JP4993083B2 - Session management apparatus, program, and storage medium - Google Patents

Description

  The present invention relates to a session management apparatus that manages session information.

  Conventionally, integrated management using a domain (domain controller) has been proposed as authentication / account management. The user has a unique account on the domain and can access the WEB site under the domain. An account on a domain is not valid in another domain.

It is difficult to integrate all of these into one domain, such as when there are multiple existing WEB site provisioning servers, each of which owns an identity system, or when there are users who use multiple accounts Met.
Therefore, there is a method of performing authentication by identity cooperation between WEB site providing servers instead of the integrated management by domain.

In addition, in order to link different WEB site providing servers, there is an information processing system that uses service session information and places a service cooperation server to generate a task session indicating the cooperation between the WEB site providing servers (for example, [[ (See Patent Document 1].)
In addition, in order to enable a service across different WEB site providing servers, a method for managing a series of operations in a task session with a portal site and managing each WEB site providing server as a thread session. (For example, refer to [Patent Document 2].)
In addition, there is a system that guarantees that the user is an authorized user to the related WEB site by one-time user authentication at the main WEB site and prevents direct access to the sub WEB site without going through the main WEB site. (For example, see [Patent Document 3].)

JP 2006-195791 A JP 2004-178466 A JP 2002-014927 A

  However, when user information is included in the linkage information when accessing the related WEB site, the method of taking over the linkage information on the network is dangerous such as leakage of user information or unauthorized access using the leaked information. There is a problem with safety.

  In addition, WEB site providing servers that are already operated with different identity systems may become one group due to a corporate merger or the like. It is possible to perform authentication linkage by identity linkage between WEB sites. For example, you can log out from the services of all the WEB site providing servers you use, or all WEB where the same user is logged in with different accounts There is a problem that it is difficult to perform integrated management such as logging out from the site providing server or linking sessions.

  Moreover, the system shown in Patent Document 1 uses service session information as information for associating cooperation between WEB site providing servers, instead of user information having a risk of leakage of personal information. However, the system according to Patent Document 1 generates a task session indicating cooperation of service session information by placing a service cooperation server separately. Therefore, the system according to Patent Document 1 has a problem that the introduction of a task session indicating cooperation complicates the system configuration and increases the processing load of the entire system.

  The method shown in Patent Document 2 is for a portal site to manage a predetermined set of web services including processing procedures, and it is not assumed that a user arbitrarily accesses a related WEB site. There is a problem.

  In the conventional example and the system shown in the above patent document, when the same user logs in to the same WEB site providing server using a plurality of different accounts, the WEB site management side recognizes it as a different user. was there. Therefore, management with a sense of unity is difficult even though the same user is accessing.

  The present invention has been made in view of the above problems, and an object of the present invention is to provide a session management apparatus capable of controlling processing related to a service in units of users when each user uses a plurality of services. To do.

  In order to achieve the above-described object, the first invention is provided between at least one information providing server that provides various types of information and at least one terminal device that is connected to the information providing server via a network and belongs to a user. A session management apparatus that manages a session that is a communication unit of the user, and when the user accesses the information providing server from the terminal device, a unique first session ID for each user and the information providing server provide Session ID creation means for creating a unique second session ID for each service to be performed; session ID transmission means for sending the first session ID and the second session ID to the terminal device of the user that is the access source; One session ID and at least one second session ID are associated with each other Session registration means for registering as session management information, second session ID search means for searching for the second session ID corresponding to the first session ID with reference to the session management information, and all the searched And a batch processing unit configured to collectively perform predetermined processing for the session indicated by the second session ID.

The first session ID (user session ID) is an identification ID created for each user. When the user logs in to the information providing server once from the terminal device and accesses with a different account, the first session ID is not created because the first session ID has already been created for the user.
The second session ID (service session ID) is an identification ID created for each service provided by the information providing server. The second session ID is created every time the user logs in to the service provided by the information providing server from the terminal device.
The account is a user ID for logging in systematically. One user may have a plurality of accounts for the same information providing server.

  When the user accesses the information providing server from the terminal device, the session management device according to the first aspect of the invention provides a unique first session ID for each user and a unique second session ID for each service provided by the information providing server. Create The session management device sends the first session ID and the second session ID to the access source terminal device, and registers the first session ID and the second session ID in association with each other as session management information. The session management apparatus refers to the session management information, searches for the second session ID corresponding to the first session ID, and collectively performs predetermined processing for the sessions indicated by all the searched second session IDs.

  When a predetermined process is requested for a session indicated by one second session ID corresponding to the first session ID, the session management apparatus performs the predetermined process for sessions indicated by all the second session IDs corresponding to the first session ID. Do it all at once. The predetermined process is, for example, a collective logout process from the information providing server.

The session management device according to the first aspect of the invention can perform batch processing for all sessions indicated by a plurality of second session IDs associated with the first session ID. For example, collective processing (for example, collective logout) can be performed for all operations in which the same user logs in with a plurality of different accounts.
Thereby, a user's work efficiency and operativity can be improved.

In addition, the session management device collates the first session ID and the second session ID sent from the user terminal device with the registered first session ID and second session ID, in the user information providing server. The usage authority may be determined.
Further, the session management apparatus may restrict or disable the use authority of the user in the information providing server when the collation result of the first session ID or the second session ID is not appropriate.
Thereby, since the information management server discriminates the user who has the right to use, the session management device can prevent unauthorized access, information leakage, etc., and ensure safety.

In the session management device, the session ID transmission unit may record the first session ID in cookie information that can be referred to by the information providing server and cause the terminal device to hold the first session ID.
In the session management apparatus, the session ID transmission unit may record the second session ID in a parameter of net position information such as a URL (Uniform Resource Locator) and send it to the terminal apparatus.

The second invention is a program for causing a computer to function as the session management device of the first invention.
A third invention is a computer-readable recording medium on which a program for causing a computer to function as the session management device of the first invention is recorded.

  ADVANTAGE OF THE INVENTION According to this invention, when each user uses a some service, the session management apparatus which can control the process regarding the said service per user can be provided.

  Hereinafter, a preferred embodiment of a session management apparatus according to the present invention will be described in detail with reference to the accompanying drawings. In the following description and the accompanying drawings, the same reference numerals are given to components having substantially the same functional configuration, and redundant description will be omitted.

(1. Configuration of session management system 1)
First, the configuration of the session management system 1 will be described with reference to FIG.
FIG. 1 is a configuration diagram of the session management system 1.
The session management apparatus according to the present invention is a session management server that manages a session of an information providing server in the session management system 1.

  The session management system 1 is configured by connecting a terminal device 5 and a server (A1) 11-1, an information providing server, a server (A2) 11-2,. Further, a plurality of terminal devices 5 and servers may be connected.

  The terminal device 5 belongs to the user 3. The server (A1) 11-1, the server (A2) 11-2,... Belong to the business operator (A1) 9-1, the business operator (A2) 9-2,. The business operator (A1) 9-1, the business operator (A2) 9-2,... Are in a partnership relationship as a group A13, and the terminal device 5 includes a server (A1) 11-1 and a server (A2) 11-2. It is possible to access (screen transition) between WEB sites provided by... As if they were provided by a single server.

  That is, when the user 3 logs in to any of the servers A11 (server (A1) 11-1, server (A2) 11-2,...) Belonging to the group A13, all the servers A11 seem to be integrated into one WEB. A site providing server is configured, and the user 3 is equivalent to logging in and using this single WEB site providing server.

  The session management server 15 manages session information that is information related to access of all the servers A11 in the group A13.

Next, the configuration of the session management system 1 will be described in more detail with reference to FIG.
FIG. 2 is a diagram showing the configuration of the session management system 1 in detail.

(1-1. Configuration of Terminal Device 5)
The terminal device 5 is a device such as a computer that can be connected to the server A 11 and the session management server 15 via the network 7.

The terminal device 5 includes a WEB page request unit 25 and a WEB page display unit 27. The WEB page request means 25 is a means for requesting a WEB page from the server A11 of the provider that provides the WEB page. The WEB page display means 27 is a means for displaying the WEB page 55 provided from the server A11.
The terminal device 5 receives and stores the session information 23 (FIG. 4) related to the session provided together with the WEB page 55. Details of the session information 23 will be described later.

(1-2. Configuration of Session Management Server 15)
The session management server 15 includes session acquisition means 33, session collation means 35, user session ID creation means 43, service session ID creation means 45, session registration means 47, user batch processing means 49, and session management information 37 and the like in the storage unit. A computer or the like.

  The session management server 15 registers and manages session information related to all servers A11 in the session management information 37 (FIG. 5). The session management server 15 acquires the user session ID 29 and the service session ID 31 sent from the terminal device 5, and transmits the user session ID 29 and the service session ID 31 to the terminal device 5.

The session acquisition unit 33 acquires information (user session ID 29, service session ID 31) related to a session sent from the terminal device 5 together with the WEB page request.
The session collation unit 35 collates the information regarding the session acquired by the session acquisition unit 33 with the registration information of the session management information 37 (FIG. 5).

The user session ID creation unit 43 creates a user session ID 29 that is unique identification information for each user 3. For creating the user session ID 29, identification information (for example, a user ID) related to the user may be used.
The service session ID creating unit 45 creates a service session ID 31 that is unique identification information for each service that the user 3 logs in from the terminal device 5.
The session registration unit 47 registers the created user session ID 29 and service session ID 31 in the session management information 37.
Details of the session management information 37 will be described later.
The user batch processing means 49 performs batch processing for accounts having the same user session ID 29.

(1-3. Configuration of Server A11)
The server A11 is a device such as a computer having user authentication means 39, WEB page creation means 51, and user information 41, content information 53, and the like in a storage unit.
The user authentication means 39 checks the authentication information (user ID, password, etc.) sent from the terminal device 5 with the user information 41 (FIG. 6), and determines whether or not the user 3 of the terminal device 5 is a valid user. Certify.
The WEB page creation means 51 takes out the corresponding content from the content information 53 and creates a WEB page 55. The content information 53 is content such as characters, numerical values, video, images, and audio.

(2. Hardware configuration)
Next, the hardware configuration of the terminal device 5, the server A11, and the session management server 15 will be described with reference to FIG.
FIG. 3 is a hardware configuration diagram of the terminal device 5, the server A 11, and the session management server 15. Note that the hardware configuration shown in FIG. 3 is merely an example, and various configurations can be adopted depending on the application and purpose.

  The terminal device 5, the server A11, and the session management server 15 are configured by connecting a CPU 151, a memory 153, a storage unit 155, a display unit 157, an input unit 159, an output unit 161, and a communication unit 163 via a system bus 165. The

  A CPU 151 (Central Processing Unit) is an arithmetic device (four arithmetic operations, comparison operations, etc.), and a device that performs hardware and software operation control.

  The memory 153 is a memory such as a RAM and a ROM. A RAM (Random Access Memory) stores a ROM (Read Only Memory), an OS (Operating System) program read from the storage unit 155, an application program, and the like. The RAM functions as a main memory and work area for the CPU 151.

  The storage unit 155 is a device that stores various data, and is, for example, a hard disk. The storage unit 155 stores programs executed by the CPU 151, data necessary for program execution, an OS, various databases, and the like.

  The display unit 157 is a display device, such as a CRT monitor or a liquid crystal panel. The display unit 157 includes a logic circuit (such as a video adapter) for realizing the video function of the computer.

  The input unit 159 is an input device for various data, such as a keyboard and a mouse. The output unit 161 is an output device for various data, for example, a printer. Drive devices that perform data input / output with various media can also be used as the input unit 159 and the output unit 161.

The communication unit 163 is a communication control device that connects and communicates with an external device via the network 165. For example, Internet communication using TCP / IP is possible.
The system bus 165 is a path that mediates transmission / reception of control signals, data signals, and the like between the devices.

  The terminal device 5, the server A 11, and the session management server 15 load a program (application program, OS program, etc.) stored in the storage unit 155, ROM, or storage medium into the RAM of the memory 153 to control the CPU 151. Various processes are executed below.

(3. Configuration of Session Information 23, Session Management Information 37, and User Information 41)
(3-1. Session information 23)
Next, the session information 23 held by the terminal device 5 will be described with reference to FIG.
FIG. 4 is a diagram illustrating an example of the configuration of the session information 23.
Information regarding the session sent together with the WEB page 55 provided by the server A11 is stored as the session information 23 in the storage unit 155 of the terminal device 5.

  The session information 23 includes items such as a user session ID 61, a service session ID 63, an expiration date 67, and an account 69. The user session ID 61 and the service session ID 63 store the user session ID 29 and the service session ID 31 sent together with the WEB page 55 from the server A 11, and the expiration date 67 stores the expiration date of the user session ID 29 and the service session ID 31. The In the item of account 69, the account of the user 3 who has logged into the server A11 from the terminal device 5 (for example, “user1 @ A1” (record 201)) is stored.

  The expiration date 67 is updated every time the terminal device 5 accesses the server A11. When the expiration date 67 elapses, the user session ID 29 and the service session ID 31 are invalidated.

(3-2. Session management information 37)
Next, the session management information 37 held by the session management server 15 will be described with reference to FIG.
FIG. 5 is a diagram illustrating an example of the configuration of the session management information 37.
The session management information 37 is information related to a session stored in the storage unit 155 of the session management server 15 of the group A13.

  The session management information 37 includes items such as a user session ID 61, a service session ID 63, an expiration date 67, and an account 69. In the items of the user session ID 61 and the service session ID 63, a user session ID 29 and a service session ID 31 generated by the session management server 15 when the user 3 logs in to the group A13 (any one of the servers A11) from the terminal device 5 are stored. The expiration date 67 stores the expiration dates of the user session ID 29 and the service session ID 31.

  In the item of the account 69, an account (for example, “user1 @ A1” (record 204)) of the user 3 logged in to the group A13 (any one of the servers A11) is stored.

The expiration date 67 is updated each time the user 3 accesses any of the servers A11 by the terminal device 5. When the expiration date 67 elapses, the user session ID 29 and the service session ID 31 are invalidated.
The value of the user session ID 61 is unique for each user 3. Further, the value of the service session ID 63 is unique for each service (account 95) to be provided.

(3-3. User information 41)
Next, the user information 41 held by the server A11 will be described with reference to FIG.
FIG. 6 is a diagram illustrating an example of the configuration of the user information 41.
The user information 41 is information about the user stored in the storage unit 155 of the server A11.

The user information 41 has items such as an account 69 and a password 71. Detailed information (name, address, transaction information, etc.) regarding the user 3 may be stored in the user information 41 for each account 69, but description thereof is omitted here.
In the item of account 69, an account (user ID) when the user 3 logs in to the server A11 is stored. The same user 3 may have a plurality of accounts (user IDs) for the same server A11.
In the item of the password 71, an identification ID for performing user authentication with both an account (user ID) is stored.

(4. Operation of session management system 1)
Next, the operation of the session management system 1 will be described with reference to FIGS. In addition, the screen displayed on the display unit 157 of the terminal device 5 will be described with reference to FIGS.
The terminal device 5 receives content from the server A11 based on the operation of the input unit 159 by the user 3. The terminal device 5 displays the screen A provided from the server A11 on the display unit 157.

(4-1. Session management during login)
FIG. 7 is a flowchart showing session management when the session management server 15 logs in.
A top screen 301 (FIG. 10) is displayed on the display unit 15 of the terminal device 5. The top screen 301 is, for example, a screen of a predetermined WEB site provided by a securities company or the like. The terminal device 5 makes a login request to the server A11 (group A13) via the top screen 301.

FIG. 10 is a diagram showing a top screen 301 provided by the server A11.
When an account (user ID) and password are input on the top screen 301 and the “login request button” 73 is clicked, a login request is transmitted from the terminal device 5 to the server A11 and the session management server 15 (step 1001).

  If the terminal device 5 has already logged in to the server A11 using another account (user ID), a unique user session ID 29 has already been created for each user 3 by the server A11. Simultaneously with the login, the user session ID 29 is also sent to the server A11.

  The user authentication means 39 of the server A11 compares the account (user ID) and password sent from the terminal device 5 with the values registered in the user information 41 (FIG. 6), and performs user authentication (step 1002).

  The session acquisition unit 33 of the session management server 15 acquires session information sent from the terminal device 5, and the session verification unit 35 determines whether or not the acquired user session ID 29 has been registered with the session management information 37 (FIG. 5). Match.

  If the user session ID 29 has not been sent from the terminal device 5 or if the sent user session ID 29 has not been registered or is not valid (NO in step 1003), the user session ID creation means 43 newly creates a user session. ID 29 is created (for example, user session ID 29 “US01”), and session registration means 47 registers it in session management information 37 (step 1004).

  If the user session ID 29 has been registered and is valid (within the expiration date) (YES in step 1003), or if a new user session ID 29 is created and registered in step 1004, the service session ID creation means 45 is newly created. A service session ID 31 is created (for example, service session ID 31 “SS11”), and the session registration unit 47 registers it in the session management information 37 (step 1005). The session registration unit 47 registers the expiration date 67 of the service session ID 31 and the user account 69 (for example, “user1 @ A1”) in the session management information 37 at the same time.

The WEB page creation means 51 of the server A11 creates a WEB page 55 by extracting the content from the content information 53 and sends it to the terminal device 5 (step 1006). The server A11 sends the service session ID 31 to the terminal device 5 together with the WEB page 55. Further, a user session ID 29 may be sent.
The terminal device 5 displays the WEB page (server A provision screen (1) 302) on the display unit 157 (step 1007).

FIG. 11 is a diagram showing a server A providing screen (1) 302 provided by the server A11.
The server A provided screen (1) 302 (FIG. 11) is a screen displayed when the user 3 logs in to the server (A1) 11-1 from the terminal device 5 with the account “user1 @ A1”.

On the server A provision screen (1) 302, buttons and links for accessing a WEB site provided by the server A11 and other related servers are displayed.
For example, the “market price information” button 75 is an access button to a market price information screen provided by another related server.

  The terminal device 5 stores the user session ID 29 and the service session ID 31 sent together with the WEB page 55 in the session information 23 (step 1008).

  FIG. 12 shows a screen in which the user 3 logs into the server (A1) 11-1 from the terminal device 5 using an account “user2 @ A1” different from the account “user1 @ A1”. When the account (user ID) “user2 @ A1” and the password are input on the server A providing screen (2) 303 (FIG. 12) and the login button 73 is clicked, the user 3 uses the account “user2 @ A1” as the server. (A1) It is possible to log in to 11-1.

  In this case, the user session ID 29 is already registered in the session management information 37 (FIG. 5) when logging in with the account “user1 @ A1”. Accordingly, only a new service session ID 31 “SS12” is created and registered as the record 205 (FIG. 5) of the session management information 37.

  FIG. 13 shows a screen in which the user 3 uses the server (A1) 11-1 from the terminal device 5 with both the accounts “user1 @ A1” and “user2 @ A1”. The server (A1) 11-1 side grasps that the same user 3 is logged in because the values of the user session ID 29 corresponding to the two accounts “user1 @ A1” and “user2 @ A1” are the same. To do.

  Through the above process, the session management server 15 creates a new service session ID 31 for each service (for each service account) provided by the server A11 when the user 3 requests a login from the terminal device 5 to the server A11 of the group A13. And register. If the user session ID 29 is not registered, the session management server 15 newly creates and registers a user session ID 29.

  As described above, since the session management server 15 creates a unique user session ID 29 for each user 3, the user session ID 29 can be used for integrated processing for each user 3. When the terminal device 5 of each user 3 uses a plurality of services of the server 11, the session management server 15 can control processing related to the service for each user.

  For example, as in the record 204 and record 205 of the session management information 37 (FIG. 5), even if the value of the account 69 is different, the value of the user session ID 61 is the same. I understand. In addition, the record 206 logged into the different server A11 (server (A2) 11-2) in the group A13 with the account 69 “foo @ A2” also has the same user session ID 61 value as the records 204 and 205. Thus, it can be seen that the access is from the same user 3.

  In addition, since the session management server 15 creates a unique service session ID 31 for each service (for each service account), it can be used for integrated processing for each service that provides the service session ID 31.

  In addition, the session management server 15 uses the user session ID 29 and the service session ID 31 in combination as session information, so that appropriate use according to the scene, such as integrated management for each user or management for each service, is possible. is there. As will be described later, when linking to other related WEB sites, it is possible to ensure safety against information leakage by using only the service session ID 31 as linkage information.

(4-2. Session management when updating WEB pages)
FIG. 8 is a flowchart showing session management when the WEB page of the session management server 15 is updated. The update of the WEB page indicates a re-display of the WEB page, a screen movement to another WEB page, or the like.
After logging in to the server A11, the terminal device 5 requests a web page update request provided by the server A11 or a web page provided by any server A11 belonging to the group A13 (step 2001). For example, when the “order” request button 76 is clicked on the server A provision screen (1) 302 of FIG. 11, a web page related to the order is requested.

  The terminal device 5 sends the user session ID 29 and the service session ID 31 sent from the server A11 after login to the server A11 and the session management server 15 together with the WEB page request.

The session acquisition unit 33 of the session management server 15 acquires a session, and the session verification unit 35 collates the user session ID 29 sent from the terminal device 5 of the user 3 with the service session ID 31 based on the session management information 37 ( Step 2002). When the validity including the expiration date of the user session ID 29 and the service session ID 31 is authenticated, the WEB page creation means 51 of the server A11 creates a WEB page 55 and sends it to the terminal device 5 (step 2003). The session management server 15 updates the corresponding expiration date 67 of the session management information 37.
FIG. 14 shows a server A providing screen 305 that is a WEB page related to an order. The information display 79 displays information related to orders.

  Through the above process, the user 3 sends the user session ID 29 and the service session ID 31 to the session management server 15 when making a WEB page request from the terminal device 5 to any server A11 in the group A13. The session management server 15 authenticates the validity of the user session ID 29 and the service session ID 31 based on the session management information 37, and then sends the WEB page 55 to the terminal device 5 together with the user session ID 29 and the service session ID 31 whose expiration date has been updated. send.

  As described above, the session management server 15 is a user issued at the time of login when the terminal device 5 logged in to any server A11 in the group A13 requests WEB page display or update provided by any server A11. Authentication of both session ID 29 and service session ID 31 is requested.

  Therefore, for example, by using the service session ID 31 leaked from the terminal device 5, unauthorized access from the terminal device trying to use any server A <b> 11 of the group A <b> 13 can be prevented.

  In the screen transition between different servers A11, the login process can be performed in each server A11, but the login process may not be performed in consideration of operability. In this case, instead of holding the user information 41 for each server A11, the user information 41 may be centrally managed by the session management server 15.

(4-3. Session management during batch logout processing)
FIG. 9 is a flowchart showing session management when the user 3 is logged in and logged out collectively from all WEB pages provided by the server A11.
The user 3 logs in to the WEB page provided by the server A11 with a plurality of accounts by the terminal device 5. When the user 3 logs in to the server (A1) 11-1 with a plurality of accounts “user1 @ A1”, “user2 @ A1”, and “foo @ A2”, for example, the screen shown in FIG. (In FIG. 13, it is assumed that the screen by the account “foo @ A2” is not displayed).

  At this time, the record 201 by the account “user1 @ A1”, the record 202 by the account “user2 @ A1”, and the record 203 by the account “foo @ A2” are stored in the session information 23 (FIG. 4) of the terminal device 5. . The session management information 37 (FIG. 5) of the session management server 15 stores a record 204 by the account “user1 @ A1”, a record 205 by the account “user2 @ A1”, and a record 206 by the account “foo @ A2”. The

  The user 3 makes a logout request to the server A11 through the terminal device 5 (step 4001). For example, the “logout” request button 77 is clicked on the server A providing screen (1) 302 (FIG. 13) provided by the server (A1) 11-1 displayed on the terminal device 5.

  The terminal device 5 sends the user session ID 29 and the service session ID 31 to the session management server 15 of the server A11. The session management server 15 collates the user session ID 29 and the service session ID 31 (step 4002).

  That is, the user session ID 29 “US01” and the service session ID 31 “SS11” related to the account “user1 @ A1” and the service session ID 31 “SS11” are sent from the terminal device 5 and the record 204 of the session management information 37 is collated.

  The session management server 15 searches for the item of the service session ID 63 having the same user session ID 29 value as the user session ID 29 “US01” of the record 204, and extracts the record 204, the record 205, and the record 206 (step 4003).

  The user batch processing means 49 of the session management server 15 uses the accounts 69 “user1 @ A1”, “user2 @ A1”, “foo” corresponding to all the records (record 204, record 205, record 206) of the searched service session IDs 63. Logout processing is performed for “@ A2” (step 4004).

  FIG. 15 shows a server A providing screen 306 provided from the server (A1) 11-1 to the terminal device 5 after the collective logout processing from the server A11 is completed. On the server A provision screen 306, for example, all the logged-out accounts “user1”, “user2”, and “foo” are displayed.

  For example, it is assumed that the “order” request button 81 on the server A providing screen 304 by the account “user2 @ A1” whose display remains in FIG. 15 is clicked. Since the account “user2 @ A1” has already been logged out by the collective logout process described above, a screen for notifying that logout has been completed is displayed.

  FIG. 16 is a server A providing screen 307 that notifies the terminal device 5 that the account “user2 @ A1” has been logged out. The user 3 can log in to the server A11 again by inputting authentication information (user ID and password) on the server A providing screen 307 in FIG.

  Through the above process, when the user 3 requests the terminal device 5 to log out from the WEB page provided by the server A11, the session management server 15 of the server A11 corresponds to the user session ID 29 registered in the session management information 37. All service session IDs 31 to be searched are searched. The session management server 15 performs collective logout processing for all accounts corresponding to all the searched service session IDs 31.

Thus, when the user 3 is logged in to the same WEB site with a plurality of accounts, it is possible to log out from all accounts at once by making a logout request with one account. That is, the session management server 15 can perform batch processing (for example, logout processing) for each user, and can improve the work efficiency and operability of the user 3.
It is also possible to select not to perform batch processing for each user.

(5. Succession of user session ID 29 and service session ID 31)
The takeover of the user session ID 29 and the service session ID 31 is not limited as long as the user session ID 29 and the service session ID 31 can be transmitted and received together with the WEB page request (request) and the WEB page transmission (response). For example, in a WWW (World Wide Web) system, it may be recorded in cookie information or a URL (Uniform Resource Locator) parameter for transmission / reception. In addition, when recording in a URL parameter, it may be embedded in a link on a WEB page.

  In a browser application that displays a WEB page, cookie information is usually overwritten each time an information providing server under the management of one session management server is accessed. On the other hand, URL parameters are easy to refer to.

The user session ID 29 is not desirably referred to by a group site other than the group A13. Therefore, it is desirable to record in the cookie information of the browser instead of the URL parameter. The user session ID 29 is unique for each user 3, and there is no problem even if the cookie information is overwritten with the same value.
On the other hand, since a service session ID 31 may be assigned for each service (for each service account) provided to one user 3, there is a possibility that if the service session ID 31 is recorded in cookie information, it is overwritten with a different value. is there. Therefore, it is desirable to record in URL parameters. Since only the service session ID 31 without the user session ID 29 restricts or disables the authority to use the server A 11, even if the user session ID 29 is referred to by a third party, it is possible to prevent the security effect. .

(6. Effects, etc.)
As described above in detail, in the session management system 1 according to the embodiment of the present invention, the user session ID 29 and the service session ID 31 are used according to the scene, thereby improving customer convenience and preventing information leakage. Safety can be ensured.

  In the group A13 that collates both the user session ID 29 and the service session ID 31 and permits the use of the service, only the service session ID 31 is used as linkage information when linking to other servers. Therefore, it is possible to secure safety against unauthorized use of the group A13.

  In addition, since the service session ID 31 is uniquely created for each provided service (for each service account at the time of login), the service session ID 31 is used as linkage information when returning to the original server again by linking to another server. By taking over, you can return to the original server with the account when linked to other servers. Therefore, confusion of the user 3 can be reduced and operability can be improved.

  Further, when each user 3 uses a plurality of services of the server 11, processing related to the service can be controlled in units of users. When the same user 3 logs in to the server A11 of the group A13 with a different account, the same user session ID 29 is created. Therefore, integrated management such as batch processing for each user can be performed using the user session ID 29. For example, as a batch process, a batch logout from the same WEB site can be performed for each user. This improves the convenience of the user 3 and improves work efficiency and operability.

  The preferred embodiments of the session management system according to the present invention have been described above with reference to the accompanying drawings, but the present invention is not limited to such examples. It will be apparent to those skilled in the art that various changes or modifications can be conceived within the scope of the technical idea disclosed in the present application, and these are naturally within the technical scope of the present invention. Understood.

Configuration diagram of session management system 1 Detailed configuration diagram of session management system 1 The figure which shows the hardware constitutions of the session management server 15, server A11, and the terminal device 5. The figure which shows the session information 23 (terminal device 5) The figure which shows the session management information 37 (session management server 15) The figure which shows the user information 41 (server A11) Flowchart showing session management at the time of login of the session management server 15 A flowchart showing session management when the WEB page of the session management server 15 is updated. Flow chart showing session management when the terminal device 5 logs out collectively The figure which shows the top screen 301 which server A11 provides The figure which shows the server A provision screen (1) 302 The figure which shows the server A provision screen 302,303 The figure which shows the server A provision screen 302,304 The figure which shows the server A provision screen 305 The figure which shows the server A provision screen 304,306 The figure which shows the server A provision screen 307

Explanation of symbols

1 ......... Session management system 3 ......... User 5 ......... Terminal device 7 ......... Networks 9-1, 9-2,...
11-1, 11-2, ... Server A
13 ... Group A
15... Session management server 23... Session information 25... WEB page request means 27... WEB page display means 29 and 61.
31, 63 ... Service session ID
33 ......... Session acquisition means 35 ......... Session verification means 37 ......... Session management information 39 ......... User authentication means 41 ......... User information 43 ......... User session ID creation means 45 ......... Service session ID Creation means 47 ......... Session registration means 49 ......... User batch processing means 51 ......... Web page creation means 53 ......... Content information 55 ......... Web page 67 ......... Expiration date 69 ......... Account 73 ... …… “Login” request button 75 ...... “Market price information” button 76 ...... “Order” request button 77 ...... “Logout” request button 79 …… Information display 81 …… Order button 151 …… CPU
153 ......... Memory 155 ......... Storage unit 157 ......... Display unit 159 ......... Input unit 161 ......... Output unit 163 ......... Communication unit 201-208 ......... Record 301 ......... Top screen 302- 307 ……… Screen A

Claims (7)

A session management device that manages a session as a communication unit between at least one information providing server that provides various types of information and at least one terminal device that is connected to the information providing server via a network and belongs to a user. And
A session for creating a unique first session ID for each user and a unique second session ID for each service provided by the information providing server when the user accesses the information providing server from the terminal device ID creation means;
Session ID transmission means for transmitting the first session ID and the second session ID to the terminal device of the user who is the access source;
Session registration means for registering one first session ID and at least one second session ID in association with each other as session management information;
A second session ID search means for searching for the second session ID corresponding to the first session ID with reference to the session management information;
Batch processing means for collectively performing predetermined processing for the sessions indicated by all of the searched second session IDs;
A session management apparatus comprising:   When the predetermined processing is requested for the session indicated by one second session ID corresponding to the predetermined first session ID, the batch processing means all the second session IDs corresponding to the predetermined first session ID. The session management apparatus according to claim 1, wherein the predetermined processing is collectively performed for the session indicated by. The information providing server of the user by collating the first session ID and the second session ID sent from the terminal device of the user with the registered first session ID and the second session ID Session verification means for determining usage authority in
The session management apparatus according to claim 1, further comprising: The session verification unit restricts or disables the use authority of the user in the information providing server when a verification result of at least one of the first session ID and the second session ID is not appropriate. The session management device according to claim 3 . The session management device according to any one of claims 1 to 4, wherein the session ID transmission unit records the second session ID in a parameter of net position information and transmits the parameter to the terminal device.   A program for causing a computer to function as the session management device according to any one of claims 1 to 5. A computer-readable recording medium having recorded thereon a program that causes the computer to function as the session management device according to any one of claims 1 to 5.

Images