JP4286635B2 - Access control system and access control method - Google Patents

Description

  The present invention relates to an access control system and an access control method for controlling access to a certain WWW server via a network using a WWW browser of each terminal, and in particular, to an existing WWW server and a WWW browser. The present invention relates to an access control system and an access control method that can eliminate the trouble of exchanging information for complicated access control and information provision without making any changes.

  Currently, various information is developed by the WWW on the Internet. Because of the nature of the WWW, basically everything is open to the public. For this reason, methods such as providing access restrictions by passwords are generally used for information that is to be kept private. In this case, for example, the operator of the WWW server must perform password registration and password management through procedures such as user registration, and in order to change the information provided for each user, A management method is required.

  In addition, although access restriction as described above is unnecessary, there is also a WWW that requests personal attributes of an access user. Normally, before accessing a predetermined WWW page, a page for requesting entry of personal attributes is presented, and if the input is confirmed, the WWW page is disclosed. In the provision of information by existing WWW, there are many scenes that require predetermined information when accessing certain information.

  In order to eliminate the trouble of exchanging information for complicated access control and information provision, such as setting access restrictions with passwords and requesting entry of personal attributes, There are Japanese Patent Application No. 2003-284248 and Japanese Patent Application No. 2003-290238 related to the application, and it is not only determined whether access is permitted or not for an access request, but it is permitted to access if a certain condition is satisfied. An access control system that can evaluate conditional access permission has also been proposed (see, for example, Patent Document 1).

Publication 2001-184264

  However, it is considered that the conventional system described above needs to be shifted to a dedicated system, and in terms of its introduction cost, it is not smoothly spread to general WWW operations.

  Therefore, the object of the present invention has been made in consideration of such circumstances, and information for complicated access control and information provision without adding systematic changes to existing WWW servers and WWW browsers. An object of the present invention is to provide an access control system and an access control method that eliminates the trouble of exchange and is highly convenient for both information acquisition requesters and WWW server operators.

In order to achieve the above object, an access control system according to claim 1 of the present invention is an access control system for controlling access to a certain WWW server via a network using a WWW browser of each terminal. An access control mechanism composed of an access request transmitting device, an access request receiving device, and a use condition determining device is incorporated in each terminal on the acquisition requester side and the WWW server side ,
The access request transmission device of the access control mechanism on the information acquisition requester side is
Means for receiving an acquisition request for information from a WWW browser to a WWW server;
Means for transmitting an access request reception function confirmation signal to determine whether the terminal on the WWW server side has an access request reception device;
Means for receiving a response from the access request receiving device on the WWW server side in response to the access request receiving function confirmation signal, and transmitting an acquisition request to the access request receiving device on the WWW server side;
Means for functioning as a proxy to return the acquisition result from the WWW server to the WWW browser when receiving an acquisition request for the WWW server of a terminal that does not have an access request receiving device from the WWW browser;
The access request receiving device on the WWW server side is
Means for responding to the access request reception function confirmation signal;
Upon receiving the acquisition request transmitted from the access request transmitting device on the information acquisition requester side, the use condition for the WWW server installed in the terminal using the use condition determining device on the WWW server side in response to the acquisition request Means for obtaining the judgment results;
A means for functioning as a proxy and returning the acquired information from the WWW server to the access request transmitting device on the information acquisition requester side if the determination result is to permit access;
When it is determined that the personal attribute information of the information acquisition requester is required as a result of the determination by the use condition determination device, the access request receiving device uses the access request transmitting device to Means for requesting acquisition of attribute information;
Upon receiving the personal attribute information acquisition request, the usage condition determination device on the information acquisition requester side is used to acquire the usage condition determination result, and the personal attribute information is returned to the access request transmission device on the WWW server side according to the result. Means to
Means for receiving the returned personal attribute information, obtaining the use condition determination result again using the use condition determining device on the WWW server side, and performing processing according to the result;
And a means for returning the finally obtained result to the WWW browser .

Further, the invention of claim 2 is characterized in that, in claim 1, the use condition judging device has a function of judging an acquisition request using at least one use condition, and not only the permission judgment based on the use condition. Further, it has a function of changing an acquisition request destination depending on conditions.

According to a third aspect of the present invention, in the first aspect , each access request receiving apparatus stores and manages the personal attribute information or information requested as a result of use condition determination.

The access control mechanism according to claim 4 of the present invention includes an information acquisition requester side and a WWW server in an access control system that performs access control to a certain WWW server via a network using a WWW browser of each terminal. An access control mechanism that is incorporated in the terminal on the side and is configured by an access request transmitting device, an access request receiving device, and a use condition determining device,
The access request transmission device of the access control mechanism on the information acquisition requester side is
Means for receiving an acquisition request for information from a WWW browser to a WWW server;
Means for transmitting an access request reception function confirmation signal to determine whether the terminal on the WWW server side has an access request reception device;
Means for receiving a response from the access request receiving device on the WWW server side in response to the access request receiving function confirmation signal, and transmitting an acquisition request to the access request receiving device on the WWW server side;
Means for functioning as a proxy to return the acquisition result from the WWW server to the WWW browser when receiving an acquisition request for the WWW server of a terminal that does not have an access request receiving device from the WWW browser;
The access request receiving device on the WWW server side is
Means for responding to the access request reception function confirmation signal;
Upon receiving the acquisition request transmitted from the access request transmitting device on the information acquisition requester side, the use condition for the WWW server installed in the terminal using the use condition determining device on the WWW server side in response to the acquisition request Means for obtaining the judgment results;
A means for functioning as a proxy and returning the acquired information from the WWW server to the access request transmitting device on the information acquisition requester side if the determination result is to permit access;
When it is determined that the personal attribute information of the information acquisition requester is required as a result of the determination by the use condition determination device, the access request receiving device uses the access request transmitting device to Means for requesting acquisition of attribute information;
Upon receiving the personal attribute information acquisition request, the usage condition determination device on the information acquisition requester side is used to acquire the usage condition determination result, and the personal attribute information is returned to the access request transmission device on the WWW server side according to the result. Means to
Means for receiving the returned personal attribute information, obtaining the use condition determination result again using the use condition determining device on the WWW server side, and performing processing according to the result;
And a means for returning the finally obtained result to the WWW browser .

Further, the invention of claim 5 is the invention according to claim 4 , wherein the usage condition determining device has a function of determining an acquisition request using at least one usage condition, and not only a permission determination based on the usage conditions. Further, it has a function of changing an acquisition request destination depending on conditions.

The access control method according to claim 6 of the present invention is a method for controlling access to a certain WWW server via a network using a WWW browser of each terminal, wherein the information acquisition requester side and the WWW side The server side terminal incorporates an access control mechanism composed of an access request transmission device, an access request reception device, and a use condition determination device, respectively, and the access request transmission device of the access control mechanism on the information acquisition requester side Receiving an information acquisition request from the WWW browser to the WWW server, transmitting an access request receiving function confirmation signal to determine whether the terminal on the WWW server has an access request receiving device, and a WWW server The access request receiving device on the side responds to the access request receiving function confirmation signal; The access request transmitting device on the information acquisition requester side receives the response returned from the access request receiving device on the WWW server side, and transmits the acquisition request to the access request receiving device on the WWW server side; The access request transmission device of the terminal receives an acquisition request for a WWW server of a terminal that does not have an access request reception device from the WWW browser, and functions as a proxy to return the acquisition result from the WWW server to the WWW browser; The access request receiving device on the WWW server side receives the acquisition request transmitted from the access request transmitting device on the information acquisition requester side, and uses the use condition determination device on the WWW server side for the acquisition request, the terminal Obtaining a determination result of a use condition for a WWW server installed in the network; and If the access request is permitted to be accessed, a step of functioning as a proxy and returning the acquired information from the WWW server to the access request transmitting device on the information acquisition requester side, and a determination result in the use condition determining device If it is determined that the personal attribute information of the information acquisition requester is required, a step of requesting acquisition of personal attribute information to the access request receiving device on the information acquisition requester side using the access request transmitting device; When the personal attribute information acquisition request is received, the usage condition determination device on the information acquisition requester side is used to acquire the usage condition determination result, and the personal attribute information is transmitted to the access request transmission device on the WWW server side according to the result. The return step and the returned personal attribute information are received, and the use condition determination device on the WWW server side is used again to determine the use condition determination result. The method includes a step of acquiring and performing processing according to the result, and a step of returning the finally obtained result to a WWW browser .

A seventh aspect of the invention resides in a program for causing a computer to execute the processing of each step according to the sixth aspect .

The invention according to claim 8 resides in a recording medium on which the program according to claim 7 is recorded.

  According to the present invention described above, it is possible to eliminate the trouble of exchanging information for complicated access control and information provision without adding a systematic change to an existing WWW server or WWW browser simply by incorporating an access control mechanism. The convenience of both the information acquisition requester and the WWW operator can be greatly improved.

  Hereinafter, the present invention will be described in detail based on embodiments of the present invention with reference to the drawings.

  FIG. 1 is a schematic diagram of an access control mechanism 104 according to the present invention incorporated in each terminal of an information acquisition requester and a WWW server operator. The access control mechanism 104 includes an access request transmission unit 101, an access request reception unit 102, and a use condition determination unit 103.

  The access request transmitting means 101 has a function of receiving an acquisition request for information from the WWW browser of its own terminal to the WWW server, or an acquisition request for personal attribute information to the information acquisition requester from the WWW server, from the terminal on the WWW server side; Judgment whether the access control mechanism on the WWW server side or the information acquisition requester side has an access request receiving means for receiving the acquisition request transmitted from the access request transmitting means 101 of the access control mechanism in the partner terminal. A function for transmitting an access request reception function confirmation signal to the other terminal, and an access control mechanism on the WWW server side or an access control mechanism on the information acquisition requester side in response to a response to the access request reception function confirmation signal Function as a proxy and WW as a proxy The function of relaying the acquisition request to the server and the reception result from the WWW server or the access request receiving means on the information acquisition requester side are returned to the access request receiving means of the access control mechanism on the WWW browser or WWW server side. It has a function.

  The access request receiving means 102 has a function for responding to an access request receiving function confirmation signal from the access request transmitting means in the access control mechanism on the information acquisition requester side, and as a result access in the access control mechanism on the information acquisition requester side. A function that acquires a use condition determination result using the use condition determination unit 103 in response to an acquisition request sent from the request transmission unit, and functions as a proxy when the determination result permits access. The function of relaying the acquisition request to the WWW server and the information acquisition requester side using the access request transmission means on the WWW server side when it is determined that the determination result requires the personal attribute information of the acquisition requester Function for requesting acquisition of personal attribute information to the access request receiving means, and access request transmitting means on the WWW server side In response to an acquisition request for personal attribute information, the use condition determination means 103 on the information acquisition requester side is used to acquire the determination result of the use requester's use condition, and the personal attribute information is requested to access the WWW server according to the result. It has a function of returning to the transmission means, and a function of acquiring the use condition judgment result again using the use condition judgment means 103 on the WWW server side when the personal attribute information is obtained.

  The use condition determining unit 103 has a function of determining an acquisition request using at least one or more use conditions. Depending on the use conditions, the use condition determining unit 103 has a function of changing an acquisition request destination depending on conditions, not just a permission determination. Is preferred.

  FIG. 2 is a schematic configuration diagram showing a specific example of an access control system executed by the access control mechanism according to the embodiment of the present invention.

  In this access control system, the access request transmission device 211 in the access control mechanism 214 incorporated in the terminal 20 of the information acquisition requester sends information from the WWW browser 201 to the WWW server 202 installed in the terminal 21 of the WWW server operator. An acquisition request shall be received.

  First, the access request transmission device 211 transmits an access request reception function confirmation signal to the access control mechanism 224 of the terminal 21 in order to determine whether the terminal 21 on the WWW server 202 side has the access request reception device 222. The access request receiving device 222 in the access control mechanism 224 responds to the access request receiving function confirmation signal. Upon receiving this response, the access request transmitting apparatus 211 transmits an information acquisition request for the WWW server 202 to the access request receiving apparatus 222.

  When the access request transmission apparatus 211 receives a request from the WWW browser 201 to the WWW server 203, it similarly transmits an access request reception function confirmation signal to the terminal 22 in which the WWW server 203 is installed. However, since the terminal 22 does not have an access request receiving device, the access request transmitting device 211 cannot obtain an access request receiving function confirmation signal response from the terminal 22. In this case, the access request transmission device 211 functions as a proxy and returns the acquisition result from the WWW server 203 to the WWW browser 201.

  When the access request receiving apparatus 222 receives an acquisition request from the access request transmitting apparatus 211, the access request receiving apparatus 222 acquires a use condition determination result using the use condition determining apparatus 223 in response to the acquisition request. If the determination result is that the access to the WWW server 202 is permitted, the access request receiving device 222 functions as a proxy, and the acquisition result from the WWW server 202 is obtained as the access request transmitting device 211 of the acquisition requester. Return to When it is determined that the personal attribute information of the acquisition requester is necessary, the access request reception device 222 uses the access request transmission device 221 to receive the access request of the acquisition requester. An acquisition request for personal attribute information is sent to the device 212.

  The access request receiving apparatus 212 that has received the personal attribute information acquisition request acquires the use condition determination result using the use condition determination apparatus 213, and returns the personal attribute information to the access request transmission apparatus 221 according to the result. When the access request receiver 222 obtains the personal attribute information of the requester of the acquisition from the access request transmitter 221, the access request receiver 222 acquires the use condition determination result again using the use condition determination device 223, and follows the result. Process. This process automatically exchanges information necessary for determining usage conditions. Eventually, the access request receiving apparatus 222 that has obtained some result returns the result to the access request transmitting apparatus 211. The access request transmission device 211 further returns the result to the WWW browser 201.

  FIG. 3 is a flowchart showing a flow of processing for an information acquisition request from the WWW browser to the WWW server in the access request transmission unit 101 in the access control mechanism 104.

  The access request transmitting apparatus 211 receives an acquisition request for the WWW server from the WWW browser 201 (step S301), and inquires of the terminal having the WWW server whether the access request receiving apparatus is provided (step S302). When the information acquisition request destination is the WWW server 203, since the terminal 22 having this server 203 does not have an access request receiving device (NO in step S302), the access request transmitting device 211 serves as a proxy to the WWW server 203. The request is relayed (step S303). When the information acquisition request destination is the WWW server 202, since the terminal 21 having this server 202 has the access request receiving device 222 (YES in step S302), the access request transmitting device 211 is the access request receiving device 222. An acquisition request is transmitted to (step S304). The reception result from the WWW server 203 or the access request receiving device 222 is returned to the WWW browser (step S305).

  FIG. 4 is a flowchart showing a flow of processing for an acquisition request from an access request transmitting unit on the WWW browser side in the access request receiving unit 102 in the access control mechanism 104.

  The access request receiving apparatus 222 receives the acquisition request sent from the access request transmitting apparatus 211 on the WWW browser side (step S401), and in response to the acquisition request, the use condition determining apparatus 223 determines the use condition for the WWW server 202. Is performed (step S402). If the determination result does not permit access (NG in step S402), the access request receiving apparatus 222 generates an error message (step S403). If the determination result is that access is permitted (OK in step S402), the access request receiving apparatus 222 relays the acquisition request to the WWW server 202 (step S404). If the determination result in the use condition determining device 223 requires the personal attribute information of the information acquisition requester (information required in step 402), the requester's personal attribute information acquisition processing is performed (step S405). If the personal attribute information of the requester can be acquired from the use condition determination device 213 on the information acquirer side via the access request reception device 212 (success in step S405), the use condition determination device 223 is used again to determine the use condition (step S405). S402). If the personal attribute information of the requester cannot be acquired (failure of step S405), the access request receiving apparatus 222 generates an error message (step S406). Finally, the processing result is returned to the access request transmitting apparatus 211 on the WWW browser side (step S407).

  The requester's personal attribute information acquisition processing is switched between the access request transmission / reception device on the WWW server side and the access request transmission / reception device on the WWW browser side.

  FIG. 5 is a flowchart showing the flow of processing for an acquisition request for personal attribute information from the access request receiving means in the access request transmitting means.

  The access request transmitting device 221 receives an acquisition request for personal attribute information from the access request receiving device 222 (step S501), and inquires of the terminal 20 on the WWW browser side whether the access request receiving device is present (step S502). If the access request receiver is not included (NO in step S502), the access request transmitter 221 returns an error message to the access request receiver 222 (step S503). If the terminal 20 has an access request receiving device (YES in step S502), the access request transmitting device 221 transmits an acquisition request to the access request receiving device 212 on the WWW browser side (step S504). The reception result from the access request receiving device 212 is returned to the access request receiving device 222 via the access request transmitting device 224 (step S505).

  The processing for the acquisition request for personal attribute information from the access request transmitting device 221 in the access request receiving device 212 is basically the same processing as in FIG. In step S <b> 404, “the access request receiving device 222 relays an acquisition request to the WWW server 202” is simply replaced with “the access request receiving device 212 relays an acquisition request for personal attribute information to the use condition determination device 213”. . This indicates that the functions of the access request transmission / reception devices on the WWW server side and the WWW browser side are completely equivalent. The storage location of personal attribute information (or information requested as a result of use condition determination) is managed by the access request receiving apparatus, and can be identified by the information name. For example, personal attribute information can be stored in a WWW server on a terminal having a WWW browser.

  Note that the processing of each step in each means in the above-described access control mechanism according to the present invention includes a magnetic disk (floppy (registered trademark) disk, hard disk, etc.), optical disk (CD-ROM) as programs that can be executed by a computer. , DVD, etc.) and storage media such as semiconductor memory can be distributed.

1 is a schematic diagram of an access control mechanism according to the present invention. It is a system configuration figure showing a specific example of an access control system concerning an embodiment of the invention. It is a flowchart which shows the flow of a process with respect to the acquisition request from the WWW browser in an access request transmission means. It is a flowchart which shows the flow of a process with respect to the acquisition request from the access request transmission means by the side of a WWW browser in an access request reception means. It is a flowchart which shows the flow of a process with respect to the acquisition request | requirement of the personal attribute information from the access request receiving means in an access request transmission means.

Explanation of symbols

20 Information acquisition requester's terminal (terminal)
21 WWW server operator terminal 22 WWW server operator terminal without access request receiving means 101 Access request transmitting means 102 Access request receiving means 103 Usage condition determining means 104 Access control mechanism 201 WWW browser 202, 203 WWW server 211 Access Request transmission device 212 Access request reception device 213 Usage condition determination device 214 Access control mechanism 221 Access request transmission device 222 Access request reception device 223 Usage condition determination device 224 Access control mechanism

Claims (8)

In an access control system that controls access to a certain WWW server via a network using a WWW browser of each terminal, an access request transmitting device and an access request are sent to the information acquisition requester side and the WWW server side terminal. An access control mechanism composed of a receiving device and a use condition judging device is incorporated respectively.
The access request transmission device of the access control mechanism on the information acquisition requester side is
Means for receiving an acquisition request for information from a WWW browser to a WWW server;
Means for transmitting an access request reception function confirmation signal to determine whether the terminal on the WWW server side has an access request reception device;
Means for receiving a response from the access request receiving device on the WWW server side in response to the access request receiving function confirmation signal, and transmitting an acquisition request to the access request receiving device on the WWW server side;
Means for functioning as a proxy to return the acquisition result from the WWW server to the WWW browser when receiving an acquisition request for the WWW server of a terminal that does not have an access request receiving device from the WWW browser;
The access request receiving device on the WWW server side is
Means for responding to the access request reception function confirmation signal;
Upon receiving the acquisition request transmitted from the access request transmitting device on the information acquisition requester side, the use condition for the WWW server installed in the terminal using the use condition determining device on the WWW server side in response to the acquisition request Means for obtaining the judgment results;
A means for functioning as a proxy and returning the acquired information from the WWW server to the access request transmitting device on the information acquisition requester side if the determination result is to permit access;
When it is determined that the personal attribute information of the information acquisition requester is required as a result of the determination by the use condition determination device, the access request receiving device uses the access request transmitting device to Means for requesting acquisition of attribute information;
Upon receiving the personal attribute information acquisition request, the usage condition determination device on the information acquisition requester side is used to acquire the usage condition determination result, and the personal attribute information is returned to the access request transmission device on the WWW server side according to the result. Means to
Means for receiving the returned personal attribute information, obtaining the use condition determination result again using the use condition determining device on the WWW server side, and performing processing according to the result;
An access control system comprising: means for returning a finally obtained result to a WWW browser . The use condition determining device has a function of determining an acquisition request using at least one or more use conditions, and has a function of changing an acquisition request destination depending on the conditions as well as determining permission according to the use conditions. The access control system according to claim 1. 2. The access control system according to claim 1 , wherein each of the access request receiving devices stores and manages the personal attribute information or information requested as a result of use condition determination . An access request transmitting apparatus incorporated in the information acquisition requester side and the WWW server side terminal in an access control system that performs access control to a certain WWW server via a network using a WWW browser of each terminal; An access control mechanism comprising an access request receiving device and a use condition judging device,
The access request transmission device of the access control mechanism on the information acquisition requester side is
Means for receiving an acquisition request for information from a WWW browser to a WWW server;
Means for transmitting an access request reception function confirmation signal to determine whether the terminal on the WWW server side has an access request reception device;
Means for receiving a response from the access request receiving device on the WWW server side in response to the access request receiving function confirmation signal, and transmitting an acquisition request to the access request receiving device on the WWW server side;
Means for functioning as a proxy to return the acquisition result from the WWW server to the WWW browser when receiving an acquisition request for the WWW server of a terminal that does not have an access request receiving device from the WWW browser;
The access request receiving device on the WWW server side is
Means for responding to the access request reception function confirmation signal;
Upon receiving the acquisition request transmitted from the access request transmitting device on the information acquisition requester side, the use condition for the WWW server installed in the terminal using the use condition determining device on the WWW server side in response to the acquisition request Means for obtaining the judgment results;
A means for functioning as a proxy and returning the acquired information from the WWW server to the access request transmitting device on the information acquisition requester side if the determination result is to permit access;
When it is determined that the personal attribute information of the information acquisition requester is required as a result of the determination by the use condition determination device, the access request receiving device uses the access request transmitting device to Means for requesting acquisition of attribute information;
Upon receiving the personal attribute information acquisition request, the usage condition determination device on the information acquisition requester side is used to acquire the usage condition determination result, and the personal attribute information is returned to the access request transmission device on the WWW server side according to the result. Means to
Means for receiving the returned personal attribute information, obtaining the use condition determination result again using the use condition determining device on the WWW server side, and performing processing according to the result;
An access control mechanism comprising: means for returning the finally obtained result to a WWW browser . The use condition determining device has a function of determining an acquisition request using at least one or more use conditions, and has a function of changing an acquisition request destination depending on the conditions as well as determining permission according to the use conditions. The access control mechanism according to claim 4 . A method for controlling access to a certain WWW server via a network using a WWW browser of each terminal, the access request transmitting device and the access request being sent to the information acquisition requester side and the WWW server side terminal An access control mechanism composed of a receiving device and a use condition determining device is incorporated, and the access request transmitting device of the access control mechanism on the information acquisition requester side receives an information acquisition request from the WWW browser to the WWW server. A step of transmitting an access request reception function confirmation signal to determine whether a terminal on the WWW server side has an access request reception apparatus; and an access request reception function confirmation signal on the WWW server side of the access request reception function confirmation signal The access request transmitting device on the information acquisition requester side In response to a response from the access request receiving apparatus on the W server side, a step of transmitting an acquisition request to the access request receiving apparatus on the WWW server side, and an access request transmitting apparatus on the information acquisition requester side receives an access request from the WWW browser. When receiving an acquisition request for a WWW server of a terminal for which no receiving device exists, a step of functioning as a proxy and returning an acquisition result from the WWW server to the WWW browser, and an access request receiving device on the WWW server side acquires information Receiving the acquisition request transmitted from the requester-side access request transmitting device, and using the usage condition determining device on the WWW server side in response to the acquisition request, the determination result of the usage condition for the WWW server installed in the terminal And when the determination result permits access, A step of functioning as a proxy and returning the acquisition information from the WWW server to the access request transmission device on the information acquisition requester side, and the determination result in the use condition determination device requires the personal attribute information of the information acquisition requester If it is determined, the step of making an acquisition request for personal attribute information to the access request receiving device on the information acquisition requester side using the access request transmitting device; Using the use condition judging device on the acquisition requester side to obtain the use condition judgment result, and according to the result, returning the personal attribute information to the access request transmitting device on the WWW server side, and receiving the returned personal attribute information Step of obtaining the use condition determination result again using the use condition determining device on the WWW server side and performing processing according to the result And a step of returning the finally obtained result to the WWW browser . The program for making a computer perform the process of each step of Claim 6 . A recording medium on which the program according to claim 7 is recorded .

Images