JPH11161609A - System and method for method use authentication of decentralized object system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce resources to be used to check the use right with respect to the method use authentication system of the decentralized object system. SOLUTION: Sever application on a server computer X1 accepts a request to execute a method from a user and extracts a method right identifier indicating the user range of the method that the user can use. A method authenticating process part 5 checks the use right of the method p7 of the user with the method right identifier and the method identifier of the method p7 requested by the user. When a method pp11 that the method p7 considered to have the use right is present on a server computer Y2, the server computer Y2 checks the use right of the method pp11 of the server computer X1 with the method right identifier ddd from the server computer X1 and the method identifier pp and executes the method pp11 when the use right is effective.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a security check method in an object-oriented distributed computing system, and more particularly, to a method for authenticating a user and a method for authenticating a method.

[0002]

2. Description of the Related Art In a network system of a client-server model, a server which provides a network service function checks the right to use a service by using a user identifier transmitted from a client who generally wants to receive the service. I have.

[0003] For example, Japanese Patent Laid-Open Publication No. 4-358
In 250 ", a mechanism is described in which a service of a server on a computer can be used if the user passes a use right check by a login identifier such as a user identifier and a network address at the time of login.

FIG. 5 is a configuration diagram of a use authentication system described in the above publication. In FIG. 5, the user x on the computer A
However, when the user accesses the resource on the computer B via the network, the user identifier is stored in the request to the server 5 on the computer B, and a service request is made. After it is checked that the user identifier and the network address of the requesting computer are registered in the user registration list for managing the usage right, the user x accesses the resource provided by the server on the computer B. Can receive.

When this method is applied to a distributed object system, items of available methods are added to the record of the user registration list and managed, and when a service request is made, a user identifier and a request A record matching the network address of the original computer and the request method is searched from the user registration list, and if it exists, it is considered that the user has the right to use the request method, and the service is provided.

[0006]

The method using authentication method in the above-mentioned conventional distributed object system is as follows.
In order to check the execution right of a method execution request from a user who has logged in to the computer, it is necessary to manage all users and combinations of methods for which the user has execution rights in the user right table However, there has been a problem that the data amount of the user right table becomes enormous and consumes storage resources.

Further, in order to check the execution right of a method execution request from a user who has logged in to another computer via the own computer, the user logs in to the user right table of the other computer. It is also necessary to manage the data of the user managed in the user right table of the incoming computer, and there is a problem that the data amount of the user right table is further increased.

An object of the present method is to provide a user use authentication method for a method that solves the above problem in a distributed object system.

[0009]

According to a first aspect of the present invention, in a method usage authentication system in a distributed object system, a computer that receives a method execution request from a user uses the method based on a user identifier of the user. A server application for retrieving a method right identifier indicating a range, and a method authentication processing unit for checking the right of use of the method by the user based on the method right identifier and a method identifier for identifying the method requested by the user. It is characterized by having.

According to a second aspect of the present invention, in the first aspect, the server application extracts the method right identifier from an entry that matches the user identifier of the user from a user registration table provided in advance. And

[0011] In a third aspect of the present invention, the method authentication processing means according to the first aspect is arranged such that, when an entry including a combination of the method usage right identifier and the method identifier exists from a method security table provided in advance. Is characterized as having the right to use.

According to a fourth aspect of the present invention, in the method of the first aspect, the method authentication processing means uses the own method if the child method called by the method, which is considered to have the right to use, exists in another computer. A method execution request is output to the other computer together with the second method right identifier indicating the use range of the method that can be performed and the method identifier of the child method, and the method authentication processing means of the other computer receiving the method execution request Check the usage right of the child method based on the received second method right identifier and the method identifier of the child method.

According to a fifth invention of the present application, the method authentication processing means of the another computer in the fourth invention includes a combination of the second method usage right identifier and the child method identifier from a method security table provided in advance. When an entry exists, it is determined that the child method is used.

According to a sixth aspect of the present invention, in the method usage authentication method in the distributed object system, when the computer receives a method execution request from the user, the computer can use the method from a user registration table provided in advance. The method right identifier indicating the usage range of the method is taken out, and the right to use the method of the user is checked from the method security table provided in advance by the method right identifier and the method identifier for identifying the method requested by the user. It is characterized by doing.

The seventh invention of the present application is the method according to the sixth invention, wherein a child method called by the method, which is regarded as having the right to use, exists in another computer, and the method can be used by the own computer. A method execution request is output to the other computer together with the second method right identifier indicating the second method right identifier and the method identifier of the child method, and the other computer that has received the method execution request receives the received second method right identifier and the second method right identifier. The usage right of the child method is checked based on the method identifier of the child method.

[0016]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Next, a first embodiment of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a block diagram showing a first embodiment of the present invention.

When the user starts a session to receive the service provided by the server application 3 to the server computer X1, the server application 3 searches the user right table 4 for an entry corresponding to the user identifier, and After obtaining the method right identifier indicating the use range of the method that can be used by the user, the method authentication processing 5 is called. The method authentication processing 5 searches the method security table 6 for an entry including the method right identifier and the method identifier indicating the method requested by the user, and calls the method specified by the method identifier when the entry exists. Providing services.

The server computer Y2 is also provided with a method authentication process 10 and a method security table 11, and performs the same processes as the server computer X1.

Next, the operation of the first embodiment of the present invention will be described in detail with reference to FIG.

The service that the user X requests from the server application 3 of the server computer X1 is a method p7, and the method p7 is a method p11 (corresponding to a child method described in claims) and another method as an execution unit. The composite method to construct, and the method p
11 is located on the server computer Y.

When the user X uses the server application 3 of the server computer X1, a user identifier 111 is stored in a request for the server application 3. The server application 3 extracts the user identifier from the request (step 21), and searches the user registration table 4 of the computer X1 for a user entry that matches the user identifier 111 (step 22). Since a matching entry exists, the method right identifier aa
a (step 24), and then a method usage right identifier aaa and a method identifier p indicating the method to be used
7 is stored in the request, and the method authentication processing 5 is called. The method authentication process 5 searches the method security table 6 for an entry including a combination of the method usage right identifier aaa and the method identifier p (step 25). Since the entry exists, it is determined that the right of use of the method indicated by the method identifier p is available, and the method p7 is called (step 27).

In the method p7, the method right identifier ddd8 stored in the method p7 is extracted, and the method right identifier ddd and the method identifier pp which is an execution unit of the method p7 are stored in the request, and the method identifier pp exists. Method authentication processing 9 of server computer Y2
Call. The method authentication process 9 searches the method security table 10 for an entry that matches the method right identifier ddd and the method identifier pp (step 30). Since the entry exists, it is assumed that the right to use the method pp11 is available, the method pp11 specified by the method identifier pp is called (step 32), and a service is provided (step 33).

[0024]

Next, an embodiment of the present invention will be described with reference to the drawings.

FIG. 3 is a functional block diagram showing a news clipping service as an embodiment.

The news clipping service is a service for transmitting newspaper articles of a genre designated by a user to a user by e-mail, and is provided by a function of searching for articles under specified conditions and a function of transmitting a result by e-mail. In FIG. 3, the news clipping program 31 on the server computer X1 calls the clipping 71 that actually performs clipping, and the article search 11 on the server computer Y2 is performed to search for a newspaper article from the clipping 71.
2 is called.

In the method security table 10 on the server computer Y 2, the method identifiers “article search” and “article reference” indicate that the method right identifier ddd indicates the right to use the methods of the article search 112 and the article reference 113. "It is defined. On the other hand, the method right identifier ddd is stored in the clipping 71 method on the server computer X1, indicating that the user has the right to use the article search 112 and article reference 113 methods on the server computer Y2. . ddd is
This is the method right identifier of the computer, which indicates the usage range of the method that can be used by the own computer.

When the user X starts a session to receive a news clipping service for delivering news belonging to a specified genre to the server computer X1,
The news clipping program 31 searches the user right table 4 for an entry that matches the user identifier 111, and obtains a method right identifier aaa indicating the use range of the service that can be used by the user. Next, method authentication processing 5
Is the method right identifier aa included in the method invocation request
An entry including a and the method identifier "clipping" is searched from the method security table 6, and if an entry exists, the clipping 71 is called. Similarly, the server computer Y2 has a method authentication process 9, a method security table 10, and a clipping 71.
Is provided with a method "article search 112" called from the.

Next, the operation of the embodiment of the present invention will be described in detail. When the user X uses the news clipping 31 which is a service of the server computer X1, the user identifier 111 is stored in the request for the news clipping 31. The news clipping 31 extracts the user identifier 111 from the request and searches the user right table 4 of the computer X1 for a user entry that matches the user identifier 111. Since there is a matching entry, the method right identifier aa included in the next entry
a and the clipping 71 method are stored in the request, and the method authentication processing 5 is called. The method authentication processing 5 is based on the method usage right identifier a
Search for an entry that matches aa. Since the method identifier “clipping” in the entry matches the requested method identifier, it is assumed that the clipping 71 method has the right to use, and the clipping 71 is called. In the clipping 71, since it is necessary to call the article search 112 method of the server computer Y2 for the purpose of article search, the method right identifier ddd stored in the method providing the service is extracted, and the method right identifier ddd and the article search are retrieved. 112 is stored in the request, and the method authentication process 9 of the server computer Y2 is called. The method authentication process 9 is based on the method right identifier ddd and the method identifier “article search” from the method security table 10.
Search for an entry that matches. Since the entry exists, it is considered that the right to use this method exists, and the article search 1
Calls 12 methods to search for articles. When the result of the article search is returned, the clipping 71 sends an article conforming to the clipping condition to the user by e-mail and returns it.

Next, a second embodiment of the present invention will be described in detail with reference to the drawings.

FIG. 4 is a block diagram showing a second embodiment of the present invention.

When the user starts a session to receive the service provided by the server application 3 to the server computer X1, the server application 3 searches the user right table 4 for an entry matching the user identifier, and searches for the user. After obtaining the method right identifier indicating the use range of the service that can be used, the method p7 is called. The method p7 searches the method security table 6 for an entry that matches the method right identifier and the method identifier in the method authentication processing 5, and if there is a matching entry, performs the processing of the method p7 to provide a service. The server computer Y2 also has a method security table 10 similarly.

As described above, individually providing the method authentication processing 5 in the method p7 is disadvantageous in terms of effective use of resources, but has an advantage that the processing becomes faster.

Next, the operation of the second embodiment of the present invention will be described in detail.

When the user X uses the server application 3 of the server computer X1, the server application 3 calls the method p7 of the server computer X1 and the method p7 is the method p11 of the server computer Y2.
Is called, first, the user identifier 111 is stored in the request to the server application 3. The server application 3 extracts the user identifier 111 from the request, and searches the user right table 4 of the computer X1 for a user entry that matches the user identifier 111.
Since there is a matching entry, the method usage right identifier aaa included in the entry is extracted, stored in the request, and the method p7 specified by the method identifier p7 is called. In the method p7, in the method authentication process 5, the method security table 6 is searched for an entry that matches the method right identifier aaa and the method identifier p. Since there is a matching entry, it is considered that the right to use the method p7 exists, and the process of the method p7 is executed.

In the method p7, the method right identifier ddd stored in the method p7 is taken out, the method right identifier ddd is stored in the request, and the method pp1
Call the method pp11 of the server computer Y2 where 1 exists. In the method authentication process 9, the method pp11 searches the method security table 10 for an entry that matches the method right identifier ddd and the method identifier pp. Since there is a matching entry, the method pp11 determines that the use right of the method pp11 exists. After that, the process of the method pp11 is continuously executed,
Providing services.

[0037]

As described above, according to the present invention, when the method usage authentication of the user is performed, the combination of all the users and the method for which the user has the execution right in the user right table as in the related art. Instead of managing them, the method security table manages the method right identifier that certifies the user's right to use multiple specific services on the computer, and uses the method right identifier when the user uses the service. Has the effect of reducing resources used for checking usage rights.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a first embodiment of the present invention.

FIG. 2 is an operation flowchart showing the first embodiment of the present invention.

FIG. 3 is a block diagram when a news clipping service is used as an example in the first embodiment;

FIG. 4 is a block diagram showing a second embodiment of the present invention.

FIG. 5 is a block diagram showing an embodiment of the related art.

[Explanation of symbols]

 1 server computer X 2 server computer Y 3 server application 4 user registration table 5 method authentication processing 6 method security table 7 method p 8 method right identifier ddd 9 method authentication processing 10 method security table 11 method pp 31 news clipping program 71 clipping 112 Article search 113 Article reference

Claims (7)

[Claims] 1. A method for authenticating a method usage in a distributed object system, comprising: a server application which receives a method execution request from a user and extracts a method right identifier indicating a usage range of the method from a user identifier of the user; A method in a distributed object system, comprising: a method authentication processing means for checking the right of use of the method by the user with the method right identifier and a method identifier for identifying the method requested by the user. Usage authentication method. 2. The distributed object system according to claim 1, wherein the server application extracts the method right identifier from an entry that matches the user identifier of the user from a user registration table provided in advance. Method usage authentication method. 3. The method authentication processing means, when an entry including a combination of the method usage right identifier and the method identifier exists from a method security table provided in advance, determines that the method usage right exists. The method usage authentication method in the distributed object system according to claim 1. 4. The method authentication processing means according to claim 2, wherein, when a child method called by the method regarded as having the right to use exists in another computer, the method authentication processing means indicates a use range of the method which can be used by the own computer. A method execution request is output to the other computer together with the method right identifier and the method identifier of the child method, and the method authentication processing means of the other computer that has received the method execution request receives the received second method right identifier and the second method right identifier. 2. The method usage authentication method in a distributed object system according to claim 1, wherein a right to use said child method is checked based on a method identifier of said child method. 5. The method authentication processing means of the another computer uses the child method when there is an entry including a combination of the second method usage right identifier and the child method identifier from a method security table provided in advance. 5. The method using authentication method in a distributed object system according to claim 4, wherein the method is regarded as having a right. 6. In the method usage authentication method in a distributed object system, when a computer receives a method execution request from a user, the computer indicates a usage range of the method that can be used by the user from a user registration table provided in advance. Extracting a method right identifier, and checking the user's right to use the method from a method security table provided in advance based on the method right identifier and a method identifier for identifying the method requested by the user. Method usage authentication method in distributed object system. 7. When a child method called by the method deemed to have the usage right exists in another computer, a second method right identifier indicating the usage range of the method that can be used by the own computer and the child method A method execution request is output to the other computer together with the method identifier of the method,
7. The distributed object according to claim 6, wherein the other computer receiving the method execution request checks the right to use the child method based on the received second method right identifier and the method identifier of the child method. Method usage authentication method in the system.