JP2009054086A - Information providing device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To uniformly manage access rights to a shared content provided by a plurality of services in a device which is connected to a terminal via a network and performs access control from a user to provide a plurality of services. <P>SOLUTION: Access control over a plurality of service providing servers 12 and 13 connected to a shared content 141 from a client terminal 3 is performed by an access control server 102 having access control data 103 to be data on the basis of which a determination of accessibility to the shared content 14 is made. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an apparatus that provides a plurality of services by connecting to a terminal via a network and realizing access control from a user.

  Many information providing devices (Web systems) that provide services on the Web via the Internet have been built, but some of them need to be protected, such as those that provide information to individuals and transactions between companies Some information (content) exists. For this reason, in the Web system, an access control function for content by personal authentication is introduced, and access control to the content is realized at the time of service provision. On the other hand, there is a need to use content from a plurality of services in order to improve business efficiency.

  In a conventional Web system access control device, when a new content is created, the policy server describes the security attributes set by the creator or administrator of the content and the security policy of the organization such as a company. Create an access control list based on the policy data. The created access control list is stored in the document management server that provides the service. When the user accesses this content, the user accesses the document management server that provides the content, and accesses the content with permission of access based on the access control list stored in the document management server. (For example, refer to Patent Document 1).

Japanese Patent Laying-Open No. 2006-48340 (Example 3, FIG. 20)

  In the conventional information providing apparatus, when one content is shared content provided by a plurality of services, an access control list is required for each server that provides the service, and there is addition / deletion of shared content and change of access authority. In addition, there is a problem that the access control lists of a plurality of servers that provide the content must be changed in conjunction.

  The present invention has been made to solve the above-described problems. By integrally managing the access rights of shared contents provided by a plurality of services, the access control lists of a plurality of servers are linked. The challenge is to eliminate the need for changes.

  In the information providing apparatus according to the present invention, the access control to the plurality of service providing servers connected to the shared content from the client terminal has access control data that is data used as a basis for determining whether to access the shared content. This is performed by the access control server.

  According to the present invention, the access control server centrally determines whether or not the service providing server can be accessed, so that the access authority can be changed by changing only the access control data. As a result, it is possible to avoid changing the access control lists of a plurality of servers in conjunction with each other.

Embodiment 1 FIG.
FIG. 1 is a schematic configuration diagram of an information providing apparatus according to Embodiment 1 for carrying out the present invention, FIG. 2 is a functional block diagram of an access control server according to Embodiment 1 for carrying out the present invention, and FIG. FIG. 4 is an explanatory diagram showing an example of user information data in the first embodiment for carrying out the invention. FIG. 4 is an explanatory diagram showing an example of a service provided by each server in the first embodiment for carrying out the present invention. 5 is an explanatory diagram showing an example of setting of access authority required by the service providing server according to the first embodiment for carrying out the present invention, and FIG. 6 is a diagram illustrating the service providing server according to the first embodiment for carrying out the present invention. FIG. 7 is an explanatory diagram showing an example of contents according to the first embodiment for carrying out the present invention, and FIG. 8 is an embodiment of the present invention. FIG. 9 is an explanatory diagram showing an example of content uniquely identifying the content in the first embodiment for carrying out the present invention, and FIG. 10 is an explanatory diagram showing an example of content in the first embodiment for implementing the present invention. It is explanatory drawing which shows the example of the access control server in Embodiment 1 for implementing.

  In FIG. 1, a Web system 1 that provides content and a client terminal 3 that requests content are connected via a network 2. Although only one client terminal 3 is shown in FIG. 1, usually a plurality of client terminals 3 are connected. This Web system 1 includes an authentication server 100 that authenticates a user by access from the client terminal 3 by a user, user information data 101 that stores user information, and an access control server 102 that realizes access control across services. , Access control data 103 for storing information used by the access control server 102, a plurality of service providing servers 12 and 13 for providing information in response to the request from the client terminal 3 described above, and a service providing among the plurality of service providing servers The content 121 used only by the server 12, the content 131 used only by the service providing server 13, and the content 141 shared and used by both the service providing server 12 and the service providing server 13, of which the authentication server 100, Chromatography The information data 101, the access control server 102, the service providing server 12 and 13 are connected to each other via a LAN (Local Area Network) 11 is a network in the Web system 1. This LAN 11 is connected to the network 2 described above.

  The authentication server 100 manages whether a user accessing from the client terminal 3 is logged in. When a user logs in to the Web system 1 by inputting a user ID, a password, or an identification code that replaces it in the client terminal 3 to log in, the user ID, password, or an identification code that replaces the above-mentioned information is stored in the user information data 101 By comparing the information, it is determined whether or not the user can log in. Only logged-in users can use the service providing servers 12 and 13 via the access control server 102. As in the example shown in FIG. 3, the user information data 101 stores information such as a password and an organization or a job system using a user ID as a key. In FIG. 3, if the service providing server 12 provides a service used only by a user belonging to a company organization, and the service providing server 13 provides a service used by a general user, the service providing server 12 is accessed. Possible users are users with user IDs A, B, C, and D, and users who can access the service providing server 13 are users with user IDs E, F, G, H, and I.

  FIG. 4 shows services provided by the service providing servers 12 and 13. As described above, the service providing server 12 is a server used only by users belonging to the company organization and provides business services, and the service providing server 13 is a server used by general users and provides information providing services. The contents of each service are as described in the corresponding column of FIG.

  As shown in FIG. 5, the service providing server 12 has a user policy for giving authority to roles and authorities. The service providing server 13 also has authority to roles and authorities as shown in FIG. The user who gives is defined.

  Further, in the content 121 in the business service provided by the service providing server 12, a status indicating the state of the content corresponding to each content and a content creator are registered as shown in FIG. As shown in FIG. 8, the content 131 in the information providing service to be provided registers a status indicating the state of the content corresponding to each content, a content creation user, and a disclosure range of this content. However, “PR Vol. 12” exists as the content 141 shared by both service providing servers 12 and 13, and this content is the content of the business service shown in FIG. 7 and the content of the information providing service shown in FIG. Shown in both figures.

  These contents and operations can be uniquely specified based on a predetermined expression by the function of the access control server or other server. For example, when the “modify” operation is performed on the content “10/11 meeting report” in “business service”, the service, content, and operation start with “http: // Web...” As shown in FIG. Assume that folders, files, and query parameters can be expressed in combination in a URL (Uniform Resource Locator) described in a format. However, in implementing the present invention, in order to share content across services, it is necessary to be able to designate content and service or content and operation as independent information. Services and operations do not necessarily have to be expressed independently, depending on their permissions.

  In order to realize access control for this uniquely specified content and its operation, the access control data 103 includes content 121 in the business service shown in FIG. 7, content 131 in the information providing service shown in FIG. The access control data for the shared content 141 shown in both of FIG. 8 is stored in the format shown in FIG. That is, for each content, a service that uses the content, an operation that the service performs on the content, and a user are specified, and whether access is permitted or not is stored as permission information. In each service, the authority for the content is attempted based on the content attributes such as “content creator” as shown in FIG. 7 and “range to allow disclosure” as shown in FIG. The user information, the organization, the job system, etc. are replaced with information contained in the user information data 101 and stored. Each record of the access control data shown in FIG. 10 is interpreted in order, meaning that, for example, all members except for the user I cannot access all contents of the business service.

  Using the access control data 103 expressed in this way, the access control server 102 executes access control by processing according to the block diagram shown in FIG. In FIG. 2, a request 611 indicates an HTTP request input by the user at the client terminal 3 and passed through the authentication server 100. This request 611 includes the service, content, and operations for the content as shown in FIG. In addition, information for determining the user who presented the request 611 is included in an HTTP header or Cookie which is a part of the information of the request 611.

  Upon receiving this request 611, the access control server 102 passes the request response process 621 and then passes the information to the access determination process 622. This access determination processing 622 specifies the user who has made the request 611 from the user information data 101 by the user information acquisition processing 625 via the access control data management processing 624 that handles input / output of data related to access control. Information relating to the service, content, and operation on the content is associated with the access control data 103, and when it is determined that access is permitted, the request transfer processing 623 uses the service providing server 12 based on the service information included in the request 611. Alternatively, a request is transmitted to 13, and the response 613 is transmitted to the client as a response 614. If it is determined that access is impossible as a result of the association with the access control data 102, a response 614 for displaying to the user that access is not permitted is created in the access determination process 622, and the request response process 621 is performed. Is transmitted to the client terminal 3.

  Since the access control server 102 is configured in this way, the access control of the unique contents 121 and 131 corresponding to the service providing server 12 or 13 and the shared contents 141 corresponding to the plurality of service providing servers 12 and 13 is changed. In order to do this, it is only necessary to change the access control data 103 that centrally manages data related to content access control.

  In this way, by providing an access control server that centrally manages access control data using expressions that uniquely identify content, services, and operations for services, a single content including shared content can be shared with a plurality of users. On the other hand, it is possible to permit or disallow information provision from a plurality of service providing servers, respectively, and it is also possible to change access control data only by changing access control data.

Embodiment 2. FIG.
In the first embodiment, when the contents 121, 131, and 141 are newly created or the information regarding access restriction is changed, the contents of the access control data 103 in FIG. 10 shown in the first embodiment are changed. However, this change may be performed by control settings from the service providing servers 12 and 13.

  In the second embodiment of the present invention, the functional block diagram of the access control server in the second embodiment for carrying out the present invention shown in FIG. 11 and the second embodiment for carrying out the present invention shown in FIG. A description will be given according to the explanatory diagram of control setting.

  In FIG. 11, the access control server 102 is provided with a control setting reception process 626 that is an input / output means for setting access control data from the service providing server 12 or 13, and the data stored in the access control data 103 handled by the Web system 1 Input interface. In response to the control setting reception processing 626, each service providing server 12, 13 transmits the control setting 104 according to a predetermined format as content is added / deleted. The control setting input / output process 626 that has received the control setting 104 passes the control setting 104 to the access control data management process 624, changes the access control data 103, sends a control response 105, and a service that has transmitted the control setting 104. It returns to the providing servers 12 and 13.

  FIG. 12 shows an example of the control setting 104. In the control setting 104, in addition to operations such as “add”, “delete”, and “update” as commands for the access control data, a list of currently set data is acquired as a control response 105 by an operation designation such as “list acquisition”. You can also specify an operation. The other data part includes information such as contents, services, operations, and users, and these are stored as one record in the access control data 102. The currently set control setting 105 can also be obtained with the same structure as the control setting 104. This data may be handled in a format such as XML (Extensible Markup Language) as shown in FIG.

  In the control setting 104, the content, service, operation, and user can each specify a plurality of elements. However, since the service should not affect other services, only the service that transmits the control setting 104 is specified. Only the system administrator or a specially authorized person can make settings across services, and the normal service does not change the settings of other services. Is transmitted together with authentication information for identifying Similarly, in the case of the control response 105 for acquiring the currently set control setting, only the user's own information can be acquired.

  By doing so, it becomes possible to dynamically update the access control data by the function of each service side in a situation where many contents are added to and registered in the service providing server.

  In this embodiment, the access control server is allowed not only to permit / deny, but also to execute various functions such as the presence / absence of log acquisition in the access control server. As a result, it is possible to realize functions that can be used for auditing, such as accumulating only logs for important operations.

Embodiment 3 FIG.
FIG. 13 shows a functional block diagram of an access control server in the third embodiment for carrying out the present invention, and a third embodiment for carrying out the present invention shown in FIG. A description will be given according to the explanatory diagram of the URL conversion definition.

  In order to apply the first embodiment of the present invention, it is necessary to make the URL, which is a request from the access control server to the service providing server, the same format so that the service, content, and operation can be uniquely identified. However, when building a plurality of services separately, it is difficult to make requests to all service providing servers the same URL expression. For this reason, in the third embodiment, the contents can be uniquely specified for the outside using the Web system, and the addresses can be used so that each service can use convenient expressions inside the Web system. A mechanism to perform conversion is added.

  In order to realize this mechanism, the request transfer processing 623 of the access control server 102 is provided with means for performing URL address conversion using the URL conversion definition 631 shown in FIG.

  The contents of the URL conversion definition 631 will be described with reference to the example shown in FIG. With respect to the URL expression 1001 disclosed to the outside by the Web system 1, information such as service, content, and operation is regarded as a variable. When the URL expression 1002 is used in the service providing server 12 and the URL expression 1003 is used in the service providing server 13, the URL in the request is stored in the URL conversion definition 631 for the internal service based on the format conversion definition 1004. Convert. In the URL expression 1001, the information specifying the service included in the [A] column is used as a determination condition, and the format is changed based on the conversion ID 1 for the service providing server 12 and the conversion ID 2 for the service providing server 13.

  Here, there are cases where information input externally cannot always be used as internal information. That is, for a certain operation, a name such as “modify” is used outside the Web system, but a name “update operation” is used internally, it is necessary to convert the variable into an internal representation. For this reason, a variable conversion definition 1005 is provided in the URL conversion definition, and a method for replacing a variable in the conversion ID of the format conversion definition 1004 is defined. In the conversion definition, functions such as encoding, string concatenation, replacement, and conditional branching can be used.

  As described above, according to the third embodiment of the present invention, it is possible to perform access control for each content even when the service providing server specifies the content and operation with different URL expressions.

Embodiment 4 FIG.
FIG. 15 is a functional block diagram of an access control server in the fourth embodiment for carrying out the present invention, and FIG. 16 is a fourth embodiment for carrying out the present invention. A description will be given according to the explanatory diagram of the control setting process definition.

  In the second embodiment, since only the processing provided in the access control data management process 624 is used for the control setting 104 in advance, the format of the control setting 104 is determined according to a method uniquely determined by the access control data management process 624. However, when a plurality of services are constructed separately, it is difficult to determine control settings from all service providing servers according to the same method. For this reason, in the fourth embodiment, when the access control data 103 is accessed by making it possible for each service to use a convenient expression in the Web system 1 for the control setting 104 method, A mechanism for converting the combination of service, operation, and user into the method according to FIG. 10 shown in the first embodiment of the present invention is added.

  In order to realize such a service, as shown in FIG. 15, the contents described in the control setting 104 are interpreted, and information to be converted so that the access control data 103 can be accessed by a uniquely determined method is held. A control setting process definition 632 is provided, and means for performing necessary processing on the control setting 104 according to the contents defined in the control setting process definition 632 is provided.

  FIG. 16 shows an example of the control setting process definition 632. In the first record of this example, when an “add” command is transmitted from the business service by the control setting 104, if the user value included in the command is “system administrator”, the authority is This indicates that a user who is allowed to be interpreted as “General Manager of General Affairs Division”. As a result, even if the “system administrator” is not defined in the business service provided by the service providing server 12, the access control server 102 can define it centrally.

  Similarly, in the second record of FIG. 16, in the “user content list acquisition” command, which is an extension of the command for the service to receive a response like the “list” command described above, “E” is displayed for the user and “ Defines the processing when “operational content” is specified. Based on this definition, the access control data management process 624 performs a matching search on the access control data 103 so that the control response 105 includes a list of contents that can be operated by the user “E”.

  By defining such a processing content definition as a control setting processing definition separately from the processing body, it is possible to expand various access control data operations required by the service without creating different processing for each service.

Embodiment 5 FIG.
In the third embodiment, the service providing servers 12 and 13 inside the Web system 1 are specified. However, in a system having a large number of bases, not only the service providing servers 12 and 13 inside the Web system 1, It is also possible to access a service providing server outside the Web system 1.

  FIG. 17 is a schematic configuration diagram of an information providing apparatus according to the fifth embodiment for carrying out the present invention, and FIG. 18 is a functional block diagram of an access control server according to the fifth embodiment for carrying out the present invention.

  FIG. 17 shows an example in which the service providing server 15 is provided from the Web system 1 via the network 2. Here, it is assumed that the network 11 is configured so that the Web system 1 can transmit a request from the access control server 102 to the service providing server 15 in the network 2. When the access control server 102 transfers a request to the service providing server 15, information such as authentication information and access control settings that should not be leaked outside the system is transmitted over the network 2. When a malicious third party existing in the network 2 uses information, the trust of the Web system 1 is greatly impaired.

  For this reason, the access control server 102 has an encryption key data store 633 and communication processing 627 for communication to the outside as shown in FIG. The request from the request transfer process 623 is encrypted by the encrypted communication process 627, and the encrypted request 615 is transmitted to the service providing server 15. The response 616 from the service providing server 15 is also combined by the encrypted communication process 627 and returned to the request transfer process 623. At this time, the service providing server 15 is originally an external URL, but by appropriately describing the URL conversion definition 631, access control can be performed in the same manner as the Web system 1. This encrypted communication process can also be realized by general SSL communication.

  As described above, in the fifth embodiment of the present invention, even when a service providing server exists in a network outside the Web system, access control can be performed centrally in the access control server.

It is a schematic block diagram of the information provision apparatus which shows Embodiment 1 of this invention. It is a functional block diagram of the access control server which shows Embodiment 1 of this invention. It is explanatory drawing which shows the example of the user information data which shows Embodiment 1 of this invention. It is explanatory drawing which shows the example of the service which each server which shows Embodiment 1 of this invention provides. It is explanatory drawing which shows the example of a setting of the access authority which the service provision server which shows Embodiment 1 of this invention requires. It is explanatory drawing which shows the example of a setting of the access authority which the service provision server which shows Embodiment 1 of this invention requires. It is explanatory drawing which shows the example of the content which shows Embodiment 1 of this invention. It is explanatory drawing which shows the example of the content which shows Embodiment 1 of this invention. It is explanatory drawing which shows the example of an expression which pinpoints the content which shows Embodiment 1 of this invention uniquely. It is a block diagram of a load selection interruption | blocking apparatus. It is explanatory drawing which shows the example of the access control server which shows Embodiment 1 of this invention. It is a functional block diagram of the access control server which shows Embodiment 2 of this invention. It is explanatory drawing of the control setting which shows Embodiment 2 of this invention. It is a functional block diagram of the access control server which shows Embodiment 3 of this invention. It is explanatory drawing of the URL conversion definition which shows Embodiment 3 of this invention. It is a functional block diagram of the access control server which shows Embodiment 4 of this invention. It is explanatory drawing of the control setting process definition which shows Embodiment 4 of this invention. It is a schematic block diagram of the information provision apparatus which shows Embodiment 5 of this invention. It is a functional block diagram of the access control server which shows Embodiment 5 of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Web system 2, 11 Network 3 Terminal 12, 13 Service provision server 102 Access control server 103 Access control data 141 Shared content

Claims (5)

A plurality of service providing servers connected to the network;
Shared content connected to at least two service providing servers among the plurality of service providing servers;
Providing a corresponding service based on a request for requesting a service using the shared content transmitted from the terminal via the network and access control data for determining whether or not the shared content is accessible An information providing apparatus comprising: an access control server that determines access to a server.   The information providing apparatus according to claim 1, wherein the access control server includes input / output means for setting access control data from the service providing server.   The information providing apparatus according to claim 1, wherein the access control server includes a unit that performs URL conversion when accessing the service providing server.   The information providing apparatus according to claim 2, wherein the input / output means converts data to be set when setting access control data from the service providing server into a predetermined format.   The access control server comprises means for determining access to a service providing server that is external to the information providing apparatus and connected to the network, and means for encrypting communication of access to the service providing server. The information providing apparatus according to claim 1 or 3.

Images