JP2004070757A - Reference authority management system and method and program for the system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To disclose to a network even address information of an information server dynamically assigned by the connection agent of a network by highly accurately ensuring security. <P>SOLUTION: First, a user A performs the use registration of this main service in an address service server 12. Afterwards, an IP address registration requesting part registers the IP address of a home server 11 in each fixed period. When performing access to the home server 11, a client terminal 13 requests the issue of an access ticket, and inquires for the IP address of the home server 11. When the client terminal 13 actually accesses the home server 11, the address service server 12 checks the validity of the access ticket. When the access ticket is certified as a valid ticket, the communication state is established, so that the data can be browseable. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a reference authority management system, a method, and a program for managing an authority to refer to information stored in an information server via a network when the information server is connected to a network such as the Internet. .
[0002]
[Prior art]
In recent years, as the use of networks such as the Internet and the continuous connection have become widespread, it has become common practice to constantly connect each user's personal computer and the like to the network and release it as an information server to the outside. I have.
However, exposing the server to the outside means that it has the possibility of being attacked from all over the world. For this reason, by registering the ID and the password in the information server, management of reference authority to the information server is performed.
[0003]
As a system using such a password, there is a user authentication system disclosed in JP-A-2002-82910. When a user refers to data of an information server from a first terminal device via a network, the system accesses the information server from a second terminal device such as a portable terminal to acquire a password, and acquires the acquired password. The user inputs from the first terminal device, and the authentication server performs user authentication based on the input password.
According to this, it is possible to exclude a person other than a specific user from accessing the information server from the terminal device with a relatively simple configuration.
[0004]
[Problems to be solved by the invention]
However, in the conventional management of the reference authority using the ID and the password, if the ID and the password are stolen by someone, there is a risk that the access will be unauthorized unless the user changes the password. There is a problem that leaves anxiety.
[0005]
Further, even though the constant connection to the network is becoming widespread, few users own information servers to which address information such as a fixed IP address (Internet Protocol Address) is assigned, and the ISP dynamically (Internet Service Provider) A large number of users use an IP address assigned by a connection provider such as a provider. As a result, when accessing an information server via a network, access is possible only when the IP address of the information server is known in advance.
Therefore, the reason that an individual user can open an information server such as a personal computer at home to the outside is that it is possible to construct a firewall or the like by himself, and also to have a technical ability with an information server to which a fixed IP address is assigned. Only some users.
[0006]
In the user authentication system disclosed in the above-mentioned Japanese Patent Application Laid-Open No. 2002-82910, user authentication is performed by acquiring a password from an information server by a second terminal device. It is necessary to use a second terminal device separately from the first terminal device that performs the above.
Further, after accessing from the second terminal device and acquiring the password, it is necessary for the user to re-enter the password in the first terminal device, and there is a problem in the easiness of the operation by the user.
[0007]
The present invention has been made in view of such a situation, and has the following objects.
A first object is to provide a reference authority management system, method, and method capable of exposing an information server to a network without requiring another device or an operation for the other device, while ensuring security with high accuracy. It is to provide a system program.
[0008]
A second object is to provide a reference authority management system, a method, and a program for the system, which can open an information server to a network without requiring a technical ability to construct a firewall or the like.
[0009]
A third object is to provide a reference authority management system and method capable of opening an information server to a network even when address information for specifying the information server is address information dynamically assigned by a network connection provider or the like. , And to provide a system program.
[0010]
[Means for Solving the Problems]
In order to achieve such an object, the present invention has the following features.
The invention according to claim 1 is a system in which an information server, a client terminal, and a management server having access ticket issuing means for issuing an access ticket indicating an access right to the information server are connected via a network. Wherein the client terminal sends an access ticket issued by the access ticket issuing means to the information server, and issues an information reference request to the information server. The information server includes a confirmation request unit for requesting the management server to confirm the validity of the transmitted access ticket, and the management server confirms that the access ticket requested by the confirmation request unit is valid. It is equipped with access ticket confirmation means to confirm whether or not To.
[0011]
According to a second aspect of the present invention, the access ticket issuance unit newly issues an access ticket having an expiration date every time a request is made, and the management server issues an access ticket issued by the access ticket issuance unit to the access ticket. There is provided an expiration date management unit that stores the expiration dates of the tickets in association with each other, and the access ticket checking unit checks whether the access ticket is valid with reference to the expiration date management unit.
[0012]
According to a third aspect of the present invention, the information server includes address information registration request means for requesting the management server to register the address information of the information server at predetermined time intervals. Address information storage means for storing address information of the information server in response to a registration request of the information server. The access ticket request means of the client terminal stores the address information of the information server in the address information storage means when requesting the access ticket from the management server. The information reference requesting means issues an information reference request to the address information of the information server acquired by the request from the access ticket requesting means.
[0013]
According to a fourth aspect of the present invention, the management server includes a usage right registration unit that receives registration of the usage right by an ID of a user who grants the usage right, and the usage right registration unit transmits the registered ID to an expiration date. The access ticket issuing unit receives the request for issuance together with the ID of the user who made the request, refers to the expiration date management unit, and stores the ID of the requesting user in the expiration date management unit. , The access ticket and the expiration date of the access ticket are stored in association with the ID.
[0014]
The invention according to claim 5 is a reference authority management method in a system in which an information server, a client terminal, and a management server are connected via a network, wherein the client terminal requests the management server for an access ticket. A ticket requesting step, an access ticket issuing step in which the management server issues an access ticket indicating an access right to the information server, and sending the access ticket issued in the access ticket issuing step to the information server and referring to the information server for information. An information reference requesting step for issuing a request, a confirmation requesting step in which the information server requests the management server to confirm the validity of the transmitted access ticket, and whether the access ticket for which the confirmation request is issued in the confirmation requesting step is valid And an access ticket confirming step in which the management server confirms the It is characterized in.
[0015]
According to a sixth aspect of the present invention, in the access ticket issuing step, a new access ticket having an expiration date is newly issued every time an access ticket is requested, and the management server adds the access ticket issued in the access ticket issuing step to the access ticket. And an expiration date management means for storing the expiration dates in association with each other. In the access ticket checking step, the access ticket is checked for validity with reference to the expiration date management means.
[0016]
According to a seventh aspect of the present invention, the information server performs an address information registration requesting step of requesting the management server to register the address information of the information server at predetermined time intervals, and the management server registers the address information in the address information registration requesting step. An address information storing step of storing address information of the information server in response to the request; in the access ticket requesting step, when the client terminal requests the access ticket from the management server, the address information of the information server stored in the address information storing step is also stored. In the request and information reference requesting step, an information reference request is issued to the address information of the information server acquired by the request in the access ticket requesting step.
[0017]
In the invention according to claim 8, the use right registration step in which the management server registers the use right by the ID of the user who grants the use right is performed before the access ticket requesting step. The received ID is stored in the expiration date management means, and in the access ticket requesting step, the management server receives the issuance request together with the ID of the user who made the request, and in the access ticket issuing step, refers to the expiration date management means. Then, when the ID of the user who made the request is stored in the expiration date management unit, the access ticket and the expiration date of the access ticket are stored in association with the ID.
[0018]
The invention according to claim 9 is a program for a reference authority management system in which an information server, a client terminal, and a management server are connected via a network, and requests the client terminal for an access ticket from the management server. Causing the management server to execute an access ticket issuing process for issuing an access ticket indicating an access right to the information server, and causing the client terminal to transmit the access ticket issued in the access ticket issuing process to the information server. And the information server executes an information reference request process for issuing an information reference request, and causes the information server to execute a confirmation request process for requesting the management server to confirm the validity of the transmitted access ticket. The access ticket for which the confirmation request was issued in the confirmation request process Doo is characterized in that to execute the access ticket confirmation process for confirming whether legitimate or not.
[0019]
According to a tenth aspect of the present invention, in the above access ticket issuance processing, a new issuance is performed every time an access ticket having an expiration date is requested, and the management server accesses the access ticket issued in the access ticket issuance processing. An expiration date management unit for storing the expiration dates of the tickets in association with each other is provided, and in the access ticket confirmation processing, it is determined whether or not the access ticket is valid by referring to the expiration date management unit.
[0020]
The invention according to claim 11 causes the information server to execute an address information registration request process for requesting registration of the address information of the information server to the management server at predetermined time intervals, and causes the management server to execute the address information registration request process. In the access ticket requesting process, when the client terminal requests the management server for the access ticket, the information server stored in the address information storing process is executed. In the information reference request processing, an information reference request is issued to the address information of the information server acquired by the request in the access ticket request processing.
[0021]
According to a twelfth aspect of the present invention, the management server executes the use right registration process of receiving the use right registration by the ID of the user who grants the use right before the access ticket request process. The received ID is stored in the expiration date management means, and in the access ticket request processing, the management server receives the issuance request together with the ID of the user who made the request. When the ID of the user making the reference and making the request is stored in the expiration date management unit, the access ticket and the expiration date of the access ticket are stored in association with the ID.
[0022]
BEST MODE FOR CARRYING OUT THE INVENTION
Next, a reference authority management system, method, and system program according to the present invention will be described in detail with reference to FIGS.
[0023]
As shown in FIG. 1A, the reference authority management system according to the first embodiment of the present invention includes a home server (information server) 11, an address service server (management server) 12, and a client terminal 13. They are connected to each other via the Internet.
The connection from the client terminal 13 to the Internet is not limited to the constant connection shown in FIG. 1A. For example, as shown in FIG. And may be connected by dial-up via a telephone line. That is, when the user accesses the address service server 12 from the client terminal 13, the client terminal 13 connects to the address service server 12 via the Internet by dial-up or the like, and accesses the home server 11 from the client terminal 13. In doing so, the client terminal 13 may connect to the home server 11 via the Internet by the above dial-up or the like.
[0024]
As shown in FIG. 2, the home server (information server) 11 periodically accesses the address service server 12, and registers an IP address of the home server 11 (an IP address registration request unit). 111, an information reference unit 113 that receives an information reference request from the client terminal 13 and calls the access ticket confirmation request unit 112, and an access ticket confirmation request unit 112 that confirms the validity of the access ticket received from the client terminal 13. It is configured with.
[0025]
The address service server (management server) 12 has a use right registration unit 121 for registering whether there is a public right to publish the home server 11 or a use right to use (refer to) the home server 11, and regularly accesses from the home server 11. An IP address registration unit (address information registration unit) 122 that registers the IP address of the home server 11 by the access and receives an ID / PW (a combination of a user ID and a password) from the client terminal 13 and sends the ID / PW to the client terminal 13. Requests an IP address inquiry section (address information inquiry section) 123 for returning the IP address of the home server 11 and an access ticket having an expiration date to permit access to the home server 11 (indicating an access right to the home server). Access ticket issuance department newly issued every time 24, configured by a client terminal 13 confirms the validity receive access ticket from the (access ticket to check authenticity or not) access ticket checking unit 125 for.
[0026]
Further, the client terminal 13 requests an IP address inquiry request unit (address information inquiry request unit) 131 for inquiring the IP address of the home server 11 from the address service server 12 and requests the home server 11 for information reference. And an information reference request unit 132.
[0027]
The above-described home server 11, address service server 12, and client terminal 13 include a control unit (not shown) such as a CPU, a storage unit (not shown) such as an HDD, and a communication unit such as an Ethernet (registered trademark). A predetermined program is stored in the storage unit, and the control unit performs a processing operation according to the program, so that the home server 11, the address service server 12, and the client terminal 13 perform the above-described operations. It is configured by each function.
[0028]
Next, an outline of an operation when a user accesses information of the home server 11 from the client terminal 13 in the reference authority management system according to the present embodiment will be described with reference to FIGS.
As described below, this reference authority management system provides a method in which a personal computer or the like of a user's home is securely disclosed to the outside as a home server.
[0029]
First, the user A registers the use of this service with the address service server 12 (step S1). Thereafter, the resident process on the home server 11 is started, and the started resident process (IP address registration request unit) registers the IP address of the home server 11 with the address service server 12 at regular intervals (step). S2).
At the time of this registration, the address service server 12 checks whether the authentication and disclosure authority by ID / PW have been registered, thereby eliminating access from an unauthorized user. Also, by registering at regular intervals, even if the connection to the Internet is interrupted or the IP address is changed, the new IP address will be re-registered to the address service server 12 after the preset fixed period. Therefore, it is possible to prevent the IP address of the home server 11 from being different from the IP address registered in the address service server 12 with high accuracy. In other words, even if the IP address of the home server 11 is dynamically assigned by an ISP or the like, the IP address registered in the address service server 12 can be matched with high accuracy.
[0030]
When accessing the home server 11 from the client terminal 13, the user A requests the address service server 12 from the client terminal 13 to issue an access ticket indicating an access right to the home server 11, and also issues an IP address of the home server 11. (Step S3). Also at this time, the address service server 12 eliminates unauthorized access from others by performing ID / PW authentication.
When returning the IP address (URL) to the client terminal 13, the address service server 12 newly issues an access ticket and returns it together with the IP address (step S4). When the client terminal 13 actually accesses the home server 11, the address service server 12 checks the validity of the access ticket, thereby restricting access from others (steps S6 and S7). . When the ticket is recognized as a valid ticket by this check, the communication state is established, and the client terminal 13 can refer to the data of the home server 11 (step S8).
The access ticket has an expiration date and becomes invalid after the expiration date, so that the access ticket can be prepared for theft.
[0031]
Next, a series of operations described above in the reference authority management system according to the present embodiment will be described in detail with reference to FIGS. 4 shows step S1, FIG. 5 shows step S2, FIG. 6 shows steps S3 and S4, and FIG. 7 shows steps S5 to S8, respectively.
[0032]
First, the user A sends his (user A) ID and PW (password) to the address service server 12, as shown in FIG. 4, in order to make his home server 11 publicly accessible from the outside. A request for registration of the use right is sent (step S1). This registration request may be made from any terminal that can communicate with the address service server 12, for example, from the home server 11.
The use right registration unit 121 of the address service server 12 performs the personal authentication using the ID / PW of the user A, and sets the public right on the user management DB 126 to “Yes” when the user is confirmed.
[0033]
When the publishing authority is registered, the user A sets the ID / PW of the user A in the IP address registration request unit (address information registration request unit) 111 of the home server 11 and makes it resident. The resident IP address registration request unit 111 accesses the IP address registration unit (address information registration unit) 122 of the address service server 12 at regular time intervals as shown in FIG. / PW and the IP address of the home server 11 are passed (step S2). That is, a registration request is made to the address service server 12 for the IP address of the home server 11 using the ID / PW.
Note that the time interval of the registration request by the resident IP address registration request unit 111 may be predetermined or set by the user.
[0034]
Upon receiving the ID / PW and the IP address from the home server 11, the IP address registration unit 122 checks the validity of the received ID / PW of the user A with reference to the user management DB 126, and when there is no problem. Is stored in the IP address management DB (address information storage means) 127 in association with the user A's ID.
[0035]
When the user A tries to access the home server 11 from the client terminal 13 such as when he / she wants to refer to the information of the home server 11 after going out, as shown in FIG. (Information inquiry requesting unit) 131 is started. The IP address inquiry request unit 131 sends the ID / PW of the user A to the IP address inquiry unit (address information inquiry unit) 123 of the address service server 12 and requests the IP address of the home server 11 and the access ticket. (Step S3).
The IP address inquiry unit 123 confirms the validity and disclosure authority of the received ID / PW in the user management DB 126, and if there is no problem, refers to the IP address corresponding to the ID from the IP address management DB 127. That is, when the received ID / PW is valid and the disclosure right is set to “Yes” (when the use right is registered), the IP address inquiry unit 123 associates the received ID / PW with the received user A ID. The IP address of the home server 11 stored in the IP address management DB 127 is obtained.
[0036]
When the IP address of the home server 11 is acquired, the IP address inquiry unit 123 calls the access ticket issuing unit 124, and the access ticket issuing unit 124 issues an access ticket indicating an access right to the home server 11 and having a valid period. I do. The access ticket issuing unit 124 associates the access ticket issued as a reference authority of the user A to the home server 11 and the expiration date with the ID of the user A in the reference authority management DB (expiration date management unit) 128 in association with the user A ID. Store.
Upon obtaining the IP address and the access ticket of the home server 11 as described above, the IP address inquiry unit 123 returns the IP address and the access ticket to the client terminal 13 (Step S4).
[0037]
Upon receiving the above IP address and access ticket from the address service server 12, the information reference request unit 132 of the client terminal 13 accesses the received IP address of the home server 11 as shown in FIG. The ticket is sent (step S5).
The transmission of the access ticket may be a method incorporated as a part of the IP address as shown in FIG. 7, or may be another method.
[0038]
In the home server 11, the information reference unit 113 is resident, and upon receiving an access request (information reference request) from the client terminal 13, activates the access ticket confirmation request unit 112. The access ticket confirmation request unit 112 passes the ID / PW and the access ticket to the access ticket confirmation unit 125 of the address service server 12 to confirm the validity of the received access ticket, and requests an inquiry (step S6). .
[0039]
The access ticket confirmation unit 125 of the address service server 12 checks the validity of the ID / PW received from the access ticket confirmation request unit 112 of the home server 11 by referring to the user management DB 126. If there is no problem with the validity of the ID / PW, the access ticket confirming unit 125 compares the access ticket stored in the reference authority management DB 128 associated with the ID of the user A with the received access ticket, If it is confirmed that the access ticket has not expired, it is determined that the ticket is a valid access ticket, and an OK confirmation result is returned to the home server 11 (step S7).
After confirming the validity of the access ticket, the client terminal 13 can freely browse the information of the home server 11 (step S8). That is, when the home server 11 receives a notification that the access ticket is valid from the address service server 12, a communication state is established between the home server 11 and the client terminal 13 so that data can be exchanged. become.
[0040]
Next, a reference authority management system according to a second embodiment of the present invention will be described.
In the reference authority management system according to the second embodiment, the user A who discloses the home server 21 and the user B who references the home server 21 from the client terminal 23 may be different persons, and may be plural. Good thing. That is, in the reference authority management system according to the first embodiment described above, for example, as shown in FIG. 8, a person who has reference authority to refer to the home server 21 from the client terminal 23 transmits to the user A who publishes the home server 21. The present invention is not limited to this, and may be plural.
[0041]
The configuration of the reference authority management system according to the second embodiment includes, as shown in FIG. 8, each functional unit included in the reference authority management system according to the first embodiment described above with reference to FIGS. As described above, the person having the reference authority is not limited to the user A, and may be plural.
That is, the home server 21, the address service server 22, and the client terminal 23 are connected to each other via the Internet in the same manner as in the first embodiment described with reference to FIG.
Further, upon receiving the registration request, the usage right registration unit 221 sets the disclosure right stored in the user management DB 226 to “Yes” for the user A who owns the home server 21 as the right to open the home server 21. As the use authority for using (referencing) the home server 21, the ID of the user who has received the use authority registration request from the user having the public authority “Yes” is stored in the reference authority management DB 228 as a referenceable ID.
The reference authority management DB (expiration date management means) 228 stores the ID of the user A having the authority to publish the home server 21 in association with the above-mentioned referenceable ID, and stores the referenceable ID from the user in which the referenceable ID is stored. When the access ticket is issued in response to the request, the access ticket issued for the user's referenceable ID and the expiration date are stored in association with each other.
[0042]
As for the outline of the operation, the outline of the operation in the first embodiment described above with reference to FIGS. 2 and 3 is not limited to the user A but has a plurality of persons having the reference authority as described above. It is also made possible.
That is, in step S1, the user A registers with the address service server 12 the public authority indicating that the user is the owner of the home server 11 (has administrative authority), and the user B who grants the use authority of the service Is registered as a referenceable ID (registration of use authority).
In step S3, the client terminal 23 requests the IP address of the home server 21 and the access ticket for access to the home server 21. However, a referenceable ID, not the user A, is registered in the reference authority management DB 228. The user B may be.
When the access ticket issuing unit 224 issues an access ticket in step S4, the access ticket issuing unit 224 refers to the reference authority management DB 228 and sets the ID of the user B who has issued the request as the referenceable ID. It is checked whether or not it is registered, and if it is registered as a referenceable ID, an access ticket is issued.
[0043]
Next, a series of operations shown in FIG. 3 in the reference authority management system according to the second embodiment will be described in detail with reference to FIGS. 9 shows step S1, FIG. 10 shows step S2, FIG. 11 shows steps S3 and S4, and FIG. 12 shows steps S5 to S8 for each operation shown in FIG.
[0044]
When the user A registers the publication authority in the address service server 22, the ID of the user B who wants to make the home server 21 public is sent to the address service server 22, as shown in FIG. 9 (step S1). That is, the ID of the user B (ID that can be referred to) that enables the data of the home server 21 to be referred to by the access from the client terminal 23, together with the ID and the password of the user A, the use authority registration unit of the address service server 22. 221 to request registration of the use authority (reference authority).
This registration request may be made from any terminal that can communicate with the address service server 12, for example, from the home server 11.
[0045]
The use right registration unit 221 performs the personal authentication of the user A who has accessed the user management DB 226 using the received ID and password of the user A, and after registering the public right of the home server 21 as “Yes”, The ID of the user B is stored (registered) in the reference authority management DB (expiration date management means) 228 as the use authority (reference authority) for the home server 21 owned by the user A in association with the ID of the user A as a referenceable ID. . The reference authority to one home server 21 can register a plurality of users by registering a plurality of IDs in the reference authority management DB 228.
[0046]
When the public authority is registered, as shown in FIG. 10, the user A makes the IP address registration request unit (address information registration request unit) 211 resident in the home server 21 similarly to the first embodiment, and registers the IP address. The request unit 211 requests the address service server 22 to register an IP address at regular intervals (step S2).
Accordingly, the IP address registration unit (address information registration unit) 222 checks the validity of the ID / PW of the user A with reference to the user management DB 226 as in the first embodiment. The IP address of the home server 21 is stored in the IP address management DB (address information storage unit) 227 in association with the ID of the user A.
[0047]
When the user B refers to the information of the home server 21 of the user A, as shown in FIG. 11, the IP address inquiry request unit (address information inquiry request unit) 231 transmits the ID / PW of the user B and the home server 21 to be referred to. Sends the ID of the user A who is the owner of the home server 21 to the address service server 22, and requests the IP address of the home server 21 and the access ticket indicating the right to access the home server 21 (step S3).
The IP address inquiry unit (address information inquiry unit) 223 checks the validity of the ID / PW of the received user B and the public authority in the user management DB 226. If there is no problem, the owner of the home server 21 to be referred to is The IP address is referred to in the IP address management DB 227 from the ID of a certain user A. That is, when the received ID / PW of the user B is valid, the IP address inquiry unit 223 acquires the IP address of the home server 21 stored in the IP address management DB 227 in association with the received ID of the user A. I do.
[0048]
When the IP address of the home server 21 is obtained, the IP address inquiry unit 223 calls the access ticket issuing unit 224. The access ticket issuing unit 224 refers to the reference authority management DB 228 to check whether the ID of the user B is stored (registered) as a referenceable ID, and when the ID is stored, the access right to the home server 21 is determined. Is issued, and the access ticket of the user A to the home server 21 and the expiration date thereof are stored in the reference authority management DB 228 in association with the ID of the user B.
Upon acquiring the IP address and the access ticket of the home server 21 as described above, the IP address inquiry unit 223 returns the IP address and the access ticket to the client terminal 23 (Step S4).
[0049]
Upon receiving the above-mentioned IP address and access ticket from the address service server 22, the information reference request unit 232 of the client terminal 23 accesses the received IP address of the home server 21 as shown in FIG. The ticket is sent (step S5).
The transmission of the access ticket may be a method of transmitting the access ticket separately from the IP address as shown in FIG. 12, or may be another method.
[0050]
In the home server 21, when the information reference unit 213 is resident and receives an access request (information reference request) from the client terminal 23, it activates the access ticket confirmation request unit 212. The access ticket confirmation request unit 212 sends the ID / PW registered in the home server 21 and the access ticket passed from the client terminal 23 to the address service server 22 in order to confirm the validity of the received access ticket. Then, an inquiry is requested to the access ticket confirmation unit 225 (step S6).
[0051]
The access ticket confirmation unit 225 of the address service server 22 refers to the user management DB 226 to confirm the validity of the ID / PW received from the access ticket confirmation request unit 212 of the home server 21. If there is no problem in the validity of the ID / PW, the access ticket confirming unit 225 associates the received ID and the received access ticket with the referenceable ID in the reference authority management DB 228 and the referenceable ID such as the user B. The access ticket is compared with the stored access ticket to confirm whether or not the access right exists (whether or not the access rights are the same). If the expiration date is not exceeded, the access ticket is valid. And returns an OK confirmation result to the home server 21 (step S7).
After confirming the validity of the access ticket, the client terminal 23 can freely browse the information of the home server 21 (step S8). That is, when the home server 21 receives a notification that the access ticket is valid from the address service server 22, a communication state is established between the home server 21 and the client terminal 23 so that data can be exchanged. become.
[0052]
As described above, the reference authority management system as each of the above-described embodiments makes it possible to refer to the information of the home server at home or the like from a client terminal such as a personal computer, a mobile terminal, or a mobile phone while going out while ensuring security. be able to.
The reason is that an access ticket is always required when accessing the home server, and if there is no access ticket or if it is determined that the access ticket is invalid, an information reference to the home server results in an error. . Also, every time an access is made to the address service server, a different access ticket is newly issued, so that it is very difficult to forge the access ticket.
[0053]
Further, even a user who cannot construct a firewall or the like can easily open the home server and refer to the home server from the client terminal.
In addition, not only the IP address fixedly assigned when the home server is opened to the outside but also the IP address dynamically assigned by the ISP or the like can be easily opened. Become like
[0054]
In each of the above-described embodiments, the home server, the address service server, and the client terminal are described as being connected to each other via the Internet. Other networks may be used.
In the case where the connection is made via another network, the address in the network may be specified as address information that can be specified instead of the IP address.
[0055]
【The invention's effect】
As described above, in the present invention, the management server issues an access ticket indicating an access right to the information server, and the management server checks whether the access ticket sent to the information server is valid.
As a result, for example, even a user who does not have the technical ability to construct a firewall or the like can open the information server to the network while ensuring security.
[0056]
The access ticket having a validity period is newly issued every time a request is made from the client terminal.
As a result, it is possible to make it difficult to forge the access ticket, and it is possible to prevent the security from being lost even if the access ticket is stolen.
[0057]
Further, the address information of the information server is registered in the management server at predetermined time intervals, and the client terminal issues an information reference request to the address information of the information server acquired from the management server.
As a result, even when the address information specifying the information server is the address information dynamically assigned by the network operator or the like, the client terminal can access the information server with high accuracy.
[0058]
Further, the management server receives the registration of the use right by the ID of the user who grants the use right, and the access ticket is obtained when the ID of the user who has issued the issuance request is stored in the expiration date management unit of the management server. Issued to
As a result, a user who is authorized to use the information server can access the information server from the client terminal even if the user does not own (disclose) the information server.
[Brief description of the drawings]
FIG. 1 is a block diagram illustrating an outline of a reference authority management system according to a first embodiment of the present invention.
FIG. 2 is a block diagram illustrating an outline of a configuration and operation in the reference authority management system.
FIG. 3 is a timing chart illustrating an outline of an operation in the reference authority management system as the embodiment of the present invention.
FIG. 4 is a block diagram illustrating an operation of a reference authority management system as a first embodiment in step S1 of FIG. 3;
FIG. 5 is a block diagram illustrating an operation of the reference authority management system in step S2 of FIG. 3;
FIG. 6 is a block diagram illustrating an operation of the reference authority management system in steps S3 and S4 of FIG. 3;
FIG. 7 is a block diagram illustrating an operation of the reference authority management system in steps S5 to S8 of FIG. 3;
FIG. 8 is a block diagram illustrating an outline of a reference authority management system according to a second embodiment of the present invention.
FIG. 9 is a block diagram illustrating an operation of a reference authority management system as a second embodiment in step S1 of FIG. 3;
FIG. 10 is a block diagram illustrating an operation of the reference authority management system in step S2 of FIG. 3;
FIG. 11 is a block diagram illustrating an operation of the reference authority management system in steps S3 and S4 of FIG. 3;
FIG. 12 is a block diagram illustrating an operation of the reference authority management system in steps S5 to S8 of FIG. 3;
[Explanation of symbols]
11, 21 Home server (information server)
111, 211 IP address registration request section (address information registration request section)
112, 212 Access ticket confirmation request section
113, 213 Information reference section
12, 22 Address service server (management server)
121, 221 use authority registration unit
122, 222 IP address registration unit (address information registration unit)
123, 223 IP address inquiry section (address information inquiry section)
124, 224 access ticket issuing unit
125, 225 Access ticket confirmation section
126, 226 User management DB
127, 227 IP address management DB (address information storage means)
128, 228 Reference authority management DB (expiration date management means)
13,23 Client terminal
131, 231 IP address inquiry request section (address information inquiry request section)
132, 232 information reference request section

Claims (12)

A system comprising: an information server, a client terminal, and a management server including an access ticket issuing unit that issues an access ticket indicating an access right to the information server via a network,
The client terminal,
Access ticket requesting means for requesting the management server for an access ticket, and information reference requesting means for sending an access ticket issued by the access ticket issuing means to the information server and issuing an information reference request to the information server. ,
The information server comprises:
A confirmation requesting unit for requesting the management server to confirm the validity of the transmitted access ticket,
The management server,
A reference authority management system, comprising: an access ticket confirmation unit that confirms whether an access ticket for which a confirmation request has been issued from the confirmation request unit is valid. The access ticket issuance means newly issues an access ticket having an expiration date every time it is requested,
The management server includes an expiration date management unit that stores an access ticket issued by the access ticket issuing unit in association with an expiration date of the access ticket,
2. The reference authority management system according to claim 1, wherein the access ticket confirmation unit refers to the expiration date management unit to confirm whether the access ticket is valid. The information server includes an address information registration request unit that requests the management server to register address information of the information server at predetermined time intervals,
The management server includes an address information storage unit that stores address information of the information server in response to a registration request from the address information registration request unit,
The access ticket requesting means of the client terminal, when requesting an access ticket from the management server, also requests the address information of the information server from the address information storage means,
3. The reference authority management system according to claim 1, wherein the information reference request unit issues the information reference request to address information of the information server acquired by a request from the access ticket request unit. The management server includes a usage right registration unit that receives registration of the usage right by an ID of a user who grants the usage right,
The use right registration unit stores the registered ID in the expiration date management unit,
The access ticket issuance unit receives the request for issuance together with the ID of the user who made the request, refers to the expiration date management unit, and stores the ID of the requesting user in the expiration date management unit. 4. The reference authority management system according to claim 2, wherein when there is, the access ticket and the expiration date of the access ticket are stored in association with the ID. A reference authority management method in a system in which an information server, a client terminal, and a management server are connected via a network,
An access ticket requesting step in which the client terminal requests an access ticket from the management server;
An access ticket issuing step in which the management server issues an access ticket indicating an access right to the information server,
Sending an access ticket issued in the access ticket issuing step to the information server and issuing an information reference request to the information server; and confirming the validity of the access ticket sent by the information server to the information server. A confirmation request process requesting the management server;
An access ticket confirming step in which the management server confirms whether or not the access ticket for which the confirmation request has been issued in the confirmation requesting step is valid. In the access ticket issuance step, a new access ticket is issued every time an access ticket having an expiration date is requested,
The management server includes an expiration date management unit that stores an access ticket issued in the access ticket issuance process in association with an expiration date of the access ticket,
6. The reference authority management method according to claim 5, wherein in the access ticket confirmation step, the validity period management unit is referred to confirm whether the access ticket is valid. The information server performs an address information registration requesting step of requesting registration of the address information of the information server to the management server every predetermined time,
The management server comprises an address information storage step of storing address information of the information server by a registration request in the address information registration request step,
In the access ticket requesting step, when the client terminal requests an access ticket from the management server, the client terminal also requests the address information of the information server stored in the address information storing step,
7. The reference authority management method according to claim 5, wherein in the information reference requesting step, the information reference request is issued to the address information of the information server acquired by the request in the access ticket requesting step. Performing a use right registration step in which the management server receives the use right registration by an ID of a user who grants the use right before the access ticket requesting step;
In the use authority registration step, the registered ID is stored in the expiration date management unit,
In the access ticket requesting step, the management server receives a request for issuance together with the ID of the user who made the request,
In the access ticket issuing step, the expiration date management unit is referred to, and when the ID of the requesting user is stored in the expiration date management unit, the access ticket and the expiration date of the access ticket are determined. 8. The reference authority management method according to claim 6, wherein the reference authority management method is stored in association with an ID. An information server, a client terminal, and a management server, which are connected to each other via a network.
Causing the client terminal to execute an access ticket request process for requesting an access ticket from the management server;
Causing the management server to execute an access ticket issuing process of issuing an access ticket indicating an access right to the information server;
The client terminal sends an access ticket issued in the access ticket issuance process to the information server and executes an information reference request process of issuing an information reference request to the information server,
Causing the information server to execute a confirmation request process of requesting the management server to confirm the validity of the sent access ticket;
A program for a reference authority management system, characterized by causing the management server to execute an access ticket confirmation process for confirming whether an access ticket for which a confirmation request has been issued in the confirmation request process is valid. In the access ticket issuance process, a new access ticket having an expiration date is newly issued each time an access ticket is requested,
The management server includes an expiration date management unit that stores an access ticket issued in the access ticket issuance process in association with an expiration date of the access ticket,
10. The program according to claim 9, wherein in the access ticket confirmation processing, it is confirmed whether the access ticket is valid by referring to the expiration date management unit. Causing the information server to execute an address information registration request process for requesting registration of the address information of the information server to the management server at predetermined time intervals;
Causing the management server to execute an address information storage process of storing the address information of the information server according to the registration request in the address information registration request process;
In the access ticket requesting process, when the client terminal requests an access ticket from the management server, the client terminal also requests the address information of the information server stored in the address information storing process,
11. The reference authority management system according to claim 9, wherein in the information reference request processing, the information reference request is issued to the address information of the information server acquired by the request in the access ticket request processing. program. Causing the management server to execute a usage right registration process of receiving a usage right registration by an ID of a user who grants the usage right before the access ticket requesting process;
In the use right registration process, the registered ID is stored in the expiration date management unit,
In the access ticket request processing, the management server receives a request for issuance together with the ID of the user who made the request,
In the access ticket issuance process, the access ticket and the expiration date of the access ticket are referred to when the ID of the requesting user is stored in the expiration date management unit with reference to the expiration date management unit. 12. The program according to claim 10, wherein the program is stored in association with an ID.

Images