JPH0950422A - Interaction succession type access control method on computer network and server computer therefor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform access control provided with consistency in a series of access spread over plural servers on a computer network. SOLUTION: A client computer 101 and server computers 102 and 103 are connected to each other by a network 104. The server computer 102 is a home server managing the user information of a user using the client computer 101 and the server computer 103 is the server not managing the user information of the client computer 101. The client computer 101 issues an information acquisition request to the server computers 102 and 103 corresponding to a URL (uniform resource locator) from the user. The sever computers 102 and 103 analyze an interaction ID in the information acquisition request, discriminate the same user, store a series of the access and check the access. If necessary, the computers inguire from the other server to validate the interaction ID issued by the other server.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a dialog inheritance type access control method on a computer network and a server computer thereof, and more particularly, to a communication service access control for providing a hypertext to a user on a computer network. Is.

[0002]

2. Description of the Related Art Conventionally, WWW (World-Wide Web) has been known as a communication service for providing hypertext to a user on a computer network. As a method therefor, HTTP (Hyper Text Tr) is used.
ansfer Protocol). This method provides a service to an unspecified number of users. Conventionally, a protocol in which an information acquisition request is made only when an information acquisition request is generated for a series of operations on a user's hypertext. IP address (server address), port number,
URL (Uniform Resource) that sets the information to be acquired
Information is acquired by connecting to the server of the service provider specified by Locator).

FIG. 7 shows a system configuration of this conventional WWW. In the figure, 101 is a computer (client side computer) used by the user to receive the service, and 103 is a computer (server side computer) for providing the service.
Both are connected by a network 104. Inside the computer 101, 201 is various browsers for receiving the WWW service, 202 is various operating systems for controlling the computer 101, and inside the computer 103, 203 is a user for the WWW service. Storage unit for information to be provided (hypertext, etc.), 2
04 various daemons for providing WWW services,
Reference numeral 205 denotes various operating systems for controlling the computer 103. In the browser 201,
U from the user input from the input device of the computer
An information acquisition request is issued to a WWW server on the network according to the RL. In the daemon 204 of the WWW server that has received the information acquisition request, the information storage unit 20 indicated by the URL
The information in 3 is transferred to the user.

FIG. 8 shows an example of a service providing sequence of this conventional WWW server. In the figure, even when there are multiple requests for information provision from multiple users, the information is returned in the same procedure.

The HTTP in the conventional WWW is intended for communication services to an unspecified number of users, and the information is identified by identifying the same user from a series of information acquisition requests, storing an operation history for each user, and an access history. Cannot be protected.

On the other hand, the present applicant has previously developed a system in which the functions of identifying the same user from a series of information acquisition requests, storing an operation history for each user, and protecting information by an access history are expanded. Proposed (Japanese Patent Application No. 7-125387)
No. "Interaction management type information providing method and device").

FIG. 9 shows the system configuration of Japanese Patent Application No. 7-125387. 101, 103 and 10
4 is the same as in FIG. Client computer 1
Inside 01, 201 is various browsers for receiving WWW service provision, and 202 is the computer 1
A variety of operating systems for controlling 01, and a storage unit 401 for storing information (hypertext etc.) to be provided by the user 203 in the WWW service in the server-side computer 103.
Is a daemon for providing a WWW service capable of interactive management, 402 is an interactive storage unit for accumulating information required for interactive management, and 205 is various operating systems for controlling the computer. Browser 2
From 01, an information acquisition request is issued to the WWW server on the network according to the URL from the user input from the input device of the computer. In the daemon 401 of the WWW server that has received the information acquisition request, the dialogue storage unit 402
Whether or not WWW service can be provided is determined based on
When permitting the service provision, the information in the information storage unit 203 indicated by the URL is transferred to the user.

FIG. 10 shows an example of a sequence between the client and the server in this case. Here, a series of accesses will be called a dialogue. At the initial stage of access from the user, the server generates an identifier (conversation ID) for the conversation and U required for the next access.
The hypertext in which the conversation ID is added to the RL is provided to the user. From the client, the user clicks a predetermined character on the transferred hypertext to access the server by the URL with the conversation ID.

In the system of Japanese Patent Application No. 7-125387 mentioned above, access control can be performed at a high level in a communication service for an unspecified number of users, but the effective range of these functions depends on each information provider. Only for the server. For this reason, in a series of information acquisition using WWW, when accessing across various information providing servers on a computer network, it is necessary to separately authenticate the information acquisition request in each server.

[0010]

SUMMARY OF THE INVENTION An object of the present invention is to provide a hypertext on a computer network to a large number of unspecified users in a communication service using WWW. Enables advanced access control such as identification, storage of operation history for each user, protection of information by access history, and at the same time, consistent access control even in a series of access across multiple servers , There is no need to authenticate a separate information acquisition request at each server.

[0011]

SUMMARY OF THE INVENTION The present invention is based on the above-mentioned Japanese Patent Application No. 7-125 in the URL used in HTTP in WWW.
The most important feature is that the identifier (conversation ID) for identifying a series of information from the same user introduced in No. 387 is inherited and managed among a large number of servers existing on the computer network.

[0012]

According to the present invention, in the initial stage of access from the user, the server identifies the conversation (conversation I
D) is generated, and the hypertext to which the URL and the conversation ID required for the next access are added is provided to the user. From the client, the user clicks a predetermined character on the transferred hypertext to access the server with the dialogue ID and the URL. The server analyzes the conversation ID in the information acquisition request sent from the client, identifies the same user, stores a series of accesses, and checks a predetermined access. In these checks, the conversation ID in your server
In addition to the identification based on the management information of 1., the dialog server inquires about the conversation ID managed by another server, and the conversation ID issued by the other server is also validated. This enables consistent access control even in a series of access across servers.

[0013]

DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described below with reference to the drawings.

FIG. 1 shows an embodiment of a computer network to which the present invention is applied. In the figure, 101 is a computer (client-side computer) used by a user to receive a service, 1
Reference numerals 02 and 103 denote computers (server side computers) for providing services, and 104 is a network for providing communication services between them. Various WWW browsers operate on the client side computer 101, and server side computers 102 and 10
3, various daemon programs that provide WWW services operate, and information to be provided to users through the network 104 is accumulated. The difference between 102 and 103 is that 102 manages the user information on the 101 side and 103 does not manage the user information on the 101 side. Computers 101, 102 and 103
Are connected by a network 104.

FIG. 2 shows an example of a more detailed system configuration of the present invention. In the figure, in the client side computer 101, 201 is various browsers for receiving WWW service provision, and 202 is the computer 1
01 are various operating systems for controlling 01, and server side computers 102 and 103.
Of these, 203 is a storage unit for storing information (hypertext etc.) for providing to the user in the WWW service, 40.
Reference numeral 1 is a service control unit (daemon) for providing a WWW service capable of managing dialogues, 402 is a dialogue storage unit for accumulating information necessary for carrying out dialogue management, and 205 is for controlling the computers 102 and 103. Various operating systems. The computer 102 is a home server that manages user information of users who use the client-side computer 101, and the computer 103 is a server computer that is not the home server of the client-side computer 101.

FIG. 3 shows a detailed configuration of the service control unit (daemon) 401 in the computers 102 and 103. Reference numeral 601 is an access control unit, 602 is a dialogue identification unit, and 603 is a communication processing unit.

From the browser 201 of the client side computer 101, an information acquisition request is issued to the WWW server on the network 104 in accordance with the URL input by the user from the input device of the computer 101.
In the service control unit 401 of the server-side computer 102 or 103 that has received the information acquisition request, the access control unit 601 determines whether information is provided and whether or not access is possible, and the dialog identification unit 602 communicates with a user who is permitted access. The access information of the user is managed for each ID issued and each conversation ID, and the information in the storage device 203 is transferred to the user by the communication processing unit 603.

FIG. 4 shows an example of a sequence between the client and the server according to the present invention. here,
It is assumed that the server A and the server B have a partnership relationship.

In the first example for the user A, an information acquisition request (first access) is made to the server A by inputting the URL from the user A in the client (browser), and the initial screen with the dialog ID acquisition request is acquired. Next, the client sends an information acquisition request with a dialog ID acquisition request (second access) by the operation of the user A to the server A.
Go to. If the information acquisition request from the client satisfies the information providing condition (for example, the information of the user A is managed by the server A in this example because the user name and the password match), the server A determines the conversation ID. Issued,
The dialogue ID is stored in the dialogue storage unit 402, and the dialogue ID is added to the hypertext requested by the user (this is accompanied by the next information acquisition request) and output. In this example, the destination of the next information acquisition request is the hypertext in the server B, and the information acquisition request added with the conversation ID issued by the server A is issued to the server B (third access). The server B that has received the information acquisition request with the conversation ID analyzes the conversation ID and issues a conversation ID inquiry and a user information acquisition request to the server A that is the conversation ID issuing source. Server A responds to the inquiry from Server B by
The dialog storage unit 402 is searched to authenticate the dialog ID, and the authentication result and the user information in the system (for example, inquiry to the OS) are returned to the server B. The server B determines whether or not the information in the server B can be provided to the user A based on the authentication result and the user information transmitted from the server A. In this example, since the information provision to the user A is permitted, the server B outputs the hypertext in the self information storage unit 203 to the user A.

In the following example for the user B whose home server is the server B, an information acquisition request (first access) is made to the server A by inputting the URL from the user B in the client (browser), and the conversation ID acquisition request Acquire initial screen. Next, in the client, the information acquisition request with the conversation ID acquisition request (2
Access) to the server A. However, in this example, the information of the user B is not managed by the server A, and the user B has not authenticated at the home server in the course of a series of access (there is no conversation ID issued by the server B). , Server A is denied access.

FIG. 5 shows an example of a URL with a dialogue ID as one embodiment of the information acquisition request with a dialogue ID. The URL of the first access used in the first access to obtain the initial screen is the same as the conventional WWW. In the second access, the ID acquisition request is added to this URL. In the third and subsequent accesses, in addition to the various information acquisition requests, the dialog ID specifying the issuing server is added to access the server. Then, this conversation ID is inherited to other servers.

FIG. 6 shows a flowchart of the operation of the service control unit 401 in the server computer. In FIG. 6, the part surrounded by the broken line is the operation of the access control unit 601 and the dialogue identifying unit 602, and the other part is the operation of the communication processing unit 603.

First, in step 1002, it is determined whether the input to the service control unit is an information acquisition request from a client or a dialogue ID inquiry from another server. In the case of an inquiry about the conversation ID from another server, the processes of steps 1003 to 1006 are performed, and the determination result and the user information are returned to the inquired server. In the case of the information acquisition request from the client, it is determined in steps 1007 and 1009 whether it is the first access, the ID acquisition request, or the conversation ID-added information acquisition request. In the case of the first access, a process for returning the initial screen with the ID acquisition request is performed in step 1008. In the case of an ID acquisition request, whether or not the dialog ID is to be issued is determined in step 1010 based on the user information transmitted together with the ID acquisition request. If the dialog ID is to be issued, the processing in steps 1011 to 1014 is performed. When the information is provided to the user and the user is not permitted, an access denial message is output in step 1015. In the case of the information acquisition request with the dialogue ID, the dialogue ID is extracted in step 1016, and the dialogue ID is checked in step 1017. Then, if the conversation ID is issued by itself, steps 1018 to 102
Information is provided to the user according to the processing of 0, and if the conversation ID is issued by another server, an inquiry about the conversation ID is made to the server identified by the conversation ID in step 1021, and the determination result and the user information are acquired in step 1022. After that, whether or not the access is permitted is checked in Step 1023, and when the access is permitted, the information is provided to the user in Steps 1024 and 1025. In the case of other conversation IDs, it is regarded as an illegal conversation ID, and the access is performed in Step 1026. Perform rejection processing.

[0024]

As described above, according to the present invention,
By inheriting and validating the identifier for a series of access introduced in the above-mentioned Japanese Patent Application No. 7-125387 between different servers, it is possible to perform consistent access control in a series of access across servers. become.

[Brief description of drawings]

FIG. 1 is an example of a system configuration for providing a communication service targeted by the present invention.

FIG. 2 is a detailed diagram of an embodiment of a system configuration according to the present invention.

FIG. 3 is a detailed diagram of a service control unit in the server of FIG.

FIG. 4 is an example of a sequence between a client and a server in the present invention.

FIG. 5 is an example of a URL for realizing an information acquisition request with a dialogue ID according to the present invention.

FIG. 6 is an example of a flowchart of a service control unit of the server according to the present invention.

FIG. 7 is an example of a system configuration for providing a conventional WWW service.

FIG. 8 is an example of a sequence in a conventional WWW service server and client.

FIG. 9 is an example of a system configuration previously proposed by the applicant.

10 is an example of a sequence in the server and the client of the system configuration of FIG.

[Explanation of symbols]

 101 Service Target Computer 102, 103 Service Provider Computer 104 Network 201 WWW Browser 202 Operating System 203 Information Storage Unit 204 WWW Daemon 205 Operating System 401 Service Control Unit 402 Dialogue Storage Unit 601 Access Control Unit 602 Dialogue Discrimination Unit 603 Communication Processing Department

Claims (2)

[Claims] 1. An access control method on a server side in a computer network including a server computer having a World-Wide Web for information provision and a client computer having a browser for obtaining information from the World-Wide Web, which is a client. When the information acquisition request is received from the side, it is determined whether it is the first information acquisition request or the second or subsequent information acquisition request. In the case of the first information acquisition, the hypertext of the initial screen having the information request with the ID acquisition request Is returned to the client side, and at the time of the second and subsequent information acquisition requests, if there is a request from a user who has satisfied the information provision conditions with an ID acquisition request, the conversation ID specified by the issuing server Produces
The dialog ID is registered in the dialog storage unit, the hypertext with the dialog ID added is returned to the client side, and in the case of an information acquisition request that is not an ID acquisition request, the dialog ID in the information acquisition request is extracted. An inquiry is made to the issuer server that is known from the conversation ID, and it is determined whether information can be provided based on the result of user authentication from the issuer server.
Dialogue inheritance on a computer network characterized by performing access denial when the dialogue ID does not exist, or is not a regular dialogue ID, or even if the regular dialogue ID does not allow information provision according to the user's attributes Type access control method. 2. In a server computer that provides World-Wide Web information to a client computer connected by a computer network by Hyper Transfer Protocol, an interactive identification means for identifying a series of accesses from the same user, and the same user's interactive identification means. A server computer comprising: an interactive storage means for storing an access history and a control means for controlling information provision by referring to the access history from a plurality of servers.