JP5183681B2 - Program and method for returning security token - Google Patents

Description

  The present invention relates to a program and a method for returning a security token.

  In recent years, with the spread of the Internet and the like, users can easily access convenient services by accessing the Internet or the like from a terminal. A user inputs user information when using such a service, and can use the service after user authentication is performed by the service providing side. Here, the user authentication is performed by various levels and methods such as a session ID, a user ID and a password.

  Such a service provided by the Internet or the like may be provided as a so-called Web service (web service). For example, a Web service that provides a complicated purchase order transaction is provided by cooperation between an ordering service by a Web server on the ordering company side and an order fulfillment service by one or more Web servers of the business partners. . Such a Web service applies Internet-related technologies such as HTTP (HyperText Transfer Protocol), and transmits and receives XML (Extensible Markup Language) format technology called SOAP (Simple Object Access Protocol). The When a plurality of Web servers execute processing requested from a user's terminal in cooperation with each other, the Web server that first receives the request receives the above-described user authentication when calling a function of another Web server that cooperates. The information for is included in the http header and transmitted.

  Here, a conventional user authentication process in a Web service by cooperation of a plurality of Web servers will be described with reference to the drawings. FIG. 4 is a diagram for explaining a conventional process related to user authentication between a plurality of linked Web servers 900. In FIG. 4, for example, the Web server 900a receives a Web service request from the terminal 50 using the http protocol, and executes the Web service program. The Web server 900a transmits a Web service request to the other Web server 900b that cooperates by using the http protocol. Then, the Web server 900b that needs to authenticate the user transmits a security token acquisition request, which is user authentication information, to the authentication issuing server 910, and receives the authenticated security token from the authentication issuing server 910. Next, the Web server 900b executes a process (for example, API (Application Programming Interface)) for calling a function of the other Web server 900c using the http protocol. Similarly, the Web server 900f that needs to authenticate the user transmits a security token acquisition request to the authentication issuing server 910 and receives the authenticated security token from the authentication issuing server 910.

  In such user authentication, Patent Document 1 that discloses an authentication system that can easily use an authentication server in common for a plurality of services is known. In the authentication system disclosed in Patent Literature 1, when a Web service server receives access from a client that has not completed necessary user authentication, redirect request information that requests the client to access the authentication server The authentication server performs user authentication of the client when accessed from the client, and transmits information indicating that the user authentication is successful when the user authentication is successful to the client. Therefore, other Web service servers and the like can use information indicating that the user authentication is successful, so that the authentication function of the authentication server can be shared by a plurality of services.

Japanese Patent Laid-Open No. 11-282804

  The authentication system disclosed in Patent Document 1 can use already authenticated user information in the case of a Web service that accepts a service request from a client. However, the technique disclosed in Patent Document 1 is not related to a Web service system in which a plurality of Web servers process in response to a processing request from a user terminal. Further, when the web server calling relationship as shown in FIG. 4 has two or more branches, AP # 1.3 of the web server 900f is once authenticated by the authentication issuing server 910. Since the security token received from the server cannot be received, it is necessary to access the authentication issuing server 910 again to receive the security token.

  Therefore, there is a need for a program and method that can perform efficient authentication in a Web service by a plurality of Web servers that cooperate with each other.

  It is an object of the present invention to provide a program and a method for returning a security token so that efficient authentication can be performed in a Web service by a plurality of Web servers that cooperate with each other.

  The present invention provides the following solutions.

  (1) A program for sequentially transferring security tokens between a plurality of Web servers linked via a communication network, and responding to a request from a terminal to a first Web server included in the plurality of Web servers A terminal communication protocol for sending out data for each terminal is processed as a protocol for transmitting a data request to a second Web server included in the plurality of Web servers, and a pseudo terminal request transmission step is executed. In response to receiving the data request from the first Web server, the security token is processed as a return protocol of the security token to the first Web server. A program for executing a pseudo-terminal reply step for replying.

  According to the configuration of (1), the program according to the present invention includes a plurality of terminal communication protocols that distribute data for each terminal in response to a request from the terminal to a first Web server included in the plurality of Web servers. A security token in response to receiving the data request from the first Web server by causing the second Web server to process and transmit the data request to the second Web server included in the Web server. The terminal communication protocol is processed as a security token return protocol to the first Web server and returned.

  That is, the program according to the present invention causes the first Web server to process and transmit the terminal communication protocol as a protocol for transmitting a data request to the second Web server, and causes the second Web server to transmit the first communication protocol. In response to receiving the data request from the Web server, the security token is written in the cookie information field of the http header in the terminal communication protocol and returned. In this way, when returning a result from the call destination Web server to the call source Web server, the program according to the present invention uses the HTTP header in the terminal communication protocol to store the security token held in a series of API call sessions. Write in the cookie information field. As a result, even when the web server call relationship as shown in FIG. 4 is branched and has two or more branches, the subsequent branched web server has not received another web server in the preceding branch until then. The received security token can be received reliably. Therefore, the program according to the present invention can cause the Web server to perform efficient authentication by returning a security token in a Web service by a plurality of linked Web servers.

  (2) A program for sequentially transferring security tokens between a plurality of Web servers that cooperate via a communication network, in response to a request from a terminal to a second Web server included in the plurality of Web servers A pseudo-terminal request receiving step for processing and receiving a terminal communication protocol for distributing data for each terminal as a protocol for receiving a data request from a first Web server included in the plurality of Web servers; and the first Web In response to receiving the data request from a server, a pseudo-terminal reply step of processing and returning the security token as a return protocol of the security token to the first Web server as the terminal communication protocol; A program that executes

  According to the configuration of (2), the program according to the present invention includes a plurality of terminal communication protocols that distribute data for each terminal in response to a request from the terminal to a second Web server included in the plurality of Web servers. In response to the reception of the data request from the first Web server, the security token, the terminal communication protocol, It is processed and returned as a security token return protocol to the first Web server.

  That is, the program according to the present invention causes the second Web server to process and receive the terminal communication protocol as a protocol for receiving a data request from the first Web server, and receives the data request from the first Web server. In response, the security token is written in the cookie information field of the http header in the terminal communication protocol and returned. In this way, when returning a result from the call destination Web server to the call source Web server, the program according to the present invention uses the HTTP header in the terminal communication protocol to store the security token held in a series of API call sessions. Write in the cookie information field. As a result, even when the web server call relationship as shown in FIG. 4 is branched and has two or more branches, the subsequent branched web server has not received another web server in the preceding branch until then. The received security token can be received reliably. Therefore, the program according to the present invention can cause the Web server to perform efficient authentication by returning a security token in a Web service by a plurality of linked Web servers.

  (3) causing the second Web server to further execute a step of receiving response data from a third Web server included in the plurality of Web servers called by the http protocol, and in the pseudo terminal reply step, When the second Web server includes the security token in the header of the received response data, the security token is read from the header, and the second Web server is called by the http protocol. The program according to (2), in which the read security token is written in a cookie information field of an http header by a cookie information transmission function, and is returned to the first Web server.

  According to the configuration of (3), the program according to (2) causes the second Web server to receive response data from the third Web server included in the plurality of Web servers called by the http protocol, When the security token is included in the header of the response data received in the second Web server, the security token is read from the header, and the second Web server is called to the first Web server using the http protocol. The read security token is written in the cookie information field of the http header by the cookie information transmission function, and is returned to the first Web server.

  Therefore, the program according to (3) can cause the Web server to perform efficient authentication by returning a security token in a Web service by a plurality of Web servers that cooperate with each other.

  (4) A method for sequentially transferring security tokens between a plurality of Web servers that cooperate via a communication network, and responding to a request from a terminal to a first Web server included in the plurality of Web servers A terminal communication protocol for sending out data for each terminal is processed as a protocol for transmitting a data request to a second Web server included in the plurality of Web servers, and a pseudo terminal request transmission step is executed. In response to receiving the data request from the first Web server, the security token is processed as a return protocol of the security token to the first Web server. To execute a pseudo-terminal reply step.

  Therefore, as in (1), the method according to the present invention can cause a Web server to perform efficient authentication by returning a security token in a Web service by a plurality of Web servers that cooperate with each other.

  According to the present invention, in a Web service by a plurality of Web servers that cooperate with each other, the Web server can perform efficient authentication.

It is a figure for demonstrating the process regarding the security token between the some web servers which cooperates of this invention. It is a flowchart which shows the process of the web service program of the web server which concerns on one Embodiment of this invention. It is a flowchart which shows the reply process which concerns on one Embodiment of this invention. It is a figure for demonstrating the process regarding the user authentication between the some web servers which cooperates conventionally.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  The Web server 900 according to this embodiment includes hardware included in a computer and its peripheral devices, software that controls the hardware, a Web service program, and a reply program according to the present invention.

  The hardware includes a storage unit, a communication device, a display device, and an input device in addition to a CPU (Central Processing Unit) as a control unit. Examples of the storage unit include a memory (RAM: Random Access Memory, ROM: Read Only Memory, etc.), a hard disk drive (HDD: Hard Disk Drive), and an optical disk (CD: Compact Disc, DVD: Digital Versatile Drive, etc.). It is done. Examples of the communication device include various wired and wireless interface devices. Examples of the display device include various displays such as a liquid crystal display and a plasma display. Examples of the input device include a keyboard and a pointing device (mouse, tracking ball, etc.).

  The software includes a computer program and data for controlling the hardware. The computer program and data are stored in the storage unit, and are appropriately executed and referenced by the control unit. The computer program and data can be distributed via a communication line, or can be recorded on a computer-readable medium such as a CD-ROM and distributed.

  FIG. 1 is a diagram for explaining processing related to a security token between a plurality of linked Web servers 900 according to the present invention. The example of FIG. 1 is a plurality of Web servers 900a, 900b, 900c, 900d, 900e, 900f, etc. that cooperate via a communication network (not shown). This is an example of a process related to a security token between Web servers 900a and the like). The web server 900 that has received a service request from the terminal 50 includes a reply program that sequentially delivers and returns security tokens, and provides a web service in cooperation with the plurality of web servers 900.

  In FIG. 1, for example, the Web server 900 a receives a Web service request from the terminal 50 by the terminal communication protocol by the Web service program. The terminal communication protocol is an http protocol, and includes a cookie data that is session information in an http header. The Web server 900 distributes data for each terminal 50 in response to a request from the terminal 50 according to a terminal communication protocol, for example, transmits data corresponding to cookie data for each terminal 50. Then, the Web server 900 writes a security token, which is user authentication information, in the cookie information field of the http header in the terminal communication protocol, transmits it, receives the response, and receives the response from the cookie information field. Read the security token.

  In FIG. 1, for example, when the Web server 900b needs to authenticate a user and has not received a security token from the Web server 900a, the Web server 900b transmits a security token acquisition request to the authentication issuing server 910, Receive and obtain an authenticated security token from 910. Next, in order to call the function of the Web server 900c, the reply program of the Web server 900b writes the security token acquired by the cookie information transmission function (setcookie ()) in the cookie information field of the http header in the terminal communication protocol. Then, the Web service request is transmitted to the Web server 900c.

  The Web server 900c receives the Web service request and reads the security token written in the cookie information field of the http header in the terminal communication protocol. Then, the reply program of the Web server 900c returns a response in which the received security token is written to the cookie information field of the http header in the terminal communication protocol by the cookie information transmission function (setcookie ()).

  The Web server 900b receives the response data from the Web server 900c called by the http protocol, and when the security token written in the cookie information field of the http header in the terminal communication protocol is included, the security token is extracted from the header. Is read. Then, the reply program of the Web server 900b writes the security token read in the response from the Web server 900c to the cookie information field of the http header in the terminal communication protocol by using the cookie information transmission function (setcookie ()), and sets the Web server 900b. A reply is made to the Web server 900a called by the http protocol.

  Here, an example of a header of an HTTP response transmitted from the terminal 50 to the terminal 50 by the Web server 900a that has received the Web service request from the terminal communication protocol is shown.

HTTP / 1. X 200 OK
Date: Tue, 22 Jun 2010 10:41:41 GMT
・
・
・
Expires: -1
Pragma: no-cache
Cache-Control: no-cache
Connection: close
Transfer-Encoding: chunked
Content-Type: text / html
Set-Cookie: B = abcdefg12345678 = 3 & s = l4; expires = Tue, 02-Jun-2037 20: 00: 0GMT; path = /; domain =. xxx. co. jp

  In this example, the cookie information field of the http header is a field indicated by “Set-Cookie:”. Cookie information is separated by semicolons. For example, expires indicates an expiration date. In the cookie information field, for example, the security token read in the response from the Web server 900c called by the Web server 900b is written in the cookie information field by the cookie information transmission function (setcookie ()) and returned to the Web server 900a. An example of an HTTP response header when the Web server 900b returns a security token to the Web server 900a is shown below.

HTTP / 1. X 200 OK
Date: Tue, 22 Jun 2010 10:41:41 GMT
・
・
・
Set-Cookie: ValidationTokenString123456abcdef

  As described above, the reply program commonly used in the Web server 900 normally uses the Set-Cookie field of the http header used for the exchange of cookie information with the terminal browser, so that the API can be used during API cooperation. Write a security token in

  The returned security token is returned in the same manner between the linked Web servers 900 by the return program. That is, the first Web server 900 that requires a security token acquires a security token only once, and the subsequent Web server 900 has a calling relationship like the Web server 900e from the Web server 900a shown in FIG. Even when there are two or more branches, user information can be efficiently authenticated using the returned security token.

  FIG. 2 is a flowchart showing processing of the Web service program of the Web server 900 according to the embodiment of the present invention. The web service program starts when the web server 900 receives a service request from the terminal 50 or another web server 900.

  In step S <b> 101, the CPU performs preprocessing for calling functions of another Web server 900. More specifically, in order to authenticate user information, the CPU needs to authenticate user information based on a service request received from another Web server 900 as the execution of the pseudo terminal request receiving step. If the security token is not received, an authentication request is transmitted to the authentication issuing server 910, and a security token that is user authentication information is received and acquired from the authentication issuing server 910. When it is necessary to authenticate the user information and the CPU receives the security token, the CPU authenticates the user information with the received security token. Thereafter, the CPU moves the process to step S102.

  In step S102, the CPU performs a process of delivering a security token in order to call a function of another Web server 900. More specifically, in order to call the function of the other Web server 900, the CPU executes a pseudo terminal request transmission step, and sets a cookie information transmission function (setcookie ()) in the cookie information field of the http header in the terminal communication protocol. ), The acquired security token is written, and the Web service request is transmitted to another Web server 900. Thereafter, the CPU moves the process to step S103.

  In step S <b> 103, the CPU performs a reply process (see subsequent FIG. 3) after calling a function of another Web server 900. Thereafter, the CPU moves the process to step S104.

  In step S104, the CPU performs processing for executing the Web service. Thereafter, the CPU ends the process.

  FIG. 3 is a flowchart showing a reply process according to an embodiment of the present invention.

  In step S201, the CPU receives a response from the other web server 900 that has called the CPU. More specifically, the CPU receives response data, which is data after the other Web server 900 has processed to provide a service, from the other Web server 900 called in step S102. Thereafter, the CPU moves the process to step S202.

  In step S202, the CPU determines whether a security token exists in the response header. More specifically, the CPU determines whether or not a security token is included in the cookie information field in the terminal communication protocol of the response data received from the other web server 900. If this determination is YES, the CPU moves the process to step S203, and if NO, the CPU ends the process and moves the process to the step next to the step that moves to the present process.

  In step S203, the CPU reads the security token from the cookie information field in the terminal communication protocol in the header of the response data received from the other Web server 900. Thereafter, the CPU moves the process to step S204.

  In step S <b> 204, the CPU returns a security token to the Web server 900. More specifically, the CPU writes the security token read from the cookie information field in the terminal communication protocol in the response data into the cookie information field by the cookie information transmission function and returns it as execution of the pseudo terminal reply step. Thereafter, the CPU ends the process, and shifts the process to the next step after the step shifts to the present process.

  According to the present embodiment, the reply program is commonly used in the Web service program in order to sequentially pass security tokens between the plurality of Web servers 900 that cooperate via the communication network. Then, the reply program causes the first Web server 900 to process and transmit the terminal communication protocol as a protocol for transmitting the data request to the second Web server 900, and causes the second Web server 900 to transmit the first communication protocol. In response to receiving the data request from the Web server 900, the security token is written in the cookie information field of the http header in the terminal communication protocol by the cookie information transmission function and returned. The reply program causes the second Web server 900 to receive response data from the third Web server 900 included in the plurality of Web servers 900 called by the http protocol, and the second Web server 900 receives the response data. When the security token is included in the header of the response data, the security token is read from the header, and the second Web server 900 is called by the http protocol to the first Web server 900 using the cookie information transmission function. , The read security token is written in the cookie information field of the http header, and is returned to the first Web server 900. In this way, when returning a result to the call source Web server 900, the return program in the call destination Web server 900 writes the security token held in a series of API call sessions in the cookie information field of the http header. . Accordingly, the caller Web server 900 can read the security token from the cookie information field of the http header. As a result, even when the calling relationship of the Web server 900 as shown in FIG. 4 is branched to have two or more branches, the subsequent branched Web servers 900e and 900f are the other Web servers existing in the preceding branch. 900b, 900c, 900d can reliably receive the security token received so far. Therefore, in a Web service by a plurality of Web servers 900 that cooperate, the Web server 900 can perform efficient authentication using the returned security token.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. The effects described in the embodiments of the present invention are only the most preferable effects resulting from the present invention, and the effects of the present invention are limited to those described in the embodiments of the present invention. is not.

50 terminals 900 900a, 900b, 900c, 900d, 900e, 900f Web server 910 authentication issue server

Claims (3)

A program that sequentially passes security tokens between a plurality of Web servers that cooperate via a communication network,
In a first Web server included in the plurality of Web servers,
The http protocol to send the data in response to a request from the terminal, processed by transmit as a protocol for transmitting a data request to a second Web server included in the plurality of Web servers,
In the second web server,
When the data request is received from the first web server, the response data of the http protocol received from the third web server included in the plurality of web servers, which is called by the http protocol, is received. When the security token is included in the response data header of the http protocol, the security token is read out, and the read-out is performed in the cookie information field of the http protocol header for the first Web server that has transmitted the data request. write security token cookie information transmission function, each is returned to process the http protocol to which the security token is written as a response protocol of the security token to the first Web server A program characterized by executing the management. A program that sequentially passes security tokens between a plurality of Web servers that cooperate via a communication network,
In a second Web server included in the plurality of Web servers,
The http protocol for sending data to the terminus in response to a request from the terminal, is received by processing as a protocol for receiving data requests from the first Web server included in the plurality of Web servers,
When the data request is received from the first web server, the response data of the http protocol received from the third web server included in the plurality of web servers, which is called by the http protocol, is received. When the security token is included in the response data header of the http protocol, the security token is read out, and the read-out is performed in the cookie information field of the http protocol header for the first Web server that has transmitted the data request. The security token is written by the cookie information transmission function, and the http protocol in which the security token is written is processed and returned as the security token return protocol to the first Web server.
A program characterized by causing each process to be executed . A method of sequentially passing security tokens between a plurality of Web servers that cooperate via a communication network,
The 1 Web server included in the plurality of Web servers,
The http protocol to send the data in response to a request from the terminal, sends treated as a protocol for transmitting a data request to a second Web server included in the plurality of Web servers,
The second web server is
When the data request is received from the first web server, the response data of the http protocol received from the third web server included in the plurality of web servers, which is called by the http protocol, is received. When the security token is included in the response data header of the http protocol, the security token is read out, and the read-out is performed in the cookie information field of the http protocol header for the first Web server that has transmitted the data request. The security token is written by the cookie information transmission function, and the http protocol in which the security token is written is processed and returned as the security token return protocol to the first Web server.
A method characterized by executing each process .

Images