JP2004086490A - Integrated service system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To simplify procedures for services that users utilize by presenting a list of the services only that the users can utilize when limiting the services that the users can utilize. <P>SOLUTION: This integrated service system comprises individual service information accumulating means 112 for accumulating information for the plurality of individual services, individual service attribute managing means 113 for managing the attributes of the individual services, user certifying means 111 for certifying the users when the users access it, and individual service list creating means 114 for creating the list of the individual services that the users can utilize from the information for the individual services accumulated by the individual service information accumulating means 112 and for presenting the list to the certified users. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an integrated service device that presents information of at least one service providing site that can be used by a predetermined user via a network to a terminal device of the predetermined user via the network, and particularly to a large number of services on the network. The present invention relates to an integrated service device that presents information about a service provided by a providing site in a form that facilitates use by the user.
[0002]
[Prior art]
Recently, web services have been attracting attention. A web service is a series of mechanisms for a user (service user) to search for and use the functions of an application published on a network by a service provider. The functions of the server can be easily performed from another device. Can be called. The web service is realized by using standard Internet technologies (protocols and the like). Web services are often defined using protocols such as HTTP and XML, so they do not depend on the platform, so that cooperation between web services is also easy.
By the way, the client does not always know in advance the URL of the service he wants to use. To cope with such a case, a method of dynamically detecting a service and a method of using a service registry have been proposed.
[0003]
To dynamically detect a service, a method of broadcasting or multicasting an inquiry to a network is generally used. For example, a service detection method using Simple Service Discovery Protocol (SSDP) has been proposed. SSDP defines a method for detecting web services. SSDP is based on HTTP and HTTPMU, and the control point (software that obtains UPnP service and device descriptions, sends actions to services, receives events from services) searches for resources of interest It defines how and how devices announce availability. Here, UPnP (Universal Plug and Play) is an architecture that provides a plug and play function to peer-to-peer network devices. In this way, all control points on the network are able to keep track of network traffic and still know correctly about network conditions. When the control point and the device use the SSD and the communication with the control point is started by UPnP, the control point and the device can send an SSDP search request through the HTTPMU to detect devices and services available on the network. The control point can be adjusted to search for only certain types of devices, such as, for example, VCRs, or only certain types of services, such as clock services, or only certain devices.
[0004]
On the other hand, in the method of searching for a service using a registry, a service provider registers service contents and the like in a registry and publishes the service. The service broker manages information on the contents of services provided by a plurality of service providers. The user accesses the registry, searches for a service, and obtains information for using the service. Next, XML documents required for coordination of the Web application are exchanged according to a predetermined protocol. A method of searching for a service using a registry is described in, for example, Alan Kotok, DavidR. R. Webber "ebXML" September 2001 New Riders Publishing, page 232-241.
[0005]
[Problems to be solved by the invention]
As described above, since the protocol of the web service is platform independent, various users (clients) can use the same service. If the URL of the service providing site and its protocol specification (service schema) are known, the client can access the service. In this case, there is no problem even if the use of the service is not restricted, for example, in a case where the service is used in a limited place such as at home or where only a service intended to be widely disclosed such as an e-commerce service for the general public is handled.
[0006]
However, particularly when the service providing site (or service function) restricts the use of some users (when only a specific user is permitted to use the service), the following problem occurs.
[0007]
For example, it is assumed that the document management server provides a user with a document management function as a service. In this case, usually, a certain document space corresponds to one service (that is, one document management server has a plurality of document spaces), and the accessible document space differs depending on the user. However, even a user without access right can know the existence of the document space (for example, the name and other attributes), so that it is impossible to cope with a case where the existence of the service is desired to be kept secret except for a specific user.
[0008]
An object of the present invention is to provide a list of only services available to a user when the use of the service is restricted by the user (such as when only a specific user is permitted to access), and An object of the present invention is to provide a service providing device that can easily use the service.
[0009]
[Means for Solving the Problems]
The integrated service device of the present invention provides information on at least one individual service available to a user via a network to the user via the network, wherein the information on a plurality of individual services is provided. A stored individual service information storage unit, an individual service attribute management unit that manages attributes of the individual service, a user authentication unit that authenticates the user when the user accesses it, the individual service information A service list creation unit that creates a list of individual services available to the user from the information about the individual services stored in the storage unit, and provides the list to the authenticated user. Features. In the integrated service device of the present invention, only the accessible individual services are included in the list, so that the user can easily select the service.
[0010]
Also, when using an external service registry, register only the integrated service in the service registry and do not register individual services, so that the existence of individual services will not be known to users without access rights, Individual services can be kept confidential.
[0011]
In the integrated service device of the present invention, the service attribute management means may be configured to store the authentication information of the user for using the individual service. As a result, since the integrated service manages which individual service the user can access, the accessible service can be immediately determined, and the client does not have to wait.
[0012]
Further, the integrated service device of the present invention may include an inquiry unit for acquiring authentication information of the individual service from the user and inquiring whether or not the individual service can be used. Thus, since the individual service itself is inquired about which individual service the user can access, the accessible service can always be determined using the latest information.
[0013]
Further, in the integrated service device of the present invention, the individual service attribute management unit may be configured to include an individual service connection unit that performs connection to the individual service on behalf of the user. Therefore, the user does not need to input user information (such as a password) again for connection to the individual service, which can save time and effort.
In the integrated service device of the present invention, when the user uses the individual service, the individual service of the user can be authenticated in the individual service. Since the connection can be made using the user authentication interface originally existing in the individual service, the integrated service can also perform the connection proxy without preparing a special interface on the individual service side.
[0014]
In the integrated service device of the present invention, the individual service connection means may be configured to connect to the individual service in a privileged mode and pass user information to the individual service. Thus, the user authenticated by the integrated service accepts the individual service as it is, so that the integrated service can perform the connection proxy even if the user authentication method is different between the integrated service and the individual service.
[0015]
The integrated service device of the present invention can provide a service list without access protection even before user authentication or when user authentication fails. As a result, a list of individual services that can be accessed by anyone can be obtained without performing user authentication. Therefore, if the user knows that the service desired to be used can be accessed by any user, the authentication procedure can be omitted.
[0016]
The integrated service device according to the present invention can include a service search unit that searches for an applicable individual service by designating a condition of a service to be listed. As a result, individual services to be included in the list can be limited according to specified conditions, not just a list, so that a desired individual service can be quickly selected even when a large number of individual services are registered.
[0017]
BEST MODE FOR CARRYING OUT THE INVENTION
FIG. 1 is a functional block diagram showing a configuration example of the integrated service device 11 of the present invention. In FIG. 1, the integrated service device 11 includes a user authentication unit 111, an individual service information storage unit 112, an individual service attribute management unit 113, and an individual service list creation unit 114. The client 2 is connected to the integrated service device 11, and the individual service 3 is connected to the client 2. Although only one client 2 is shown in FIG. 1, many clients 2 are connected to a network as shown in the system diagrams of FIGS. 3 and 4 described later. Further, in FIG. 1, the individual service 3 is shown as a set of a plurality of individual services (SRV01, SRV02,...), But as shown in the system diagrams of FIGS. Many distributed and connected to the network. Of course, the present invention does not exclude a case where a plurality of individual services are concentrated in one place.
[0018]
The user authentication unit 111 specifies, for example, (1) a user name and a password, (2) an electronic certificate of the user who signed the request, and (3) a secure For example, a method is used in which an external user authentication unit connected via a communication path is requested to perform authentication and a result is returned. When the user authentication is completed, the user ID of the accessing client is determined, and the integrated service device 1 executes a search process for an individual service.
[0019]
The individual service information storage unit 112 is a storage device such as a hard disk, a magneto-optical disk, and a memory, and stores information about the individual service 3 (SRV01, SRV02,...). The individual service information storage unit 112 stores the attributes of each individual service in a database as described later.
[0020]
The individual service attribute management unit 113 manages the attributes of each individual service. This attribute (attribute information) may include an access point (URL), a service name, a service type, a service ID, a service description, a service technical specification, an inquiry destination, and an ACL (access control list). it can. The ACL (Access Control List) is a record that records whether each user can access. The individual service attribute management unit 113 manages the attribute information in a database. Usually, the service ID of the database is used as a primary key, and the user ID (recorded in the ACL) is used as a key. You can search only the services you have.
[0021]
The individual service list creator 114 lists, as a list, only those individual services registered in the database (that is, stored in the individual service information storage 112) that can be accessed by the user associated with the specified user ID. Can be presented. In this list, all or a part of the above-described service attributes such as an access point of an individual service are listed.
[0022]
The individual service search unit 115 can narrow down services to which the user has access right, using the service name and the service type as keys.
[0023]
FIG. 2 is a functional block diagram showing a configuration example of the integrated service device 12 of the present invention. 2, the integrated service device 12 includes a user authentication unit 121, an individual service information storage unit 122, an individual service attribute management unit 123, an individual service list creation unit 124, an individual service search unit 125, and an access permission / inquiry inquiry unit. 126 and an individual service connection means 127. As in the case of FIG. 1, a client 2 is connected to the integrated service device (in FIG. 2, indicated by reference numeral 12), and the client 2 is connected to an individual service 3. Although only one client 2 is shown in FIG. 2, a large number of clients 2 are connected to the network, and the individual services 3 are also shown as a set of a plurality of individual services (SRV01, SRV02,...).
[0024]
The user authentication unit 121, the individual service information storage unit 122, the individual service attribute management unit 123, the individual service list creation unit 124, and the individual service search unit 125 in FIG. , An individual service attribute management unit 113, an individual service list creation unit 114, and an individual service search unit 115. However, in FIG. 2, the user authentication information for using the individual service is stored in the individual service information storage unit 112 in association with the individual service.
[0025]
The access permission / inquiry inquiring unit 126 can inquire of the individual service 3 at appropriate time whether a user having a predetermined user ID can access the service. A list of individual services that responded within a predetermined period of time when access is possible is created. The access permission / inquiry inquiring means 126 receives a user ID or the like for an individual service from the user when the user accesses the integrated service apparatus 1 or obtains an individual service information stored in the individual service information storage 122. Using the user ID or the like, an inquiry can be made to the individual service on behalf of the user. In this case, if the user can access the individual service as a result of the inquiry, the individual service can be included in the list created by the individual service list creating unit 124. Even when there is no user access, the individual service can be inquired on behalf of the user by using the user ID or the like for the individual service stored in the individual service information storage unit 122. If it is clear that the user cannot access the individual service in the future, such as when the validity period of the password has expired, the user ID or password can be invalidated (for example, deleted).
The access permission / inquiry inquiring means 126 can inquire each registered individual service by a method such as unicast, multicast or broadcast. Since the access permission / inquiry means 126 can manage the individual service to be accessed, it is not necessary for the individual service attribute management means 113 to manage the ACL.
[0026]
The individual service connection unit 127 can access an individual service specified in accordance with a predetermined method for the individual service 3 on behalf of the client (user). In the access procedure, information (session information) necessary for accessing the individual service is returned to the client. Specifically, (1) the information necessary for user authentication passed from the client is passed to the individual service as it is, (2) a unique secure communication path is secured between the integrated service and the individual service, and the user ID is For example, there is a method of attaching a signature to an integrated service and delivering it.
[0027]
FIG. 3 is a diagram showing an example of a search system including the integrated service device of the present invention. In FIG. 3, a LAN 100 is connected to the Internet 200 via a GW (gateway). The LAN 100 is connected to the integrated service device 1, a plurality of clients 21 and 22, and an individual service terminal 31. Also, individual service terminals 32 and 33 and a client 23 are connected to the Internet 200 via a GW. The integrated service 1 corresponds to the integrated service devices 11 and 12 in FIGS. 1 and 2, the clients 21 to 23 correspond to the client 2 in FIGS. 1 and 2, and the individual service terminals 31 to 33 correspond to the ones in FIGS. Corresponds to the individual service terminal 3.
[0028]
FIG. 4 is a diagram showing another example of a search system including the integrated service device of the present invention. 4, the integrated service device 1 is connected to the Internet 200 via a GW, the client 21 is connected via the GW, and the individual service terminals 31 to 33 are connected via the GW. An Internet connection provider 4 is connected to the Internet 200 via a GW, and clients 22 to 24 are connected to the Internet connection provider 4. The integrated service 1 corresponds to the integrated service apparatuses 11 and 12 in FIGS. 1 and 2, the clients 21 to 24 correspond to the client 2 in FIGS. 1 and 2, and the individual service terminals 31 to 33 correspond to the ones in FIGS. Corresponds to the individual service terminal 3.
[0029]
An operation example of the integrated service device 11 of FIG. 1 will be described with reference to FIG.
In FIG. 5, first, when the client 2 accesses the integrated service device 11, the integrated service device 11 receives the information a1 (for example, the user ID and password of the integrated service) required for the authentication required for the user authentication (P001). ).
[0030]
The integrated service 11 executes an authentication procedure by the user authentication means 111 (P002). Although not shown in FIG. 5, if authentication is not possible, an error is returned to the client 2 and the processing is terminated. If authentication is successful, a specific individual service accessible by the user (user authentication Is retrieved by the individual service management means 112, and a retrieval result (display information a2 of a list of specific individual services) is created in, for example, an XML format (P003) and returned to the client. FIG. 10A shows an example of a script returned to the client when two individual services are accessible, and FIG. 10B shows a display example.
[0031]
In the client 2, a list of the display information a2 is displayed (P004), and the user selects an individual service to use by referring to the service list (P005). At this time, the integrated service device 11 receives the narrowing-down request information a3 from the client 2, and can perform narrowing-down according to the category or the like by using the individual service searching means 115. When the search is performed, the display information a2 about the new list is returned to the client 2.
[0032]
The client 2 specifies the URL of the individual service site displayed in the list and connects to the specific individual service desired by the user (P006). Then, the client 2 connects to the specific individual service using the ULR displayed in the list.
[0033]
Another operation example of the integrated service device 11 of FIG. 1 will be described with reference to FIG.
FIG. 6 shows a case where an individual service site accessible by an unspecified user is displayed when the integrated service apparatus 11 cannot authenticate the user of the client 2. In FIG. 6, a process corresponding to whether the client 2 has successfully authenticated the user at P002 is displayed as P008. If the user cannot be authenticated in P008, an individual service site accessible by the unspecified user is searched and returned to the client 2 as display information a4. Also in this case, the integrated service apparatus 11 receives the narrowing-down request information a3 from the client 2, performs narrowing-down according to the category or the like by using the individual service search unit 115, and returns new display information a4 to the client 2. In the example of FIG. 6, when information necessary for user authentication is received from the client, it is determined whether or not the authentication is valid. However, the user did not present the authentication information and thus did not receive the authentication information. Also in this case, the integrated service 11 can create a list of individual services accessible to unspecified users and send the list to the client 2.
[0034]
An operation example of the integrated service device 12 of FIG. 2 will be described with reference to FIG.
In FIG. 7, first, when the client 2 accesses the integrated service device 12, the integrated service device 12 receives information b1 (for example, a user ID and a password of the integrated service) required for authentication required for user authentication (P101). ).
The integrated service 21 executes an authentication procedure by the user authentication means 121 (P102). Although not shown in FIG. 7, as in the case of FIG. 5, if authentication is not possible, an error is returned to the client 2 and the processing is terminated. If authentication is successful, the user accesses using the user ID. A possible specific individual service is searched by the individual service management unit 122, and a search result (display information b2 of a list of specific individual services) is created in, for example, an XML format (P103), and this is returned to the client.
[0035]
In the client 2, a list of the display information b2 is displayed (P104), and the user selects an individual service to be used by referring to the service list (P105). At this time, the integrated service device 12 can receive the narrowing-down request information b3 from the client 2 and use the individual service searching unit 215 to perform narrowing-down according to the category or the like. When the refinement is performed, the display information b2 about the new list is returned to the client 2.
[0036]
The client 2 specifies the URL of the individual service site displayed in the list and sends information b4 for specifying the specific individual service desired by the user to connect to the integrated service device 12 (P106). The integrated service device 12 acquires information (user ID, password, etc., for the individual service) necessary for access to the individual service from the client 2 or the individual service attribute management unit 123 (P107), and accesses the individual service. (P107). When the integrated service device 12 accesses the individual service site 3, the integrated service device 12 sends information b5 (here, session ID) necessary for the client 2 to access the individual service site 3 to the client 2, and the client 2 Using the session ID, the individual service site 3 is accessed using the ULR displayed in the list, and the individual service is used (P108).
[0037]
Another operation example of the integrated service device 12 of FIG. 2 will be described with reference to FIG.
FIG. 8 shows a case where the integrated service device 12 displays an individual service site accessible by an unspecified user when the user authentication of the client 2 cannot be performed. In FIG. 8, a process according to whether or not the client 2 has successfully authenticated the user at P102 is displayed as P109. If the user cannot be authenticated in P109, an individual service site accessible by an unspecified user is searched and returned to the client 2 as display information b6. Also in this case, the integrated service device 12 receives the narrowing-down request information b3 from the client 2, performs narrowing-down according to the category or the like using the individual service search means 115, and returns new display information b6 to the client 2. In the example of FIG. 8, when information necessary for user authentication is received from the client, it is determined whether or not the authentication is valid. However, the user did not present the authentication information and thus did not receive the authentication information. Also in this case, the integrated service 12 can create a list of individual services accessible to an unspecified user and send the list to the client 2.
[0038]
7 and 8, the client 2 connects to the individual service using the session ID at P108, but the integrated service 12 connects to the individual service 3 as shown in FIG. It can be configured to access the individual service 3 via the Internet. In FIG. 9, the client 2 specifies the URL of the individual service site displayed in the list and sends information b4 for specifying the specific individual service desired by the user to connect to the integrated service device 12 (P106). Acquires the information (user ID, password, etc., for the individual service) necessary for accessing the individual service from the client 2 or the individual service attribute management means 123 (P107), and thereafter, in place of the client 2, Access the individual service 3 (P111). Upon access, the integrated service device 12 receives the display information b6 from the individual service site 3 and sends it to the client 2, while receiving the usage information b7 (information originally sent from the client 2 to the individual service site 3) from the client 2. Is sent to the individual service site (P111). As a result, the client 2 can use the individual service (P108 ').
[0039]
【The invention's effect】
The present invention presents a list of only services available to a user when the use of the service is restricted by the user, for example, when only a specific user is permitted to access, and the user can easily make the list. Services can be used.
[Brief description of the drawings]
FIG. 1 is a functional block diagram illustrating a configuration example of an integrated service device according to the present invention.
FIG. 2 is a functional block diagram showing another configuration example of the integrated service device of the present invention.
FIG. 3 is a diagram showing an example of a search system including the integrated service device of the present invention.
FIG. 4 is a diagram showing another example of a search system including the integrated service device of the present invention.
FIG. 5 is a diagram illustrating an operation example of the integrated service device of FIG. 1;
FIG. 6 is a diagram illustrating another operation example of the integrated service device of FIG. 1;
FIG. 7 is a diagram illustrating an operation example of the integrated service device of FIG. 2;
FIG. 8 is a diagram showing another operation example of the integrated service device of FIG. 2;
FIG. 9 is a diagram illustrating an operation example of an integrated service device that accesses an individual service on behalf of a client.
FIG. 10A is a diagram illustrating an example of a script returned to a client when two individual services are accessible, and FIG. 10B is a diagram illustrating a display example thereof.
[Explanation of symbols]
1,11,12 Integrated service equipment
2,21-24 clients
3,31-33 Individual service site
41 Internet Provider
111, 121 user authentication means
112, 122 Individual service information storage means
113,123 Individual service attribute management means
114, 124 individual service list creation means
115,125 Individual service search means
126 Individual service inquiry means
127 Individual service connection means
100 LAN
200 Internet
SRV01, SRV02, ... individual service site
GW Gateway

Claims (6)

An integrated service device that provides information about at least one individual service available to a user via a network to the user via the network,
Individual service information storage means for storing information about a plurality of individual services;
Individual service attribute management means for managing the attributes of the individual service;
A user authentication unit for authenticating the user when the user accesses the user;
An individual service list creating unit that creates a list of individual services available to the user from information about the individual services stored in the individual service information storage unit, and provides the list to the authenticated user. ,
An integrated service device comprising: The integrated service device according to claim 1, wherein the service attribute management unit stores the authentication information of the user for using the individual service. 3. The integrated service apparatus according to claim 1, further comprising an inquiry unit that acquires authentication information of the individual service from the user and inquires whether the individual service is available. 4. The integrated service device according to claim 1, wherein the individual service attribute management unit includes an individual service connection unit that performs connection to the individual service on behalf of the user. 5. The integrated service device according to claim 1, wherein when the user uses the individual service, authentication of the user's individual service is performed in the individual service. 6. The integrated service device according to claim 1, wherein the individual service connection unit connects to the individual service in a privileged mode and passes user information to the individual service.

Images