JP2005301891A - Access controller, information providing system, and access control method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enable information to be provided in consideration of an area where information provision is limited. <P>SOLUTION: White lists or black lists are preliminarily registered in a search server 60 as information provision conditions of areas where the information provision is limited. A proxy server 50 determines whether a content can be provided for a mobile machine 10 requesting the content or not on the basis of the white list or the black list of an area where the mobile machine 10 is present. The proxy server 50 provides a content request from the mobile machine 10 to a CP server 80 providing the content, on the basis of a determination result. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an access control device, an information providing system, and an access control method.

  Conventionally, the access management database that stores connection prohibition information and, if there is a request for information from the user client, only the information provided by the information providing client that can be provided in comparison with the connection prohibition information in the access management database is permitted. There has been proposed an information providing system including an access management means (see, for example, Patent Document 1). Specifically, in Patent Document 1, when a provider has an access restriction list for each user and the user requests connection to a restricted site, a connection rejection message is transmitted to restrict access. Technology is disclosed.

  Also, a Web page that restricts access when the administrator registers a site subject to access restriction in advance in a relay device such as a DNS server, and the transmission request from the client is access to the registered site. A browsing / use restriction system has been proposed (see, for example, Patent Document 2).

Further, a mobile device for registering a URL address of a site that allows a parent to access a minor, comparing the URL address of the access destination with the registered URL address, determining whether access is possible, and performing communication Has been proposed (see, for example, Patent Document 3). In addition, the content provider server determines whether or not the content can be provided based on the browser of the mobile device.
JP 2003-167852 A JP 2002-116958 A JP 2003-186842 A

  However, the conventional method has only access restrictions based on an access restriction list for each user, and access restrictions taking account of being a minor or a mobile device browser. Therefore, it was not possible to provide information in consideration of areas where information provision is restricted. Specifically, in the conventional method, even if the information provision restriction is different for each area where the user is located, the access restriction cannot be performed correspondingly. That is, the access restriction cannot be performed by geographically dividing.

  Therefore, an object of the present invention is to enable information provision in consideration of an area where information provision is restricted.

  An access control apparatus according to the present invention includes a determination unit that determines whether or not information provision to a mobile device is possible based on information provision conditions in an area where information provision is restricted where a mobile device that requests information provision exists. And an access control unit that provides a request for information provision from a mobile device to an information providing apparatus that provides information based on a determination result by the unit.

  According to such an access control device, it is possible to determine whether or not to provide information to the mobile device based on the information provision conditions of the area where the mobile device requesting information provision exists. Then, the access control device can provide a request for information provision from the mobile device to the information providing device that provides information based on the determination result. Therefore, the information providing device acquires a request for information provision from the mobile device and provides the information to the mobile device only when it is determined that information can be provided to the mobile device based on the information provision conditions. it can. Therefore, according to the access control apparatus, it is possible to provide information in consideration of an area where information provision is restricted.

  Furthermore, it is preferable that the access control device includes a condition storage unit that stores information provision conditions of an area where information provision is restricted. According to this, it is possible to register in advance in the access control device the information provision conditions for the area where information provision is restricted.

  The information provision condition is at least one of a permission condition that specifies information that is not restricted in the area, or a restriction condition that specifies information that is restricted in the area, and the determination unit is in the area where the mobile device exists. If the permit conditions match, or if the area where the mobile station exists and the restriction conditions do not match, it is determined that information can be provided, and if the permit condition does not match the area where the mobile station exists, or It is preferable to determine that information cannot be provided when the restriction condition matches the area where the mobile device exists.

  An information providing system according to the present invention provides a mobile device based on a condition storage unit that stores information providing conditions for an area where information provision is restricted and an information providing condition for an area where a mobile device that requests information provision exists. A determination unit that determines whether information can be provided, an access control unit that provides a request for information provision from a mobile device to an information providing device that provides information based on a determination result by the determination unit, and a mobile device And an area addition unit for adding an area where a mobile device exists to a request for information provision.

  According to such an information providing system, it is possible to register in advance information providing conditions for areas where information provision is restricted. Furthermore, the information providing system can determine whether or not information can be provided to the mobile device based on the information provision conditions of the area where the mobile device requesting information provision exists. And the information provision system can provide the information provision request | requirement from the mobile apparatus to the information provision apparatus which provides information based on the determination result. Therefore, the information providing device acquires a request for information provision from the mobile device and provides the information to the mobile device only when it is determined that information can be provided to the mobile device based on the information provision conditions. it can.

  Furthermore, since the information providing system includes the area adding unit, it is possible to appropriately control the information provision in consideration of the area based on the area having higher reliability than the area notified by the mobile device itself. Therefore, according to the information providing system, it is possible to provide information in consideration of an area where information provision is restricted.

  In addition, the information providing system includes a correspondence storage unit that stores the correspondence between the location information managed by the mobile communication network to which the mobile device is connected and the zone, and the zone addition unit acquires the location information of the mobile device, It is preferable to determine an area by referring to the correspondence storage unit based on the acquired position information, and add the determined area to the request.

  Furthermore, the request for providing information is an HTTP request, and the area adding unit preferably adds an area for each HTTP request. According to this, since an area is added for each HTTP request, the information providing system can determine whether information can be provided based on the information provision condition of the area for each HTTP request.

  The access control method according to the present invention determines whether or not to provide information to a mobile device based on an information provision condition in an area where information provision is restricted where there is a mobile device that requests information provision. On the basis of this, a request for providing information from a mobile device is provided to an information providing apparatus that provides information.

  As described above, according to the present invention, it is possible to provide information in consideration of an area where information provision is restricted.

[Information provision system]
As shown in FIG. 1, the information providing system 1 includes a mobile device 10, a base station 20, a mobile communication network (A) 30a, a mobile communication network (B) 30b, a gateway (Gateway, hereinafter referred to as “GW”). 40), an access control device 90, the Internet 70, and a content provider server (hereinafter referred to as "CP server") 80. The access control device 90 includes a proxy server 50 and a search server 60.

  The CP server 80 is an information providing device that provides information. Hereinafter, information provided by the CP server 80 is referred to as “content”. The CP server 80 is connected to the Internet 70. The CP server 80 provides content from the CP server 80 to the mobile device 10 to the proxy server 50 via the Internet 70. The CP server 80 acquires a request for information provision from the mobile device 10 to the CP server 80 (hereinafter referred to as “content request”) from the proxy server 50 via the Internet 70.

  The content request includes designation of content requested by the mobile device 10. The content can be specified using an address indicating a storage location where the content is stored. For example, a URL (Uniform Resource Locator) address is used as the address indicating the storage destination. In addition, the content request may include a content provision request by SSL (Secure Sockets Layer). A request for content specification or provision by SSL is made by the user of the mobile device 10. Further, the content request includes a user ID such as a telephone number of the user of the mobile device 10 or a mobile device number.

  The CP server 80 provides content to the mobile device 10 based on the acquired content request. The CP server 80 provides the content stored in the URL address included in the content request to the mobile device 10. The content request and content provision are performed using, for example, HTTP (HyperText Transfer Protocol). In the case of complying with HTTP, an HTTP request is used as a content request, and the content is provided as an HTTP response. The CP server 80 is provided by a content provider.

  The mobile device 10 is connected to the base station 20 by radio. The mobile device 10 is connected to the mobile communication network (A) 30 a via the base station 20. The mobile device 10 transmits a content request to the CP server 80 to the proxy server 50 via the connected mobile communication network (A) 30a, another mobile communication network (B) 30b, and the GW 40. The mobile device 10 acquires content from the CP server 80 from the proxy server 50 via the GW 40, the mobile communication network (B) 30b, and the mobile communication network (A) 30a.

  The mobile communication network (A) 30a and the mobile communication network (B) 30b are connected to provide a roaming service. When the mobile communication network (A) 30a and the mobile communication network (B) 30b are provided in different countries, GRX (Global Roaming eXchange service) is provided. In this embodiment, as shown in FIG. 1, the base station 20 connected to the mobile communication network (A) 30a and the mobile communication network (A) 30a is provided in the country A, and the mobile communication network (B) 30b is provided in the country B. ing.

  The GW 40 is a gateway that connects the mobile communication network (B) 30 b and the proxy server 50. The GW 40 includes interfaces (hereinafter referred to as “I / F”) 41 and 42, a correspondence relationship database 43, and an area addition unit 44. The interface 41 is an interface with the mobile communication network (B) 30b. The interface 41 transmits / receives data to / from the mobile communication network (A) 30a via the mobile communication network (B). The interface 42 is an interface with the proxy server 50 unit.

  The correspondence relationship database 43 is a correspondence relationship storage unit that stores correspondence relationships between location information managed by the mobile communication network to which the mobile device 10 is connected and areas. The location information managed by the mobile communication network includes an area number and a cell ID.

  In addition, provision of content may be limited depending on the area. For example, if a content provider wants to restrict provision by area, it may be required to restrict provision by law or regulation. Examples of laws and regulations include copyright laws and regulations that prohibit domestic information from being taken out of the country. Areas are delimited by units that are restricted from being provided. Area units include, for example, countries, states, prefectures, cities, wards, areas that include multiple countries such as Asia, Europe, and EU, and areas that are managed by carriers that build and operate mobile communication networks. There is. For identification of the area, for example, area identification data for identifying the area such as a country code, a city symbol, a country name, a city name, and a carrier name is used.

  Thus, for example, the correspondence database 43 stores the correspondence between the location information such as area numbers and cell IDs managed by the mobile communication network (A) 30a and the mobile communication network (B) 30b, and the area identification data.

  The area adding unit 44 adds an area in which the mobile device 10 exists to a request for information provision from the mobile device 10. The zone adding unit 44 acquires a content request from the mobile device 10 via the I / F 41. The zone adding unit 44 acquires position information of the mobile device 10 that requests the content. For example, the zone adding unit 44 manages the location information such as the area number and cell ID where the mobile device 10 exists, which is managed by the mobile communication network (A) 30a to which the mobile device 10 is connected, in the mobile communication network (B ) Acquired from the mobile communication network (A) 30a via 30b. The zone adding unit 44 searches the correspondence database 43 based on the acquired location information of the mobile device 10 and acquires zone identification data associated with the location information. In this way, the area adding unit 44 determines an area where the mobile device 10 exists by referring to the correspondence database 43 based on the acquired position information. The area adding unit 44 adds area identification data of the determined area to the content request.

  In this embodiment, a country is used as a unit of area. Specifically, the area adding unit 44 adds a country code in which the mobile device is located (hereinafter referred to as “connected country”). In the case of FIG. 1, since the mobile device 10 is connected to the base station 20 provided in the country A and exists in the country A, the connection country of the mobile device 10 is the country A. For example, when complying with HTTP, the zone adding unit 44 acquires an HTTP request as a content request from the mobile device 10 from the mobile communication network (B) 30b.

  The area adding unit 44 refers to the correspondence database 43 to determine an area where the mobile device 10 exists, and adds the country code of country A, which is the connected country of the mobile device 10, to the HTTP header of the acquired HTTP request. . The zone adding unit 44 adds roaming information to the HTTP header of the content request in addition to the zone. In addition, when the unit of area is a state other than the country, prefecture, city, ward, area including multiple countries, area managed by a telecommunications carrier, etc., the area adding unit 44 has a mobile device. The area identification data of the area to be added is added. The area adding unit 44 provides a content request such as an HTTP request to which an area or roaming information is added to the proxy server 50 via the I / F 42.

  The access control device 90 is an access control device that controls access to the CP server 80 by the mobile device 10. The access control device 90 performs access control using the proxy server 50 and the search server 60.

  The proxy server 50 is a control device that determines whether or not information can be provided to the mobile device and provides a content request to the CP server 80. The proxy server 50 includes I / Fs 51 to 53, a user information database 54, a determination unit 55, and an access control unit 56. The interface 51 is an interface with the GW 40. The interface 52 is an interface with the Internet 70. The interface 53 is an interface with the search server 60.

  The user information database 54 is a user information storage unit that stores user information. The user information is information related to the user of the mobile device, and includes user-specific information unique to the user and mobile device information related to the mobile device used by the user. The user specific information includes, for example, the user's age, gender, nationality, religion, contract details, and the like. The mobile device information includes information related to the performance of the mobile device such as the browser type of the mobile device, the capacity that the mobile device can receive, and the capacity that the mobile device can display. The user information database 54 stores user information in association with the user ID.

  The determination unit 55 determines whether or not information can be provided to the mobile device 10 based on the information provision condition of the area where the mobile device 10 that requests information provision exists. The information provision condition is a condition for providing information in an area where information provision is restricted. The information provision conditions include a permission condition that specifies information that is not restricted in the area and a restriction condition that specifies information that is restricted in the area. In the present embodiment, as the information provision conditions, two lists, a white list that is a permission condition that specifies content that is not restricted in the area, and a black list that is a restriction condition that designates content that is restricted in the area are provided. Use.

  In the white list and black list, content is specified using a URL address indicating the storage location of the content. The unit for specifying the content is not limited. The content can be specified, for example, in content provider units, content page units, content data units, or file units in the content. Therefore, the content is specified using, for example, the domain name, host name, directory name, and file name of the URL address. The white list and black list may include SSL information in addition to a URL address (hereinafter referred to as “URL information”) that designates content. The SSL information specifies a URL address that specifies the content and that the content is provided by SSL. Information provision conditions can specify a plurality of contents. Therefore, the white list and the black list can include a plurality of URL information and SSL information. In the present embodiment, the white list and the black list are determined for each area, that is, for each country.

  The determination unit 55 determines whether the content can be provided to the mobile device 10. First, the determination unit 55 acquires a content request from the mobile device 10 to which the area where the mobile device 10 exists is added from the GW 40 via the I / F 51.

  Next, the determination unit 55 acquires user restriction information from the search server 60. The user restriction information is information related to a user who is a restriction target based on the information provision condition. Specifically, the user restriction information is information in which a user ID of a user who is a restriction target is associated with a list type for each area used for restriction of the user. The determination unit 55 requests and acquires user restriction information from the search server 60 via the I / F 53.

  Then, the determination unit 55 compares the user ID included in the content request with the acquired user restriction information and determines whether the user restriction information includes the user ID. When the user restriction information does not include the user ID, the determination unit 55 determines that the user is not a restriction target based on the information provision condition. Therefore, the determination unit 55 determines that the content can be provided to the mobile device 10.

  On the other hand, when the user restriction information includes a user ID, the determination unit 55 determines that the user is a restriction target based on the information provision condition. Then, the determination unit 55 compares the area added to the content request with the user restriction information, and in the area where the user exists, whether the type of list used for the restriction of the user is a white list or a black list. Determine.

  The determination unit 55 acquires from the search server 60 a list that is used by the mobile device 10 and that is used to restrict the provision of information to the user of the mobile device 10. Specifically, the determination unit 55 designates the area added to the content request and the type of list determined to be used for user restriction, and the white list or black list of the area where the mobile device 10 exists. Is requested to the search server 60 via the I / F 53. The determination unit 55 acquires a specified type list of the specified area from the search server 60 via the I / F 53.

  If the content request does not include a content provision request by SSL, the determination unit 55 sends the content to the mobile device 10 based on the URL information included in the white list or black list of the area where the mobile device 10 exists. It is determined whether or not it is possible to provide. When using the white list, the determination unit 55 determines whether the URL address included in the content request matches the URL information of the white list. The determination unit 55 determines that the content can be provided if they match, and determines that the content cannot be provided if they do not match. When using a black list, the determination unit 55 determines whether the URL address included in the content request matches the URL information of the black list. The determination unit 55 determines that the content cannot be provided if they match, and determines that the content can be provided if they do not match.

  When the content request includes a content provision request by SSL, the determination unit 55 determines whether or not the content can be provided based on the SSL information included in the white list or the black list. When using the white list, the determination unit 55 determines whether the URL address included in the content request matches the URL address included in the SSL information of the white list. The determination unit 55 determines that the content can be provided if they match, and determines that the content cannot be provided if they do not match. When using the black list, the determination unit 55 determines whether or not the URL address included in the content request matches the URL address included in the SSL information of the black list. The determination unit 55 determines that the content cannot be provided if they match, and determines that the content can be provided if they do not match. Note that the determination unit 55 may use both a white list and a black list. For example, the determination unit 55 determines using the white list, and determines using the black list when it is determined that the content cannot be provided.

  Furthermore, it is preferable that the determination unit 55 determines whether the content can be provided to the mobile device 10 based on the user information. In this case, the determination unit 55 requests and acquires the content restriction information from the search server 60 via the I / F 53. For example, the determination unit 55 acquires content restriction information when requesting a white list or a black list. Content restriction information includes user-specific information such as the user's age, gender, nationality, religion, and contract details, the type of browser of the mobile device used by the user, the capacity that the mobile device can receive, and the capacity that the mobile device can display. This is information related to content whose provision is restricted by mobile device information such as. The content restriction information indicates the correspondence between the content of user information and the restricted content. In the present embodiment, the content restriction information associates the content of user information with the URL address of the restricted content.

  The determination unit 55 searches the user information database 54 based on the user ID of the mobile device 10 included in the content request, and acquires user information. The determination unit 55 compares the acquired user information with the content restriction information, and determines the URL address of the content that is restricted for the user. Next, the determination unit 55 determines whether the determined URL address of the restricted content matches the URL address included in the content request, and determines whether the content can be provided to the mobile device 10. .

  For example, when the user of the mobile device 10 is a minor, the determination unit 55 provides the content if the URL address of the content that cannot be provided to the minor matches the URL address of the content requested by the user. If it does not match, it is determined that provision is possible. Similarly, the determination unit 55 moves when the content of the provided user is limited, the content cannot be provided to a person of a specific nationality, or the content cannot be provided for religious or contractual reasons. It is determined whether or not the user of the device 10 does not correspond to a person who cannot provide content, and whether or not content can be provided is determined. Further, the determination unit 55 determines whether or not the content can be provided based on the mobile device performance such as the browser type of the mobile device 10, the capacity that the mobile device 10 can receive, and the capacity that the mobile device 10 can display. . At this time, the determination unit 55 may acquire user information from the mobile device 10 via the I / F 51.

  The access control unit 56 provides the information providing request from the mobile device 10 to the information providing apparatus that provides information based on the determination result of the availability. When the access control unit 56 determines that the content can be provided, the access control unit 56 provides the content request from the mobile device 10 to the CP server 80 that provides the requested content via the I / F 52. On the other hand, when the access control unit 56 determines that the content cannot be provided, the access control unit 56 discards the content request from the mobile device 10. Furthermore, the access control unit 56 provides a rejection notice to the mobile device 10 via the I / F 51. The rejection notification notifies the mobile device 10 that the content cannot be provided as a result of determining whether the content can be provided.

  Then, the access control unit 56 acquires content from the CP server 80 to the mobile device 10 in response to the content request via the I / F 52. The access control unit 56 provides the acquired content to the mobile device 10 via the I / F 51.

  The search server 60 is a management device that manages information provision conditions such as a white list and a black list, user restriction information, and content restriction information. The search server 60 includes an I / F 61, a list database 62, a control unit 63, and a restriction information database 64. The I / F 61 is an interface with the proxy server 50. The list database 62 is a condition storage unit that stores information provision conditions. The list database 62 stores a white list and a black list. As shown in FIG. 2, the list database 62 stores a country list 62a, a white list (1) 62b, a white list (2) 62d, a black list (1) 62c, and a black list (2) 62e. To do.

  A white list number and a black list number are assigned to the white list and the black list as list identification data for identifying the list. The white list (1) 62b has the white list number (1), the white list (2) 62d has the white list number (2), the black list (1) 62c has the black list number (1), and the black list. (2) Blacklist number (2) is assigned to 62e.

  The country list 62a stores a correspondence relationship between a country as an area and a white list and a black list as information provision conditions. The country list 62a stores a white list number and a black list number in association with the country code. For example, the white list number (1) and the black list number (1) are associated with the country code (1).

  Each of the white list (1) 62b, the white list (2) 62d, the black list (1) 62c, and the black list (2) 62e includes a plurality of URL information (1) to URL information (n) and a plurality of SSL information ( 1) to store SSL information (n). The white list and black list are set by the content provider. Then, for example, a white list or black list set by the content provider from a terminal device outside the search server 60 is stored in the list database 62. As a result, the white list and black list are newly registered in the list database 62, and the registered white list and black list are updated.

  The restriction information database 64 is a restriction information storage unit that stores user restriction information and content restriction information. The restriction information database 64 stores user restriction information by associating a user ID with a list type for each area used for restriction of the user. Furthermore, the restriction information database 64 stores the contents of the user information and the URL address of the restricted contents in association with each other.

  The control unit 63 provides information provision conditions to the proxy server 50. The control unit 63 acquires a request from the proxy server 50 specifying the area and the type of list via the I / F 61. In this embodiment, the control part 63 receives designation | designated of a country code as an area. The control unit 63 searches the country list 62a of the list database 62 based on the specified country code, and acquires the number of the specified type list associated with the country code. The control unit 63 acquires the white list of the acquired white list number and the black list of the black list number from the list database 62. For example, when receiving the designation of the country code (1), the white list, and the black list, the control unit 63 selects the white list number (1) and the white list number (1) associated with the country code (1) from the country list 62a. Get blacklist number (1). Then, the control unit 63 acquires the white list 62 b with the acquired white list number (1) and the black list 62 c with the black list number (1) from the list database 62. The control unit 63 provides the acquired white list or black list to the proxy server 50 via the I / F 61.

  Further, the control unit 63 provides the proxy server 50 with user restriction information and content restriction information. The control unit 63 acquires a request for user restriction information and content restriction information from the proxy server 50 via the I / F 61. When acquiring the request, the control unit 63 acquires the user restriction information and the content restriction information from the restriction information database 64 and provides them to the proxy server 50 via the I / F 61. As described above, the proxy server 50 and the search server 60 function as the access control device 90.

[Access control method]
Next, an access control method using the information providing system 1 shown in FIG. 1 will be described. As shown in FIG. 3, the mobile device 10 transmits, for example, an HTTP request to the proxy server 50 as a content request to the CP server 80 (S101). The GW 40 adds the country code of the connected country of the mobile device 10 to the content request transmitted from the mobile device 10 to the proxy server 50 (S102). The GW 40 provides the content request with the country code added to the proxy server 50 (S103).

  The proxy server 50 requests the list from the search server 60 by specifying the country code added to the acquired content request and the type of the list. Further, the proxy server 50 requests content restriction information from the search server 60 (S104). The search server 60 provides the proxy server 50 with the specified type list of the specified country code and the content restriction information (S105).

  The proxy server 50 determines whether the content can be provided to the mobile device 10 based on the URL address included in the content request and the white list or black list acquired from the search server 60. Further, the proxy server 50 determines whether the content can be provided to the mobile device 10 based on the user information and the content restriction information acquired from the search server 60 (S106). If the determination result indicates that the proxy server 50 cannot be provided (NG), the proxy server 50 discards the content request and provides a rejection notification to the mobile device 10 (S107).

  If the determination result indicates that the content can be provided (OK), the proxy server 50 provides the content request to the CP server 80 (S108). The CP server 80 provides the content to be provided to the mobile device 10 to the proxy server 50 as, for example, an HTTP response based on the acquired content request (S109). The proxy server 50 provides the acquired content to the mobile device 10 (S110).

  Furthermore, the process of step (S102) shown in FIG. 3, that is, the process of adding the country code to the content request will be described in more detail with reference to FIG. The GW 40 acquires a content request from the mobile device 10 from the mobile communication network (B) 30b (S201). The GW 40 acquires, from the mobile communication network (A) 30a, location information such as an area number and a cell ID in which the mobile device 10 exists, managed by the mobile communication network (A) 30a to which the mobile device 10 is connected. (S202). The GW 40 refers to the correspondence database 43 based on the acquired location information of the mobile device 10, and determines the country code of the connection country of the mobile device 10 (S203). The GW 40 adds the determined country code to the content request (S204). Then, the GW 40 provides the proxy server 50 with the content request with the country code added.

  Next, the procedure of steps (S104) to (S108) shown in FIG. 3, that is, the procedure for determining whether or not the content can be provided to the mobile device 10 will be described in more detail with reference to FIG. explain.

  The proxy server 50 requests user restriction information from the search server 60 (S301). The search server 50 acquires user restriction information from the restriction information database 64 (S302). The search server 50 transmits the acquired user restriction information to the proxy server 50 (S303). The proxy server 50 compares the user ID included in the content request with the acquired user restriction information, and determines whether or not the user is a subject of content provision restriction based on the white list or the black list (S304).

  When it is determined in step (S304) that the user is a target person, the proxy server 50 receives the user restriction information and the area where the user exists, and the user is restricted by the white list or the black list in the area. It is determined whether the setting is made, and the type of list to be applied is determined (S305). The proxy server 50 requests the search server 60 for the white list or the black list of the area where the user exists, according to the determination result in step (S305). At this time, the proxy server 50 also requests content restriction information (S306).

  The search server 60 refers to the list database 62a shown in FIG. 2 based on the content requested in (S306), and acquires the white list number or black list number of the area where the user exists (S307). Further, the search server 60 acquires a white list or black list corresponding to the number from the list database 62 based on the acquired white list number or black list number, and transmits the white list or black list to the proxy server 50. At this time, the search server 60 also transmits content restriction information (S308).

  The proxy server 50 determines whether the acquired list is a white list or a black list (S309). In the case of the white list, the proxy server 50 determines whether or not the URL address included in the content request matches the URL information of the white list (S310). If they match, the proxy server 50 determines that provision is possible from the viewpoint of the white list. Then, the proxy server 50 further determines whether the content can be provided to the mobile device 10 based on the user information and the content restriction information acquired from the search server 60 (S312). If the proxy server 50 determines that the content can be provided also in step (S312), the proxy server 50 provides the content request to the CP server 80 (S313).

  On the other hand, in step (S310), the proxy server 50 determines that the content cannot be provided if the URL address included in the content request does not match the URL information of the white list. In this case, the proxy server 50 discards the content request and provides a rejection notification to the mobile device 10 (S314). In step (S312), the proxy server 50 also proceeds to step (S314) to provide a rejection notice to the mobile device 10 when it is determined that provision is not possible from the viewpoint of user information.

  In step (S309), if the acquired list is a black list, the proxy server 50 determines whether the URL address included in the content request matches the URL information of the black list (S311). . If the prokeyers 50 do not match, it is determined that provision is possible from the viewpoint of the blacklist. Then, the proxy server 50 proceeds to step (S312) and determines whether or not the content can be provided to the mobile device 10 from the viewpoint of the content restriction information. If the proxy server 50 determines that it can be provided also in step (S312), the proxy server 50 proceeds to step (S313) and provides the content request to the CP server 80.

  On the other hand, in step (S311), the proxy server 50 determines that the content cannot be provided when the URL address included in the content request matches the URL information of the black list. Then, the proxy server 50 proceeds to step (S314) and provides a rejection notification to the mobile device 10. If it is determined in step (S304) that the person is not a restriction target, the process proceeds to step (S312), and determination based on user information is performed. If the proxy server 50 does not store the user information of the mobile device 10, the step (S312) may be omitted and the process may proceed to step (S313).

〔effect〕
According to the access control device 90 including the proxy server 50 and the search server 60, the information providing system 1, and the access control method, a white list or a black list is preliminarily stored in the search server 60 as information providing conditions for areas where information provision is restricted. You can register. Furthermore, the access control apparatus 90 can determine whether or not the content can be provided to the mobile device 10 based on the white list or black list of the area where the mobile device 10 requesting the content exists. Then, the access control device 90 can provide a content request from the mobile device 10 to the CP server 80 that provides the content based on the determination result. Therefore, the CP server 80 acquires a content request from the mobile device 10 only when it is determined that the content can be provided to the mobile device 10 based on the white list or the black list, and the content is transferred to the mobile device. 10 can be provided. Therefore, it is possible to provide content in consideration of the area where content provision is restricted, and the load on the mobile device 10 and the CP server 80 is reduced.

  In recent years, the area where content can be used has been expanded due to the spread of the Internet and the like, but the restrictions on content provision differ depending on the area. Therefore, even when the restriction on content provision changes due to movement of the mobile device 10, the access control device 90 that suppresses content provision on the network side based on the area and enables appropriate content provision, The information providing system 1 and the access control method are extremely useful.

  In particular, it is possible to prevent the mobile device 10 used by a user who has no knowledge of the content provision restriction or the mobile device 10 with insufficient copyright protection measures from acquiring content that violates the restriction. Of course, there is an advantage that a knowledgeable user can use the content appropriately without being aware of the restrictions. Therefore, the user can be protected appropriately, and a uniform service can be provided to the entire user. It is also effective for copyright protection of contents. Furthermore, since the access control device 90 determines whether or not the content can be provided for each content request and restricts access to the content, the access control device 90 can sequentially cope with a change in restriction due to movement. Furthermore, according to the present invention, it is possible to provide means for preventing an operator from roaming-out users browsing a prohibited site against local laws.

  The information providing system 1 also includes a GW 40 that adds an area where the mobile device 10 exists to a content request from the mobile device 10. Therefore, the mobile device 10 itself does not need to notify the area where the mobile device 10 exists, and the load on the mobile device 10 can be further reduced. Further, it is possible to cope with a mobile device that does not have a function of detecting and notifying an area where the mobile device 10 exists. Furthermore, the information providing system 1 can appropriately control the content provision in consideration of the area based on the area provided on the network side with higher reliability than the area notified by the mobile device 10 itself. In particular, the information providing system 1 can determine whether or not content provision is possible for each HTTP request based on the information provision condition of the area by adding the area where the mobile device is present to each HTTP request.

[Example of change]
The present invention is not limited to the above embodiment, and various modifications can be made. In the above-described embodiment, the GW 40 adds a zone to the content request. However, the mobile device 10 transmits a content request including the zone where the mobile device 10 exists and the location information of the mobile device 10 to the proxy server 50. Also good. In this case, the mobile device 10 needs to include detection means for detecting the position of the mobile device 10 using GPS (Global Positioning System) or the like.

  When the mobile device 10 transmits a content request to which a zone is added, the mobile device 10 stores a correspondence relationship between the position information and the zone in advance. Then, the mobile device 10 obtains an area where the mobile device 10 exists based on the position information of the mobile device 10 detected by the detection means and the correspondence relationship, and adds area identification data of the obtained area to the content request. When the mobile device 10 adds location information, the GW 40 can determine the area based on the location information added to the content request instead of the location information managed by the mobile communication network.

  Further, instead of the GW 40, the determination unit 55 of the proxy server 50 determines the area where the mobile device 10 exists based on the location information managed by the mobile communication network and the location information added to the content request by the mobile device 10. It may be. In this case, the proxy server 50 includes a correspondence database that stores correspondence between position information and areas. Then, the determination unit 55 searches the correspondence database based on the position information and obtains the corresponding area.

  Furthermore, when the mobile device 10 moves to another area while providing content by streaming, the access control unit 56 of the proxy server 50 may stop providing the content. Further, the access control unit 56 may provide the mobile device 10 with an instruction to reproduce only in the area added to the content request after adding the content to the content. For example, the access control unit 56 can add an instruction to the HTTP header of the HTTP response. According to this, it is also possible to suppress the use of the provided content by the mobile device 10 reproducing based on the instruction.

  Further, the search server 60 may be connected to the Internet 70 and receive registration and update of the white list and black list from the CP server 80. In this case, the search server 60 has an interface with the Internet 70, and the control unit 63 acquires a list registration request and an update request from the CP server 80 via the interface. Then, the control unit 63 updates the list database 62 based on a registration request or an update request.

  The list database 62 shown in FIG. 2 may be further subdivided for each category of user information such as the user's age, sex, nationality, religion, contract content, and the like. In this case, the country numbers in the country list 62a are further subdivided for each category of user information, and a white list number and a black list number are associated with each country number category. Then, the determination unit 55 of the proxy server 50 requests the list from the search server 60 by specifying the area, the category of user information, and the type of list. The control unit 63 of the search server 60 also searches the country list 62a based on the specified country number and user information category, and acquires the list number.

It is a figure which shows the structure of the information provision system which concerns on embodiment of this invention. It is a figure which shows the list database which concerns on embodiment of this invention. It is a sequence diagram which shows the procedure of the access control method which concerns on embodiment of this invention. It is a flowchart which shows the procedure of the country code addition process which concerns on embodiment of this invention. It is a flowchart which shows the procedure of the determination process which concerns on embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Information provision system 10 Mobile device 20 Base station 30a Mobile communication network (A)
30b Mobile communication network (B)
40 GW
43 Correspondence relation database 44 Area addition part 50 Proxy server 41, 42, 51, 52, 53, 61 I / F
54 user information database 55 determination unit 56 access control unit 60 search server 62 list database 63 control unit 64 restriction information database 70 internet 80 CP server 90 access control device

Claims (8)

A determination unit that determines whether or not to provide the information to the mobile device based on an information provision condition in an area where the information provision is restricted in which the mobile device that requests information provision exists;
An access control device, comprising: an access control unit that provides the information providing device that provides the information with the information provision request from the mobile device based on a determination result by the determination unit.   The access control apparatus according to claim 1, further comprising a condition storage unit that stores an information provision condition of an area where the information provision is restricted. The information provision condition is at least one of a permission condition that specifies the information that is not restricted in the area, or a restriction condition that specifies the information that is restricted in the area,
The determination unit determines that the information can be provided when the permission condition matches the area where the mobile device exists, or when the restriction condition does not match the area where the mobile device exists. ,
The information provision is determined to be impossible when the area where the mobile station exists and the permission condition do not match, or when the limit condition matches the area where the mobile station exists. 3. The access control device according to 1 or 2. A condition storage unit for storing information provision conditions in areas where information provision is restricted;
A determination unit that determines whether or not to provide the information to the mobile device based on the information provision condition of an area where the mobile device that requests the information provision exists;
An access control unit for providing the information provision request from the mobile device to an information providing apparatus for providing the information based on a determination result by the determination unit;
An information providing system comprising: an area adding unit that adds the area in which the mobile device exists to the information provision request from the mobile device. A correspondence storage unit that stores correspondence between position information managed by a mobile communication network to which the mobile device is connected and the area;
The area adding unit acquires position information of the mobile device, determines the area by referring to the correspondence storage unit based on the acquired position information, and adds the determined area to the request. The information providing system according to claim 4. The information provision request is an HTTP request,
The information providing system according to claim 4 or 5, wherein the area adding unit adds the area for each HTTP request. Determining whether or not to provide the information to the mobile device based on the information provision conditions of the area where the information provision is restricted where the mobile device requesting information provision exists;
An access control method characterized in that, based on the determination result, the information providing request from the mobile device is provided to an information providing apparatus that provides the information. The information provision condition is at least one of a permission condition that specifies the information that is not restricted in the area and a restriction condition that specifies the information that is restricted in the area, and
When the area where the mobile device exists and the permission condition match, or when the area where the mobile device exists and the restriction condition do not match, determine that the information can be provided,
The information provision is determined to be impossible when the area where the mobile station exists and the permission condition do not match, or when the limit condition matches the area where the mobile station exists. 8. The access control method according to 7.

Images