JP2002073557A - Storage medium storing a program for causing server to perform processing related to authentication - Google Patents

Abstract

(57) [Problem] An object of the present invention is to provide a session number for identifying a connection after completion of authentication from a user terminal connected via a network using authentication information for specifying a user who uses the user terminal. It is an object of the present invention to provide an authentication system that manages an authentication state in association with each other and controls access from a user terminal. An object of the present invention is a storage medium storing a program for causing a server to perform a process of performing authentication based on authentication information specifying a user received from a user terminal connected via a network, A session number notification procedure for notifying the user terminal of a session number for identifying a session that can be connected according to the authentication result of the user authentication performed based on the authentication information received from the user terminal; This is achieved by a storage medium storing a program having a session number registration procedure for registering the session number in an authentication connection management unit that manages the session numbers notified by the session number notification procedure in association with each other.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to an authentication system for performing authentication based on authentication information for specifying a user from a user terminal connected via a network, and more particularly, to identifying the authentication information and connection. The present invention relates to an authentication system for managing an authentication state in association with a session number and controlling access from a user terminal.

[0002]

2. Description of the Related Art Conventionally, WWW (World Wood)
As one of the functions for restricting access to contents in the eWeb) server, there is basic authentication for authenticating with a user name and a password at the time of access. When developing an application that requires authentication on a WWW server,
In many cases, basic authentication is used. In the basic authentication, when the authentication is successful, access to the content is only permitted uniformly, and there is no mechanism for restricting access according to the user name. For this reason, when it is desired to restrict access for each user in an application, each application independently controls the access after the basic authentication, and authentication information such as which operation is permitted for each user is also managed for each application.

Further, in a conventional host-driven computer system, a user who uses a terminal is authenticated by a user inputting a profile and a password from the terminal. After authentication, the host computer has a message queue for each profile,
A message between the host computer and the terminal is realized by a mechanism for transmitting a processing result of an application started from the terminal or a message from the system in response to a processing request from the terminal to the host computer to the authenticated profile.

[0004]

However, in the above-described conventional authentication method, a new Web application is
Each time a WW server is provided, an individual authentication process is required in a new Web application. That is, it is necessary to create a table for managing profile names and passwords that can be used in the new Web application, and an authentication process for checking the validity of the profile name and password using the table.

[0005] Further, a user needs to input a profile name and a password every time the Web application is started.

Further, as described above, since the authentication function is provided for each Web application, a different profile name and password can be set for each Web application, but the authentication processing may be complicated.

Further, a client which manages a client for each session and provides information based on a request from the client is provided.
In a WW server, when an application operating on a conventional host-driven computer system can be operated from a WWW browser, there is a problem that messages accumulated for each profile name cannot be displayed on a browser on a client side.

Further, CGI (Common Gateway Interface)
ce) Program or HTML (Hyper Text Markup Lang)
uage) When an access right check is added for each content, it is necessary to independently create control for each Web application.
When the user right is changed on the web application side, there is a problem that this right change is not immediately reflected in the access right to the HTML content or the like.

Therefore, it is necessary for a server to manage an authentication state based on a profile name and a password and a session number for identifying a connection with a terminal on a network.

[0010] Therefore, an object of the present invention is to provide a server in which, after authentication from a user terminal connected via a network is completed by authentication information specifying a user who uses the user terminal, a session number for identifying the connection is established. It is another object of the present invention to provide a storage medium storing a program for managing an authentication state and controlling access from a user terminal.

[0011]

According to the present invention, there is provided a server for performing a process of performing authentication based on authentication information for identifying a user received from a user terminal connected via a network. Number notification for notifying the user terminal of a session number for identifying a session that can be connected according to the authentication result of the user authentication performed based on the authentication information received from the user terminal in the storage medium storing the program for And a session number registration step of registering the session number in an authentication connection management unit that manages the authentication information authenticated by the user and the session number notified by the session number notification procedure in association with each other.

A server in which the program is installed from a storage medium storing such a program performs user authentication with the authentication information, and after the authentication, can manage the authentication information with a session number for identifying a network connection. .

Therefore, when an access request with a session number is received from a user terminal, control corresponding to the access request can be performed based on the session number. In the case of a connection, the authentication process need only be performed once, and there is no need to perform the authentication process for each access.

The authentication information is a profile name and a password that can identify the user.

[0015] From the viewpoint that an access request from a user terminal can be restricted, the present invention further provides an authentication information corresponding to a session number assigned to the access request when the access request is received from the user terminal. From the authentication information managed by the authentication connection management means,
It can be configured to have an access permission procedure for permitting the access request according to the search result.

The server in which the program is installed from the storage medium storing such a program searches the authentication information by the session number, and according to the search result, permits the application to be started. It can know whether the user who is performing is authenticated. Therefore, there is no need to perform authentication processing for each application.

In view of restricting an access request to a program from a user terminal, the present invention provides the above-mentioned access permission procedure, wherein, when the access request is a program execution request, the session number assigned to the execution request The corresponding authentication information is retrieved from the authentication connection management means, and the authorization information is obtained from the authentication information management means that manages the authorization information for each authentication information in accordance with the search result. Acquiring the execution permission information relating to the requested program from the execution permission information managing means for managing the execution permission information for each program, and acquiring the execution permission information and the authority information acquisition procedure. An execution permission determining step of determining execution permission of the program based on the authority information.
According to the result of the execution permission determination procedure, the program can be configured to be permitted to be executed based on the authentication information.

The server in which the program is installed from the storage medium storing such a program searches the authentication information by the session number, and permits the start of the external program according to the search result. It is possible to know whether the corresponding user has been authenticated. Therefore, it is not necessary to perform the authentication process for each external program.

The above program is, for example, CGI (Comm
on Gateway Interface).

The execution permission information is, for example, information set for each external program such that only a system administrator, a general user, or the owner is permitted to execute.

The authority information is information set at the time of authentication registration, and indicates, for example, an authority level of a system administrator or a general user.

From the viewpoint of restricting an access request from a user terminal to a file, the present invention provides the above-mentioned access permitting means, when the access request is a file provision request, by using a session number assigned to the provision request. Acquiring the corresponding authentication information from the authentication connection management means, and obtaining the authority information corresponding to the authentication information from the authentication information management means for managing the authority information for each authentication information according to the search result. Steps: obtaining, from the provision permission information management means for managing provision permission information for each file expressing the provision information, provision permission information relating to the file for which provision was requested, and obtaining the obtained provision permission information and the authority information A provision permission determining step of determining provision permission of the file based on the authority information obtained by the procedure. Depending on the result of determination by the variable determining procedure based on the authentication information may be configured to allow the provision of the file.

The server in which the program is installed from the storage medium storing such a program searches the authentication information by the session number, and according to the search result, permits the access to the file. It is possible to know whether the corresponding user has been authenticated. Therefore, it is not necessary to perform the authentication process for each file.

The file is, for example, a file in HTML (Hyper Text Markup Language) format for providing information.

From the viewpoint that a message can be transmitted to a terminal, the present invention searches for corresponding authentication information from the authentication connection management means based on a session number transmitted from a user terminal, and based on the searched authentication information. And obtaining, for each piece of authentication information, corresponding message range information from authentication information management means for managing message range information indicating a range of receivable messages, and notifying the user terminal of a message corresponding to the obtained message range information. And a message control procedure.

A server in which the program is installed from a storage medium storing such a program can transmit a message to a user terminal. Also, an appropriate message can be transmitted to the terminal according to the message range information.

From the viewpoint of facilitating the authentication end processing, the present invention provides the above-mentioned message control procedure, wherein the message is transmitted to a user terminal corresponding to a session number managed by the authentication connection management means at predetermined intervals. And a session disconnection procedure for performing a session disconnection process by deleting information relating to the session number from the authentication connection management means in accordance with the presence or absence of a response from the user terminal to the message. .

The server in which the program is installed from a storage medium storing such a program performs a session disconnection process depending on whether or not there is a response from the user terminal. There is no need to perform authentication termination processing based on the authentication. Therefore, it is not necessary to perform authentication end processing for each of the application, program, HTML content, and the like provided to the user terminal.

According to the present invention, there is provided an authentication server for performing authentication based on authentication information specifying a user received from a user terminal connected via a network, wherein the authentication server performs user authentication based on the authentication information received from the user terminal. A session number notifying unit for notifying the user terminal of a session number for identifying a session that can be connected according to the authentication result, and associating authentication information of the authenticated user with the session number notified by the session number notifying unit. And an authentication connection management means for managing the authentication information corresponding to the session number given to the access request from the authentication information managed by the authentication connection management means when receiving an access request from the user terminal. And access permission means for permitting the access request in accordance with the search result. It is possible to configure that.

According to the present invention, there is provided an authentication method for performing authentication based on authentication information for specifying a user received from a user terminal connected via a network, the user authentication being performed based on the authentication information received from the user terminal. A session number notification procedure for notifying the user terminal of a session number for identifying a session that can be connected according to the authentication result, and the authentication information of the authenticated user is associated with the session number notified by the session number notification procedure. And an authentication connection management procedure to manage the authentication information corresponding to the session number assigned to the access request from the authentication information managed by the authentication connection management procedure when the access request is received from the user terminal. And an access permission procedure for permitting the access request according to the search result. It can be configured to. The present invention provides a user terminal connected to an authentication server that performs user authentication via a network, based on a session number that identifies a session that can be connected according to the authentication result of the user authentication notified from the authentication server. A message processing unit for receiving a message transmitted from the authentication server and responding to the message, the message processing unit having an acquisition procedure for acquiring the message processing means from the authentication server, and receiving the message according to the message processing means acquired by the acquisition procedure. The message may be displayed on the display unit, and a response message to the displayed message may be selectively transmitted.

In such a user terminal, a message transmitted from the authentication server can be received and displayed, and a response message to the displayed message can be transmitted.

[0032]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a diagram showing a system configuration of the authentication system.

The WWW server 100 operates as the authentication management processing unit 20
By having 0, it functions as an authentication system.

In FIG. 1, the WWW server 100
eb application A and Wb application B
And a CGI 140 that provides content 145 having CGI content or HTML content, and further includes an authentication management processing unit 200 and a CGI 220 that authenticate the user of the terminal 30 connected via the Internet.

The authentication management processing unit 200 stores a profile database (D) for managing authentication information for each profile.
B) and a CG that manages an authentication management table 225 that associates a session number with which a connection has been established with the terminal 30 with a profile indicating the user of the terminal 30.
By controlling I220, the user of the terminal 30 is managed. In addition, according to the authentication result, the Web application A and the Web application and the content 210 provided by the CGI 140 are provided to the user.

The profile DB 210 manages passwords, authority information, message receiving range information, and the like for each profile name.

The authentication management table 225 stores a session number and a profile name that are currently connected.

At the terminal 30, the user enters WWW-B
A connection is made to the WWW server 100 using the browser 40. The user authenticates to the WWW server 100 by inputting the profile and the password. WWW-B
The router 40 performs an authentication process by transmitting the profile and password input by the user to the WWW server 100. The session number is notified according to the result of the authentication processing in the WWW server 100, and the session number is stored in the session number storage area 50.

The hardware configuration of the computer system that constitutes the authentication system according to one embodiment of the present invention is, for example, as shown in FIG.

In FIG. 2, a WWW server 100 as this authentication system includes a CPU (Central Processing Unit) 11, a memory unit 12, an input unit 14, a display unit 15, an auxiliary storage device 16, a CD-ROM drive unit 17, and a communication unit. It has a unit 18.
These units 11, 12, 13, 14, 15, 1,
6, 17 and the communication unit 18 are connected to the bus B.

The CPU 11 controls the WWW server 100 according to a program stored in the memory unit 12 and performs processing in an authentication management processing unit 200 as described later. The memory unit 12 includes a RAM and an RO
M, and stores a program executed by the CPU 11, data necessary for processing by the CPU 11, data obtained by the processing by the CPU 11, and the like. Further, a part of the area of the memory unit 12 is allocated as a work area used for processing in the CPU 11.

The input unit 14 has a mouse, a keyboard, and the like, and is used by an administrator to input various information necessary for processing in the WWW server 100. The display unit 16 displays various information necessary for the administrator under the control of the CPU 11.

The auxiliary storage device 16 is composed of, for example, a hard disk unit, and various tables such as the authentication management table 225 shown in FIG.
It stores a program for executing the web application and various external programs called by the CGI.

A program related to the authentication management process is provided to the system by the CD-ROM 20, for example. That is, the CD-ROM 20 storing the program related to the authentication management process is stored in the CD-ROM drive unit 17.
Is set to the CD-ROM drive unit 17
Reads the program from the CD-ROM 20, and the read program is installed in the auxiliary storage device 16 via the bus B. When the authentication management process is started, the CPU 11 starts the process according to the program installed in the auxiliary storage device 16. Note that a CD is used as a medium for storing the program.
-Not limited to the ROM 20, but may be any computer-readable medium.

FIG. 3 is a diagram showing an authentication management process for a Web application.

As shown in FIG. 3, after the connection is established, the terminal 30
Of the WWW server 100 to the WWW browser 4
The user inputs a profile and a password from the sign-on screen 42 for authentication provided at 0 ().

The WWW server 100 has a WWW browser 4
When the authentication information such as the profile name and the password from 0 is received, the authentication management processing unit 200 is activated. Based on the profile name and the password, the authentication management processing unit 200 accesses the profile DB 210 in which the profile name and the password are associated, and determines whether authentication is possible ().

When the authentication of the user is successful, the authentication management processing section 200 generates a unique session number in the WWW server 100, and registers the profile name and the session number in the authentication management table 225 (), and
The session number is notified to the WW browser 40 ().

The WWW browser 40 stores the notified session number in the session number storage area 50, and thereafter,
It is configured to acquire the session number at the time of data transfer.

When the user of the terminal 30 operates the WWW browser 40
When, for example, the Web application A is started, the WWW browser 40
Obtains the session number from (), and the WWW server 10
0 is notified to the main body of the Web application A operating at (0).

The Web application A checks the validity of the user by referring to the authentication management table 225 based on the notified session number (). When the session number is valid, the Web application A acquires the name of the signed-on profile from the authentication management table 225 (). Therefore, according to the acquisition of the profile, the Web application A
Starts operation. In other applications B and C, the same authentication management processing is performed.

As described above, by associating the profile name with the session number, the Web application authenticated by the profile name can be appropriately changed.
It can be provided to the user according to the corresponding session number.

FIG. 4 is a diagram showing an example of the sign-on screen.

As shown in FIG. 4, the user can use the WWW browser 40
In the sign-on screen 42 provided above, for example,
“XSYSSMNGR”, P in the PROFILE input area 43
A predetermined password is entered in the ASSWORD input area 44. Based on the input data, the authentication management processing unit 200 of the WWW server 100 performs user authentication.

Next, an authentication management process executed by the CPU 11 will be described.

FIG. 5 is a flowchart for explaining the authentication management process.

Referring to FIG. 5, it is determined whether or not the user has signed on in response to the access request from terminal 30 (step S101). That is, based on the session number of the terminal 30 accessed via the network, it is determined from the session management table 225 whether a corresponding profile name exists. If the user has signed on, the authentication management process ends. If the user has not signed on, the process proceeds to step S102.

In step S102, the sign-on screen 42 as shown in FIG.
2 is displayed. The user of the terminal 30 inputs a profile name and a password according to the displayed sign-on screen 42.

The authentication management processing section 200 accesses the profile DB 210 based on the profile name and the password received from the terminal 30, and determines whether or not authentication is possible (step S105).

If it is determined in step S104 that authentication is possible, a unique session number is generated in the WWW server 100 (step S105), and the authentication management table 225 associates the session number with the received profile name. (Step S10)
6).

The authentication management processing unit 20 of the WWW server 100
0 notifies the terminal 30 of the generated session number. Then, the WWW browser 40 of the terminal 30 stores the notified session number in the session number storage area 50 (Step S107).

On the other hand, if it is determined in step S104 that authentication is not possible, the authentication management processing section 200 of the WWW server 100 displays an authentication error on the WWW browser 40 of the terminal 30 (step S108). If there is a display request for the sign-on screen 42 in response to the display request for the sign-on screen 42 from the terminal 30, the authentication management processing unit 200 returns to step S102.
The authentication management process ends.

Next, a case where the terminal 30 accesses the CGI content of the content 142 shown in FIG. 1 will be described with reference to FIGS.

FIG. 6 is a diagram for explaining an example of the authentication management process when executing the CGI content.

As shown in FIG. 6, the user of the terminal 30 can access the URL (Unifor
When “m Resource Locator” is specified, the session number in the session number storage area 50 is automatically notified to the WWW server 100 (step).

Upon receiving the access request from terminal 30, WWW server 100 activates authentication management processing section 200. The activated authentication management processing section 200 searches the authentication management table 225 for a corresponding profile name based on the received session number, and determines whether or not the user is signed on.

If the user is not signed on, that is, if the corresponding profile name is not in the authentication management table 225, the received session number is determined to be invalid, and the sign-on screen 42 for authentication is displayed on the WWW browser 4
0 is displayed.

In the WWW browser 40, the user
The user inputs the profile name and password from the sign-on screen 42, which is the displayed authentication screen (step).

The authentication management processing unit 20 of the WWW server 100
At 0, the profile DB 210 is searched based on the received profile name and password to determine whether authentication is possible. In other words, if there is a password corresponding to the profile name, it is determined that authentication is possible, a unique session number is generated in the authentication system, and the session number generated in the authentication management table 225 is associated with the profile name. register. Further, the generated session number is notified to the WWW browser 40, and the HTML (Hyper Text Markup Language) automatically jumps to the URL specified by the user in the above step.
e) Return the document to the terminal 30.

In the WWW browser 40, the session number notified from the WWW server 100 is stored in the session number storage area 50, and the URL is accessed according to the notified session number.

The authentication management processing unit 20 of the WWW server 100
A value of 0 determines whether or not the session number for which the access request has been made is valid based on the authentication management table 225. In this case, since the notified session number is managed in the authentication management table 225 in association with the profile name, it is determined that the session number is valid.

If the session number is valid in the step, the authentication management processing section 200 acquires the profile name from the authentication management table 225, becomes a profile corresponding to the session number, and sets the profile specified by the URL.
Start the GI program. That is, the authentication management processing unit 2
00 refers to the authority information corresponding to the profile from the profile DB 210, and if the authority information is permitted by the execution permission information for the designated CGI program name defined in the CGI content 146, the sign-on profile Then, the designated CGI program is executed ().

As described above, the WWW server 100 can perform authentication based on a profile name and provide a CGI program in accordance with a session number.
Further, it is possible to permit execution of the CGI content according to the execution permission authority assigned to the profile name.

FIG. 7 is a diagram for explaining an example of an authentication management process when executing HTML content.

As shown in FIG. 7, the user of the terminal 30 uses the WWW browser 40 to obtain the URL (Unifor
When “m Resource Locator” is specified, the session number in the session number storage area 50 is automatically notified to the WWW server 100 (step).

Upon receiving the access request from terminal 30, WWW server 100 activates authentication management processing section 200. The activated authentication management processing section 200 searches the authentication management table 225 for a corresponding profile name based on the received session number, and determines whether or not the user is signed on.

If the user is not signed on, that is, if the corresponding profile name is not in the authentication management table 225, it is determined that the received session number is invalid, and the sign-on screen 42 for authentication is displayed on the WWW browser 4
0 is displayed.

In the WWW browser 40, the user
The user inputs the profile name and password from the sign-on screen 42, which is the displayed authentication screen (step).

The authentication management processing unit 20 of the WWW server 100
At 0, the profile DB 210 is searched based on the received profile name and password to determine whether authentication is possible. In other words, if there is a password corresponding to the profile name, it is determined that authentication is possible, a unique session number is generated in the authentication system, and the session number generated in the authentication management table 225 is associated with the profile name. register. Further, the generated session number is notified to the WWW browser 40, and the HTML (Hyper Text Markup Language) automatically jumps to the URL specified by the user in the above step.
e) Return the document to the terminal 30.

In the WWW browser 40, the session number notified from the WWW server 100 is stored in the session number storage area 50, and the URL is accessed according to the notified session number.

The authentication management processing section 20 of the WWW server 100
A value of 0 determines whether or not the session number for which the access request has been made is valid based on the authentication management table 225. In this case, since the notified session number is managed in the authentication management table 225 in association with the profile name, it is determined that the session number is valid.

If the session number is valid in the step, the authentication management processing section 200 obtains the profile name from the authentication management table 225 and becomes a profile corresponding to the session number.
0, refer to the authority information corresponding to the profile, and
Specified HTML defined in ML content 148
If the authority information is permitted by the execution permission information for the file name, the designated H
Read TML content.

Therefore, the authentication management processing unit 200
The HTML content is returned to the browser 40 ().
The returned HTML content is stored in the WWW browser 40
Will be displayed.

As described above, the WWW server 100 can perform authentication based on a profile name and provide a CGI program in accordance with a session number.
Further, it is possible to permit execution of the HTML content according to the execution permission authority assigned to the profile name.

Next, a method of notifying a message from the WWW server 100 to the terminal 30 connected via the Internet will be described with reference to FIGS. 8, 9 and 10.

FIG. 8 is a diagram showing an example of a message notification process.

In FIG. 8, server 1000 controls access from terminal 30 via the Internet.
A WW server 100, an authentication processing unit 200 for performing authentication management of access from the terminal 30, an application 70 independently operated by the server 1000, and an application 7
0 and a message monitor server 300 for transmitting a message transmitted to the corresponding session. Further, the server 1000 configures a profile DB 210 that manages the message reception range information in association with the profile name and an authentication management table 225 in which the session number and the profile name are associated with each other in the auxiliary storage device illustrated in FIG.

The application 70 adds a message to the message queue 302 of the message monitor server 300 in order to transmit a message addressed to each profile.

The message queue 302 also stores messages from the operating system (OS) of the server 1000.

As shown in FIG. 8, the authentication management processing section 200 returns an authentication screen in response to an access request from the terminal 30.

The sign-on screen 42 is displayed on the WWW browser 40 of the terminal 30 (step). The user
A profile name and a password are input from the displayed sign-on screen 42 (step).

The authentication management processing unit 200 on the server 1000 side
In the above, after the authentication processing similar to the above, according to the authentication result, the URL of the application that monitors the message
Is returned to the WWW browser 40 (step).

[0094] The WWW browser 40 is
By accessing the URL returned from the authentication management processing unit 200 on the 00 side, an application for monitoring a message is downloaded from the WWW server 100 (step). The message monitor 310 is activated on the WWW browser 40 side. The activated message monitor 310 acquires the session number from the session number storage area 50 and notifies the message monitor server 300 on the server 1000 side. (Step).

Upon receiving the notification of the session number, the message monitor server 300 of the server 1000 acquires the profile name from the authentication management table 225 based on the session number, and searches the profile DB 210 based on the acquired profile. Thereby, the corresponding message reception range information is obtained. Further, the application 70 stored in the message queue 302
Alternatively, a message corresponding to the message reception range information of the profile is selected from a message queue from the OS (step).

Therefore, the message monitor server 300
Transmits a message to the message monitor 310 of the WWW browser 40 when a message is generated in the corresponding profile (step). The message monitor 310 displays the received message on a GUI screen.

On the other hand, the message monitor server 300 on the server side refers to the authentication management table 225 and communicates with each authenticated session number at regular intervals, and the message monitor 310 on the WWW browser 40 side.
Check the existence of (step). At this time, if there is no response from the message monitor 310 on the WWW browser 40 side, the message monitor server 300 on the server 1000 side
Stores the authenticated session number in the authentication management table 2
25, the authentication is invalidated.

In the above steps, a message monitor screen displayed on the WWW browser 40 will be described.

FIG. 9 is a diagram showing an example of a message monitor screen displayed on the WWW browser.

From FIG. 9, the WWW browser 4 on the terminal 30 side
The message monitor screen 312 displayed at 0 is mainly
Stream message 314 and response request message 3
16.

The stream message 314 displays a list of messages received by the message monitor 310 with the signed-on profile. The stream message 314 includes information such as a serial number, a date, a time, and a message.

The response request message 316 displays a list of messages requiring a response. Response request message 3
Reference numeral 16 includes information such as a serial number, a date, a time, and a message.

The message monitor screen 312 further includes a profile name display area 318 and a sign-on time display area 3.
19.

The profile name display area 318 displays the name of the profile signed on by the user.

The sign-on time display area 319 displays the time of sign-on with the profile name.

When the user selects and clicks a message from the response request message 316 shown in FIG. 9 with a mouse, a response window as shown in FIG. 10 pops up.

FIG. 10 is a diagram showing an example of a response window.

From FIG. 10, the response window 320 is
Message display area 321 and reply character string input area 322
And an execute button 323 and a close button 324.

The message display area 321 is displayed by the user in FIG.
Of the message selected from the response message 316 shown in FIG.

The user responds to the message by inputting a character string to be replied to in the response character string input area 322 and clicking an execution button 323. on the other hand,
When the close button 324 is clicked, if there is an input character in the response character string input area 322, the input character is canceled and the response window can be closed.

By the message notification processing, the server 1
000 can appropriately notify a message to the session number corresponding to the profile name. Further, since an appropriate message is selected according to the message reception range information corresponding to the profile name, effective message notification can be performed.

Further, the presence of the message monitor 310 of the terminal 30 can be confirmed by transmitting the message at predetermined intervals. By deleting the corresponding session number from the authentication management table 225 when there is no response from the message monitor 310, the user does not need to perform authentication end processing such as sign-off for each activated application.

Therefore, the present invention provides the authentication management processing unit 200
It is not necessary to execute the authentication process for each application or each time the CGI content is activated.

In the above embodiment, the user is authenticated by the profile name and the password, and after the authentication, the user authentication process can be omitted.

Further, the user does not need to be aware of the process of terminating the authentication of the application, CGI program, or HTML content provided by the WWW server started or executed after the authentication.

Further, the user uses the WWW server to
As in the case of conventional message processing between a host-driven computer system and a terminal, a message can be received and a response message in response to the received message can be transmitted.

In the above example, the processing in steps S103 to S106 shown in FIG. 5 corresponds to the session number registration procedure, and the processing in step S107 shown in FIG. 5 corresponds to the session number notification procedure.

The following is added.

(Supplementary Note 1) In a storage medium storing a program for causing a server to perform a process of performing authentication based on authentication information specifying a user received from a user terminal connected via a network, the user terminal A session number notification procedure for notifying the user terminal of a session number for identifying a session that can be connected in accordance with the authentication result of the user authentication performed based on the received authentication information, the user authentication authenticated information and the session number notification A storage medium storing a program having a session number registration procedure for registering a session number in an authentication connection management means for managing a session number notified by a procedure in association with the session number. (1) (Supplementary note 2) In the storage medium according to Supplementary note 1, when an access request is received from a user terminal, the authentication information corresponding to the session number assigned to the access request is further transmitted to the authentication connection management unit. A storage medium storing a program having an access permission procedure for searching from managed authentication information and permitting the access request according to the search result. (2) (Supplementary note 3) In the storage medium according to Supplementary note 2, when the access request is a request to execute a program, the access permission procedure may be performed by the authentication connection management unit based on a session number assigned to the execution request. An authorization information acquisition procedure for acquiring the authorization information corresponding to the authentication information from an authentication information management unit that manages the authorization information for each authentication information in accordance with the search result, and executing the program for each program. From the execution permission report management means that manages permission information,
Execution permission determination for obtaining execution permission information related to the program for which execution has been requested, and determining execution permission of the program based on the obtained execution permission information and the authority information acquired by the authority information acquisition procedure. And a storage medium storing a program for permitting the execution of the program based on the authentication information in accordance with the result of the execution permission determination procedure. (3) (Supplementary note 4) In the storage medium according to Supplementary note 2, when the access request is a file provision request, the access permission unit transmits the file from the authentication connection management unit based on the session number assigned to the provision request. A corresponding authorization information is searched, and an authorization information acquisition procedure for acquiring authorization information corresponding to the authorization information from an authorization information management unit that manages the authorization information for each authentication information according to the search result, and expressing the provided information Obtaining, from the provision permission information managing means for managing provision permission information for each file to be provided, the provision permission information relating to the file for which provision was requested, and the obtained provision permission information and the authority acquired by the above-described authority information acquisition procedure. And a provision permission judging step of judging the provision permission of the file based on the information. Based on the authentication information storage medium storing a program to allow the provision of the file.
(4) (Supplementary note 5) In the storage medium according to any one of Supplementary notes 1 to 4, based on the session number transmitted from the user terminal, the corresponding authentication information is searched from the authentication connection management unit, and the searched authentication information is searched. Based on the obtained authentication information, for each authentication information, obtains corresponding message range information from authentication information management means that manages message range information indicating a range of receivable messages, and outputs a message corresponding to the obtained message range information. A storage medium storing a program having a message control procedure for notifying a user terminal.
(5) (Supplementary note 6) In the storage medium according to Supplementary note 5, the message control procedure includes transmitting a message at predetermined intervals to a user terminal corresponding to a session number managed by the authentication connection management means, A storage medium storing a program having a session disconnection processing procedure for performing a session disconnection process by deleting information on the session number from the authentication connection management means in accordance with the presence or absence of a response from the user terminal to the authentication connection management means.

(Supplementary Note 7) In an authentication server that performs authentication based on authentication information specifying a user received from a user terminal connected via a network, a user authentication performed based on authentication information received from the user terminal is performed. A session number notifying unit for notifying the user terminal of a session number for identifying a session that can be connected according to the authentication result, and associating authentication information of the authenticated user with the session number notified by the session number notifying unit. And an authentication connection management means for managing the authentication information corresponding to the session number given to the access request from the authentication information managed by the authentication connection management means when receiving an access request from the user terminal. ,
An authentication server having access permission means for permitting the access request in accordance with the search result.

(Supplementary Note 8) In an authentication method for performing authentication based on authentication information specifying a user received from a user terminal connected via a network, a user authentication performed based on authentication information received from a user terminal is performed. A session number notification procedure for notifying the user terminal of a session number for identifying a session that can be connected according to the authentication result, and the authentication information of the authenticated user is associated with the session number notified by the session number notification procedure. And an authentication connection management procedure to manage the authentication information corresponding to the session number assigned to the access request from the authentication information managed by the authentication connection management procedure when the access request is received from the user terminal. And an access permission procedure for permitting the access request according to the search result. Authentication method.

(Supplementary Note 9) A session number for identifying a session that can be connected to a user terminal connected to an authentication server that performs user authentication via a network according to the authentication result of the user authentication notified from the authentication server. A message processing means for receiving a message transmitted from the authentication server and responding to the message based on the message processing means. A user terminal for displaying a received message on a display unit and selectively transmitting a response message to the displayed message.

[0123]

As described above, according to the first to fifth aspects of the present invention, after the user is authenticated, the authentication information for specifying the user, the user terminal used by the user, and the computer for performing the authentication are provided. Is managed in association with the session number to be identified. Therefore, the user does not need to perform the authentication process for each service provided by the authentication system after the authentication.

[Brief description of the drawings]

FIG. 1 is a diagram showing a system configuration of an authentication system.

FIG. 2 is a diagram illustrating a hardware configuration.

FIG. 3 is a diagram illustrating an authentication management process for a Web application.

FIG. 4 is a diagram illustrating an example of a sign-on screen.

FIG. 5 is a flowchart illustrating an authentication management process.

FIG. 6 is a diagram illustrating an example of an authentication management process when executing CGI content.

FIG. 7 is a diagram illustrating an example of an authentication management process when executing HTML content.

FIG. 8 is a diagram illustrating an example of a message notification process.

FIG. 9 is a diagram showing an example of a message monitor screen displayed on a WWW browser.

FIG. 10 illustrates an example of a response window.

[Explanation of symbols]

 11 CPU 12 Memory Unit 14 Input Unit 15 Display Unit 16 Auxiliary Storage Device 17 CD-ROM Driver 18 Communication Unit 20 CD-ROM B Bus 100 WWW Server 200 Authentication Management Processing Unit 210 Profile DB 225 Authentication Management Table 300 Message Monitor Server 310 Message monitor

 ────────────────────────────────────────────────── ─── Continued on the front page (72) Inventor Kaoru Iguchi 4-1-1, Kamidadanaka, Nakahara-ku, Kawasaki City, Kanagawa Prefecture Inside Fujitsu Limited (72) Inventor Akihiro Matsushita 4-1-1, Kamiodanaka, Nakahara-ku, Kawasaki City, Kanagawa Prefecture No. 1 Inside Fujitsu Limited (72) Shoichi Kamio 4-1-1, Kamiodanaka, Nakahara-ku, Kawasaki City, Kanagawa Prefecture Inside 1-1 Fujitsu Limited (72) Teruko Mabuchi 4-chome, Kamikodanaka, Nakahara-ku, Kawasaki City, Kanagawa Prefecture No. 1 Fujitsu Co., Ltd. (72) Inventor Akira Sugawara 4-1-1, Kamiodanaka, Nakahara-ku, Kawasaki-shi, Kanagawa F-term within Fujitsu Co., Ltd. 5B085 AE23 BC01 BG07 5J104 AA07 EA03 KA01 MA02 NA05 NA06

Claims (5)

[Claims] 1. A storage medium storing a program for causing a server to perform a process of performing authentication based on authentication information specifying a user received from a user terminal connected via a network, the program being received from the user terminal. A session number notification procedure for notifying the user terminal of a session number for identifying a session that can be connected in accordance with the authentication result of the user authentication performed based on the authentication information; and A storage medium storing a program having a session number registration procedure of registering the session number in an authentication connection management unit that manages the notified session numbers in association with each other. 2. The storage medium according to claim 1, further comprising: upon receiving an access request from a user terminal, managing authentication information corresponding to a session number assigned to said access request by said authentication connection management means. And a storage medium storing a program having an access permission procedure for permitting the access request according to the search result. 3. The storage medium according to claim 2, wherein the access permission procedure is performed when the access request is a program execution request.
Based on the session number given to the execution request, the corresponding authentication information is searched from the authentication connection management means, and according to the search result, the authentication information management means managing the authority information for each authentication information is used to search for the authentication information. A permission information acquisition procedure for acquiring the corresponding permission information; and execution permission information relating to the requested program from the execution permission information managing means for managing the execution permission information for each program. And an execution permission determining step of determining execution permission of the program on the basis of the authority information acquired by the authority information acquiring step. A storage medium storing a program that permits execution of the program based on the program. 4. The storage medium according to claim 2, wherein said access permitting means, when said access request is a file provision request, responds from said authentication connection management means by a session number assigned to said provision request. Authorization information acquisition procedure for acquiring authorization information corresponding to the authentication information from an authentication information management unit that manages the authorization information for each authentication information in accordance with the search result. From the provision permission information management means for managing the provision permission information for each file, obtain the provision permission information for the file for which the provision was requested, and obtain the obtained provision permission information and the permission information obtained by the permission information acquisition procedure. And a provision permission judging step of judging the provision permission of the file on the basis of the above. Based on the authentication information storage medium storing a program to allow the provision of the file. 5. The storage medium according to claim 1, wherein, based on a session number transmitted from the user terminal,
Search the corresponding authentication information from the authentication connection management means,
Based on the retrieved authentication information, for each piece of authentication information, obtain corresponding message range information from authentication information management means that manages message range information indicating a range of receivable messages, and respond to the obtained message range information. A storage medium storing a program having a message control procedure for notifying a user terminal of a message.