JP4814131B2 - Mediation system, program, and storage medium - Google Patents

Description

  The present invention relates to a session management apparatus that manages session information.

  Conventionally, integrated management using a domain (domain controller) has been proposed as authentication / account management. The user has a unique account on the domain and can access the WEB site under the domain. An account on a domain is not valid in another domain.

If you already have multiple existing WEB site provisioning servers, each of which owns an identity system, or if you have users who use multiple accounts, integrating all of these into one domain It was difficult.
Therefore, there is a method of performing authentication by identity cooperation between WEB site providing servers instead of the integrated management by domain.

In addition, in order to link different WEB site providing servers, there is an information processing system that uses service session information and places a service cooperation server to generate a task session indicating the cooperation between the WEB site providing servers (for example, [[ (See Patent Document 1].)
In addition, in order to enable a service across different WEB site providing servers, a method for managing a series of operations in a task session with a portal site and managing each WEB site providing server as a thread session. (For example, refer to [Patent Document 2].)
In addition, there is a system that guarantees that the user is an authorized user to the related WEB site by one-time user authentication at the main WEB site and prevents direct access to the sub WEB site without going through the main WEB site. (For example, see [Patent Document 3].)

JP 2006-195791 A JP 2004-178466 A JP 2002-014927 A

  However, when user information is included in the linkage information when accessing the related WEB site, the method of taking over the linkage information on the network is dangerous such as leakage of user information or unauthorized access using the leaked information. There is a problem with safety.

  In addition, WEB site providing servers that are already operated with different identity systems may become one group due to a corporate merger or the like. It is possible to perform authentication linkage by identity linkage between WEB sites. For example, you can log out from the services of all the WEB site providing servers you use, or all WEB where the same user is logged in with different accounts There is a problem that it is difficult to perform integrated management such as logging out from the site providing server or linking sessions.

  Moreover, the system shown in Patent Document 1 uses service session information as information for associating cooperation between WEB site providing servers instead of user information that may leak personal information. However, the system according to Patent Document 1 generates a task session indicating cooperation of service session information by placing a service cooperation server separately. Therefore, the system according to Patent Document 1 has a problem that the introduction of a task session indicating cooperation complicates the system configuration and increases the processing load of the entire system.

  The method shown in Patent Document 2 is for a portal site to manage a predetermined set of web services including processing procedures, and it is not assumed that a user arbitrarily accesses a related WEB site. There is a problem.

  In the conventional example and the system shown in the above patent document, there is a problem that when the same user logs in to the same WEB site using a plurality of different accounts, the WEB site management side recognizes it as a different user. . Therefore, management with a sense of unity is difficult even though the same user is accessing.

  Conventionally, in the case of a customer direct system in which a user directly logs into a predetermined WEB server and operates resources (accounts and the like), one account corresponds to one user ID. That is, in the customer direct system, the relationship of user ID: account: session is 1: 1: 1.

  However, there is a case where it is desired to construct an intermediary system (agent system) that operates an account of another user by placing an agent (agent server) where a customer direct system already exists. In the agency system, the relationship of user ID (agent ID): account: session is 1: N: N. Therefore, the existing system must be significantly modified or a new system must be constructed. Therefore, there is a problem that the existing customer direct system cannot be effectively used and the cost of system construction is large.

In addition, when mediation processing for a plurality of users is performed at the same time, there is a user who logs out due to the expiration of the session if the time during which the operation is not performed becomes long.
On the other hand, if processing related to all users is taken as one session, there is a problem that independent operation cannot be performed for each user.

  The present invention has been made in view of the above problems, and an object thereof is to provide a mediation system that can be constructed by effectively utilizing an existing system.

In order to achieve the above-described object, according to a first invention, an information processing server and a first terminal device belonging to an intermediary that mediates a plurality of users are connected via a network, and the first terminal device of the mediator is the plural The intermediary system for acquiring a WEB page from the information processing server by intermediating the user of the user when the intermediary accesses the information processing server from the first terminal device. Session ID creation means for creating a session ID and a second session ID that is unique for each user, and the first session ID and the second session ID to the first terminal device of the mediator who is the access source As session management information, a session ID transmission means to be sent, one first session ID and at least one second session ID are associated with each other. The session registration means for recording, the first session ID and the second session ID sent from the first terminal device of the mediator, and the registered first session ID and second session ID are collated And an information providing means for creating the WEB page for each user and providing it to the first terminal device of the mediator based on the collation result by the session collating means . 1 session ID is recorded on the cookie information of the browser which displays the said WEB page, and said 2nd session ID is recorded on the parameter of URL, The mediation system characterized by the above-mentioned .

The first session ID is an identification ID created for each mediator. The first session ID is created when the mediator accesses the information processing server from the first terminal device. The second session ID is an identification ID created for each user. The second session ID is created when an intermediary accesses the information processing server by mediating / proxying the user from the first terminal device, or when the user accesses the information processing server directly from the second terminal device.
The first terminal device is a terminal device belonging to an intermediary (broker). The intermediary accepts requests for mediation processing and proxy processing from a plurality of users to the information processing server.

  In the mediation system of the first invention, when the mediator accesses the information processing server from the first terminal device, the mediation system assigns a unique first session ID for each mediator and a unique second session ID for each mediator. create. The mediation system sends the first session ID and the second session ID to the first terminal device as the access source, and registers the first session ID and the second session ID in association with each other as session management information. The intermediary system collates the first session ID and second session ID sent from the first terminal device with the registered first session ID and second session ID, and creates various information for each user who mediates. Provided to the first terminal device.

  In the first invention, the second terminal device (user's terminal device) is utilized by utilizing a system that uses session information (second session ID) when directly accessing the information processing server from the second terminal device (user's terminal device). ) Can access the information processing server under the mediation of the first terminal device (intermediary terminal device). That is, by creating a unique first session ID for an intermediary and creating a unique second session ID for each user, mediation via an intermediary based on an existing system that uses session information as linkage information A system can be easily constructed.

The session ID creating means creates a unique second session ID for each user when the user accesses the information processing server from the second terminal device, and the session ID transmitting means assigns the second session ID to the access source The session registration means registers the second session ID as session management information, and the session verification means sends the second session ID registered with the second session ID sent from the user's second terminal apparatus. The information providing unit may collate with the session ID, and the information providing unit may create various types of information for each user based on the collation result by the session collating unit and provide the information to the second terminal device of the user.
The user can directly access the information processing server from the second terminal device and use the second session ID as session management information.

Further, the mediation system may determine which access is made by the mediator's first terminal device or the user's second terminal device based on the type of service account provided by the information processing server.
Based on the account type (brokerage or user), the access source terminal device to which the account belongs (broker's first terminal device or user's second terminal device) can be determined. If the access source is an intermediary, the intermediary system further requests information related to the user that the intermediary mediates or represents, and manages the mediator and the user in association with the first session ID and the second session ID, respectively. I do. If the access source is a user, the mediation system performs session management by associating the user with the second session ID.

In addition, when an operation is performed on any of the sessions indicated by the plurality of second session IDs corresponding to the first session ID, the mediation system sets the expiration dates of the plurality of second session IDs corresponding to the first session ID. All may be updated.
That is, when an operation related to any one of the users intermediated by the mediator is performed, the expiration date of the second session ID corresponding to all the users can be updated and the session can be continued.

The second invention is a program for causing a computer to function as the mediation system of the first invention.
A third invention is a computer-readable recording medium recording a program that causes a computer to function as the mediation system of the first invention.

  According to the present invention, it is possible to provide a mediation system that can be constructed by effectively utilizing an existing system.

  Hereinafter, preferred embodiments of an intermediary system according to the present invention will be described in detail with reference to the accompanying drawings. In the following description and the accompanying drawings, the same reference numerals are given to components having substantially the same functional configuration, and redundant description will be omitted.

(1. Configuration of mediation system 1)
First, the configuration of the mediation system 1 will be described with reference to FIG.
FIG. 1 is a configuration diagram of the mediation system 1.

  In the brokerage system 1, the terminal device 11 of the broker 13 as the first terminal device and the terminal devices 15-1, 15-2,... As the second terminal device and the information processing server 5 are connected via the network 3. Configured. Furthermore, the some terminal device 15, the terminal device 11, and the information processing server 5 may be connected.

  The terminal devices 15-1, 15-2,... Belong to the users 17-1, 17-2,. The information processing server 5 belongs to the information processing company 9. The information processor 9 provides information after receiving a request from the user 17 and executing predetermined information processing. The information processing company 9 is, for example, a financial institution such as a securities company or a bank that handles financial products. The terminal device 11 belongs to the broker 13.

  Each of the terminal devices 15-1, 15-2,... Can directly access the information processing server 5. Further, the terminal devices 15-1, 15-2,... Can request the broker 13 to mediate access to the information processing server 5. In addition, each of the users 17-1, 17-2,... May request the broker 13 to mediate to the information processor 9 using a document, a telephone, or the like.

  The session management server 7 belongs to the information processing company 9 together with the information processing server 5 and manages session information which is information related to access to the information processing server 5.

Next, the configuration of the mediation system 1 will be described in more detail with reference to FIG.
FIG. 2 is a diagram showing the configuration of the mediation system 1 in detail.

(1-1. Configuration of the terminal device 11 (broker 13))
The terminal device 11 as the first terminal device is a device such as a computer that can be connected to the terminal device 15 of the user 17 and the information processing server 5 of the information processing company 9 via the network 3.

The terminal device 11 includes a WEB page request unit 43 and a WEB page display unit 45. The WEB page request unit 43 is a unit that requests the information processing company 9 (information processing server 5) that provides the WEB page to provide the WEB page. The WEB page display unit 45 is a unit that displays a WEB page 73 provided from the information processing server 5.
The terminal device 11 receives and stores session information 47 (FIG. 5) related to the session provided with the WEB page 73. Details of the session information 47 will be described later.

(1-2. Configuration of Terminal Device 15 (User 17))
The terminal device 15 as the second terminal device is a device such as a computer that can be connected to the terminal device 11 of the broker 13 and the information processing server 5 of the information processor 9 via the network 3.

The terminal device 15 includes a WEB page request unit 49 and a WEB page display unit 51. The WEB page request unit 49 is a unit that requests the information processing company 9 (information processing server 5) that provides the WEB page to provide the WEB page. The WEB page display means 51 is a means for displaying the WEB page 63 provided from the information processing server 5.
The terminal device 15 receives and stores session information 53 (FIG. 6) related to the session provided together with the WEB page 63. Details of the session information 53 will be described later.

(1-3. Configuration of Information Processing Server 5 (Information Processing Company 9))
The information processing server 5 is a device such as a computer having the user authentication means 21, the WEB page creation means 27, and the user information 23, the content information 25, etc. in the storage unit.

The user authentication means 21 collates authentication information (user ID, password, etc.) sent from the terminal device 15 or the terminal device 11 with the user information 23 (FIG. 7), and the terminal device 15 or the terminal device 11 is a valid user. It authenticates whether it is.
The WEB page creation means 27 takes out the corresponding content from the content information 25 and creates a WEB page 73 or a WEB page 63. The content information 25 is content such as characters, numerical values, video, images, and audio.

(1-4. Configuration of session management server 7 (information processing company 9))
The session management server 7 includes a session acquisition unit 29, a session verification unit 31, a first session ID creation unit 33, a second session ID creation unit 35, a session registration unit 37, a batch processing unit 41, and session management information 39 in the storage unit. An apparatus such as a computer having

  The session management server 7 registers and manages session information related to the connection of the terminal device 11 (broker 13) and the terminal device 15 (user 17) in the session management information 39 (FIG. 4). The session management server 7 acquires the second session ID 62 sent from the terminal device 15, and transmits the second session ID 62 with the expiration date and the like updated again together with the WEB page 63 to the terminal device 15. In addition, the session management server 7 acquires the first session ID 71 and the second session ID 72 sent from the terminal device 11, and the first session ID 71 and the second session ID 72 are updated in the terminal device 11 together with the WEB page 73. Send.

The session acquisition unit 29 acquires information (a second session ID 62, a first session ID 71, and a second session ID 72) related to a session sent from the terminal device 15 and the terminal device 11 together with the WEB page request.
The session collation unit 31 collates the information related to the session acquired by the session acquisition unit 29 with the registration information of the session management information 39 (FIG. 4).

The first session ID creation means 33 creates a first session ID 71 that is unique identification information for each broker 13.
The second session ID creation means 35 creates a second session ID 62 or a second session ID 72 that is unique identification information for each user 17.
The session registration unit 37 registers information related to the created session (first session ID 71, second session ID 72, and second session ID 62) in the session management information 39.
The batch processing unit 41 performs batch processing for all user accounts indicated by the second session ID 72 corresponding to the same first session ID 71.
Details of the session management information 39 will be described later.

(2. Hardware configuration)
Next, the hardware configuration of the terminal device 15, the terminal device 11, the information processing server 5, and the session management server 7 will be described with reference to FIG.
FIG. 3 is a hardware configuration diagram of the terminal device 15, the terminal device 11, the information processing server 5, and the session management server 7. Note that the hardware configuration shown in FIG. 3 is merely an example, and various configurations can be adopted depending on the application and purpose.

  The terminal device 15, the terminal device 11, the information processing server 5, and the session management server 7 include a CPU 151, a memory 153, a storage unit 155, a display unit 157, an input unit 159, an output unit 161, and a communication unit 163 via the system bus 165. Connected and configured.

  A CPU 151 (Central Processing Unit) is an arithmetic device (four arithmetic operations, comparison operations, etc.), and a device that performs hardware and software operation control.

  The memory 153 is a memory such as a RAM and a ROM. A RAM (Random Access Memory) stores a ROM (Read Only Memory), an OS (Operating System) program read from the storage unit 155, an application program, and the like. The RAM functions as a main memory and work area for the CPU 151.

  The storage unit 155 is a device that stores various data, and is, for example, a hard disk. The storage unit 155 stores programs executed by the CPU 151, data necessary for program execution, an OS, various databases, and the like.

  The display unit 157 is a display device, such as a CRT monitor or a liquid crystal panel. The display unit 157 includes a logic circuit (such as a video adapter) for realizing the video function of the computer.

  The input unit 159 is an input device for various data, such as a keyboard and a mouse. The output unit 161 is an output device for various data, for example, a printer. Drive devices that perform data input / output with various media can also be used as the input unit 159 and the output unit 161.

The communication unit 163 is a communication control device that connects and communicates with an external device via the network 165. For example, Internet communication using TCP / IP is possible.
The system bus 165 is a path that mediates transmission / reception of control signals, data signals, and the like between the devices.

  The terminal device 15, the terminal device 11, the information processing server 5, and the session management server 7 load programs (application programs, OS programs, etc.) stored in the storage unit 155, ROM, or storage medium into the RAM of the memory 153. Various processes are executed under the control of the CPU 151.

(3. Configuration of Session Management Information 39, Session Information 47, Session Information 53, and User Information 23)
(3-1. Session management information 39)
Next, the session management information 39 held by the session management server 7 will be described with reference to FIG.
FIG. 4 is a diagram illustrating an example of the configuration of the session management information 39.
The session management information 39 is information related to a session stored in the storage unit 155 of the session management server 7 of the information processing company 9.

  The session management information 39 includes a first session table 81, a second session table 85, and a correspondence table 83.

  The first session table 81 is a table related to the first session ID 71. The first session table 81 includes items such as a first session ID 87, an expiration date 91, and an intermediary account 93. In the item of the first session ID 87, the first session ID 71 created by the session management server 7 when the broker 13 logs in to the information processing company 9 (information processing server 5) from the terminal device 11 is stored. Stores the expiration date of the first session ID 71.

In the item of the brokerage account 93, an account (for example, “C1 @ A”) of the terminal device 11 of the brokerage agent 13 logged into the information processing agent 9 is stored.
The expiration date 91 is updated each time the broker 13 accesses the information processor 9 (information processing server 5) from the terminal device 11. When the expiration date 91 elapses, the first session ID 71 is invalidated.
The value of the first session ID 71 is unique for each broker 13.

  The second session table 85 is a table related to the second session ID 62 or the second session ID 72. The second session table 85 includes items such as a second session ID 89, an expiration date 91, and a user account 95. The item of the second session ID 89 includes the second session ID 62 created by the session management server 7 when the user 17 logs in directly to the information processing company 9 (information processing server 5) from the terminal device 15, or the broker 13 The second session ID 72 created when logging in to the information processing company 9 through the user 11 from the device 11 as a proxy is stored, and the expiration date 91 stores the second session ID 62 or the expiration date of the second session ID 72. The

In the item of the user account 95, an account (for example, “user1 @ A”) of the user 17 that is mediated and represented by the terminal device 11 of the broker 13 is stored.
The expiration date 91 is updated every time the information processing server 5 provides a WEB page related to the user account 95. When the expiration date 91 elapses, the second session ID 62 or the second session ID 72 is invalidated.
Further, the value of the second session ID 62 or the second session ID 72 is unique for each user 17.

  The correspondence table 83 is a table that associates the first session ID 87 item of the first session table 81 with the second session ID 89 item of the second session table 85. When the broker 13 mediates a plurality of users 17, a plurality of second session IDs 72 correspond to the same first session ID 71.

  When the user 17 logs in directly to the information processing company 9 (information processing server 5) by the terminal device 15, the first session table 81 and the correspondence table 83 are not used.

(3-2. Session information 47)
Next, the session information 47 held by the terminal device 11 of the broker 13 will be described with reference to FIG.
FIG. 5 is a diagram illustrating an example of the configuration of the session information 47.
The session information 47 is information related to a session stored in the storage unit 155 of the terminal device 11 of the broker 13.

  The session information 47 includes items such as a first session ID 87, a second session ID 89, an expiration date 91, a mediation account 93, and a user account 95.

  When the broker 13 logs in to the information processing server 5 of the information processing company 9 through the user 17, the session management server 7 of the information processing company 9 creates a unique first session ID 71 for the broker 13. Then, a unique second session ID 72 is created for the user 17.

A first session ID 71 (for example, “US01”) is stored in the first session ID 87 item, and a second session ID 72 (for example, “SS11”) is stored in the second session ID 89 item.
In the expiration date 91, the expiration dates of the first session ID 71 and the second session ID 72 are stored.

  In the item of the brokerage account 93, an account (for example, “C1 @ A”) of the brokerage agent 13 logged into the information processing server 5 is stored. In the item of the user account 95, the account of the user 17 (for example, “user1 @ A”) in which the broker 13 mediates access to the information processing server 5 is stored.

  The expiration date 91 is updated every time the broker 13 accesses the information processing server 5 from the terminal device 11. When the expiration date 91 elapses, the first session ID 71 and the second session ID 72 are invalidated.

(3-3. Session information 53)
Next, session information 53 held by the terminal device 15 of the user 17 will be described with reference to FIG.
FIG. 6 is a diagram illustrating an example of the configuration of the session information 53.
The session information 53 is information related to a session stored in the storage unit 155 of the terminal device 15 of the user 17.

  The session information 53 includes items such as a second session ID 89, an expiration date 91, and a user account 95. In the item of the second session ID 89, a second session ID 62 created by the session management server 7 when the user 17 directly accesses the information processing server 5 from the terminal device 15 is stored. The expiration date of is stored.

In the item of the user account 95, an account (for example, “user1 @ A”) when the user 17 logs in to the information processing server 5 from the terminal device 15 is stored.
Note that the session information 53 is not created when the user 17 requests the mediator 13 for mediation / proxy.

(3-4. User information 23)
Next, the user information 23 held by the information processing server 5 will be described with reference to FIG.
FIG. 7 is a diagram illustrating an example of the configuration of the user information 23.
The user information 23 is information about the user stored in the storage unit 155 of the information processing server 5. The users viewed from the information processing server 5 are the broker 13 and the user 17.

The user information 23 includes items such as an account 97, an account type 99, and a password 101.
In the item of account 97, an account when the user (broker 13 or user 17) logs in to the information processing server 5 is stored. In the item of the account type 99, information for identifying the user (the broker 13 or the user 17) is stored. For example, “broker” is stored in the account type 99 if the account is the broker 13, and “user” is stored in the account type 99 if the account is the user 17.
In the item of the password 101, an identification ID for performing user authentication with both the account 97 (user ID) is stored.

(4. Operation of mediation system 1)
Next, the operation of the mediation system 1 will be described with reference to FIGS. In addition, the screen displayed on the display part 157 of the terminal device 11 (broker 13) is demonstrated suitably, referring FIGS. 11-16.
The terminal device 11 (broker 13) receives content from the information processing server 5 based on a brokering process request operation from the terminal device 15 (user 17). The terminal device 11 displays the WEB page provided from the information processing server 5 on the display unit 157.

(4-1. Session management during login)
FIG. 8 shows a session management server when the terminal device 15 (user 17) makes a mediation request to the terminal device 11 (broker 13), and the broker 13 logs in the information processor 9 as a broker for the user 17 7 is a flowchart showing session management of FIG.

Each user 17 requests the broker 13 for mediation processing (step 1001). Each user 17 sends a user account 55 and a password 56 from each terminal device 15 to the terminal device 11 (broker 13).
The mediation processing request method may be a method using a document, a telephone, or the like without using the network 3.

  A login screen 301 (FIG. 11) to the information processing server 5 is displayed on the display unit 157 of the terminal device 11 (broker 13) (step 1002). The login screen 301 is, for example, a screen of a predetermined WEB site provided by a bank or the like. The terminal device 11 (broker 13) makes a login request to the information processing server 5 from the login screen 301.

FIG. 11 is a diagram showing a login screen 301 displayed on the terminal device 11 (broker 13).
When an account (mediation account 57) and password 58 are entered in the login screen 301 and the “login request button” 201 is clicked, a login request is transmitted from the terminal device 11 to the information processing server 5 and the session management server 7.

  The information processing server 5 (information processing company 9) compares the account (mediation account 57) and password 58 sent from the terminal device 11 of the broker 13 with the values registered in the user information 23 (FIG. 7), Authentication that the broker 13 is a valid user is performed (step 1003). Since the account type 99 of the sent account 97 (for example, the brokerage account 57 “C1 @ A”) is “brokerage” as a result of the collation with the user information 23, the information processing server 5 logs in through brokerage brokerage. Process.

  The first session ID creating means 33 of the session management server 7 (information processing company 9) newly creates a first session ID 71, and the session registration means 37 is a first session table 81 of the session management information 39 (FIG. 4). The first session ID 71 is registered in (Step 1004).

  The WEB page creation means 27 of the information processing server 5 (information processing company 9) sends the created WEB page 73 and the first session ID 71 to the terminal device 11 (broker 13). The page (mediation login screen 302) is displayed on the display unit 157 (step 1005).

FIG. 12 is a diagram showing an intermediary login screen 302 provided from the information processing server 5.
On the mediation login screen 302, a login screen of the user 17 for whom the terminal device 11 (mediation agent 13) performs mediation processing is displayed.

  When the user account 55 and the password 56 of each user 17 are input to the mediation login screen 302 and the “login request button” 201 is clicked, a login request (mediation login) is sent from the terminal device 11 to the information processing server 5 and the session management server 7. Request) is sent.

  The information processing server 5 (information processing company 9) compares the user account 55 and password 56 sent from the terminal device 11 of the broker 13 with the values registered in the user information 23 (FIG. 7), and each user 17 Is authenticated as a legitimate user (step 1006). The session verification unit 31 of the session management server 7 (information processing company 9) compares the first session ID 71 received together with the user account 55 and the password 56 with the first session table 81 (FIG. 4) of the session management information 39. , Proceed with login process by intermediary.

  The second session ID creation means 35 of the session management server 7 (information processing company 9) newly creates a second session ID 72 for each user account 55 (for each user 17), and the session registration means 37 has session management information 39. The second session ID 72 is registered in the second session table 85 (FIG. 4) (step 1007). In addition, the session registration unit 37 registers the correspondence between the first session ID 87 of the first session table 81 and the second session ID 89 of the second session table 85 in the correspondence table 83.

The WEB page creation means 27 of the information processing server 5 creates a WEB page 73 (step 1008), and transmits it to the terminal device 11 (broker 13) together with the first session ID 71 and the second session ID 72.
The terminal device 11 (broker 13) displays the WEB page 73 (screen 303) on the display unit 157 (step 1009).

FIG. 13 is a diagram showing a screen 303 of account information provided by the information processing server 5.
On the account information screen 303, screens 304 to 306 of account information corresponding to each user 17 (each terminal device 15) are displayed.

  The terminal device 11 (broker 13) stores the first session ID 71 and the second session ID 72 in the session information 47 (FIG. 5) (step 1010).

  Through the above process, the session management server 7 (information processing company 9) of the mediation system 1 performs mediation login processing if the transmission source of the login request is the terminal device 11 of the mediation company 13. That is, when the broker 13 requested for the brokering process by each user 17 requests the terminal device 11 to log in to the session management server 7, the session management server 7 newly creates and registers the first session ID 71. The broker 13 makes a broker login request for each user 17 from the broker login screen 302 sent from the session management server 7. The session management server 7 newly creates and registers a second session ID 72 for each user 17, and further registers each second session ID 72 in association with the first session ID 71. The information processing server 5 (information processing company 9) transmits the created WEB page 73 together with the first session ID 71 and each second session ID 72 to the terminal device 11 (broker 13).

  In this way, the information processing company 9 creates a unique first session ID 71 for each broker 13 and creates and associates a unique second session ID 72 for each user 17 so that the broker system can be configured with a simple configuration. Can be realized.

  In addition, the session management server 7 uses the first session ID 71 and the second session ID 72 in combination as the session information, so that appropriate management according to the scene such as integrated management for each broker 13 or management for each user 17 is performed. Processing becomes possible.

(4-2. Session management when updating WEB pages)
FIG. 9 is a flowchart showing session management when the WEB page of the terminal device 11 (broker 13) is updated. The update of the WEB page indicates a re-display of the WEB page, a screen movement to another WEB page, or the like.
After logging in to the information processing server 5 (information processing company 9), the broker 13 requests the information processing server 5 to update the WEB page based on the broker request of the predetermined user 17 (step 2001).

  The broker 13 uses the terminal device 11 to obtain the first session ID 71 sent from the information processing server 5 at the time of login together with the WEB page update request and the second session ID 72 created for the mediating user 17. The data is sent to the processing server 5 and the session management server 7.

The session acquisition unit 29 of the session management server 7 acquires a session, and the session verification unit 31 collates the first session ID 71 and the second session ID 72 sent from the terminal device 11 based on the session management information 39 (step) 2002). When the validity including the expiration dates of the first session ID 71 and the second session ID 72 is authenticated, the WEB page creation means 27 of the information processing server 5 creates a WEB page 73 and sends it to the terminal device 11 (step 2003). . The session management server 7 updates the corresponding expiration date 91 of the session management information 39.
The terminal device 11 updates and displays the received WEB page 73 (step 2004).

  For example, based on an intermediation request for “withdrawal request” from the user 17-1 (user 1), the “draw-out request button” 203 on the account information screen 304 (FIG. 13) of the terminal device 11 for the user 17-1 (user 1). Is clicked, the terminal device 11 sends a first session ID 71 “US01” and a second session ID 72 “SS11” to the information processing server 5 together with the withdrawal request. The information processing server 5 provides the account information screen 307 (FIG. 14) to the terminal device 11 after the session information authentication.

FIG. 14 is a diagram showing a screen 307 of account information provided by the information processing server 5.
On the account information screen 307, a screen 308 for the user 17-1 (user1) is updated and displayed.

  Further, the broker request processing from the user 17-3 (user3) is completed, and the “logout request button” 205 is clicked on the account information screen 306 (FIG. 13) for the user 17-3 (user3) of the terminal device 11. Then, the terminal device 11 sends a first session ID 71 “US01” and a second session ID 72 “SS13” together with a logout request to the information processing server 5. The information processing server 5 provides the account information screen 309 (FIG. 15) to the terminal device 11 after the session information authentication.

FIG. 15 is a diagram showing an account information screen 309 provided by the information processing server 5.
On the account information screen 309, a logout completion notification screen 310 for the user 17-3 (user3) is displayed.

  Through the above process, the terminal device 11 (broker 13) mediates the WEB page update request of any user 17 and requests the information processing server 5 to update the WEB page by the terminal device 15. The terminal device 11 sends the first session ID 71 and the second session ID 72 created for the mediating user 17 to the session management server 7. The session management server 7 authenticates the validity of the first session ID 71 and the second session ID 72 based on the session management information 39, and then updates the expiration dates of the first session ID 71 and the second session ID 72. The information processing server 5 sends the updated WEB page 73 for the corresponding terminal device 15 (user 17) to the terminal device 11 (broker 13) together with the first session ID 71 and the second session ID 72.

  Thus, the terminal device 11 (broker 13) is created for the first session ID 71 and the brokering user 17 when mediating the web page update request of any of the terminal devices 15 (user 17). The second session ID 72 is sent to the session management server 7. By using the first session ID 71 and the second session ID 72 as the session information, the mediation system 1 can be realized with a simple configuration.

  In addition, since the intermediary system 1 takes over session information (first session ID 71 and second session ID 72) that does not include user information on the network, it prevents leakage of personal information and reduces the risk of unauthorized access and the like. can do.

(4-3. Session management during logout)
FIG. 10 is a flowchart showing session management when the broker 13 logs out from the information processing server 5 (information processor 9).
The broker 13 requests the information processing server 5 to log out from the terminal device 11 (step 3001). By logout of the terminal device 11 (broker 13), collective logout processing is performed for the accounts of all the users 17 who are the broker requester.

  The terminal device 11 sends the first session ID 71 sent from the information processing server 5 at the time of login together with the logout request to the information processing server 5 and the session management server 7.

  The session acquisition unit 29 of the session management server 7 acquires a session, and the session verification unit 31 verifies the first session ID 71 sent from the terminal device 11 based on the session management information 39 (step 3002).

  The session management server 7 authenticates the validity including the expiration date of the first session ID 71. Next, the session management server 7 searches all the second session IDs 89 corresponding to the first session ID 71 based on the correspondence table 83 (FIG. 4) of the session management information 39 (step 3003).

Further, the session management server 7 performs logout processing for the user accounts 95 indicated by all the searched second session IDs 89 based on the second session table 85 (FIG. 4) of the session management information 39 (step 3004).
The information processing server 5 creates a logout completion notification and sends it to the terminal device 11, and the terminal device 11 displays the logout completion notification (step 3005).

  For example, when the “collective logout request button” 207 is clicked on the account information screen 303 (FIG. 13), the terminal device 11 sends the first session ID 71 “US01” to the information processing server 5 together with the collective logout request. The session management server 7 searches all the second session IDs 89 (“SS11”, “SS12”, “SS13”) corresponding to the first session ID 71 “US01”, and further, the user accounts 95 indicated by the second session IDs 89, respectively. Collective logout processing is performed for (“user1 @ A”, “user2 @ A”, “user3 @ A”). The information processing server 5 provides the terminal device 11 with a collective logout completion notification screen 311 (FIG. 16).

FIG. 16 is a diagram showing a collective logout completion notification screen 311 provided by the information processing server 5.
On the collective logout completion notification screen 311, collective logout completion notification screens 312 to 314 for all users 17 (user 1 to user 3) are displayed.

  Through the above process, the terminal device 11 (broker 13) sends the first session ID 71 sent from the information processing server 5 at the time of login to the information processing server 5 and the session management server 7 together with the collective logout request. The session management server 7 searches for all the second session IDs 72 corresponding to the first session ID 71, and further performs logout processing for all accounts 95 corresponding to the second session ID 72.

  As described above, when the broker 13 makes a collective logout request using the terminal device 11, all the second session IDs 72 corresponding to the first session ID 71 are searched, and the account of the terminal device 15 (user 17) that is the mediation request source. Logout processing can be performed for. By associating one first session ID 71 with a plurality of second session information 72, the brokerage system 1 can easily realize batch processing for each broker 13. Batch processing is not limited to batch logout processing.

(4-4. Management of session expiration date)
With reference to FIG. 17, the management of the session expiration date of the mediation system 1 will be described.
FIG. 17 is a flowchart regarding management of the session expiration date of the mediation system 1.
The broker 13 logs in to the information processing server 5 with the broker account “C1 @ A” (step 3501). The session management server 7 creates a first session ID “US01” for the broker 13 (step 3502).

  The broker 13 acts as a proxy for the user 17-1 who has received the broker request and logs in with the user account “user1 @ A” (step 3503). Similarly, the broker 13 acts on behalf of the user 17-2 and the user 17-3 and logs in with the user accounts “user2 @ A” and “user3 @ A”, respectively (steps 3504 and 3505).

  The session management server 7 creates the second session ID “SS11”, the second session ID “SS12”, and the second session ID “SS13” for the user 17-1, the user 17-2, and the user 17-3, respectively. (Steps 3506-3508).

  When the broker 13 performs an operation related to any of the users 17-1, 17-2, and 17-3 (any of steps 3510 to 3512), the session management server 7 uses the first session ID “US01. ”, The second session ID“ SS11 ”, the second session ID“ SS12 ”, and the second session ID“ SS13 ”are all updated (step 3513).

While the operations relating to the user 17-1, the user 17-2, and the user 17-3 are performed by the broker 13, the processes from step 3509 to step 3514 are repeated.
When the broker 13 performs a logout operation (step 3515), the session management server 7 first session ID “US01”, second session ID “SS11”, second session ID “SS12”, and second session ID “SS13”. Are all invalidated (step 3516).

  As described above, when an operation related to any of the user 17-1, the user 17-2, and the user 17-3 is performed, all the sessions (the first session ID and all the related second session IDs) are updated. , Some sessions will not be invalidated. Moreover, since different 2nd session ID is produced for every user 17, operation can be performed independently for every user 17. FIG.

  In FIG. 17, it is described that all the expiration dates of the first session ID and the second session ID are updated when any user account is operated. The expiration date may be updated only for the two session IDs. Accordingly, the second session ID is automatically invalidated for a user account that has been left for a long time after the operation is interrupted.

(5. Session management for direct user access)
Next, a process when the user 17 directly accesses the information processing server 5 of the information processing company 9 without making a mediation request will be described with reference to FIG. The screen displayed on the display unit 157 of the terminal device 15 (user 17) will be described with reference to FIGS. 19 and 20 as appropriate.

  FIG. 18 is a flowchart showing session management when the user 17 logs in directly to the information processing server 5 of the information processing company 9 from the terminal device 15 without making a mediation request, and changes screens.

  A login screen 301 (FIG. 11) to the information processing server 5 (information processing company 9) is displayed on the display unit 157 of the terminal device 15 (user 17) (step 4001). The login screen 301 is, for example, a screen of a predetermined WEB site provided by a bank or the like. For example, when the user account 55 “user1 @ A” and the password 56 “aspfg” are input to the login screen 301 and the “login request button” 201 is clicked, the information processing server 5 and session management are performed from the terminal device 15 (user 17). A login request is transmitted to the server 7.

  The information processing server 5 (information processing company 9) collates the account (user account 55) and password 56 sent from the terminal device 15 with values registered in the user information 23 (FIG. 7), and the user account 55 ( Authentication that the user 17) is a legitimate user is performed (step 4002). As a result of collation with the user information 23, the information processing server 5 has the account type 99 of the sent account 97 (for example, the user account 55 “user1 @ A”) as “user”. Perform login process.

The second session ID creation means 35 of the session management server 7 (information processing company 9) newly creates a second session ID 62 for each user account 55 (for each user 17), and the session registration means 37 has session management information 39. The second session ID 62 is registered in the second session table 85 (FIG. 4) (step 4003).
In the case of direct login from the user 17, the first session table 81 and the correspondence table 83 of the session management information 39 are not used.

The WEB page creation means 27 of the information processing server 5 creates a WEB page 63 (step 4004) and transmits it to the terminal device 15 (user 17) together with the second session ID 62.
The terminal device 15 (user 17) displays the WEB page 63 (account information screen 315) on the display unit 157 (step 4005).

FIG. 19 is a diagram showing a screen 315 of account information provided by the information processing server 5.
On the account information screen 315, an account information screen 316 for the terminal device 15 (user 17 “user1 @ A”) is displayed.

The terminal device 15 (user 17) stores the second session ID 62 in the session information 53 (FIG. 6) (step 4006).
Subsequently, the user 17 requests the information processing server 5 to update the WEB page through the terminal device 15 (step 4007).

  The terminal device 15 sends the second session ID 62 sent from the information processing server 5 at the time of login to the information processing server 5 and the session management server 7 together with the WEB page update request.

The session acquisition unit 29 of the session management server 7 acquires a session, and the session verification unit 31 verifies the second session ID 62 sent from the terminal device 15 based on the session management information 39 (step 4008). When the validity including the expiration date of the second session ID 62 is authenticated, the WEB page creation means 27 of the information processing server 5 creates the WEB page 63 and sends it to the terminal device 15 (step 4009). The session management server 7 updates the corresponding expiration date 91 in the second session table 85 (FIG. 4: session management information 39).
The terminal device 15 updates and displays the received WEB page 73 (step 4010).

For example, when the “drawing request button” 203 is clicked on the account information screen 315 (FIG. 19), the terminal device 15 sends the second session ID 62 “SS11” to the information processing server 5 together with the withdrawal request. After the session information authentication, the information processing server 5 provides the terminal device 15 with an account information screen 317 (FIG. 20).
FIG. 20 is a diagram showing a screen 317 of account information provided by the information processing server 5.
On the account information screen 317, a screen 318 for the user 17-1 (user1) is displayed.

  Through the above process, the session management server 7 (information processing company 9) of the mediation system 1 performs login processing by direct login from the user if the transmission source of the login request is the terminal device 15 of the user 17. That is, when the user 17 makes a login request to the information processing server 5 and the session management server 7 using the terminal device 15, the information processing server 5 identifies that the account type 99 is “user”, and performs a user direct login process. The session management server 7 newly creates and registers a second session ID 62. The information processing server 5 sends the second session ID 62 to the terminal device 15 together with the created WEB page 63.

  The terminal device 15 transmits the second session ID 62 to the information processing server 5 and the session management server 7 together with the WEB page update request. After authenticating the validity of the second session ID 62, the session management server 7 sends the updated WEB page 73 to the terminal device 15 together with the second session ID 62 whose validity has been updated.

  As described above, in the mediation system 1, the user 17 can directly log in to the information processing server 5 and the session management server 7 of the information processing company 9 without using the mediator 13.

(6. Succession of first session ID 71 and second session ID 72)
The takeover of the first session ID 71 and the second session ID 72 is not limited as long as the method can transmit and receive the first session ID 71 and the second session ID 72 together with the WEB page request (request) and the WEB page transmission (response). For example, in a WWW (World Wide Web) system, it may be recorded in cookie information or a URL (Uniform Resource Locator) parameter for transmission / reception. In addition, when recording in a URL parameter, it may be embedded in a link on a WEB page.

  In a browser application that displays a WEB page, cookie information is usually overwritten each time an information processing server under the management of one session management server is accessed. On the other hand, URL parameters are easy to refer to.

  It is not desirable to refer to the first session ID 71 other than access with the information processing company 9. Therefore, it is desirable to record in the cookie information of the browser instead of the URL parameter. The first session ID 71 is unique for each broker 13 and there is no problem even if the cookie information is overwritten with the same value.

  On the other hand, since a different second session ID 72 may be assigned to each user 17 mediated by one broker 13, there is a possibility that if the second session ID 72 is recorded in the cookie information, it is overwritten with a different value. Therefore, it is desirable to record the second session ID 72 in the URL parameter. When the user 17 makes an intermediary request to the broker 13 and accesses the information processor 9 through the terminal device 15, the use authority of the information processor 9 is limited only by the second session ID 72 without the first session ID 71. It is invalidated. Therefore, even if the second session ID 72 is referred to by a third party, the influence on security can be prevented.

(7. Effects, etc.)
As described above in detail, in the mediation system 1 according to the embodiment of the present invention, by using the first session ID 71 and the second session ID 72, an existing session information utilization system can be used effectively and easily. An intermediary system (agency system) can be constructed. That is, by utilizing an existing system, it is possible to reduce the cost burden for constructing a mediation system.

  In the information processing company 9 that collates both the first session ID 71 and the second session ID 72 and permits the use of the service by the mediation system 1, even if one of the session IDs is leaked, the use of the service is not permitted. Safety against unauthorized use from other terminal devices can be enhanced.

  Further, when one broker 13 mediates a plurality of users 17 and logs in to the information processor 9 with different accounts, the same first session ID 71 is created. Therefore, integrated management such as simultaneous logout of the terminal device 15 (user 17), for example, can be performed using the first session ID 71, and the processing load and communication load of the mediation system 1 as a whole can be reduced.

  Moreover, when the broker 13 performs an operation related to any one of the users 17 through the plurality of users 17, the expiration dates of the second session IDs 72 related to all the users 17 are updated. Accordingly, it is possible to prevent the second session IDs 72 related to all the users 17 including the user 17 who has not been operated from being invalidated, so that the operability can be improved. Further, since different second session IDs 72 are created for each user 17, the broker 13 can perform independent operations for all users 17.

  The preferred embodiments of the mediation system according to the present invention have been described above with reference to the accompanying drawings, but the present invention is not limited to such examples. It will be apparent to those skilled in the art that various changes or modifications can be conceived within the scope of the technical idea disclosed in the present application, and these are naturally within the technical scope of the present invention. Understood.

Configuration diagram of mediation system 1 Detailed configuration diagram of mediation system 1 The figure which shows the hardware constitutions of the information processing server 5, the session management server 7, the terminal device 15, and the terminal device 11. The figure which shows the session management information 39 (session management server 7) The figure which shows the session information 47 (the terminal device 11 of the broker 13). The figure which shows the session information 53 (terminal device 15) The figure which shows the user information 23 (information processing server 5) The flowchart which shows the session management at the time of the mediation login of the terminal device 15 (user 17) The flowchart which shows the session management at the time of the WEB page update of the terminal device 11 (broker 13) The flowchart which shows the session management at the time of the collective logout of the terminal device 11 (broker 13) Diagram showing login screen 301 The figure which shows the mediation login screen 302 The figure which shows the screen 303 of account information The figure which shows the screen 307 of account information The figure which shows the screen 309 of account information The figure which shows the collective logout completion notification screen 311 Flow chart relating to session expiration management of the brokerage system 1 A flowchart showing session management when the terminal device 15 directly logs in to the information processing company 9 and changes the screen. The figure which shows the screen screen 315 of account information The figure which shows the screen screen 317 of account information

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ......... Intermediation system 3 ......... Network 5 ......... Information processing server 7 ......... Session management server 9 ......... Information processing company 11, 15-1, 15-2, ..., ... Terminal device 13... Intermediaries 17-1, 17-2,... User 21... User authentication means 23... User information 25... Content information 27. …… Session acquisition means 31... Session collation means 33... First session ID creation means 35... Second session ID creation means 37... Session registration means 39. Batch processing means 43, 49... WEB page request means 45, 51... WEB page display means 47, 53. 8,101 ......... password 62,72,89 ......... the second session ID
63, 73 ... Web page 71, 87 ... First session ID
81 ......... First Session Table 83 ......... Correspondence Table 85 ......... Second Session Table 91 ......... Expiration Date 93 ......... Intermediation Account 95 ......... User Account 97 ......... Account 99 ......... Account Type 151 ......... CPU
153 ......... Memory 155 ......... Storage unit 157 ......... Display unit 159 ......... Input unit 161 ......... Output unit 163 ......... Communication unit 201 ......... Login request button 203 ......... Drawout request button 205 ……… Logout request button 207 ……… Batch logout request button 301 ……… Login screen (broker 13 and user 17)
302 ... Intermediary login screen (broker C1)
303, 307, 309, 311 ......... Provision screen to the broker C1 304 to 306, 308, 310, 312 to 314 ......... Information display regarding the user 17 315, 317 ... …… Provision screen to the user 17 316, 318 ... Information display about user 17

Claims (6)

An information processing server and a first terminal device belonging to an intermediary that mediates a plurality of users are connected via a network, and the first terminal device of the mediator mediates the plurality of users to send a WEB page from the information processing server. An intermediary system to obtain,
Session ID creation for creating a unique first session ID for each mediator and a unique second session ID for each user when the mediator accesses the information processing server from the first terminal device Means,
Session ID transmission means for sending the first session ID and the second session ID to the first terminal device of the mediator of the access source;
Session registration means for registering one first session ID and at least one second session ID in association with each other as session management information;
Session verification means for verifying the first session ID and the second session ID sent from the first terminal device of the mediator, and the registered first session ID and second session ID;
Information providing means for creating the WEB page for each of the users based on the collation result by the session collating means and providing it to the first terminal device of the mediator;
Equipped with,
The intermediary system , wherein the first session ID is recorded in cookie information of a browser that displays the WEB page, and the second session ID is recorded in a URL parameter . The session ID creating means creates a unique second session ID for each user when the user accesses the information processing server from a second terminal device,
The session ID transmission means sends the second session ID to the second terminal device of the user who is the access source,
The session registration means registers the second session ID as session management information,
The session verification means collates the second session ID sent from the user's second terminal device with the registered second session ID,
2. The mediation according to claim 1, wherein the information providing unit creates the WEB page for each user based on the collation result by the session collating unit and provides the WEB page to the second terminal device of the user. system.   Type determining means for determining which access is made by the mediator's first terminal device or the user's second terminal device based on the type of service account provided by the information processing server. The mediation system according to claim 1 or 2. When an operation is performed on any of the sessions indicated by the plurality of second session IDs corresponding to the first session ID, all the expiration dates of the plurality of second session IDs corresponding to the first session ID are updated. The mediation system according to any one of claims 1 to 3, wherein A program that causes a computer to function as the mediation system according to any one of claims 1 to 4 . A computer-readable recording medium recording a program that causes a computer to function as the mediation system according to any one of claims 1 to 4 .

Images