JPH11175475A - ACCESS CONTROL METHOD AND RECORDING MEDIUM RECORDING ACCESS CONTROL PROGRAM - Google Patents

Abstract

(57) Abstract: An access control method and an access control program for reducing the load on a WWW server as an information provider by a network cache and the load on a network itself and permitting only users who satisfy the conditions to browse contents. And a recording medium on which is recorded. SOLUTION: The content is previously encrypted and stored in a WWW server 1, the encrypted content is received as a message by a WWW browser 3, the IP address of a key server is checked from a transfer encoding header of the message, and an encryption key ID and User authentication information to key server 2
The key server 2 checks whether the access right of the encryption key corresponding to the encryption key ID exists from the user information received from the WWW browser 3 and returns the encryption key to the WWW browser 3 if it exists. Then, the WWW browser 3 decrypts the encrypted content with the encryption key.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention satisfies a predetermined condition in order to restrict users in order to protect paid contents or maintain security when providing information using the WWW (World Wide Web) on the Internet. The present invention relates to an access control method that allows only a user to view information and a recording medium that records an access control program.

[0002]

2. Description of the Related Art With the development of the Internet and the spread of the WWW, various information has been provided on the Internet. At the same time, there is a growing need to show information only to certain specific users. I would like to show paid content only to those who paid the usage fee, and confidential information only to those who have the authority to see it. A technology that allows only those who satisfy certain conditions to view information is called access control.

[0003] Conventional access control has been realized as an integral part of the information transfer function of a WWW server. That is, an ID and a password are issued in advance to a user who satisfies the conditions, and the information itself is not transferred unless the correct ID and password are input when requesting information to the WWW server.

[0004]

However, the above-mentioned conventional access control method has a problem that its consistency with the network cache technology is poor.

[0005] In the network cache technology, frequently used contents are stored in a cache server,
In response to the request for the content, a cache server transfers information instead of the WWW server.
In recent years, it has been spreading rapidly because the load on the WW server and the network can be reduced.

However, since the cache server cannot determine whether the information request is from a user who satisfies the conditions, the cache server does not perform any proxy transfer of the content under the conventional access control. However, there is a problem that the advantage that the load on the WWW server and the network cannot be reduced due to the problem cannot be enjoyed.

[0007] The present invention has been made in view of the above,
An object of the present invention is to record an access control method and an access control program that allow only a user who satisfies a condition to view contents while reducing the load on a WWW server as an information provider and the load on the network itself by a network cache. It is another object of the present invention to provide a recording medium that has been designed.

[0008]

In order to achieve the above object, according to the present invention, in an information providing system having a WWW server and a WWW browser on the Internet, the WWW server pre-encrypts and stores contents. In response to an information request from a WWW browser, the encrypted content is delivered as a message to the WWW browser, and an encryption key for decrypting only the WWW browser that satisfies a predetermined condition is separately delivered. The gist is to decrypt the encrypted content.

According to the first aspect of the present invention, WWW
The server encrypts the content in advance, stores the content, delivers the encrypted content to the WWW browser in response to a request from the WWW browser, and separately delivers an encryption key for decrypting only to the WWW browser that satisfies the predetermined condition. Decrypts the encrypted content with the encryption key, so that the network cache technology can be effectively used, and the load on the WWW server and the load on the network can be reduced. That is, whether or not content can be browsed is determined by WWW.
It is not the permission or disapproval of the transfer of information at the server, but whether or not the user on the WWW browser side has the key to decrypt it. Since the content is encrypted, the transfer of the content is unconditional. Authorized and available to anyone, can hold content in a cache server, WW
The load on the W server and the network can be reduced.

The present invention described in claim 2 is the same as the claim 1.
In the invention described in the above, the process of separately delivering the encryption key to the WWW browser is performed when the WWW browser that has received the message including the encrypted content is transfer-encoded (Transfer-Encodi
ng) Check the IP address of the key server from the header, send the encryption key ID and user authentication information to the key server, and the key server uses the encryption key I based on the user information received from the WWW browser.
The gist is to check whether or not the access right of the encryption key corresponding to D exists, and to return the encryption key to the WWW browser if it exists.

According to the present invention, the WWW browser which has received the message containing the encrypted content checks the IP address of the key server from the transfer encoding header of the message, and converts the encryption key ID and the user authentication information into a key. The key server checks from the user information from the WWW browser whether the access right of the encryption key corresponding to the encryption key ID exists, and returns the encryption key to the WWW browser if it exists. The content can be browsed only when the encrypted content is decrypted with the encryption key, the network cache technology can be effectively used, and the load on the WWW server and the load on the network can be reduced. The transfer encoding header is prepared by the WWW server.
The ID of the corresponding encryption key and the IP address of the registered key server are entered therein.

According to a third aspect of the present invention, there is provided an information providing system having a WWW server and a WWW browser on the Internet, wherein the WWW server stores contents in advance by encrypting the encrypted contents. A request is sent from the WWW browser to the WWW server and received as a message by the WWW browser.
The W browser checks the IP address of the key server from the Transfer-Encoding header of the received message, transmits the encryption key ID and the user authentication information to the key server, and the key server transmits the user information received from the WWW browser. Check whether the access right of the encryption key corresponding to the encryption key ID exists,
If it exists, return the encryption key to a WWW browser;
The gist is that a WWW browser records an access control program for decrypting the encrypted content with the encryption key on a recording medium.

According to the third aspect of the present invention, WWW
The content is previously encrypted and stored in the server, the encrypted content is received by a WWW browser, the IP address of the key server is checked from the transfer encoding header, and the encryption key ID and user authentication information are transmitted to the key server. The key server checks whether the access right of the encryption key corresponding to the encryption key ID exists from the user information received from the WWW browser, and if so, returns the encryption key to the WWW browser. Since the access control program for decrypting the encrypted content is recorded as a recording medium, the distribution of the program can be improved by using the recording medium.

[0014]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a block diagram showing a system configuration for implementing an access control method according to one embodiment of the present invention. In FIG. 1, 1 is a WWW server that stores and distributes information, 2 is a key server that manages encryption keys and checks access conditions, 3 is a device that requests information from the WWW server 1 and distributed from the WWW server 1. A WWW browser 4 for displaying the received information to the user is a cache server for temporarily storing information of the WWW server 1 and delivering information on behalf of the WWW server 1.

The WWW server 1 comprises an information transmitting unit 11, an encryption processing unit 13, and an information storage unit 15. The information transmitting unit 11 receives an information request from the WWW browser 3, extracts the requested information, that is, the content from the information storage unit 15, and delivers the content to the WWW browser 3. At this time, when encrypting and delivering the content, transfer encoding of the delivery message
(Transfer-Encoding) Indicates that the header is encrypted. The encryption processing unit 13 performs content encryption for the access control method and registration of a key with the key server 2. The information storage unit 15 stores content and management information of the present access control method.

The key server 2 has a user encryption key comparison table 21,
It comprises an encryption key storage unit 23 and an encryption key communication unit 25. The user encryption key comparison table 21 stores a user and an encryption key to which the user has an access right in a table format. The encryption key storage unit 23 stores the encryption key passed from the WWW server 1. The encryption key communication unit 25 receives the encryption key and the access information from the WWW server 1 and stores them in the user encryption key comparison table 21 and the encryption key storage unit 23.
Further, the encryption key communication unit 25 receives the request for the encryption key from the WWW browser 3, checks whether or not the requesting user has the access right from the user encryption key comparison table 21, and if the user has the access right, converts the encryption key to the WWW. Send to browser 3.

The WWW browser 3 comprises an information receiving section 31, a decryption processing section 33, a display section 35, and an encryption key receiving section 37. The information receiving unit 31 includes the WWW server 1
Sends an information request and receives the response. The decryption processing unit 33 performs decryption when the response received from the WWW server 1 via the information receiving unit 31 is encrypted. The display unit 35 displays a response from the decryption processing unit 33.
The encryption key receiving unit 37 requests the key server 2 for an encryption key, receives the encryption key from the key server 2, and supplies the key to the decryption processing unit 33.

The cache server 4 comprises an information transfer unit 41 and a cache storage unit 43. The information transfer unit 41 sends an information request from the WWW browser 3 to the WWW
Relays the response from WWW server 1 to WWW server 1
The response is sent to the browser 3 and the response is stored in the cache storage unit 43. Note that the cache server 4 is the same as that used in normal WWW, and does not particularly require a function unique to the present invention.

Next, the operation of the embodiment shown in FIG. 1 will be described with reference to FIGS.

FIG. 2 is a flowchart showing a communication control process when the WWW server 1 communicates with the WWW browser 3. 2, when the WWW server 1 receives a request from the WWW browser 3 (step S11),
The request is interpreted to prepare a response message (step S13). At this time, when the information requested from the WWW browser 3 is encrypted, the WWW server 1
(1) an identifier indicating that the response message body is encrypted; (2) an identifier indicating the IP address of the key server 2; and (3) an identifier of an encryption key for encrypting the requested information. encoding·
It is attached to the header and returned to the WWW browser 3 (steps S17, S19).

Next, with reference to the flow chart shown in FIG. 3, the processing from when the WWW browser 3 receives and displays a response message from the WWW server 1 will be described.

In FIG. 3, the WWW browser 3 is
When the response message is received from the W server 1 (step S21), it is checked whether or not the transfer encoding header of the message includes an identifier indicating that "the message body is encrypted" (step S23). If there is such an identifier, the IP address of the key server 2 and the ID of the encryption key are obtained from the transfer encoding header (step S25). Then, it communicates with the key server 2 indicated by the obtained IP address, and receives an encryption key corresponding to the ID from the key server 2 (step S27). Then, using the encryption key, the message received from the WWW server 1 is decrypted (step S29), and the decrypted message is displayed on the display unit 35 (step S31).

Next, with reference to a flowchart shown in FIG. 4, a process of transferring an encryption key between the key server 2 and the WWW browser 3 will be described. 4, the flowchart on the left side shows the encryption key receiving process of the WWW browser 3, and the flowchart on the right side shows the key transmitting process of the key server 2.

In FIG. 4, in a state where the key server 2 is waiting for a connection from the WWW browser 3 (step S
51), when the WWW browser 3 is connected to the key server 2 (step S41), the key server 2 sends the server authentication information to W
The data is transmitted to the WW browser 3 (step S52). WWW
When receiving the server authentication information from the key server 2 (step S42), the browser 3 checks the server authentication information and confirms that the server is correct (step S43).

After confirming the server authentication information, the WWW browser 3 sends the user authentication information to the key server 2 (step S44). Upon receiving the user authentication information from the WWW browser 3 (step S53), the key server 2 checks the received user authentication information and checks whether the user is a correct user (step S54). WWW Browser 3
Transmits the identifier of the encryption key to the key server 2 (step S45). The key server 2 confirms that the user is a correct user from the user authentication information, and further receives an encryption key identifier from the WWW browser 3 (step S5).
5), the key server 2 checks whether the user has an access right to the encryption key corresponding to the received encryption key identifier (step S56). If the user has the access right, the key server 2 returns the encryption key to the WWW browser 3 (Step S57), and the WW
The W browser 3 receives the encryption key (step S4)
6).

Next, the overall operation of the embodiment shown in FIG. 1 will be described with reference to the sequence diagram shown in FIG. In FIG. 5, first, when the information is not cached, the information request from the WWW browser 3 is sent to the WWW server 1 via the cache server 4 and the WWW
The server 1 returns the requested information. This reply information is temporarily stored in the cache server 4 and transmitted to the WWW browser 3 via the cache server 4. If this information is encrypted, the WWW browser 3 requests the key server 2 for an encryption key. The key server 2 returns the encryption key to the WWW browser 3 in response to the request, and the WWW browser 3 uses the encryption key to decrypt the encryption information.

On the other hand, when the information is cached, the information request from the WWW browser 3 is processed by the cache server 4, and the information is transmitted from the cache server 4 to the W server.
This is returned to the WW browser 3. If this information is encrypted, the WWW browser 3 similarly requests the key server 2 for an encryption key, and the key server 2 returns the encryption key to the WWW browser 3, and the WWW browser 3 The key is used to decrypt the encrypted information.

[0029]

As described above, according to the present invention,
The WWW server encrypts the content in advance and stores it,
Encrypted content in response to request from WW browser
Delivery to the WWW browser, and separately deliver an encryption key to decrypt only to the WWW browser that satisfies the predetermined condition, and the WWW browser decrypts the encrypted content with the encryption key.
Effective use of network cache technology, WWW
A large amount of information can be distributed even if the server has a low capability, and provision of pay contents and provision of secret information to many users can be realized with inexpensive hardware. Also,
Since the load on the network can be reduced, an increase in network cost due to the distribution of a large amount of information can be suppressed. Further, in the conventional access control, there is a risk that contents are leaked due to theft of communication, but in the present invention, such risks can be avoided because the contents are encrypted.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a system configuration for implementing an access control method according to an embodiment of the present invention.

FIG. 2 is a diagram illustrating a WWW server in the embodiment of FIG.
It is a flowchart which shows the communication control processing at the time of communicating with a browser.

FIG. 3 is a diagram illustrating a WWW browser in the embodiment of FIG.
13 is a flowchart illustrating a process from receiving a response message from a W server to displaying the response message.

FIG. 4 is a flowchart illustrating a process of transferring an encryption key between a key server and a WWW browser.

FIG. 5 is a sequence diagram showing an overall operation of the embodiment shown in FIG. 1;

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 WWW server 2 Key server 3 WWW browser 4 Cache server 13 Encryption processing unit 15 Information storage unit 21 User encryption key comparison table 23 Encryption key storage unit 25 Encryption key communication unit 33 Decryption processing unit 37 Encryption key reception unit 43 Cache storage Department

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁶ Identification code FI H04L 12/58

Claims (3)

[Claims] 1. An information providing system having a WWW server and a WWW browser on the Internet.
The WW server encrypts the content in advance and stores it.
Delivering the encrypted content as a message to the WWW browser in response to an information request from the W browser,
An access control method, wherein an encryption key for decrypting is separately delivered only to a WWW browser that satisfies a predetermined condition, and the WWW browser decrypts the encrypted content with the encryption key. 2. A process for separately delivering an encryption key to the WWW browser, wherein the WWW browser that has received the message including the encrypted content uses the Transfer-Encoding header of the message to determine the IP address of the key server. Check the address, send the encryption key ID and the user authentication information to the key server, and the key server
2. The method according to claim 1, wherein it is determined whether the access right of the encryption key corresponding to the encryption key ID exists from the user information received from the browser, and if the access right exists, the encryption key is returned to the WWW browser. Access control method. 3. An information providing system having a WWW server and a WWW browser on the Internet,
In the WWW server, the content is encrypted and stored in advance, and the encrypted content is requested from the WWW browser to the WWW server, and is sent as a message to the WWW server.
The message is received by the browser, and the WWW browser receives the transfer encoding (Transfer-En
coding) Checks the IP address of the key server from the header, transmits the encryption key ID and user authentication information to the key server, and in the key server, the access right of the encryption key corresponding to the encryption key ID is determined from the user information received from the WWW browser. Check whether it exists, and if so, replace the encryption key with W
A recording medium storing an access control program, wherein the access control program is returned to a WWW browser, and the WWW browser decrypts the encrypted content with the encryption key.