JP5402666B2 - Server access program, server access device, and server access method - Google Patents

Description

  The present invention relates to a server access program, a server access device, and a server access method for accessing a target server via a proxy that performs authentication.

  When a client device accesses a server by specifying a URL (Uniform Resource Locator) and receives an information service provided by the server, authentication may be performed by a proxy existing between the client device and the server. Here, the URL is information indicating the location of the information resource. The proxy is a computer provided between the client device and the server for the purpose of speeding up access, security, filtering, information rewriting, and the like. A proxy technique for managing access and editing information between a client and a server is known.

  For example, Patent Document 1 discloses a technique for restricting access from a client device to a WEB server with a proxy. A client device that wishes to access the WEB server transmits a request specifying a URL including authentication key information indicating that authentication has been issued by the proxy during user authentication. Then, the proxy sends only a request designating a URL including authentication key information to the WEB server. A request specifying a URL that does not include authentication key information is not sent to the WEB server. Upon receiving a request from the client device, the WEB server returns a file for providing a service to the client device via the proxy as a response.

Japanese Patent Laid-Open No. 11-242639

  A link may be included in the file returned from the WEB server to the client device. A user operating the client device designates a link on the information screen presented by the file acquired from the WEB server. Subsequently, the client device transmits a request specifying the URL associated with the link to the WEB server via the proxy. At this time, if there is no authentication key information in the designated URL, access to the WEB server is blocked by the proxy.

  Here, for example, when a file returned from the WEB server to the client device passes through the proxy, a method in which the proxy rewrites the URL in the file to a URL including authentication key information can be considered. Therefore, when a link in the file is specified in the client device, a request specifying a URL including the authentication key information already associated with the link in the file is transmitted to the proxy. Access to the server is not blocked.

  However, the proxy cannot rewrite URLs inside all files. For example, when the file returned from the WEB server to the client device is a binary file or the like, it is very difficult for the proxy to detect and rewrite the URL inside the file.

  The present invention solves the above-described problems and makes it possible to prevent a request specifying a link in a file returned from a server to a client device from being authenticated by the proxy from being blocked by the proxy. The purpose is to provide.

  The disclosed program authenticates a user and sends a computer that performs processing to access the server specified by the information resource location information through a proxy that issues authentication information indicating that the authentication has been completed. To make it work.

  That is, the program sends a request to the proxy to the server that specifies the first information resource location information that does not include authentication information to the computer on which the program is installed and executed; Obtaining a second information resource location information including information resource location information and authentication information; extracting a difference between the first information resource location information and the second information resource location information; A step of acquiring a file provided by the server based on the information resource location information via a proxy, a step of outputting a screen based on the acquired file, and a selection for the third information resource location information included in the file by the user. Accepting step and the fourth information resource location information with the extracted difference added to the third information resource location information And generating a fourth resource other request specifying locational information and a step of sending to the proxy.

  With the above technology, even if a request sent from the client device to the server after authentication by the proxy is a request that specifies the link in the file returned from the server to the client device, the proxy does not block the request. .

It is a figure which shows a system configuration example. It is a sequence diagram which shows the example of a flow in case the file returned to a client apparatus from a WEB server is an HTML file. It is a sequence diagram which shows the example of a flow in case the file returned to a client apparatus from a WEB server is an HTML file. It is a sequence diagram which shows the example of a flow in case the file returned to a client apparatus from a WEB server is a file which cannot rewrite URL used as a link destination by a proxy. It is a figure which shows the example of an authentication information table. It is a functional diagram of the server access process part with which the client apparatus by this Embodiment is provided. It is a figure which shows the example of the data table stored in the URL information storage part by this Embodiment. It is a figure which shows the example of the data stored in the difference information storage part by this Embodiment. It is a server access process flowchart by the server access process part of this Embodiment. It is a sequence diagram which shows the example of a flow in case the file returned to a client apparatus from a WEB server by this Embodiment is a SWF file. It is a sequence diagram which shows the example of a flow in case the file returned to a client apparatus from a WEB server by this Embodiment is a SWF file. It is a figure which shows the hardware structural example of the client apparatus by this Embodiment.

  Hereinafter, the present embodiment will be described with reference to the drawings.

  FIG. 1 is a diagram illustrating a system configuration example.

  In the system shown in FIG. 1, the client device 1, the proxy 2, and the WEB server 3 are computers each including hardware such as a CPU (Central Processing Unit) and a memory. The client device 1 -proxy 2 and the proxy 2 -WEB server 3 are connected by a network.

  The client device 1 is a computer that can access the WEB server 3 by specifying a URL. Here, the client device 1 is, for example, a mobile phone, a PDA (Personal Digital Assistant), a PHS (Personal Handy-phone System), or the like. The WEB server 3 is a computer that provides services such as provision of information through a WEB page to the client device 1 that has accessed. A user who uses the client device 1 browses information provided by a file acquired from the WEB server 3 by the client device 1 using a browser by accessing the WEB server 3 in which the URL is specified.

  The proxy 2 is a computer provided in the preceding stage of the WEB server 3 in order to restrict access to the WEB server 3. The proxy 2 performs user authentication for the client device 1 that requests access to the WEB server 3, and permits access to the WEB server 3 only for the client device 1 that has been successfully authenticated.

  Here, an example in which the proxy 2 detects and rewrites the URL in the file returned from the WEB server 3 to the client device 1 will be described using the sequence diagrams shown in FIGS. The URL inside the file is the URL of the link destination in the WEB page output on the display screen of the client device 1. The WEB page is generated by the browser based on the file returned via the proxy. Here, only when the file returned from the WEB server 3 to the client apparatus 1 is a text file, the proxy 2 can detect and rewrite the URL described in the file.

  2 and 3 are sequence diagrams showing an example of the flow when the file returned from the WEB server to the client device is an HTML file.

  The user designates the URL with the browser of the client device 1. For example, the following description will be given on the assumption that the user designates a URL or the like for displaying a menu screen of a service provided by the WEB server 3. The client device 1 accepts designation of a URL by the user (step S200). Here, it is assumed that “http://test.example.com/menu” is specified as the URL. This URL “http://test.example.com/menu” is a URL that does not include authentication key information before user authentication by the proxy 2. The authentication key is information indicating that authentication has been issued when user authentication by the proxy 2 is successful. The client device 1 transmits a request specifying the URL “http://test.example.com/menu” to the proxy 2 (step S201).

  The proxy 2 detects the access to the WEB server 3 by the client device 1 by receiving a request specifying the URL “http://test.example.com/menu” (step S202). At this time, the proxy 2 confirms whether the authentication key information is included in the URL of the request from the client device 1 (step S203). Since the URL “http://test.example.com/menu” is the URL of the request transmitted from the client device 1 before user authentication, the authentication key information is not included.

  Here, it is assumed that the proxy 2 performs user authentication with respect to the client device 1 when a request specifying a specific URL that does not include authentication key information is received from the client device 1. When a request specifying a URL other than a specific URL that does not include authentication key information is received from the client apparatus 1, the proxy 2 sends a file for presenting an error screen to the client apparatus 1. Shall be returned.

  Here, it is assumed that only the URL “http://test.example.com/menu” is a specific URL for performing user authentication. The proxy 2 returns a file for presenting the user authentication screen to the client device 1 (step S204). Note that the proxy 2 transmits a file to the client device 1 based on the IP address of the client device 1.

  The client device 1 displays a user authentication screen, and the user inputs user information in the input field of the user authentication screen. Here, the user information is a combination of a user name and a password. When the client device 1 receives an input of user information from the user (step S205), the client device 1 transmits the user information to the proxy 2 (step S206).

  The proxy 2 performs user authentication for the client device 1 using the user information received from the client device 1 (step S207). More specifically, the proxy 2 determines whether the combination of the user name and password included in the user information received from the client device 1 matches the user name and password registered in advance in the proxy 2. That is, it is determined whether or not the user who has been permitted in advance to access the specific WEB server 3 via the proxy 2. If the combination of user name and password matches, user authentication is successful.

  The proxy 2 issues an authentication key when user authentication for the client device 1 is successful. The authentication key is information indicating that the user authentication for the client device 1 has been successful. Here, it is assumed that “xxxx” is issued as an authentication key (ukey) for the client device 1. The proxy 2 records user authentication information, which is information on the result of user authentication, including the issued authentication key, in an authentication information table stored in a storage device included in the proxy 2 (step S208).

  The proxy 2 adds the authentication key information “ukey = xxxx” to the URL “http://test.example.com/menu” of the request received from the client device 1, and the URL “http including the authentication key information” “: //test.example.com/menu? ukey = xxxx” is returned to the client apparatus 1 (step S209).

  The client device 1 accepts the designation of the URL “http://test.example.com/menu?ukey=xxxx” including the authentication key information acquired from the proxy 2 (step S210). This URL designation reception may be a user input designation such as selection of an access instruction button displayed on the screen, or an automatic URL designation received from the proxy 2 by redirection. Also good. The client device 1 transmits a request specifying a URL “http://test.example.com/menu?ukey=xxxx” including authentication key information to the proxy 2 (step S211). Then, the client device 1 proceeds to S218 in FIG.

  The proxy 2 receives the request specifying the URL “http://test.example.com/menu?ukey=xxxx”, and detects access to the WEB server 3 by the client device 1 (step S212). Then, the proxy 2 proceeds to S213 in FIG. Then, the proxy 2 checks whether or not the authentication key information is included in the URL of the request from the client device 1 (step S213).

  Specifically, the proxy 2 checks whether the authentication key recorded in the authentication information table is included in the URL of the request from the client device 1. Since the URL “http://test.example.com/menu?ukey=xxxx” includes the information “ukey = xxxx” of the authentication key “xxxx” recorded in the authentication information table, the client device 1 Is permitted to access the WEB server 3.

  The proxy 2 transmits a request from the client device 1 to the WEB server 3 (step S214). At this time, the proxy 2 transmits the URL after deleting the authentication key information from the URL of the request to the WEB server 3 as a request. That is, the URL of the request transmitted from the proxy 2 to the WEB server 3 is “http://test.example.com/menu”.

In response to a request from the client device 1 with the URL “http://test.example.com/menu”, the WEB server 3 creates a file for displaying a menu screen of the service provided by itself. It returns to the proxy 2 (step S215). The file returned here is an HTML file of a text file, and the HTML file includes a description including a URL indicating a link.
<html>
<A Href="http://test.example.com/menuA"> menuA </A><BR>
<A Href="http://test.example.com/menuB"> menuB </A><BR>
</ html>
Is included.

Since the client device 1 has been authenticated, the proxy 2 sets authentication key information “ukey = xxxx” in the URL indicating the link in the file from the WEB server 3 to the client device 1 (step S216). At this time, the description of the part including the URL indicating the link in the file is as follows:
<html>
<A Href="http://test.example.com/menuA?ukey=xxxx"> menuA </A><BR>
<A Href="http://test.example.com/menuB?ukey=xxxx"> menuB </A><BR>
</ html>
It can be rewritten as The proxy 2 returns the file in which the authentication key information “ukey = xxxx” is set in the URL indicating the link to the client device 1 (step S217).

  The user browses the information on the menu screen provided by the file acquired from the WEB server 3 via the proxy 2 with the browser of the client device 1.

  Here, it is assumed that the user selects the menu A link on the menu screen. The client device 1 accepts a link selection by the user (step S218). The client device 1 transmits a request designating the URL associated with the selected link to the proxy 2 (step S219). Here, the URL associated with the selected menu A link is “http://test.example.com/menuA?ukey=xxxx” in the file acquired from the WEB server 3 via the proxy 2. Shall. That is, a request specifying the URL “http://test.example.com/menuA?ukey=xxxx” is transmitted from the client apparatus 1 to the proxy 2.

  The proxy 2 detects the access to the WEB server 3 by the client device 1 by receiving the request specifying the URL “http://test.example.com/menuA?ukey=xxxx” (step S220). At this time, the proxy 2 confirms whether the authentication key information is included in the URL of the request from the client device 1 (step S221). The URL “http://test.example.com/menuA?ukey=xxxx” includes the information “ukey = xxxx” of the authentication key “xxxx” recorded in the authentication information table. Is permitted to access the WEB server 3.

  The proxy 2 transmits a request from the client device 1 to the WEB server 3 (step S222). At this time, the proxy 2 deletes the authentication key information from the request URL. That is, the URL of the request transmitted from the proxy 2 to the WEB server 3 is “http://test.example.com/menuA”.

  Thereafter, similarly to step S215, a file is returned from the WEB server 3 via the proxy 2.

  As described above, when the file returned from the WEB server 3 via the proxy 2 is a rewritable file such as an HTML file, the proxy 2 uses an authentication key in the URL indicating the link included in the file. Can be set.

  FIG. 4 is a sequence diagram showing an example of the flow when the file returned from the WEB server to the client device is a file in which the URL to be linked cannot be rewritten by the proxy. As an example of a file that cannot be rewritten, a SWF file that is a binary file will be described below.

  The SWF file is a movie file for reproduction created with Adobe Flash (registered trademark). Hereinafter, an example of a flow when the file returned from the WEB server 3 to the client device 1 is an SWF file will be described with reference to FIG. The flow from the WEB server 3 to the return of the file to the proxy 2 (step S215) is the same as that of the above-described HTML file from S200 to S215 shown in FIGS. .

In response to a request from the client device 1 with the URL “http://test.example.com/menu”, the WEB server 3 creates a file for displaying a menu screen of the service provided by itself. It returns to the proxy 2 (step S215). The file returned here is a SWF file of a binary file, and the SWF file contains the URL content indicating the link as follows:
on (press) {getURL ("http://test.example.com/menuA");}
on (press) {getURL ("http://test.example.com/menuB");}
Is included.

  Here, although the client apparatus 1 has been authenticated, the file from the WEB server 3 to the client apparatus 1 is an SWF file, so the proxy 2 adds the authentication key information “ ukey = xxxx "cannot be set. The proxy 2 returns the file received from the WEB server 3 to the client device 1 as it is (step S230).

  The user browses the information on the menu screen provided by the file acquired from the WEB server 3 via the proxy 2 with the browser of the client device 1.

  Here, it is assumed that the user selects the menu A link on the menu screen. The client device 1 accepts selection of a link by the user (step S231). The client device 1 transmits a request specifying the URL associated with the selected link to the proxy 2 (step S232). Here, it is assumed that the URL associated with the selected menu A link is “http://test.example.com/menuA” in the file acquired from the WEB server 3 via the proxy 2. That is, a request specifying the URL “http://test.example.com/menuA” is transmitted from the client apparatus 1 to the proxy 2.

  The proxy 2 detects the access to the WEB server 3 by the client device 1 by receiving the request specifying the URL “http://test.example.com/menuA” (step S233). At this time, the proxy 2 checks whether or not the authentication key information is included in the URL of the request from the client device 1 (step S234). Since the URL “http://test.example.com/menuA” does not include the authentication key information recorded in the authentication information table, access from the client device 1 to the WEB server 3 is not permitted.

  Here, since the URL “http://test.example.com/menuA” included in the request from the client device 1 is not a specific URL for performing user authentication, the proxy 2 presents an error screen. The file is returned to the client device 1 (step S235). Note that the proxy 2 authenticates the user to the client device 1 in all cases where a request specifying a URL that does not include authentication key information is received from the client device 1 without setting a specific URL for performing user authentication. May be performed.

  As described above, when the file returned from the WEB server 3 via the proxy 2 is a binary file that is difficult to rewrite, such as a SWF file, the proxy 2 authenticates the URL indicating the link included in the file. The key information cannot be set. At this time, if the link specified in the file is specified by the user, access to the WEB server 3 from the client device 1 is blocked or the troublesome user authentication is restarted even though the user authentication has been executed once. A problem arises that must be done.

  In addition to the SWF file, various files such as a PDF file, a DOC file, an XLS file, and a PPT file can be considered as binary files that are difficult to be rewritten by the proxy 2.

  Here, an example of an authentication information table included in the proxy 2 will be described.

  FIG. 5 is a diagram illustrating an example of the authentication information table.

  The authentication information table 20 shown in FIG. 5 has information such as a user name, an authentication key (ukey), and an access time. Furthermore, when the authentication key is issued, the IP address assigned to the client device 1 used by the user may be included. The user name is a user name included in user information at the time of user authentication. The authentication key (ukey) is an authentication key (ukey) indicating that authentication has been issued due to a successful user authentication. The access time is the time when user authentication is performed.

  In the following, when a URL of a link included in a file that cannot be rewritten by the proxy 2 obtained from the WEB server 3 is designated, the authentication key information is automatically added to the designated URL. The client device 1 according to the embodiment will be described.

  FIG. 6 is a functional diagram of the server access processing unit provided in the client device according to the present embodiment.

  The client device 1 according to the present embodiment includes a server access processing unit 10 that performs access processing to the WEB server 3 specified by the URL. The server access processing unit 10 according to the present embodiment is specified when a URL of a link included in a file that is acquired from the WEB server 3 through the proxy 2 that performs authentication and cannot be rewritten by the proxy 2 is specified. A function of automatically adding authentication key information to the URL.

  The server access processing unit 10 includes a URL designation receiving unit 11, a URL information storage unit 12, a difference extraction unit 13, a difference information storage unit 14, a difference addition unit 15, a request output unit 16, and a file acquisition unit 17. The server access processing unit 10 and the functional units of the server access processing unit 10 are realized by hardware such as a CPU and a memory included in the computer of the client device 1 and a software program.

  The URL designation accepting unit 11 accepts designation of a URL for specifying an access destination WEB server 3. The designation of the URL is, for example, selection of a shortcut or a link by the user, character input of the URL, or the like. The URL designation accepting unit 11 stores the designated URL in the URL information storage unit 12 when there is an access to the WEB server 3 that designates the URL. The URL information storage unit 12 is a storage device that can be accessed by a computer and stores history information of a URL designated by access to the WEB server 3.

  When the user authentication is performed by the proxy 2, the difference extraction unit 13 stores the URL specified in the request before the user authentication stored in the URL information storage unit 12 and the URL acquired from the proxy 2 after the user authentication. The difference is extracted.

  The URL specified in the request before user authentication is a URL that does not include authentication key information. The URL acquired from the proxy 2 after the user authentication is a URL including authentication key information obtained by adding the authentication key information to the URL of the request before the user authentication by the proxy 2 after the user authentication. That is, the difference between the URL specified in the request before user authentication and the URL acquired from the proxy 2 after user authentication is information on the authentication key. Here, it is assumed that the URL acquired from the proxy 2 after user authentication is designated by redirection and stored in the URL information storage unit 12 by the URL designation receiving unit 11.

  The difference extraction unit 13 stores the extracted difference in the difference information storage unit 14. The difference information storage unit 14 is a computer-accessible storage device that stores information on the difference between the URL specified in the request before user authentication and the URL acquired from the proxy 2 after user authentication.

  When the link associated with the URL included in the file acquired from the WEB server 3 via the proxy 2 that performs authentication is designated, the difference adding unit 15 performs the processing on the URL associated with the link. The difference stored in the difference information storage unit 14 is added. Here, the file acquired from the WEB server 3 is a file such as a binary file that cannot be rewritten by the proxy 2, and the URL included in the file is a URL that does not include authentication key information. That is, the difference adding unit 15 adds authentication key information to a URL that does not include authentication key information.

  The request output unit 16 transmits a request specifying a URL. When the difference adding unit 15 adds a difference to the URL received by the URL designation receiving unit 11, the request output unit 16 transmits a request specifying the URL to which the difference is added to the proxy 2. That is, when a URL included in a file that is acquired from the WEB server 3 through the proxy 2 that performs authentication and cannot be rewritten by the proxy 2, the request output unit 16 displays the URL with the difference added. Send the specified request to proxy 2. When the difference adding unit 15 does not add a difference to the URL received by the URL designation receiving unit 11, the request output unit 16 outputs a request specifying the URL received by the URL designation receiving unit 11.

  The file acquisition unit 17 acquires a file returned from the WEB server 3 in response to a request for which a URL is specified.

  FIG. 7 is a diagram showing an example of a data table stored in the URL information storage unit according to this embodiment.

  A URL information table 120 shown in FIG. 7 is an example of data in which history information of a URL designated by access to the WEB server 3 stored in the URL information storage unit 12 is recorded. The URL information table 120 shown in FIG. 7 has information such as a designated URL, date and time, and authentication check. The designated URL indicates a URL designated when accessing the WEB server 3. The date / time indicates the date / time when the request including the specified URL is transmitted. The authentication check indicates whether the specified URL is a URL returned from the proxy 2 after user authentication by the proxy 2. For example, in the URL information table 120 shown in FIG. 7, a record whose authentication check is “authentication” indicates that a request specifying a URL returned after user authentication has been made.

  FIG. 8 is a diagram illustrating an example of data stored in the difference information storage unit according to the present embodiment.

  The difference data 140 illustrated in FIG. 8 is an example of difference data stored in the difference information storage unit 14 between the URL specified in the request before user authentication and the URL acquired from the proxy 2 after user authentication. The difference data 140 shown in FIG. 8 includes the URL “http://test.example.com/menu” specified in the request before user authentication and the proxy 2 after user authentication in the URL information table 120 shown in FIG. This is a difference from the acquired URL “http://test.example.com/menu?ukey=xxxx”.

  FIG. 9 is a server access processing flowchart by the server access processing unit of the present embodiment.

  The example of the flowchart shown in FIG. 9 is an example of processing by the server access processing unit 10 when the user selects a link on the browser screen presented by the file acquired from the WEB server 3. Here, the file acquired from the WEB server 3 is a file returned to the client device 1 via the proxy 2 that performs authentication from the WEB server 3 and is a binary file that cannot be rewritten by the proxy 2. .

  When the user selects a link on the browser screen presented by the file, the URL designation accepting unit 11 accepts designation of a URL associated with the corresponding link inside the file (step S10).

  The URL designation receiving unit 11 determines whether the host unit of the designated URL matches the host unit of the URL acquired from the proxy 2 after user authentication stored in the URL information storage unit 12 (step S11). .

  If the two host units do not match (NO in step S11), the URL designation receiving unit 11 determines that the request including the designated URL is not a request to the WEB server 3 via the proxy 2 that has performed user authentication. to decide. At this time, the request output unit 16 transmits a request including the designated URL (step S14).

  If the two host units match (YES in step S11), the URL designation receiving unit 11 determines that the request including the designated URL is a request to the WEB server 3 via the proxy 2 that has performed user authentication. . At this time, the difference extraction unit 13 extracts the difference between the URL specified in the request before user authentication by the proxy 2 stored in the URL information storage unit 12 and the URL acquired from the proxy 2 after user authentication. (Step S12). The extracted difference is stored in the difference information storage unit 14. The difference adding unit 15 adds the difference stored in the difference information storage unit 14 to the URL associated with the link (step S13). The request output unit 16 transmits a request specifying the URL with the difference added to the proxy 2 (step S14).

  10 and 11 are sequence diagrams showing an example of the flow when the file returned from the WEB server to the client device according to the present embodiment is an SWF file.

  The user designates a URL for displaying a menu screen of a service provided by the WEB server 3 using the browser of the client device 1. The URL designation accepting unit 11 of the client device 1 accepts designation of a URL by the user (step S100). Here, it is assumed that “http://test.example.com/menu” is specified as the URL. This URL “http://test.example.com/menu” is a URL that does not include authentication key information before user authentication by the proxy 2.

  The URL designation receiving unit 11 of the client device 1 stores the URL “http://test.example.com/menu” that does not include the specified authentication key information in the URL information storage unit 12 (step 101). . For example, the URL stored at this time is the designated URL “http://test.example.com/menu” in the URL information table 120 shown in FIG. The request output unit 16 of the client device 1 transmits a request specifying the URL “http://test.example.com/menu” to the proxy 2 (step S102).

  The proxy 2 detects the access to the WEB server 3 by the client device 1 by receiving a request specifying the URL “http://test.example.com/menu” (step S103). At this time, the proxy 2 confirms whether the authentication key information is included in the URL of the request from the client device 1 (step S104). Since the URL “http://test.example.com/menu” is the URL of the request transmitted from the client device 1 before user authentication, the authentication key information is not included. The proxy 2 returns a file for presenting the user authentication screen to the client device 1 (step S105).

  The client device 1 displays a user authentication screen, and the user inputs user information in the input field of the user authentication screen. When the client device 1 receives an input of user information from the user (step S106), the client device 1 transmits the user information to the proxy 2 (step S107).

  The proxy 2 performs user authentication for the client device 1 using the user information received from the client device 1 (step S108). The proxy 2 issues an authentication key when user authentication for the client device 1 is successful. Here, it is assumed that “xxxx” is issued as an authentication key (ukey) for the client device 1. The proxy 2 records user authentication information, which is information on the result of user authentication, including the issued authentication key, in the authentication information table 20 stored in the storage device included in the proxy 2 (step S109).

  The proxy 2 adds the authentication key information “ukey = xxxx” to the URL “http://test.example.com/menu” of the request received from the client device 1, and the URL “http including the authentication key information” ": //test.example.com/menu? ukey = xxxx" is returned to the client device 1 (step S110). Then, the proxy 2 proceeds to S114 in FIG. Note that the processes S103, S104, S105, S108, and S109 of the proxy 2 correspond to S202, S203, S204, S207, and S208 in FIG. The proxy 2 performs the same process as the conventional process. In other words, the URL of the request is rewritten by the proxy 2 as usual.

  The URL designation accepting unit 11 of the client device 1 accepts designation of the URL “http://test.example.com/menu?ukey=xxxx” including the authentication key information returned from the proxy 2 (step S111). . This URL designation reception may be a user input designation such as selection of an access instruction button displayed on the screen, or an automatic URL designation received from the proxy 2 by redirection. Also good.

  The URL designation receiving unit 11 of the client device 1 stores the URL “http://test.example.com/menu?ukey=xxxx” including the specified authentication key information in the URL information storage unit 12 ( Step 112). For example, the URL stored at this time is the designated URL “http://test.example.com/menu?ukey=xxxx” after user authentication in the URL information table 120 shown in FIG. Then, the client device 1 advances the processing to S113 in FIG. The request output unit 16 of the client device 1 transmits a request specifying the URL “http://test.example.com/menu?ukey=xxxx” including the authentication key information to the proxy 2 (step S113). ).

  The proxy 2 detects the access to the WEB server 3 by the client device 1 by receiving the request specifying the URL “http://test.example.com/menu?ukey=xxxx” (step S114). At this time, the proxy 2 confirms whether or not the authentication key information is included in the URL of the request from the client device 1 (step S115). Specifically, the proxy 2 checks whether the authentication key recorded in the authentication information table 20 is included in the URL of the request from the client device 1. Since the URL “http://test.example.com/menu?ukey=xxxx” includes the information “ukey = xxxx” of the authentication key “xxxx” recorded in the authentication information table 20, the client device Access from 1 to the WEB server 3 is permitted.

  The proxy 2 transmits a request from the client device 1 to the WEB server 3 (step S116). At this time, the proxy 2 deletes the authentication key information from the request URL. That is, the URL of the request transmitted from the proxy 2 to the WEB server 3 is “http://test.example.com/menu”.

In response to a request from the client device 1 with the URL “http://test.example.com/menu”, the WEB server 3 creates a file for displaying a menu screen of the service provided by itself. It returns to the proxy 2 (step S117). The file returned here is a SWF file of a binary file, and the SWF file contains the URL content indicating the link as follows:
on (press) {getURL ("http://test.example.com/menuA");}
on (press) {getURL ("http://test.example.com/menuB");}
Is included.

  Here, although the client apparatus 1 has been authenticated, the file from the WEB server 3 to the client apparatus 1 is an SWF file, so the proxy 2 adds the authentication key information “ ukey = xxxx "cannot be set. The proxy 2 returns the file received from the WEB server 3 to the client device 1 as it is (step S118).

  The file acquisition unit 17 of the client device 1 acquires the file returned from the WEB server 3 via the proxy 2. The user browses the information on the menu screen provided by the file acquired from the WEB server 3 via the proxy 2 with the browser of the client device 1.

  Here, it is assumed that the user selects the menu A link on the menu screen. The client device 1 accepts a link selection by the user (step S119). At this time, the URL designation accepting unit 11 of the client device 1 accepts designation of the URL inside the file acquired from the WEB server 3 associated with the selected link. Here, it is assumed that the URL inside the file acquired from the WEB server 3 associated with the selected menu A link is “http://test.example.com/menuA”.

  The difference extraction unit 13 of the client device 1 determines whether the URL selected as the link destination is a URL inside the file and is an access to the WEB server 3 that has been previously authenticated by the proxy 2 in the past. . For example, the difference extraction unit 13 refers to the URL information storage unit 12 and determines whether the URL selected in S119 is the same as the URL included in the request when user authentication was performed in the past. . If they are the same, it can be determined that the access is to the WEB server 3 via the proxy 2 that has performed user authentication in the past.

  At this time, the difference extraction unit 13 of the client device 1 stores the URL “http://test.example.com/menu” stored in the URL information storage unit 12 and does not include the authentication key information, and the authentication key information. The difference “? Ukey = xxxx” from the URL “http://test.example.com/menu?ukey=xxxx” including the URL is extracted (step S120). The difference extraction unit 13 of the client device 1 stores the extracted difference “? Ukey = xxxx” in the difference information storage unit 14.

  The difference adding unit 15 of the client apparatus 1 performs the difference “? Ukey = stored in the difference information storage unit 14 for the URL“ http://test.example.com/menuA ”associated with the selected link. xxxx "is added (step S121). The URL with the difference added is “http://test.example.com/menuA?ukey=xxxx”.

  The request output unit 16 of the client device 1 transmits a request specifying the URL “http://test.example.com/menuA?ukey=xxxx” with the difference added to the proxy 2 (step S122).

  The proxy 2 receives the request specifying the URL “http://test.example.com/menuA?ukey=xxxx”, and detects the access to the WEB server 3 by the client device 1 (step S123). At this time, the proxy 2 confirms whether the authentication key information is included in the URL of the request from the client device 1 (step S124). Since the URL “http://test.example.com/menuA?ukey=xxxx” includes the information “ukey = xxxx” of the authentication key “xxxx” recorded in the authentication information table 20, the client device Access from 1 to the WEB server 3 is permitted.

  Thereafter, the file is returned from the WEB server 3 via the proxy 2 in the same manner as in Steps S117 and thereafter.

  As described above, the server access processing unit 10 according to the present embodiment automatically provides the authentication key information when the URL of the link in the file that cannot be rewritten by the proxy 2 is specified after the authentication by the proxy 2. Add and output the request. As a result, even after the user authentication by the proxy 2, even if the request specifies the URL of the link in the file that cannot be rewritten by the proxy 2, the proxy 2 does not block the request.

  The processing by the server access processing unit 10 of the present embodiment described above can be realized by hardware such as CPU and memory provided in the computer and a software program, and the program is recorded on a computer-readable recording medium. It can also be provided through a network.

  FIG. 12 is a diagram illustrating a hardware configuration example of the client device according to the present embodiment.

  The client device 1 includes a CPU 1001, a ROM (Read Only Memory) 1002, a RAM (Random Access Memory) 1003, a communication unit 1004, an HDD (Hard Disk Drive) 1005, an input unit 1006, a medium reading unit 1007, and a display unit 1008. Each part is connected to each other via a bus 1009. Each unit can send and receive data to and from each other under the control of the CPU 1001.

  A CPU 1001 is a central processing unit that controls operation of the entire client device 1. The communication unit 1004 receives a signal from another computer and passes the content of the signal to the CPU 1001. Furthermore, the communication unit 1004 transmits a signal to another computer in response to an instruction from the CPU 1001.

  The HDD 1005 stores, for example, a program that causes the computer to execute each process shown in the flowchart of FIG. 9 as a program that causes the computer to perform the same functions as the server access processing unit 10 described in the present embodiment. . The CPU 1001 reads out this program from the HDD 1005 and executes it, so that the computer functions as the URL designation receiving unit 11, the difference extracting unit 13, the difference adding unit 15, the request output unit 16, and the file acquiring unit 17 shown in FIG. become. This program may be stored in the ROM 1002 or the RAM 1003 accessible by the CPU 1001.

  Further, the HDD 1005 is managed as a storage unit such as the URL information storage unit 12 and the difference information storage unit 14 shown in FIG. 6 under the management of the CPU 1001. Difference information and the like are stored. Similar to the program, each information may be stored in the ROM 1002 or the RAM 1003 accessible by the CPU 1001. The input unit 1006 receives data input under the control of the CPU 1001.

  For example, the program describing the processing contents shown in the flowchart of FIG. 9 can be recorded on a computer-readable recording medium. Examples of the computer-readable recording medium include a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory. Magnetic recording devices include HDDs, flexible disks (FD (Flexible Disk)), magnetic tapes (MT (Magnetic Tape)), and the like. Optical discs include DVD (Digital Versatile Disc), DVD-RAM, CD (Compact Disc) -ROM, CD-R (Recordable) / RW (ReWritable), and the like. Magneto-optical recording media include MO (Magneto-Optical disk). When this program is distributed, for example, a portable recording medium such as a DVD or CD-ROM in which the program is recorded may be sold.

  In the computer that executes the program, the medium reading unit 1007 reads the program from, for example, a recording medium that records the program describing the processing contents shown in the flowchart of FIG. The CPU 1001 stores the read program in the HDD 1005, the ROM 1002, or the RAM 1003. The computer reads a program from HDD 1005, ROM 1002, or RAM 1003, which is its own storage device, and executes processing according to the program.

  Although the present embodiment has been described above, the present invention can naturally be modified in various ways within the scope of the gist thereof.

  For example, the server access processing unit 10 of this embodiment adds authentication key information obtained from the URL difference only when a URL of a link inside a file that cannot be rewritten by the proxy 2 such as a SWF file is specified. Processing to do. If it is assumed that the proxy 2 does not rewrite all files including the text file, the server access processing unit 10 obtains from the URL difference in all cases where the URL of the link in the file is designated. A process for adding the information of the authentication key thus obtained may be performed.

  In this embodiment, the server access processing unit 10 extracts the URL difference before and after the user authentication at the timing when the URL of the link in the file is specified. However, the URL difference extraction is not necessarily performed at that timing. There is no need to do. For example, the server access processing unit 10 may extract a difference between URLs before and after user authentication at the timing of receiving a URL including authentication key information from the proxy 2 after user authentication by the proxy 2.

DESCRIPTION OF SYMBOLS 1 Client apparatus 10 Server access process part 11 URL designation | designated reception part 12 URL information storage part 13 Difference extraction part 14 Difference information storage part 15 Difference addition part 16 Request output part 17 File acquisition part 2 Proxy 3 WEB server

Claims (4)

A program for causing a computer to execute a process of accessing a server specified by information resource location information through a proxy that issues authentication information indicating that the authentication has been completed, as well as authenticating a user. ,
In the computer,
Sending a request to the server specifying the first information resource location information not including the authentication information to the proxy;
Obtaining second information resource location information including the first information resource location information and the authentication information from the proxy;
Extracting the difference between the first information resource location information and the second information resource location information;
Obtaining the file provided by the server via the proxy based on the second information resource location information;
Outputting a screen based on the obtained file;
Receiving from the user a selection for third information resource location information included in the file;
Generating fourth information resource location information by adding the extracted difference to the third information resource location information;
And a step of transmitting another request designating the fourth information resource location information to the proxy. The server access program according to claim 1, wherein the file is a binary file. A server access device that performs processing for accessing a server specified by information resource location information via a proxy that authenticates a user and issues authentication information indicating that the authentication is completed.
Including the first information resource location information that does not include the authentication information specified in the request to the server transmitted to the proxy, and the first information resource location information and the authentication information acquired from the proxy A difference extraction unit for extracting a difference from the second information resource location information;
A receiving unit that accepts a selection from the user for third information resource location information included in a file provided by the server based on the second information resource location information acquired via the proxy;
A difference adding unit for generating fourth information resource location information obtained by adding the extracted difference to the third information resource location information;
The server access apparatus, comprising: an output unit that transmits another request designating the fourth information resource location information to the proxy. A server access method in which a computer executes processing for accessing a server specified by information resource location information via a proxy that authenticates a user and issues authentication information indicating that the authentication is completed. ,
The computer is
Sending a request to the server specifying the first information resource location information not including the authentication information to the proxy;
Obtaining second information resource location information including the first information resource location information and the authentication information from the proxy;
Extracting the difference between the first information resource location information and the second information resource location information;
Obtaining a file provided by the server via the proxy based on the second information resource location information;
A process of outputting a screen based on the obtained file;
Receiving a selection from the user for the third information resource location information included in the file;
Generating fourth information resource location information by adding the extracted difference to the third information resource location information;
A server access method comprising: performing another request designating the fourth information resource location information to the proxy.

Images