JP2003132030A - Information processing device and method, recording medium and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To simply control access to two or more servers and two or more services, and to prevent unauthorized access or the like. SOLUTION: A gateway 3 is connected to two or more servers and a device that provides two or more services, and is installed where a broadband network of the Internet or the like and a local network of LAN or the like are switched between them. An access control part 72, based on data stored in an access right database 73, exercises control over a fire wall 71, two or more servers connected to a subsequent stage and the device that provides two or more services. The access right database 73 manages data set by an administrator who manages the servers or the like. As the managed data, a user ID for identifying a user who has made an access request is associated with the server and service to which the access is permitted.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an information processing apparatus and method, a recording medium, and a program, and more particularly, an information processing apparatus and method suitable for collectively controlling access to a plurality of servers and services, The present invention relates to a recording medium and a program.

[0002]

2. Description of the Related Art In recent years, with the spread of networks such as the Internet, the number of devices (servers) connected to the networks is also increasing. Although it is possible for another server connected to the network to access a predetermined server among those servers, it is often not preferable that such a thing be performed simply. In other words, it is necessary to provide a mechanism that prevents a server without access permission from being accessed. As such a mechanism, a firewall or A
Service-specific access control based on CL (access control list) is performed as necessary.

[0003]

Access control unique to a service based on ACL is performed independently for each service. On the other hand, access control by a firewall is performed on a gateway that is a relay point of the network. Therefore, an administrator who manages a plurality of servers and a plurality of services has to set firewalls on the gateway and ACLs for each service, which is troublesome. .

In an environment in which a firewall or ACL is set, if an administrator desires to give a predetermined user access to a predetermined service for a limited period of time, the firewall packet AC for each service as well as changing the settings for passage
There is a problem in that it is necessary to change L, and it is troublesome to perform such processing because the procedure becomes complicated.

However, if only the setting for prohibiting the passage of packets to the firewall is made and the ACL is not changed, for example, a user who is permitted to access can temporarily set the passage setting of the firewall by using the service. There is a problem that another user who is not permitted to access may illegally use the service by some means while being performed.

[0006] In addition, in order to give a common access right to a plurality of services, it is necessary to make settings for an independent ACL for each service, so that a complicated and troublesome operation is required. There was a problem such as.

In Japanese Unexamined Patent Publication No. 2000-244481, access to a device connected to a local network from a terminal connected to another network is authenticated by a user, controlled by a firewall, and controlled by the terminal. It is disclosed that an input server-specific authentication information is converted by an authentication server to be converted into authentication information in a format that a firewall can handle, thereby providing an access control mechanism to various devices.

According to this method, it is not possible to collectively control the access rights of the devices in the local network for each user, and it is necessary to control them individually. Therefore, setting for control is troublesome. However, there is a problem that it takes time.

Japanese Laid-Open Patent Publication No. 11-338799 discloses that a client on the Internet uses a LAN (Local Area Network).
When accessing the service inside the server, the user is authenticated by the authentication server, and as a result, the resource management server
Calculate access rights to LAN resources. When the service in the LAN receives the request and the access right information via the Internet, the requested resource is converted into a mobile object code and transmitted to the requesting client. It is disclosed that the client executes code to allow communication while controlling access to resources in the LAN.

According to this method, some environment for executing the mobile code is required for the client, and a mobile code generation mechanism must be prepared for each service. There is a problem that a lot of labor is required.

The present invention has been made in view of such circumstances, and an object thereof is to collectively control access to a plurality of servers and access to a plurality of services, and to make settings for the control. It is an object of the present invention to facilitate such processing.

[0012]

[Means for Solving the Problems] In order to solve the above problems,
The information processing apparatus of the present invention firstly stores a user identification information for identifying a user and a storage unit that stores service information relating to a service to which access is permitted in association with each other. If there is, the read means for reading the service information associated with the user identification information corresponding to the user from the storage means, and the access right information for restricting access to the service, the service read by the read means The gist is to include a generation unit that generates information including information, and a supply unit that supplies the access right information generated by the generation unit to the user.

Secondly, in addition to the first gist, the gist is to generate the access right information including an electronic signature.

Thirdly, in addition to the first gist, the gist is to generate the access right information including information on a period during which access to the service is permitted.

Fourthly, in addition to the first gist, the gist further includes an instruction means for giving an instruction to a firewall based on the service information read by the reading means.

Fifth, in addition to the first aspect, the gist is that the user identification information includes an interface ID of an address defined by IPv6.

According to the information processing method of the present invention, user identification information for identifying a user, a storage control step of controlling storage of associated service information regarding a service to which access is permitted, and a predetermined service from the user are performed. When there is an access request, the service information associated with the user identification information corresponding to the user is read from the information whose storage is controlled by the process of the storage control step, and at least the read service information is included.
It is summarized as including a generation step of generating access right information for restricting access to a service, and a supply step of supplying the access right information generated by the processing of the generation step to a user.

The program of the recording medium according to the present invention includes a user control information for identifying a user, a storage control step for controlling storage associated with service information relating to a service to which access is permitted, and a predetermined service from the user. When there is an access request from the user, the service information associated with the user identification information corresponding to the user is read from the information whose storage is controlled by the process of the storage control step, and at least the read service information is included. It is summarized as including a generation step of generating access right information for restricting access to a service, and a supply step of supplying the access right information generated by the processing of the generation step to a user.

The program of the present invention includes a user identification information for identifying a user, a storage control step for controlling storage associated with service information regarding a service to which access is permitted, and an access request from a user to a predetermined service. If there is, read the service information associated with the user identification information corresponding to the user from the information whose storage is controlled by the process of the storage control step, and at least include the read service information,
The gist is to cause a computer to execute a generation step of generating access right information for limiting access to a service and a supply step of supplying the access right information generated by the processing of the generation step to a user.

In the information processing apparatus and method, and the program of the present invention, when the user makes an access request to a predetermined service, the service information associated with the user identification information corresponding to the user is read out. , Access right information for limiting access to the service is generated including at least the read service information.

[0021]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below, and the correspondence between the constituent elements described in the claims and specific examples in the embodiments of the invention will be illustrated as follows. . This description is for confirming that the specific examples supporting the invention described in the claims are described in the embodiments of the invention. Therefore, although described in the embodiment of the invention, even if there is a specific example not described here as a component corresponding to the configuration requirement, that is, It does not mean that it does not correspond to. vice versa,
Even if a specific example is described here as corresponding to a constituent element, that does not mean that the specific example does not correspond to constituent elements other than the constituent element.

Further, this description does not mean that the inventions corresponding to the concrete examples described in the embodiments of the invention are all described in the claims. In other words, this description is an invention that corresponds to the specific examples described in the embodiments of the invention and is not included in the claims of this application, that is, in the future, a divisional application will be filed. It does not deny the existence of an invention added by amendment.

The information processing apparatus of the present invention (for example, the gateway 3 shown in FIG. 4) has user identification information for identifying the user (for example, user ID stored in the access right database 73 shown in FIG. 7). And a storage means (for example, the access shown in FIG. 4) that stores the service information (for example, the HTTP service 81 and the FTP service 82 stored in the access right database 73 shown in FIG. 7) related to the access-permitted Authority database 73) and read-out means for reading out the service information associated with the user identification information corresponding to the user from the storage means when the user makes an access request to the predetermined service (for example, shown in FIG. 6). Access control unit 72 of gateway 3 performs processing in step S22) and services Generating means for generating access right information for restricting access to the information including the service information read by the reading means (for example, the access control unit 72 of the gateway 3 shown in FIG. 6).
Performed in step S22) and a supply unit that supplies the access right information generated by the generation unit to the user (for example, the process performed by the access control unit 72 of the gateway 3 shown in FIG. 6 in step S22). It is characterized by including.

Based on the service information read by the reading means, an instruction means for giving an instruction to the firewall (eg, the gateway 3 shown in FIG. 6).
Access control section 72) in step S23) may be further included.

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a diagram showing the configuration of an embodiment of an information processing system to which the present invention is applied. The network 1 is a network including the Internet and the like. A server 2-1 and a server 2-2 are connected to the network 1. Further, a server 4-1 and a server 4-2 are also connected to the network 1 via the gateway 3.

The gateway 3, the server 4-1 and the server 4-2 are, for example, a network (for example, a LAN (Local Area Network)) constructed in one home or company.
rk)) 5 and are configured to exchange data with each other, and are also configured to exchange data with the server 2-1 and the server 2-2 via the gateway 3 and the network 1. ing.

In the following description, when it is not necessary to individually distinguish the server 2-1 and the server 2-2, they are simply described as the server 2. The same applies to other devices. The server 2 is a device connected to the network 1 without going through the gateway 3 or a device corresponding to the gateway 3, and the server 4 is a device connected to the network 1 under the control of the gateway 3.

Of course, the server 2 and the server 4 include devices such as a personal computer and a mobile phone which have a function of connecting to the network 1 and a function of browsing a homepage. It may be a home appliance such as a so-called internet home appliance. The internet home appliance is, for example, a refrigerator or a television receiver having a function of connecting to the network 1 and having a function of acquiring data from the server 2 or providing data to the server 2. .

FIG. 2 shows the internal structure of the server 2. CPU (Central Processing Unit) 2 of server 2
1 executes various processes according to a program stored in a ROM (Read Only Memory) 22. RAM
The (Random Access Memory) 23 appropriately stores data and programs necessary for the CPU 21 to execute various processes. The input / output interface 25 is
An input unit 26 including a keyboard and a mouse is connected, and a signal input to the input unit 26 is output to the CPU 21. Further, the input / output interface 25 is also connected to an output unit 27 including a display and a speaker.

Further, the input / output interface 25 includes
A storage unit 28 including a hard disk and a communication unit 29 that exchanges data with another device (for example, the server 4) via the network 1 are also connected. The drive 30 includes a magnetic disk 41 and an optical disk 4.
2. Used when reading or writing data from a recording medium such as the magneto-optical disk 43 and the semiconductor memory 44.

The gateway 3 and the server 4 can also have basically the same internal configuration as the server 2 shown in FIG. However, the gateway 3 and the server 4 can be configured to realize the function according to the function.

FIG. 3 is a functional block diagram of the server 2. The server 2 uses the access right processing client 61, HT
TP (HyperText Transfer Protocol) client 6
2 and a function composed of an FTP (File Transfer Protocol) client 63.

The access right processing client 61 executes processing relating to access to the server 4 via the gateway 3. The access right processing client 61, which will be described in detail later, receives, for example, a response from the gateway 3 side that transmits an access request to the server 4 (gateway 3) in response to a user operation, and the response The access right information included in is passed to the HTTP client 62 and the FTP client 63, and the HTTP client 62 and the FTP client 63 perform processing such as making the service available.

When the processing in the access right processing client 61 is completed, the HTTP client 62 or FTP
The client 63 starts exchanging data with the server 4. The HTTP client 62 executes a process related to data transfer such as a home page. The FTP client 63 executes processing related to file transfer.

Each client in the server 2 shown in FIG. 3 may be realized by hardware or software. In the case of being realized by software, for example, the program stored in the ROM 22 or the storage unit 28 (FIG. 2) is activated, and the CPU 21 is realized by executing the activated program.
In the functional block diagrams relating to the gateway 3 and the server 4 shown below, similarly, the function may be realized by hardware or software.

FIG. 4 is a functional block diagram of the gateway 3. The gateway 3 includes a firewall 71 and an access control unit 72. Firewall 7
1 is provided to perform control so that an internal network cannot be arbitrarily entered from the outside. The source IP address, source port, and transmission of an IP (Internet Protocol) packet to be passed Destination IP address,
Access is controlled by referring to the destination port to determine whether or not to pass the IP packet.

The access control unit 72 performs control based on the access right data stored in the access right database 73. For example, from the data stored in the access right database 73, the user requesting access is authenticated, the authority of the user is checked, the access right information is issued and transmitted, and the firewall 71 is sent. , Make pass settings to make the user accessible.

FIG. 5 is a functional block diagram of the server 4. As shown in FIG. 5A, the server 4-1 includes an HTTP service 81 and provides data (service) described in HTTP. As shown in FIG. 5B, the server 4-2
Is composed of an FTP service 82 and provides data (service) described in FTP. HTTP service 81
The FTP service 82 has a function of verifying the legitimacy of the access right information from the accessing server 2.

The operation of the information processing system shown in FIG. 1 will be described with reference to the flowchart of FIG. In the following description, data will be exchanged with the HTTP service 81 of the server 4-1 as an example. When data is exchanged with the FTP service 82, the same processing as described below is performed.

Access right processing client 6 of server 2
1 transmits an access request to the server 4 in step S11. This processing is performed by, for example, the user performing predetermined processing on the server 2,
This is done at the time when the user inputs the address of, and instructs to connect to the input address. The access request made to the server 4 is received by the gateway 3 provided on the network 1 side of the server 4.

The access control unit 72 of the gateway 3 is
In step S21, the authentication process for the server 2 (user) that has issued the access request is executed. In the authentication processing, for example, the access right processing client 61 on the server 2 side presents a public key certificate in X509 format (certificate format conforming to the regulations of ISO) with an electronic signature by a private key, and access This is performed by the control unit 72 verifying it.

As another method related to the authentication process, the server 2 side may transmit an encrypted user name and password, and the access control unit 72 may perform authentication using the user name and password. .

The authentication may be performed by any method, but when the authentication is completed and the authentication is successful in step S21, the access control section 72
The information transmitted from the server 2 side is acquired as the user ID used to identify the user who has made the access request.

In step S22, the access control section 72 issues an access right according to the user ID of the authenticated user. In this case, since the authentication in step S21 is successful, the access right gives the right to receive the service provided by the HTTP service 81 of the server 4.
This access right is issued by calculating the access right to the HTTP service 81 and issuing the access right information based on the calculation.

The calculation of the access right and the issuance of the access right information are performed, for example, by the following procedure. The access control unit 72 retrieves and reads out the data for issuing the access right information from the access right database 73 by using the user ID acquired by the authentication processing in step S21 as a key.

Here, the data stored in the access right database 73 will be described with reference to FIG. The access right database 73 is user ID, HTTP
The access right of each service (each directory) of the service 81 and the access right of each service (each directory) of the FTP service 82 are stored (managed) in association with each other.

An administrator who manages the gateway 3 and the server 4 creates data managed by such an access right database 73. That is, the administrator sets, for each service (directory) of each server 4, in the access right database 73 what kind of access right is to be given in a type corresponding to the type of request in the application layer.

Returning to the explanation of the flow chart of FIG. 6, the access right issuance processing in step S22 will be described. First, using the user ID obtained as a result of the authentication process in step S21 as a key, the information associated with the user ID is read from the access right database 73 as shown in FIG.

Here, the case where the user ID is userA will be described as an example. As shown in FIG. 7, userA has HT
As a service of TP service 81, / doc / public /, / doc
Access to the two services (directory) / private / userA / is permitted, and access to the two services (directory) / pub / and / home / userA / is permitted as the FTP service 82 service. Information is associated and managed.

An example of the description of access right information issued based on these pieces of information is shown below. The access right information shown below describes the authority for the user A described above.

[0051] 1 <service> 2 <type> http </ type> 3 <permit> 4 <direcitory> / doc / public / </ direcitory> 5 <direcitory> / doc / private / userA / </ direcitory> 6 </ permit> 7 </ service> 8 <service> 9 <permit> 10 <type> ftp </ type> 11 <direcitory> / pub / </ direcitory> 12 <direcitory> / home / userA / </ direcitory> 13 </ permit> 14 </ service>

In this access right information, as described in the 2nd to 5th lines, in the 4th line among the services provided by the HTTP service 81, that is, the service whose protocol type is HTTP, A service called doc / public / and, as described in line 5, / doc / private
It shows that access is granted to the service named / userA /.

Also, in this access right information, 1
From line 0 to line 12, as described in line 11 among services provided by the FTP service whose protocol type is FTP, that is, / p
A service called ub / and, as described on line 12, /
It is shown that access is granted to the service home / userA /.

In this way, the access right database 73
The access right information is created by using the information managed in. The above access right information is an example,
It does not represent a limitation. As described above, in response to the connection request for the HTTP service 81, the HTTP service 81
Both access rights of the FTP service 82 may be included as one access right information. In such a case, the access right information for the two services required when the link to the FTP service 82 is described from the WWW page on the HTTP service 81 is passed to the access right processing client 61 at once. I can do things.

Of course, in response to the connection request to the HTTP service 81, access right information including only the access right to the HTTP service 81 may be issued.

The access control unit 72 digitally signs the above-mentioned access information using the secret key of the access control unit 72, and issues it as formal access right information. In addition, when writing the access right information, if necessary, information accompanying the access right is added. The information is, for example, information indicating the valid period of the access right information.

When the access right information is transmitted / received on the network 1, the access right information may be compressed using a predetermined compression method for the purpose of reducing the amount of data. good.

When the access control section 72 generates the access right information as described above, it sends the access right information to the server 2. While performing such transmission, the access control unit 72, in step S23,
The firewall 71 is instructed to perform the pass setting necessary for accessing the HTTP service 81 requested by the access right processing client 61 of the server 2.

The firewall 71 operates in step S31.
At, the passage setting is performed in response to the instruction from the access control unit 72. At this time, if the setting related to the deadline is included, the setting is also performed. When the setting related to the deadline is performed, a timer may be started from that point and the elapse of the set deadline may be monitored.

Access right processing client 6 of server 2
1 receives the access right information issued (transmitted) as the process of step S22 of the access control unit 72 of the gateway 3 in step S12, and provides the received access right information to the HTTP client 62.

In step S41, the HTTP client 62 is connected via the network 1 by including the provided access right information in the HTTP request.
The connection to the TP service 81 is started. For example, the access right information is included in the header of the HTTP protocol and transmitted.

In step S51, the HTTP of the server 2
Upon receiving the HTTP request including the access right information from the client 62, the HTTP service 81 verifies the validity of the access right information by using the public key of the access control unit 72 which is the signer. As described above, when issuing the access right information, the access control unit 72 uses the private key of the access control unit 72 as a part of the access right information to perform the electronic signature as the processing of step S22. There is. Therefore, the HTTP service 81 verifies the validity of the electronic signature in step S51.

Also, the HTTP server 81 uses the step S51.
At, the expiration date of the access right information is also verified. If the verification is successful, the processing after step S51 is executed, but if the verification is unsuccessful, in other words, if the verification result is that the access is not valid, the processing after step S51 is not executed. The verification result indicating that the access is not valid is issued when the electronic signature cannot be decrypted by the signer's public key or when the expiration date has expired.

In step S52, the access right is verified. First, the HTTP service 81 interprets an application layer request for a service included in the received HTTP request. As a result of the interpretation, it is verified whether or not the request content issued by the server 2 matches the information of the service permitted to be accessed, which is included in the access right information.

For example, the request from the server 2 is
When it is "GET /doc/private/userA/index.html", the information described in the access right information included in the HTTP request from the server 2 is the file "/ doc / p
Verify whether or not the access right to “rivate / userA / index.html” is included. If the access right is included, execute the request, and if the access right is not included, accept the request. Performs the process of not having.

In step S53, the HTTP service 8
1 returns the response of the result of executing the request.
In this case, the file “/doc/private/userA/index.htm
The content of “l” is transmitted to the HTTP client 62.

The HTTP client 62 executes step S42.
In, the contents of the file "/doc/private/userA/index.html" sent from the HTTP service 81 are received,
By executing the processing according to the received contents,
Providing services to users. As a result, for example, a predetermined image or text is displayed on the display as the output unit 27, and the user can browse the displayed image or text.

Step S in HTTP Client 62
41 and the step S5 in the HTTP service 81
By repeating the processing from 1 to S53,
The user can browse the services from the HTTP service 81 within a predetermined range.

After the passage of the packet through the firewall 71 set as the processing in step S23 is permitted, the firewall 71
In step S32, passage prohibition is set.
By executing the setting of the prohibition of passage, in step S43, even if the HTTP client 62 of the server 2 issues a service request including the access right information in the HTTP request in the same manner as in step S41, the firewall 71 of the firewall 71 The request is rejected by the processing.

In step S33, the firewall 71 transmits a response to the service request, which denies access to the HTTP client 62. When the HTTP server 81 receives and processes such a response, the user can recognize that the access is denied.

Thereafter, for example, even if another user tries to access the same service illegally, the firewall 71 does not pass the packet, so that the unauthorized access can be prevented.

In the above description, the case where the access right information for permitting access is issued in the access control unit 72 has been described. However, regarding the case where the access right information for prohibiting access is issued, the flowchart of FIG. It will be described with reference to FIG. In step S61, the access right processing client 61 of the server 2 executes step S
The same process as 11 requests access to the server 4. The request is received by the access control unit 72 of the gateway 3 connected to the server 4.

When the access request is received, the access control unit 72 authenticates in step S71. As a result of the authentication process, the user ID of the user who has requested the access is stored in the access right database 73. If it is determined that it is not stored, step S
At 72, access right information including information that access is prohibited is issued.

Alternatively, when the user ID of the user who has requested the access is not stored in the access right database 73, the administrator of the server 4 treats such a user as a guest, and FIG. If it is set as shown in, the access right information is issued within the range of the access right given to the guest. At this time, in the example shown in FIG. 7, the user ID “guest” is associated with the HTTP service 81 and the FTP service 82.
Each one service is associated as permitting access, but if there is no associated service, access right information including information for prohibiting access is issued.

When access right information for prohibiting access is issued in this way, the access right information is transmitted to the server 2. In step S73, the access control unit 72 of the gateway 3 instructs the firewall 71 to set the passage prohibition. The firewall 71 performs the setting in step S81 according to the instruction.

On the other hand, the access right processing client 61 of the server 2 supplies the received access right information to the HTTP client 62 in step S62. HTTP
The client 62 transmits an HTTP request including the supplied access right information to the server 4 in step S91. The request is received by the firewall 71 of the gateway 3, but the firewall 71
Indicates that passage is prohibited, so step S8
At 2, the server 2 responds to the connection refusal.

The HTTP server 81 of the server 2, which has received such a connection refusal response, displays a screen which allows the user to recognize that the connection is refused by performing a predetermined process in step S92. To do.

In this way, by identifying the user in the gateway 3, it becomes possible to collectively control access to a plurality of servers and a plurality of services connected to the gateway 3.

Even if the service request from the server 2 passes through the firewall 71, the HTTP of the server 4
When the service 81 verifies the validity in step S51 (FIG. 6), it is determined that the service 81 is not valid,
As a result, the access request of the server 2 is prohibited. Further, even if the HTTP service 81 determines that there is legitimacy, it is determined in the access right verification in step S52 that no service is permitted to be provided, and as a result, the access request of the server 2 is issued. Is banned.

With the above-described procedure, it becomes possible to enable communication from the global network 1 such as the Internet to a service on the network 5, which is a local network, and at the same time control the access right to the service. .

In the above-described embodiment, the HT connected to the network 5 which is a local network.
Although the example of controlling the access from the network 1 to the TP service 81 has been described, the present invention is not limited to such a form, and can be similarly applied to the access control to other services. is there.

Next, another mode of this embodiment will be described. The overall configuration in FIG. 1 is the same. Also,
The servers 2-1 and 2-2 and the servers 4-1 and 4-2 have the same configurations as those shown in FIGS. 2 and 5, respectively. As shown in FIG. 9, the gateway 3 has a configuration in which the firewall 71 is removed from the gateway 3 shown in FIG.

The operation of such a configuration will be described with reference to the flowchart of FIG. here,
It is assumed that each of the server 2, the gateway 3, and the server 4 holds an identifier that can be uniquely distinguished. As the identifier, IPv6 (Internet Protocol Versio
It is possible to use the address specified in n 6).

The address specified in IPv6 is 1
It is composed of 28 bits, and the lower 64 bits thereof are a unique ID assigned to each device as an interface ID. In the following description, the case of using the lower 64-bit interface ID will be described as an example, but other information that can uniquely identify the device may be used.

The administrator of the server 4 creates the access right database 73 as shown in FIG. 7 in advance. Here, as the user ID, the interface I described above is used.
D is used, and its interface ID is created in association with the services provided by the HTTP service 81 and the FTP service 82, respectively.

Access right processing client 6 of server 2
The processing performed by step 1 in steps S101 and S102 is basically the same as the processing in steps S11 and S12 in the flowchart of FIG. 6, and the processing performed by the access control unit 72 of the gateway 3 in steps S111 and S112 is Since it is basically the same as the processing of steps S21 and S22 in the flowchart of FIG. 6, its detailed description is omitted.

In step S112, step S1
The access right information describing the access right to the service provided from the HTTP server 81 and the FTP server 82 is issued by the user ID (interface ID) of the user authenticated in the process of 11. Here, the address specified by IPv6 of the server 2 is "2001: 298: 2".
00: b87: 2d0: b7ff: fead: d26c ”, the lower 6
4-bit “0x02d0b7fffeadd26c” is acquired as an interface ID (user ID) unique to the server 2. The acquired interface ID is included in the issued access right information. At this time, when a restriction regarding the time limit is added, the information regarding the time limit is also included in the access right information.

In step S121, the HT of the server 2
The TP client 62 sends a service request to the server 4. The HTTP service 81 of the server 4 uses the HTTP including the received access right information in step S131.
The validity of the request is verified by using the public key of the access control unit 72 of the gateway 3 which is the signer. Also,
Verify the expiration date of access right information at the same time. If the verification is successful, the processing from step S131 is executed,
If the verification has failed, the processes in and after step S131 are not executed.

In step S132, the HTTP service 81 compares the interface ID as the user ID included in the access right information with the interface ID acquired from the IP address of the HTTP client 62 that sent the request, and if they match. , And the subsequent processing is executed and if they do not match, the access right information is considered invalid, the subsequent processing is not executed, and an error is returned to the server 2.

In this case, the verification of the ID in step S132 is performed by checking the lower 64 bits of the address "2001: 298: 200: b87 :: 2d0: b7ff: fead: d26c" specified by IPv6, which is given to the server 2. 0x02d0b7fffeadd26c ”is compared with the user ID included in the access right information.

Step S1 performed by the HTTP service 81
The processing of 33 and step S134 is the same as the processing of step S52 and step S53 of the flowchart of FIG. 6, so description thereof will be omitted.

By repeatedly performing the service request from the server 2 and the service provision from the server 4, the service request is issued from the server 2 after the period in which the access to the server 4 is permitted has elapsed. Then (step S123), in step S135, the HTTP service 81 determines that the validity period has expired when the validity is verified, and as a result, in step S136, the server requesting the provision of the service. For 2, the error response is executed.

In the above-described second embodiment, the server 4 that provides the service and the server 2 that receives the service.
Different from the first embodiment in that the gateway 3 located in the middle of is not related to the control for executing the service, the restriction on the connection form between the local network such as the home network and the wide area network such as the Internet. Has the advantage that For example, the present invention can be easily applied to the case where a local network and the Internet are connected by two gateways.

As described above, according to the present invention, the administrator of the local network can collectively set the access right to the services provided on the local network. Since access control can be performed collectively, for example, processing for control such as limiting the service usage period can be performed easily. In addition, in an environment where multiple server software are operated in the home, it is possible not only to control each service individually but also to easily control access to some services in common. Becomes

The series of processes described above can be executed by hardware, but can also be executed by software. When a series of processes is executed by software, it is possible to execute various functions by installing a computer in which the programs that make up the software are built into dedicated hardware, or by installing various programs. The recording medium is installed in a general-purpose personal computer, for example.

As shown in FIG. 2, the recording medium is a magnetic disk 41 (including a flexible disk) and an optical disk 42 on which the program is recorded, which is distributed in order to provide the program to the user, separately from the personal computer. (CD-ROM (Compact Disc-Read Only Memory),
Not only is it configured by a package medium such as a DVD (including a Digital Versatile Disc), a magneto-optical disc 43 (including an MD (Mini-Disc) (registered trademark)), or a semiconductor memory 44, but is also incorporated in a computer in advance. It is configured by a ROM 22 in which a program is stored, which is provided to the user in a stored state, and a hard disk including a storage unit 28.

In the present specification, the steps for describing the program provided by the medium are not limited to the processing performed in time series according to the order described, but may be performed in parallel even if the processing is not necessarily performed in time series. Alternatively, it also includes processes that are individually executed.

In this specification, the system means
It represents the entire apparatus composed of a plurality of devices.

[0099]

As described above, according to the information processing apparatus, method, and program of the present invention, when the user makes an access request to a predetermined service, the information is associated with the user identification information corresponding to the user. Since the access right information for reading out the service information that is present and limiting the access to the service including at least the read out service information is generated, the service management side verifies that the access right information is valid or not. By verifying the contents, it is possible to prevent unauthorized access and to easily set the access.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration of an embodiment of an information processing system of the present invention.

FIG. 2 is a diagram showing an internal configuration of a server 2.

FIG. 3 is a functional block diagram of a server 2.

FIG. 4 is a functional block diagram of a gateway 3.

FIG. 5 is a functional block diagram of a server 4.

FIG. 6 is a flowchart illustrating an operation of the information processing system shown in FIG.

FIG. 7 is a diagram illustrating data stored in an access right database 73.

8 is a flowchart illustrating another operation of the information processing system shown in FIG.

9 is another functional block diagram of the gateway 3. FIG.

10 is a flowchart illustrating another operation of the information processing system shown in FIG.

[Explanation of symbols]

1 network, 2 servers, 3 gateways, 4 servers, 61 access right processing client, 62 HTTP client, 63 FTP client, 71 firewall, 72 access control unit, 73 access right database, 81 HTTP
Services, 82 FTP services

Claims (8)

[Claims] 1. A storage unit for storing user identification information for identifying a user and service information relating to a service permitted to be accessed in association with the user, and an access request to the predetermined service from the user, Read out means for reading out the service information associated with the user identification information corresponding to the user from the storage means, and access right information for restricting access to the service, which is read out by the read out means. An information processing apparatus comprising: a generating unit that generates information including the service information; and a supplying unit that supplies the access right information generated by the generating unit to the user. 2. The information processing apparatus according to claim 1, wherein the generation unit generates the access right information including an electronic signature. 3. The information processing apparatus according to claim 1, wherein the generation unit generates the access right information including information regarding a period in which access to the service is permitted. 4. The information processing apparatus according to claim 1, further comprising an instruction unit that issues an instruction to a firewall based on the service information read by the reading unit. 5. The information processing apparatus according to claim 1, wherein the user identification information includes an interface ID of an address defined by IPv6. 6. A storage control step of controlling associated storage of user identification information for identifying a user and service information relating to a service to which access is permitted, the user requesting access to the predetermined service. In that case, the service information associated with the user identification information corresponding to the user is read from within the information whose storage is controlled by the storage control step, and at least the read service information is included. A generating step of generating access right information for limiting access to the service; and a supplying step of supplying the access right information generated in the processing of the generating step to the user. Information processing method. 7. A storage control step of controlling storage of associated user identification information for identifying a user and service information regarding a service to which access is permitted, the user requesting access to the predetermined service. In that case, the service information associated with the user identification information corresponding to the user is read from within the information whose storage is controlled by the process of the storage control step, and at least the read service information is included. A generating step of generating access right information for limiting access to the service; and a supplying step of supplying the access right information generated by the processing of the generating step to the user. A recording medium that stores a computer-readable program . 8. A storage control step of controlling storage in which user identification information for identifying a user and service information regarding a service to which access is permitted are associated with each other; In that case, the service information associated with the user identification information corresponding to the user is read from within the information whose storage is controlled by the storage control step, and at least the read service information is included. A program for causing a computer to execute a generation step of generating access right information for limiting access to the service, and a supply step of supplying the user with the access right information generated in the processing of the generation step.