JP3662734B2 - Web page access control apparatus and method - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a Web page access control apparatus and method suitable for use in controlling access to a Web page from a Web client.
[0002]
[Prior art]
Conventionally, user authentication in the Web (WWW; World Wide Web) has been performed in units of Web servers or directories in Web servers. This is because the conventional Web server program executed on the Web server basically sends the source file of the Web page as it is to the Web client. The source file sent from the Web server to the Web client is usually a text file described in, for example, an HTML format (hypertext markup language format).
[0003]
Therefore, conventionally, for example, it has been difficult to set access permission / denial for each user for each Web page. In this specification, information corresponding to one source file (HTML file) on the Web is called one Web page or one Web page information.
[0004]
An example of a conventional user authentication method on the Web will be described with reference to FIG. In FIG. 6, a Web client 100 is connected to a Web server 200 via the Internet, a LAN (local area network), or the like. Here, consider a case where the user makes a predetermined input to the Web browser in the Web client 100 and accesses the Web page indicated by the HTML file 201 specified by the URL (Uniform Resource Locator) managed by the Web server 200. . However, in this case, it is assumed that the directory in which the HTML file 201 is stored is set to permit access to only certain users.
[0005]
When a display request designating the HTML file 201 is sent from the Web client 100 to the Web server 200 {(1)}, the Web server 200 notifies the Web client 100 that authentication is necessary. To do. The Web client 100 that has received the notification displays a message prompting the user to input a user ID (user identification symbol) and a password. When the user inputs the user ID and password, the input information is sent to the Web server 200. If the access right for the directory in which the HTML file 201 is stored is defined in the access control definition file 202, the Web server 200 confirms the contents of the access control definition file 202 {{(2) read request and read }, The HTML file 201 is read only when the user is permitted to access the directory {read request and read of (3)}. Then, the read HTML file 201 is transmitted from the Web server 200 to the Web client 100 and displayed on the Web client 100 {display (4)}.
[0006]
In the conventional authentication method as shown in FIG. 6, the access right is set for each directory. In general, each directory stores a plurality of HTML files. Therefore, it is difficult to set the access right for each Web page for each user and to set the access right for each display content of each Web page (for each part of the page).
[0007]
For example, when the HTML file 201 includes three contents of display contents A, B, and C, the user A is permitted to display only the display contents A and C, and the user B is allowed to display only the display contents B and C. It is not possible to make a setting such as permitting access by simply changing the setting of the access right for the directory in which the HTML file 201 is stored. In such a case, for example, an HTML file showing only display contents A and C and an HTML file showing only display contents B and C are individually created, and each file is stored in a different directory. Conceivable. However, in such a case, the storage location of multiple files is taken into account when setting links for how to set links from other web pages to individually created files, or when setting or changing access rights. Since processing is required, there arises a problem that access rights cannot be easily managed.
[0008]
[Problems to be solved by the invention]
As described above, in the conventional authentication method on the Web, it is difficult to set access permission / non-permission for each Web page and to set an access right for each Web page content. . In addition, there is a problem that it is not possible to easily manage the set access right for each Web page or for each user.
[0009]
The present invention has been made under such a background, and enables access to a Web page that allows user authentication to be performed on a Web page basis and allows the displayed content to be changed by the accessing user. It is an object to provide a control device and method. Another object of the present invention is to provide a Web page access control device that makes it easy to manage the settings and changes.
[0010]
[Means for Solving the Problems]
  In order to solve the above problems, the invention of claim 1 is an apparatus that provides Web page information indicated in hypertext format for access from a Web client, and a user who operates the Web client that accesses the Web page Authentication means for confirming whether the login information is correct, creation means for creating a hypertext file indicating the accessed web page based on the login information confirmed by the authentication means, and hypertext created by the creation means Sending means for sending a file to the Web clientAnd the creation means has an addition means for adding access information to a Web page that can change the creation contents of the hypertext file by the creation means based on the login information confirmed by the authentication means.This is a web page access control device characterized by the above. Further, in the invention according to claim 2, the information indicating the reference destination included in the hypertext file indicating the accessed Web page based on the login information confirmed by the authentication means is stored in It has a selection means for selecting contents included in the hypertext file so that it can be either one with or without address information..
[0011]
According to the above configuration, since the display content of the Web page is determined based on the authentication result of the user authentication performed for each Web page, a desired access right for each user and for each display content in the Web page. Can be set. In addition, by selecting, as reference destination (link) information included in the Web page, information with address information and information without it based on the authentication result, for example, a link for a user without access right. It is possible to perform restrictions such as displaying only the heading corresponding to the destination and not being able to follow the link destination. In addition, an administrator authority capable of managing setting / changing of access right to a predetermined Web page by sending access information to a Web page that can change the creation content of the Web page to a specific user Can manage the access right of the corresponding Web page from any Web client.
[0012]
  Claims3The described invention includes an access control setting file that sets one or a plurality of levels of access rights for one or a plurality of users, a content control definition file that defines the correspondence between the contents of each Web page and the access rights, , One or more storage means for storing a display content definition file indicating the display content of each Web page, a script file describing a script to be executed, and access to a predetermined Web page from a Web client The authentication means for confirming whether the login information of the user operating the Web client is correct and the script described in the script file corresponding to the accessed Web page are confirmed by the authentication means. Based on login information and the contents of the access control settings file The access right determining means for determining whether or not the user has an access right to the web page, and when the access right determining means determines that the user has an access right to the web page, Based on the content of the content control definition file, according to the transmission information determination means for determining the content of the information included in the Web page to be transmitted, the determination result by the access right determination means and the determination by the transmission information determination means, the Web page Web page information creation means for creating a web page information file indicating a web page to be displayed on the web client with reference to a display content definition file corresponding to the web page information file created by the web page information creation means Sending means for sending to the Web client;Administrator authority determining means for determining whether or not the user has administrator authority capable of changing the contents of the access control setting file and the content control definition file based on the login information confirmed by the authentication means And the Web page information creation unit displays the display content definition file corresponding to the Web page on the Web client according to the determination result by the access right determination unit and the determination by the transmission information determination unit. When creating a Web page information file to be added, access information for accessing a Web page in which the contents of the access control setting file and the content control definition file can be changed according to the determination result by the administrator authority determining unit is added. It is characterized byWeb page access control device.
[0013]
  Claims4The claimed invention is claimed from any specified hypertext file.3A method for creating an access control setting file, a content control definition file, a display content definition file, and a script file stored in the storage means of the Web page access control device describedPage registration meansInformation about at least hyperlinks contained in the specified hypertext fileBy parsingCorrespondence between extracted information about hyperlinks and predetermined access rightsShowingContent control definition fileCreate and register in the storage meansContent control definition file creation process,Page registration meansFrom the hypertext file,Page registration meansCreate a display content definition file by replacing at least the description part related to hyperlink information extracted in the content control definition file creation processAnd register in the storage meansDisplay content definition file creation process,Page registration meansCreate an access control configuration file using default dataAnd register in the storage meansAccess control setting file creation process,Page registration meansCreate a script file corresponding to each file created in the content control definition file creation process, display content definition file creation process, and access control setting file creation processAnd register in the storage meansA method for creating a file used in an access control device for a Web page, characterized by comprising a script file creation process. According to this, each file can be automatically created from any one HTML file.
[0014]
  Claims5The described invention is a Web server that provides Web page information indicated in a hypertext format for access from a Web client.Authentication meansAn authentication process for confirming whether the login information of the user operating the Web client is correct or not;Creation meansA creation process for creating a hypertext file indicating the accessed web page based on the login information confirmed in the authentication process;Sending meansA sending process for sending the hypertext file created in the creating process to the Web client.The creation means has an addition process of adding access information to a Web page that can change the creation contents of the hypertext file based on the login information confirmed by the authentication process.This is a Web page access control method as a feature.
[0015]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram for explaining an embodiment of a Web page access control apparatus according to the present invention. In this figure, parts corresponding to the conventional configuration shown in FIG. . In FIG. 1, a Web server 300 corresponds to the Web page access control apparatus of the present invention. One of the main features of the present invention different from the conventional one is that each Web page is composed of a script file, an access control setting file, a content control definition file, and a display content definition file. Hereinafter, Web page access control according to the present invention in the Web server 300 shown in FIG. 1 will be described.
[0016]
When a user accesses a Web page with a URL managed by the Web server 300 from the Web client 100 connected to the Web server 300 via the Internet or a LAN {display request of (1)}, the Web server 300 is connected to the Web server 300. The script file 301 corresponding to the accessed Web page (URL) is called by the Web server program executed in {{Display request of (2)}. The script file 301 is a file describing each process that can be interpreted and executed by the Web server program executed on the Web server 300. In this case, a plurality of script files 301 are prepared corresponding to each Web page.
[0017]
In the present embodiment, if the access right is set for each server in the Web server 300, the Web server 300 displays a Web page when the Web server program makes a display request to the script file 301. Outputs a message requesting password input to the requesting user. Then, the input user ID (user name) and password are compared with the authentication information stored in the Web server 300 to confirm whether or not they match. If the input information is incorrect, a message rejecting the display request (1) is output to the Web client 100. Note that the authentication process for each server in this embodiment is the same as the conventional one. Also, the authentication setting is not limited to the server unit, but can be performed for the directory unit. Further, in the Web page access control apparatus of the present invention, it is possible to omit an authentication method in units of servers or directories by including an authentication process in the script file 301 as described later.
[0018]
If the input user ID and password are valid, the server program accesses the access control setting file 302 corresponding to the accessed Web page according to the description of the script file 301 {read request and read of (3) }. Then, based on the description of the access control setting file 302, it is confirmed whether or not the user ID confirmed in the authentication process has the right to view the page for which the display request has been received.
[0019]
The access control setting file 302 is a file prepared for each Web page, and is a file describing a user ID or group ID having (or not having) an access right to the Web page. Further, the access control setting file 302 can define the level of access right possessed by each user or each group ID when it is necessary to set an access level in the content unit for the Web page. Yes. The group ID is composed of a plurality of user IDs or group IDs, and the relationship between the group ID and the user ID or group ID included in the group ID is stored in another predetermined file in the Web server 300. It shall be registered.
[0020]
As a result of access to the access control setting file 302, if the entire Web page is not permitted to be displayed for the confirmed user ID, an HTML file describing a message to deny access is sent to the Web client 100. The Then, the message is displayed on the Web client 100 {display (4a)}. On the other hand, when at least a part of the Web page is permitted to be displayed for the confirmed user ID, the Web server program accesses the content control definition file 303 according to the description of the script file 301 {(4b ) Read request and lead}.
[0021]
The content control definition file 303 is a file prepared for each Web page, and defines information for specifying display content whose access right is restricted, an ID accessible to the content, or a level of access right. It consists of information. In addition, when the access right is restricted for the hyperlink included in the web page, information for specifying each hyperlink and setting information for the access right for each hyperlink are described. It has become. For example, an ID that allows display of both heading information (text information indicating link destinations, image information, etc.) and link destination address information included in the hyperlinks in association with information specifying each hyperlink Alternatively, an access right level, an ID that is permitted to be displayed only for the heading information, an access right level, and the like are defined in the content control definition file 303. Here, on the other hand, the display of both the heading information and the address information of the link destination is permitted, which means that both the reference and access of the hyperlink destination are permitted for the user, When only heading information is permitted, it means that the heading information can only be viewed and the corresponding link destination cannot be accessed.
[0022]
When the Web server program reads the content of the content control definition file 303 and confirms the content of the access right that is included in the Web page and the information about the access right, the Web server program then follows the description in the script file 301. Access the display content definition file 304 {read request and read of (5)}. The display content definition file 304 is a file prepared for each Web page, and includes HTML text data including all information corresponding to all access right levels in the corresponding Web page, and the access right. It consists of additional data necessary to edit the text data. These data can be configured, for example, as a text file in which tags (specific commands) that are interpreted only when the script file 301 is executed are inserted into HTML text data corresponding to the entire display content of the Web page. The information indicated by the tag to be inserted includes, for example, information indicating the start and end positions of the part of the access right defined in the content control definition file 303 and the access right for the part. This is information indicating the correspondence relationship of data in the content control definition file 303 to be defined and information for identifying each hyperlink defined in the content control definition file 303.
[0023]
Next, according to the description of the script file 301, the Web server program generates an HTML file to be sent to the Web client 100 based on the contents of each file 302, 303, 304 so that only the contents to which the user has access rights are included. create. For example, if display of a part of a page is not permitted for the user, an HTML file that does not include text information indicating the part is created, and, for example, a hyper page to another page included in the page is created. If the link is not permitted for the user, the HTML file is created so as not to include information on the hyperlink (heading and address information or address information). Then, the Web server program sends the created HTML file to the Web client 100 and is displayed on the Web client 100 {display (6) and display (7)}.
[0024]
As described above, the Web client 100 displays a Web page having display contents corresponding to each user's access right. When the Web page indicated by the HTML file sent to the Web client 100 includes image information and audio information, an image and audio file corresponding to each information is stored in a predetermined directory in the Web server 300 as in the past. Stored in
[0025]
According to the above configuration and procedure, in this embodiment, access control for a predetermined Web page is performed for each user and for each content. In the embodiment described above, the access right for each Web page is controlled using the authentication information confirmed in the conventional authentication process in units of servers or directories. Therefore, the user ID once authenticated as valid is valid after moving to another page. However, in an environment where the same Web client is used by a plurality of users, it is desirable to discard authentication contents when access is lost for a long time, for example, when the user is away from the desk. In this case, each script file (301) provided corresponding to each Web page includes a process of requesting the user ID and password again when a predetermined time has elapsed since the previous authentication. You can do it.
[0026]
In addition, the setting / changing of the contents such as the access right set in the access control setting file 302 and the content control definition setting file 303 described above is applicable only when accessing from the Web client 100 with a user ID having administrator authority. Information necessary for setting / changing a Web page can be included in the Web page information and displayed on the Web client 100 side. For example, link information to a Web page that can be set / changed within the same Web page is added as a hyperlink only to a user with administrator authority, or the address of the Web page for setting / change Information for displaying information and a button for instructing display of the page can be added. In this way, a plurality of users having administrator authority can set / change access rights for an arbitrary Web page from an arbitrary Web client.
[0027]
Next, details of each process in the Web server 300 described with reference to FIG. 1 will be described with reference to the flowchart shown in FIG. The flowchart shown in FIG. 2 shows the flow of each process executed by the script file 301 called when the user accesses the Web page of the URL managed by the Web server 300 from the Web client 100 shown in FIG. is there. The Web server program executed by the Web server 300 confirms whether the accessed user has logged in according to the description of the called script file 301 (step S301). If the user has not logged in (if the user ID and password are not authenticated) (the determination result in step S301 is “no”), the Web server program requests the Web client 100 to input the user ID and password, and inputs them. The obtained user ID and password are compared with authentication information stored in the Web server 300 (step S302). If the comparison result is correct, the process proceeds to the next step (step S304), and if it is not correct, the authentication information is repeatedly confirmed (step S302). On the other hand, if the result of determination in step S301 is that the user has already logged in, it is determined whether the time since login is within a predetermined time limit (step S303). On the other hand, if the time after login exceeds the time limit in step S303, the authentication process is performed again (step S302). On the other hand, if the time is less than the time limit, the user ID confirmed at the time of login is determined. It is confirmed whether or not has the access right to the Web page (S304).
[0028]
In the above processing, every time each script file 301 is called by the description of each script file 301, that is, every time a different web page is accessed, the user has logged in by the processing as in step S301. A determination is made as to whether or not there was. Therefore, in the example shown in FIG. 2, the authentication process in units of Web servers or directories described with reference to FIG. 1 can be omitted. In addition, since the determination process in step S303 places a certain limit on the time after login, for example, in an environment where multiple users operate the same Web client 100, the user remains away while logged in. Even in such a case, it is possible to avoid that at least another user keeps accessing for a long time using the authentication information of the other person as it is.
[0029]
If the user is logged in and the time since login is within a predetermined time limit, in step S304, based on the content of the access control setting file 303 corresponding to the Web page, the user ID or For the group ID to which the user ID belongs, it is determined whether or not access to at least a part of the display contents of the Web page is permitted. If it is determined in step S304 that there is an access right, a display content setting subroutine is called in step S305, where display content is set according to the level of access right. On the other hand, if it is determined that there is no access right, a setting is made to display that the access to the Web page is denied (step S306).
[0030]
FIG. 3 is a flowchart showing each process of the display content setting subroutine called in step S305 of FIG. In the display content setting subroutine, first, referring to the content control definition file 303 corresponding to the Web page, when the access right is set for each display content in the Web page, each setting is made. It is determined whether display or non-display setting processing corresponding to the access right has been completed for all of the portions (step S3051). If there are settings in display content units and the setting for display or non-display has not been completed for all of them, the process proceeds to step S3052, and each part is referenced with reference to the content control definition file 303. It is determined whether the user has access rights. Here, if the user has access right, a setting is made to display the part (step S3053). If the user has no access right, the setting is made not to display the part. Perform (step S3054). Then, the process returns to step S3051, and it is determined again whether there is a part that has not been set. Note that, in the example shown in this figure, determination about the hyperlink access right is not performed in step S3051.
[0031]
When the process of steps S3051 to S3054 is repeatedly executed to complete the display or non-display setting for all the parts, the process proceeds to step S3055 to display or hide each link destination included in the Web page. Settings are made. If it is determined in step S3055 that the display / non-display settings for all of the link destinations included in the Web page have not been completed, the hyperlinks defined in the content control definition file 303 are With reference to the information, it is sequentially determined for each hyperlink whether the user has the right to display the link (step S3056). If the link can be displayed, the content control definition file 303 corresponding to the Web page is referred to again to determine whether the user has the access right to the link destination (that is, the link destination address). Whether or not display of the information is permitted) is determined (step S3057).
[0032]
If it is determined in step S3057 that there is an access right to the link destination, a setting is made to display the link as a hyperlink using a heading and a link destination address (step S3058). If it is determined that there is no access right, a setting is made to display only the heading for the link (step S3059). On the other hand, if it is determined in step S3056 that the user does not have the right to display information related to the link, a setting is made not to display any information including the headline for the link. (Hyperlink hidden setting in step S3060). When the display setting by the processing of steps S3055 to S3060 is completed for all link destinations included in the Web page, it is determined in step S3055 that there is no link destination that has not been set, and the display content setting subroutine shown in FIG. The process ends.
[0033]
In the example shown in FIG. 3, it is assumed that the determination regarding the link destination access right of the hyperlink in step S3057 is performed with reference to the content control definition file 303 corresponding to the Web page (link source Web page). However, for example, it is possible to determine whether or not there is an access right by referring to the content control definition file corresponding to the linked Web page. In this case, setting information about the presence / absence of the link destination access right (whether address information can be referenced) is omitted from each content control definition file.
[0034]
When the processing of the display content setting subroutine shown in FIG. 3 is completed, in the flow shown in FIG. 2, in step S307, the administrator ID registered in advance so that the user ID can set / change access rights, etc. It is determined whether the corresponding ID is satisfied. The registration of the ID having the administrator authority may be set in the access control setting file 302 corresponding to the Web page, or separately set in another file in the Web server 300. Also good. If it is determined in step S307 that the user ID is an ID having administrator authority, a setting is made to display an administrator switch on the Web page (step S308). An administrator switch has a headline indicating an administrator in the Web client 100, and when the user performs an operation such as moving the mouse cursor over the switch and clicking a button, the administrator switch of the Web page is displayed. This is graphic information that can refer to other Web pages that can set / change access rights. Therefore, when displaying the administrator switch, at least information specifying the display switch and address information corresponding to the management Web page are sent to the Web client 100.
[0035]
When the processing of step S307 or the processing of step S307 and step S308 is completed, the process proceeds to step S309, and the display content setting result in step S305 (setting content of steps S3053 to S3054 and S3058 to S3060 in FIG. 3) or step S306. An HTML file to be sent to the Web client 100 is created with reference to the display content definition file 304 corresponding to the Web page based on the access rejection display setting content in step S308 and the administrator switch display setting result in step S308. (Step S309). When the HTML file is created in step S 309, the web server program returns from the execution of the script file 301 and sends the created HTML file to the web client 100. The contents of the Web page accessed by the above processes are displayed according to the display contents corresponding to the user's access right to the Web page.
[0036]
Next, with reference to FIG. 4, the outline | summary is demonstrated about each process using the Web page for administrators called by operating an administrator switch in the Web client 100 shown in FIG. When a user having an ID having administrator authority accesses the Web page, the Web client 100 displays a Web page including an administrator switch. When the user operates the administrator switch, the Web client 100 receives the HTML file located at the URL set in the administrator switch, and displays the administrator Web page. In the administrator Web page, a page access right setting menu (S401) having a menu (S410) for setting the access right for each user and a menu (S420) for setting the access right for each group in the lower hierarchy. Then, a display content setting menu (S501) having a hyperlink setting menu (S510) and a partial display content setting menu (S520) in the lower hierarchy is displayed.
[0037]
When a user accesses a menu for setting access rights for each user (S410) or a menu for setting access rights for each group (S420), the corresponding Web page (calls the management Web page) A menu for setting the access right for each user or group for the (web page). When the content of the access control setting file corresponding to the Web page is updated according to the user's operation and the setting of the access right for each user or group is completed, the Web that called the management Web page to the Web client 100 is called An instruction to display the page is sent. Therefore, the original Web page is displayed again on the Web client 100.
[0038]
On the other hand, when the user accesses the hyperlink setting menu S510, a list of URLs included in the Web page is displayed. Here, the user selects and sets a URL whose setting is to be changed (S511). Next, the user sets the access right for the link destination of the set URL (S512). The setting results in steps S511 and S512 are written in the content control definition file corresponding to the Web page. When the above processing is completed, an instruction to display the original Web page is sent to the Web client 100, and the Web client 100 displays the original Web page again.
[0039]
On the other hand, when the user accesses the display content setting menu S520, a desired range in the Web page is set (step S512), and an access right is set for the set range (step S522). The content thus written is written in the content control definition file corresponding to the Web page. When these processes are completed, an instruction to display the Web page is sent to the Web client 100, and the Web client 100 displays the original Web page again.
[0040]
According to the configuration as described above, a user having administrator authority can access the Web page for which access right management is to be performed and operate the administrator switch to manage the access right for the Web page. It is possible to access a Web page that can be performed. When the setting is completed, the Web page is displayed again on the Web client 100, so that the link destination included in the Web page can be easily referred to, and the Web page is efficiently included in the page. You can continue to set and change the access right of the link destination.
[0041]
Next, referring to FIG. 5, the script file 301, the access control setting file 302, the content control definition file 303, and the display content definition file 304 shown in FIG. An embodiment of a program (hereinafter referred to as a page registration program) for creating and registering in a Web server will be described. However, each file characterized by the present invention can be created by any method without using the automatic creation / registration program described here.
[0042]
A user who wants to register Web page information in the Web server 300 shown in FIG. 1 first creates a Web page to be registered in advance as a single HTML file as before, and if necessary, An image or audio file specified in the HTML file is prepared.
[0043]
When registering the Web page indicated by the prepared single HTML file in the Web server 300 according to the present invention, the user first starts the page registration program and designates the HTML file to be registered. The page registration program automatically parses the designated HTML file and extracts a description about each hyperlink contained therein. Then, based on the extracted description about each hyperlink, a content control definition file 303 is created and registered in the Web server 300 (S601). However, in the content control definition file 303 created here, predetermined default values (default values) for the information for specifying each hyperlink, the header information included in each hyperlink, and the address information of the link destination Definition information with the access right of the user.
[0044]
Hyperlinks can be automatically extracted by parsing a specified HTML file. However, for the display part other than the hyperlink, it is impossible to automatically extract the setting range of the access right or the like unless a certain condition is given to the HTML file to be analyzed. Therefore, when this program is used, it is necessary to separately set a portion other than the hyperlink.
[0045]
Next, the page registration program extracts a text file corresponding to the text other than the hyperlink from the specified HTML file, and at the same time, the description regarding the hyperlink extracted in step S601 can be interpreted when the script file 301 is executed. The display content definition file 304 is created and registered in the Web server 300 (step S602). As a predetermined description that can be interpreted at the time of execution of the script file 301, for example, a predetermined tag is used to define that the description is dedicated to the script file 301, and the text format is within the range specified by the tag. And a description indicating a correspondence relationship with information on each hyperlink defined in the content control file 303 can be added.
[0046]
Next, the page registration program creates an access control setting file 302 using default data and registers it in the Web server 300 (step S603). As default data set in the access control setting file 302, for example, as a user ID capable of displaying the Web page, the ID of the user operating the page registration program and the administrator authority to manage the Web page Register a user ID with If such data is used, after the files constituting the web page are automatically registered by this page registration program, until a predetermined access right is set by a user having administrator authority, It is possible not to allow access from the user.
[0047]
Then, a script file 301 that is referred to when creating the Web page is created in association with each file so that each file created and registered in steps S601 to S603 can be referred to, and the created script file 301 is registered in the Web server 300 (step S604).
[0048]
According to the embodiment of the page registration program according to the present invention described with reference to FIG. 5, it is possible to register an arbitrary Web page to the Web server 300 of the present invention only by specifying an HTML file to be registered. Each file necessary for this is automatically created, and the Web page can be registered.
[0049]
As mentioned above, although the example was demonstrated about embodiment of this invention, Embodiment of this invention is not restrict | limited to it, It is possible to change suitably in the range which does not deviate from the scope of the present invention. For example, each file (301 to 304) characterized by the present invention is configured in binary format instead of text format, and the contents of each file are integrated into one, or each Web page is configured by further dividing It is possible to change the number of files to be changed, store each file in a distributed manner on the network as well as in one Web server. Further, the access control method and the automatic file creation / registration program executed in the Web page access control apparatus of the present invention can be distributed by being recorded on a computer-readable recording medium.
[0050]
【The invention's effect】
As described above, according to the present invention, user authentication can be performed in units of Web pages, and contents displayed on the Web client can be changed for each accessed user. Furthermore, according to the present invention, it is possible to easily perform management related to setting and changing of access rights in units of Web pages.
[Brief description of the drawings]
FIG. 1 is a block diagram showing an embodiment of a Web page access control apparatus according to the present invention.
FIG. 2 is a flowchart showing a script execution process of the present invention by the Web server 300 shown in FIG.
FIG. 3 is a flowchart showing the flow of each process in the display content setting subroutine (S305) in FIG.
FIG. 4 is a system flow showing a flow of each process according to an operation of an administrator switch according to the present invention.
FIG. 5 is a system flow showing a page registration program according to the present invention that automatically creates files 301 to 304 used in the Web server 300 shown in FIG. 1;
FIG. 6 is a configuration diagram illustrating a conventional Web page access control method;
[Explanation of symbols]
300 Web server
301 script file
302 Access control settings file
303 Content control definition file
304 Display content definition file

Claims (5)

An apparatus for providing Web page information indicated in a hypertext format for access from a Web client,
Authentication means for confirming whether the login information of the user who operates the Web client accessing the Web page is correct;
Creating means for creating a hypertext file indicating the accessed web page based on the login information confirmed by the authenticating means;
Sending means for sending the hypertext file created by the creating means to the Web client ;
The creation means has an addition means for adding access information to a web page that can change the creation contents of the hypertext file by the creation means based on the login information confirmed by the authentication means. Page access control device. Any said creation means, based on said login information is confirmed by the authentication means, information indicating a reference destination included in the access hypertext file indicating Web page, those accompanied by reference destination address information or without although The Web page access control apparatus according to claim 1, further comprising a selection unit configured to select contents included in the hypertext file so as to be one of them. An access control setting file that sets one or more levels of access rights for one or more users, a content control definition file that defines the correspondence between the contents of each web page and the access rights, and each web page One or more storage means for storing a display content definition file indicating display content and a script file describing a script to be executed;
Authentication means for confirming whether the login information of the user who operates the Web client is correct or not for access to a predetermined Web page from the Web client;
By executing the script described in the script file corresponding to each accessed web page,
Access right determination means for determining whether or not the user has access rights to the web page based on the login information confirmed by the authentication means and the content of the access control setting file;
When the access right determining means determines that the user has the right to access the Web page, the content of the information included in the Web page to be sent is determined based on the content of the content control definition file. Sending information determining means to perform,
A Web page information file indicating a Web page to be displayed on the Web client is created by referring to a display content definition file corresponding to the Web page according to the determination result by the access right determination unit and the determination by the transmission information determination unit. Web page information creation means;
Sending means for sending the web page information file created by the web page information creating means to the web client ;
Administrator authority determining means for determining whether or not the user has administrator authority capable of changing the contents of the access control setting file and the content control definition file based on login information confirmed by the authentication means;
Comprising
Web page information to be displayed on the Web client by the Web page information creating unit referring to the display content definition file corresponding to the Web page according to the determination result by the access right determining unit and the determination by the transmission information determining unit When creating a file, the access control setting file and the content control definition file are added with access information for accessing a web page that can change the contents of the content control definition file according to the determination result by the administrator authority determination unit. access control device of the Web page to be. A method for creating an access control setting file, a content control definition file, a display content definition file, and a script file stored in the storage means of the Web page access control device according to claim 3 from any specified hypertext file Because
At least information on hyperlinked pages registration unit is contained in the specified hypertext file extracted by parsing create containers control definition file among showing the correspondence between the information and a predetermined access rights for hyperlinks the extracted Content control definition file creation process to be registered in the storage means ,
From page registration means the hypertext file, creates and said stored display content definition file by replacing the description portion related information hyperlinks page registration unit is extracted with at least the contents control definition file creating process to a predetermined description A process for creating a display content definition file to be registered in the means ,
An access control setting file creation process in which the page registration means creates an access control setting file using default data and registers it in the storage means ;
The page registration means creates a script file corresponding to each file created in the content control definition file creation process, the display content definition file creation process, and the access control setting file creation process, and registers it in the storage means. A method for creating a file used in an access control device for a Web page, comprising: a script file creating process. In a web server that provides web page information indicated in hypertext format for access from a web client,
An authentication process in which the authentication means confirms whether the login information of the user operating the Web client is correct;
A creation process for creating a hypertext file indicating the accessed web page based on the login information confirmed in the authentication process by the creation means ;
And the sending process of sending means for sending a hypertext file that was created by the creating process to the Web client only contains,
The creation means includes an addition process of adding access information to a web page that can change a creation content of a hypertext file based on the login information confirmed by the authentication process. Page access control method.

Images