JP4812680B2 - Access control device - Google Patents

Description

  The present invention relates to access control to a server that provides a Web service, and more particularly to an access control apparatus that controls access to a server in consideration of server load.

  With the advent of World Wide Web (hereinafter simply referred to as Web) systems and Web service technologies that make it possible to use various software functions via the network using SOAP (Simple Object Access Protocol), etc. Linkage of information systems and utilization of information services are becoming more widespread. However, in a network system using such a technique, when the number of users using the service (the number of access users) increases, access to the server is concentrated and the response time decreases. It was.

  In order to improve such a problem, various techniques have been conventionally considered. For example, there is a first conventional technique in which a plurality of servers providing services are prepared and the response time is shortened by using a load balancer.

  In addition, there is a second conventional technique that shortens response time by giving priority to processing of a specific user by giving priority when accessing (see, for example, Patent Documents 1 and 2). Specifically, in the prior art described in Patent Document 1, a client information database storing attribute information including identification information and priority information is provided for each client, and when the request command is a transaction end request command, the client information database The request command group is executed in descending order of client priority.

  Further, in the prior art described in Patent Document 2, a means for storing a session of a user who has performed a specific operation such as a callback request is provided, and Web data that matches the session is transmitted and received from other sessions. Is also prioritized.

JP 2001-31424 A JP 2003-087421 A

  However, in the first conventional technique, it is necessary to prepare a large number of servers according to the number of users, and there is a problem that the cost of the network system increases.

  Further, in the second prior art, since the load situation of the server providing the service is not taken into consideration, even when the priority of the user is increased when the access request is received from many users, The load remains high without being reduced. Therefore, there is a problem that the response time can be shortened for a user with high priority, but the response time cannot be shortened for a user with low priority. In other words, the second prior art has a problem that the effect of shortening the response time for access to the server is limited.

  The present invention has been made in view of the above, and shortens the response time of access to the server in consideration of the priority to the user and the load distribution to the server without increasing the number of servers more than necessary. It is an object of the present invention to obtain an access control apparatus that can do the above.

  In order to solve the above-described problems and achieve the object, the present invention provides a client and a network that are connected to a plurality of servers that hold data related to at least one service, and that access the server and request a service. An access control apparatus that selects one server from a plurality of servers that are connected via the network and provides a service requested by the client, acquires data related to the requested service from the selected server, and transmits the data to the client An access queue having a queue that is associated with each server and registers waiting for access to the server, a service name held by the server, and a user ID for identifying a user who uses the service. The load distribution level indicating the priority of load distribution to the server is registered. Load distribution definition database, storage means for storing a service deployment information database in which the service name and the server name to be accessed in association with the load distribution level are stored, and the service name included in the service call request received from the client And a server accessible according to the load distribution level of the service name and user ID requested from the client based on the user ID and the load distribution definition database and service deployment information database stored in the storage means Load balancing control means for selecting a candidate for the server, and based on the load status of the server candidate selected by the load balancing control means, the server having the lowest load status is selected, and the service is added to the queue corresponding to the selected server. Wait for access by call request Characterized in that and a server load monitoring means for registering.

  According to the present invention, the load balancing control means allows the user to identify the service name and user ID included in the service call request received from the client, and the service name and service held by the server. A load distribution definition database in which a load distribution level indicating the priority of load distribution to a server is registered in association with an ID, and a service deployment information database in which a service name and a server name to be accessed in association with the load distribution level are registered Based on the service name requested by the client and the load distribution level of the user ID, the server candidate that can be accessed is selected, and the server load monitoring unit selects the server candidate selected by the load distribution control unit. Based on the load status, select the server with the lowest load status and select Since the access waiting due to the service call request is registered in the queue corresponding to the server, it becomes possible to distribute the load on the server according to the user and the service to be used, and the number of servers is more than necessary. There is an effect that it is possible to obtain an access control device that can shorten the response time of access to the server in consideration of the priority to the user and the load distribution to the server without increasing.

  Embodiments of an access control apparatus according to the present invention will be described below in detail with reference to the drawings. Note that the present invention is not limited to the embodiments.

  An embodiment of an access control apparatus according to the present invention will be described with reference to FIGS. FIG. 1 is a diagram showing an example of a configuration of a network system to which an access control apparatus according to the present invention is applied. In FIG. 1, the network system includes one to a plurality of (in this case, three) clients 3 (shown as 3-1 to 3-3) and a plurality (in this case, three) of servers 7 (7-1 to 7-1). 7-3) and the connected access control device 1 are connected by a network 5 such as the Internet, for example.

  The server 7 holds information related to the service to be provided, and provides predetermined service information in response to a request from the access control device 1. In FIG. 1, servers 7-1 and 7-2 hold services 1 and 2, and server 7-3 holds service 1.

  The access control device 1 includes a service interface definition DB 11, a service interface unit 12, a load distribution definition DB 13, a service deployment information DB 14, a priority definition DB 15, a load distribution control unit 161, a priority control unit 162, and a server load monitoring unit 163. An access control unit 16, an access queue 17, an actual service calling unit 18, an access history management unit 19, and an access history DB 20. The service interface definition DB 11, the load distribution definition DB 13, the service deployment information DB 14, the priority definition DB 15, and the access history DB 20 are stored in a storage unit (not shown).

  Information related to the interface of the Web service provided to the client 3 is registered in the service interface definition DB 11. FIG. 2 is a diagram showing registration items registered in the service interface definition DB 11. In FIG. 2, as a registration item of the service interface definition DB 11, a service name, a service URL (Uniform Resource Locator) associated with the service name, and an interface definition file name are listed.

  In the service name, the name of the service to be provided is registered. In the service URL, a URL storing the data of the service registered in the service name is registered. In the interface definition file name, the file name of the interface definition file in which the definition of the interface information of the service indicated by the service name is described in detail is registered. The interface definition file describes, for example, items used for format and search information in WSDL (Web Services Description Language) and the like, and storage means (not shown) in the access control device 1 or storage to which the access control device 1 can be connected. Stored in the device.

  Returning to FIG. 1, the service interface unit 12 has an interface function for communicating with the client 3 via the network 5, and performs communication with the client 3. Further, the service interface information of the service provided from the request from the client 3 and the service interface definition DB 11 (requested from the client 3) is generated, and the generated service interface information is transmitted to the client 3.

  Information on the load distribution level of the server 7 for the user is registered in the load distribution definition DB 13. FIG. 3 is a diagram showing registration items registered in the load distribution definition DB 13. In FIG. 3, the service name, user ID, time zone, and load distribution level are listed as registration items registered in the load distribution definition DB 13.

  In the service name, the name of the service to be provided is registered. In the user ID, an identifier (user ID) given in advance to the user in order to identify the user who provides the service registered in the service name is registered. In the time zone, a time zone in which the load distribution level for providing the service is valid is registered. In the load distribution level, the load distribution level when the user registered in the user ID uses the service registered in the service name is registered.

  Returning to FIG. 1, information regarding the server 7 that actually holds the service is registered in the service deployment information DB 14. FIG. 4 is a diagram showing registration items registered in the service deployment information DB 14. In FIG. 4, service names, load distribution levels, and real server names are listed as registration items in the service deployment information DB 14. In the service name, the name of the service to be provided is registered. In the load distribution level, the load distribution level in the service registered in the service name is registered. In the real server name, the name (identifier) of the server 7 that can select the service registered in the service name at the load distribution level registered in the load distribution level is registered.

  Returning to FIG. 1, information related to priority related to services is registered in the priority definition DB 15. FIG. 5 is a diagram showing registration items registered in the priority definition DB 15. In FIG. 5, service names, user IDs, time zones, and priorities are listed as registration items registered in the priority definition DB 15. In the service name, the name of the service to be provided is registered. In the user ID, a user ID given in advance to the user in order to identify the user who provides the service registered in the service name is registered. In the time zone, a time zone in which the priority is valid is registered. In the priority, the priority when the user registered in the user ID uses the service registered in the service name is registered. Here, it is assumed that the priority “1” has the highest priority, and the priority “2” has the highest priority next to the priority “1”.

  The access control unit 16 determines the priority of the service requested from the client 3 based on the load distribution definition DB 13, the service deployment information DB 14, the priority definition DB 15, and the load status of the server 7, and sets the determined priority. Based on this, the server 7 to be accessed is selected. The access control unit 16 sets a job (access request) at a predetermined position in the access queue 17 according to the selected server 7.

  The access control unit 16 includes a load distribution control unit 161, a priority control unit 162, and a server load monitoring unit 163. The load distribution control unit 161 selects an accessible server 7 candidate from the servers 7 that hold the service requested by the client 3 based on the load distribution definition DB 13 and the service deployment information DB 14.

The server load monitoring unit 163 monitors the load status of the server 7 and selects the server 7 to be accessed from the candidates for the accessible server 7 selected by the load distribution control unit 161 based on the monitoring result. The priority control unit 162 sets the job at a predetermined position in the access queue 17 according to the server 7 selected by the server load monitoring unit 163 based on the priority of the job held in the priority definition DB 15 and the access queue 17. Set.

  The access queue 17 has a queue associated with each server 7 and holds jobs to be accessed to the server 7. In FIG. 1, the access queue 17 includes a queue associated with the server 7-1, a queue associated with the server 7-2, and a queue associated with the server 7-3. In each queue, an access ID assigned to identify a job by the priority control unit 162 is registered, and access information is registered in association with the access ID. Here, the access information refers to various jobs related to the job indicated by the access ID including priority, user ID, service name to be accessed, service URL, date and time of registration in the access queue 17, and a predetermined upper limit of waiting time. It is information.

  The actual service calling unit 18 has an interface with the server 7 and provides the actual service by accessing the server 7 based on the access ID registered in the access queue 17 and the access information associated with the access ID. The acquired data is acquired, and the acquired data is transmitted to the client 3 via the access control unit 16 and the service interface unit 12.

  The access history management unit 19 registers access history information for services held by the server 7 in the access history DB 20 and manages the access history information. FIG. 6 is a diagram illustrating an example of registration items registered in the access history DB 20. In FIG. 6, access date / time, service name, user ID, implementation priority, and usage load distribution level are listed as registration items in the access history DB 20.

  In the access date and time, the date and time when the server 7 was accessed is registered. The access date and time may be the date and time when the request from the client 3 is received. In the service name, the name of the service used (accessed) is registered. In the user ID, a user ID for identifying a user who uses the service registered in the service name on the date and time registered as the access date and time is registered. As the execution priority, the priority used when the server 7 is actually accessed is registered. In the use load distribution level, the load distribution level used when actually accessing the server 7 is registered.

  Next, the operation of the network system to which the access control apparatus 1 according to the present invention is applied will be described with reference to the sequence diagram of FIG. The user inputs information including a service name to the client 3 in order to receive a desired service.

  The client 3 generates a service interface information acquisition request including the user ID and service name (step S100). The client 3 transmits the generated service interface information acquisition request to the access control apparatus 1 (step S101).

  Based on the service interface information acquisition request and the service interface definition DB 11 received from the client 3, the access control apparatus 1 executes a service interface information acquisition process for acquiring service interface information necessary for receiving the requested service ( Step S102).

  The operation of the service interface information acquisition process executed by the access control device 1 will be described in detail with reference to the flowchart of FIG. The service interface unit 12 extracts a service name from the received service interface information acquisition request (step S200).

  The service interface unit 12 acquires a service URL and an interface definition file name based on the service name and the service interface definition DB 11 (step S201). Specifically, the service interface unit 12 uses the extracted service name as a search key and the service name in the service interface definition DB 11 as a search key, and associates the service URL and interface in the service interface definition DB 11 with the service name that matches the search key. Get the service URL and interface definition file name registered in the definition file name.

  The service interface unit 12 acquires a file indicated by the interface definition file name acquired from a storage unit (not shown) or a storage device to which the access control device 1 can be connected (step S202). Based on the acquired file and the service URL, the service interface unit 12 includes service interface information including information (such as items used for format and search information) required for access from the acquired file (interface definition file) and the service URL. Is generated (step S203). The acquired interface definition file itself may be included in the service interface information. The service interface unit 12 generates a service interface information acquisition response including the generated service interface information (step S204) and ends the access information acquisition process.

  Returning to FIG. 7, the service interface unit 12 of the access control apparatus 1 transmits the service interface information acquisition response generated by the service interface information acquisition process to the client 3 indicated by the user ID (step S103).

  The client 3 extracts information necessary for access and a service URL from the received service interface information response. The client 3 prepares an environment for receiving a service based on information necessary for access, and generates a service read request including a user ID, a service name, and a service URL (step S104). The client 3 transmits the generated service read request to the access control apparatus 1 (step S105).

  The access control device 1 accesses the server 7 that holds the service requested by the service read request, based on the service read request, the load distribution definition DB 13, the service deployment information DB 14, and the priority definition DB 15 received from the client 3. An access control process is executed (step S106).

  With reference to the flowchart of FIG. 9, the detailed operation of the access control process executed by the access control apparatus 1 will be described. The load distribution control unit 161 of the access control apparatus 1 extracts a service name, a service URL, and a user ID from a service read request received from the client 3 via the service interface unit 12 (step S300).

  The load distribution control unit 161 acquires a load distribution level from the load distribution definition DB 13 based on the extracted service name and user ID and the current time (step S301). Specifically, the load distribution control unit 161 searches for the service name and user ID in the load distribution definition DB 13 using the combination of the extracted service name and user ID as a search key, and matches the service name and user ID that match the search key. A set of user IDs is extracted. The load distribution control unit 161 acquires the time zone and the load distribution level registered in the time zone and the load distribution level of the load distribution definition DB 13 in association with the extracted set.

  "User 1", "User 2", "User 3", and "*" are registered in the user ID of the load distribution definition DB 13 shown in FIG. Here, “*” indicates all users. Here, when paying attention to the user ID “user 1”, the load distribution control unit 161, when the service name is “service 1”, the time zone “0: 00-24: 00” and the load distribution level “2”. If the service name is “service 2”, the time zone “8: 00-20: 00” and the load distribution level “2”, the time zone “20: 00-8: 00” and the load The distribution level “1” is acquired.

  The load distribution control unit 161 selects a load distribution level based on the acquired time zone, load distribution level, and current time. For example, when the user ID “user 1” and the service name “service 1” are used as search keys, the time zone is “0: 00-24: 00”, so the load distribution level “0” does not depend on the current time. 2 ”is selected. When the user ID “user 1” and the service name “service 2” are used as search keys, if the current time is “8:00” or later and “20:00” or earlier, it is associated with this time zone. Load distribution level “2” is selected, and if the current time is “20:00” or later and “8:00” or earlier, the load distribution level “1” associated with this time zone is selected. Note that the current time is acquired from a clocking function (not shown) in the access control device 1.

  The load distribution control unit 161 acquires the real server name from the service deployment information DB 14 based on the service name and the selected load distribution level (step S302). Specifically, the load distribution control unit 161 searches for the service name and the load distribution level in the service deployment information DB 14 using the combination of the service name and the selected load distribution level as a search key, and matches the service name and the search key. The real server name associated with the load distribution level and registered in the service deployment information DB 14 is acquired.

  Specifically, when the service name “service 1” and the load distribution level “1” are used as search keys, the load distribution control unit 161 associates the service name “service 1” and the load distribution level “1” with the service. The server name “server # 1” indicating the server 7-1 registered in the real server name of the deployment information DB 14 is acquired. When the service name “service 1” and the load distribution level “2” are used as search keys, the load distribution control unit 161 associates the service name “service 1” and the load distribution level “1” with the service deployment information DB 14. The server name “server # 1” indicating the server 7-1 registered in the real server name, the service name “service 1”, and the load distribution level “2” are associated with the real server name in the service deployment information DB 14. The server name “server # 2” indicating the registered server 7-2 is acquired. That is, the load distribution control unit 161 acquires all the real server names associated with the combination of the load distribution level and the service name equal to or less than the value of the load distribution level selected from the load distribution definition DB 13 from the service deployment information DB 14. As a result, the higher the load distribution level (in this case, the greater the load distribution level value), the greater the number of servers 7 that can be accessed, and the higher the priority. The load distribution control unit 161 notifies the server load monitoring unit 163 of the service name, service URL, user ID, and acquired real server name.

  The server load monitoring unit 163 determines whether there are a plurality of notified real server names, that is, whether there are a plurality of real server names acquired by the load distribution control unit 161 (step S303). When there are a plurality of real server names (step S303, Yes), the server load monitoring unit 163 checks the load status of each server 7 indicated by the real server name (step S304). The load status of the server 7 is confirmed by, for example, the number of accesses to the server 7, the CPU operating rate, the status of the queue corresponding to the server 7 in the access queue 17, and the like.

  The server load monitoring unit 163 selects the server 7 with the lowest load based on the confirmed load status of the server 7 (step S305). That is, the server 7 with the lowest load is selected as the server 7 to be accessed from among the candidate servers 7 selected by the load distribution control unit 161. The server load monitoring unit 163 notifies the priority control unit 162 of the service name, service URL, user ID, and server name indicating the selected server 7.

  On the other hand, when the number of real servers notified from the load distribution control unit 161 is one, that is, when only one server 7 is selected by the load distribution control unit 161 (No in step S303), the server load monitoring unit 163 Selects the notified server 7 as the server 7 to be accessed without depending on the notified load of the server 7. The server load monitoring unit 163 notifies the priority control unit 162 of the service name, service URL, user ID, and server name indicating the selected server 7.

  The priority control unit 162 acquires the priority from the priority definition DB 15 based on the notified service name, user ID, and current time (step S306). Specifically, the service name and user ID in the priority definition DB 15 are searched using the notified service name and user ID set as a search key, and associated with the service name and user ID matching the search key. The time zone and priority registered in the priority definition DB 15 are acquired.

  The priority control unit 162 selects a priority based on the acquired time zone, priority, and current time. In the priority definition DB 15 shown in FIG. 5, the service name “service 1” and the user ID “user 1”, the service name “service 1” and the user ID “user 2”, and In the case of the service name “service 1” and the user ID “user 3”, the time zone is “0: 00-24: 00”, respectively. Therefore, the priority control unit 162 selects the priority registered in the priority definition DB 15 in association with the service name and the user ID without depending on the current time. Here, when the current time is outside the acquired time zone, or when there is no time zone and priority associated with the service name and the user ID, the priority control unit 162 has the lowest priority value ( Here, the priority “1”) is selected.

  The priority control unit 162 inserts a job at the queue position of the access queue 17 corresponding to the selected priority (step S307). Specifically, for example, when the real server name notified from the server load monitoring unit 163 indicates the server 7-1, the priority control unit 162 sets the queue of the access queue 17 corresponding to the server 7-1. select. The priority control unit 162 acquires the priority, the registration date and time, and the waiting time of the access information associated with the access ID that is executed first from among the access IDs held in the selected queue. The priority control unit 162 compares the acquired priority with the selected priority (priority of the job to be inserted into the queue). When the selected priority is higher than the acquired priority, the priority control unit 162 compares the time obtained by adding the waiting time to the registration date and the current time. When the time obtained by adding the waiting time to the registration date and time is before the current time, the priority control unit 162 shifts the access ID to be executed first and the order of the target queue subsequent to this access ID one by one. A new access ID is registered at the head of the queue, and the priority, user ID, service name, and service URL notified from the server load monitoring unit 163 in association with the access ID and the current date and time (access queue 17 And the upper limit of a predetermined waiting time, that is, access information is registered.

  On the other hand, if the selected priority is less than or equal to the acquired priority, or if the selected priority is higher than the acquired priority and the time added to the registration date and time is past the current time, The priority control unit 162 acquires the priority, the registration date and time, and the waiting time of the access information associated with the access ID held in the queue next to the compared priority, and selects the acquired priority. The priority selected by comparing the priority and repeating the operation of searching for an access ID in which the selected priority is greater than the acquired priority and the time when the waiting time is added to the registration date and time is before the current time. A job to be newly registered is inserted into the queue before a job having a lower priority than the job and having not yet waited since being registered in the queue. Thereby, the access control process to the access queue 17 in response to the service call request from the client 3 is completed.

  Returning to FIG. 7, the access control apparatus 1 transmits an actual service call request to the server 7 (step S107). Specifically, the real service calling unit 18 of the access control device 1 acquires the access ID registered at the head of the queue of the access queue 17 corresponding to the server 7 and accesses associated with the acquired access ID. Based on the service URL of the information, an actual service call request is transmitted to the server 7.

  Receiving the actual service call request, the server 7 acquires data (result) of the requested actual service (step S108). The server 7 generates an actual service call response including the acquired data (result), and transmits the generated actual service call response to the access control apparatus 1 (step S109).

  The real service call unit 18 notifies the service interface unit 12 of the real service call response received from the server 7 and the user ID of the access information associated with the access ID corresponding to the real service call response via the access control unit 16. To do. Further, the actual service calling unit 18 outputs access information associated with the access ID for the actual service call response received from the server 7 to the access history managing unit 19 via the access control unit 16. Based on the service URL of the access information associated with the acquired access ID, the access ID of the job to be executed next is acquired from the queue of the access queue 17 associated with the server 7 that has transmitted the actual service call response. An actual service call request is transmitted to the server 7.

  On the other hand, the access history management unit 19 executes history information processing for registering access history information in the access history DB 20 based on the access information notified via the access control unit 16 (step S110). Specifically, the access history management unit 19 acquires the current time, and registers the acquired current time as the access date / time in the access history DB 20. The access history management unit 19 associates the service name of the access information, the user ID, the priority, and the service name, user ID, execution priority, and usage load distribution level of the access history DB 20 in association with the registered access date and time. Register the load distribution level.

  The service interface unit 12 generates a service call response including the result of the actual service call response based on the user ID notified via the access control unit 16, and the client 3 indicates the generated service call response by the user ID. (Step S111).

  In this embodiment, the priority control unit 162 registers the access ID in the queue of the access queue 17 based on the priority. However, the load distribution control unit is not used without using the priority definition DB 15. The access IDs may be registered in the order selected by the server load monitoring unit 163 in the queue of the access queue 17 corresponding to the server 7 selected according to the load status from among the accessible server 7 candidates selected by 161. .

  As described above, in this embodiment, the load distribution control unit 161 determines the service name and user ID included in the service call request received from the client, and the user who uses the service name and service held by the server. The load distribution definition DB 13 in which the load distribution level indicating the priority of load distribution to the server is registered in association with the user ID for identification, and the server name to be accessed in association with the service name and the load distribution level are registered. The server load monitoring unit 163 selects a server candidate that can be accessed based on the service distribution information DB 14 and the load distribution level of the service name and user ID requested by the client. Based on the load status of the selected server candidates, the server with the lowest load status Since the access waiting due to the service call request is registered in the queue of the access queue 17 corresponding to the selected server, it becomes possible to distribute the load on the server according to the user and the service to be used. The response time of access to the server 7 can be shortened in consideration of the priority to the user and the load distribution to the server without increasing the number of servers more than necessary.

  Further, in this embodiment, the load distribution definition DB 13 has time zone information for validating the load distribution level, and the load distribution control unit 161 includes the current time within the time zone registered in the load distribution definition DB 13. In this case, the load distribution level is made effective, so it is possible to perform load distribution control based on priority according to time zones as well as users and services to be used, and perform detailed access control. Can do.

  Furthermore, in this embodiment, the priority control unit 162 includes a priority definition DB 15 in which priorities are registered in association with service names and user IDs, and service names and user IDs included in service call requests. Based on the service call request, the priority of the service name and the user ID included in the service call request is acquired, and the access waiting of the priority lower than the priority acquired in the access waiting registered in the queue of the access queue 17 is Since the access waiting due to the service call request is inserted before, priority control for each server 7 to be accessed can be performed, and the response time for access to the server 7 can be shortened.

  Furthermore, in this embodiment, the priority definition DB 15 has information on the time zone in which the priority is valid, and the priority control unit 162 includes the current time within the time zone registered in the priority definition DB 15. In this case, since priority is made effective, it is possible to perform priority control for each server 7 to be accessed not only by the user and the service to be used, but also by time, etc., and detailed access control It can be performed.

  Further, in this embodiment, the priority control unit 162 determines that the access waiting with the priority lower than the priority acquired in the access waiting registered in the queue of the access queue 17 has passed the predetermined waiting time. Since the priority is determined to be higher than the acquired priority when there is, the waiting state is not delayed even if the priority is low after a certain period of time, and the server 7 is more than necessary. It is possible to prevent the response time of access from being increased.

  Furthermore, in this embodiment, it has a service interface definition DB 11 in which information related to an interface for providing a service in association with a service name is registered, and the service interface unit 12 responds to a service interface information acquisition request from a client. Based on the service name and the service interface definition DB 11 included, the client is notified of information about the interface of the requested service, and the actual service calling unit 18 sequentially reads the access waits registered in each queue of the access queue 17. Since the data necessary for the service is acquired from the server 7 and transmitted to the client 3, the server 7 accessed by the client 3 and the server 7 that actually provides the service are separated and operated To enable access control by load distribution by distributing to any server 7, it is possible to shorten the response time for access to the server 7.

  In this embodiment, the priority control means registers the service name, user ID, actually used load distribution level, and actually used priority in association with the access ID as access information. Since the access history management unit 19 registers the access information in the access history DB 20 in association with the date and time when the server 7 is accessed, the service call execution information, the load distribution level used at that time, and It is possible to manage the history of priority information and the like, facilitating billing management and the like.

  As described above, the access control apparatus according to the present invention is useful for controlling access to a server that provides a Web service, and is particularly suitable for a system having a large number of users who use the service.

It is a figure which shows an example of a structure of the network system to which the access control apparatus in this invention is applied. It is a figure which shows the registration item registered into the service interface definition DB shown in FIG. It is a figure which shows the registration item registered into load distribution definition DB shown in FIG. It is a figure which shows the registration item registered into service deployment information DB shown in FIG. It is a figure which shows the registration item registered into the priority definition DB shown in FIG. It is a figure which shows the registration item registered into access history DB shown in FIG. It is a sequence diagram for demonstrating operation | movement of the network system to which the access control apparatus in this invention is applied. It is a flowchart for demonstrating the detailed operation | movement of the service interface information acquisition process which an access control apparatus performs. It is a flowchart for demonstrating the detailed operation | movement of the access control process which an access control apparatus performs.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Access control apparatus 3-1, 3-2, 3-3 Client 5 Network 7-1, 7-2, 7-3 Server 11 Service interface definition DB
12 Service Interface 13 Load Balancing Definition DB
14 Service deployment information DB
15 Priority definition DB
16 Access Control Unit 17 Access Queue 18 Real Service Calling Unit 161 Load Distribution Control Unit 162 Priority Control Unit 163 Server Load Monitoring Unit

Claims (4)

A plurality of servers that are connected to a plurality of servers that hold data related to at least one service, and that are connected to a client that accesses the server and requests a service via a network, and that provide the service requested by the client An access control device that selects one server from among the servers, acquires data related to the requested service from the selected server, and transmits the data to the client;
An access queue having a queue that is associated with each server and registers waiting for access to the server;
User ID, and load balancing definition database load distribution level is registered that indicates the extent of the load distribution to the server that corresponds to the time zone to identify the service name, the user to use the service by the server holds , service deployment information database in which the service name and correspondingly accessible server name to the load distribution level is registered, the service name, the user ID, and the priority corresponding to the time zone is registered Storage means for storing a priority definition database ;
Service name included in the service call request received from the client, based on the user ID, and the current time, before Symbol load distribution level determined from the load balancing application databases included from the service deployment information database to the service call request Load balancing control means for selecting an accessible server candidate corresponding to a service name and a load balancing level equal to or lower than the determined load balancing level ;
If the candidate server selected by the load balancing control means is plural, and the server load monitoring means you select the lowest load status server,
Based on the service name, user ID, and current time included in the service call request, the priority is selected from the priority definition database, and the server load monitoring unit registers the queue in the queue corresponding to the selected server. Priority of inserting an access wait due to the service call request before waiting for an access that is lower than the selected priority and the access wait is equal to or lower than the upper limit value of the predetermined wait time. Control means;
An access control device comprising: In the storage means , a service URL that is a URL storing service data of the service name corresponding to the service name and an interface definition file name that is a name of a file in which information necessary for access is described are registered. Store the service interface definition database
Service interface means for notifying the client of the service URL and interface definition file name of the requested service based on the service name included in the service interface information acquisition request from the client and the service interface definition database;
An actual service calling means for sequentially reading out the access waiting registered in each queue of the access queue, obtaining data necessary for the service from the server, and transmitting the data to the client;
The access control apparatus according to claim 1 , further comprising: The server load monitoring means, or the priority control means,
When registering access waiting in the queue of the access queue, register access information in association with the access waiting,
Access history management means for storing the access information in the storage means as an access history database;
Access control device according to claim 1 or 2, further comprising a. The access information is the service name and user ID included in the service call request , the determined load distribution level, and the selected priority.
The access history management means includes
Registering the access information in the access history database in association with the date and time of accessing the server;
The access control apparatus according to claim 3 .

Images