storage unit 109. The access control ID associated with the page ID of the desired homepage is detected, and the detected access control ID and the authentication information of the user are sent to an authentication client unit 110 described later, and an authentication request is made. If the authentication is OK, the path name associated with the page ID is detected from the private homepage management information storage unit 109, and the user-desired homepage is stored from the private homepage storage unit 107 according to the detected path name. Private website access that detects and sends to the above user terminal A processing unit. Further, here, when the homepage is sent to the user terminal 101, a token for guaranteeing the authentication including the access control ID of the group to which the homepage belongs is sent to the user terminal 101.

An access server 110 receives the access control ID and the user authentication information sent from the closed homepage access processing unit and sends the access control ID, the user authentication information and the authentication client ID to an authentication server unit 112 described later. The authentication client unit sends a request for authentication, receives the authentication result from the authentication server unit 112, and sends it to the closed homepage access processing unit 108. The authentication client ID is an ID for identifying the authentication client unit. For example, when there are a plurality of WWW server units, there are a plurality of the authentication client units.
W servers can be distinguished and effective. Further, in the present embodiment, an access unit is constituted by the above-mentioned closed homepage access processing unit 108 and the above-mentioned authentication client unit 110.

[0018] 111 receives the page ID of the next homepage sent from the user terminal unit 101 and the token including the access control ID, and receives the next homepage page from the closed homepage management information storage unit 109. Access control I associated with ID
D is detected, the detected access control ID is compared with the access control ID included in the token sent from the user terminal unit 101, and the validity of the token is determined. A path name associated with the page ID is detected from the private homepage management information storage unit 109, and the next homepage is detected from the private homepage storage unit 107 according to the detected path name, and the user terminal unit This is an authentication link unit to be sent to 101.

Reference numeral 112 denotes an authentication server unit for authenticating a user accessing the home page. A personal information storage unit 113 stores user information including authentication information registered in advance of the user. An authentication permission information storage unit 114 stores the access control ID and the type of authentication used for the authentication process in association with each other. W above
The access control ID and the authentication information of the user sent from the authentication client unit 110 of the WW server unit 106 are received, and the type of authentication associated with the access control ID is detected from the authentication permission information storage unit 114. Detecting authentication information of the user corresponding to the type of authentication detected from the personal information storage unit 113, and comparing the detected authentication information with authentication information received from the authentication client unit 110 to perform authentication determination. And an authentication determination unit that sends the authentication result to the authentication client unit 110.

Next, the operation of the homepage access control device and the homepage access control method will be described. When a user accesses a desired homepage that is opened only to a specific user, for example, the user terminal unit 1
When a predetermined URL is input to 01, an authentication page 103 in which a page ID corresponding to the homepage desired by the user is set is downloaded from the WWW server unit 106 to the user terminal unit 101. Then, the authentication image processing unit 104 defined in the authentication page 103 is called WWW.
An authentication screen is displayed on the browser 102.

FIG. 2 is an example of a screen displayed by the authentication screen processing unit 104. On the screen of FIG. 2, the user can select a user ID, a password, fingerprint information (one finger), and fingerprint information (two fingers) as authentication information.

The user can use the WWW browser 102
Check the authentication screen displayed in, select the required authentication items, and enter the authentication information. For example, the user ID and the password are input from a keyboard, and the fingerprint information is input by pressing an acquisition button of the authentication screen displayed by the authentication screen processing unit 104. Also, for example, the authentication information acquisition unit 10
The user I is connected to the IC card reader connected to
The authentication information is input by reading an IC card on which D, a password, fingerprint information, and the like are recorded.

In response to the user's input operation, the authentication information acquisition unit 105 acquires the user's authentication information (authentication information acquisition step). For example, a key code input from the keyboard is obtained as user ID and password authentication information. In addition, a sensor of the fingerprint reader installed at the position of the acquisition button of the authentication screen processing unit 104 acquires the user's press as fingerprint information. Still further, the IC card reader reads the user ID, password, and the like stored in the user's IC card.
The fingerprint information and the like are read and acquired as authentication information.

Thereafter, when the user presses the send button displayed on the authentication screen, the authentication screen processing unit 1
04 sends the authentication information acquired by the authentication information acquiring unit 105 and the page ID set in the authentication page 103 to the private page access processing unit 108 on the WWW server unit 106 (authentication screen) Processing steps). Then, the private page access processing unit 10
8 receives the authentication information and the page ID, and starts an authentication process.

The detailed operation and processing of the secret document access processing unit 108 will be described with reference to FIGS. 1, 3 and 4.

FIG. 3 shows an example of data stored in the private homepage management information storage unit 109. In FIG. 3, reference numeral 301 denotes a page ID for identifying a home page. Reference numeral 302 denotes an access control ID for identifying a group to which a home page belongs. Here, the home pages are grouped according to the content. 303 is a place (path name) where the home page exists. In FIG. 3, the page ID, access control ID, and path name of each of the five homepages are stored. FIG. 4 is a flowchart showing the operation of the closed homepage access processing unit 108.

The private document access processing unit 108 first receives the user authentication information sent from the authentication screen processing unit 104 and the page ID of the private web page desired by the user (step 401, WWW receiving step). . Then, the access control ID associated with the received page ID is detected and acquired from the private website management information storage unit 109 (step 40).
2. WWW detection step). Next, this access control ID
And the authentication information of the user are sent to the authentication client 110 to request an authentication process (step 403, authentication requesting step).

Then, it is determined whether the authentication result sent from the authentication client 110 is OK (step 404). If the authentication result is “authentication OK”, the closed homepage management information storage unit 109 detects the path name where the homepage associated with the page ID exists,
According to the detected path name, the homepage is detected from the private webpage storage unit 107 and the WWW browser 10
2 sends the home page (Step 405, W
WW sending step). On the other hand, if the authentication result is not OK, that is, if the authentication is NG, a home page for an error message is sent to the WWW browser 102 (step 406). As described above, when the authentication is successful, the private web page desired by the user is set to WWW.
Although the message is displayed on the browser 102 (WWW browser step), if the authentication fails, an error message such as an authentication error or an authentication method error is displayed on the WWW browser 102, and the user cannot access the private website. Can not.

Next, the detailed operation and processing of the authentication processing will be described with reference to FIGS. 1, 5 and 6. FIG. 5 is an example of personal information including authentication information stored in the personal information storage unit 112. In FIG. 5, a user ID, a password, information of one fingerprint, and information of two fingerprints are stored as authentication information, and personal information such as a personal name, affiliation, and contact information are also stored. Here, the user ID is a key of the personal information.

FIG. 6 shows an example of the authentication permission information in which the access control ID stored in the authentication permission information storage unit 114 is associated with the type of authentication used in the authentication processing. In addition, a user ID and an authentication client ID are stored, and the type of authentication used for authentication is determined according to a combination of the access control ID, the user ID, and the authentication client ID.

In FIG. 6, reference numeral 601 denotes a user ID of a user accessing a private website, 602 denotes an authentication client ID for identifying the authentication client unit 110,
Reference numeral 603 denotes an access control ID for identifying the group of the homepage desired by the user. Reference numeral 604 denotes an authentication means when the user of the user ID authenticates the access right to the access control ID with the authentication client of the authentication client ID, ie, the type of authentication. Is a remark.

In the example of FIG. 6, when user1 accesses JINJI1 with Aclient, the user ID and one fingerprint are used for authentication. When user1 accesses KEIRI1 with Aclient, the user ID is used. Authentication with password information is defined. That is, in this example, user I
D601, the authentication client ID 602, and the access control ID 603 are combined into a group, and the type of authentication can be changed according to the group.

First, the authentication determining unit 115 receives the authentication information, the access control ID, and the authentication client ID sent from the authentication client unit 110 (authentication receiving step), and
From 4, the type of authentication corresponding to the user ID, the access control ID, and the authentication client ID included in the authentication information is detected. The authentication information corresponding to the type of authentication detected from the authentication permission information storage unit 114 is stored in the personal information storage unit 113 using the user ID as a key.
(Authentication detection step). Next, the authentication information detected from the personal information storage unit 113 is compared with the authentication information received from the authentication client unit 110, and the user is authenticated (authentication determination step). It is sent to the unit 110 (authentication sending step). Here, the personal information storage unit 113
Authentication information detected from the authentication client unit 110
If the received authentication information matches, authentication OK is sent as the authentication result, and if they do not match, authentication NG is sent.

Next, the overall operation of the WWW apparatus will be described. FIG. 7 is a sequence diagram illustrating an overall flow of the authentication process. First, when a user inputs a URL corresponding to the desired homepage into the user terminal unit 101 in order to access a desired homepage that is disclosed only to a specific user, the WWW server unit 106 responds to the user's desired homepage. The page ID to be authenticated and the authentication page 103 set by the authentication image processing unit 104 are sent to the user terminal unit 101.

Thereafter, the authentication screen processing section 104 stores the authentication information input by the user and the authentication page 10
The page ID corresponding to the user-desired home page set in No. 3 is transmitted to the closed home page access processing unit 108 (sequence 701). Then, the private website access processing unit 108 detects the access control ID for the page ID from the private website management information storage unit 109, and
D and the authentication information input by the user are sent to the authentication client 110, and authentication is requested (sequence 7).
02).

The authentication client unit 110 requests authentication from the authentication determination unit 115 in accordance with the authentication protocol, and corresponds to the access control ID and the authentication information sent from the closed homepage access processing unit 108 and the authentication client unit 110. Authentication client ID
Is sent to the authentication determination unit 115 (sequence 703).
The authentication determination unit 115 performs authentication using the information of the personal information storage unit 113 and the authentication permission information storage unit 114, and determines the authentication result of authentication OK or authentication NG.
0 (sequence 704).

The authentication client unit 110 that has received the authentication result further sends the result to the closed homepage access processing unit 108 (sequence 70).
5). The private website access processing unit 108
Sends a homepage for an error message to the WWW browser 102 if the authentication result is authentication NG,
If the authentication result is OK, the private path management information storage unit 109 detects the existence path name of the home page corresponding to the page ID, and the private home page storage unit 107 detects the home page according to the path name. Send to 102. At this time,
In order to access the next homepage linked from this homepage, a token including the access control ID for guaranteeing authentication is set in this homepage (sequence 706).

Next, the detailed operation and processing of the authentication link unit 111 will be described with reference to FIG. FIG. 8 is a flowchart showing a detailed operation of the authentication link unit 111. After the authentication is OK as described above and the homepage desired by the user is displayed on the WWW browser 102,
When the user accesses the next homepage linked from the homepage desired by the user, the authentication link unit 111 sets the token set in the displayed homepage sent from the WWW browser 102 as an access request, A page ID corresponding to the next homepage desired by the user is received. (Step 801).

The authentication link unit 111 decrypts the encrypted token and checks the validity of the token (step 802). The token includes, for example, information such as the time at which the authentication was previously successful, the access control ID at which the authentication was successful, and a fixed value for validity determination.
When the information is determined to be valid, the validity of the token is satisfied.

Next, the authentication link unit 111 determines whether the token is valid (step 80).
3) If the token is invalid, a home page displaying an access error is sent to the WWW browser 102 (step 805). On the other hand, if the token is valid, the access control ID corresponding to the page ID corresponding to the next private website desired by the user is detected from the private website management information storage unit 109 (step 804). Then, the access control ID detected from the secret website management information storage unit 109
Is compared with the access control ID at the time of authentication contained in the token (step 806).

If the result of comparison in step 806 is different, a home page displaying an access error is sent to the WWW browser 102 (step 805).
Authentication is not continued. On the other hand, if the result of the comparison in step 806 is that they are the same, the authentication is continued, and the authentication link unit 111 makes the above-mentioned private The homepage is detected from the homepage storage unit 107, a new token is set, and sent to the WWW browser 102 (step 808). As described above, when the access control IDs match, the authentication is continued, and the next home page can be accessed without performing new authentication, but the token is invalid or the access control IDs do not match. In this case, the authentication is not continued. For example, the user cannot access the next homepage unless the authentication is newly performed and the authentication is OK, so that the security for accessing the homepage can be enhanced.

FIG. 9 is a sequence diagram when accessing a home page opened only to a specific user while following a link. First, as described above, when the user inputs a URL corresponding to a desired homepage, the authentication page 103 in which the page ID of the homepage and the authentication screen processing unit 104 are set is downloaded to the user terminal unit 101. Then, the authentication screen processing unit 104
Is the authentication information input by the user and the authentication page 10
3 is sent to the private website access processing unit 108 (sequence 70).
1).

The non-public homepage access processing unit 1
08 detects an access control ID corresponding to the transmitted page ID from the private website management information storage unit 109, sends the detected access control ID and the transmitted authentication information to the authentication client 110, and executes the authentication process. Request (sequence 901). As a result, authentication O
In the case of K, the above-mentioned closed homepage access processing unit 10
8 detects the corresponding homepage from the non-disclosed homepage storage unit 106 (sequence 902), generates a token (token 1) including an access control ID for guaranteeing authentication (sequence 903), and sets the detected homepage. And sends it to the WWW browser 102 (sequence 904). In FIG. 9, the contents of the electronic file of page1.html are sent to the homepage whose page ID is page1.

Next, an access request to the home page whose page ID is page 2 arrives at the authentication link unit 111 by a link from page1.html. At this time, the token (token 1) set in page1.html is also sent (sequence 905). Then, the authentication link unit 111 decrypts the token (sequence 906) and confirms the validity of the token. Then, the access control ID of page2 and the access control ID included in token 1, that is, page1
Then, the continuity of the access control ID of page1 and the access control ID of page2 is confirmed (sequence 907). If the access control IDs of page1 and page2 match and there is no abnormality in the token, the homepage of page2 is detected from the private webpage storage unit 107 (sequence 908), and a new token (token2) is generated (sequence 2). Sequence 90
9). Then, the generated token is set in page2.html, which is an electronic file of the homepage of page2, and sent to the WWW browser 102 (sequence 91).
0).

As described above, according to the present embodiment, a plurality of homepages are grouped by the access control ID according to the contents of the homepage, and
By using the authentication permission information storage unit in which D and the type of authentication such as a user ID, password, and fingerprint information used for authentication are stored in association with each other, it is possible to determine whether the user can be accessed. The type of authentication can be changed according to the access control ID of the group. For example, it is possible to make an authentication determination with an appropriate type of authentication according to the degree of secrecy of the homepage. Also, since the type of authentication is determined according to the access control ID, for example,
Even when a plurality of homepages exist in a plurality of WWW server units, the authentication processing for access to the plurality of homepages can be uniformly processed by one authentication server unit. It is possible to increase the rate of development.

The authentication permission information storage unit stores the access control ID, the user ID, and the authentication client ID.
Since the type of authentication used for authentication is determined according to the combination of D, the groups can be classified in more detail. Therefore, it is necessary to make an authentication determination using a more appropriate authentication type according to the system operation mode. Becomes possible.

Further, when the private website access processing section sends the home page to the user terminal, the access control ID of the group to which the home page belongs is sent to the user terminal, and the authentication link section sends the access control ID to the user terminal.
Is compared with the access control ID of the user-desired next homepage linked to the homepage, and the continuation of the authentication is determined. If they match, that is, if the authentication is continued, the next homepage is replaced with the user terminal. By sending the information to the section, it is not necessary to perform authentication based on the authentication information of the user each time the user accesses another home page, so that the operability of the user can be improved. Also, the token is invalid or the access control ID
Does not match, that is, when accessing a home page belonging to an access control ID different from the access control ID whose authentication has been previously made OK, it is determined that the authentication has not been continued. For example, new authentication is performed and the authentication does not become OK. As long as the next home page cannot be accessed, security for accessing the home page can be enhanced.

In this embodiment, the user ID is used as a key when the authentication judging unit detects the personal information storage unit. However, the key may be any key that can uniquely determine the user. It is not limited to ID. For example, even if the user ID sent from the authentication client unit is undefined, the same processing can be performed after first determining the user ID from fingerprint information that can uniquely determine the user.

[0048]

As described above, according to the homepage access control device of the present invention, the W
In a system comprising a WW server unit, a user terminal unit for accessing the homepage, and an authentication server unit for authenticating a user accessing the homepage, the user terminal unit includes a WWW browser for displaying the homepage, and the user An authentication information acquisition unit that acquires the authentication information of the above, an authentication screen processing unit that sends the authentication information acquired by the authentication information acquisition unit and the page ID of the homepage desired by the user to the WWW server unit, WWW
The server unit is grouped into a predetermined group, and stores a plurality of homepages that are open to only specific users in a closed homepage storage unit, and a page ID of each of the plurality of homepages and a group to which each of the homepages belongs. A secret homepage management information storage unit in which an access control ID is stored in association with the user ID, a page ID of the homepage desired by the user sent from the user terminal unit, and authentication information of the user are received. The access control ID corresponding to the page ID of the homepage desired by the user is detected from the homepage management information storage unit, and the detected access control ID and the authentication information of the user are sent to the authentication server unit for authentication. Request and if the authentication result is authentication OK, the above-mentioned private home An access unit for detecting the user-desired homepage from the message storage unit and sending it to the user terminal, wherein the authentication server unit stores a personal information storage unit in which authentication information registered in advance of the user is stored. When,
An authentication permission information storage unit in which the access control ID and the type of authentication used for the authentication process are stored in association with each other, and the access control ID and the user authentication information sent from the WWW server unit are received. Detecting the type of authentication associated with the access control ID from the authentication permission information storage unit, detecting the user authentication information corresponding to the detected authentication type from the personal information storage unit, and performing the detection. The authentication information is compared with the authentication information received from the WWW server unit to make an authentication determination, and the authentication determination unit sends the authentication result to the WWW server unit. When making a determination, the type of authentication can be changed according to the access control ID of the group, and for example, an appropriate It is possible to perform the authentication judgment in the kind of testimony. In addition, since the type of authentication is determined according to the access control ID, for example, even when a plurality of homepages exist in a plurality of WWW server units,
The authentication processing for access to the plurality of homepages can be uniformly processed by one authentication server unit, and the development of an access control mechanism for homepages can be accelerated.

According to the homepage access control device of the next invention, the access unit of the WWW server unit transmits the access control ID of the group to which the homepage belongs when sending the homepage to the user terminal. The user terminal unit is configured to transmit the page ID of the next homepage desired by the user linked to the homepage sent from the access unit and the access control I sent from the access unit.
And D to the WWW server unit,
Further, the WWW server unit receives the page ID of the next homepage and the access control ID sent from the user terminal unit, and receives the page ID of the next homepage from the closed homepage management information storage unit.
Is detected, and the detected access control ID is compared with the access control ID sent from the user terminal unit. If the access control ID matches, the next homepage is stored in the closed homepage storage unit. Has been detected and sent to the user terminal unit, the access control ID does not match, that is, a homepage belonging to an access control ID different from the access control ID whose authentication has been previously approved is accessed. In this case, for example, it is not possible to access the next homepage unless new authentication is performed and the authentication is successful, so that there is an effect that security for homepage access can be enhanced. Further, when the access control IDs match, there is no need to perform authentication based on the authentication information of the user each time the user accesses another home page, so that the operability of the user can be improved. is there.

Furthermore, according to the homepage access control method of the next invention, the WWW which discloses the homepage is disclosed.
In a control method using a homepage access control device including a server unit and a user terminal unit accessing the homepage and an authentication server unit performing authentication of a user accessing the homepage, the user terminal unit includes:
A WWW browser step for displaying the home page, an authentication information obtaining step for obtaining the user's authentication information, and the authentication information obtained in the authentication information obtaining step and the page ID of the user's desired home page to the WWW server unit. Executing an authentication screen processing step to be sent, wherein the WWW server unit receives a page ID of the homepage desired by the user sent from the user terminal unit and authentication information of the user, and a predetermined group. From the private homepage management information storage unit in which respective page IDs of a plurality of homepages that are grouped into a group and are opened to only specific users are stored in association with the access control IDs of the groups to which the homepages respectively belong. Page I of the desired homepage A WWW detecting step of detecting the access control ID associated with the request, an authentication requesting step of sending the access control ID detected in the WWW detecting step and the authentication information of the user to the authentication server unit, and requesting authentication. WW for detecting the homepage desired by the user from the non-public homepage storage section and sending it to the user terminal when the authentication result is OK
Executing a W sending step, wherein the authentication server unit is used for the authentication receiving step of receiving the access control ID and the user authentication information sent from the WWW server unit, and the access control ID and the authentication process. The authentication type associated with the access control ID received in the authentication receiving step is detected from the authentication permission information storage unit in which the authentication type is stored in association with the authentication type. An authentication detection step of detecting the user authentication information corresponding to the type of the detected authentication from the stored personal information storage unit; authentication information detected in the authentication detection step; and authentication information received from the WWW server unit. And the authentication result of the authentication determining step is transmitted to the WWW server unit. By performing the authentication sending step to be attached, it is possible to change the type of authentication according to the access control ID of the group when making an authentication determination as to whether the user is accessible. Accordingly, it is possible to make an authentication determination with an appropriate authentication type. In addition, since the type of authentication is determined according to the access control ID, for example, even when a plurality of homepages exist in a plurality of WWW server units, the authentication process for access to the plurality of homepages is performed by one authentication process. There is an effect that the processing can be unified in the server unit, and the development of a homepage access control mechanism can be accelerated.

[Brief description of the drawings]

FIG. 1 is a configuration diagram showing a homepage access control device according to a first embodiment of the present invention.

FIG. 2 is an explanatory diagram illustrating an example of a screen displayed by an authentication screen processing unit according to the first embodiment of the present invention.

FIG. 3 is an explanatory diagram showing an example of data stored in a private website management information storage unit according to the first embodiment of the present invention.

FIG. 4 is a flowchart showing a detailed operation of a closed homepage access processing unit according to the first embodiment of the present invention.

FIG. 5 is an explanatory diagram illustrating an example of data stored in a personal information storage unit according to the first embodiment of the present invention.

FIG. 6 is an explanatory diagram illustrating an example of data stored in an authentication permission information storage unit according to the first embodiment of the present invention.

FIG. 7 is a sequence diagram illustrating a flow of an authentication process according to the first embodiment of the present invention.

FIG. 8 is a flowchart showing a detailed operation of the authentication link unit according to the first embodiment of the present invention.

FIG. 9 is a sequence diagram showing a flow of access control following a link of a private website in the first embodiment of the present invention.

FIG. 10 is a configuration diagram showing a conventional homepage access control device.

[Explanation of symbols]

101: user terminal unit, 102: WWW browser, 10
3: Authentication page, 104: Authentication screen processing unit, 105: Authentication information acquisition unit, 106: WWW server unit, 107: Private homepage storage unit, 108: Private homepage access processing unit, 109: Private homepage management information storage Unit, 110: authentication client unit, 111: authentication link unit, 112: authentication server unit, 113: personal information storage unit, 114: authentication permission information storage unit, 115: authentication determination unit

 ────────────────────────────────────────────────── ─── Continuing on the front page (72) Inventor Tetsuo Sadahaku 2-3-2 Marunouchi, Chiyoda-ku, Tokyo F-term (reference) 5B085 AE04 AE06 AE23 BG07

Claims (3)

[Claims] 1. A homepage access control device comprising a WWW server unit for publishing a homepage, a user terminal unit for accessing the homepage, and an authentication server unit for authenticating a user accessing the homepage, wherein the user terminal unit is , WW to display the above homepage
A W browser, an authentication information acquisition unit that acquires the authentication information of the user, and the authentication information acquired by the authentication information acquisition unit and the page ID of the homepage desired by the user.
An authentication screen processing unit for sending to a WW server unit, wherein the WWW server unit is grouped into a predetermined group, and stores a plurality of homepages that are open to only specific users. A non-disclosed homepage management information storage unit in which the page IDs of the plurality of homepages and the access control IDs of the groups to which the homepages respectively belong are stored in association with each other; It receives the page ID of the homepage and the authentication information of the user, detects the access control ID associated with the page ID of the homepage desired by the user from the closed homepage management information storage unit, and detects the detected access control ID. And the authentication information of the user to the authentication server Request, and the authentication result is
An access unit for detecting the user's desired homepage from the closed homepage storage unit in the case of K and sending it to the user terminal, wherein the authentication server unit stores authentication information registered in advance for the user. The authentication information storing unit, the authentication information storing unit storing the access control ID and the type of authentication used in the authentication process in association with each other, the access control ID sent from the WWW server unit, Receiving the authentication information of the user, detecting the type of authentication associated with the access control ID from the authentication permission information storage unit, and detecting the type of authentication corresponding to the detected authentication type from the personal information storage unit. The authentication information is detected, and the detected authentication information is compared with the authentication information received from the WWW server unit to make an authentication determination. A homepage access control device, comprising: an authentication determination unit that sends the authentication determination unit to a WWW server unit. 2. The access unit of the WWW server unit is configured to, when sending a home page to the user terminal, send an access control ID of a group to which the home page belongs to the user terminal. Is configured to send the page ID of the next homepage desired by the user linked to the homepage sent from the access unit and the access control ID sent from the access unit to the WWW server unit. The WWW server unit receives the page ID of the next homepage and the access control ID sent from the user terminal unit, and receives the page ID of the next homepage from the closed homepage management information storage unit.
Is detected, and the detected access control ID is compared with the access control ID sent from the user terminal unit. If the access control ID matches, the next homepage is stored in the closed homepage storage unit. 2. The home page access control device according to claim 1, further comprising an authentication link unit for detecting the password and sending the detected link to the user terminal unit. 3. A homepage access control method using a homepage access control device comprising a WWW server unit for publishing a homepage, a user terminal unit for accessing the homepage, and an authentication server unit for authenticating a user accessing the homepage. In the above, the WW for displaying the homepage on the user terminal unit
A W browser step, an authentication information obtaining step for obtaining the user authentication information, and an authentication screen processing for transmitting the authentication information obtained in the authentication information obtaining step and the page ID of the homepage desired by the user to the WWW server unit Executing a step, in the WWW server section, a WWW receiving step of receiving the page ID of the user-desired homepage sent from the user terminal section and the authentication information of the user, and grouping into a predetermined group, Each page I of multiple homepages that are open to specific users only
D and the access control ID of the group to which the homepage belongs are stored in association with the access control ID of the homepage desired by the user from the closed homepage management information storage unit.
D, a WWW detecting step of detecting the D, an access control ID detected in the WWW detecting step, and an authentication requesting step of sending the user's authentication information to the authentication server unit to make an authentication request. In the case of the above, a WWW sending step of detecting the user's desired homepage from the non-public homepage storage unit and sending it to the user terminal is executed, and the access control sent from the WWW server unit is executed by the authentication server unit. An authentication receiving step of receiving an ID and authentication information of the user, and the access control ID
The authentication type associated with the access control ID received in the authentication receiving step is detected from the authentication permission information storage unit in which the authentication type used in the authentication processing is stored in association with the authentication type used in the authentication process. An authentication detecting step of detecting the user's authentication information according to the detected authentication type from the personal information storage unit in which the registered authentication information is stored; the authentication information detected in the authentication detecting step; and the WWW server A homepage access control method, comprising the steps of: performing an authentication determination step of performing authentication determination by comparing authentication information received from an authentication unit; and an authentication transmission step of transmitting an authentication result of the authentication determination step to the WWW server unit. .