JP2006048493A - Location search server device and service information system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the problem with the conventional way of making an inquiry to a UDDI registry about the location of a Web service wherein a data server managing the Web service may be accessed illicitly since the location of the Web service is answered without user authentication. <P>SOLUTION: A Web service information acquisition server 3 includes a Web service information DB 31 for storing the location of Web service information stored and managed by a data server 4; an authentication information DB 32 for storing permission information for the Web service information whose location is managed; and a group of authentication parts 33 that, upon the input from a client 1 of search information 12 for inquiring the location, obtains the location of the Web service information by searching the Web service information DB 31 according to the search information 12 and performs authentication according to the search information 12. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to management of the location of service information provided by a service information providing server device, a location search server device that authenticates a service information acquisition request, and a service information providing system.

Ryozo Matsuno “Learning in Java [Web Services] Intensive Course”, Soshim Publishing, November 22, 2003, P221-230, Web Service Usage Using Conventional UDDI (Universal Description, Discovery, and Integration) ("Java" in the above-mentioned literature name is a registered trademark). In this prior art, in order to find the desired Web service, the client inquires about the location information of the requested Web service from the UDDI registry. In this UDDI registry, information on a connection method to a server for a provided service is registered in advance from a server that provides a Web service. For this reason, when the UDDI registry receives an inquiry from the client, it passes to the client information related to the connection method to the server having the corresponding information. As a result, the client knows the server that provides the Web service, and then connects directly to the server from the client and executes the Web service. In general, when a client connects to a server that provides a Web service, authentication is performed using a user name and a password in the server.
Ryozo Matsuno "Learning in Java [Web Service] Intensive Course", Soshim Publishing, November 15, 2003, P221-230

  In the conventional UDDI, the client can always know the connection destination when there is data registered in the UDDI registry at the time of service search. For this reason, all access control is performed on the server, and a DOS attack (a DOS attack is a process aimed at breaking security by targeting a software bug or processing that exceeds the limit of the server's processing capability) There is a problem that there is a risk of being exposed to such as making a request intentionally and bringing down the server.

  In addition, in conventional authentication, only the user name and password are used, so if you have a certain level of authority, you can connect from an affiliated server, even if you connect from an affiliated company's server. However, even if it is accessed from an application that simply displays and displays information in a graph, or accessed from an application that discloses the read information to a third party, it is authorized regardless of whether it is authorized. there were.

  The present invention has been made to solve the above-described problems, and an object thereof is to control access to a web service or the like. Further, the access control is performed by another server device other than the server device that provides service information.

  The location information indicating the location of the service information provided by the service information providing server device according to the present invention is stored, and the search information for searching the location of the predetermined service information is input from the client device, and the search information is A location search server that searches for location information of service information includes a location information storage unit that stores service identification information that identifies the service information in association with the location information, and stores the service information for the client device. A permission information storage unit that stores permission information permitting provision and the service identification information in association with each other; a search information input unit that inputs authority information indicating acquisition authority of the location information together with the search information; and the search The location information storage unit is searched based on the search information input by the information input unit, and the location information and service identification are searched. A search unit for acquiring information, and permission information corresponding to the service identification information acquired by the search unit by searching the permission information storage unit, and whether the acquired permission information and the authority information match If the permission information and the authority information match, the location information acquired by the search unit is notified to the client device. If the permission information and the authority information do not match, the location information And a permission confirmation unit for notifying the client device that it has not been acquired.

  The location search server device according to the present invention does not notify the client device of the location information when the permission information and the authority information do not match, so that the service information providing server device can be protected from unauthorized access. .

Embodiment 1 FIG.
FIG. 1 is a configuration diagram of a service information providing system according to the first embodiment. In the configuration diagram of FIG. 1, a client device (hereinafter, “client device” is referred to as “client”) intends to acquire service information stored in a data server that is an example of a service information providing server device. It is a figure explaining performing search with respect to the web service information acquisition server which is an example of a location search server apparatus in order to access the web service to provide.

  In FIG. 1, a client 1 who wants to access a Web service stores authority information 11, and a client 2 stores authority information 21. Here, the authority information is information indicating acquisition authority used when determining whether or not service information can be acquired. For example, the user name, password, client identification information, program identification information, and the like It is. Each of the clients 1 and 2 can be connected to a Web service information acquisition server 3 that is an example of a location search server device and a data server 4 that is an example of a service information providing server device via the Internet 501 that is a network. The Web service information acquisition server 3 is open to clients who are permitted to provide information related to the Web service. The element of the thick line part in the Web service information acquisition server 3 is a mechanism added to the conventional UDDI registry. On the other hand, the element of the thin line portion in the Web service information acquisition server 3 is a succession of the conventional UDDI registry. The web service information database (DB) 31 is an example of a location information storage unit, and stores information related to the web service. For example, service identification information for identifying a Web service and location information indicating a connection destination for accessing the Web service are stored. The authentication information database (DB) 32 is an example of a permission information storage unit, and shows permission information for permitting provision of service information, which is authentication information indicating whether or not provision of information to a client is permitted. Remember every time. The Web service information DB 31 stores a service ID (service identification information) indicating a unique service and information (location information) related to the service corresponding to the service ID, and the authentication information DB 32 stores a service ID (service identification information). ) And a set of user information (permission information) that can use service information corresponding to the service ID. The authentication component group 33 receives search information for searching for a location of predetermined service information, and acquires information about the Web service by using the information stored in the Web service information DB 31 and the authentication information DB 32 for the search information. It has a function to authenticate and return the result to the client.

  The data server 4 that is an example of a service information providing server device provides Web service information that is service information. For example, the service information database (DB) 42 is a DB that stores data required by the clients 1 and 2, and the Web service A that is an example of the service information providing unit 43 can operate on the data server 4. A program that reads Web service information related to Web service A from the service information DB 42 and provides the read information to an access partner.

  Next, the information flow of the service information providing system 10 will be described. Search information 12 for searching for a specific Web service is transmitted from the client 1, and search information 22 for searching for a specific Web service is transmitted from the client 2 to the Web service information acquisition server 3. As a response to the search information 12 and the search information 22, the Web service information acquisition server 3 notifies the client 1 and the client 2 with location information 34 indicating the location of the Web service or non-applicable information 35 for not reporting the location. After receiving the location information 34, the client 1 or the client 2 generates location information 23 for accessing the Web service using the received location information 34, and uses the location information 23 to service the data server 4. It requests the information providing unit 43 to provide service information. The data server 4 sends the Web service information 41 to the transmission source of the location information 23 of the client 1 or the client 2 as a response to the location information 23. As described above, the service information providing system 10 includes the client 1, the client 2, the web service information acquisition server 3, and the data server 4, authenticates an access request for a specific web service, and obtains location information of the web service. Notice.

  On the other hand, FIG. 2 is a configuration diagram of a conventional Web service providing system using UDDI. The client 1 can be connected to the UDDI registry and the data server 4 via the Internet 501. In the UDDI registry 3 a, information related to the Web service provided by the data server 4 is registered in advance from the data server 4, and information related to service information requested by the client 1 is acquired and provided to the client 1. In response to a data acquisition request from the client 1, the data server 4 acquires corresponding data and provides it to the client 1.

  FIG. 3 is a detailed configuration diagram of the Web service information acquisition server 3 in FIG. In FIG. 3, an authentication component group 33 includes a search information input unit 331 that receives search information 12 and 22 such as user authority information and search conditions from the client 1 or 2, and a Web service search by UDDI using conventional technology. (UDDI) search unit 332 that provides location information such as a connection destination for the Web service obtained as a result, permission information corresponding to the service to be provided, and authority information included in the input search information And a permission confirmation unit 333 for determining whether or not the service information can be disclosed to the user.

  FIG. 4 is a diagram showing elements and information flows included in the clients 1 and 2 in FIG. In FIG. 4, clients 1 and 2 input search conditions 18 for searching for a Web service to be accessed, and input authority information 11 and 21 for creating authority information on the client side. The search information generation unit 13 that generates the search information 22 and the transmission unit 14 that transmits the search information 12 and 22 to the Web service information acquisition server 3 are provided. Further, the receiving unit 15 that receives the location information 34 or the non-applicable information 35 from the Web service information acquisition server 3 and the access that transmits the location information 23 that accesses the Web service to the data server 4 using the location information 34. The unit 16 is provided. In addition, an acquisition unit 17 that acquires Web service information 41 provided by the data server 4 and outputs the Web service information 41 to an output device such as a display device such as a CRT or a printer device is provided. Note that the authority information 11 and 21 may be input by a user using an input device such as a keyboard, or may be stored in a memory (not shown), extracted, or generated by executing an application program. It doesn't matter.

  FIG. 5 is a diagram showing the elements included in the data server 4 of FIG. 1 and the flow of information. In FIG. 5, the data server 4 receives the location information 23 for accessing the Web service transmitted from the clients 1 and 2, and acquires the corresponding Web service information by searching the service information DB 42 using the location information 23. The service information providing unit 43 is provided. The service information providing unit 43 transmits the Web service information 41 of the acquired Web service to the client that is the transmission source of the location information 23.

  Here, an example of a computer system that realizes each of the Web service information acquisition server 3, the data server 4, and the clients 1 and 2 will be described. FIG. 6 is a diagram showing the external appearance of a computer system that realizes each of the Web service information acquisition server 3, the data server 4, and the clients 1 and 2. 6, the computer system includes a system unit 200, a CRT (Cathode Ray Tube) display device 141, a keyboard (K / B) 142, a mouse 143, a compact disk device (CDD) 186, a printer device 187, and a scanner device 188. These are connected by cables. Further, the computer system is connected to a facsimile machine (FAX machine) 310 and a telephone 320 through a cable. Further, it is connected to the Internet 501 through the web server 500. Each of the Web service information acquisition server 3, the data server 4, and the clients 1 and 2 is realized by the computer system shown in FIG.

  FIG. 7 is a hardware configuration diagram of the computer system of FIG. In FIG. 7, the computer system includes a CPU (Central Processing Unit) 137 that executes a program. The CPU 137 is connected to the ROM 139, RAM 140, communication board 144, CRT display device 141, K / B 142, mouse 143, FDD (Flexible Disk Drive) 145, magnetic disk device 146, CDD 186, printer device 187, scanner device 188 via the bus 138. Connected with. The RAM is an example of a volatile memory. ROM, FDD, CDD, magnetic disk device, and optical disk device are examples of nonvolatile memory. These are examples of a storage device or a storage unit. The communication board 144 is connected to the FAX machine 310, the telephone device 320, and the like. For example, the communication board 144, the K / B 142, the FDD 145, and the like are examples of the information input unit. For example, the communication board 144, the scanner device 188, the CRT display device 141, and the like are examples of an output unit.

  The magnetic disk device 146 stores an operating system (OS) 147, a window system 148, a program group 149, and a file group 150. The program group is executed by the CPU 137, the OS 147, and the window system 148.

  The program group 149 stores programs that execute the functions described as “˜units” in the description of the Web service information acquisition server 3, the data server 4, and the clients 1 and 2. The program is read and executed by the CPU. In the file group 150, what is described as “˜storage unit”, “˜information”, and “˜judgment result” in the above description of the embodiment is stored as “˜file”.

  In addition, what has been described as “˜unit” in the above description of the embodiment may be realized by firmware stored in the ROM 39. Alternatively, it may be implemented by software alone, hardware alone, a combination of software and hardware, or a combination of firmware.

  The program for carrying out the above-described embodiment also includes other recordings such as a magnetic disk device, FD (Flexible Disk), optical disk, CD (compact disk), MD (mini disk), DVD (Digital Versatile Disk), etc. You may memorize | store using the recording apparatus by a medium.

  Next, specific examples of operations of the clients 1 and 2, the Web service information acquisition server 3, and the data server 4 will be described with reference to FIGS. 8 to 10. FIG. 8 is a configuration diagram of the service information providing system. FIG. 9 is an example of information stored in the Web service information DB 31. FIG. 10 is an example of information stored in the authentication information DB 32. Note that the Web service information acquisition server 3 in FIG. 8 has the configuration of the Web service information acquisition server 3 in FIG.

  In FIG. 8, the client 1 and the client 2 are about to obtain Web service information stored and managed by the data server 4. The Web service information to be obtained is obtained from the service information DB 42 through the Web service A managed by the data server 4 (for example, “Web service A” uses information indicating the address of the Web service information to be obtained. To be acquired). Further, it is assumed that the client 1 and the client 2 do not know the location of the data server 4 at first. That is, it is assumed that the users of the clients 1 and 2 cannot directly access the service information DB 42 of the data server 4. The client 1 stores the user ID “user1” as the authority information 11. The client 2 stores the user ID “user2” as the authority information 21. Each of the clients 1 and 2 corresponds to a specific condition (a condition for specifying a Web service that provides required Web service information) to the Web service information acquisition server 3 using a user ID stored and managed by the client 1 and 2. Queries information about Web services. That is, the client 1 generates search information 12 for performing a specific Web service search, and transmits the search information 12 to the Web service information acquisition server 3 via the Internet 501. In addition, the client 2 transmits search information 22 for performing a specific Web service search to the Web service information acquisition server 3 via the Internet 501. For example, the search information 12 includes a search condition 18 and a user ID “user1” for searching for a specific Web service, and the search information 22 includes a search condition 18 and a user ID for searching for specific Web service information. It has “user2”. The user ID is authority information.

  The Web service information acquisition server 3 receives the search information 12 and 22 transmitted from the clients 1 and 2 by the search information input unit 331, respectively. The Web service information DB 31 of the Web service information acquisition server 3 corresponds to the location information “http: // server: 8080 / Services / supply” which is the connection destination of the Web service which is the location information 312 as shown in FIG. Service ID (service identification information 311) “99999-9999-9999-9999-99999999” is stored. The authentication information DB 32 of the Web service information acquisition server 3 stores permission information 322 as shown in FIG. 10 and a service ID (service identification information 321) that permits provision of information in association with the permission information. In the example of FIG. 10, the Web service having the service identification information “99999-9999-9999-9999-99999999” and the service identification information “01234-5678-9902-3456-78901234” for the user ID “user2”. It is shown that it is possible to provide a Web service having

  The search unit 332 receives the search information 12 and 22 received by the search information input unit 331, and searches whether the location information that matches the search condition of the search information 12 and 22 is stored in the Web service information DB 31. The search result is notified to the permission confirmation unit 333. Here, the search condition will be described. As described above, the user of the client does not know the location of the data server 4. Therefore, the search condition is information that does not include an address indicating the location of the data server 4. For example, if the location information 312 in FIG. 9 is “http: // server: 8080 / Services / supplily” and “server: 8080” indicates the location of the data server 4, the search condition is “server”. : / Services / suppley other than “: 8080”. The search operation of the search unit 332 determines not a complete match with the location information 312 stored in the Web service information DB 31 but a match with location information other than the location information of the data server 4 in the location information 312.

  The permission confirmation unit 333 receives the search result from the search unit 332. At this time, if the search result indicates that the location information has been found, the searched location information and the service identification information 311 corresponding to the location information are received from the search unit 332. Further, the authority information of the search information 12 and the search information 22 input by the search information input unit 331 is also input.

  When the search result indicates that the location information has been found, the permission confirmation unit 333 searches the authentication information DB 32 and acquires the user ID corresponding to the service identification information 311 received from the search unit 332. Then, the acquired user ID and authority information are compared to determine whether or not they match. If they match, the location information 312 is returned to the search source client as the Web service location information 34.

  When the user ID of the permission information does not match the authority information, when the search unit 332 finds no location information of the service information that matches the search condition, the permission confirmation unit 333 corresponds to the service identification information 311 from the authentication information DB 32 When the user ID to be searched cannot be retrieved, the non-applicable information 35 is returned to the retrieval source client.

  For example, when the user of the client 1 has the authority information “user1” and the service identification information 311 can acquire “99999-9999-9999-9999-99999999” by the search unit 332, this “99999-9999- In the example of FIG. 10, “user2” is permitted to disclose information for “9999-9999-99999999”, and “user1” is not set. For this reason, the client 1 is not provided with information regarding the Web service, and a response of the non-applicable information 35 is returned. On the other hand, when the user of the client 2 connects to the Web service information acquisition server 3, the Web service information acquisition server 3 is inquired with the authority information of the user ID “user2”, and the service identification information 311 in FIG. “User2” is set in the user ID “9999-9999-9999-99999999”. Therefore, the client 2 is permitted to provide information, and the location information 312 of the service identification information “99999-9999-9999-9999-99999999” is passed as the Web service location information 34.

  As a result, the client 1 is not informed of the connection destination information regarding the data server and the existence thereof. Further, the client 2 can use the web service based on the obtained location information regarding the web service, and can acquire target information.

  In this way, by using the user authentication function at the time of providing information of the Web service information acquisition server, in addition to the function of searching for the location information of the conventional Web service, the existence of the Web service exists in the other party who is not permitted to authenticate. Even if the information is not given, the Web service information is disclosed only to users who are permitted to disclose the information, and the Web service information can be prevented from being illegally accessed. Further, since the location information of the data server is not notified to users who are not permitted to be disclosed, it is possible to prevent the data server from being accessed illegally.

  In addition, it has been described that the conventional data server performs authentication using the user name and password in the data server when the client connects to the data server. This conventional authentication function may be provided in the data server 4 of the first embodiment. As a result, even if a client without authentication permission is directly connected to the Web service by another means, a double authentication system in which the connection is rejected by the authentication of the conventional Web service, which is higher. There is an effect that security can be realized.

  In the above example, the authority information is only the user ID, but may include a password.

  In the first embodiment, the location information of the Web service server that the client wants to access is managed, and the information related to the Web service server that is permitted to be published is managed. By having a Web service location information acquisition server that has a function of authenticating whether or not to provide information related to the service server, the existence of the service and the server that performs the service are not notified to users who do not have access rights. An example of the featured system has been described.

  Also, a function that stores a user name / password in advance as information about the Web service server, receives a user name and password from a client, and authenticates the received user name and password by comparing them with a previously stored user name and password An example of a system characterized in that authentication is performed by the Web service location information acquisition server by providing the Web service location information acquisition server having the above-described information.

Embodiment 2. FIG.
In this embodiment, an example of a location search server apparatus and service information providing system having program identification information for identifying a client application program in authority information will be described. The client, Web service information acquisition server, and data server of this embodiment are realized by the computer system shown in FIG. 6, and the computer system has the hardware configuration shown in FIG.

  FIG. 11 is a configuration diagram of the service information providing system according to the second embodiment. In FIG. 11, each of users 1, 2, and 3 tries to acquire name list information managed by the data server 4, but since the location of the name list information is unknown, the web service that manages the location information of the name list information The information acquisition server 3 is accessed, and the location information is stored and managed to acquire location information indicating the location.

  User 411 uses application A of application 511 and application A of application 521 from client 1 and client 2, user 412 uses application A of application 521 from client 2, and user 413 uses client 2. From the application 512 of the application 512, the name list information is being browsed. The application A is a program that can display only a graph, for example, and the application B is a program that allows a user to process data, for example, storage of data. In addition, each of the applications A, B, and C includes repository access units 5111 and 5211 that acquire the location of data in order to acquire data required in the application.

  The data server 4 includes a service information providing unit 43 serving as a window for providing data through a Web service, and a name list information DB 621 for storing name list information. In addition, the service information providing unit 43 includes a name list information providing program 611 that executes processing for providing name list information to a user who has made a browsing request. The name list information providing program 611 is stored in the program group 149 of FIG. 7, and the service information providing unit 43 is the CPU 137.

  The Web service information acquisition server 3 knows that the name list information has been managed by the data server 4 in the past. The authentication component group 33 authenticates the location of the name list information and the other party for the search information “request for name list information” from the outside. The Web service information DB 31 is an example of a UDDI information DB that stores information that “name list information” is “in the data server”. The authentication information DB 32 stores a partner to whom information “name list information” may be provided.

  In FIG. 11, “◯” indicates that the location information has been acquired, and “X” indicates that the location information has not been acquired.

  Next, the operation of the service information providing system in FIG. 11 will be described. First, the user 1 will be described with reference to FIG. FIG. 12 is a diagram extracted from the overall configuration diagram of FIG. 11 of the components used when the user 1 intends to acquire name list information using the application A of the client 2 in FIG. In FIG. 12, user 1 first logs in to application A, and passes user information “user 1” as one of authority information 21 to application A. Further, the user 1 informs the application A of “search list information request” which is the search condition 18. The application A adds the program identification information “application A” indicating that it is the application A to the information “user 1” and “list information request” received at this time, and passes it to the repository access unit 5211. The repository access unit 5211 uses the “user 1” (user name), “application A” (program identification information), and “list information request” (search condition) for “client 2” of the client 2 that is operating. Search information 22 is generated by adding (client identification information), and the generated search information 22 is transmitted to the Web service information acquisition server 3 to make an inquiry.

  In the Web service information acquisition server 3, the authentication component group 33 first receives the search information 22, searches the Web service information DB 31 based on the search condition “request for name list information” of the search information, and provides information. Get server location information. Subsequently, the authentication component group 33 may access the authentication information DB 32 and provide Web service information of the acquired location information server to “user 1” using “application A” of “client 2”. Find out if. An example of the authentication information at this time is shown in FIG. As shown in FIG. 13, the authentication information has a hierarchical structure in the order of data server, client, application, and user. With this structure, even if the same user accesses from different applications and clients, there is a different correspondence. Keep it available. Here, when “data server”, “client 2”, “application A”, and “user 1” are traced in FIG. 13, authentication is “allowed” and “information can be provided”. The authentication part group 33 obtains the result. Thereafter, the authentication component group 33 returns the location information 34 indicating that “name list information” exists in the “data server” to the repository access unit 5211 of the client 2. The client 2 generates location information 23 for accessing the data server 4 from the returned location information 34, connects the data server 4, and acquires name list information.

  In this way, the user 1 can acquire the location information of the name list information from the Web service information providing server by using the application A from the client 2, specify the data server using the acquired location information, and acquire the name list information. .

  On the other hand, even if the user 1 tries to obtain the location information from the client 1 using the application A, since the provision of information is not permitted for “client 1” from the authentication information of FIG. Sent from the service information acquisition server 3.

  Further, even if the user 2 tries to acquire the location information from the client 2 by using the application A, since the provision of information is not permitted for the “user 2” from the authentication information of FIG. Sent from the service information acquisition server 3.

  Further, when the user 3 tries to acquire the location information from the client 2 using the application B, the information about the “client 2” and the “application B” from the authentication information of FIG. Therefore, the location information 34 is sent from the Web service information acquisition server 3.

  As described above, by managing authentication information in a hierarchical structure, even if the same user accesses from different applications, different correspondences such as data server, client, application, user according to various situations This has the effect of enabling complex access control.

  Further, the order of the hierarchies is not limited to the order of the data server, the client, the application, and the user. For example, the user may be the highest hierarchy.

  The authority information may be at least one of a data server, client identification information, program identification information, user name, and the like. For example, only the program identification information or a mechanism for authenticating only the client identification information may be used. Absent. For example, when only the program identification information is authenticated, the authentication information DB 32 stores only the program identification information that permits the provision of information, not the hierarchical structure.

  In this embodiment, program identification information (application name) that may be given information is stored in the authentication information DB in advance, and an application name that uses the Web service information acquired after acquiring the Web service information is received from the client and received. Description of an example of a system characterized in that authentication is performed for each application by providing a Web service information acquisition server having a function of authenticating by comparing the application name and the application name stored in the authentication information DB did.

  Also, assuming that the client is accessing the Web service information acquisition server using a predetermined application, an identification name for identifying the client application to which the Web service information may be given is stored in advance and accessed from the client. Each application on the client side by providing a Web service information acquisition server having a function of authenticating the received application by comparing the received application identification name with the previously stored application identification name. An example of a system having an access control mechanism characterized by performing authentication is described.

  The authentication is performed by confirming that all of the user name, the password, the identification name for identifying the client, and the identification name for identifying the client-side application are matched (including matching), or at least one of them, A system having an access control mechanism characterized in that fine authentication is performed by determining whether or not Web service information can be given by confirming that one or more are combined and matched (including matching) An example was described.

Embodiment 3 FIG.
In this embodiment, an example of a location search server device and a service information providing system that use a time at which Web service information may be disclosed for authentication will be described.

  FIG. 14 is an overall configuration diagram of the third embodiment. FIG. 14 is a diagram illustrating an example in which a user 1 who wants to check a deposit and saving balance such as a bank and a user 2 who wants to make a payment to a bank access the deposit information DB 104 of the bank server which is the data server 4. In FIG. 14, a user 81 is a user 1 who wants to view deposit information with respect to the bank server, and a user 82 is a user 2 who wants to make a payment with the bank server. The client 91 is an application server that operates an application 911 used by the user 81. The client 92 is an application server that operates an application 912 used by the user 82. The application 911 is an application used by the user 81 for confirming the deposit balance, and has program identification information of “application A”. The application 912 is an application used by the user 82 to make a payment, and has program identification information of “application B”. The Web service information acquisition server 3 has the same configuration as in FIG. 1, and the authentication component group 33 in FIG. 14 has the same configuration as the authentication component group 33 in FIG. The users 81 and 82 do not know where the deposit information DB 104 and the data server 4 are. Therefore, before accessing the deposit information DB 104, the users 81 and 82 access the Web service information acquisition server 3 and acquire location information for connecting to the data server. Further, the Web service information acquisition server 3 determines whether or not the user 81 or 82 can access the bank server by the authentication component group 33. As a result of the determination, if access is possible, the Web service information acquisition server 3 notifies the user who can access the location information of the bank server. In the case of access addition, the web service information acquisition server 3 notifies the user who cannot access the information indicating that there is no match. The flow of information between the client, the Web service information acquisition server, and the data server, and the content of the information are the same as in the first and second embodiments.

  The difference from Embodiments 1 and 2 is that the authentication information DB 32 stores the time during which provision of Web service information is permitted. FIG. 15 is an example of information stored in the authentication information DB 32 of this embodiment. In FIG. 15, the authentication information DB 32 stores permission information in a hierarchical structure of data server> client identification information> program identification information> permission time information> user. Information other than the permission time information is the same as in the first and second embodiments. The permission time information indicates a time at which the web service information is permitted to be published. In the example of FIG. 15, “9:00 am to 5:00 pm” is a time when the publication is permitted. Further, the authentication information DB 32 in FIG. 15 does not store permission information for the client 1.

  Next, the operation of the service information providing system will be described. The user 81 instructs the application 911 that he / she wants to view the deposit information. At this time, the application 911 has the information of the authority information 11 and the search condition 18 that “user 1” is accessing the application 911 and the desired operation is “view the deposit information of user 1”. . The application 911 receives “browsing request” from the user 81, generates search information 12, connects the Web service information acquisition server 3, and transmits the search information 12. The search information 12 is at least the authority information 11 indicating that the user name is “user 1”, the program identification information is “application A”, and the client identification information is “client 1”, and “view the deposit information of user 1”. And a search condition 18.

  In the Web service information acquisition server 3, the search information 12 from the application 911 is received by the search information input unit 331. The search information input unit 331 passes the search information 12 to the search unit 332. The search unit 332 searches the Web service information DB 31 in response to the information that the authority information is “user 1”, “application A”, “client 1” and “view the deposit information of user 1”. The location information and service identification information of the data server 4 that accesses the deposit information DB are acquired. Note that the Web service information DB 31 stores information of the contents shown in FIG. The search unit 332 passes the location information, service identification information, and search information 12 to the permission confirmation unit 333. The permission confirmation unit 333 acquires time information indicating the time at which the location information, service identification information, and search information are received from the search unit 332 from the time management function that the self-confirmation unit 333 has. Thereafter, the authentication information DB 32 is searched to determine whether or not disclosure of Web service information is permitted. In the example of the authentication information DB 32 in FIG. 15, permission information related to “client 1” is not stored. For this reason, the permission confirmation unit 333 transmits the non-applicable information 35 to the user 81 of the client 1.

  On the other hand, the search information 22 of the user 82 includes authority information 21 of “user 2”, “application B”, and “client 2”. Since the operations of the search information input unit 331 and the search unit 332 are the same as the operations when the search information 12 of the user 1 is input, the description thereof is omitted. When the permission confirmation unit 333 searches the authentication information DB 32, whether or not they match in the order of “data server identification information”, “client identification information”, “program identification information”, “permission time information”, and “user name”. Confirm. Here, “data server identification information”, “client identification information”, “program identification information”, and “user name” respectively match the search information 22. “Permitted time information” is a time period during which browsing is permitted, and is set to be possible between “9:00 and 17:00”. For this reason, when the acquired time information matches the permission time information, the permission confirmation unit 333 determines that browsing is possible and notifies the user 82 of the location information.

  The user 82 can access the data server 4 using the application 912 using the location information transmitted from the Web service information acquisition server 3 and access the deposit information DB 104 to perform settlement.

  When the above-described permission time information is stored in the authentication information DB, “9: 00 to 17: a time zone in which payment can be made after several hours have elapsed since the user received the location information from the Web service information acquisition server 3. Even after the range of “00” is passed, for example, after “18:00”, the location information is known, so that the data server can be accessed. For this reason, when the Web service information acquisition server 3 transmits the location information to the client, the permission time information is also transmitted together. Then, when accessing the data server, the allowable time information is sent to the data server, and the data server side checks whether the time at which the current access is performed is included in the allowable time information. . Alternatively, the permission time information is stored by the application 912 and the permission time information stored when the user requests access to the data server is compared with the time when the access is requested. If the requested time is included, the data server is accessed according to the request. If not included, a notification may be issued that the data server cannot be accessed and the processing is forcibly terminated. .

  As described above, in this embodiment, by providing a hierarchical structure, not only the three layers of server, application, and user, but also other layers such as time are provided according to the situation, and authentication at the time of access is finely detailed. There is an effect that can be controlled.

  By providing a Web service information acquisition server that performs authentication by combining information other than information related to clients, applications, and users, such as the time of access, as authentication information. An example of a service information providing system having an access control mechanism characterized by performing fine authentication has been described.

Embodiment 4 FIG.
In the third embodiment, the data server is only the data server 4 in the service information providing system. In this embodiment, an example of a service information providing system including two or more data servers will be described.

  FIG. 16 is a configuration diagram of the service information providing system of this embodiment. FIG. 17 is an example of information stored in the authentication information DB 32 of this embodiment. In FIG. 16, the service information providing system includes two data servers 4 and 40. Further, the authentication information DB 32 of FIG. 16 has permission information having a hierarchical structure for each of “data server 1” and “data server 2”. For example, for “data server 1”, permission information is set such that the program identification information is “application A”, the permission time information is “7:00 to 20:00”, and the user name is “user 1”. For the “data server 2”, permission information is set such that the program identification information is “application B”, the permission time information is “10: 0 to 15:00”, and the user name is “user 2”. Therefore, the permission confirmation unit 333 confirms whether the web service information can be disclosed for each data server.

  As described above, in this embodiment, since the authority information can be set for each of the plurality of data servers, the permission information for permitting the provision of the Web service information can be set according to the contents of the database managed by the data server. For this reason, there is an effect that it is possible to finely determine whether information disclosure is possible or not.

1 is a configuration diagram of a service information providing system according to Embodiment 1. FIG. It is a block diagram of a conventional Web service providing system using UDDI. It is a detailed block diagram of the Web service information acquisition server 3 in FIG. It is a figure which shows the element with which the clients 1 and 2 of FIG. 1 are provided, and the flow of information. It is a figure which shows the element with which the data server 4 of FIG. 1 is provided, and the flow of information. 2 is a diagram illustrating an external appearance of a computer system that realizes each of a Web service information acquisition server 3, a data server 4, and clients 1 and 2. FIG. It is a hardware block diagram of the computer system of FIG. 1 is a configuration diagram of a service information providing system according to Embodiment 1. FIG. It is an example of the information which Web service information DB31 of Embodiment 1 memorizes. It is an example of the information which authentication information DB32 of Embodiment 1 memorizes. FIG. 10 is a configuration diagram of a service information providing system according to a second embodiment. 11 is a diagram in which each component used when the user 1 is trying to acquire name list information using the application A of the client 2 in FIG. 11 is extracted from the overall configuration diagram of FIG. 11. It is an example of the information which authentication information DB32 of Embodiment 2 memorizes. FIG. 10 is a configuration diagram of a service information providing system according to a third embodiment. It is an example of the information which authentication information DB32 of Embodiment 3 memorizes. FIG. 10 is a configuration diagram of a service information providing system according to a fourth embodiment. It is an example of the information which authentication information DB32 of Embodiment 4 memorizes.

Explanation of symbols

  1, 2 client, 3 Web service information acquisition server, 3a UDDI registry, 4 data server, 11, 21 authority information, 12, 22 search information, 13 search information generation unit, 14 transmission unit, 15 reception unit, 16 access unit, 17 Acquisition unit, 18 Search condition, 23, 34 Location information, 31 Web service information DB, 32 Authentication information DB, 33 Authentication component group, 35 Not applicable information, 40 Data server, 41 Web service information, 42 Service information DB, 43 Service information providing unit, 81, 82 users, 91, 92 clients, 104, 105 Deposit information DB, 137 CPU, 138 bus, 139 ROM, 140 RAM, 141 CRT display device, 142 K / B, 143 mouse, 144 Communication board 145 FDD, 146 magnetism Disk device, 147 OS, 148 window system, 149 program group, 150 file group, 186 CDD, 187 printer device, 188 scanner device, 200 system unit, 310 FAX machine, 320 telephone, 311, 321 service identification information, 312 Information, 322 permission information, 331 search information input unit, 332 search unit, 333 permission confirmation unit, 411, 412, 413 user, 500 web server, 501 Internet, 511, 512, 513, 521 application, 611 name list information providing program, 621 Directory information DB, 911, 912 Application, 5111, 5211 Repository access unit.

Claims (7)

The location information indicating the location of the service information provided by the service information providing server device is stored, and the search information for searching the location of the predetermined service information is input from the client device, and the location of the service information corresponding to the search information is input. In the location search server device for searching for information,
A location information storage unit for storing the service identification information for identifying the service information and the location information in association with each other;
A permission information storage unit that stores permission information for permitting the client device to provide the service information and the service identification information in association with each other;
A search information input unit for inputting authority information indicating acquisition authority of the location information together with the search information;
A search unit that searches the location information storage unit based on the search information input by the search information input unit and acquires location information and service identification information;
The permission information corresponding to the service identification information acquired by the search unit is acquired by searching the permission information storage unit, and it is determined whether or not the acquired permission information matches the authority information, and the permission information The location information acquired by the search unit is notified to the client device, and the location information cannot be acquired when the permission information and the authority information do not match. A location search server device comprising a permission confirmation unit for notifying the device. The authority information includes a user name and a password for identifying a user of the client device,
The permission information includes a user name and a password that permit the provision of the service information,
2. The location search server according to claim 1, wherein the permission confirmation unit determines whether or not a user name and a password included in the acquired permission information match a user name and a password of the authority information. apparatus. The authority information includes program identification information for identifying an application program of the client device that uses the service information,
The permission information includes permitted program identification information for identifying an application program permitted to use the service information,
The location search according to claim 1 or 2, wherein the permission confirmation unit determines whether or not the permitted program identification information included in the acquired permission information matches the program identification information of the authority information. Server device. The authority information includes client identification information for identifying the client device,
The permission information includes permitted client identification information for identifying a client device permitted to use the service information,
The permission confirmation unit determines whether or not the permitted client identification information included in the acquired permission information matches the client identification information of the authority information. Location search server device. The authority information includes a user name and password for identifying a user of the client device, program identification information for identifying an application program of the client device that uses the service information, and client identification information for identifying the client device. Have
The permission information includes a user name and password that are permitted to provide the service information, permitted program identification information that identifies an application program that is permitted to use the service information, and a client device that is permitted to use the service information. Authorized client identification information to identify,
The permission confirmation unit confirms that the user name, password, program identification information, and permitted client identification information included in the acquired permission information all match the user name, password, program identification information, and client identification information of the authority information. The location search server device according to claim 1, wherein it is determined whether or not.   The location search server device according to claim 1, wherein the search unit is Universal Description Discovery and Integration (UDDI). A service information providing server device that provides service information requested from the client device;
A client device for inquiring about the location of the service information;
The location information indicating the location of the service information is stored, the search information for inquiring the location of the predetermined service information is input from the client device, the location information of the service information for the search information is searched, and the client In a service information providing system comprising a location search server device that notifies location information searched to a device, and connecting the server device, the client device, and the location search server device via a predetermined network,
The location search server device is
A location information storage unit for storing the service identification information for identifying the service information and the location information in association with each other;
A permission information storage unit that stores permission information related to the client device side that permits the provision of the service information and the service identification information in association with each other;
A search information input unit for inputting authority information indicating acquisition authority of the location information together with the search information from the client device;
A search unit that searches the location information storage unit based on the search information input by the search information input unit and acquires location information and service identification information;
The permission information corresponding to the service identification information acquired by the search unit is acquired by searching the permission information storage unit, and it is determined whether the acquired permission information matches the authority information input by the search information input unit. If the permission information matches the authority information, the location information acquired by the search unit is notified to the client device. If the permission information does not match the authority information, the location information can be acquired. A permission confirmation unit for notifying the client device of the absence,
The client device
When the location information is notified by the location search server device, an access unit that accesses the service information of the server device using the notified location information;
An acquisition unit that acquires service information corresponding to the location information from the server device,
The service information providing server device
A service information storage unit for storing service information corresponding to the location information;
A service information providing unit for inputting location information from the client device, retrieving service information corresponding to the entered location information by searching the service information storage unit, and transmitting the acquired service information to the client device; Service information providing system characterized by comprising.

Images