JP2002290481A - Access control device and access control method - Google Patents

Abstract

(57) [Summary] [PROBLEMS] To allow a user to use a network using the same client computer fairly. In a network system including a server, a client, and a gateway for controlling a connection between the server and the client, identification information for identifying the client is received, and based on the identification information, An access control device is used that specifies a client, stores the usage status of the client, and sends an instruction to the gateway to restrict access of the client to the server for each client according to the usage status.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a technique for controlling network connection of a specific terminal.

[0002]

2. Description of the Related Art Conventionally, for example, the following has been implemented as access restriction for connection from a LAN to the Internet. (1) Limit the number of simultaneous uses / sessions of the Web server to control overload of the Web server; (2) Prohibit access to specific resources to protect youth;
(3) Because it is a membership service, it is performed for the purpose of prohibiting non-member access by authentication, and (4) restricting access to ensure security against intrusion from outside the LAN. I have. This restricts access to a specific user and does not impose access restriction on a specific client (terminal).

[0003]

As described above, in the related art, access restriction to the user (user) has been performed but access restriction to the terminal itself has not been performed. In this case, there is a problem that a queue is formed due to inappropriate use of the user. In the future, as the use of networks including the Internet expands, it is expected that network access from information terminals installed in public facilities and other facilities will increase, but such network use can be performed fairly for each person There is a need.

In a family restaurant or the like, an information terminal or an order receiving terminal may be arranged at each seat in place of a magazine or for the purpose of reducing the number of staff by automating order reception. In such a case,
It is possible that the turnover rate of customers will deteriorate, and it is necessary to control the entry of customers by restricting the use of terminals placed in seats in some way.

[0005] The present invention has been made in view of the above points, and provides an access control device and an access control method for forcing proper use of a terminal.

[0006]

An access control device according to the present invention comprises a server computer, a client computer, the server computer and a client computer.
In a network system including a gateway that controls connection between computers, an access control device that instructs the gateway to perform access control, and receives identification information for specifying the client computer. Receiving means, storage means for identifying the client computer based on the identification information and storing the use state of the client computer, and, for each client computer, according to the use state, Instruction means for sending an instruction to restrict access to the server computer to the gateway.

Further, in the access control apparatus of the present invention, the receiving means transmits the address of the client computer as the identification information so that the client computer accesses the server computer and receives a predetermined service. And the client
Upon receiving predetermined information for identifying a service requested by the computer, the storage unit specifies the client computer and stores the usage status of the client computer based on the address and the predetermined information. It is characterized by.

Further, in the access control device of the present invention, the predetermined information includes a port number for identifying a protocol used in a service provided by a server computer, and the instruction means includes: A service that requires access control is identified from the client computer, and a service that requires access control is requested from the client computer, and if the use state of the client computer satisfies a predetermined condition, the client computer Sending an instruction to restrict access to the server computer to the gateway.

[0009] Further, in the access control apparatus of the present invention, as the predetermined condition, an upper limit of the number of use times or the use time of the service by the client computer is set.

An access control method according to the present invention is directed to a network system including a server computer, a client computer, and a gateway for controlling a connection between the server computer and the client computer. An access control method for instructing access control to
A receiving procedure for receiving identification information for identifying the client computer, a storage procedure for identifying the client computer based on the identification information and storing a usage status of the client computer, And for each client computer, the server
Sending an instruction to restrict access to the computer to the gateway.

In the access control method of the present invention,
The client computer sends the identification information to the server computer to access the server computer and receive a predetermined service, and the address of the client computer and predetermined information for identifying the service requested by the client computer. In the receiving procedure, the client computer is specified based on the address and the predetermined information, and the use status of the client computer is stored in the storing procedure.

In the access control method of the present invention,
The predetermined information includes a port number for identifying a protocol used in a service provided by a server computer, and the instruction procedure includes a procedure for identifying a service for controlling access based on the port number. ,
A step of requesting a service for controlling access from the client computer and determining whether a use condition of the client computer satisfies a predetermined condition. If it is determined that the request is made and the usage status of the client computer satisfies a predetermined condition, an instruction to restrict access of the client computer to the server computer is sent to the gateway computer. .

[0013] In the access control method of the present invention,
As the predetermined condition, an upper limit of the number of uses or the use time of the service by the client computer is set.

[0014] The present invention is also a program for causing a computer to execute the method according to claim 5, comprising a receiving procedure for receiving identification information for specifying the client computer; Based on
A storage procedure for specifying the client computer and storing a use state of the client computer; and restricting access of the client computer to the server computer for each client computer according to the use state. An instruction procedure for sending an instruction to the gateway.

Further, the present invention is a computer-readable recording medium on which the program according to claim 9 is recorded.

[0016]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram illustrating a configuration of an application server according to an embodiment of the present invention. FIG. 2 is a diagram showing an outline of an entire network system including an application server.

First, the application of the present embodiment
An overview of the entire network system including the server will be described. As shown in FIG. 2, the application server 1
Is connected to a gateway 2, and a client computer (hereinafter, referred to as a client) 3 is connected to a network such as the Internet via the gateway 2 and the Internet relay device 4 (the Internet is used in the following description). It is connected to the Web server 5 above. For the sake of simplicity, only one each is shown in this figure, but the client 3, the Internet relay device 4, and the Web server 5 may be composed of a plurality.

The client 3 is a terminal that receives a service provided by a server computer on the network such as the Web server 5. Further, the Internet relay device 4 includes devices such as a general router, a proxy server, and a firewall. The device denoted by reference numeral 5 in FIG. 2 is a WWW (World Wide Web) web server, but is also a server computer that provides services such as file transfer, e-mail, and chat. Is also good. The client 3 always accesses the server computer such as the Web server 5 via the gateway 2 when accessing the server computer.

The gateway 2 responds to the request from the client 3 to the Web server 5 by requesting access to the client 3 (application server 1).
Is received from the client 3 for the access restriction instruction or the release instruction is received).
Then, when the access restriction is released, the request from the client 3 is transmitted to the Web server 5 as it is, and a response is returned to the client 3. Conversely, if access is restricted, a message to the effect that the Internet service cannot be used is sent to the client 3 or
Disconnect.

As described above, the application server 1
Performs the access restriction on the specific client 3 to the gateway 2 and releases the access restriction. The timing at which the application server 1 restricts access depends on the application.

Further, in the gateway 2, when changing the access restriction in accordance with the instruction from the application server 1, the restriction may be changed immediately, or the restriction may be changed after a certain period of time. Good. The gateway 2 viewed from the client 3 corresponds to a conventional proxy server. Therefore, when a WWW browser is used in the client 3, the setting of the proxy server is made to correspond to the gateway 2.

As described above, in the above configuration, in order to make the gateway 2 a general-purpose function, the gateway 2 itself only performs access control to the client 3.
The access restriction instruction itself is performed by the application server 1.

Next, the application of the present embodiment
The configuration of the server 1 will be described.

The application server 1 sends an I-mail to be transmitted when the client 3 accesses the Web server 5.
A receiving unit 1a that receives a P address or a MAC address (hereinafter, an IP address is used in the present embodiment), a port number, and other detailed information depending on a protocol from the gateway 2, and a receiving unit 1a from an administrator, which will be described later. An input unit 1b for receiving input of setting information, a registering unit 1c for storing the input setting information in the following storage unit 1f, and other IP addresses, port numbers, and protocols depending on the protocol of the client 3 received from the gateway 2. Based on the detailed information and the setting information registered in the storage unit 1f (details will be described later), a processing unit 1e including an instruction unit 1d that sends an access restriction instruction to the gateway 2, and a receiving unit 1
a storage unit 1 for storing the information received by a and the setting information
f.

The above-mentioned access restriction means rejection of a request or disconnection of a connection. The network in the present embodiment is based on TCP / IP. The port number is for identifying a protocol used in the Web server 5, a mail server, an FTP server (both not shown), and the like.

The information received from the gateway 2 is stored in the storage unit 1f for each client (that is, for each IP address) and for each service that the client 3 requests (that is, for each port number). Further, additional information indicating the usage status of the client 3 is added. For example, in the case of a search system in which the Web server 5 searches for and presents some information, the number of searches is set in the additional information as the usage status (see FIG. 3A). In addition, in the case of presenting a general homepage or the like, the usage time is set in the additional information as the usage status (see FIG. 3B).

The setting information input by the administrator includes the necessity of access restriction (control necessity) for each port number.
And conditions (control types) when access restriction is required (see FIG. 4). The change of the setting information by the administrator is possible even while the system is operating, and the access restriction of the gateway 2 can be dynamically changed during operation.

The processing section 1e is composed of a memory and a CPU.
(Central Processing Unit) and the like, and a function (not shown) for realizing each function of the processing unit 1e is loaded into a memory and executed to realize the function. The storage unit 1f is configured by a non-volatile recording device such as a hard disk or a magneto-optical disk. The application server 1 has a communication interface for connecting to the gateway 2, and is further connected to an input device, a display device, and the like (neither is shown) as peripheral devices. Here, the input device refers to an input device such as a keyboard and a mouse.
The display device is a CRT (Cathode Ray Tub)
e) and liquid crystal display devices.

Next, an example of the operation of the application server 1 configured as described above will be described, and the gateway 2 connected to the application server 1 will be described.
And the operation of the client 3 connected to the Web server 5 via the gateway 2 will be described.

[Embodiment 1] In this embodiment, W
This is an example of a case where a book search service is provided using a search system implemented on the eb server 5. In the present embodiment, access is not restricted for an access (initial screen display request) in which the port number 80 is specified, and is not performed for an access in which the port number 8080 is specified (in the case of a book search request). Access shall be restricted. Further, in the following description, it is assumed that access is restricted at the fourth search, and when there is an access designated with the port number 80, the storage unit 1f having the IP address of the client 3 that started the access and the port number 8080 The additional information indicating the usage status included in the identification information recorded in the information is reset.

First, the client 3 transmits an initial screen display request to the gateway 2 to display the initial screen provided by the Web server 5 (s1 in FIG. 5). At this time, a URL (Uniform) corresponding to the initial screen is displayed.
HTTP using Resource Locator
Information (IP address, port number, detailed information of the client 3) for accessing the Web server 5 by the protocol is transmitted from the client 3. In the example shown in FIG. 5, the port number 80 is included in this information at this time. Note that a set of the IP address, port number, and detailed information of the client 3 is used as identification information for identifying the client 3.

The gateway 2 notifies the application server 1 of the information received from the client 3 (s2 in FIG. 5), and transmits an initial screen display request to the Web server 5 (s3 in FIG. 5). At this time, the application server 1 searches the registered setting information using the port number included in the notification received from the gateway 2 as a key,
Determine whether access restriction is necessary. In this example, the port number included in the notification received by the application server 1 is “80” and does not require access restriction, so that it is determined that access restriction is not required. At this time, the application server 1 resets the additional information indicating the usage status of the identification information corresponding to the IP address of the client 3 and the port number 8080. That is,
The number of searches set as additional information is “0”. On the other hand, the Web server 5 that has received the initial screen display request transmits the data of the initial screen to the client 3.

Next, the client 3
Transmits a book search request to the gateway 2 in order to receive the book search service provided by (2) (FIG. 5: s4). The book search request is transmitted from the gateway 2 to the Web server 5 (FIG. 5: s5), and the information of the book search request is notified to the application server 1 (FIG. 5: s6). At this time, this information includes the port number 808
0 is included.

Upon receiving the notification from the gateway 2, the application server 1 searches the setting information using the port number 8080 included in the notification as a key, and determines whether access restriction is required. Since access restriction is required for the port number 8080,
It is determined that access to port number 8080 requires access restriction. When this determination is made,
Further, using the IP address of the client 3 and this port number as a key, the corresponding information is already recorded or the identification information recorded in the storage unit 1f is searched. At this time, since the corresponding information does not yet exist in the identification information, the application server 1 adds “1” as additional information indicating the usage status (the number of searches) in addition to the received information.
Record the identification information with. On the other hand, Web server 5
Sends the book search result to the client 3 (FIG. 5: s7, s8).

Next, a second book search is similarly performed.
When the third book search is performed, the client 3
Sends a book search request to the gateway 2 (FIG. 5: s9). The book search request is transmitted from the gateway 2 to the Web server 5 (FIG. 5: s10), and the information of the book search request is transmitted to the application server 1
(FIG. 5: s11). At this time, the information includes the port number 8080.

When the application server 1 receives the notification from the gateway 2, the application server 1 searches the setting information using the port number 8080 included in the notification as a key, and determines whether access restriction is required. Since the port number 8080 requires access restriction, it is determined that access restriction is required. Then, the IP of the client 3 is further increased.
Using the address and this port number as a key, search is made for the identification information recorded in the storage unit 1f whether the corresponding information is already recorded. At this time, the identification information includes the corresponding information, and the application server 1 adds “+” to the additional information indicating the usage status (the number of searches) in addition to the received information.
The identification information obtained by adding “1” is recorded. Since the third book search is performed at this time, the additional information is “3”.

When there is a book search request from the client 3 next time, it is the fourth time to execute access restriction, so the application server 1 sends an access restriction instruction to the gateway 3 to the gateway 2 (FIG. 5: s).
12). On the other hand, the book search result is transmitted from the Web server 5 to the client 3 (FIG. 5: s13, s1).
4).

Next, when the fourth book search request is sent from the client 3 (s15 in FIG. 5), the gateway 2 has already received an access restriction instruction from the application server 1 to the client 3, so that the gateway 2 uses To indicate that the service is not available to the other person (for example, information to display a message such as "You cannot search more than three times. Please switch to the next person").
Is transmitted (FIG. 5: s16).

As described above, the client 3 can receive the book search service up to the third time, but its use is prohibited at the fourth time. Then, when the next person displays the initial screen, the additional information indicating the use status of the identification information corresponding to the client 3 is reset again, and a new book search can be performed. As described above, the first embodiment
The details were explained.

[Embodiment 2] In this embodiment, a terminal (client 3) installed at a customer seat in a family restaurant or the like is used.
This is an example of a case in which an Internet connection is made available. In this embodiment, the setting information is set so as to perform the following access restriction, and the access to the client 3 is restricted. Of course, the setting of this setting information can be changed immediately by the administrator.

In this embodiment, at the time when the user is guided to the seat or when the order is received, the additional information indicating the use status of the terminal included in the recorded identification information is reset.
At this time, the initial value of the use point of the terminal installed at the customer seat is set in the additional information. The user can use
The terminal can access the Internet only for the time corresponding to the usage point. The usage points set in the additional information are subtracted from the time at which the customer is seated, and the usage points are added according to the order.

When the number of use points increases, the time during which the Internet can be used increases. Then, when the use points are exhausted, if it is still a congested time zone, access is disabled. If you are not accessible,
A message such as "Usage time has passed. Unable to access the next order" is displayed on the terminal. Also,
In a case where it is considerably congested and a considerable amount of time is required to wait for an order or the like, as a special case, the user is allowed to access the Internet without restriction regardless of the point of use. In this case, the administrator can temporarily release the access restriction by omitting the necessity of the control of the setting information. In addition, in a time zone where there are many vacant seats, since the effect of attracting customers is expected by opening the Internet connection, the setting of the setting information is changed according to the time zone.

Next, in the present embodiment, the application server 1, the gateway 2, the client 3, the Web
An operation flow between the servers 5 will be described.

First, in the case of a time slot with many vacant seats, in this case, the administrator sets the setting information registered in the application server 1 so as not to restrict access to the client 3. That is, the necessity of control of the setting information is “no”. In this state, when a home page display request for the home page provided by the Web server 5 is transmitted from the client 3 to the gateway 2 (FIG. 6: t1), the information included in the home page display request is transmitted to the application server 1 ( (FIG. 6: t2), a homepage display request is transmitted to the Web server 5 (FIG. 6: t3). The homepage display request transmitted here is the same as the initial screen display request described in the first embodiment.

When the application server 1 receives the notification from the gateway 2, the application server 1 searches the setting information registered in the storage unit 1f using the port number “80” included in the notification as a key. It is determined whether "is" or "not". As mentioned earlier, during times of vacant seating,
Since the setting information is set so as not to restrict access, it is determined to be “No” here and the application
The server 1 only receives the notification. On the other hand, a response to the homepage display request is transmitted from the Web server 5 to the client 3 (FIG. 6: t4, t5).

Next, in a crowded time zone, in this case,
The item of control necessity corresponding to the port number “80” of the setting information registered in the application server 1 is set to “necessary”.

Here, when a customer at the seat where the client 3 is installed places an order, a use point corresponding to the amount of the order and the IP address of the client 3 are transmitted from the order accepting machine to the application server 1 ( Figure 6: t
6). Here, it is assumed that the order receiving machine can transmit the IP address of the client 3 and the information of the use point to the application server 1 by wireless communication or the like. Then, the application server 1 having received the information on the IP address of the client 3 and the use point from the order accepting machine adds the use point to the identification information having this IP address stored in the storage unit 1f, indicating the use status. Set as initial value of information (reset of usage point).

Next, when a home page display request is transmitted from the client 3 to the gateway 2 (FIG. 6: t
7), the information included in the home page display request is transmitted to the application server 1 (FIG. 6: t8), and the home page display request is transmitted to the Web server 5 (FIG. 6: t9). Then, a response to the homepage display request is transmitted from the Web server 5 to the client 3 (FIG. 6: t10, t11).

Further, when the customer places an additional order, a use point corresponding to the amount of the additional order and the IP address of the client 3 are transmitted from the order accepting machine to the application server 1 (FIG. 6). : T12). The application server 1 sets additional information indicating the use status of the identification information based on the information received from the order receiving machine. In this case, a value obtained by adding the use points for the additional order to the remaining use points is set.

Then, as the time elapses, the usage points set in the additional information are subtracted. Then, when the use point set in the additional information becomes “0”, the application server 1 notifies the gateway 2 of an access restriction instruction to the client 3. Then, in response to the request for displaying the home page from the client 3 (FIG. 6: t14), the gateway 2 causes the client 3 to display a message such as "The usage time has been exceeded. The next order cannot be accessed." 6: t15). The details of the second embodiment have been described above.
The operation flow described in the first embodiment and the second embodiment is an example, and is not limited to the above processing flow.

Further, the present invention is not limited to the Internet,
A network using an AN or dial-up may be used. Further, a program for realizing a part or all of the functions of the processing unit 1e in FIG. 2 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read and executed by a computer system. Thus, access restriction processing for the client may be performed. Here, the “computer system” includes an OS and hardware such as peripheral devices.

Further, the “computer system” is WW
If the W system is used, a homepage providing environment (or display environment) is also included. The “computer-readable recording medium” refers to a floppy (registered trademark) disk, a magneto-optical disk, an RO
M, a portable medium such as a CD-ROM, and a storage device such as a hard disk built in a computer system. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) inside a computer system that becomes a server or a client when a program is transmitted through a network such as the Internet or a communication line such as a telephone line. And those holding programs for a certain period of time.

The above program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the "transmission medium" for transmitting a program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. Further, the program may be for realizing a part of the functions described above. further,
What can realize the above-mentioned function in combination with a program already recorded in the computer system, that is, a so-called difference file (difference program) may be used.

The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and a configuration and the like within the scope of the present invention may be used. included.

[0055]

As described above in detail, according to the present invention, this client computer is specified by the identification information for specifying the client computer, and its use status is recorded. Accordingly, control for restricting access to the server computer can be performed for each client computer, so that each user can use the network using the same client computer fairly.

When a service provided on the network can be enjoyed from a client computer installed in a store or the like, the enjoyment of this service is
By controlling with the access control device of the present invention, it becomes possible to control the turnover rate of the customer and the entry of the customer.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a configuration of an application server according to an embodiment of the present invention.

FIG. 2 is a diagram showing an outline of an entire network system including an application server.

FIG. 3 is an example of identification information according to the embodiment;

FIG. 4 is an example of identification information in the embodiment.

FIG. 5 is a sequence diagram illustrating the operation of the first embodiment.

FIG. 6 is a sequence diagram illustrating the operation of the second embodiment.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 ... Application server (access control apparatus) 1a ... Reception part 1b ... Input part 1c ... Registration part 1d ... Instruction part 1e ... Processing part 1f ... Storage part 2 ... Gateway 3 ... Client (client computer) 4 ... Internet relay device 5 Web server (server computer)

Claims (10)

[Claims] 1. A network system comprising: a server computer; a client computer; and a gateway for controlling a connection between the server computer and the client computer. An access control device that receives identification information for identifying the client computer; and identifies the client computer based on the identification information and stores a use state of the client computer. Storage means, and instructing means for sending, to the gateway, an instruction to restrict access of the client computer to the server computer for each client computer according to the use situation. Access control device according to claim. 2. The receiving means, wherein the client computer requests the address of the client computer and the client computer to transmit as the identification information in order to access the server computer and receive a predetermined service. Upon receiving predetermined information for identifying a service, the storage unit specifies the client computer based on the address and the predetermined information, and stores a use state of the client computer. The access control device according to claim 1. 3. The service according to claim 2, wherein the predetermined information includes a port number for identifying a protocol used in a service provided by a server computer, and the instruction unit controls access based on the port number. And when a service requiring access control is requested from the client computer and the usage status of the client computer satisfies a predetermined condition, the client computer accesses the server computer. The access control device according to claim 2, wherein an instruction to restrict the access is sent to the gateway. 4. The system according to claim 3, wherein the predetermined condition is set to a number of times the service is used by the client computer or an upper limit of the use time.
An access control device according to claim 1. 5. A network system comprising a server computer, a client computer, and a gateway for controlling a connection between the server computer and the client computer, wherein an access control instruction is issued to the gateway. An access control method for receiving the identification information for identifying the client computer; and identifying the client computer based on the identification information and storing a use state of the client computer. A storage procedure; and an instruction procedure for sending, to the gateway, an instruction to restrict access of the client computer to the server computer for each client computer in accordance with the use situation. Access control method to be. 6. An address of the client computer and a service requested by the client computer, the client computer sending the identification information to access the server computer and receive a predetermined service. Receiving the predetermined information in the receiving procedure, identifying the client computer based on the address and the predetermined information, and storing the use state of the client computer in the storing procedure. The access control method according to claim 5. 7. The predetermined information includes a port number for identifying a protocol used in a service provided by a server computer. The instruction procedure includes a service for controlling access based on the port number. And a step of determining whether a service for controlling access is requested from the client computer and the usage status of the client computer satisfies a predetermined condition. When a service for controlling the client computer is requested and it is determined that the use state of the client computer satisfies a predetermined condition, the gateway computer is instructed to restrict access of the client computer to the server computer. It is characterized by sending Claim 6
2. The access control method according to 1. 8. The method according to claim 7, wherein, as the predetermined condition, the number of times of use of the service by the client computer or the upper limit of the use time is set.
2. The access control method according to 1. 9. A program for causing a computer to execute the method according to claim 5, wherein a receiving procedure for receiving identification information for identifying the client computer; and the client based on the identification information. A storage procedure for specifying a computer and storing a use state of the client computer; and an instruction to restrict access of the client computer to the server computer for each client computer according to the use state. An instruction procedure for sending to the gateway. 10. A computer-readable recording medium on which the program according to claim 9 is recorded.