WO2004080007A1 - Access control system using ip address classification - Google Patents

Abstract

An access control system performs access control by a method set by a data provider according to the IP address classification. The access control system is connected to a network for relaying a data providing system and a user accessing the data providing system. The access control system includes user IP address acquisition means for receiving a data providing system access request from a user and acquiring an IP address, an IP address classification database in which IP addresses are classified according to countries, areas, organizations, line types, transmission origin types, arbitrary classification types, and the like, an access control setting database in which a control method is set according to the IP address classification, access enabled/disabled judgment means for selecting an access control method corresponding to the IP address classification identified, and access control means for executing the access control method selected.

Description

 Specification

1 Access control system using padless classification

 The present invention uses an IP address classification database in which a plurality of IP addresses are classified in advance according to at least one of IP addresses classified by country, region, organization type, line type, transmission source type, and arbitrary classification type. The present invention also relates to an access control system using IP address classification, wherein access control is performed by a method set in advance by a data provider according to the IP address classification. '' Conventional technology

 Conventionally, websites that provide images, music, videos, and other various contents, and systems that provide databases and paid data programs via networks typified by the Internet have been used. I'm familiar. There are various types of data provided, such as content provided free of charge and content provided for a fee. In the case of paid content / paid data, the data provider charges the user. And so on.

 '' 不正 Unauthorized access to content and copyright protection

There is a need to take more.

 f, Japanese Patent Application Laid-Open No. 2002-3112 685 “Contents Collection System for IP Content Charges, Method for Collecting Charges for Content, Billing Server, Billing Method, Billing Server and Program Recording Medium” In systems that allow consumers to acquire or use paid content via Internet, it is possible to collect fees for various types of content easily and reliably.

When the user terminal connects to the network, the correspondence information between the user's telephone number notified from the exchange and the user's I address assigned to the user terminal is sent to the charging server. A first server for transmitting, a second server for transmitting the user's IP address and billing information to the billing server when transmitting the content to the user terminal, and the first server; The correspondence information between the transmitted user's telephone number and the user's IP address and the user's IP address and charging information sent from the second server are combined to determine the user's telephone number to be charged. This is a system having a billing server for specifying and billing content charges included in telephone charges.

 According to the above-mentioned technology, each user is identified by using the 1P address and telephone number of the accessing user, and the charging is surely performed. Therefore, it is necessary to manage the data of each user.

 Also, when transmitting and receiving data using the Internet, for example, when a user accesses the system, such as writing on an electronic bulletin board, the user uses the IP address of a specific user or a cookie to identify the user. In addition, a method of eliminating unauthorized users by restricting writing and access is used. In such a case, if it is determined that the user is a fraudulent user, the data identifying the individual user is stored and stored, and the user is determined by managing the data of each person. It is necessary to control access.

 Therefore, the database is identified as an unauthorized user, such as a user who makes unauthorized access for the first time or a user who accesses from another terminal device, and is stored and managed.

 ', I cannot prevent the unauthorized access of the user.

 In order to prevent access, a filtering function that checks the access request of the user who sent the access request to the user / user system that provides data and content can be used to filter out unauthorized users, It is desirable to transfer another web access indicating that unauthorized access is not allowed.

.t, Japanese Patent Application Laid-Open No. 2002-247471 "Unauthorized access prevention method, security device, gateway device and terminal device" prevents unauthorized access to the private network device from outside. A possible method and an apparatus for implementing the method have been proposed. Connect external and internal networks This is an unauthorized access prevention method that connects via a toway device and prevents unauthorized access to devices on the internal network from the external network.

 When a data packet is transmitted from the external network to a device in the internal network, the packet information of the data packet and the self-authentication data of the gateway device are transmitted on the external network. The data is transmitted to the security management device, and the security management device requests sender-side authentication data from the sender of the data packet based on the packet information, and the sender sends the sender-side authentication data in response to the request. By transmitting the sender-side authentication data to the security management device, it is determined whether or not the sender is permitted to access the internal network.

 The present invention also discloses a method of using the IP address, TCP information, UDP access port number, etc. of the sender of the data bucket as the bucket information.

 However, even with the above technology, individual users are specified by using the sender authentication data of the accessing sender, and access is permitted or denied. It is necessary to manage the data of each person.

 In other words, according to these methods, it is essential to store and manage in advance the data of all users who have requested access to a specific website / server, etc., and use them as a database. .

 On the other hand, if such a huge database is used, enormous labor and equipment will be required to maintain and maintain the data in order to keep the data up-to-date, and the number of resources will increase.

 , Even if we can maintain and maintain the database of each user, the person HI: Assuming the Internet world that connects the world, and if there are billions of people, the parts that are not included in the data are still huge. is there.

Access to servers through 'logs stored on server' files, etc. The ability to identify users by domain name or IP address', and most individual Internet users They use a service provider (1 SP), and these ISPs provide Because there are many IP addresses, each P-user of dial-up IP connection is assigned a different P address every time they are accessed, so it will be different each time. There.

 Therefore, the filing scale first divides users into arbitrary regions through their IP addresses when transmitting advertisements and other information using a computer network, and is effective based on the classification. A system to solve the above-mentioned problem by sending it to the public was found.

 According to this method (Patent No. 33197731), when there are a plurality of senders who want to send advertisements and information, the classification of a region can be adjusted according to each sender's intention, and cost and cost can be adjusted. Taking into account the maintenance and management efforts, it is possible to provide a system and method that can achieve a higher advertising effect or information provision effect. '' In addition, the Internet has exploded, the number of users has increased in each region, and a number of Internet service providers (ISPs) have emerged along with this. The applicant has developed a technology that collects an enormous amount of IP address data used by access points in various parts of the country and classifies them by region.

 According to the conventional technology, it is necessary to collect and store and manage data of each user even when determining user attributes and the like using an IP address. By using a unique database that associates the information with the region, it is possible to determine the region of the transmission source even if individual users are not specified.

 φ: In the technical field of access control in the invention, it has conventionally been necessary to collect and store and manage the data of each individual user as before, but this requires a database that specifies each user. No built-in access control. In addition, unauthorized access users

For the first time, that user is stored as a user who gains unauthorized access. By the way, music content, moving image content, brochures that can be used on the Internet, etc. Access and When accessing data related to usage contracts such as the use of paid databases, it may be necessary to provide access control depending on the region of the accessing user, such as the country, or the organization. Many.

 For example, if the server administrator has been granted the right to distribute only in Japan, access to video data such as movies and audio data such as music may be permitted from outside Japan. In the case of unauthorized access or unauthorized access, the server administrator may be held liable, along with the unauthorized user.

 Also, if the server administrator is granted the right to distribute only to the contracted company, it may allow access from non-contracted companies in data distribution such as paid databases and paid news distribution. However, if unauthorized access is made possible, the server administrator may be held liable along with the user making the unauthorized access. Disclosure of the invention

 Therefore, the present invention solves the above-mentioned various problems, and in the present invention, a plurality of I-addresses are determined in advance by at least one of country, region, organization, line, source, and arbitrary classification. Using the I-address classification database classified according to the I-address classification, the data provider sets in advance according to the I-address classification. The purpose is to provide.

 In the technical field of access control, it is no longer necessary to collect and store data for each individual as in the past, and a plurality of various web sites can be created without building a database for each user. In accordance with the control method requested by the data provider such as

Ί to Π ^: You can do two things. Also, for the first time when an unauthorized access user appears, there is no need to memorize and manage the user as a user who has a correct access.In addition, each country, service, service, nationwide and worldwide Access points in each region, companies and other organizations that have their own IP addresses In the case where the huge amount of IP addresses used for inputting is increased or changed, the data is collected and a pre-classified database is set up. Can do.

 Further, in the present invention, the access statistics for each region of each user, such as country, region, region, line type, transmission source type, arbitrary classification type, etc., including unauthorized access, can be obtained, Another object of the present invention is to provide a system capable of relaying access to the optimal access ¾ even when access is permitted based on this. In the invention described in claim 1, in order to solve the above problem,

A system provided to be connected to a network for relaying between a data providing system provided by the data provider and a user terminal accessing the data providing system,

A user IP address acquiring means for automatically acquiring a sender's IP address when an access request to the data providing system is received from a user terminal;

A 1P address classification database that classifies a plurality of IP addresses in advance according to at least one of the IP address classifications of country, region, organization type, line type, source type, and arbitrary classification type;

An access control setting database in which access control is performed for each data providing system in advance according to the source's 1P address classification, and which access control is performed for which IP address classification,

 From the I address of the transmission source obtained by the address acquisition means, the I classification is determined by referring to the I address classification database, and access to determine an access control method corresponding to the address classification is permitted.

 Access control means for executing the access control method determined by the access permission / non-permission determination means in response to an access request; and / or a method set in advance by a data provider in accordance with a standard. Access by

—It is characterized by an access control system that uses the I-address classification, which performs a precise operation.

In order to solve the above-mentioned problems, in the invention described in claim 2, In the invention described in claim 1,

The system is characterized in that the system is an access control system using an IP address classification, comprising an access request receiving unit for receiving an access request to the data providing system, and an access request relay unit. .

 In order to solve the above-mentioned problems, in the invention described in claim 3, in the invention described in claim 1 or 2,

The access control setting database includes a data provider information storage unit that stores information about a data provider, and a data provider system storage unit that stores information about a data providing system including an access request relay destination. It is characterized by an access control system using 1P address classification.

 In order to solve the above-mentioned problems, in the invention described in claim 4, in the invention described in any one of claims 1 to 3,

The access control means transmits an access request that rejects the access request to the user terminal when the access permission determination means determines that the access request is not to be relayed. It is characterized by being a control system.

 Further, in order to solve the above problems, in the invention described in claim 5, in the invention described in any one of claims 1 to 3,

 The access control means, when it is determined by the access permission / non-permission determining means that no access request is made, relays the key * to the data provision system for inaccessible users, which is stored in the access control setting data. It is characterized by access control using address classification.

 .1: In order to solve the problem, in the invention described in Claim 6, in the invention described in 15

Accessible user data provision system is a web page provided in advance according to at least one of IP address classifications of country, region, organization type, M line type, source type, and arbitrary classification type. , IP address classification The special feature is that it is an access control system used.

 Further, in order to solve the above problems, in the invention described in claim 7,

 In the invention described in the range of 1 to 6 in the range of Mil-mi,

The files provided by the data provider system are audio data, moving image data, image data, and other content data, and the access request relaying means includes an access request by the access permission determining means. If it is determined that the content is to be relayed, the information transmission system uses an IP address acquisition and classification system that relays the content data distribution request according to the access request. In order to solve the above-mentioned problem, in the invention described in claim 8, in the invention described in claim 7,

The above-mentioned data providing system for inaccessible users is provided with content data provided in advance according to at least one of IP address classifications of country / region / organization type / line type / source type / arbitrary classification type. It is characterized by an access control system that uses IP address classification, which is a web page that notifies the user that distribution is impossible.

 Further, in order to solve the above problem, in the invention described in claim 9, in the invention described in any of claims 7 or 8,

The above-mentioned data providing system for inaccessible users is provided with IP address of at least one of country, region, organization type, line type, source type, and arbitrary classification type.

'It is characterized as an access core / recording system using IP address classification, which is a web page to which sample data distribution of content data is provided in advance.

 In order to solve the above-mentioned problems, in the invention described in Claim 10, in the invention described in any one of claims 7 to 9, 7 Organization type ·

• Communication • Type • At least one of the optional classification types using IP address classification. Uses the IP address classification, which is a web page that accepts a content data copyright permission request in advance. It is a special feature that it is an access control system. Further, in order to solve the above problems, in the invention described in claim 11, in the invention described in any one of claims 1 to 10,

 The files provided by Rii's data provider system are audio data, video data, image data, and other content data.The data distribution system that distributes the content is connected to a network. Multiple,

If the access control means determines that the access request is to be relayed by the access permission / non-permission determining means, the IP address classification is performed based on the source IP address obtained by the user address obtaining means. In addition to making a determination by referring to the database, it also determines which of the multiple data provider systems will distribute the content data, and in accordance with the access request, determines the data provision system determined based on the IP address classification. On the other hand, it is characterized by an access control system that uses IP address classification to relay content data distribution requests.

 Further, in order to solve the above-mentioned problems, in the invention described in claim 12, in the invention described in any one of claims 1 to 11,

 1 It is characterized in that it is an access control system using IP address classification, provided with a counting means for calculating the undetermined IP address statistics for which the address classification cannot be determined.

 Further, in order to solve the above problem, in the invention described in claim 13, in the invention described in any one of II 1 to 12,

 When the availability determination means determines that the access request is not to be relayed, it is characterized in that it is a control system using IP address classification, provided with a tallying means for tallying availability statistics. Description

: It is a system configuration diagram showing an example of the basic configuration of the system of size and description. FIG. 2 shows the IP addresses possessed by each access point of each provider obtained by the IP address obtaining means. Shows an example of the data format for storing It is a data schematic diagram.

 Figure 3 is a data barrel diagram showing an example of a regional address classification database in which data is stored in association with IP addresses, country codes, regional codes, regional keys, and the like. ,

 Fig. 4 shows an example of an IP address classification data base that stores data associated with P address, country code, area code, municipal name, other arbitrary data, type, etc. It is a data schematic diagram shown.

 FIG. 5 is a data schematic diagram showing an example of an IP address classification database in which data is stored in association with〗 address, line type code, バ ン ド of broadband / narrow band, and any other classification type. .

 FIG. 6 is a data schematic diagram showing an example of a data provider information storage means for storing information on a data provider.

 FIG. 7 is a schematic data diagram showing an example of a data provider system storage means for storing information on a data providing system including an access request relay destination.

 FIG. 8 is a schematic data diagram showing another example of an access control classification database in which a data provider has set access permission.

 FIG. 9 is a flowchart showing an example of the basic processing flow of the present invention. FIG. 10 is a flowchart showing an example of the basic processing flow of the present invention. FIG. 11 is a flowchart showing an example of a basic processing flow of the present invention. FIG. 1 is a system conceptual diagram showing a typical example of a system using the access control system of the present invention.

¾Best form of administration

 Preferred embodiments of the system of the invention with reference to the a-plane, with reference to the drawings

FIG. 1 is a system configuration diagram showing a basic configuration of: t, ψ;

C) The access control system using the P address classification is a network that relays the data provider capability and the data terminal that relays the data provider system and the user terminal that accesses the data provider system. System connected to It is.

 The data providing system is a web site or the like accessed from a user terminal, and is generally configured by a computer / server or other server device. In addition to the system that provides web contents using the HTTP protocol, the data providing system is a system that provides data via a network by FTP or other protocol when the user accesses it. All right,.

 When the data providing system includes a web site, the data providing system includes a web server for storing content data and blogs.

 The content data is displayed on web pages such as HTML and XML files, and on mobile phones that can access websites such as C-H TML files. Data files are included.

 Also, it stores character data files, audio data files, image data files, moving image data files, animation data files, and other various content data that are displayed or output as input to these files. can do.

 The program is a program that searches and extracts data stored in a database or the like in response to a search request from a user terminal, or an HTML file that can display the extracted data on WEB. A program to be generated, a program sent from a customer terminal and stored in a database or the like, a program connected to a server system, a program to send and receive data input / output via a computer network or network, an electronic bulletin board It can include programs that write, store, and write data, programs that send e-mail from files on the web, and other programs.

-Examples include systems that provide movies and other video content by downloading and streaming, systems that provide music and other audio data by downloading and streaming data, and data bases. '-A system that provides data. There are no restrictions on how data is provided, whether paid or free, but access control to prevent unauthorized access to paid data and copyright It can perform access control for rights protection.

 Next, as a user terminal for accessing the data providing system, usually, a computer terminal such as a personal computer / workstation is used. Means, input means, output means, display means, etc. Computer networks such as the Internet are also equipped with functions to send and receive connectives and data, and are usually equipped with application programs such as browser e-mail software, e-mail 'Roses', and an operating system (OS). It is a form.

 In addition, user terminals include wireless communication terminals such as mobile phones equipped with a browser function that can be connected to the Internet, mobile information terminals, and the Internet.

Devices such as TVs, game consoles, video conferencing systems, and other home appliances with network connectivity can be broadly included.

 The system of the present invention is connected to a network and provided for relaying a data providing system provided by a data provider and a user terminal accessing the data providing system. The network includes a wide range of forms, such as the Internet, a network connected by a dedicated line, an intra-company LAN, an inter-company LAN, and a WAN.

 Further, the form of the communication line used here widely includes the form of wired communication and the form of wireless communication, and includes the form using satellite communication and B e u o o o th.

"One", ^"n ° IP Adoresu access control system using classification, Yu) is a device for relaying an access request to La data providing system, the call is accessed to receive an access request to the data providing system And access request relay means.

 It has the same or similar function as-, and performs packet transfer by looking at the P address for data transfer by the data transfer function.

 , ':-It may be a dedicated device that performs the game, but it may be a server with the same function.

 This description The access control system using IP address classification has an application server function with at least a program and a database.

L2 Database server function. These can be installed in the same physical device, physically composed of multiple devices, or connected via a network.

It includes a form composed of a plurality of devices physically connected to each other, and includes various forms if a similar function is realized.

 * Preferably, for data maintenance, data management, and the like, a computer terminal connected to the system of the present invention or having a storage unit, a control unit, an input unit, an output unit, a display unit, etc. Is provided.

 The input means includes various devices such as a keyboard, a mouse, a tablet, etc., for inputting information on the system operator / administrator of the present invention, and for correcting / updating / deleting information. Used for etc.

 The control means is a database for storing IP addresses categorized by region. Programs such as software and application programs, OSs, central processing units, memories, etc., control the computer system. . The display means is a display of a computer terminal, which is connected to the computer system and required for operation.

 The output means transmits information to a monitor for output on a screen, data output to a printer or the like for printing and output, and transmits information to a storage means at a remote place via a network. And data output means such as an input / output interface used for storing data.

 • φ: The system of the invention is equipped with a user IP address means for automatically acquiring the IP address of the transmission source when the user terminal accesses the data providing system.

 7) The IP address is an IP address assigned to a user terminal or a server device such as a LAN including a user terminal when the user is assigned a unique IP address. The IP address of e-mail, which is accessed by the user via the Internet service provider (ISP), is the IP address of the Internet service provider (ISF) access point.

Access from a user terminal that made an access request to a specific data providing system JP2003 / 001665

The data is relayed to the access control system of the present invention by transfer or the like, and is received by the access request receiving means.

 The IP address of the user, regardless of the source, is transmitted to the data providing system transmitted from the user terminal (described in the IP header added to the access request data, received by the system of the present invention, and received by the user IP). Received by the address acquisition means The user's access record can also be recorded in the server's log file as soon as the file on the server is accessed.

 The 1-P address is a 32-bit numerical data, and is composed of a network address portion indicating a network and a host address portion indicating a computer. For example, the address on the network of servers located all over the world is shown in the form of “01.24.45.7.8.8”. These are converted to each other in a one-to-one correspondence with a domain name, for example, a character string that has a certain meaning, such as "~. Provider name.ne.jp" or "~. You can, but you can't tell at a glance if you look at the IP address as it is as a series of numbers.

 However, as described above, as can be seen from the fact that a domain name can be mutually converted in a one-to-one correspondence, a specific server having an original 'domain always corresponds to a specific server connected to a network. Compatible with computers.

In other words, it means that the user's server can be specified by specifying the IP address,

 At present, -'less is 32 bits numerical data, and it has a network address part which indicates which network and a host address part which indicates which computer.

¾

 In the commonly used version of the IP address, IPv4 (Internet Version 4), it is represented by 32 bits, and for convenience, it is represented by a decimal number separated by 8 bits. For example, "192.166.0.2"

: Indicates an address on the network of one server existing in the world.

'The IP address of the source is classified into five classes from Las A to Class E according to the size of the network to which the host belongs, and is actually assigned to the network-host. IP addresses are currently available for large networks Class A, Class B for medium networks, and Class C for small networks. Each of these classes is identified by the most significant bit pattern of the 32-bit address, and these IP addresses are composed of a network section and a host section as described above.

 For example, in class A, the first bit is 0, the next 7 bits are the network part, and the remaining 24 bits are the host part. The range of the IP address is “0.0.0.0.0” and “1 27.255.255.355”.

 In class B, the first bit is 10, the next 14 bits are the network part, and the remaining 16 bits are the host part. The range of the IP address is from “128.0.0.0.0” to “191.255.255.255”.

 In class C, the first bit is 110, the next 21 bits are the network part, and the remaining eight bits are the host part. The range of the IP address is from "192.0.0.0.0" to "223.255.255.255".

 In addition, the IP address referred to in the present invention includes, in addition to the currently used IP version 4 (IP v 4), a purge yon 6 ( Revised versions, such as IPv6), shall be included.

Also, the IP address in the present invention, such as a network in a company, the TCPZI P in a closed network such as an intranet that is not connected to the inter-network Bok - ^c "co one '-, and the like Buraibeto-Adoresu the flop ¾ You can also.

 λ: Internet providers used by a large number of individual users have a large number of IΡ addresses for access provided in a large number of regions because they are used from a large number of countries throughout the country.

 For this reason, most Internet users who use Internet Service Providers (IS よ り) from their dial-up addresses have access to their individual I I addresses.

¾ な. Ivy is often assigned. This is because the host of the access point allocates a large number of I addresses so that many users can access the same access point.

Next, the system of the present invention preliminarily stores a plurality of I I addresses by country, region, and group. It has an IP address classification database that is classified according to at least one of the IP address classifications of the weaving type, line type, source type, and arbitrary classification type.

 Fig. 2 shows an example of the data format for storing the IP address held by each access point of each provider, obtained by the 〖address acquisition means. Provider ID, area code ID , Prefectural name ID, minimum value (MIN IP) and maximum value (MAX IP) indicating the range of IP addresses held by the access point are assumed to be stored.

 Also, when classifying IP addresses by region, when classifying by area unit of telephone number, the above-mentioned IP address database and the area code of the telephone line of the access point that acquired the IP address Thus, classification can be performed and data can be stored.

 In addition, it is possible to classify by region from the domain name and the host name included in the domain name and store it.

The domain name has a hierarchical structure of host name, organization or company name, organization attribute, and country name. For example, in the case of “WWW.XX.CO.jp”, www is the host name, XXX is the company name, It can be determined that CO is an organization attribute and jp is a country _nameu

 Similarly, in the case of the domain name of the access point of the provider, for example, "" tko1.aaa.ne.jppj, where tko1 is the host name and aaa

"You can determine the name of the organization, ne is the organizational attribute, jp is the country name, and you can build a database from the host name.

 When connecting to the access point and acquiring the IP address data, the data can be stored by classifying it by the area unit of the area code of 'No. -The database can include major and regional classifications such as prefectures, cities, and area codes of telephone numbers, and so on.

As described in the column, in the present invention, an IP address classification database in which a plurality of IP addresses are classified according to IP address classifications by country and region can be provided in advance. Fig. 3 is a data diagram showing an example of a regional address classification database in which data is stored in association with IP addresses, country codes, regional codes, regional keys, etc. A domain name, host name, telephone number, etc. may be set as required.

 Referring to FIG. 3, the IP addresses are classified into the upper three sections and the lower three sections, and are stored in the access points of the Internet 'service provider (ISP), This is the configuration of such an example, because large companies and large organizations sometimes have ID addresses within a continuous range. For example, in the first line of the record shown in FIG. 3, the IP address "25.2.

In the range from 55.25.5.1 to 255.25.5.255.50.10, the country code is "JP" (Japan) and the area code is "TKO". This shows that ^ machi; ^ is Tokyo as an example. Classification of Tokyo 23 wards or each of the 23 wards may be made.

 In addition, in the fourth line of the record in FIG. 3, the IP address “25.25.25.5.20.1” is one IP address without a particularly continuous range, and the country code is “JP”. (Japan), the regional code is “NMD”, and 巿 indicates that the town is Numazu as an example.

 Similarly, in the present invention, an IP address classification data in which a plurality of IP addresses are classified in advance according to the IP address classification such as organization type and organization can be stored.

 FIG. 4 is a data schematic diagram showing an example of IP address classification data in which data is stored in association with an IP address, a country code, a region code, a town name, and other arbitrary data.

In addition, data determined in such a manner was associated with the area determined in this way, such as an IP address, an organization type code, a network, an organization name, and any other classification type.ί An example of an address classification database FIG. 4 is a data structure diagram showing Referring to FIG. 4, the IP addresses are classified into the upper three sections and the lower three sections and stored. For this reason, the configuration of such an example is adopted. For example, the fourth 003/001665

In the first line of the record in the figure, the range from the IP address “255.255.255., 1” to “255.255.255.100” is the organization code “CO” and ti, for example (ΐ'Profit An organization code can be added to indicate a corporation, etc., and an example is shown in which an organization code and a corresponding company name are stored. You can set up for-profit corporations, schools, Internet service providers, and individuals, and you can also set up corporations, limited liability companies, corporations, and other settings.

 Similarly, in the present invention, an I-address classification data base in which a plurality of I-addresses are classified according to the I-address classification such as line type and source type can be provided in advance.

 Fig. 5 is a data schematic showing an example of an I-address classification database in which data is stored in association with I-addresses, line type codes, broadband / narrowband, and any other classification type. FIG.

 Here, referring to FIG. 5, the reason that the I @ addresses are classified into the upper three sections and the lower three sections and stored is that the ID addresses in a continuous range are similarly held. For this reason, the configuration of such an example is adopted. For example, in the record in Fig. 5, line types such as "CATV", "I SDN", "A DSL", "PHS", "mobile phone", and "regular line" are corresponding to IP addresses. For example, a line type code that indicates the type of code is stored.

 Also, as the source type, type such as user-owned server, Internet service provider, cable TV company, communication company, etc.

: You can also store and manage the classification of each specific company (such as telecommunications companies and Internet 'sir' gateways). Kimei's system uses an access control setting data that sets in advance the access collection to be performed according to the source IP address classification for each data providing system, and the IP address classification to control the control port. One

The access control setting database includes data provider information storage means for storing information on the data provider, and a data provider including an access request relay destination. And a data provider system storage means for storing information on the service system.

 FIG. 6 is a schematic data diagram showing an example of a data provider information storage means for storing information about a provider. Data about data providers such as websites are stored.

 FIG. 7 is a schematic data diagram showing an example of a data provider system storage means for storing information on a data providing system including an access request relay destination. Both the IP address classification database and the access control classification database can be configured in various forms. For example, the data provider information storage means and the data provider system storage means may be separate databases, or may be one integrated database. If these functions are provided, for example, the IP address classification database and the access control classification database include various tables and the like, and may be a single relational database as a whole.

 FIG. 8 is a data schematic diagram showing another example of an access control-classification database in which a data provider has set access permission.

 FIG. 7 shows an example of the data provider system storage means for storing information on the data providing system including the access request relay destination in the access control setting database, an example of which is shown in FIG.

The first provider (ID: 0 0 0 1 0 0 1) provides data to the user on the web tp: //www.******co.jp, which is the access request relay destination. According to the example shown in the first line of the z-code, the access control set by the provider (ID: 0 0 0 0 0 0 1) is a condition that permits the user's access to be relayed according to the present invention. If the access relay is not permitted, the access from the through user will be restricted to another web page, the access non-use Gita provision system ( http: //www.co.jp/1 ogon.htm) It is set to relay to, for example, a web page for user registration and billing, and when necessary processing is performed. Is requesting access to the user 'Access to the web site (http: 〃www. *****. Co.jp) of the connection destination may be permitted, or a warning message, error message, etc. will be displayed without permitting a single blade. J: No,

 In addition, any other various IP address classifications can be set, and various types or combinations of multiple types can be used as various access control systems according to the data provider. This makes it possible to meet the needs of those who do not want to see the content data, do not want to show it, or do not want to download it.

 For example, movies specifically for broadband distribution. In the content business that requires copyright management such as animation, it can meet the needs that it is not necessary for users outside the licensing area, such as regions and organizations, to access. Also, by using the IP address range held by the Internet service provider (ISP) as a classification, it is possible to make settings such as not allowing access to users using the Internet service provider 1A. In the business of content and data holders / providers, new business opportunities can be created, such as selecting the Internet, service, and / or provider, and managing the license for each Internet, service, and provider.

 Alternatively, corporate websites can meet the needs of information blocking and information manipulation, for example, by performing access control on access from the classification of IP address ranges used by competitors.

 Furthermore, in the corporate network, if the IP address range of each department or branch is used as a classification, it is possible to effectively transmit internal messages, etc., and the equipment, cost, and overall Network traffic can be reduced.

Advertisement content providers are also used by elementary and junior high schools.

1> Using the index range as a classification can control minors' access to inappropriate content.

For example, the data provision system for inaccessible users stored and stored in the access control setting database, such as the country- This is a web page that is provided in advance according to at least one of the IP address classifications of the following: • Castle type • Organization type • Line type. Another example: The system for providing data for non-accessible users, stored in the access control port connection setting database, such as-/ pages, is, for example, country-specific, region-specific, organization-type, line This is a web page that is provided in advance in accordance with the IP address classification of at least one of the following: type, source type, and arbitrary classification.

 When the user is not allowed to relay the access, in which case the access from the applicable user is transferred to another page, the inaccessible user-only data provision system. For example, the following various web pages can be set as examples.

 For example, a data providing system for inaccessible users stored in the access control setting database as another web page, etc. is, for example, country, region, organization type, line type, source Type · This page is provided in advance according to at least one of the IP address classifications in the arbitrary classification type and accepts a sample data distribution request for content data.

 In addition, the data provision system for inaccessible users stored in the access control setting database as another web page etc. is, for example, country, region, organization type, line type, source type, arbitrary classification. This is a web page that is provided in advance according to at least one of the IP address classifications of the type and receives a content data copyright permission request.

 In addition, the data providing system for the inaccessible user, which is another web page, may be another page in the server device of the data providing system provided by the data provider, or may be another server device. A web page for non-accessible users to display warning messages, error messages, etc. may be provided in the system.

ft. Referring to FIG. 7, according to the example shown in the third row of the record in FIG. 7, the condition for permitting the system of the present invention to relay the user's access is as follows. (Country code = jp) and the organization code "Co" is set in advance. If access relay is not permitted, access from the relevant user is not relayed to another web page, etc., and access relay is set to be denied.

 As shown in Fig. 2, data that sets the request for each access control for each data provider or data providing system is stored in the access control setting database. In addition, when the same data provider has set up various data providing systems such as websites, it is necessary to set the request of each access control for each or each data providing system. Can be done.

 The storage location of the files in the data providing system may be located on servers such as individual companies or organizations that provide the data, regardless of the location on the network. The data providing system accessed by the user may be a server owned by a data provider such as a company or an organization or a rental server.

 Alternatively, even if these are stored and stored in the same system as the IP address acquisition means, the IP address classification database, the access control port setting database, or the like or a server connected thereto, Good.

 Next, the system according to the present invention comprises: a transmission source obtained by the user address obtaining means.

</) The IP address class, etc., is provided with access permission / non-permission judging means for judging the IP address class by referring to the IP address class database, and judging the access control method corresponding to the IP address class.

 That is, when a user sends an access request to a specific data providing system, an access request including an HTTP request message with an IP address allocated to the user is transferred to the access control system of the present invention. And is received by the access request receiving means.

 That is, when the IP address and the ground identification are stored in association with each other in the above-mentioned IP address classification database, the ground: 1 or another is determined by referring to the IP address database. Can be determined.

In the above-mentioned I-address classification database, I-address and organization type When is stored in association with, the organization type and the like can be determined by referring to the IP address database.

 In the case where the IP address and the line type are stored in association with each other in the IP address classification database, the type of the thread spring can be determined by referring to the IP address database.

 The access permission / non-permission determining means receives the current IP address used by the user for connection, and refers to whether or not the P address is in the IP address classification database., The access control setting means is referred to, the data providing system to which the user has made an access request is determined, and the access relay condition is referred to.

 In this way, it is determined whether or not the user's IP address is permitted to relay access according to the access relay conditions.

 If the result of the determination indicates that the access relay is permitted, the access request relay means for performing the access relay transmits the user's access request to the data providing system. For example, if the data provider system is a system that distributes audio data, video data, image data, and other content data, the access request relay means may relay the access request by the access permission determination means. If determined, relay the content data distribution request according to the access request.

- How, the result of the determination by the accessibility determination unit, when the access relay is not permitted, in accordance with the access control method is stored in advance in the access control configuration database in accordance with IP address classification, _u performing access control Lumpur

 For this reason, the system of the present invention includes an access control means for executing the access control method determined by the access permission / non-permission determining means in response to an access request of the user.

丫 The access control means is not stored in the access control setting database when it is determined that the access request is not relayed by the access permission determination means! ^. Relays the access request to the data provision system for inaccessible users. Alternatively, the access control means transmits a response rejecting the access request to the user if the access permission / non-permission determining means determines not to relay the access request.

 Next, another application form of the access control system of the present invention will be described.

 As described above, the IΡ address of the source user is described in the IΡ header added to the access request data to the data providing system transmitted from the user terminal, and is received by the system of the present invention. User I Ρ Address acquisition means received. The user's access record can be recorded in the server's log file as soon as the server file is accessed. As a program for acquiring the user's IP address from the log file, a program in a language such as CGI, SSI, or JAVA is generally used.

 Therefore, the access control system of the present invention can be provided with a program for totalizing access and recording access statistics based on a log file including the IP address of the user. A preferable example of the data items for which access aggregation is performed is a classification based on the IP address classification such as a region, an organization type, and a line type determined based on a user's IP address and IP address, an access date and time, and an access request destination. It is a data item such as a data providing system.

 Preferably, if there is an IP address that has not been stored in the IP address classification database, it is preferable to separately accumulate this data and aggregate it, which can be used for data maintenance and management of the IP address classification database. .

 There is a tallying means for performing a process of tallying undetermined IP address statistics for which 1 P-address classification could not be determined.

 All IP addresses and their corresponding host name regions are determined and

--Because it is not always stored at a certain pace, it is necessary to summarize the undetermined list and to use it to enrich the data when updating or adding a base. it can,, '

If the access permission / non-permission determining unit determines that the access request is not to be relayed, a totaling unit that totals the access denial statistics is provided. A PC orchid 003/001665

If the access permission / rejection determination unit has made an access that did not permit the relay of the access request, it is preferable to separately accumulate and aggregate this data, which can be used to report the aggregation result to the data provider. .

 Next, if the determined IP address classification is, for example, a regional classification, for example: ΦKyoto counts by adding 1 to Tokyo, and Kanagawa counts by adding 1 to Kanagawa. To remove. If this is the first regional classification, add that region to the counted item and count 1.

 In addition, for example, in the case of an organization type classification, for example, in the case of a corporation, 1 is added to the corporation and counting is performed, and in the case of the ISP, 1 is added to the ISP and counted. If this is the first organization type classification, add that organization type list to the counted item.

Count one.

 For example, if it is a line type classification, for example, if it is a normal line,

Brass 1 and count. If it is AD S L, add 1 to AD S L and count. If this is the first line type classification, the line type is added to the count item to be counted and 1 is counted.

 As a method of analyzing access and storing it as data, a method using a CGI program is generally used.

 Next, another application form of the access control system of the present invention will be described.

The files provided by the data provider system are audio data, moving image data, image data, and other content data, and the data distribution system for distributing the content is connected to a network. It is a form in which a plurality are provided. For example, in the case where a movie company provides a moving image distribution website as a data providing system, servers that store the moving images to be distributed are set up throughout the country. Or, in the case where the software creator provides the software download jfj r ^ website, servers that store the software to be downloaded are set up all over the world. In this case, the server accessed by the user for down-loading can be downloaded from a server in the area near the user's area. Is generally preferred. In addition, it is generally preferable that the server accessed by the user for download or the like be a server that can be downloaded from a server suitable for the type of line of the user. In addition, the server accessed by the user for downloading, etc. may be a server for a contract corporation or a down server for companies that have contracts with software companies or data distribution companies, etc., according to the user's thread type. There may be cases where it is preferable to be able to do so.

 Therefore, if the access control means determines that the access request is to be relayed by the access permission / non-permission determining means, the IP address classification is determined based on the source IP address obtained by the user address obtaining means. Classification

—In addition to making a decision with reference to a database, determine whether content data is to be distributed from a plurality of data provider systems, and, according to an access request, a number of data provision systems (servers, etc.) The content data distribution request is relayed to the preferred data providing system determined based on the IP address classification. Hereinafter, a basic processing flow of the present invention will be described.

 9 to 11 are flowcharts showing an example of the basic processing flow of the present invention. Note that the processing flow shown here is an example, and the present invention is not limited to this.

 In Fig. 12, a preferred example of a system use mode and a typical example using the access control system of the present invention are respectively shown by system conceptual diagrams.

 Communication is established by accessing the Internet or the like from a user terminal (S100) and connecting to an access point of the Internet-Service Provider (ISP) (S101). Then, an access request to a data providing system (such as a web server) is transmitted (S102). The access request is transmitted to the access control system by transfer or the like (S103). At this time, the originating user →) IP address is described in the access request data to the data providing system transmitted from the user terminal (the IP header added thereto).

The access control system receives a request for access to the data providing system from the user terminal (S104), and the access request receiving means receives the access request. The request data is received (S105).

 The data containing the IP address included in the access request is extracted by the user IP address acquisition f. Stage (S106), and based on this, the access permission / inhibition judging means executes the access control setting data base. Then, a data providing system included in the access request is extracted by referring to the access request (S107). URL, such as the web server of the data providing system that the user is trying to access.

 The access permission / non-permission determining means determines the access relay condition of the corresponding data providing system (S108).

 Next, the access availability determination means refers to the IP address classification database and extracts the classification of the IP address (S109). The IP address classification is classified by region, organization type I, line type, or other arbitrarily set classification, or a combination thereof.

 The access permission / non-permission judging means judges whether or not the access relay condition meets a preset access relay condition (S110). If it is judged that the access is possible, the access request relay means sends the data to the corresponding data providing system. The access request is relayed (S111). In the data providing system, the relayed access request from the user terminal is received (S112). As a result, in response to an access request from the user terminal, the data providing system transmits content data and the like to the user terminal (SI 13), and the subsequent data communication processing between the user terminal and the data providing system is performed. (S114).

 In S110, the access permission / non-permission determining means determines whether or not the access relay conditions set in advance are met. If it is determined that the access is permitted, the access control means switches the access control port to the access control port. The access control method is determined with reference to the rule setting database (S150).

The system determines whether or not the inaccessible user, such as a web page for a user who has been denied access, has a certain power (S151). The data providing system for the inaccessible user to be accessed is determined (S 15 2), and the access control means relays the access request to the corresponding data providing system for the inaccessible user (S 15 3). Inaccessible user Data access system receives an access request from a user terminal (s

1 5 4) ₀ Responds to an access request from one user terminal and sends

The content data and the like are transmitted from the ift-sh-chim to one user terminal (S155), and data communication processing between the user terminal and the data providing system is performed (s155). The content data sent to the user terminal from the non-accessible user data providing system and displayed on the user terminal is, for example, a screen that displays a message that access is not permitted, or prompts for membership registration, payment of fees, or copyright licensing. A screen is one example.

 In S151, it is determined whether there is a data providing system for an inaccessible user such as a web page for a user who has been denied access (S151), and if it is not set in advance, The access control means determines that the access request cannot be relayed (S200), and responds to the access request from the user terminal, and transmits data indicating that the access relay cannot be performed from the access control system to the user terminal (S200). 2 0 1). The user terminal receives and displays the data indicating that access relay is disabled (S202). Industrial applicability

 As described above, according to the present invention, a plurality of IP addresses are classified in advance into at least one of a plurality of IP addresses by country-by district, organization type, line type, source type, and arbitrary classification type. Using the IP address classification database classified according to the above, an access control system using the IP address classification that performs access control according to the method set in advance by the data provider according to the IP address classification can be provided.

This eliminates the need to collect and store and manage the data of individual users as in the past, in the technical field of access control. Also, it is possible to follow the control method requested by the data provider such as a plurality of various websites, data sources, etc., and to use the access control port. Also, it is not necessary to memorize and manage unauthorized users as unauthorized users only after the appearance of unauthorized users. In addition, the huge amount of data that can be used for access nets for each Internet, service, provider, nationwide, and access points in various parts of the world, companies and other organizations that have their own IP addresses allocated, When the IP address of the Internet is increased or changed, access control can be performed by collecting such data and providing a pre-classified database.

 According to the present invention, for example, a music content, a moving image content, a program usable on the Internet, and a content contract related to a copyright licensing, etc. Depending on the access control method requested by the data provider, depending on the region, such as the country of the user accessing the data, or the organization, the access control may be performed. Will be possible.

 As a result, if the server administrator has been granted the right to distribute only in Japan, access from outside Japan will be permitted for the distribution of moving image data such as movies and the distribution of audio data such as music. And prevent unauthorized access and prevent the server administrator from being held accountable, along with the unauthorized user.

 In addition, if the right of distribution is granted only to the company to which the administrator has subscribed, access from non-contracted companies is permitted for data distribution such as paid databases and paid news distribution. This prevents the server administrator from being held liable, as well as the user making the unauthorized access.

 Further, according to the present invention, it is possible to obtain access statistics for each region for each user such as country, region, group, type, line type, source type, arbitrary classification type, etc. Even if access is permitted based on this, it is possible to provide a system that can relay access to the optimal access destination.

Claims

The scope of the claims 1. In order to relay the data providing system provided by the data provider and the user terminal accessing the data providing system, the system is connected to the network and provided with 3 o When a user terminal receives an access request to the data providing system,  1 P 7 'User IP address acquisition means for automatically acquiring dress, A 1P end-of-dress database that classifies multiple IP addresses in advance according to at least one of the IP address classifications of country, ± area, organization type, line type, source type, and arbitrary classification type. An access control setting database in which access control is performed in advance for each data providing system according to the IP address classification of the transmission source, which access control is to be performed for which IP address classification, and The source IP address strength obtained by the user address acquisition means, the IP address classification is determined by referring to the IP address classification database, and the access control method corresponding to the IP address classification is determined. Access permission / non-permission determining means for determining An access control means for executing the access control method determined by the access permission / inhibition determination means in response to an access request from the user; An access control system using IP address classification, wherein access control is performed according to a method set in advance by a data provider according to the P address classification.  2. In the invention described in claim 1, The system comprises: an access request receiving unit for receiving an access request to the data providing system; and an access request relay unit. \> Access control system using dress division.  3. In the invention described in claims 1 or 2, The actor control setting database includes a data provider information storage means for storing information about the data provider, and a data provider including an access request relay destination. An access control system using IP address classification, characterized by comprising a data provider system storage means for storing information about the system.  4. In the invention according to any one of claims 1 to 3, The access control means transmits a response rejecting the access request to the user terminal when the access permission / non-permission determining means determines that the access request is not relayed. An access control system using the Internet.  5. In the invention according to any one of claims 1 to 3, The access control means provides data for an inaccessible user stored in the access control setting database when the access permission determination means determines that the access request is not relayed. An access control / relay system using IP address classification, which relays access requests to the system.  6. In the invention described in claim 5, The above-mentioned data providing system for inaccessible users is provided in advance according to at least one of IP addresses classified by country, region, organization type, line type, transmission source type, and arbitrary classification type. An access control system using IP address classification.  7. In the invention according to any one of claims 1 to 6, The files transmitted by the data provider system are audio data, moving image data, image data, and other content data, and the access request relaying means relays the access request by the access permission / evaluation means. An information transmission system using an IP address acquisition / classification system, characterized in that when it is determined that the request is made, the content data distribution request is relayed in accordance with the access request.  8. The invention described in Claim 7 F i, User data submission system is based on I-address classification of at least one of country, region, organization type, wire type. 、 利用 ί ア ク セ ス ア ク セ ス ア ク セ ス ア ク セ ス コ コ コ コ コ コ ア ク セ ス ア ク セ ス ア ク セ ス ア ク セ ス ア ク セ ス ア ク セ ス ア ク セ ス ア ク セ ス コ ア ク セ ス ア ク セ ス ア ク セ ス ア ク セ ス ア ク セ ス Access code using ア ク セ ス Noguchi  9. In the invention described in either claim 7 or claim 8, Previous ^ .Har 1: The user-provided data provision system is based on IP address classification of at least one of country, region, organization type, line type, source type, and arbitrary classification type. According to the present invention, there is provided an access control system in which an IP address classification is performed by using a web page that receives a request for distributing sample data of content data, which is provided in advance.  10. In the invention according to any one of claims 7 to 9, The above-mentioned data providing system for inaccessible users is provided in advance according to at least one of the IP address classifications of country, region, organization, line, transmission source, and arbitrary classification. An access control system using IP address classification, characterized in that it is a web page that accepts a copyright permission request for content data. '  11. In the invention according to any one of claims 1 to 10, The files transmitted by the data provider system are audio data, video data, image data, and other content data, and the data distribution system for distributing the content is connected to a network. Are provided, When the access control means determines that the access request is to be relayed by the access permission determining means, the IP address classification is performed based on the source IP address obtained by the user address obtaining means. In addition to making a determination with reference to the database, it also determines which of the multiple data provider systems to distribute the content data to, and provides a data provision system that is determined based on the IP address classification according to the access request. In contrast, an access controller using IP address classification, which is characterized by relaying a content distribution request,  1 2 '. Claims IS "! In the invention described in any one of  (1) The process of summarizing the undecided I address statistics that could not be judged for 1 address address (ί ί ■ ') Accumulation using the I address classification, characterized by the provision of the aggregation means -His control system. 13. In the invention according to any one of claims 1 to 12, An access control system using an IP address classification, characterized in that the access permission / rejection determining means determines that the access request is not to be relayed. .