JP2019057778A - Network service cooperation method, client service platform, client instance creation server, and program - Google Patents

Abstract

To provide a network service cooperation method, and the like, while allows a user to prevent technical information leakage for a third person service accessing the API.SOLUTION: In a situation where one service has personal information of a user, and provides an API for causing the other service to use its own service, a network service cooperation method creates a closed network for connecting the own service and the other service kinetically, so that the other service does not leak information of the own service to the outside, when the other service uses the personal information of the user owned by the own service.SELECTED DRAWING: Figure 1

Description

  The present disclosure relates to a network service cooperation method, a client service platform, a client instance generation server, and a program that cooperate with services operated by a plurality of different operators and provide them to users.

  Currently, many B2B2C (Business to Business to Consumer) services delegate part of the user's authority using an authorization technology such as Oauth (see, for example, Non-Patent Document 2). In this method, the reliability of the service to which the authority is delegated is based on the trust by the URL and certificate in the redirect by HTTPS.

The background is the following technology.
1. Open API / API Economy In providing services, multiple services are used and combined (linked) to realize efficient service construction. Therefore, it is a technology that opens a service API and promotes use by others.
2. When building a microservice service, it is a technology that increases the scalability and availability of each service component by dividing it into functions and connecting them with a network, rather than creating them with a monolithic program.
3. OAuth2 (Non-Patent Document 1)
When developing an API to allow other services to be used by other services, in order not to let other services know the personal ID and password of their own services, use authorization for other services is done by the own service, and others This is a technology for issuing a “token” to a service and attaching the token to the API access. Prior to this technology, information acquisition by “scraping” was common, and there was a risk of leakage of ID / password.
4). Faas (Function as a Service)
In service cooperation, in order to minimize the resources of the cloud to be used, resources are dynamically secured only when the user uses the service, and other resources are released. Since resources are not secured when there are no users, overall resource utilization efficiency is better than other XaaS (IaaS / PaaS) services.
5. Container technology Computer resources managed by the operating system are separated in the OS name space, and a virtual environment is realized at low cost by using only a virtual network for communication between the separated resources. Technology.

RFC6749

There are two problems with current licensing techniques.
First, technically, the client (the service to which the user's partial authority is delegated) can use the data that passes freely, and if there is malicious intent, the user's information can be used by a third party. It is a point that can be leaked.
Second, the authority delegation source service (resource server) must individually manage the delegation destination service (client) by URL, etc., and the connection destination is limited even though it is an open API. It must be managed, and free connection cannot be realized.

  In the conventional B2B2C framework, there is generally no means for preventing an intermediate B from leaking information obtained during processing to the outside. For this reason, in a service that handles highly privacy information such as finance, free competition between clients by the open API has been hindered. In addition, at present, in order to view account information of a plurality of banks, the service must store user IDs and passwords, perform proxy login and scraping, and there is a risk of password leakage.

That is, the prior art has the following problems.
APIs (Application Programming Interfaces) that use various data and devices handled in daily life are shared or opened, and users can use services via third-party services (clients) that access the APIs. It is desired. For that purpose, it is necessary for the user to delegate a part of the authority in the service he uses to the third party service. However, there is currently no technical solution for preventing a malicious third party service from misusing the delegated authority to leak the user's personal information to the outside.

  In OAuth2, it is assumed that the certificate of a trusted certificate authority that is issued is checked against the HTTPS redirect destination URL to the third party service as a means of confirming the reliability of the intermediate application. This is a social contract restriction, and technical information leakage prevention is not guaranteed.

  Therefore, in order to solve the above problems, the present invention provides a network service cooperation method, a client service platform, a client instance generation server, and a program capable of preventing technical information leakage with respect to a third-party service in which a user accesses an API. The purpose is to provide.

  In order to achieve the above-described object, the present invention provides a method in which a service has personal information of a user and provides an API that allows other services to use the user's own service. When a service is used, a closed network that connects the service and the other service is dynamically generated so that the service does not leak information about the service to the outside.

Specifically, the network service cooperation method according to the present invention includes:
As an instance, a client that can use an open API of a resource server that provides a desired service for each user terminal,
A network service cooperation method for generating a client service platform comprising: a client gateway via access from the user terminal to the client instance; and a service gateway via access from the client instance to the resource server. ,
Along with the generation of the client instance, a firewall function is generated that blocks access to the client instance from other than the client gateway and access from the client instance to other than the service gateway.

In addition, the client service platform according to the present invention is:
A client instance generation server that generates, as an instance, a client that can use an open API of a resource server that provides a desired service for each user terminal;
A client gateway via access from the user terminal to the client instance;
A service gateway via access from the client instance to the resource server;
A client service platform with
The client instance generation server generates a firewall function that blocks access to the client instance from other than the client gateway and access from the client instance to other than the service gateway along with the generation of the client instance. It is characterized by.

Furthermore, the client instance generation server according to the present invention includes:
As an instance, a client that can use an open API of a resource server that provides a desired service for each user terminal,
A client instance generation server for generating a client service platform comprising: a client gateway via access from the user terminal to the client instance; and a service gateway via access from the client instance to the resource server. ,
Along with the generation of the client instance, a firewall function is generated that blocks access to the client instance from other than the client gateway and access from the client instance to other than the service gateway.

  In the present invention, the protection of user information on the user side in service cooperation is evolved from the mechanism of Oauth2 (RFC 6749) based on the technology of Faas (Function as a Service) and the latest container technology. .

  As described above, there is the Auth2 standard as an authorization technique in the case of “I want other services to use my service, but I do not want other services to know the user ID and password of my service”. However, in Auth2, it is not assumed that “when other service uses the own service, the customer data of the own service is prevented from being leaked outside via the other service”. This is because the server of the other service is under the management of the other service provider.

  In recent years, with the development of cloud technology and edge technology, the degree of freedom in service arrangement has increased, and as its ultimate form, Faas (Function as a Service), which activates functions only when the service is required, has attracted attention. ing.

  Therefore, the present invention limits the other services that use the open API to FaS, and creates an instance of the other service dynamically for each end user of the own service that is placed under a specific platform and uses the other service. Then, the above problem is solved by dynamically constructing or arranging a virtual network for protecting information.

  Specifically, when creating a client instance, access to the "client instance" from outside the "client gateway", and from the "client instance" to the "service gateway" and "resources for clients" -A firewall is installed on the instance to block communication for access to anything other than the database.

  Therefore, the present invention can provide a network service cooperation method, a client service platform, and a client instance generation server that can prevent technical information leakage with respect to a third party service in which a user accesses an API.

The detailed operation is as follows.
The firewall function is
An access token for confirming the validity of the client instance is acquired from the resource server side to the client gateway and transferred from the user terminal to the service gateway via the client gateway and the client instance. And adding the access token to
The identification information of the user terminal, the address of the resource server, and the address of the client instance are notified from the client gateway to the service gateway, and transferred from the client instance to the service gateway at the service gateway. The transmission source and the transmission destination of the access are confirmed.

  A program according to the present invention is a program for causing a computer to function as the client instance generation server. The client instance generation server according to the present invention can be realized by a computer and a program, and can be recorded on a recording medium or provided through a network.

  The present invention can provide a network service cooperation method, a client service platform, a client instance generation server, and a program that can prevent technical information leakage for a third party service in which a user accesses an API.

It is a figure explaining the network service cooperation method which concerns on this invention.

  Embodiments of the present invention will be described with reference to the accompanying drawings. The embodiments described below are examples of the present invention, and the present invention is not limited to the following embodiments. In the present specification and drawings, the same reference numerals denote the same components.

[Overview]
The terms such as “entity”, “client”, “authorization code”, “access token”, “resource server”, and “authorization server” in the present embodiment use OAuth2 (Non-Patent Document 1).

  This embodiment is a technique for preventing a “client” using an open API of a “resource server” from connecting to a third party unintended by an “entity” via a network.

  In this embodiment, the “authorization” mechanism of OAuth has been developed with FaaS technology, and by adopting virtual network technology, the “client” itself, which has been considered difficult in the past, can use the information of the “resource server”. This prevents the “client” from leaking to a third party.

  In this embodiment, the authorization code issued when the user is authenticated to the service authorization server and the access from the client is checked against the authorization server when the entity accesses the client, and the access token is issued. Receive. As a result, the connection destinations are dynamically restricted using the control group technology of the OS. In addition, information such as passwords and money transfer destinations that the client wants to keep secret is accessed in advance by a method different from the client. Note that this technology does not cover authentication. In addition, a client that can be modified on the user side, such as a dedicated application for a portable terminal or a Web application written in Java (registered trademark) Script, is not targeted.

  This embodiment assumes a system that is connected by a Web browser and does not place important information such as a service password on the user side (Authentication Flow in OAuth). Currently, information is not leaked to other sites from a general Web browser unless there is a special permission such as CORS.

It is assumed that all communication between roles in this embodiment is performed by HTTPS (TCP), and the IP address of the connection destination is uniquely determined from the URL.
In addition, the roll of this embodiment is as follows.
In the present invention, there are five independent roles for realizing a secure intermediate service (client).
(1) Entity User terminal. Assume a personal computer web browser or mobile terminal.
(2) Client service platform This is a platform for operating secure clients. Assuming operation by a service provider, the configuration includes the following.
-Client gateway-Service gateway-Client instance generation server-Client instance-Client resource database-Client monitor monitor (not required, not shown in Figure 1)
(3) Services Provide services to users. In this embodiment, the user does not use the service directly, but uses it via the client. Services include:
-Authorization server-Resource server (4) Client Access to services on behalf of users.
(5) Certificate issuer The certificate may be issued but not required. Not shown in FIG.

[Service linkage initial settings]
(Procedure 1) The client service developer places the developed client software on the “client instance generation server” of the “client service platform”.
Here, the client developer may store the authentication information of the person who uses the client, the address of the access destination service, and the like in the client software. The arranged client software may be arbitrarily updated.
The client developer may add a client certificate (issued by a third party) to the client software and use the certificate when accessing the service resource (resource server).
(Procedure 2) The client service platform issues (pauses) a unique URL to the arranged client. The user uses the client through access to this URL. This URL may be incorporated into software in the terminal on the entity side.

[Details of operation]
FIG. 1 is a diagram illustrating a network service cooperation method according to this embodiment. This network service linkage method
The client instance 13 that can use the open API of the resource server 17 that provides a desired service for each user terminal 102 is used as an instance.
A network service cooperation method for generating a client service platform 301 including a client gateway 11 via access from the user terminal 102 to the client instance 13 and a service gateway 12 via access from the client instance 13 to the resource server 17 Because
Along with the generation of the client instance 13, a firewall function is generated that blocks access to the client instance 13 from other than the client gateway 11 and access from the client instance 13 to other than the service gateway 12.

The firewall function is
An access token for confirming the validity of the client instance 13 is acquired from the service 101 to the client gateway 11, and the access is transferred from the user terminal 102 to the service gateway 12 via the client gateway 11 and the client instance 13. Adding the access token,
The identification information of the user terminal 102, the address of the resource server 17 and the address of the client instance 13 are notified from the client gateway 11 to the service gateway 12, and transferred from the client instance 13 to the service gateway 12 by the service gateway 12. Confirm the source and destination of the access.

The client service platform 301
A client instance generation server 14 that generates, as an instance, a client instance 13 that can use the open API of the resource server 17 that provides a desired service for each user terminal 102;
A client gateway 11 via access from the user terminal 102 to the client instance 13,
A service gateway 12 through access from the client instance 13 to the resource server 17,
Is provided.
The client instance generation server 14 generates a client instance 13 and a firewall function that blocks access to the client instance 13 from other than the client gateway 11 and access from the client instance 13 to other than the service gateway 12. To do.

(Step S01)
The “entity (user terminal 102)” logs in to the “authorization server 16” of the service 101, indicates the range of authority for the client instance 13 to use the resource server 17, and includes “authorization code” and “resource server URL”. To get.
(Step S02)
The “entity” accesses the URL of the client instance 13 shown in (procedure 2) of the service cooperation initial setting. At that time, an entity that has not received the authentication of “client gateway 11” of “client service platform 301” logs in (authenticates) to “client gateway 11” with “user ID”.
Note that step S01 and step S02 may be reversed. In addition, after the login in step S02, it may be automatically redirected to the authorization server in step 1.
(Step S03)
The “entity” notifies the “client gateway 11” of the “authorization code” and “resource URL” acquired in step S01.
(Step S04)
The “client gateway 11” presents an “authorization code” to the “authorization server 16” and acquires an “access token”. Here, the reason why the entity does not directly acquire the access token is to prevent access to an unauthorized resource server due to theft or analysis of the entity.
(Step S05)
The “client gateway 11” notifies the “service gateway 12” of the “user ID” and “resource server address” of the user terminal 102.
(Step S06)
The “entity” accesses the client instance 13 via the “client gateway 11”.
(Step S07)
Based on the “user ID”, the “client gateway 11” confirms whether or not the “client instance 13” dedicated to the user having the ID in the “client service platform 301” is formed as an instance. . If “client instance 13” does not exist, “client instance generation server 14” is instructed to generate “client instance 13”.
(Step S08)
The “client instance generation server 14” generates a “client instance 13” unique to the “user ID” as an instance, and returns an address for accessing the client instance 13 to the “client gateway 11”. At that time, the “client service platform 301” prepares a “client resource database 15” for storing user information for a long period of time for each user ID, and only the information about the “client resource database 15” (such as an access token). ) Storage or acquisition may be allowed.
(Step S09)
The “client gateway 11” notifies the “service gateway 12” of the address of the “client instance 13”.
(Step S10)
The “client gateway 11” adds an “access token” to the URL or the like for the access from the “entity”, and transfers the access to the “client instance 13”.
(Step S11)
The “client instance 13” gives the “access token” received in step S10 when accessing the “resource server 17” of the service.
(Step S12)
The HTTPS communication packet that accesses the “resource server 17” from the “client instance 13” is checked at the “service gateway 12” for its source and destination addresses. It is confirmed that the source and destination addresses match the address information notified in steps S05 and S09.
(Step S13)
A packet that has passed through “service gateway 12” accesses “resource server 17” and receives a service. The “resource server 17” confirms the validity of the “client instance 13” with the access token.

The operation described in FIG. 1 has the following characteristics.
(A) The entity is premised on a Web browser. Web browsers are equipped with a mechanism called “Same Origin Policy” that prevents information acquired from a server from leaking outside.
(B) The entity does not store an access token necessary for accessing the resource server 17. Therefore, even if a third party can analyze the internal state of the browser on the entity side by shortening the validity period of the authorization code, if the validity period of the authorization code is passed, access to the resource server 17 is not Can not.
(C) The access destination of the third party service (client instance 13) is limited to the resource server 17 by the client gateway 11 and the service gateway 12 that use the communication path by the client service platform 301. Since the client service platform 301 prevents access to others through the network, the client instance 13 cannot leak information about the privacy of the user that the client instance 13 has acquired.

  Therefore, the network service cooperation method described in this embodiment is a malicious third party when using a third party service (client) that uses an open API of a service used by a user from a mobile terminal or a personal computer. It is possible to prevent the service (client) from leaking information related to the user service to others.

  In the network service cooperation method according to the present invention, a quality management service for notifying the service operating company of the operating state of the service instance as the usage rate of the CPU or DB may be separately prepared. At that time, it should be considered so that information can be confirmed by a third party so that information is not leaked via information such as logs, or that only objective performance information can be notified to the service developer.

11: Client gateway 12: Service gateway 13: Client instance 14: Client instance generation server 15: Client resource database 16: Authorization server 17: Resource server 101: Service 102: User terminal (entity)
301: Client Service Platform

Claims (5)

As an instance, a client that can use an open API of a resource server that provides a desired service for each user terminal,
A network service cooperation method for generating a client service platform comprising: a client gateway via access from the user terminal to the client; and a service gateway via access from the client to the resource server,
A network service cooperation method, characterized in that, together with the generation of the client instance, a firewall function is generated that blocks access to the client from other than the client gateway and access from the client to other than the service gateway. The firewall function is
An access token for confirming the validity of the client instance is acquired from the resource server side to the client gateway, and the access is transferred from the user terminal to the service gateway via the client gateway and the client. Adding the access token,
The identification information of the user terminal, the address of the resource server and the address of the client instance are notified from the client gateway to the service gateway, and transferred from the client to the service gateway at the service gateway. The network service cooperation method according to claim 1, wherein an access transmission source and a transmission destination are confirmed. A client instance generation server that generates, as an instance, a client that can use an open API of a resource server that provides a desired service for each user terminal;
A client gateway via access from the user terminal to the client;
A service gateway via access from the client to the resource server;
A client service platform with
The client instance generation server generates a firewall function that blocks access to the client from other than the client gateway and access from the client to other than the service gateway along with the generation of the client instance. And a client service platform. As an instance, a client that can use an open API of a resource server that provides a desired service for each user terminal,
A client instance generation server that generates a client gateway through access from the user terminal to the client instance and a service gateway through access from the client to the resource server;
A client instance generation server that generates a firewall function that blocks access to the client instance from other than the client gateway and access from the client to other than the service gateway together with generation of the client instance .   The program for functioning a computer as a client instance production | generation server of Claim 4.

Images