JP2002024185A - Device and method for processing access request - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a device and a method for processing access requests with improved security and reliability. SOLUTION: A download sale server 10 is provided with access reception means 12 and 20 which receive the access request information to the objects having accessing identifiers, an access destination identifier designation means 20 which designates the identifiers of access destinations that can access the objects about the access request information received by the means 12 and 20 and a holding means 22 which holds the access destination identifiers designated by the designation means 20 in response to those access identifiers.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to an access request processing device and an access request processing method, and more particularly, to an access request processing device and an access request processing method for processing an access request for an object.

[0002]

2. Description of the Related Art Conventionally, in a so-called download sales system that sells software and image data via the Internet, a user accesses a shop homepage, and from there, an object such as desired software and image data is obtained. to download. In this system, multiple users can access the object from the same connection destination (site), and in general, a combination of user ID and password can be used to allow only authorized users to download. Many.

[0003]

[Problems to be solved by the invention]

[0004] However, if only a combination of a user ID and a password is used, unauthorized access is easily performed by others, and a system with higher security and reliability is required.

Accordingly, a technical problem to be solved by the present invention is to provide an access request processing device and an access request processing method with improved security and reliability.

[0006]

SUMMARY OF THE INVENTION The present invention provides an access request processing apparatus having the following configuration in order to solve the above technical problems.

The access request processing device is configured to receive access request information for an object having an access source identifier, and to access the object in response to the access request information received by the access request receiving device. An access destination identifier designating means for designating an access destination identifier of an accessible access destination, and a storage means for storing the access destination identifier designated by the access destination identifier designating in association with the access source identifier.

In the above configuration, an access (operation such as reading, writing, operation command, etc.) is requested for an object (for example, data of software, image, music, etc., which can be accessed). In this case, the user (client) first transmits to the access request processing device access request information that is information requesting access to the object and includes an access source identifier that is its own identifier. When the access request receiving device receives the access request information, the access request processing device specifies an access destination identifier (for example, a URL or a directory) which is an identifier for specifying an access destination capable of accessing the object. Is specified, and the specified access destination identifier is stored in association with the access source identifier by the storage means. Then, the user can access the object by accessing the access destination specified by the access destination identifier.

[0009] Access to the access destination specified by the access destination identifier refers to the correspondence between the access destination identifier and the access source identifier stored in the storage means, and is permitted only to a user having a legitimate access source identifier. can do.

[0010] According to the above configuration, the access request processing device appropriately designates an access destination for accessing the object, thereby making the access request processing device more illegal than a conventional system in which a plurality of users can access the object from the same connection destination. The possibility of preventing unauthorized access can be increased. Further, even if there is an unauthorized access, the effect is limited to a specific access source identifier, so that the influence of the unauthorized access can be minimized.

Therefore, safety and reliability can be improved.

Preferably, the access request receiving means includes a determining means for determining whether to receive the received access request information. The determining means operates the access destination identifier specifying means and the storage means when determining that the access request information is accepted.

According to the above configuration, when it is appropriate to permit the access request to the object, the access is permitted by designating the access destination identifier. On the other hand, when it is inappropriate to grant an access request to an object, the access request can be rejected and unnecessary designation of an access destination identifier can be avoided.

[0014] Preferably, there is provided notification means for notifying the access destination identifier to the access source of the access source identifier.

According to the above configuration, only the access source that has received the notification of the access destination identifier can access the object, and can specify an object that can know the access destination identifier. Therefore, safety and reliability can be further improved.

Preferably, the access destination identifier designating means designates a different access destination identifier for each piece of the access request information received by the access request receiving means.

According to the above configuration, when an access request is granted with a condition such as a time limit or the number of times, the access destination is closed or deleted after the time limit or after a predetermined number of times. All access to the access destination may be denied, and management of the access request becomes easy. Further, even if an unauthorized access is found, it is sufficient to specify the access destination identifier and deny access only to that identifier, so that it is possible to avoid inconvenience to other users. Therefore, safety and reliability can be further improved.

Incidentally, the access destination identifier designating means comprises:
The access destination identifier may be designated by selecting the access destination identifier from the access destination identifiers prepared in advance.

Preferably, the access destination identifier designating means generates a different access destination identifier each time the access request receiving means receives the access request information.

According to the above configuration, the access destination identifier is generated only when the access request is accepted, so that it is difficult for a third party to predict the access destination. Therefore, safety and reliability can be further improved.

The present invention also provides an access request processing method having the following configuration.

The access request processing method includes first, second, and third steps. In the first step, access request information for an object having an access source identifier is received. In the second step, an access destination identifier of an access destination that can access the object is specified with respect to the access request information received in the first step. In the third step, the access destination identifier specified in the second step is stored in association with the access source identifier.

According to the above method, safety and reliability can be improved.

[0024]

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a block diagram showing an access request processing apparatus and an access request processing method according to an embodiment of the present invention;

FIG. 1 is an overall configuration diagram of the download sales system. The download sales system includes users 2 and 4, a download sales server 10, and an online payment agency system 30, which are connected to each other via a communication network such as the Internet.

The download sales server 10 has a first access destination 12, a second access destination 14, a download request receiving unit 20, a database 22, an authentication server 24, and a content recording unit 26.

The first access destination 12 is a site for accessing a homepage (not shown) of a shop that sells products (digital data) such as software, images and music on the Internet. URL of this site
Is open to the public, and a plurality of users 2 and 4 can access the same first access destination 12 as indicated by arrows 50 and 60.
Can be accessed. The users 2 and 4 can perform a product purchase procedure on the shop homepage.

The second access destination 14 is a site for actually accessing and downloading a product. This download site is created separately for each order for which the purchase of a product has been approved. That is, the connection destination for downloading differs for each order. And only to the orderer,
The URL of the download site is notified. Therefore, as shown by the arrows 56 and 66, only the users 2 and 4 who have been approved for the purchase of the product
a, 14b can be accessed.

[0029] The download request receiving unit 20 receives, from the first access destination 12, data of a purchase procedure of a product performed on the homepage of the shop, and processes the data. Therefore, the download request receiving unit 20 can communicate with the online payment agency system 30 as indicated by the arrow 52,
When the purchase of a product is approved by the online payment acting system 30, an authentication file is created in the database 22.

In the content recording section 26, the data of the product itself is recorded.

The authentication server 24 stores the second access destination 1
4 access is managed. That is, database 2
Referring to the authentication file created in 2, the second access destination 1 is limited to only the users 2 and 4 whose order has been approved.
4, the user can access the product in the content recording unit 26 and download the data.

The online payment agency system 30 sends the payment authentication result to the download request receiving unit 2 of the download sales server 10 by e-mail as indicated by an arrow 52.
Notify 0. Also, as shown by arrows 53 and 63, the users 2 and 4 who have applied for the purchase of the product are notified of the settlement authentication result by mail or e-mail.

Next, the operation of the download sales system will be described with reference to FIG.

The users 2 and 4 access the shop homepage from the first access destination 12 of the download / sales server 10 and, after deciding on a purchased product, enter necessary information in a purchase request form on the homepage and transmit it. At this time, the purchase request data entered by the users 2 and 4 include:
Includes customer data (eg, addresses, names, telephone numbers, user IDs, credit card numbers, etc. of users 2 and 4), valid e-mail addresses for users 2 and 4, and purchased product data (purchased product codes, quantities, etc.) It is.

When the download sales server 10 receives this data from the first access destination 12 (U1
0), the download request receiving unit 20 temporarily registers the data in the database 22 (S10), transmits only necessary data to the online payment agent system 30 of the online payment agent, and requests payment authentication (C).
10).

When approving the settlement, the online settlement system 30 notifies the server by e-mail (C12). If the settlement is not approved, the process ends (C14). In any case, the result of the settlement approval is notified to the users 2 and 4 by mail or e-mail (U12).

The download request receiving unit 20 of the download sales server 10 is provided with an online payment system 30
, Automatically creates a password and download sites 14a and 14b, and provides temporary registration data, a password, and a URL of the download sites 14a and 14b for authentication. The file is registered in the database 22 (S12). The download sites 14a and 14b create a separate site for each purchase order of a product. For example, “xxxxx” of “http: //www.server name.jp//dcc/download/xxxxxxxx/login.html”
"xxx" part is automatically generated by combining the date and time for each purchase order of the product. Then, the users 2 and 4 send e-mails notifying the URLs and passwords of the download sites 14a and 14b. The e-mail is sent to the valid e-mail address entered at the time of purchasing the product (S14).

Upon receiving this e-mail (U14), the users 2 and 4 access the download sites 14a and 14b to which the URL has been notified at an appropriate time, if desired, and provide the e-mail address at which the e-mail was received, Enter the password notified by e-mail (U2
0).

When the download sales server 10 receives this, the authentication server 24 compares the input contents with the authentication file in the database 22 (S20).

If the authentication is successful, the authentication server 2
4 permits access to the object recorded in the content recording unit 26. This allows users 2,4
In, the download file is displayed, and the data of the purchased product recorded in the content recording unit 26 is accessed.
The data can be downloaded (U2
4). For example, it can receive purchased software and data such as images and music. The URL of the download file is, for example, “http://www.servername.jp//
dcc / download / xxxxxxxx / mdl / RAMDrvr311.sea.hqx ”.

If the authentication fails, the users 2, 4
(U22).

The second access destination 14, that is, the URL of the download site is different from the first access destination 12, that is, the URL of the homepage of the shop.
The URL of the download site is not known until the user actually purchases the product and receives a notification of the URL by e-mail. Then, the mail address that has notified the URL is grasped by the download sales server 10. Therefore, it becomes difficult to illegally access and download by stealing information of another person.

When the download is permitted for a certain period depending on the period or the number of times, after the period has elapsed, the download site only needs to be closed or deleted, and the management of the download site becomes easy.

Also, the download sales server 10
If an unauthorized access is found, a warning can be issued because the e-mail address of the other party is known. Also,
Since a separate download site is created for each order,
Even if the connection to the URL of the download site that has been accessed illegally is prohibited, no inconvenience is given to other users. Therefore, the download sales server 10
Is easy to deal with unauthorized access.

According to the access request processing system described above, security and reliability can be improved as compared with the conventional system.

It should be noted that the present invention is not limited to the above embodiment, but can be embodied in various other forms.

For example, in the above-described embodiment, download has been described as an example. However, when access is permitted, video and audio data may be played back while streaming data is being received.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of an access request processing system according to an embodiment of the present invention;

FIG. 2 is an explanatory diagram of an operation in the system of FIG. 1;

[Explanation of symbols]

2, 4 users 10 download sales server (access request processing device) 12 first access destination (access request receiving means) 14 second access destination 14a, 14b download site 20 access request receiving unit (access request receiving means, access Destination identifier designating means, determining means, notifying means) 22 database (storage means) 24 approval server 26 content recording unit 30 online payment agency system (determining means)

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI Theme coat ゛ (Reference) G06F 13/00 510 G06F 17/60 302C 17/60 302 9/06 660E F-term (Reference) 5B017 AA03 BA06 BB06 CA15 CA16 5B049 BB11 CC05 5B076 FB03 FB05 5B082 EA11 5B085 AA08 AE00 BC02

Claims (6)

[Claims] An access request receiving unit that receives access request information for an object having an access source identifier; and an access destination that can access the object in response to the access request information received by the access request receiving unit. An access request comprising: an access destination identifier designating unit for designating an access destination identifier; and a storage unit for storing the access destination identifier designated by the access destination identifier designating in association with the access source identifier. Processing equipment. 2. The access request accepting means includes a judging means for judging whether or not to receive the received access request information, and the judging means judges the access destination identifier when judging to accept the access request information. 2. The access request processing device according to claim 1, wherein the designation unit and the storage unit are operated. 3. The access request processing device according to claim 1, further comprising a notification unit that notifies the access destination identifier to the access source of the access source identifier. 4. The access according to claim 1, wherein said access destination identifier designating means designates said different access destination identifier for each of said access request information received by said access request receiving means. Request processing device. 5. The access destination identifier designating means according to claim 1, wherein said access destination identifier designating means generates a different access destination identifier every time said access request receiving means receives said access request information. Access request processing device. 6. A first step of receiving access request information for an object having an access source identifier,
A second step of designating an access destination identifier of an access destination capable of accessing the object with respect to the access request information received in the first step, and setting the access destination identifier designated in the second step to the access And a third step of storing the access request in association with the source identifier.