WO2021014633A1 - Information processing system, access control device, access control method, and access control program - Google Patents

Abstract

The present invention suppresses a delay in a data process in which an additional program is used.　A data processing device stores data including a plurality of data items, and if a recorded program is present, the recorded program is executed in accordance with an update of the data. An access control device receives a registration request including a target program of a user, the target program is analyzed, and data items that can be accessed from the target program, among the plurality of data items, are detected. The access control device assesses whether the user has access rights to the detected data items on the basis of access control information indicating data items to which the user has or does not have access rights. The access control device permits registration of the target program on the data processing device when it has been assessed that the user has access rights.

Description

Information processing system, access control device, access control method and access control program

The present invention relates to an information processing system, an access control device, an access control method, and an access control program.

As an information processing system, there is an event processing system that collects event messages from various terminal devices, updates the data held by the information processing system according to the event message, and executes information processing according to the update of the data. For example, an information processing system collects event messages including sensor data measured by using a sensor device from a terminal device such as a smartphone or an in-vehicle device, and holds state data indicating the state of the terminal device. For example, an information processing system realizes an information service that detects an update of state data and provides information according to the current state of a terminal device.

It should be noted that an event forwarding method for forwarding an event message between a plurality of entity devices has been proposed. In the proposed event forwarding method, each entity device collates the attribute information of the received event message with the filter information registered in the router, and suppresses the forwarding of unnecessary event messages based on the collation result. In addition, a device management system that allows a device connected to a client device to be accessed from a server device has been proposed. In the proposed device management system, the client device controls to exclusively execute the data communication between the client application and the device and the data communication between the server device and the device. Further, a method of transmitting an event message between a plurality of entity devices of IoT (Internet of Things) has been proposed.

Japanese Unexamined Patent Publication No. 2004-302960 Japanese Unexamined Patent Publication No. 2008-4072 International Publication No. 2014/130568

There are times when you want to add a new information service that uses at least a part of those multiple data items to an information processing system that holds data that includes multiple data items. Therefore, it is conceivable to register a program of a certain user (for example, a certain developer) in the information processing system so that the program is executed in response to the update of data.

However, from the viewpoint of information security, some data items that the user may be allowed to access and some data items that the user does not want to be allowed to access may coexist in the various data items that are collected. Therefore, authentication of data access from the user's program becomes a problem. In this regard, it is also conceivable to refer to authentication information such as ACL (Access Control List) every time an access to a certain data item occurs after registering the program to determine whether or not the data item can be accessed. However, if the access authority is confirmed for each data access, the data processing may be delayed due to the overhead.

In one aspect, an object of the present invention is to provide an information processing system, an access control device, an access control method, and an access control program that can suppress a delay in data processing using an additional program.

In one aspect, an information processing system having a data processing device and an access control device is provided. The data processing device stores data including a plurality of data items, and if a registered program exists, executes the registered program in response to the update of the data. The access control device receives a registration request including the user's target program, analyzes the target program to detect a data item that can be accessed from the target program among a plurality of data items, and the data item or the user to which the user has access authority. Determines whether the user has access authority to the detected data item based on the access control information indicating the data item for which does not have access authority, and if it is determined to have access authority, registers the target program in the data processing device. Allow that.

Further, in one aspect, an access control device having a storage unit and a processing unit is provided. Also, in one aspect, an access control method executed by a computer is provided. Further, in one aspect, an access control program to be executed by a computer is provided.

On one side, delays in data processing with additional programs are suppressed.
The above and other objects, features and advantages of the present invention will become apparent by the following description in connection with the accompanying drawings representing preferred embodiments of the present invention.

It is a figure explaining the example of the information processing system of 1st Embodiment. It is a figure which shows the example of the information processing system of the 2nd Embodiment. It is a block diagram which shows the hardware example of a firewall. It is a block diagram which shows the functional example of a node. It is a block diagram which shows the functional example of a device object. It is a figure which shows the example of the state table and the plug-in table. It is a figure which shows the format example of a message. It is a block diagram which shows the functional example of a firewall. It is a figure which shows the example of the access control list and the analysis result table. It is a figure which shows the analysis example of a plug-in. It is a figure which shows the authentication example of a plug-in. It is a figure which shows the arrangement example of the plug-in through a firewall. It is a flowchart which shows the procedure example of plug-in generation. It is a flowchart which shows the procedure example of plug-in authentication. It is a flowchart which shows the procedure example of a plug-in addition. It is a flowchart which shows the procedure example of ACL update.

Hereinafter, the present embodiment will be described with reference to the drawings.
[First Embodiment]
The first embodiment will be described.

FIG. 1 is a diagram illustrating an example of an information processing system according to the first embodiment.
The information processing system of the first embodiment includes a data processing device 10 and an access control device 20. The data processing device 10 and the access control device 20 are connected to the network. The data processing device 10 and the access control device 20 can also be referred to as a computer, an information processing device, a server computer, a server device, or the like.

The data processing device 10 performs event-driven information processing in which data is stored and a program is executed in response to an update of the data. The information processing system of the first embodiment can also be referred to as an event processing system. The information processing system of the first embodiment may be a parallel processing system including two or more data processing devices. The data processing device 10 can also be called a node. A new program to be executed in response to the update of data can be registered in the data processing device 10. When registering a new program of a certain user in the data processing device 10, the access control device 20 confirms the access authority to the data of the user and determines whether or not the program can be registered. The access control device 20 can also be referred to as a firewall, a gateway, a security device, a program inspection device, or the like.

The data processing device 10 has a storage unit 11 and a processing unit 12. The access control device 20 has a storage unit 21 and a processing unit 22. The storage unit 11 and the storage unit 21 may be a volatile semiconductor memory such as a RAM (Random Access Memory) or a non-volatile storage such as an HDD (Hard Disk Drive) or a flash memory. The processing units 12 and 22 are processors such as a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), and a DSP (Digital Signal Processor), for example. However, the processing units 12 and 22 may include electronic circuits for specific purposes such as ASIC (Application Specific Integrated Circuit) and FPGA (Field Programmable Gate Array). The processor executes a program stored in a memory (may be storage units 11 and 21). A collection of multiple processors is sometimes referred to as a "multiprocessor" or simply a "processor."

The storage unit 11 stores the data 13. The data 13 includes a plurality of data items such as data items X, Y, and Z. A plurality of data items can also be referred to as a plurality of records. The data 13 may be key-value format data including a plurality of key / value pairs. Data 13 may be updated. The data 13 may be state data indicating the state of the terminal device, or may be updated in response to an event message transmitted from the terminal device to the data processing device 10. The storage unit 11 may store the program in association with the data 13. For example, the storage unit 11 stores the program in association with a specific data item.

The processing unit 12 may register a program for the data 13. This program is removable to data and can be called a plug-in. Program registration may be requested by the access control device 20. The registration of the program may be performed dynamically while the data processing device 10 is in operation. Further, the processing unit 12 detects the update of the data 13. For example, the processing unit 12 updates the data 13 in response to an event message received from the terminal device. If the registered program exists when the update of the data 13 is detected, the processing unit 12 starts the registered program. When the registered program is associated with a specific data item, the processing unit 12 may start the registered program when it detects an update of the value of the specific data item.

The storage unit 21 stores the access control information 24. The access control information 24 indicates a data item for which a certain user has access authority or a data item for which a user does not have access authority among a plurality of data items such as data items X, Y, and Z. The access control information 24 can also be referred to as an access control list (ACL). The access control information 24 may be a so-called white list or a black list. The access control information 24 is created in advance by, for example, an administrator.

The processing unit 22 receives a registration request including the target program 23 of a certain user. The registration request indicates a request for registration of the target program 23 in the data processing device 10. The target program 23 can also be called a plug-in. The target program 23 is, for example, created by the user who is the developer. The access control device 20 may receive a registration request from the development terminal used by the user. The target program 23 may be a source code written in a high-level language, an intermediate code converted from the source code and written in an intermediate language, or a machine-readable object code.

The processing unit 22 analyzes the target program 23 included in the registration request and detects a data item that can be accessed from the target program 23 among a plurality of data items such as data items X, Y, and Z. For example, the processing unit 22 uses a static program analysis method such as Abstract Interpretation to extract possible values of variables indicating data items of access destinations and specify data items that can be access destinations. The variable indicating the data item of the access destination is, for example, a variable used as an argument of the function for accessing the data 13.

The processing unit 22 determines whether or not the user has access authority to the detected data item based on the access control information 24. When there are two or more detected data items, the processing unit 22 determines whether or not the user has access authority to all of the two or more detected data items. For example, it is assumed that the data item Y is detected as an accessible data item from the target program 23. On the other hand, it is assumed that the access control information 24 indicates that the user has the access authority to the data items X and Y and does not have the access authority to the data item Z. In that case, the processing unit 22 confirms that the user has the access authority to the detected data item Y.

If it is determined that the user has access authority, the processing unit 22 permits the target program 23 to be registered in the data processing device 10. In that case, for example, the access control device 20 transfers the registration request including the target program 23 to the data processing device 10. As a result, the target program 23 is registered in the data processing device 10. For example, in the data processing device 10, when the data item Y of the data 13 is updated, the target program 23 is started. On the other hand, if it is determined that the user does not have the access authority, the processing unit 22 refuses to register the target program 23 in the data processing device 10. In that case, for example, the access control device 20 suppresses the transfer of the registration request including the target program 23 to the data processing device 10. The access control device 20 may send a rejection message to the development terminal.

According to the information processing system of the first embodiment, before registering the target program 23 in the data processing device 10, the target program 23 is analyzed to detect data items that can be accessed. Then, based on the access control information 24, it is determined whether or not the user has the access authority to the detected data item, and if the user has the access authority, the target program 23 processes the data so as to be executed in response to the update of the data 13. It is registered in the device 10. When the target program 23 accesses the data 13 after registration, the data processing device 10 does not have to confirm the access authority to the data item of the access destination.

As a result, even if the data 13 contains a mixture of data items for which access may be permitted to a certain user and data items for which access is not permitted, access control for each data item can be realized. , Information security can be improved. Further, after the target program 23 is registered, the confirmation of the access authority can be omitted in the data processing device 10, and the access control information 24 does not have to be referred to for each access. As a result, the overhead of confirming the access authority can be reduced as compared with the method of confirming the access authority at the time of actual access, and the delay in data processing of the data processing device 10 can be suppressed.

[Second Embodiment]
Next, a second embodiment will be described.
FIG. 2 is a diagram showing an example of an information processing system according to the second embodiment.

The information processing system of the second embodiment is a real-time dynamic event processing system that collects event messages from a device to a data center, processes the event messages in real time, and provides an event-driven service.

The information processing system of the second embodiment includes a data center 50 connected to the network 52, a plurality of devices such as devices 60, 60a, 60b, 60c, 60d, 60e, and development devices 70, 70a, 70b, and the like. Includes multiple development equipment. The data center 50 includes a firewall 100 connected to the network 51, a message server 200, a plurality of nodes such as nodes 300, 300a, 300b, and a plurality of business servers such as business servers 400, 400a, 400b.

The network 51 is, for example, a data communication network such as a LAN (Local Area Network). The network 52 is a wide area data communication network such as the Internet. The firewall 100 corresponds to the access control device 20 of the first embodiment, and the node 300 corresponds to the data processing device 10 of the first embodiment.

The devices 60, 60a, 60b, 60c, 60d, 60e are terminal devices that detect the occurrence of an event and transmit an event message indicating the event to the message server 200 via the network 52. The devices 60, 60a, 60b, 60c, 60d, 60e include the sensor data measured by the sensor in the event message and transmit it.

Devices 60, 60a, 60b are mobile terminal devices such as smartphones and tablet terminals, for example. The devices 60c, 60d, 60e are, for example, in-vehicle devices mounted on a vehicle. The devices 60, 60a, 60b, 60c, 60d, 60e may include the position information including the latitude and longitude measured by GPS (Global Positioning System) in the event message and transmit it. Further, the devices 60, 60a, 60b, 60c, 60d, 60e may include the current moving speed in the event message and transmit it.

The development devices 70, 70a, 70b are terminal devices used for developing application software to be operated in the data center 50. The development devices 70, 70a, 70b are used by application software developers and administrators. For example, the developer 70 is used by an administrator, the developer 70a is used by developer A, and the developer 70b is used by developer B, who is a different developer than the developer 70a.

The development devices 70, 70a, 70b can add a plug-in, which is a detachable application program, to the nodes 300, 300a, 300b without stopping the nodes 300, 300a, 300b. Further, the development devices 70, 70a, 70b can delete the plug-in from the nodes 300, 300a, 300b without stopping the nodes 300, 300a, 300b. At that time, the development devices 70, 70a, 70b send a control message indicating the addition or deletion of the plug-in to the firewall 100. The development device 70 used by the administrator sets the firewall 100 with control information indicating the conditions of the plug-ins that can be arranged at the nodes 300, 300a, and 300b.

The firewall 100 is a server computer that receives control messages from the development devices 70, 70a, 70b and determines whether or not the plug-in can be changed. Changes to the plug-ins of the nodes 300, 300a, and 300b are performed via the firewall 100. The firewall 100 can also be called a gateway, a security device, or the like. Also, regarding plugins, developers and administrators can be called users.

The firewall 100 holds control information indicating the conditions of plug-ins that can be placed on the nodes 300, 300a, and 300b. When the firewall 100 receives the control message from the development devices 70, 70a, 70b, the firewall 100 determines whether the plug-in change such as the addition or deletion of the plug-in required by the received control message satisfies a predetermined security condition. When the predetermined security condition is satisfied, the firewall 100 forwards the control message to the message server 200. On the other hand, if the predetermined security condition is not satisfied, the firewall 100 refuses to transfer the control message.

The message server 200 is a server computer that transfers messages such as event messages and control messages. The message server 200 has a message queue for holding received messages, and transfers each message to one of the nodes 300, 300a, and 300b. The message server 200 can also be called a load distribution device.

The message server 200 receives the event message from the devices 60, 60a, 60b, 60c, 60d, 60e and distributes the event message to the nodes 300, 300a, 300b. Further, the message server 200 receives the control message from the firewall 100 and distributes the control message to the nodes 300, 300a, 300b. A security check is performed on the control message by the firewall 100. Therefore, the message server 200 rejects control messages that do not pass through the firewall 100, such as control messages directly transmitted from the development devices 70, 70a, and 70b to the message server 200.

Nodes 300, 300a, 300b are server computers that distribute and process event messages of devices 60, 60a, 60b, 60c, 60d, 60e. The nodes 300, 300a, 300b disperse and hold state data indicating the states of the devices 60, 60a, 60b, 60c, 60d, 60e.

When the nodes 300, 300a, 300b receive the event message of the device managed by the other node, the node 300, 300a, 300b forwards the event message to the other node. When the nodes 300, 300a, and 300b receive the event message of the device managed by the own node, the nodes 300, 300a, and 300b update the state data of the device. For example, the nodes 300, 300a, 300b overwrite the sensor data included in the event message with the state data. When the plug-in is associated with the updated state data, the nodes 300, 300a, and 300b activate the associated plug-in.

Nodes 300, 300a, 300b execute a plug-in to process state data and start an event-driven information service. For example, the nodes 300, 300a, 300b detect a mobile terminal device existing in a predetermined area in response to an update of position information including latitude and longitude. Further, for example, the nodes 300, 300a, and 300b detect an in-vehicle device involved in a traffic jam in response to an update of speed information indicating a moving speed. Event-driven information services can be realized by adding plug-ins. The nodes 300, 300a, 300b may call the business servers 400, 400a, 400b forming an external business system according to the execution result of the plug-in.

Further, the nodes 300, 300a, 300b receive the control message from the message server 200. When the nodes 300, 300a, and 300b receive the control message whose plug-in change target is another node, the nodes 300, 300a, and 300b forward the control message to the other node. When the nodes 300, 300a, and 300b receive the control message whose plug-in change target is the own node, the nodes 300, 300a, and 300b add or delete the plug-in according to the control message. The binary program, which is the plug-in itself, is included in the control message and distributed. Therefore, it is possible to suppress the concentration of access to the common repository from a plurality of nodes.

The business servers 400, 400a, 400b are server computers that form an external business system for real-time dynamic event processing. The business servers 400, 400a, 400b receive the event processing result from the nodes 300, 300a, 300b, execute the business application based on the event processing result, and provide the business service.

For example, the business server 400 forms a personnel management system. The business server 400a forms a dashboard system that collects various types of information. In that case, the business server 400a may provide various information to the devices 60, 60a, 60b, 60c, 60d, 60e, or may provide various information to a predetermined administrator. The business server 400b forms an operation management system. In that case, the business server 400b may provide road traffic information to other systems, or may realize automatic driving control of each vehicle.

FIG. 3 is a block diagram showing an example of firewall hardware.
The firewall 100 includes a CPU 101, a RAM 102, an HDD 103, an image interface 104, an input interface 105, a medium reader 106, and a communication interface 107. The unit of the firewall 100 is connected to the bus. The CPU 101 corresponds to the processing unit 22 of the first embodiment. The RAM 102 or the HDD 103 corresponds to the storage unit 21 of the first embodiment. Devices 60, 60a, 60b, 60c, 60d, 60e, development devices 70, 70a, 70b, message server 200, nodes 300, 300a, 300b and business servers 400, 400a, 400b also have the same hardware as the firewall 100. ..

The CPU 101 is a processor that executes program instructions. The CPU 101 loads at least a part of the programs and data stored in the HDD 103 into the RAM 102 and executes the program. The CPU 101 may include a plurality of processor cores, and the firewall 100 may include a plurality of processors. A collection of multiple processors is sometimes referred to as a "multiprocessor" or simply a "processor."

The RAM 102 is a volatile semiconductor memory that temporarily stores a program executed by the CPU 101 and data used by the CPU 101 for calculation. The firewall 100 may include a type of memory other than RAM, or may include a plurality of memories.

HDD 103 is a non-volatile storage that stores software programs such as OS (Operating System), middleware, and application software, and data. The firewall 100 may be provided with other types of storage such as a flash memory or an SSD (Solid State Drive), or may be provided with a plurality of storages.

The image interface 104 outputs an image to the display device 111 connected to the firewall 100 in accordance with a command from the CPU 101. As the display device 111, any kind of display device such as a CRT (Cathode Ray Tube) display, a liquid crystal display (LCD: Liquid Crystal Display), an organic EL (OEL: Organic Electro-Luminescence) display, and a projector can be used. .. Further, an output device other than the display device 111 such as a printer may be connected to the firewall 100.

The input interface 105 receives an input signal from the input device 112 connected to the firewall 100. As the input device 112, any kind of input device such as a mouse, a touch panel, a touch pad, and a keyboard can be used. Further, a plurality of types of input devices may be connected to the firewall 100.

The medium reader 106 is a reading device that reads programs and data recorded on the recording medium 113. As the recording medium 113, any kind of recording medium such as a magnetic disk such as a flexible disk (FD) or HDD, an optical disk such as a CD (Compact Disc) or a DVD (Digital Versatile Disc), or a semiconductor memory is used. Can be done. The medium reader 106, for example, copies a program or data read from the recording medium 113 to another recording medium such as the RAM 102 or the HDD 103. The read program is executed by, for example, the CPU 101. The recording medium 113 may be a portable recording medium, and may be used for distribution of programs and data. Further, the recording medium 113 and the HDD 103 may be referred to as a computer-readable recording medium.

The communication interface 107 is connected to the network 51 and communicates with other information processing devices. The communication interface 107 is a wired communication interface connected to, for example, a wired communication device such as a switch or a router.

Next, real-time dynamic event processing will be described.
FIG. 4 is a block diagram showing a functional example of the node.
The nodes 300, 300a, 300b have the following software modules. The node 300 has a plurality of message forwarding units such as message forwarding units 310 and 310a, a plurality of device objects such as device objects 320 and 320a, and one or more service objects such as service object 330. The node 300a has a plurality of message forwarding units such as message forwarding units 310b and 310c, a plurality of device objects such as device objects 320b and 320c, and one or more service objects such as service object 330a. The node 300b has a plurality of message forwarding units such as message forwarding units 310d and 310e, a plurality of device objects such as device objects 320d and 320e, and one or more service objects such as service object 330b.

The message server 200 receives the event message, distributes the event message to the message forwarding units 310, 310a, 310b, 310c, 310d, 310e and transfers the event message. Event messages are distributed by, for example, a round robin method. The message forwarding units 310, 310a, 310b, 310c, 310d, 310e determine the device object corresponding to the device that transmitted the event message, and transfer the event message to the determined device object. At this time, it is assumed that the message forwarding units 310, 310a, 310b, 310c, 310d, 310e know which device object is arranged on which node. The transfer destination device object may be on the same node or on another node.

The device objects 320, 320a, 320b, 320c, 320d, 320e manage state data indicating the state of the device. One device object corresponds to one device. Specifically, the device object 320 corresponds to the device 60. The device object 320a corresponds to the device 60a. The device object 320b corresponds to the device 60b. The device object 320c corresponds to the device 60c. The device object 320d corresponds to the device 60d. The device object 320e corresponds to the device 60e.

When the device objects 320, 320a, 320b, 320c, 320d, 320e receive the event message, they update their own state data using the sensor data included in the event message. The state data is key-value format data in which a key and a value are associated with each other. When a certain key / value pair is included in the event message, the device objects 320, 320a, 320b, 320c, 320d, 320e overwrite the value corresponding to the key in the state data.

In the device objects 320, 320a, 320b, 320c, 320d, 320e, it is possible to associate the plug-in with the key of the state data. The control message that adds the plug-in specifies the target device object and the target key. Therefore, different plug-ins may be placed depending on the device object. Also, two or more plug-ins may be placed on the same device object. The two or more plug-ins may be associated with the same key or different keys. One plugin may be associated with more than one key.

The device objects 320, 320a, 320b, 320c, 320d, 320e activate the plug-in when the plug-in is associated with the key whose value has been updated. The device objects 320, 320a, 320b, 320c, 320d, 320e may refer to or update state data according to the plug-in, and may generate other event messages and send them to any service object. ..

Service objects 330, 330a, 330b are objects corresponding to information services. For example, the service objects 330, 330a, 330b detect devices existing in a predetermined area, detect devices having a moving speed less than the threshold value, detect devices having a moving speed exceeding the threshold value, and the like. The service objects 330, 330a, 330b may receive event messages from the device objects 320, 320a, 320b, 320c, 320d, 320e as the plug-in is executed.

The device object from which the event message is sent may be on the same node or on another node. Which device object sends the event message to which service object depends on the implementation of the plug-in. Service objects 330, 330a, 330b may hold state data. The service objects 330, 330a, 330b perform data processing based on the received event message and state data. As a result, the service objects 330, 330a, 330b may send a message to any of the business servers.

Further, the message server 200 receives the control message from the firewall 100, distributes the control message to the message forwarding units 310, 310a, 310b, 310c, 310d, 310e and transfers the control message. The message forwarding units 310, 310a, 310b, 310c, 310d, 310e determine the device object to be changed by the plug-in, and transfer the control message to the determined device object.

When the device objects 320, 320a, 320b, 320c, 320d, 320e receive the control message for adding the plug-in, the device object 320, 320a, 320b, 320c, 320d, 320e saves the plug-in included in the control message in association with the key specified in the control message. This will cause the plugin to run when the value corresponding to that key is updated. Further, when the device objects 320, 320a, 320b, 320c, 320d, 320e receive the control message for deleting the plug-in, the device objects 320, 320a, 320b, 320c, 320d, and 320e delete the plug-in specified in the control message. In this way, the developer can dynamically add or remove plugins.

FIG. 5 is a block diagram showing a functional example of the device object.
The device object 320 has a state storage unit 321, a plug-in storage unit 322, a message determination unit 323, a state management unit 324, a plug-in management unit 325, and a plug-in execution unit 326. Other device objects have similar modules. For the state storage unit 321 and the plug-in storage unit 322, for example, the storage area allocated to the device object 320 in the storage area of the RAM is used. The message determination unit 323, the state management unit 324, the plug-in management unit 325, and the plug-in execution unit 326 are implemented using, for example, a program.

The state storage unit 321 stores state data in the key value format. State data contains one or more key / value pairs. The plug-in storage unit 322 stores the plug-in in association with the key included in the state data. The control message received by the device object 320 contains a compiled plug-in program. The plug-in is arranged executablely on the device object 320.

The message determination unit 323 receives a message from any of the message forwarding units and determines the type of the received message. Message types include events, add plugins, and delete plugins. The message determination unit 323 outputs an event message to the state management unit 324. Further, the message determination unit 323 outputs a control message indicating the addition or deletion of the plug-in to the plug-in management unit 325.

The state management unit 324 acquires an event message from the message determination unit 323. Then, the state management unit 324 extracts the key / value pair from the event message. An event message may contain more than one key / value pair. The state management unit 324 searches the state data stored in the state storage unit 321 for the key extracted from the event message, and updates the value of the state data corresponding to the key to the value extracted from the event message. .. If the key extracted from the event message does not exist in the state data, the state management unit 324 may add the extracted key / value pair to the state data.

The plug-in management unit 325 acquires a control message for adding a plug-in from the message determination unit 323. Then, the plug-in management unit 325 stores the plug-in included in the control message in the plug-in storage unit 322 in association with the key specified in the control message. Further, the plug-in management unit 325 acquires a plug-in deletion control message from the message determination unit 323. Then, the plug-in management unit 325 deletes the plug-in specified in the control message from the plug-in storage unit 322.

When adding a plug-in, the plug-in management unit 325 may perform conversion processing on the program of the plug-in included in the control message so that the plug-in is executed immediately in response to the update of the state data. .. For example, the plug-line program contained in a control message may be bytecode compiled from source code and written in a given low-level language. In that case, it is conceivable that the plug-in management unit 325 converts the bytecode into an executable class using a class loader, and registers the converted plug-in in a state in which it can be called immediately.

The plug-in execution unit 326 detects that the value corresponding to the state data key has been updated by the state management unit 324. Then, the plug-in execution unit 326 searches for the plug-in associated with the key whose value has been updated. If the corresponding plug-in exists, the plug-in execution unit 326 executes the plug-in. Even if the value corresponding to a certain key is overwritten according to the event message, if the value has not changed from before the overwriting, it may be considered that the value has not been updated.

FIG. 6 is a diagram showing an example of a state table and a plug-in table.
The state table 327 is stored in the state storage unit 321. One or more records in which a key and a value are associated are registered in the state table 327. Keys include, for example, velocity, latitude, longitude, and so on. The value corresponding to these keys is measured by the device 60 using the sensor, included in the event message, and transmitted. For example, the device 60 periodically sends an event message containing these values.

When the device object 320 receives the event message including the value of "speed", it associates with "speed" and overwrites the value in the state table 327. Similarly, when the device object 320 receives the event message including the value of "latitude", it associates with "latitude" and overwrites the value in the state table 327. When the device object 320 receives the event message including the value of "longitude", it associates with "longitude" and overwrites the value in the state table 327. Plugins can be added for speed, latitude and longitude.

The plug-in table 328 is stored in the plug-in storage unit 322. A binary program (plug-in binary) of a plug-in is registered in the plug-in table 328 in association with one or more keys. Plugin binaries created by different developers can be registered in the plugin table 328. For example, the plug-in A1 created by the developer A is registered for "speed", and the plug-in B1 created by the developer B is registered for "latitude" and "longitude".

In this case, when the value of "speed" in the state table 327 is updated, the device object 320 will activate the plug-in A1. When the value of "latitude" in the state table 327 is updated, the device object 320 will activate the plug-in B1. When the value of "longitude" in the state table 327 is updated, the device object 320 will activate the plug-in B1.

FIG. 7 is a diagram showing an example of message format.
The message determination unit 323 may receive the event message 61, the plug-in addition control message 71, and the plug-in deletion control message 72.

The event message 61 includes an object ID, a type, and sensor data. The object ID is an identifier that identifies the device object. The object ID can also be said to be an identifier that identifies the device. The object ID is given by the device that generates the event message 61 and is referenced to identify the destination device object for the event message 61. The type of event message 61 is "event". The sensor data contains one or more key / value pairs.

The control message 71 includes an object ID, a type, a user ID, a key, a plug-in ID, and a plug-in binary. The object ID is an identifier that identifies the object to which the plug-in is added. The object ID is referenced to identify the destination device object for control message 71. The type of control message 71 is "addition". The user ID is an identifier that identifies the developer or administrator who created the plug-in. The key indicates the key to which the plug-in is added. The plug-in ID is an identifier that identifies the plug-in. The plug-in ID may be an identifier calculated from the plug-in itself, such as a hash value of the plug-in binary. A plug-in binary is a pre-compiled binary format program for a plug-in.

The control message 72 includes an object ID, a type, a user ID, a key, and a plug-in ID. The object ID is an identifier that identifies the object for which the plug-in is to be deleted. The object ID is referenced to identify the destination device object for control message 72. The type of control message 72 is "delete". The user ID is an identifier that identifies the developer or administrator who deletes the plug-in. The key indicates the key for which the plug-in is to be deleted. However, when the plug-in is associated with two or more keys, the association with only some keys may be canceled and the association with other keys may be left. The plug-in ID is an identifier that identifies the plug-in.

Next, the security of the state data possessed by the device objects 320, 320a, 320b, 320c, 320d, 320e will be described.
As described above, plug-ins of different users can be mixed and placed on the same device object. The plug-in may read the value from the state data and may write the value to the state data. At this time, from the viewpoint of information security, the state data may have a value that allows access to a certain user and a value that does not want to allow access to the user. Therefore, it is preferable to control access to state data from the plug-in on a key-by-key basis.

As an access control method, a centralized management server that holds an access control list (ACL) is provided outside the real-time dynamic event processing system, and the centralized management server is inquired for access availability each time a plug-in accesses state data. Is also possible. However, this method increases the overhead of confirming access authority, and may reduce the throughput of real-time dynamic event processing.

Also, as an access control method, it is conceivable to copy the ACL to the nodes 300, 300a, 300b and check the access authority in the node every time the plug-in accesses the state data. However, even with this method, the overhead of confirming access authority increases, and the throughput of real-time dynamic event processing may decrease. In addition, it may be difficult to maintain the consistency of ACLs of a plurality of nodes when updating ACLs.

Therefore, in the second embodiment, the firewall 100 analyzes the plug-in and confirms that it conforms to the ACL before arranging the plug-in on the nodes 300, 300a, and 300b. Then, after it is confirmed that the plug-in conforms to ACL, it is omitted to check the access authority when accessing the state data from the plug-in. As a result, it is possible to reduce the access control overhead when executing the plug-in and improve the throughput of real-time dynamic event processing.

However, since confirmation of access authority at the time of access is omitted, if the security policy indicated by ACL is changed after the fact by the administrator, the existing installed plug-in may not conform to the updated ACL. .. Therefore, the firewall 100 automatically revalidates the existing plug-in when the administrator updates the ACL.

FIG. 8 is a block diagram showing a functional example of the firewall.
The firewall 100 includes an ACL storage unit 121, an analysis result database 122, a message communication unit 123, a plug-in analysis unit 124, an authentication unit 125, and an ACL update unit 126. The ACL storage unit 121 and the analysis result database 122 are implemented using, for example, the storage area of the RAM 102 or the HDD 103. The message communication unit 123, the plug-in analysis unit 124, the authentication unit 125, and the ACL update unit 126 are implemented using, for example, a program executed by the CPU 101.

The ACL storage unit 121 stores an access control list (ACL) in which a user, an object, and a key for permitting access are associated with each other. The ACL is created in advance by the administrator. ACLs may also be updated ex post facto by administrators. When a user develops a plugin and tries to add it to an object, the plugin is allowed to be added if all the keys that the plugin can access match the ACL. Will be done. In the second embodiment, the whitelist type ACL indicating the key for which access is permitted is used, but the blacklist type ACL indicating the key for which access is not permitted may be used.

The analysis result database 122 is a history database that stores the analysis results of the existing plug-ins added to the nodes 300, 300a, and 300b. The analysis result stored in the analysis result database 122 is referred to in order to suppress the re-analysis of the existing plug-in when updating the ACL. However, the firewall 100 may not have the analysis result database 122 and may re-analyze the existing plug-in when updating the ACL.

The message communication unit 123 receives a control message from the development devices 70, 70a, 70b. The message communication unit 123 outputs a control message for adding the plug-in to the plug-in analysis unit 124, and acquires the authentication result of the plug-in from the authentication unit 125. When the authentication is successful, that is, when the addition of the plug-in is permitted, the message communication unit 123 forwards the control message to the message server 200. On the other hand, when the authentication fails, that is, when the addition of the plug-in is refused, the message communication unit 123 does not forward the control message to the message server 200, but notifies the development device that sent the control message of the error.

Note that the firewall 100 may forward the plug-in deletion control message to the message server 200 without performing authentication. Further, the firewall 100 may forward the plug-in deletion control message to the message server 200 after confirming the deletion authority. The firewall 100 may delete the analysis result of the plug-in to be deleted from the analysis result database 122.

The plug-in analysis unit 124 acquires a control message for adding a plug-in from the message communication unit 123. Then, the plug-in analysis unit 124 analyzes the plug-in binary included in the control message and extracts the key that may be accessed from the plug-in. A static program analysis method such as abstract interpretation is used to extract the key. For example, the plug-in analysis unit 124 detects a variable used as an argument of a function that accesses state data, and extracts a value that the variable can take as a key that may be accessed.

The plug-in analysis unit 124 outputs the analysis result to the authentication unit 125. Further, when the authentication unit 125 determines that the authentication is successful, the plug-in analysis unit 124 saves the authentication result in which the user, the object, the plug-in, and the access destination key are associated with each other in the analysis result database 122.

The authentication unit 125 acquires the analysis result from the plug-in analysis unit 124. Then, the authentication unit 125 determines whether all the keys that may be accessed match the ACL stored in the ACL storage unit 121. That is, the authentication unit 125 searches the ACL for the access permission key corresponding to the user who created the plug-in and the target object. The authentication unit 125 determines whether each of the keys extracted by the plug-in analysis unit 124 belongs to the range of the access permission key indicated by the ACL. If all of the extracted keys match the ACL, the authentication unit 125 permits the addition of the plug-in and notifies the message communication unit 123 of the successful authentication. On the other hand, if some of the extracted keys do not match the ACL, the authentication unit 125 refuses to add the plug-in and notifies the message communication unit 123 of the authentication failure.

The ACL update unit 126 receives an ACL update message including a new ACL from the development device 70 used by the administrator. Then, the ACL update unit 126 reads the analysis result of the existing plug-in arranged in the nodes 300, 300a, 300b from the analysis result database 122. The ACL update unit 126 determines whether the key that may be accessed from the existing plug-in matches the new ACL in the same manner as the authentication unit 125.

When the old ACL is updated to the new ACL, the existing plug-in that was compatible with the old ACL may not be compatible with the new ACL. If there is a non-conforming existing plug-in, the ACL update unit 126 sends a warning message to the development device 70 used by the administrator. Then, the ACL update unit 126 replaces the old ACL of the ACL storage unit 121 with the new ACL.

FIG. 9 is a diagram showing an example of an access control list and an analysis result table.
The access control list 127 is stored in the ACL storage unit 121. One or more records including a user ID, an object ID, and a key are registered in the access control list 127. The user ID is an identifier that identifies a user including a developer and an administrator. The object ID is an identifier that identifies the device object on which the plug-in is placed. As the object ID, an identifier of one device object may be specified, such as "car001". Further, as the object ID, the range of the identifier of the device object may be specified by using the class name indicating the type of the device such as "car". Further, in the object ID, a wild card (*) representing an arbitrary character string may be used.

The key is an access permission key that allows access from the plug-in. As the access permission key, one specific key such as "speed" may be specified. Further, in the access permission key, a regular expression may be used, or a wildcard (*) may be used to specify a range of keys. You can specify the prefix of the key to allow access by adding a wildcard at the end. For example, by describing "a *", all keys starting with "a" such as "a", "aa", and "ab" can be specified.

Depending on the real-time dynamic event processing system, a plug-in placed in one object may access the state data of another object by sending a message to the other object. In that case, it is conceivable to extend the access control list 127 so as to include a user ID, an access source object ID, an access destination object ID, and a key. The access source object ID is an identifier that identifies the object in which the plug-in is placed. The access destination object ID is an identifier that identifies the object to which the access destination state data belongs.

The analysis result table 128 is stored in the analysis result database 122. One or more records including a user ID, an object ID, a plug-in ID, and an analysis result are registered in the analysis result table 128. The user ID is an identifier that identifies the user who created the plug-in. The object ID is an identifier that identifies the device object in which the plug-in is placed. The plug-in ID is an identifier that identifies the placed plug-in. The analysis result shows the key that may be accessed from the plug-in and whether the access method is value read (read) or value write (write).

From the viewpoint of verifying whether the existing plug-in conforms to the new ACL, the analysis result table 128 does not have to include the plug-in ID. The plug-in ID may be used to remove an existing plug-in that does not conform to the new ACL when an existing plug-in that does not conform to the new ACL is detected. Further, the analysis result table 128 may be divided and normalized into a table in which the plug-in ID, the key, and the access method are associated with each other, and a table in which the user ID, the object ID, and the plug-in ID are associated with each other.

Next, an analysis example and an authentication example of the plug-in will be described.
FIG. 10 is a diagram showing an analysis example of the plug-in.
Here, for ease of explanation, the plug-in is described in source code format. Actually, the plug-in analysis unit 124 analyzes the compiled plug-in binary.

The plug-in program 131 is an example of a plug-in. In the plug-in program 131, the initial value of the variable namespace is set to the character string "expleSumPlugin". Next, while the loop variable i changes from 0 to 9, the variable namespace with "." And the value of the loop variable i added to the end is assigned to the variable field, and the state data is assigned using the value of the variable field as a key. A numerical value is read from, and the numerical value is added to the variable sum. Next, it is determined whether the value of the variable sum is an even number. If it is an even number, ".outut.even" is added to the final skill of the variable namespace, and if it is an odd number, ".outut.odd" is added to the final skill of the variable namespace. Finally, the state data is updated with the value of the variable namespace as the key and the value of the variable sum as the value.

The plug-in analysis unit 124 analyzes the plug-in program 131 by abstract interpretation. In the abstract interpretation, the plug-in analysis unit 124 detects an assignment instruction that assigns a value to a variable, and adds an annotation indicating a value that the variable can take at that time for each assignment instruction. Variables in the source code correspond to registers in the bytecode, and in the analysis of the plug-in binary, annotations are added for each assignment instruction that assigns a value to the register.

From the plug-in program 131, the plug-in program 132 with annotations is generated. In the plug-in program 132, the range of the variable namespace when initializing the variable namespace is "expleSumPlugin". The range of the variable field when assigning a value to the variable field in the loop is "instanceSumPlugin. *". Here, "*" is a wild card representing an arbitrary character string. The range of the variable namespace when it is determined that the value of the variable sum is an even number is "expleSumPrugin.output.even". The range of the variable namespace when it is determined that the value of the variable sum is an odd number is "explexsumPlugin.output.odd". The range of the final variable namespace is "sampleSumPlugin.output. *".

Next, the plug-in analysis unit 124 detects a function getState that reads the value from the state data and a function setState that writes the value to the state data. The plug-in analysis unit 124 extracts an argument indicating a key from the function getState and the function setState, and specifies a value that the argument can take at that time.

The plug-in program 133 is generated from the plug-in program 132. In the plug-in program 133, the value is read from the state data using the value of the variable field as a key. The range of the variable field at this point is "instanceSumPlugin. *". Therefore, in the plug-in program 131, it is determined that the read process is performed on the key "sampleSumPlugin. *". Further, in the plug-in program 133, the value is written in the state data using the value of the variable namespace as a key. The range of the variable namespace at this point is "explexSumPlugin.output. *". Therefore, in the plug-in program 131, it is determined that the write process is performed on the key "sampleSumPlugin.output. *".

FIG. 11 is a diagram showing an example of plug-in authentication.
Wildcards can be used to specify keys in plugin analysis results and access control lists 127. Therefore, the authentication unit 125 determines the inclusion relationship of the key range. If the entire key range indicated by the analysis result of the plug-in is included in the key range indicated by the access control list 127, the addition of the plug-in is permitted. On the other hand, if at least a part of the key range indicated by the analysis result of the plug-in is not included in the key range indicated by the access control list 127, the addition of the plug-in is refused.

The plug-in programs 134, 135, 136 are examples of plug-ins. The plug-in program 134 specifies a specific character string "a" as a key. Therefore, the key that can be accessed by the plug-in program 134 is "a". The plug-in program 135 may specify a specific character string "a" as a key, and may specify a character string having one or more "c" added as a key. Therefore, the key that can be accessed by the plug-in program 135 is "a *". The plug-in program 136 uses the return value of the function as a key. Therefore, the key that can be accessed by the plug-in program 136 is "*" and is unknown.

The user who created the plug-in is developer A, the device object to be added is "car001", and the access control list 127 has an access permission key "a *" associated with the user ID and object ID. It is assumed that it is registered. Since "a" is included in "a *", the addition of the plug-in program 134 is permitted. Further, since "a *" is included in "a *", the addition of the plug-in program 135 is permitted. On the other hand, since "*" is not included in "a *", the addition of the plug-in program 136 is rejected. In this way, whether or not the plug-in can be added is determined based on the inclusion relationship of the key range.

FIG. 12 is a diagram showing an example of arranging a plug-in through a firewall.
The firewall 100 receives control messages 141 and 142 for adding the plug-in. The control message 141 requests that the plug-in 143 (plug-in B1) created by the developer B be added to the device object "car001". The control message 142 requests that the plug-in 144 (plug-in B2) created by the developer B be added to the device object "car001".

The firewall 100 analyzes the plug-in 143 and determines that the keys that may be accessed from the plug-in 143 are "latitude" and "longitude". In addition, the firewall 100 analyzes the plug-in 144 and determines that the key that may be accessed from the plug-in 144 is "speed". On the other hand, the access control list 127 included in the firewall 100 states that the developer B is allowed to access the key "latitude" of the device object "car001". Further, the access control list 127 describes that the developer B is permitted to access the key "longitude" of the device object "car001".

Then, the firewall 100 permits the plug-in 143 to be added to the device object "car001", and transfers the control message 141 to the node 300 via the message server 200. The device object 320 of the node 300 receives the control message 141 and registers the plug-in 143 included in the control message 141. For example, the device object 320 registers the plug-in 143 in association with the keys "latitude" and "longitude" of the state table 327. This causes the plugin 143 to be executed when the "latitude" or "longitude" values are updated. When the plug-in 143 accesses the state table 327, it is not necessary to confirm the access authority.

On the other hand, the firewall 100 refuses to add the plug-in 144 to the device object "car001". In this case, the control message 142 is not forwarded to the node 300 and the plug-in 144 is not registered with the device object 320.

Next, a procedure example of the information processing system of the second embodiment will be described.
FIG. 13 is a flowchart showing an example of a plug-in generation procedure.
The plug-in generation is executed by a development device such as the development devices 70, 70a, 70b. Here, it will be described as being represented by the development apparatus 70.

(S10) The development device 70 receives input from the user and creates the source code of the plug-in in response to the input from the user. However, the development device 70 may receive the plug-in source code file from another information processing device.

(S11) The development device 70 compiles the source code of the plug-in created in step S10 and generates a plug-in binary. For example, the development device 70 converts the source code of the plug-in into a bytecode written in an intermediate language.

(S12) The development device 70 generates a plug-in addition control message including the plug-in binary generated in step S11. The object ID of the control message is an identifier of the device object to be placed and is specified by the user. The user ID of the control message is an identifier of the user who uses the development device 70. The key of the control message is the key that is the execution condition of the plug-in, and is specified by the user. The plug-in ID of the control message may be automatically generated from the plug-in binary.

(S13) The development device 70 transmits the control message generated in step S12 to the firewall 100. When the control message is directly transmitted to the message server 200, the control message is rejected by the message server 200, and the message server 200 notifies the development device 70 of the error.

FIG. 14 is a flowchart showing an example of a plug-in authentication procedure.
The plug-in authentication is executed by the firewall 100.
(S20) The message communication unit 123 receives the control message for adding the plug-in.

(S21) The plug-in analysis unit 124 extracts the plug-in binary from the control message. The plug-in analysis unit 124 analyzes the plug-in binary by using a static program analysis method such as abstract analysis, and analyzes the meaning of the plug-in. For example, the plug-in analysis unit 124 detects a read function that reads the value from the state data and a write function that writes the value to the state data from the plug-in binary. The plug-in analysis unit 124 determines possible values (ranges) of the arguments of the read function and the write function.

(S22) The plug-in analysis unit 124 extracts a key that may be a read target or a write target in the plug-in based on the analysis result in step S21.
(S23) The authentication unit 125 selects one key extracted in step S22.

(S24) The authentication unit 125 extracts the user ID and the object ID from the control message. The authentication unit 125 searches the access control list 127 by using the extracted user ID and object ID and the key selected in step S23. At this time, the authentication unit 125 searches the access control list 127 for records that satisfy the conditions. The record that satisfies the condition is a record that includes a specified user ID and object ID, and also includes a permission key that includes the specified key.

(S25) The authentication unit 125 determines whether the access of the key selected in step S23 is permitted under the designated user ID and object ID. When the corresponding record is searched from the access control list 127 in step S24, it is determined that access is permitted. If the corresponding record is not searched from the access control list 127, it is determined that access is not permitted. If the access of the selected key is permitted, the process proceeds to step S26, and if not, the process proceeds to step S30.

(S26) The authentication unit 125 determines in step S23 whether all the keys extracted in step S22 have been selected. If all the keys are selected, the process proceeds to step S27, and if there are unselected keys, the process returns to step S23.

(S27) The authentication unit 125 determines whether or not the plug-in uses a predetermined prohibited API (Application Programming Interface) by referring to the analysis result in step S21. The prohibited API is a library function that is not preferable for the plug-in to use from the viewpoint of security, and is defined in advance by the administrator. For example, the prohibited API contains a function that accesses the local file system. If the prohibited API is used, the process proceeds to step S30, and if the prohibited API is not used, the process proceeds to step S28.

(S28) The plug-in analysis unit 124 registers the analysis result of step S21 in the analysis result table 128 included in the analysis result database 122.
(S29) The message communication unit 123 transfers the control message received in step S20 to the message server 200. Then, the plug-in authentication is completed.

(S30) The message communication unit 123 discards the received control message and notifies the development device that has transmitted the control message of the refusal to add the plug-in.
FIG. 15 is a flowchart showing an example of a procedure for adding a plug-in.

The plug-in addition is executed in cooperation with the message server 200 and the nodes 300, 300a, 300b. Here, it is assumed that the node 300 is executed as a representative, and the plug-in addition destination is the device object 320.

(S40) The message server 200 receives a control message for adding a plug-in. The message server 200 accepts control messages from the firewall 100, but does not accept control messages from other information processing devices.

(S41) The message server 200 transfers the control message to the message forwarding unit 310 of the node 300. The message server 200 may select a transfer destination by a round robin method. The message forwarding unit 310 transfers the control message to the device object 320 with reference to the object ID included in the control message.

(S42) The plug-in management unit 325 of the device object 320 extracts the plug-in binary from the control message. The plug-in management unit 325 performs a plug-in binary conversion process. For example, the plug-in management unit 325 uses a class loader to convert the bytecode of the plug-in into an executable class.

(S43) The plug-in management unit 325 registers the plug-in so that the plug-in is called when the value corresponding to the key specified in the control message is updated. The plug-in management unit 325 registers the plug-in in the plug-in table 328.

FIG. 16 is a flowchart showing an example of an ACL update procedure.
The ACL update is performed on the firewall 100.
(S50) The ACL update unit 126 receives the new access control list (new ACL). The new access control list is transmitted, for example, from the development device 70 used by the administrator.

(S51) The ACL update unit 126 temporarily stops the plug-in authentication performed by the authentication unit 125. Control messages arriving in the meantime will be put on hold.
(S52) The ACL update unit 126 selects one record of the existing plug-in from the analysis result table 128 included in the analysis result database 122.

(S53) The ACL update unit 126 selects one key that may be a read target or a write target from the analysis result included in the record selected in step S52.
(S54) The ACL update unit 126 extracts the user ID and the object ID from the records of the existing plug-in selected in step S52. The ACL update unit 126 searches the new access control list received in step S50 by using the extracted user ID and object ID and the key selected in step S53. At this time, the ACL update unit 126 searches the new access control list for records that satisfy the conditions. The record that satisfies the condition is a record that includes a specified user ID and object ID, and also includes a permission key that includes the specified key.

(S55) The ACL update unit 126 determines whether the access of the key selected in step S53 is permitted under the designated user ID and object ID. When the corresponding record is searched from the new access control list in step S54, it is determined that access is permitted. If the corresponding record is not searched from the new access control list, it is determined that access is not permitted. If the access of the selected key is permitted, the process proceeds to step S56, and if not, the process proceeds to step S57.

(S56) The ACL update unit 126 determines in step S53 whether all the keys included in the analysis result have been selected. If all the keys are selected, the process proceeds to step S58, and if there are unselected keys, the process returns to step S53.

(S57) The ACL update unit 126 notifies the development device that has transmitted the new access control list of the existing plug-in selected in step S52 as a nonconforming plug-in. For example, the ACL update unit 126 transmits the plug-in ID to the development device 70.

(S58) The ACL update unit 126 determines in step S52 whether all the existing plug-in records have been selected from the analysis result table 128. If all are selected, the process proceeds to step S59, and if there are unselected items, the process returns to step S52.

(S59) The ACL update unit 126 replaces the old access control list stored in the ACL storage unit 121 with the new access control list received in step S50.
(S60) The ACL update unit 126 releases the suspension of the plug-in authentication in step S51. As a result, the processing of the held control message is resumed.

According to the information processing system of the second embodiment, event messages are collected from the device, and state data indicating the state of the device is held in the device object corresponding to the device. The plug-in placed in the device object is started in response to the update of the state data, and event-driven data processing is performed. As a result, real-time dynamic event processing can be executed efficiently. You can also add plugins to the device object without stopping it. As a result, services that use state data can be dynamically added or updated, and the stoppage of real-time dynamic event processing can be suppressed.

Also, plugins of different developers can be placed on the same device object. Therefore, it is possible to implement various application software on the real-time dynamic event processing system. In addition, access control that limits the data that can be accessed from the plug-in can be performed for each key included in the state data. Therefore, the state data collected from the device can be protected.

Also, confirmation of access authority is performed by analyzing the plugin before adding the plugin to the device object, and it is omitted after the plugin is placed. Therefore, it is not necessary to check the access authority every time the plug-in accesses the state data, the access control overhead can be reduced, and the throughput of real-time dynamic event processing can be improved. For example, the communication overhead can be reduced as compared with the method of inquiring the centralized management server that holds the access control list for each access to the state data. Further, for example, as compared with the method of distributing the access control list to a plurality of nodes, it becomes easy to maintain the consistency of the access control list when updating the access control list.

Also, in the plug-in analysis, semantic analysis such as abstract interpretation is performed. Therefore, it is possible to reduce the risk of missing access to a key that the plugin is not allowed to access. For example, as a plug-in, it is possible to create a program that changes the access destination key by writing the initial value to the variable indicating the key and then rewriting the value of the variable after the fact. Even for such plugins, the risk of accessing unauthorized keys can be assessed compared to a simple static program analysis method that tracks the source code description.

In addition, the analysis result when the plug-in is added is saved in the history database, and when the access control list is updated, it is automatically checked whether the existing plug-in conforms to the new access control list. Then, if there is a nonconforming existing plug-in, a warning is notified to the administrator who created the new access control list. Therefore, even if the access authority is not confirmed for each access to the state data, the plug-in that does not conform to the access control list after the fact can be detected, and the security of the state data can be maintained.

The above simply shows the principle of the present invention. In addition, numerous modifications and modifications are possible to those skilled in the art, and the present invention is not limited to the exact configurations and applications described and described above, and all corresponding modifications and equivalents are attached. It is considered to be the scope of the present invention according to the claims and their equivalents.

10 Data processing device 11,21 Storage unit 12, 22 Processing unit 13 Data 20 Access control device 23 Target program 24 Access control information

Claims (8)

1. A data processing device that stores data including a plurality of data items and executes the registered program in response to an update of the data when a registered program exists.
   It accepts a registration request including a user's target program, analyzes the target program to detect a data item that can be accessed from the target program among the plurality of data items, and the data item to which the user has access authority or the user. Based on the access control information indicating the data item for which the user does not have the access authority, it is determined whether or not the user has the access authority for the detected data item, and when it is determined that the user has the access authority, the target program is subjected to the data processing. An access control device that allows you to register with the device,
   Information processing system with.
2. After permitting the registration of the target program, the access control device receives an update request for the access control information, and the user has access authority to the detected data item based on the updated access control information. Re-judgment and output a warning message when it is determined that you no longer have access authority.
   The information processing system according to claim 1.
3. The access control device stores an analysis history indicating the detected data item, and uses the analysis history to perform re-determination based on the updated access control information.
   The information processing system according to claim 2.
4. The access control device receives the registration request, transfers the registration request to the data processing device when permitting registration of the target program, and transfers the registration request when rejecting registration of the target program. Suppress,
   The information processing system according to claim 1.
5. The data processing device generates a plurality of objects corresponding to the plurality of terminal devices, and causes the plurality of objects to hold the data and the registered program.
   The registration request includes designation of a registration destination object, and the access control information indicates the presence or absence of access authority for a set of an object and a data item.
   Based on the access control information, the access control device determines whether or not the user has access authority to the detected data item of the registration destination object.
   The information processing system according to claim 1.
6. A storage unit that stores access control information indicating a data item for which the user has access authority or a data item for which the user does not have access authority among a plurality of data items.
   The registration request including the target program of the user is received, the target program is analyzed to detect a data item that can be accessed from the target program among the plurality of data items, and the detection is performed based on the access control information. It is determined whether or not the user has access authority to the data item, and if it is determined that the user has access authority, the target program is executed so that the target program is executed in response to the update of the data including the plurality of data items. A processing unit that allows registration in the information processing system,
   Access control device with.
7. The computer
   It accepts a registration request including the user's target program, analyzes the target program, and detects a data item that can be accessed from the target program among a plurality of data items.
   Whether the user has the access authority to the detected data item based on the access control information indicating the data item to which the user has the access authority or the data item to which the user does not have the access authority among the plurality of data items. Judge,
   When it is determined that the target program has access authority, the target program is permitted to be registered in the information processing system so that the target program is executed in response to the update of the data including the plurality of data items.
   Access control method.
8. On the computer
   It accepts a registration request including the user's target program, analyzes the target program, and detects a data item that can be accessed from the target program among a plurality of data items.
   Whether the user has the access authority to the detected data item based on the access control information indicating the data item to which the user has the access authority or the data item to which the user does not have the access authority among the plurality of data items. Judge,
   When it is determined that the target program has access authority, the target program is permitted to be registered in the information processing system so that the target program is executed in response to the update of the data including the plurality of data items.
   An access control program that executes processing.

Images