Abstract:
The present invention provides a network system, a proxy server, a session management method, and a program which enable to maintain sessions securely by managing the sessions in the proxy server. The network system includes a client, a proxy server, and at least two web servers which are connected to each other via a communication network. The proxy server includes a session management means for maintaining sessions of the at least two web servers. Upon receiving a predetermined request from an authenticated user, the session management means associates and stores user information indicating a user of the client, server information indicating a subject web server of the request, and session information received from the web server.

Description:
BACKGROUND OF THE INVENTION 
     1. Field of the Invention 
     The present invention relates to a network system, a proxy server, a session management method, and a program for communications using an active proxy. 
     2. Description of the Related Art 
     Conventionally, in case of communications using an active proxy, it is needed to maintain sessions by, for example, adding session information to a destination address. However, in this method, since a server is required to add the session information to a destination address, there is a risk that the session information may be easily leaked to other servers and a session may be stolen. Further, there is a problem that such a method cannot be applied to a case where communication is performed by using a different server within a series of sessions. 
     Further, among the Liberty Alliance specifications, a specification called LECP profile has the similar problem and it is difficult to realize such a specification, especially, in a session management method using cookies. 
     As examples of the related art of a proxy server, there are “system including proxy server and web server and program therefor” in which, when a web server in a coverage area does not return response information, a web client is informed the reason why the web server is stopped and estimated time for restarting, instead of a conventional error return (see, for example, Japanese Patent Application Laid-Open No. 2002-259338) and “proxy server and proxy control system” which suppress effects on other traffics in a network when obtaining content from an origin server (see, for example, Japanese Patent Application Laid-Open No. 2003-256321). 
     SUMMERY OF THE INVENTION 
     The present invention has been developed in view of the above problems and has an object of providing a network system, a proxy server, a session management method, and a program which enable to maintain sessions completely by managing sessions in a proxy server. 
     In order to achieve the above object, the first aspect of the invention is a network system, including a client, a proxy server, and at least two web servers. The client and the proxy server, and the at least two web servers are connected to each other via a communication network, and the proxy server includes a session management means for maintaining a session of the at least two web servers. 
     The second aspect of the invention is the network system in which, upon receiving a predetermined request from an authenticated client, the session management means stores user information of the client, server information indicating a target web server of the request, and session information received from the web server and associates them each other. 
     The third aspect of the invention is the network system in which the proxy server includes a user authentication means for carrying out user authentication of the client based on identification information received from the client, and the session management means stores, as the user information, the user authenticated by the user authentication means. 
     The fourth aspect of the invention is the network system in which the session management means stores, as the user information, an IP address received from the client. 
     The fifth aspect of the invention is the network system, further including an authentication server for carrying out user authentication of the client and informing the proxy server of an authentication result. The session management means stores, as the user information, the user authenticated by the authentication server. 
     The sixth aspect of the invention is the network system, in which the proxy server includes a protocol conversion means for converting a current protocol in use into another protocol. 
     The seventh aspect of the invention is the network system in which the proxy server includes a security means for authenticating the client and the web server. 
     The eighth aspect of the invention is a proxy server for proxy receiving in response to a request addressed to a predetermined web server from a client, in which a session management means for maintaining a session of the web server is included. 
     The ninth aspect of the invention is the proxy server in which, upon receiving a predetermined request from an authenticated client, the session management means associates and stores user information of the client, server information indicating a subject web server of the request, and session information received from the web server. 
     The tenth aspect of the invention is the proxy server in which the proxy server includes a user authentication means for carrying out user authentication of the client based on identification information received from the client, and the session management means stores, as the user information, the user authenticated by the user authentication means. 
     The eleventh aspect of the invention is the proxy server in which the session management means stores, as the user information, an IP address received from the client. 
     The twelfth aspect of the invention is the proxy server, further including an authentication server for carrying out user authentication of the client and informing the proxy server of an authentication result. The session management means stores, as the user information, the user authenticated by the authentication server. 
     The thirteenth aspect of the invention is the proxy server, further including a protocol conversion means for converting a current protocol in use into another protocol. 
     The fourteenth aspect of the invention is the proxy server, further including a security means for authenticating the client and the web server. 
     The fifteenth aspect of the invention is a session management method, in which a proxy server for proxy receiving a request addressed to a predetermined web server from a client maintains a session of the web server. 
     The sixteenth aspect of the invention is the session management method in which, upon receiving a predetermined request from an authenticated client, the proxy server associates and stores user information of the client, server information indicating a subject web server of the request, and session information received from the web server. 
     The seventeenth aspect of the invention is the session management method in which the proxy server carries out user authentication of the client based on identification information received from the client and stores the authenticated user as the user information. 
     The eighteenth aspect of the invention is the session management method in which an IP address received from the client is stored as the user information. 
     The nineteenth aspect of the invention is the session management method, further including storing, as the user information, a user authenticated by an authentication server, which carries out user authentication of the client and informs the proxy serve of an authentication result. 
     The twentieth aspect of the invention is the session management method in which the proxy server converts a current protocol in use into another protocol. 
     The twenty first aspect of the invention is the session management method in which the proxy server authenticates the client and the web server. 
     The twenty second aspect of the invention is a computer program product, when executed, causing a proxy server to carry out a session management process for maintaining a session in a web server. 
     The twenty third aspect of the invention is the computer program product in which, in the session management process, upon receiving a predetermined request from an authenticated client, the proxy server is made to associate and store user information of the client, server information indicating a subject web server of the request, and session information received from the web server. 
     The twenty fourth aspect of the invention is the computer program product in which the proxy server is made to carry out a user authentication process for authenticating the client based on identification information received from the client, and in the session management process, the proxy server is made to store, as the user information, the user authenticated in the user authentication process. 
     The twenty fifth aspect of the invention is the computer program product in which, in the session management process, the proxy server is made to carry out a process for storing, as the user information, an IP address received from the client. 
     The twenty sixth aspect of the invention is the computer program product in which, in the session management process, the proxy server is made to carry out a process to store, as the user information, a user authenticated by an authentication server, which carries out user authentication of the client and informs the proxy server of an authentication result. 
     The twenty seventh aspect of the invention is the computer program product in which the proxy server is made to carry out a protocol conversion process for converting a current protocol in use into another protocol. 
     The twenty eighth aspect of the invention is the computer program product in which, the proxy server is made to carry out a security process for authenticating the client and the web server. 
     According to the present invention, sessions can be maintained securely even when a proxy server actively accesses to a plurality of servers. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a view showing a structure of a network system according to the first embodiment of the present invention; 
         FIG. 2  is a view showing a session management function of a proxy server according to the first embodiment of the present invention; and 
         FIG. 3  is a sequence diagram showing an operation according to the first embodiment of the present invention. 
     
    
    
     DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     Preferred embodiments for realizing the present invention will be described with reference to the accompanying drawings. 
     First Embodiment 
     As shown in  FIG. 1 , in a network system according to the first embodiment of the present invention, a private network  20  such as a LAN, a proxy server  10  connected to the private network  20 , and a client terminal device (hereinafter, referred to as “client”)  11 , which is a typical information processing terminal device such as a personal computer and is connected to the private network  20 , are connected to a wide area network  21  such as the Internet via a GW (gateway)  12 . In addition, the wide area network  21  is connected to a server A 13  and a server B 14 . 
     In the first embodiment, a case where the client  11  accesses the server A 13  and the server B 14  via the proxy server  10  acting as a proxy will be considered with reference to  FIG. 1 . In this system, there are two or more servers to be accessed. 
     The proxy server  10  of the present embodiment is configured to receive a request from the client  11  and access to the server A 13 . 
     The proxy server  10  includes a session management function  30  for authenticating a user of the client  11 , identifying the user of the client  11 , and storing user information indicating the identified user associated with session information of the server A 13 . As shown in  FIG. 2 , the session management function  30  is configured to store user information indicating the user of the client  11 , server information indicating a request target server, and session information of the request target server together. 
     The proxy server  10  is configured to extract the session information of the request target server from the session management function  30  based on the session information related to the request target server in response to a request from the user of the client  11  and add the session information to the request from the client  11 . 
     The proxy server  10  is configured to add information indicating that the access to the server A 13  is carried out via a proxy. 
     When receiving a request addressed to the server B 14  from the server A 13 , the proxy server  10  is configured to transfer a request received from the server A 13  to the server B 14 . 
     The proxy server  10  is configured to transfer a response addressed to the server A 13  from the server B 14  to the server A 13 . 
     The client  11  is configured to transmit a request to a predetermined server via the proxy server  10  and receive information from the predetermined server. Here, the client  11  is configured to transmit user&#39;s input to the request source server when a request of, for example, authentication is inputted. 
     The server A 13  and the server B 14  are typical web servers and configured to receive a request from the client  11  and transmit a response according to the request. 
     When the request includes information that the access is carried out via the proxy, the server A 13  returns to the proxy server  10  information that a request is to be sent to the server B 14 . 
     The server B 14  is configured to receive the request from the server A 13 , which is transmitted via the proxy server  10 , and return information according to the request. 
     An operation (session management method and program) of the first embodiment of the present invention will be described in detail with reference to  FIG. 3 . 
     According to the present embodiment, access to the server B 14  is implemented after the proxy server  10  authenticates the user of the client  11 . The content of the access is not particularly limited. In this example, a user authentication is carried out. After the user authentication, a request for confidential information is sent to the server A 13 . Here, when the request for confidential information is transferred via the proxy, the server A 13  checks whether the user of the client  11  as a request source is authenticated by the server B 14 . When the server A 13  confirms that the user of the client  11  is authenticated by the server B 14 , the server A 13  transmits the confidential information to the client  11 . 
     First, the client  11  accesses the proxy server  10  (step S 100 ). Then, the proxy server  10  requests the client  11  a user authentication (step S 101 ). 
     The user of the client  11  inputs identification information such as an ID and a password, the identification information being previously registered to the proxy server  10 , and transmits the information to the proxy server  10  (step S 102 ). Here, this authentication method is not limited to an ID and a password and may employ conventional authentication methods. 
     The proxy server  10  confirms (authenticates) the ID and the password transmitted from the client  11  in step S 102  and transmits an authentication key that indicates the completion of the authentication to the client  11  (step  103 ). 
     The client  11  transmits an authentication request addressed to the server B 14  to the proxy server  10  with the authentication key transmitted in step S 103  (step S 104 ). 
     After confirming the authentication key, the proxy server  10  transfers the request from the client  11  to the server B 14  (step S 105 ). 
     When receiving the authentication request of the client  11  transferred by the proxy server  10 , the server B 14  authenticates and then returns an authentication result and session information (step S 106 ). 
     The proxy server  10  associates the session information returned from the server B 14  with information of the user of the client  11  and the server B 14  and registers them to the session management function  30 . In addition, the proxy server  10  transfers the authentication result returned from the server B 14  to the client  11  (step S 107 ). 
     After the client  11  confirms that the authentication is completed in the server B 14  according to the authentication result, the client  11  transmits a confidential information request addressed to the server A 13  to the proxy server  10  together with the authentication key transmitted in step S 103  (step S 108 ). 
     After confirming the authentication key, the proxy server  10  transfers the request from the client  11  to the server A 13 . Further, when transferring, the proxy server  10  adds information that the access is carried out via a proxy to the request (step S 109 ). 
     The server A 13  receives the request of the client  11  transferred by the proxy server  10 . Here, based on the information that the confidential information is requested and the access is carried out via a proxy, the server A 13  transmits to the proxy server  10  a request for authentication confirmation addressed to the server B 14  (step S 110 ). 
     When receiving the request for authentication confirmation addressed to the server B 14  and session information of the server A 13  from the server A 13 , the proxy server  10  associates the session information of the server A 13  with the information of the user of the client  11  and the server A 13  to register them to the session management function  30  and to extract the session information of the user of the client  11  and the server B 14  from the session management function  30 . The proxy server  10  transfers the request for authentication confirmation addressed to the server B 14  from the server A 13  and the session information of the server B 14  extracted from the session management function  30  to the server B 14  (step S 111 ). 
     The server B 14  confirms that the received session information is of the user authenticated in step S 106  and returns a result that the user is authenticated (step S 112 ). 
     The proxy server  10  transfers the result returned in step S 112  to the server A 13  together with the session information of the server A 13  extracted from the session management function  30  (step S 113 ). 
     The server A 13  recognizes it as a response to the request for authentication confirmation that was addressed to the server B 14  requested in step  110  based on the session information and returns the confidential information to the proxy server  10  (step S 114 ). 
     The proxy server  10  transfers the response from the server A 13  to the client  11  (step S 115 ). 
     As described above, according to the session management method with the proxy server by controlling program in the network system of the present embodiment, the client  11  can receive the confidential information from the server A 13  while the sessions are maintained in an active proxy. 
     In other words, according to the present embodiment, sessions can be maintained in the sequence shown in  FIG. 3  although it was impossible in a normal session management by a client. This is because a conventional proxy server which does not perform session management can not recognize that the request in step S 105  and the request in step S 111  in  FIG. 3  are requests transmitted from the same client. This happens because the request is addressed to the server B 14  in the step S 104  and the request is addressed to the server A 13  in step S 108 . 
     Further, according to the present embodiment, a plurality of servers can work in cooperation. In step S 110  in  FIG. 3 , the authentication is confirmed for the server B 14 ; however, requests should not be used only for authentications. Here, since the servers do not directly communicate with each other, the range where the information is transferred can be controlled. According to the first embodiment, the server A 13  is adapted to authenticate the client  11  without using the authentication information of the client  11 . 
     Second Embodiment 
     The second embodiment of the present invention employs an IP address for identification of the client  11  in a session management function  30  although the first embodiment employs an authentication in proxy server  10 . In this case, comparing to the first embodiment, the processes in steps S 100  to S 103  can be omitted and an IP address is used as an identifier for registering with and obtaining from the session management function  30 . 
     Third Embodiment 
     The third embodiment of the present invention shows a case where the client  11  is a mobile telephone. In this case, comparing to the first embodiment, the private network  20  such as a LAN in  FIG. 1  is a mobile telephone communication network and an authentication server such as a WAP server is provided in addition to the proxy server  10 . Here, a user authentication is performed in the WAP server, and a telephone number or the like can be used as an identifier to identify the client  11 . 
     In addition, according to the third embodiment, a private network  20  such as a LAN or a GW  12  is not required, so even when the client  11  and the proxy server  10  are located in a wide area network  21  such as the Internet, they can be used in the same way. 
     Fourth Embodiment 
     In the fourth embodiment of the present invention, additional functions are provided to the proxy server  10 . A protocol conversion function or a security function is added to the proxy server  10  as an additional function. The protocol conversion function enables accesses using protocols other than an IP for an ISDN dedicated network that is not the Internet. Further, the security function enables an authentication of a client or a server by using, for example, an SSL (Secure Sockets Layer) communication function so that session management can be performed similar to the first embodiment. 
     Although embodiments of the present invention are explained above, the invention should not be limited to the above embodiments and can be carried out with modifications within the scope of the present invention. The present invention may be applied to service interactions, authentication interactions, and Web systems.