JP2008276671A - Service application management system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a setting method for a permission for access-controlling for enabling a plurality of service applications operated on the same OSGi framework to be executed safely. <P>SOLUTION: All is permitted as to the permission to a resource within a segment, and the permission exceeding the segment is not imparted when not permitted by a manager. All is permitted when a service provider requests the permission to the resource included in the same segment, to a bundle of own service applications. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a service application management system equipped with a security system that separates services when a plurality of services are simultaneously operated on the same OSGi framework.

  Conventionally, there is known an OSGi framework capable of operating a plurality of plug-in programs called bundles on the same Java (registered trademark) Virtual Machine (Non-Patent Documents 1 and 2). On the OSGi framework, the above bundle can be installed and uninstalled without stopping Java (registered trademark) Virtual Machine, and classes and instances can be shared between different bundles.

  In the Java (registered trademark) security model, access control to files, sockets, and the like can be performed from a Java (registered trademark) program using information called Permission. In an expanded form, the OSGi framework allows access control of classes and instances shared between different bundles using Permission.

  On the OSGi framework, a plurality of service providers can operate service applications. A service application is a set of programs in which each service provider provides a service to an end user, and is composed of one or more bundles. An administrator exists in the OSGi framework in which these service applications operate, and the operation of the service applications can be controlled by changing the permissions of the bundles constituting each service application.

In addition, the service application provides services using resources such as bundle classes, packages, sockets, files, and system properties included in the operating environment.
OSGi Service Platform Release 3 OSGi Service Platform Release 4

  However, in the OSGi framework described above, there is no management model in the case where a plurality of different service providers operate service applications on the same OSGi framework. For this reason, there is a possibility that the service application cannot be executed safely due to an operation disturbance or resource contention from another service application.

  Therefore, in order to perform access control so that each service application can be executed safely, it is necessary for an administrator to define Permission finely, which is extremely complicated.

  In addition, since the service provider does not know the permission granted to the service provider in advance, it is difficult to develop the bundle because the permission required for each bundle must be reported to the administrator after the design is performed.

  The present invention has been made to solve the conventional problems, and provides a Permission setting method for controlling access so that a plurality of service applications operating on the same OSGi framework can be safely executed. Objective.

  The first invention for solving the above-mentioned problem includes, for each service application on the OSGi framework, means for generating a bundle that constitutes the service application and a segment that is a set of resources that the bundle can use, and the segment And a means for permitting all the Permission to the resource belonging to the bundle belonging to the same segment.

  According to the present invention, a segment is defined for each service application, all permissions within the segment are permitted, and permissions outside the segment are detected and a warning is issued, so the administrator manages all permissions. There is no need to control only Permission that may affect other service applications, and management becomes easy.

  In addition, by allowing the service provider to present a resource permitted to the service provider in advance from the administrator, the permission granted to the service application provided by the service provider becomes clear and development is facilitated.

  Embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 is a diagram illustrating a home gateway device according to an embodiment of the present invention.

  In FIG. 1, the home gateway device 1 of this embodiment includes a communication unit 11, a storage unit 12, an input unit 13, a display unit 14, and a control unit 15, and these communication unit 11, storage unit 12, input unit 13. The display unit 14 and the control unit 15 are connected via an internal bus 16.

  The communication unit 11 is connected to the network 3 and communicates with the server 2 via the network 3. For convenience of explanation, only the server 2 is illustrated, but other devices may be connected.

  The storage unit 12 is configured by a recording medium such as a hard disk, and records a control program for controlling the home gateway device itself.

  The input unit 13 includes various buttons, a keyboard, and the like, and performs various settings of the home gateway device 1.

  The display unit 14 is configured by a display device such as a lamp or a liquid crystal display device, and displays various settings of the above-described home gateway device 1 and the state of the home gateway device 1.

  The control unit 15 includes a CPU (Central Processing Unit), a ROM (Read-Only Memory), a RAM (Random Access Memory), and the like, and controls the entire home gateway device 1 based on the above-described control program. It has become.

  FIG. 2 is a diagram illustrating a configuration of software for controlling the device 2 of the home gateway device 1 according to the present embodiment. These softwares operate on the OSGi Framework that operates on the Java (registered trademark) VM.

  In FIG. 2, a segment is defined for each service application. A segment is a collection of resources that can be used by each service application, and is defined on the OSGi framework.

  FIG. 3 shows a range in which Permission is permitted. Permission is granted for all resources in the segment, and Permission beyond the segment is not granted without the administrator's permission. Accordingly, a service provider is permitted to request permission for resources included in the same segment with respect to a bundle of service applications of the service provider. For this reason, the service provider can freely determine the Permission for the bundle included in the segment of his service application within the above-described permitted range.

  In addition, a permission exceeding the segment can be obtained with the permission of the administrator.

  FIG. 4 shows a segment setting unit for managing segments. The segment setting unit generates / deletes a segment, acquires / changes / saves information of the segment, monitors the permissions included in the segment, detects a permission that affects the execution of other service applications, and gives a warning. It has a function of executing the three steps of raising.

  The segment setting unit receives a segment name, resources and permissions included in the segment, bundle information included in the segment from the Management Agent, and generates a segment according to the information. The segment is generated and stored by the segment setting unit. The Permission included in the segment is set in each bundle using PermissionAdmin or Conditional PermissionAdmin that is a function of the OSGi framework.

  The segment setting unit returns information such as the segment name, the included resource and permission, and the included bundle of the specified segment according to the instruction of ManagementAgent. The ManagementAgent can also change the information included in the segment via the segment setting unit. The segment setting unit controls the segment according to the information given from ManagementAgent and stores the information.

  The segment setting unit monitors Permission included in the segment, which is instructed by ManagementAgent, and detects Permission that may affect other service applications. For example, a permission that overlaps with a FilePermission assigned to another segment, a permission that overlaps with a ServicePermission assigned to another segment, and the like are detected. Then, the Management Agent is warned that a Permission that may affect the operation of another service application has been detected. According to the warning, the ManagementAgent can perform appropriate processing such as not permitting the permission, changing the permission, and permitting duplication of the permission.

It is a block diagram of the home gateway apparatus of one Embodiment of this invention. It is a segment block diagram of one Embodiment of this invention. It is a block diagram of the segment and Permission of one Embodiment of this invention. It is a block diagram of the segment setting part which manages the segment of one Embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Home gateway apparatus 11 Communication part 12 Storage part 13 Input part 14 Display part 15 Control part 16 Internal bus

Claims (1)

Means for generating a bundle that constitutes the service application for each service application on the OSGi framework and a segment that is a set of resources that the bundle can use;
A service application management system comprising: means for permitting all of the Permission to a resource included in the segment to bundles belonging to the same segment.

Images