JP2002342271A - Method and system for monitoring overlapped log-in in web access - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent any overlapped log-in in web access from a plurality of client computers using the same user authentication information without having to add special devices. SOLUTION: This method comprises a first for issuing session information for determining overlapped log-in, in response to an access request from a client computer to a web page managed by a WWW server and storing the issued information in the client computer which is the origin of the access request and in a session information storing means, a second step for enabling the client computer which is the origin of the access request to return, in the next access request, the session information for determining the overlapped log-in issued in the previous access request, and a third step for determining whether the session information matching the returned session information is stored in the session information storing means, and determining that the overlapped log-in, based on the same user authentication information, has been performed when the session information is not stored, and rejecting web page browsing.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a duplicate login monitoring method and system for preventing duplicate logins using the same user authentication information from a user accessing a WWW server.

[0002]

2. Description of the Related Art There is a WWW service as a communication service for providing information to a user using a computer network. In particular, on the Internet, there are a number of WWW sites that provide information using the above-mentioned services. Among them, there are WWW sites that provide information only to registered members (hereinafter, WWW sites for registered members). It is well known that it exists. Such a WWW site for registered members generally performs user authentication (authentication using one or both of a user ID and a password) for a user, and permits or denies browsing of a web page.

FIG. 10 shows a conventional WW for registered members of this type.
FIG. 9 is a sequence diagram illustrating an outline of a user authentication process used at a W site. In the figure, when a client computer requests access to a page for registered members of a WWW server (step 1001), the WWW server transmits a user authentication request to a user who uses the client computer (step 1002). The user is requested to enter a user ID and password uniquely assigned to the user. Then, when the user inputs the user ID and the password (step 1003), the input user ID and the password are input to an authentication server (SQL database, RADIUS (Remote Aut) which manages the member information.
hentication Dial In User Service), LDAP (Ligh
tweight Directory Access Protocol) (step 1004). The authentication server authenticates the user ID and the password, and transmits the result to the WWW server (Step 1005). The WWW server permits or denies browsing of the page for registered members based on the authentication result (step 1006). If the access is permitted, the data of the page for registered members is transmitted to the client computer (step 1007).

[0004] However, in this method, only the user ID and password are collated, so that the same user ID and password can be simultaneously accessed from a plurality of locations, so that a duplicate login is possible. Will be shared. For example, when the same user ID and password are used in a state where the father and the child of the family who live together use different computers, duplicate login is possible.

[0005] If this defect is abused, for example, a WWW site that provides information for a fee may not be able to strictly secure the profit that should be obtained from the original registered member. In other words, in the case of the above-mentioned cohabiting family, there is a possibility that the profit for the information charge or the connection time for two persons should be obtained, but the profit for only one person is obtained.

As a countermeasure, by increasing the security of the password by using an authentication factor in place of the conventional user ID and password, the WWW site does not always monitor the connection information of the user, and the duplication by the same user ID and password. There are ways to disable login. For example, tokens (small password generators), IC cards, encryption keys, and other items owned by the person themselves, fingerprints, voiceprints,
Personal authentication using the physical characteristics of the individual such as the retina as an authentication factor is exemplified. According to this method, since it is possible to strictly determine whether the user making the access request is the person who owns the user ID, a third party cannot access using the user ID, and as a result, Duplicate login is not possible.

[0007]

However, to implement the above system, an IC card and a reader device for transmitting authentication data to the user are required. These devices generally have not yet penetrated the user. Therefore, due to the problem of introduction cost for providing the device to the user and operational problems such as needing education for the user, the device is introduced to a WWW site that provides information on a network for an unspecified number of users such as the Internet. That is not realistic.

An object of the present invention is to monitor duplicate logins in web access which can prevent duplicate logins from a plurality of client computers using the same user authentication information (user ID and password) without adding a special device. It is to provide a method and a system.

[0009]

In order to achieve the above-mentioned object, the present invention provides a method for responding to an access request from a client computer to a web page managed by a WWW server.
A first step of issuing duplicate login determination session information and storing the session information in the access requesting client computer and the session information storage means, and at the next access request, the duplicate login issued at the previous access request A second step of returning the session information for determination from the client computer of the access request source; and determining whether session information matching the returned session information is stored in the session information storage means. And a third step of rejecting web page browsing if not present. In the third step, if no session information is returned, it is determined whether session information corresponding to the user authentication information is stored in the session information storage means. It is characterized by refusal to browse. The session information includes user authentication information and an identifier with an expiration date, and is issued after receiving user authentication based on the user authentication information. Further, the session information is encrypted.
In the third step, when session information matching the returned session information is stored in the session information storage means, the session information storage means and the identifier of the identifier in the session information stored in the client computer are stored. It is characterized in that the expiration date is sequentially updated until logoff.

[0010] The duplicate login monitoring system according to the present invention issues session information for judging duplicate login in response to an access request to a web page from a client computer, and transmits the session information to the client computer of the access request source. A first means for storing in the storage means, a second means for returning the duplicate login determination session information issued in the previous access request from the client computer of the access request at the time of the next access request, It is determined whether session information that matches the session information is stored in the session information storage means.
It is provided in a WW server or a session management device. Further, the third means determines whether session information corresponding to user identification information is stored in the session information storage means when the session information is not returned, and when the session information is already stored, the web page It is characterized by refusal to browse.

[0011]

DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be specifically described below with reference to the drawings. FIG. 1 shows an embodiment of a computer network to which the present invention is applied. In FIG. 1, reference numeral 101 denotes a client computer used by a user to receive information on the Internet (computer network) 102. A WWW server 103 provides information to the client computer 101 using a WWW service. An authentication server 104 stores user information and provides a user authentication function. Reference numeral 105 denotes a session management device having a function of monitoring user connection information.

FIG. 2 is a functional configuration diagram of the WWW server 103. The WWW server 103 includes a WWW daemon 201 for providing a WWW service and Web as middleware for relaying a user request and a back-end process.
It comprises an application server 202. Here, the Web application server 202 controls the series of requests from the WWW daemon 201 by the control unit 20.
4. Web page storage database 205 storing information to be provided to the user, Web requested by the user for access
ACL (Access Control List) database 20 for determining whether the page requires access control by user authentication
6. Authentication module 20 that communicates with authentication server 104
7, a session management module 208 for communicating with the session management apparatus 105 and an identifier creation module 209 for creating an identifier to be issued to the user.

FIG. 3 is a functional configuration diagram of the session management device 105. The session management device 105 includes a listener 301 for communicating with the WWW server 103, a control unit 302 for processing a series of requests from the listener 301, a session information database 304 for storing user session information, and the session information database 304.
And a maintenance control unit 303 that performs regular maintenance of the session information registered in the. The session information 304 includes a user ID 305, an identifier 306,
It is composed of three parameters of the expiration date 307 of the identifier 306. The session information whose expiration date 307 has expired is deleted by the maintenance control unit 303.

In this configuration, the WWW server 103
Requests the user ID and password from the client computer 101 used by the user at the initial stage of access from the user. Next, the user ID acquired from the client computer 101 is sent to the session management apparatus 105 as a search parameter to the session management apparatus 105.
The session information (connection information) corresponding to D is inquired to confirm that there is no duplicate login. Then WW
The W server 103 requests the authentication server 104 to verify the password. If the authentication result is correct, the WWW server 103 issues an identifier with an expiration date to the client computer 101, and the user ID shown in FIG.
305, an identifier 306, and an expiration date 307 of the identifier are transmitted as session information using three parameters. At the same time, the same session information transmitted to the client computer 101 is registered in the session information database 304 of the session management apparatus 105. Hereinafter, for access from the client computer 101,
The WWW server 103 uses the session information as an authentication factor. As a result, even if another user tries to connect using the same ID and password, the session management apparatus 105 refers to the session information of the target user and compares the information, so that the WWW server 103 is currently used. Access from anyone other than the user can be denied.

The processing of the client computer, WWW server, authentication server, and session management device will be described below in detail with reference to FIGS. FIG. 4 is a sequence diagram showing a procedure until the browsing of a Web page is permitted when the client computer 101 accesses the WWW server 103 for the first time, and FIG. 5 shows a procedure when the client computer 101 accesses the WWW server 103 for the second time. It is a sequence diagram. FIG.
When the WWW server 103 receives an access request from the client computer 101 (step 401), the WWW server 103 requests session information from the client computer 101 (step 402). Here, since it is the first access,
The client computer 101 returns a response without session information (step 403). Then, the WWW server 103 determines that the session information is not held. Here, if the client computer 101 has the session information issued at the time of the previous access and this session information is returned, it is determined that the access is the second or later access.

When the client computer 101 returns a response without session information, the WWW server 103
Is the user I
D and input of password (PW) are required (Step 4)
04). Therefore, the user using the client computer 101 inputs a user ID and a password, and
When transmitted to the W server 103 (step 405), the WW
The W server 103 uses the user ID received from the client computer 101 as a search parameter and inquires of the session management device 105 about session information corresponding to the user ID (step 406).

The session management device 105 checks whether or not the session information including the target user ID exists in the session information database 304, and if so, returns a registered response (step 407) and does not exist. In this case, an unregistered response is returned (step 409). If the user has already registered, it means that a legitimate user using the same user ID is already using the WWW service.
The WW server 103 is a client computer 101
Then, a duplicate login message is transmitted to refuse to browse the Web page (step 408).

If not registered, the WWW server 103 issues a user authentication request to the authentication server 104 (step 410). Therefore, the authentication server 104 performs a user authentication process using a password (step 411). If the password does not match the password registered in advance in the user authentication process, an NG response is sent to the WWW server 103.
(Step 412), and if they match, an OK response is returned (step 414). WWW server 103 is N
If a response of G is obtained, the client computer 10
1 sends a user authentication error message to
The browsing of page b is rejected (step 413).

If the passwords match and an OK response is obtained, the WWW server 103 creates an identifier 306 with an expiration date 307 to be assigned to the user of the client computer 101 (step 415), and matches it with the authenticated user ID. And transmits it to the client computer 101 as session information (step 416). In this case, the session information is encrypted by the MD5 encryption algorithm or the like, and the user's client computer 1
01 to the client computer 101
Is stored within. For example, it is stored as a Cookie. Here, the purpose of encrypting the session information is to prevent falsification by the user.

Next, when a response to the reception of the session information is received from the client computer 101 (step 417), the WWW server 103 transmits the same session information issued to the client computer 101 to the session management apparatus 105 (step 417). 41
8). The session management device 105 stores the received session information in the session information database 304 by a registration process (step 419), and returns a reception response to the WWW server 103 (step 420). WW
After receiving the reception response from the session management device 105, the W server 103 transmits a Web page (HTTP data) to the client computer 101 (step 421).

FIG. 5 shows the client computer 101.
WWW when the second or subsequent access is received from
FIG. 3 is a sequence diagram of the server 103. WWW server 10
3 receives the access request from the client computer 101 (step 501), and requests the client computer 101 for session information (step 502). Client computer 101
Has the session information issued at the time of the previous access, and if this session information is returned (step 503), it is determined that the access is the second or later access, and the expiration date is determined by the information of the expiration date 307. Is determined (step 504). If the expiration date has passed (if invalid),
A re-authentication message for transmitting the same re-authentication procedure as at the time of the first access is transmitted (step 505).

If the expiration date has not passed (if it is valid), the user ID in the session information received from the client computer 101 is used as a search parameter, and
For session information corresponding to (step 5
06). Then, if the session information corresponding to the user ID stored in the session information database 304 is received from the session management device 105
(Step 507), the session information received from the client computer 101 and the session management device 105
Is compared with the session information received from the
6. Verify whether the expiration dates 307 match (step 508). If they do not match, a duplicate login error message is transmitted to the client computer 101 (step 509), and the browsing of the Web page is rejected.

However, if session information having the same identifier 306 and expiration date 307 exists in the session information database 304 (this means that the user is an authorized user), the WWW server 103 is stored in the session management device 105. Request for updating the expired session information (meaning extending the expiration date) (step 510), and transmit the updated session information (encrypted session information) to the client computer 101. (Step 512). If a reception response is received from the client computer 101 and an update work completion message is received from the session management device 105 (step 514), the Web page (HT) is sent to the client computer 101.
TP data) (step 515).

FIG. 6 shows the client computer 101.
10 is a flowchart showing details of the processing of the WWW server 103 when there is a first access from. In FIG. 6, when the WWW server 103 receives an access request from the client computer 101 (step 601), the WWW server 103 requests the client computer 101 for session information (step 602). When the client computer 101 returns a response without session information, the WWW server 10
3 requests the client computer 101 to input a user ID and a password (PW) (step 605). Then, when the user ID and the password are received from the client computer 101, the session information corresponding to the user ID is collected in the session management apparatus 105 using the received user ID as a search parameter (step 606).

If session information including the target user ID has already been registered in the session information database 304 of the session management device 105 (step 6).
07), a legitimate user who has already used the same user ID
Since it means that the WW service is being used, a duplicate login message is transmitted to the client computer 101 to deny browsing the Web page (step 608). However, if not registered, the authentication server 10
4 is requested for user authentication (step 60).
9). Therefore, when an NG response is obtained from the authentication server 104, a user authentication error message is transmitted to the client computer 101, and browsing of the Web page is rejected (step 611).

When the passwords match and an OK response is obtained, an identifier 306 with an expiration date 307 to be assigned to the user of the client computer 101 is created (step 612), and the client information as session information is added together with the authenticated user ID. The data is transmitted to the computer 101 (step 613). Then, after receiving the reception response of the session information from the client computer 101, the same session information issued to the client computer 101 is transmitted to the session management apparatus 105 and registered in the session information database 304 (step 614). When a reception response is obtained from the session management device 105, the client computer 101
Is permitted to browse Web pages, and transmits HTTP data (step 615). If the session information has already been registered in step 603, the process proceeds to the procedure shown in the flowchart of FIG. 7 (step 604).

FIG. 7 is a flowchart showing the details of the processing when the access is made for the second time or later. In FIG. 7, when the client computer 101 has the session information issued at the time of the previous access, it is determined whether or not the expiration date has passed based on the information of the expiration date 307 in the session information (step 7).
01). If the expiration date has passed (invalid), after performing processing for deleting the session information stored in the client computer 101 (step 702), the same re-authentication as at the first access is performed. A re-authentication message for executing the procedure is transmitted (step 703).

If the expiration date has not passed (if it is valid), the user ID in the session information received from the client computer 101 is used as a search parameter, and
Is collected (step 70).
4). Then, the session information received from the client computer 101 is compared with the session information received from the session management device 105, and it is verified whether the identifier 306 and the expiration date 307 match (step 705). If they do not match, after performing processing for deleting the session information stored in the client computer 101 (step 706), a duplicate login error message is transmitted to the client computer 101 (step 707), and the Web page is deleted. Denies browsing.

However, if the identifier 306 and the expiration date 307 match, it means that the user is an authorized user.
A request is made to update the session information stored in the session management device 105 (meaning that the expiration date is extended) (step 708), and the session information whose encryption period has been updated (encrypted Session information) to update
(Step 709). Then, a reception response is obtained from the client computer 101 and the session management device 10
5, the client computer 101 is permitted to browse the Web page and transmits HTTP data (step 71).
0).

FIG. 8 shows the client computer 101.
Makes a request for termination to Web access
5 is a flowchart illustrating details of a process performed by a W server. When the WWW server 103 receives the access end request from the client computer 101 (step 8)
01), request and collect session information from the client computer 101 (step 802). Then, the expiration date of the identifier in the session information is referred to.
1. A process of deleting the session information registered in the session management device 105 is performed (steps 804 and 80).
5) Send an end message to the client computer 101 (step 806).

However, if the validity period of the identifier has expired, processing for deleting the session information registered in the client computer 101 is performed (step 807).
An end message is transmitted to the client computer 101 (step 808). In this case, the session information database 304 in the session management device 105
The expired session information in is automatically deleted by the maintenance control unit 303.

FIG. 9 is a functional explanatory diagram of the maintenance control unit 303 of the session management device 105. When the client computer 101 is connected to the WWW service and an abnormal situation occurs such that the communication with the WWW server 103 cannot be normally performed due to a line disconnection or an application error, etc., the session in the session information database 304 The information is not reflected normally, and as a result, session information of each client computer 101 remains, and when a user using the user ID attempts to reconnect, it is always regarded as a duplicate login and access is denied. Trouble occurs.
The maintenance control unit 303 refers to the session information database 304 at, for example, one-minute intervals, automatically deletes expired session information, and always keeps the session information database 304 up-to-date.
Eliminate the above problems.

In the example of FIG. 9, the time "13:04"
Session information database 3 at the check time
As a result of examining the session information of users A, M, and B registered in user 04, the session information of user B (user I
D = UserB, identifier = 98rxtrrwql, expiration date = January 2001
An example in which the validity period has expired on 13:03 on 30th is deleted and the contents of the session information database 304 are updated. As described above, according to the present embodiment, session information relating to Web access by a user is monitored by the dedicated session management device 105, thereby limiting duplicate logins from a plurality of client computers using the same user authentication information. It is possible to solve problems such as economic loss in operating the WWW site. Since the session management apparatus 105 is independent of other apparatuses, it can cooperate with an authentication server such as a database, RADIUS, LDAP, or CA, and can be easily introduced into various existing Web authentication systems. When constructing a new system, the function of the session management device is changed to WWW.
It can also be implemented in the server 103 or the authentication server 104. In addition, the expiration date is determined by the WWW server 1
03, may be performed in the session management device 105.

[0034]

As described above, according to the present invention, it is possible to prevent duplicate login in web access from a plurality of client computers using the same user authentication information without adding a special device.

[Brief description of the drawings]

FIG. 1 is a system configuration diagram showing an embodiment of the present invention.

FIG. 2 is a functional configuration diagram of a WWW server.

FIG. 3 is a functional configuration diagram of the session management device.

FIG. 4 is a sequence diagram showing a processing procedure in an initial access from a client computer.

FIG. 5 is a sequence showing a processing procedure in the second and subsequent accesses from the client computer.

FIG. 6 is a flowchart showing details of processing of a WWW server in an initial access from a client computer.

FIG. 7 is a flowchart showing details of processing of the WWW server in the second and subsequent accesses from the client computer.

FIG. 8 is a flowchart showing processing of a WWW server in response to a Web access end request.

FIG. 9 is an explanatory diagram of a maintenance process of a session information database held by the session management device.

FIG. 10 is an explanatory diagram of a user authentication process used in a conventional WWW system.

[Explanation of symbols]

101 client computer, 103 WWW server, 104 authentication server, 105 session management device, 206 ACL database, 207 authentication module, 208 session management module, 209 identifier creation module, 302 control unit, 303 Maintenance control unit, 304: session information database,
305: user ID, 306: identifier, 307: expiration date.

Claims (10)

[Claims] 1. A method for monitoring a duplicate login using the same user authentication information for a web page via a network, comprising: determining a duplicate login in response to an access request from a client computer to a web page managed by a WWW server. A first step of issuing session information for use and storing the session information in the client computer and the session information storage means of the access request source; A second step of returning the session information from the access requesting client computer; and determining whether session information matching the returned session information is stored in the session information storage means. Web page browsing Monitoring the duplicate login in web access. 2. In the third step, if no session information is returned, it is determined whether or not session information corresponding to user authentication information is stored in the session information storage means. 2. The method of monitoring duplicate logins in web access according to claim 1, wherein rejecting browsing of web pages. 3. The web access according to claim 1, wherein the session information includes user authentication information and an identifier with an expiration date, and is issued after receiving user authentication based on the user authentication information. Duplicate login monitoring method. 4. The method according to claim 3, wherein the session information is encrypted. 5. In the third step, when session information that matches the returned session information is stored in the session information storage unit, the session information stored in the session information storage unit and the client computer 5. The method according to claim 3, wherein the validity periods of the identifiers are sequentially updated until logoff. 6. A system for monitoring duplicate logins using the same user authentication information from a client computer via a network for a web page managed by a WWW server, the system comprising: On the other hand, first means for issuing duplicate login determination session information and storing the session information in the access requesting client computer and session information storage means, and at the time of the next access request, at the time of the previous access request Second means for returning the session information for duplicate login determination from the client computer of the access request source; and determining whether session information that matches the returned session information is stored in the session information storage means, Remembered A third means for rejecting web page browsing if not present, in a WWW server or a session management device, a duplicate login monitoring system for web access. 7. When the session information is not returned, the third means determines whether session information corresponding to user identification information is stored in the session information storage means, and if the session information is already stored. 7. The system according to claim 6, wherein the browser refuses to browse the web page. 8. The web access according to claim 6, wherein the session information is composed of user authentication information and an identifier with an expiration date, and is issued after the user is authenticated by the user authentication information. Duplicate login monitoring system. 9. The system according to claim 8, wherein the session information is encrypted. 10. The session information stored in the session information storage means and the client computer when session information matching the returned session information is stored in the session information storage means. 10. The duplicate login monitoring system for web access according to claim 8, wherein the validity periods of the identifiers are sequentially updated until logoff.