Session management system and management method

• US 6,587,880 B1
• Filed: 08/14/1998
• Issued: 07/01/2003
• Est. Priority Date: 01/22/1998
• Status: Expired due to Fees

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Saigo, Kikumi, Matsushima, Terunori, Amaya, Toshihiro, Hagihara, Naoko
• Primary Examiner(s): Meky, Moustafa M.
• Application Number:
  US09/134,574
• Time in Patent Office: 1,782 Days
• Field of Search: 704/227, 704/201, 704/220, 704/224, 704/228, 709/200, 709/203, 709/217, 709/218, 709/219, 709/220, 709/223, 709/224, 709/225, 709/226
• US Class Current: 709/225
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms

Abstract

The present invention relates to a session management system in which communications extending over a plurality of servers can be managed as an identical session. In this system, a URL received from an authenticated user bears a session management identifier. A display-data-creation-program control device having accepted the URL notifies it to a session-management-identifier management device. Upon verifying that the session management identifier is incorporated in the accepted URL, the identifier management device checks if a current session has been authenticated, by referring to the contents of a session-management-identifier management table. When the session has been authenticated as the result of the check, the session-management-identifier management device offers a service.

Claims

1. A session management system in which a plurality of users, and a plurality of servers for offering web services to the users are connected through a network, comprising:

said plurality of servers distributively including

a user authentication unit to store, at a first of the servers, user account information for identifying the users,

a session-management-identifier storage unit to store, at a second of the servers, session management identifiers which uniquely identify sessions of said servers with respective users of the plurality of users, where the session management identifiers are generated by the second server accessing the information identifying the users stored at the first server, and

an authentication control unit to send notification indicating that a user among the respective users has been authenticated, as a reply to information based on a request made by the user, if a session management identifier contained in the information accepted by the server itself or sent from another of said servers agrees with any of the session management identifiers stored in said session-management-identifier storage unit of the second of the servers; and

each of said plurality of servers further including

a transmission/reception unit to transmit and receive data to and from said plurality of users through said network, and

a control unit to accept the request made by the user from said transmission/reception unit, for sending said information based on said request-to said authentication control unit, and to offer the service complying with the user'"'"'s request if the reply to said information as sent back from said authentication control unit is the notification indicating that the user has been authenticated.

2. The session management system as defined in claim 1, wherein

said authentication control unit sends notification indicating that a user authentication is necessary, as said reply to the server having received said request from the user if the session management identifier is not contained in the information based on the request; and

said control unit requests said user to transmit information for the user authentication, if said reply to the information based on the request is the notification indicating that the user authentication is necessary.

3. The session management system as defined in claim 2, wherein

any of said plurality of servers further includes an authentication-information storage unit to store information for the user authentication therein;

said control unit sends to said authentication control unit the information for the user authentication as transmitted in from said user in compliance with the request for transmitting the user authentication; and

said authentication control unit assigns said session management identifier to the session with said user and stores it in said session-management identifier storage unit if said information for the user authentication as transmitted in from said user in compliance with the request for transmitting the user authentication information for the user authentication transmitted in from said user, via the server having received said request from the user, agrees with any of the user authenticating information stored in said authentication-information storage unit.

4. The session management system as defined in claim 2, wherein

each server of said plurality of servers further includes a display control unit to generate display data for requesting said user to transmit the user authenticating information;

and

said control unit causes said display control unit to generate the display data and transmits said display data to said user as the request for transmitting said user authenticating information, if said reply to said first-mentioned information is said notification indicating that said user authentication is necessary.

5. The session management system as defined in claim 1, wherein

said session-management-identifier storage unit stores therein information items indicative of beginning times of the sessions to which the stored session management identifiers are respectively assigned, in correspondence with said session management identifiers;

and

said authentication control unit sends notification indicating that authentication is necessary, as said reply to the server having received said request from said user when the session identified by said session management identifier contained in said information accepted from the server having received said request from said user has lapsed for, at least, a prescribed time period since the beginning time.

6. The session management system as defined in claim 1, wherein said network is built by the Internet technology, and said session management identifier is affixed to URL (Uniform Resource Locator) and is exchanged between said user and said plurality of servers, such exchange including sending the session management identifier with affixed URL from user to said plurality of servers when said user sends the request as a URL to said control unit.

7. The session management system as defined in claim 1, wherein

any of said plurality of servers further includes an authentication-information storage unit to store information for the user authentication therein;

said authentication control unit sends notification indicating that said authentication is necessary, as said reply to the server having received said request from said user, if the session management identifier is not contained in said information, and it generates and assigns said session management identifier to the session with said user and stores the assigned session management identifier in said session-management identifier storage unit if said authenticating information transmitted in from said user agrees with any of the user authenticating information stored in said authentication-information storage unit; and

said control unit of said each server requests said user to transmit said authenticating information and sends to said authentication control unit said authenticating information transmitted in from said user in compliance with the authenticating-information transmitting request, if said reply to the first-mentioned information is said notification indicating that said authentication is necessary.

8. The system according to claim 1, wherein each server of said plurality of servers further includes a display-data-creation program for incorporating the session management identifier into service-identifying data of the service, and the display-data-creation program then supplies this service to said control unit before said control unit offers the service.

9. The system according to claim 8, wherein the service-identifying data incorporating the session management identifier is such that selection of the service-identifying data causes it to be used by said authentication control unit to check for agreement with the session management identifiers stored in said session-management-identifier storage unit.

10. A system including web servers which constitute a system for offering services to a plurality of users through a network, comprising:

a first web server comprising

a transmission/reception unit to transmit and receive data to and from said plurality of users through said network, and

a user authentication unit to store user account information for verifying users,

a control unit to accept an original request string that both identifies a requested resource and includes a session identifier as a parameter of the string, made by the user from said transmission/reception unit, for sending the session identifier to a second web server which is one of said plurality of web servers, and for offering the service complying with the user'"'"'s request if a reply to said information as sent back from said second web server indicates that said user has been authenticated; and

the second web server comprising

a session-management identifier storage unit storing session identifiers generated based on approval from the user authentication unit of the first web server,

an authentication control unit to send notification indicating that a user among the respective users has been authenticated, as a reply to information based on a request made by the user, if a session management identifier contained in the information accepted by the server itself or sent from another of said servers agrees with any of the session management identifiers stored in said session-management-identifier storage unit, and

a control unit capable of accepting the request made by the user from said transmission/reception unit, for sending said information based on said request-to said authentication control unit, and capable of offering the service complying with the user'"'"'s request if the reply to said information as sent back from said authentication control unit is the notification indicating that the user has been authenticated.

11. A method for authorizing web server access, comprising:

requesting from a client, to a first web server, original access to a first resource at the first web server;

prompting for account authorization information at the client in response to said requesting;

validating the account authorization information, at the first web server, by comparing the account authorization information to user account information stored at the first web server, and in response storing corresponding validated session information at a second web server;

incorporating, at the first web server, the validated session information in a resource-request string contained in displayable data of the first requested resource;

displaying the first resource at the client; and

selecting a resource-request string in the displayed first resource, the resource-request string referring to a second resource at the second web server, where the second web server validates session information of the second resource request string using the stored session information;

requesting from a second client to the second web server original access to a third resource at the second web server and in response prompting for second account information at the client, validating the account information at the first web server by comparing the second account information to the user account information stored at the first web server, and in response storing second validated session information at the second web server.

12. The method according to claim 11, further comprising authorizing access to the second resource corresponding to the selected resource-request string by the second web server comparing the validated session information stored at the second web server to the validated session information incorporated in the resource-request string sent to the first web server by the client.