JP2007034956A - Http server/client system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform session management by which a session ID is immediately acquired even when a client is terminated without termination processing of a session in an HTTP server/client system without a session concept. <P>SOLUTION: The HTTP server/client system has a means that the server creates the session ID showing continuation of access, a means for transmitting the session ID from the server to the client when performing access management to the server, a means for transmitting the session ID to the server when accessing the server, a means that the server returns an error when an access request having a different session ID comes from the client, a means for prompting reconfirmation of connection when a connection request comes from a client without having the session ID and a means for invalidating the present session ID to generate a new session ID when a connection request after reconfirmation of the connection comes from a client without having the session ID and excludes simultaneous access from a plurality of clients. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to access control when a server client system is configured using HTTP.

  Conventionally, a program for setting a device from the outside of the device is created by a dedicated program that runs on a computer connected to the device, and communicates with the device using a unique protocol. In this case, there is a procedure in which exclusive control is performed on the device side so that dedicated devices operating on a plurality of computers are not accessed simultaneously, and the program side also displays the result of exclusive control.

  The dedicated program used here must be prepared for each operating system on which the program operates. For this reason, in recent years, a method has been used in which a device setting program is loaded on the device side using HTTP and device setting is performed using a general-purpose HTTP client. As a result, it is not necessary to prepare a dedicated program for each operating system.

  For example, in an information management department in a medical field or a disaster area, a situation in which a user must leave his / her seat due to an emergency call or the like frequently occurs while searching for materials or the like using a client. In such a case, log off the client being processed and leave the seat, but in the case of an emergency call, there is no time to log off, and you may forget to log off and leave the seat, Often it is not possible to return as it is.

  In such a case, the user can log in from another terminal using his / her ID and password. However, the conventional system with a user authentication function cannot be logged in due to exclusive control because the previous terminal is in use when logging in from another terminal, and it returns to the previously used terminal. There is a problem that it cannot be used unless it logs off or waits for a certain time and does not wait for a forced logoff performed by the server.

For this reason, there has been proposed a terminal management method, program, and apparatus that enable the latest login to be used effectively without performing exclusive control with respect to double login by the same user even for login by user authentication ( For example, Patent Document 1).
JP-A-2005-056301

  In the method using a dedicated program, it is necessary to provide a dedicated program for each operating system. Therefore, in recent years, a method that does not depend on an operating system using an HTTP browser is often used.

  However, in HTTP, since there is no concept of a session, it is difficult to instruct a series of continuous processes from a client to a server sequentially.

  For this reason, when session management is performed using HTTP, a login / logout function is added and exclusive control is performed.

  However, if the HTTP browser is terminated without logging out, the server remains logged in within the server, and therefore processing for considering logout is performed after a certain time. Even in this case, in order to log in again, it is necessary to wait for a certain period of time.

  The present invention has been made paying attention to the above-mentioned problems, and in a server client system using HTTP without the concept of session, an HTTP client is terminated without session termination processing in a session management application. It is an object of the present invention to provide an HTTP server / client system that can immediately acquire a session ID.

In order to solve the above-described problem, in claim 1 of the present invention,
In a server / client system that uses HTTP (Hyper Text Transfer Protocol), indicates the continuation of access when managing access to the server in a system that completes the work through multiple communications without performing account management. A means for creating a session ID by the server, a means for sending the session ID from the server to the client, a means for sending the session ID to the server when accessing the server, and an access request having a different session ID is received from the client. If the server receives a connection request from a client that does not have a session ID, the server sends a connection request after reconfirming the connection from a client that does not have a session ID. If you come, current session I As invalid, comprising means for generating a new session ID, and is characterized in that to eliminate simultaneous access from a plurality of clients.

In claim 2, in addition to claim 1,
When a connection request is received from a client that does not have a session ID, a means for prompting a password is provided.

In claim 3, in addition to claim 1,
In the case where an access is made from a client having an invalid session ID, there is provided a means for returning information indicating invalidity.

In claim 4, in the case of providing account management in claim 1,
It has a means for returning information indicating invalidity together with account information having a new session ID.

  According to claim 1 of the present invention, in a server / client system that uses HTTP (Hyper Text Transfer Protocol) without the concept of a session, the server completes the work in multiple communications without performing account management. When managing access to the server, the server creates a session ID at the start of access and performs a series of communication processes by mutually using the session ID, but when the HTTP client is terminated without session termination processing However, the session ID can be acquired immediately.

  According to the second aspect, it is possible to prevent the session from being inadvertently terminated during a series of processes.

  According to the third aspect, the terminated session can recognize that it has been terminated.

  According to claim 4, when account management is performed, it is possible to recognize the terminated account.

  The best mode for carrying out the present invention will be described below based on examples.

  The configuration of the first embodiment of the present invention is shown in FIG. Reference numeral 101 denotes a network for connecting a device having an HTTP server and a computer having an HTTP client.

  Reference numeral 102 denotes a device connected to the network 101, which is a device including an HTTP server. Reference numeral 103 denotes a network interface that performs communication with other devices connected to the network 101. Reference numeral 104 denotes an HTTP server operating on the network 101. Reference numeral 105 denotes an HTTP processing unit that executes processing based on a request received by the HTTP server 104. Reference numeral 106 denotes a session management manager that manages the presence / absence of a session, and reference numeral 107 denotes session information managed by the session management manager 106. A timer 108 returns the time in response to a request from the session management manager 106. Reference numeral 109 denotes various setting units that return the setting or change of the device 102 itself and setting information in response to a request from the HTTP processing unit 105. This does not exist in the setting unit 109 alone, but may have a logical configuration in which the setting units in the apparatus 102 are collected. Reference numeral 110 denotes HTML document information serving as original data for the HTTP processing unit 105 to generate HTTP data.

  A computer 111 is connected to the apparatus 102 by HTTP. Reference numeral 112 denotes a network interface that communicates with other devices connected to the network 101. Reference numeral 113 denotes an HTTP client that operates on the computer 111. Reference numeral 114 denotes Web page information received by the HTTP client 113, and reference numeral 115 denotes a Web page display unit that displays a Web page by the HTTP client 113. Reference numeral 116 denotes an input unit that passes information obtained from an input device (not shown) attached to the computer 111 to the HTTP client 113.

  In the apparatus 102 and the computer 111, there are components outside the above components, but the portions that do not directly affect the present invention are not described.

  FIG. 2 and FIG. 3 show an operation flow of the apparatus 102, which is a feature of the present invention. FIG. 4 shows an operation flow of the computer 111. The operation of this embodiment will be described with reference to FIGS.

  When the user of the computer 111 makes an access request to the apparatus 102 via the HTTP client 113 (S401) (S402), when the HTTP server 104 receives the request via the network 101 and the network interface 103, the HTTP processing unit 105 is directly received. Transfer data to The HTTP processing unit 105 recognizes access from the client (S201). The HTTP processing unit 105 confirms with the session management manager 106 whether a session is in operation (S202). Based on the information of the session information 107, the session management manager 106 returns to the HTTP processing unit 105 whether or not a session is in operation. The HTTP processing unit 105 receives a response from the session management manager 106, and when the session is not operating, checks whether the access request data from the computer 111 includes a session ID (S203). If it is not included, it is determined that the session is not in operation and that it is a new access request, and the session management manager 106 is requested to create a session ID. Upon receiving a session ID creation request, the session management manager 106 creates a session ID (S204), and stores the created session ID in the session information 107 together with the creation time (S205). The session management manager 106 returns the created ID to the HTTP processing unit 105, and the HTTP processing unit 105 creates data according to the access request data using the HTML document information 110 (S206) and receives it from the session management manager 106. The session ID is added (S207), and response data is returned to the computer 111 (S208). Upon receiving the response data (S403), the computer 111 stores the data in 114 and displays it on the screen (S404) on the Web page display unit 115, thereby completing the request process (S405).

  Examples of response data returned at this time are shown in FIGS. In FIG. 5, reference numeral 501 denotes a part to which session ID information is added.

  Subsequently, when the user of the computer 111 performs an operation from the displayed Web page, an access request with a session ID is transmitted to the apparatus 102 according to the data included in the information held at 114 (S402). When a request is received via the network 101 and the network interface 103, the data is transferred to the HTTP processing unit 105 as it is, and the HTTP processing unit 105 recognizes access from the client (S201). The HTTP processing unit 105 confirms with the session management manager 106 whether a session is in operation (S202). As described above, since there is session information registered in the session information 107, the time is acquired from the timer 108 (S209) and compared with the time recorded in the session information 107 (S210). When the predetermined time has not passed, it is considered that the session is continuing, and the session processing is returned to the HTTP processing unit 105. The HTTP processing unit 105 receives a response from the session management manager 106 and confirms whether or not the session ID is included in the access request data from the computer 111 (S212). Assuming that the request is from the client having the ID, the session ID included in the access request is compared with the session ID managed by the session management manager 106 (S301). If the session IDs match (S302), it is regarded as a request from the same client, the request is analyzed (S308), response data is created using HTML document information 110 (S309), and a session ID is added (S310). Response data is returned to the computer 111 (S208). At this time, in order to maintain the continuation of the session, the time information of the session information 107 is updated (S311).

  If the user of the computer 111 performs an operation after a predetermined time has elapsed, it is regarded as a timeout in the processing of S210, the session information recorded in 107 is cleared (S211), and the HTTP processing unit 105 Return as session inactive. The HTTP processing unit 105 checks whether the access request data from the computer 111 includes a session ID (S212). If included, the HTTP processing unit 105 is a session non-operation and is a request from a client having a session ID. Therefore, it is determined that the session has expired, and the process for confirming the temporary session ID is entered. Originally, the data is expired at this point, but since this is the same situation as when the temporary session ID is received, this confirmation process is performed. The session management manager 106 confirms whether a temporary session ID is issued (S303). If the temporary session ID is issued, the session ID included in the access request and the temporary session managed by the session management manager 106 are displayed. The IDs are compared (S304). Here, since there is no temporary session ID or does not coincide with the temporary session ID (S305), the response data expired using the HTML document information 110 is created (S312), and the response data is returned to the computer 111 (S208).

  When an access request is received from a user other than the user who is processing the session during the session operation, the HTTP server 104 transfers the data to the HTTP processing unit 105 as it is when the request is received via the network 101 and the network interface 103, and the HTTP processing The unit 105 recognizes access from the client (S201). The HTTP processing unit 105 confirms with the session management manager 106 whether a session is in operation (S202). As described above, since there is session information registered in 107, the time is acquired from the timer 108 (S209) and compared with the time recorded in the session information 107 (S210). If the predetermined time has not passed, it is considered that the session is continuing, and the fact that the session is operating is returned to the HTTP processing unit 105. The HTTP processing unit 105 receives a response from the session management manager 106, checks whether the access request data from the computer 111 includes the session ID (S212), and includes the session ID instead of the user who is processing the session. Therefore, it is regarded as a request from a client that does not have a session ID, and the session management manager 106 is requested to issue a temporary session ID. Upon receiving the provisional session ID creation request, the session management manager 106 creates a provisional session ID (S213) and holds the created provisional session ID in 107 together with the creation time (S214). The session management manager 106 returns the created temporary session ID to the HTTP processing unit 105. The HTTP processing unit 105 creates data indicating that the session is already being processed using 110 (S215), and the session management manager 106 The temporary session ID received from the server is added (S216), and response data is returned to the computer 111 (S208).

  When the user who has received the temporary session ID performs an operation from the displayed Web page, an access request with a session ID is transmitted to the apparatus 102 according to the data included in the information held in the Web page information 114 ( S402). When receiving the request via the network 101 and the network interface 103, the HTTP server 104 transfers the data to the HTTP processing unit 105 as it is, and the HTTP processing unit 105 recognizes access from the client (S201). The HTTP processing unit 105 confirms with the session management manager 106 whether a session is in operation (S202). Since there is session information registered in the previous 107, the time is acquired from the timer 108 (S209) and compared with the time recorded in the session information 107 (S210). If the predetermined time has not passed, it is considered that the session is continuing, and the fact that the session is operating is returned to the HTTP processing unit 105. The HTTP processing unit 105 receives a response from the session management manager 106 and confirms whether or not the session ID is included in the access request data from the computer 111 (S212). If it is included, the session is being operated and the session ID included in the access request is compared with the session ID managed by the session management manager 106 as a request from the client having the session ID (S301). To do. If the session IDs do not match, the session management manager 106 confirms whether a temporary session ID has been issued (S303). If the temporary session ID has been issued, the session ID included in the access request and the session The temporary session IDs managed by the management manager 106 are compared (S304). If these IDs match (S305), it is regarded as a request from the client that acquired the temporary session ID, and the temporary session ID information is overwritten on the session ID information (S306, S307). Thereafter, the request is analyzed (S308), response data is created using the HTML document information 110 (S309), a session ID is added (S310), and the response data is returned to the computer 111 (S208). At this time, in order to maintain the continuation of the session, the time information of the session information 107 is updated (S311).

  When the user who has received the temporary session ID performs an operation after the session is cleared, it is determined in the process of S202 that the session is not in progress, and since the request has a session ID in S203, the process of S303 is continued. Thereafter, the same operation as described above is performed.

  When the original session user accesses after the session ID is rewritten, the HTTP processing unit 105 confirms with the session management manager 106 whether the session is in operation (S202). Since there is changed session information 107, the time is acquired from the timer 108 (S209) and compared with the time recorded in the session information 107 (S210). If the predetermined time has not passed, it is considered that the session is continuing, and the fact that the session is operating is returned to the HTTP processing unit 105. The HTTP processing unit 105 receives a response from the session management manager 106 and confirms whether or not the session ID is included in the access request data from the computer 111 (S212). If the ID is included, the session is being operated, and the session ID included in the access request is compared with the session ID managed by the session management manager 106 as a request from the client having the session ID ( S301). Since the session IDs do not match, expired response data is created using the HTML document information 110 (S312), and the response data is returned to the computer 111 (S208).

  Before a user who has received a temporary session ID performs an operation from the displayed Web page, if a new temporary session is issued and the temporary session ID is overwritten, the user who has received the previous temporary session ID When an operation is performed from the displayed Web page, S201, S202, S209, S210, S212, S301, S302, S303, S304 or S201, S202, S209, S210, S211, S203, S301, S302, S303, S304 or , S201, S202, S203, S301, S302, S303, S304, the process of S305 determines that the session ID is different, and creates expired response data using the HTML document information 110 (S312). Response data is returned to the computer 111 (S20 ).

  In this embodiment, after creating a temporary session ID and reconfirming to the user, the current session ID is invalidated and a new session is generated, but the session ID is not issued without issuing the temporary session ID. An invalid method is also possible. In this case, if an inadvertent access request is made, the session is invalidated. However, in an environment where the user is limited, the operation can be simplified.

  The HTTP processing unit 105 performs not only the session processing and response data creation processing, but also processing for requesting various setting units 109 to set the requested apparatus 102 main body through an access request.

  Although the present embodiment is an embodiment of claim 3, the embodiment of claim 1 can be easily realized by omitting the processing of S312.

  The password input process described in claim 2 can be easily realized by entering a process for inputting a password before entering the flow shown in FIG. In addition, if you want to perform password input processing only during session operation, create response data including a password input request when issuing a temporary session ID, and include a password in the access request including the temporary session ID. This can be realized by performing password comparison processing in the comparison in S304. In this case, if session processing is not in progress, user restrictions are not provided, and a user who can change a session even during session processing is limited to a password holder.

  In the system for performing account management shown in claim 4, in addition to the configuration shown in the first embodiment, a mechanism for performing account management in the apparatus 102 or outside the apparatus 102 is prepared and connected to the HTTP processing unit 105. This can be realized by checking the validity of the account in the HTTP processing unit 105. When a mechanism for performing account management exists outside, the mechanism communicates with the network 101 via the network interface 103 without using the HTTP server 104 and the conjunction with the network 101. At this time, the HTTP processing unit 105 includes a unit that holds information for connecting to the mechanism in advance.

  When adding the session ID to the warning data in S215 and S216, the HTTP processing unit 105 passes the account information acquired from the mechanism, for example, the user name to the session management manager 106 and holds it in the session information 107 together with the session information. At the same time, the user name using the current session is added to the warning data. As a result, when displaying the warning data, the name of the current session user can be displayed in S404.

  Further, even when the original session user accesses after rewriting the session ID, by adding the user name using the current session to the expiration response data in the process of S312, The name of the session user can be confirmed by the original session user.

Configuration diagram of Example 1 Operation flowchart 1 of the apparatus 102 according to the first embodiment Operation flowchart 2 of the apparatus 102 according to the first embodiment Flowchart of computer 111 according to the first embodiment The figure which shows the first half of the example of the produced | generated data of Example 1. The figure which shows the second half of the example of the produced | generated data of Example 1.

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 Network 102 Equipment including HTTP server 103 Network interface 104 HTTP server 105 HTTP processing unit 106 Session management manager 107 Session information 108 Timer 109 Various setting unit 110 HTML document information 111 Device including HTTP client, computer 112 Network interface 113 HTTP Client 114 Web page information 115 Web page display unit 116 Input unit

Claims (4)

In a server / client system that uses HTTP, a system that completes work through multiple communications without performing account management.
Means for the server to create a session ID indicating continuation of access when managing access to the server;
Means for sending the session ID from the server to the client;
Means for sending a session ID to the server when accessing the server;
If the client receives an access request with a different session ID, the server returns an error;
When a connection request is received from a client not having a session ID, means for prompting reconfirmation of the connection,
Means for invalidating the current session ID and generating a new session ID when a connection request is received after reconfirming the connection from a client having no session ID;
An HTTP server / client system characterized by eliminating simultaneous access from a plurality of clients. When a connection request is received from a client who does not have a session ID, a means for prompting a password is provided.
2. The HTTP server / client system according to claim 1, wherein unnecessary access is excluded. When there is an access from a client having an invalid session ID, a means for returning information indicating invalidity is provided,
2. The HTTP server / client system according to claim 1, wherein unnecessary access is excluded. In a server / client system that uses HTTP, a system that completes work through multiple communications while performing account management.
Means for the server to create a session ID indicating continuation of access when managing access to the server;
Means for sending the session ID from the server to the client;
Means for sending a session ID to the server when accessing the server;
If the client receives an access request with a different session ID, the server returns an error;
When a connection request is received from a client not having a session ID, means for prompting reconfirmation of the connection,
Means for invalidating the current session ID and generating a new session ID when a connection request is received after reconfirming the connection from a client having no session ID;
A means for returning information indicating invalidity together with account information having a new session ID when access is made from a client having an invalid session ID;
An HTTP server / client system characterized by eliminating simultaneous access from a plurality of clients.

Images