JP2013125285A - Information processing apparatus and information processing method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To implement an information processing apparatus which is capable of executing proper post-processing even when a session with a user is unexpectedly invalidated.SOLUTION: A first business server 22 includes: a session information holding unit 42 which holds session information between the information processing apparatus and a user terminal 10; an access information holding unit 54 which holds access information showing that access has been accepted from the user terminal 10, as information independent of the session information while updating the access information; a session state estimating unit 66 which autonomously estimates whether a session is invalid or not in accordance with an update state of the access information independently of invalidation of the session due to invalidation of the session information; and a logoff processing unit 58 which executes prescribed post-processing relating the user when it is estimated that the session is invalid.

Description

  The present invention relates to a data processing technique, and more particularly to an information processing apparatus and an information processing method for providing various services in response to access from a user terminal.

  In recent years, securing information security has been regarded as important, and the user may have to complete login to the information processing apparatus on the premise of using various services provided by the information processing apparatus.

JP 2007-48241 A

  After using various services of the information processing apparatus, appropriate post-processing such as logoff may be required. However, the session between the information processing apparatus and the user may become invalid without accepting the logoff request from the user, and it may be difficult to execute appropriate post-processing.

  The present invention has been made in view of these problems, and its main purpose is to realize an information processing apparatus capable of executing appropriate post-processing even when a session with a user is unexpectedly invalidated. To provide technology.

  In order to solve the above problems, an information processing apparatus according to an aspect of the present invention includes a session information holding unit that holds information on a session between the apparatus and a user terminal, and a session when an access is received from the user terminal. Service execution unit that executes the process according to the information of the service, and when the service execution unit executes the process, the access information indicating that the access has been accepted from the user terminal is updated as information independent of the session information. The access information holding unit held by the access information holding unit is independent from the invalidation of the session by invalidating the session information held by the session information holding unit. A session state estimation unit that autonomously estimates whether or not a session is invalid according to the information update status, and a session state estimation If the session is estimated as invalid by parts comprises a post-processing unit for executing a predetermined post about the user, the.

  Another embodiment of the present invention is also an information processing apparatus. The apparatus includes a first processing unit and a second processing unit in a higher layer than the first processing unit. The first processing unit is configured to invalidate session information when a predetermined condition for invalidating a session is satisfied, and a session information holding unit that holds session information between the apparatus and the user terminal. A session disconnection unit for invalidating the session. The second processing unit is a service execution unit that executes processing according to session information when access is received from a user terminal, and information that is independent of session information when the service execution unit executes processing. The access information holding unit that holds the access information indicating that access has been accepted from the user's terminal while being held in the access information holding unit independently of the session being invalidated by the session disconnection unit. A session state estimation unit that autonomously estimates whether or not the session is invalid according to the update status of the access information, and when the session state estimation unit estimates that the session is invalid A post-processing unit to be executed.

  Yet another embodiment of the present invention is an information processing method. This method is a method executed by the information processing apparatus, and when access is accepted from a user terminal, a step of executing processing according to session information between the apparatus and the user terminal, and session information When the corresponding processing is executed, the step of updating the access information indicating that the access has been accepted from the user terminal as information independent of the session information, and the session information is invalidated to invalidate the session. Independently of invalidation of a session, a step of autonomously estimating whether or not the session is invalid according to the update status of the access information, and if the session is estimated to be invalid, Executing the process.

  It should be noted that any combination of the above-described constituent elements and a representation of the present invention converted between an apparatus, a method, a system, a program, a recording medium storing the program, and the like are also effective as an aspect of the present invention.

  According to the present invention, it is possible to realize an information processing apparatus capable of performing appropriate post-processing even when a session with a user is unexpectedly invalidated.

It is a figure which shows the structure of the information processing system of embodiment. It is a block diagram which shows the function structure of the 1st business server of FIG. It is a figure which shows the structure of access information. It is a figure which is a flowchart which shows operation | movement of a 1st business server. It is a figure which is a flowchart which shows operation | movement of a 1st business server.

  FIG. 1 shows a configuration of an information processing system according to an embodiment. 1 are connected via a known communication network such as a LAN, a WAN, or the Internet. The user terminal 10 is a PC in which a web browser is installed, and requests the first business server 22 to execute a business service. And the data of the web page which shows the execution result are acquired from the 1st business server 22, and are displayed on a display.

  The first information system 20 and the second information system 30 are information processing systems that support the execution of different tasks. For example, the first information system 20 may be a sales support system, and the second information system 30 may be a customer management system. As will be described later, the first information system 20 and the second information system 30 perform user authentication independently of each other.

  The first information system 20 includes a first business server 22 and an authentication server 24. The authentication server 24 executes user authentication processing based on the user ID and password received from the user terminal 10. The first business server 22 has the function of a web server, and when the user authentication by the authentication server 24 is successful, the first business server 22 permits the user to log in to the own device. Then, in response to a request from the logged-in user, a web application (hereinafter also referred to as “web AP”) in which a business service is installed is executed.

  Also, the first business server 22 transmits a login request specifying a user ID and password to the second business server 32, thereby executing a user login process for the second business server 32. After login, the first business server 22 appropriately accesses the second business server 32 when executing the web AP, and transmits / receives data related to the user to / from the second business server 32, for example.

  The second information system 30 includes a second business server 32. The second business server 32 executes user authentication processing based on the user ID and password transmitted from the first business server 22. As a modification, the execution subject of the user authentication process in the second information system 30 may be an authentication server different from the second business server 32 as in the first information system 20. When the second business server 32 succeeds in user authentication, the second business server 32 permits the user to log in to the own device and sets information related to the login user session. For example, a session object for the logged-in user is set, and the session object is kept in a valid state until a logoff request is received from the first business server 22.

  The second business server 32 holds information related to the user of the user terminal 10 (hereinafter also referred to as “user related information”). And after permitting the user's login to the own apparatus, while the information regarding the login user session is valid, the user related information is updated according to the update information received from the first business server 22. In addition, user-related information is provided to the first business server 22 in response to a request from the first business server 22.

  When the web AP deployed on the web server in the first business server 22 receives a logoff request from the user terminal 10, the web AP executes a user logoff process in the first business server 22 and sends the user logoff request to the second business server. 32 is notified. The second business server 32 executes a user logoff process in the second business server 32 in accordance with the logoff request. For example, information related to the login user session is deleted, and system resources reserved for the login user are released.

  However, a session between the user terminal 10 and the first business server 22 is usually performed when the web browser is terminated without performing a logoff operation on the user terminal 10 (when the close button of the web browser window is pressed). Problems may arise if the process is terminated without following the above procedure. The session invalidation process between the user terminal 10 and the first business server 22 is executed by the web server, and the fact that the session is invalidated is detected by the application on the web server at the time of invalidation. I can't. Therefore, a logoff request is not made from the first business server 22 to the second business server 32, and the user logoff process is not performed in the second business server 32. As a result, in the second business server 32, the system resources secured with the user login, such as the user session information, remain without being released. Until now, it has been necessary for the administrator of the second business server 32 to manually deal with system resources such as user session information remaining in the second business server 32 by checking whether each resource can be released.

  In order to solve this problem, the first business server 22 according to the embodiment includes means for independently estimating whether a user session is valid or invalid, in addition to the session management function by the web server. In other words, a mechanism is provided in which an upper layer application detects the fact of session disconnection by a lower layer web server. Then, the first business server 22 sends a logoff request of the user to the second business server 32 for a user whose session is estimated to be invalid, even if an explicit logoff request is not received from the user. Send autonomously. Thereby, even when the session between the user terminal 10 and the first business server 22 is terminated unexpectedly, the same post-processing (for example, log-off processing) as when a log-off request is received from the user terminal 10 can be executed. .

  FIG. 2 is a block diagram showing a functional configuration of the first business server 22 of FIG. The first business server 22 includes a web server unit 40 that provides the functions of a web server, and an application unit 50 that corresponds to a web AP deployed on the web server unit 40. Each block shown in the block diagram of the present specification can be realized in terms of hardware by an element such as a CPU of a computer or a mechanical device, and in terms of software, it can be realized by a computer program or the like. The functional block realized by those cooperation is drawn. Therefore, those skilled in the art will understand that these functional blocks can be realized in various forms by a combination of hardware and software.

  For example, each functional block in FIG. 2 may be stored in a recording medium as a computer program and installed in the storage of the first business server 22. And when the said program is started, the program module corresponding to each functional block may be read to the main memory of the 1st business server 22, and may be performed by CPU.

  The web server unit 40 includes a session information holding unit 42, a request receiving unit 44, an information providing unit 46, and a session cutting unit 48. The session information holding unit 42 holds information related to a series of sessions (hereinafter also referred to as “session information”) from when the user terminal 10 logs into the first business server 22 until the user logs off. It can be said that the session information is a session object in which an area is secured and stored for each session between the user terminal 10 and the first business server 22 in the memory of the first business server 22. The session information stores information to be continuously held during a series of sessions between the user terminal 10 and the first business server 22 using the session ID as a key. Hereinafter, the case where session information exists is also expressed as “session established”, and the case where session information is deleted is also expressed as “session disconnected”.

  The request reception unit 44 receives an HTTP request transmitted from the user terminal 10 and passes the request to the application unit 50. In the case of a user who has established a session with the first business server 22 in advance, the HTTP request from the user terminal 10 includes a session ID. The information providing unit 46 transmits an HTTP response including the web page data set by the application unit 50 to the user terminal 10 in response to the HTTP request.

  For each session between the first business server 22 and the user terminal 10, the session disconnection unit 48 monitors the access status from the user terminal 10 to the present apparatus, for example, the date and time when an HTTP request is received from the user terminal 10. Then, for a session in which access from the user terminal 10 is not accepted for a predetermined session timeout time or more, the session is invalidated. Specifically, when an HTTP request specifying a specific session ID is not accepted for a session timeout period or longer, the session information associated with the session ID is invalid. For example, session information may be deleted, and a predetermined invalid flag may be added to the session information.

  The application unit 50 includes a user information holding unit 52, an access information holding unit 54, a login processing unit 56, a logoff processing unit 58, a service execution unit 60, an access information updating unit 62, and a session information updating unit 64. The session state estimation unit 66 is included.

  The user information holding unit 52 includes a user account necessary for logging in to the apparatus (hereinafter also referred to as “first account”) and a user account necessary for logging in to the second business server 32 (hereinafter referred to as “the first account”). Are also stored in association with each other. Each of these accounts includes a user ID and a password.

  The access information holding unit 54 holds information related to access to the first business server 22 by the user terminal 10 (hereinafter also referred to as “access information”). The access information is information independent of the session information held in the session information holding unit 42. While the session information of the session information holding unit 42 is deleted as the session timeout time elapses, the access information is held regardless of whether or not the session information is deleted.

  FIG. 3 shows the structure of the access information. The access information includes a session information field, a login information field, and an access time field. In the session information field, session information including a session ID, that is, a copy of the session information stored in the session information holding unit 42 is stored. The login information field stores login information to the second business server 32, that is, a user ID and password as a second account. In the access time field, the date and time when the user terminal 10 accesses the first business server 22, here, the latest date and time when access to the session information is referenced or updated according to the HTTP request from the user terminal 10 is stored. Is done.

  Returning to FIG. 2, the login processing unit 56 receives the login request transmitted from the user terminal 10 via the request receiving unit 44. In this login request, the first account is designated. The login processing unit 56 executes a user login process based on the login request.

  Specifically, the login processing unit 56 transmits the first account designated by the login request to the authentication server 24 and receives the result of user authentication from the authentication server 24. If the user authentication by the authentication server 24 is successful, the login processing unit 56 permits the user to log in to the first business server 22. At the same time, the user information holding unit 52 obtains a second account associated with the first account designated by the login request. The login processing unit 56 transmits a login request designating the second account to the second business server 32, and receives a user authentication result from the second business server 32.

  The logoff processing unit 58 receives a logoff request transmitted from the user terminal 10 via the request receiving unit 44. In this logoff request, the first account is designated. When the logoff processing unit 58 receives the logoff request, the logoff processing unit 58 executes a user logoff process from the first business server 22. At the same time, the user information holding unit 52 obtains the second account associated with the first account designated by the logoff request. The log-off processing unit 58 transmits a log-off request designating the second account to the second business server 32, thereby causing the second business server 32 to execute the user log-off process.

  The service execution unit 60 receives a service request transmitted from the user terminal 10 via the request reception unit 44. This service request requests provision of various services other than login and logoff. The service execution unit 60 executes a process defined by the web application corresponding to the service specified by the service request in accordance with the session information associated with the session ID specified by the service request. In addition, the service execution unit 60 updates the session information as appropriate when executing the process defined by the web application. For example, data to be taken over for processing when the next service request is received from the user terminal 10 is stored in the session information.

  The session information update unit 64 sets new session information between the first business server 22 and the user terminal 10 when a user login to the first business server 22 is permitted in response to a login request from the user terminal 10. . Specifically, a unique session ID is assigned, and session information including the session ID is stored in both the user information holding unit 52 and the session information field of the access information holding unit 54.

  Further, when the session information is updated when the service execution unit 60 executes the web application, the session information update unit 64 stores the update data in both the user information holding unit 52 and the session information field of the access information holding unit 54. . As a modification, the session information update unit 64 first sets the data in the session information field of the access information holding unit 54, and then copies the data in the session information field of the access information holding unit 54 to the session information holding unit 42. May be.

  When the user authentication by the second business server 32 is successful as a result of the login request to the second business server 32 by the login processing unit 56, the access information update unit 62 assigns the second account specified by the login request to the user session. It is stored in the access information holding unit 54 in association with the ID.

  In addition, when access to session information is performed, the access information update unit 62 receives a notification to that effect from the access subject, and records the latest access status in the access time field of the access information holding unit 54. Specifically, every time the session information reference process by the service execution unit 60 or the session information update process by the session information update unit 64 is performed, the access information holding unit 54 including the session ID designated by those accesses. (In other words, the record in the access information holding unit 54 corresponding to the session information to be accessed) is specified, and the data in the access time field of the record is updated with the current time.

  The session state estimation unit 66 estimates the session state between the user terminal 10 and the first business server 22 every time it detects that a predetermined interval such as 30 minutes has elapsed since the previous estimation process was completed. Repeat the process. The session state estimation unit 66 deletes the session information by the session disconnection unit 48, so that the session between the apparatus and the user terminal 10 is invalidated, and the service from the user terminal 10 Without accepting access such as a provision request, it is independently estimated whether or not the user's session has become invalid according to the access information held in the access information holding unit 54. In other words, without constantly monitoring that the web server unit 40 invalidates the session information, without receiving a notification from the web server unit 40, and without access from the user terminal 10. Confirm the validity of the session information independently.

  Specifically, the session state estimation unit 66 sets a record in the access information holding unit 54 in which the access time field has not been updated more than the session timeout time, and a record in which the session is already invalidated (hereinafter referred to as “session”). Also called “invalid record”. For example, when the current time is 19:00 and the session timeout time is 30 minutes, a record whose access time field value is before 18:30 is specified as a session invalid record.

  When the session invalidity record is specified by the session state estimation unit 66, the logoff processing unit 58 transmits a logoff request specifying the second account recorded in the record to the second business server 32. As a result, for the user whose session is invalidated, the user's logoff process in the second business server 32 is executed afterwards even if an explicit logoff request is not received from the user. It goes without saying that the user logoff process in the first business server 22 may also be executed. The access information update unit 62 deletes the session invalid record from the access information holding unit 54 after the logoff processing unit 58 executes the logoff process.

The operation of the first business server 22 having the above configuration will be described below.
FIG. 4 is a flowchart showing the operation of the first business server 22. When the login processing unit 56 accepts a login request from the user terminal 10 (Y in S10), the login processing unit 56 executes a user login process for the second business server 32 in addition to the user login process in the own apparatus. (S12). If the login process for the second business server 32 is successful, the session information update unit 64 stores the new session information in the user information holding unit 52 and the access information holding unit 54 (S14). At the same time, the access information update unit 62 stores the user's login account for the second business server 32 in the access information holding unit 54, and stores the current time in the access information holding unit 54 as the access time (S16). Note that the processing of S16 may be executed before the processing of S14, and after the access information is stored in the access information holding unit 54, the session information therein may be copied to the session information holding unit 42. If the login request from the user terminal 10 is not accepted (N in S10), S12 to S16 are skipped.

  When the service execution unit 60 receives a service provision request from the user terminal 10 (Y in S18), the service execution unit 60 refers to the session information holding unit 42, and the validity of the session information specified by the session ID specified in the request Confirm. If the session information having the specified session ID as a key does not exist in the session information holding unit 42, in other words, if the user's session information has already been invalidated (N in S20), the login processing unit 56 The login screen data including the user ID and password input fields is provided to the user terminal 10 for display (S22). Thereafter, the process returns to S10.

  If the user session information is valid (Y in S20), the access information update unit 62 updates the access time of the access information specified by the session ID (S24), and the service execution unit 60 executes the web application according to the session information. Is executed (S26). As the web application is executed, the session information update unit 64 sequentially updates the session information (S28). When the session information is updated, the access information update unit 62 sequentially updates the access time of the access information (S30). The service execution unit 60 provides web page data indicating the execution result of the web application to the user terminal 10 via the information providing unit 46 (S32). If no service provision request is received from the user terminal 10 (N in S18), S20 to S32 are skipped.

  FIG. 5 is also a flowchart showing the operation of the first business server 22. This figure shows the operation following FIG. The session disconnection unit 48 monitors the access status from the user terminal 10 and monitors whether or not a session timeout has occurred between the user terminal 10 and the first business server 22. When the session disconnection unit 48 detects the occurrence of a session timeout (Y in S40), the session disconnection unit 48 invalidates the session between the user terminal 10 and the first business server 22 by deleting the session information of the user who has experienced the session timeout. (S42). If occurrence of a session timeout is not detected (N in S40), S42 is skipped.

  The session state estimation unit 66 detects that the inspection timing has been reached when a predetermined period has elapsed since the previous estimation process. When it is detected that the inspection timing has been reached (Y in S44), the session state estimation unit 66 confirms the access time field of each record in the access information holding unit 54. If there is a record whose access time has not been updated for the session timeout time or longer (Y in S46), the session state estimation unit 66 identifies the record as a session invalid record. The session state estimation unit 66 executes the user logoff process from the second business server 32 using the second account recorded in the session invalid record (S48), and the access information update unit 62 deletes the session invalid record. (S50). If there is no record in the access information holding unit 54 whose access time has not been updated for the session timeout period or longer (N in S46), S48 and S50 are skipped, and if the inspection timing is not detected (N in S44), S46 Skip the rest.

  According to the first business server 22 of the present embodiment, if a session is unexpectedly invalidated after accepting a logoff request from the user terminal 10 after establishing a session with the user terminal 10, the second business The user logoff process for the server 32 is executed autonomously. As a result, the second business server 32 retains a predetermined resource secured with the login of the user, and a resource that should be originally released when the session between the user terminal 10 and the first business server 22 is invalidated. It can be released automatically without continuing. Further, the burden on the administrator of the second business server 32 for releasing resources in the second business server 32 can be reduced.

  The present invention has been described based on the embodiments. This embodiment is an exemplification, and it will be understood by those skilled in the art that various modifications can be made to combinations of the respective constituent elements and processing processes, and such modifications are also within the scope of the present invention. is there.

  In the above-described embodiment, an example is shown in which the user log-off process for the second business server 32 is executed as post-processing related to the user whose session is estimated to be invalidated by the session state estimation unit 66. However, post-processing related to the user is not limited to log-off processing. For example, release of system resources reserved for the logged-in user in the first business server 22, cancellation of ongoing processing, notification of an unexpected session disconnection to a predetermined management device, etc. are executed as post-processing May be. That is, various processes to be executed when an explicit logoff request is received from the user terminal 10 and various processes to be executed when a session with the user terminal 10 is discarded (so-called abnormal process or recovery process). ) May be executed as post-processing, and the first business server 22 may include a post-processing unit that executes these post-processing. Also in this modification, it is possible to realize an information processing apparatus capable of executing appropriate post-processing even when a session with a user is unexpectedly invalidated.

  It should also be understood by those skilled in the art that the functions to be fulfilled by the constituent elements recited in the claims are realized by the individual constituent elements shown in the embodiments and the modified examples or by their linkage.

  10 user terminals, 22 first business server, 32 second business server, 42 session information holding unit, 48 session disconnecting unit, 54 access information holding unit, 56 login processing unit, 58 logoff processing unit, 60 service execution unit, 62 access An information update unit, a 64 session information update unit, and a 66 session state estimation unit.

Claims (4)

A session information holding unit that holds session information between the apparatus and the user terminal;
When receiving access from the user's terminal, a service execution unit that executes processing according to the session information;
When the service execution unit executes processing, as an information independent of the session information, an access information holding unit that holds update information indicating that access has been accepted from the user terminal;
Independently of invalidating the session by invalidating the session information held in the session information holding unit, according to the update status of the access information held in the access information holding unit A session state estimation unit that autonomously estimates whether or not the session is invalid;
When the session state estimation unit estimates that the session is invalid, a post-processing unit that executes predetermined post-processing related to the user;
An information processing apparatus comprising: In response to a login request from the user terminal, further comprising a login processing unit for executing a user login process for an external device involved in providing services to the user
The post-processing unit includes a log-off processing unit that executes a user log-off process for the external device in response to a log-off request from the user terminal,
The logoff processing unit autonomously executes a user logoff process for the external device even when there is no logoff request from the user terminal when the session is estimated to be invalid. The information processing apparatus according to 1. A first processing unit, a second processing unit of a layer higher than the first processing unit,
With
The first processing unit includes:
A session information holding unit that holds session information between the apparatus and the user terminal;
A session disconnecting unit that invalidates the session by invalidating information on the session when a predetermined condition for invalidating the session is satisfied, and
The second processing unit includes:
When receiving access from the user's terminal, a service execution unit that executes processing according to the session information;
When the service execution unit executes processing, as an information independent of the session information, an access information holding unit that holds update information indicating that access has been accepted from the user terminal;
Independently of the invalidation of the session by the session disconnection unit, it automatically estimates whether the session is invalid or not according to the update status of the access information held in the access information holding unit. A session state estimator;
When the session state estimation unit estimates that the session is invalid, a post-processing unit that executes predetermined post-processing related to the user;
An information processing apparatus comprising: A method executed by an information processing apparatus,
When receiving access from a user terminal, executing a process according to information on a session between the apparatus and the user terminal;
When processing according to the session information is executed, updating the access information indicating that access has been accepted from the user terminal as information independent of the session information;
Independently of invalidating the session by invalidating the session information, independently estimating whether the session is invalid or not according to an update status of the access information; ,
If the session is estimated to be invalid, performing predetermined post-processing for the user;
An information processing method comprising:

Images