JP4701651B2 - Program, server device, and control method - Google Patents

Description

  The present invention relates to dynamic content generation, and more particularly to a Web application development support program for reducing the development load of a Web application that provides dynamic content in response to a request from a Web browser.

  There are various Web systems that provide services and information on the Internet. In such a Web system, various functions are realized in cooperation with a plurality of Web applications that provide dynamic content that operates on a Web server in response to a user request via a Web browser of a client. It is common. There are a plurality of forms of cooperation of this Web application, and a general-purpose Web application that provides a common function of a plurality of Web applications, for example, independent of a Web application created by a system developer and a specific Web application or Web system A pattern that links (general-purpose Web application), a pattern that links a Web application and a Web application, a pattern that links a general-purpose Web application and a general-purpose Web application (package software), and the like are conceivable.

  Among these linkage patterns, generally used patterns include a pattern for linking Web applications and a pattern (package software) for linking general-purpose Web applications. However, the pattern in which the general-purpose web application and the web application are linked has a security problem that the general-purpose web application cannot be illegally used.

  In order to solve this problem, conventionally, a system developer had to create a Web application conscious of a Web application or a session of the Web system without using a general-purpose Web application. However, since the Web application created in this way cannot be linked with other Web applications or Web systems, it cannot be a general-purpose Web application.

  FIG. 9 shows a specific example in which a Web application conscious of a Web system session and a Web application are linked. In this example, the flow of processing when the user performs business processing including DB search via the Web browser of the client is shown. The client 2 and the Web server 1 are connected via a communication network, but the communication network is omitted.

  When the user logs in to the business process from the screen 21 of the Web browser of the client 2, the user authentication unit 111 of the Web application 1 (11) of the Web server 1 performs an authentication process based on the login ID and password transmitted from the client. When the user is recognized as a correct user, the session start unit 112 assigns a session ID, and the client application 2 receives the session ID and the screen data for the business screen (screen 2) 22 from the Web application 1 (11) to the client. Send.

  When the user clicks the search button from the business screen (screen 2) 22, the DB search instruction transmission data including the session ID is transmitted to the Web server 1, and the session confirmation means 131 of the Web application 3 (13) is transmitted. Screen so that the DB search means 132 can execute a DB search and display the search result as a separate screen 23. Data is transmitted to the client 2.

  When the transmission button is clicked from the client, the transmission data edited by the user as business data is transmitted to the Web server 1 together with the session ID, and the session end means 121 of the Web application 2 (12) performs the session end processing. The end processing means 122 performs the business end processing, and the series of business processing ends.

  In this case, the application (Web application 3) that performs DB search is called as one function in a series of business processes, and therefore usually needs to belong to the session of the user who started the business. Therefore, it is necessary to check whether the session belongs to the session used in the business. Such a process is a process specific to the business process, so even if the application that performs the DB search can be used in other business, the application can be reused. There was not (it is possible in terms of reuse by making the DB search processing into a library, but because it is necessary to create an application for each business, it could not be reused as a general-purpose application).

FIG. 10 shows an example in which the Web application 3 (13) for performing DB search can be used from other businesses. The processing flow is generally the same as in FIG. However, since the Web application 3 (13) for performing the DB search can be reused for other business processes, the process related to the session is removed.
In this way, it is possible to make it available from any business process, but it can be used by any system or any user, so it is important to use it illegally. There arises a problem that information is leaked. In order to avoid such problems, it may be possible to prepare a unique user authentication mechanism. However, user authentication is also performed in normal business processing, which requires extra work for the user. It will be. Moreover, since the management system is different from the business processing, only the labor is increased in terms of management.

In addition, as another Web application development support method, “use an extended function to access a control program of a server operating in a network environment and execute processing based on a script executed on the server side in the server, "A development support method and development support system for an application that operates in a system that communicates processing results to a client browser in a predetermined manner" is disclosed (for example, see Patent Document 1). It was necessary to create it each time.
JP 2002-155714 A (page 2-3)

  As described above, conventionally, a web system in which web applications are linked together or a web system in which general-purpose web applications are linked together is frequently used. The linkage pattern of these web applications has the following problems. Existed. In a Web system in which Web applications are linked to each other, it is possible to construct a system with a high degree of freedom by using the Web application. On the other hand, it is necessary for a system developer to consider a mechanism for preventing unauthorized use of the Web application.

  In addition, in a web system in which general-purpose web applications are linked together, it is not necessary for the system developer to consider a mechanism for preventing unauthorized use of the web application, while the web developed by the system developer according to the purpose of the web system. A system with a high degree of freedom like an application could not be constructed.

  An object of the present invention is to prevent unauthorized use of a general-purpose web application, which is a common function of web applications, and to reduce the development load of the web application.

  FIG. 1 is an overall configuration diagram of the present invention. The Web application development support program 12 and the Web application 11 of the present invention are executed on a computer that behaves as the dynamic content generation apparatus 1. For example, a Web application activation request input by a user from the client 2 via the Web browser 21 is received. When the dynamic content generation device 1 receives via the communication network 3, the common function start unit 111 of the Web application 11 transmits a use identification information request for using the common function to the Web application development support program 12.

  When the Web application development support program 12 receives the usage identification information request, the usage start reception unit 121 transmits usage identification information for using the common function to the Web application 11. When the Web application 11 receives the usage identification information for using the common function, the content generation unit 112 generates a content including a code for requesting the usage of the common function to which the usage identification information is added, and the client 11 via the communication network 3 2 to send.

  In the client 2, when the content is received, the content is displayed by the Web browser 21, and a user performs a database search, for example, from the content display screen, and transmits a search result to the client. When the instruction is given, a usage request for the common function to which usage identification information is added is transmitted from the client 2 to the dynamic content generation apparatus 1 via the communication network 3.

  When the dynamic content generation apparatus 1 receives a usage request for a common function with usage identification information added from the client 2, the common function execution unit 122 of the Web application development support program 12 determines whether the usage identification information is valid, When the usage identification information is valid, for example, a database search is performed, and a common function such as transmitting the search result to the client is executed.

  When the client 2 receives the execution result for the use request for the common function from the dynamic content generation device 1, the user performs a predetermined process based on the information, and inputs the Web application end request instruction. A Web application termination request to which identification information is added is transmitted to the dynamic content generation apparatus 1 via the communication network 3.

  When the dynamic content generation device 1 receives a Web application termination request with usage identification information added from the client 2, the common function termination unit 113 of the Web application 11 adds the usage identification information to the Web application development support program 12. Send a common function use end request. When the Web application development support program 12 receives the use end request for the common function to which the use identification information is added, the use identification information is invalidated, thereby illegally using the general-purpose Web application that is a common function of the Web application. Can be prevented, and the development load of the Web application can be reduced.

  Further, the common function execution unit 122 determines whether the usage identification information is valid based on the expiration date of the usage identification information, thereby obtaining, for example, usage identification information used by a certain Web application. Even if a malicious third party found by eavesdropping on communication attempts to access a general-purpose web application using unauthorized use identification information, it is impossible to use it after the expiration date. It is possible to prevent unauthorized use of general-purpose Web applications that are common functions of applications.

  In a Web system in which a Web application and a general-purpose Web application are linked, it is not necessary for a system developer to consider a mechanism for preventing unauthorized use of the general-purpose Web application, and a highly flexible system can be constructed.

  As shown in FIG. 2, in this embodiment, a part for managing user identification information that is a common function of the Web application development support program that is a common function of the Web application is implemented as a unique ID management function 14 independently. By doing so, the load of development of the Web application development support program itself is also reduced.

  FIG. 2 is an overall configuration diagram of an embodiment according to the present invention. The web server 1 and the client 2 are connected via a communication network (not shown). The Web server 1 corresponds to the dynamic content generation apparatus 1 in FIG. 1 and is executed by a plurality of Web applications 11 and 12, a general-purpose Web application 13, and a unique ID management function 14. In this embodiment, the Web application is separately implemented as Web application 1 (11), which is a pre-processing business application, and Web application 2 (12), which is a post-processing business application. May be.

  The Web application starts a session with the user authentication unit 111 for authenticating the user and the client, generates a content including a code for requesting the use of the common function to which usage identification information is added, and transmits the content to the client The session start unit 112 and the unique ID management function 14 add usage identification information to the common function use start unit 113 and the unique ID management function 14 that transmit a usage identification information request for using the general-purpose Web application 13. A common function use ending unit 123 that transmits a use termination request for the general-purpose Web application 13, a session ending unit 121 that ends a session with the client 2, and an ending unit 122 that performs a Web application termination process.

  For the unique ID management function 14, refer to the description of the configuration example of the unique ID management function in FIG.

  Whether the general-purpose Web application 13 executes a common function of the Web application, and is valid based on the expiration date of the usage identification information when receiving the usage request for the common function with the usage identification information added from the client. For example, in this embodiment, a DB search unit 132 that executes a DB search and executes a common function of a Web application, such as transmitting mask data as a search result to a client. The Web application development support program 12 in FIG. 1 corresponds to a combination of the general-purpose Web application 13 in FIG. 2 and the unique ID management function 14. Further, the common function execution means 122 of FIG. 1 corresponds to the combination of the common function use confirmation means 133 and the DB search means 132 of FIG. 2, and the use start reception means 121 and the use end means 123 of FIG. This corresponds to the unique ID management function 14 of FIG.

  In the client 2, a Web browser operates, and a screen 1 (21) that is an initial screen of the Web browser, a screen 2 (22) that is a business screen transmitted from the Web application 1, and a DB that the general-purpose Web application 13 transmits to the display device. Another screen 23 as a search result is displayed.

  FIG. 3 shows a configuration example of the unique ID management function. The unique ID management function generates and manages a unique ID that is sufficiently long and cannot be predicted. It also discards expired IDs and updates the expiration date. This function is executed either in a thread separate from the Web application or in a separate process (including on another machine). It is implemented so that IDs cannot be obtained illegally by preventing reference or execution from the client.

  Access to the unique ID management function from the Web application and the general-purpose Web application provides the following dedicated API (application program interface).

1. Create unique ID Creates a new unique ID for the specified effective period and returns the ID as a character string.

2. Check for existence of specified unique ID It is checked whether or not the specified unique ID exists in the management table. If it exists, the expiration date is updated and true is returned. Returns false if it does not exist.

3. Discard specified unique ID If the specified unique ID exists in the management table, delete it from the management table.

  In the unique ID management table, the expiration date of the usage identification information is stored together with the unique usage identification information (unique ID) that the unique ID is generated by management and cannot be predicted.

  FIG. 4 is a flowchart showing the flow of the overall processing of the embodiment. When the user gives an instruction to start the Web application 1 from the screen 1 (21) of the client 2, the URL (1) of the Web application 1 (11) is transmitted from the Web browser operating on the client 2 to the Web server 1 via the communication network 3. Uniform Resource Locator) and a Web application 1 (11) activation request including the user ID and password of the user are transmitted (S401). When the Web application 1 (11) is activated, the user authentication unit 111 performs user authentication processing based on the received user ID and password of the user (S402).

  When the user determines that the Web application 1 (11) can be used, the common function use starting unit 113 uses the dedicated API to identify the unique ID management function 14 as unique identification information of the Web application 1 (11). An ID is acquired (S403). Subsequently, the session start unit 112 performs a session start process with the client 2 (S404), and transmits screen data of the business (screen 2) including the session ID and the unique ID to the client 2 (S405). Since the user authentication process and the session start process are conventional techniques, details of the processes are omitted.

  In the client 2, when the screen data is received, the Web browser displays it on the display device, and the user presses the search button according to the displayed business screen. Then, the use request for the general-purpose web application 13 including the unique ID is transmitted from the client 2 to the web server 1 (S406).

  When the web server 1 receives a use request for the general-purpose web application 13 including the unique ID, the general-purpose web application 13 is activated, and the common function use confirmation unit 133 is designated for the unique ID management function 14 using a dedicated API. A check request is made to see if the unique ID exists in the management table (S407). If it does not exist, the process proceeds to S414 to transmit an error screen.

  If it exists, a DB search is performed, and screen data for displaying the search result as a separate screen is transmitted to the client 2 (S408). In the client 2, when the Web browser displays the received screen data as a separate screen on the display device, the user extracts necessary information from the search result and reflects it on the business screen of the screen 2 (22) (S409). When the transmission button 2 is pressed, a request for starting the Web application 2 (12) instructing the end of the business including the session ID and the unique ID is transmitted from the client 2 to the Web server 1 (S410).

  When the Web server 1 receives the request for starting the Web application 2 (12), the Web server 2 (12) is started, and the common function use ending unit 123 designates a unique ID and uses the dedicated API to use the unique ID management function 14 A request for discarding the unique ID is transmitted to the server (S411). Subsequently, the session is terminated (S412), the web application is terminated, and the process is terminated (S413). Note that the session end, end processing, and error screen transmission are conventional processes and will not be described in detail.

  FIG. 5 is a flowchart showing the flow of the common function use request process.

  When the Web application 1 is activated, the common function use starting unit 113 transmits a new unique ID request to the unique ID management function 14 using the “unique ID creation” API provided by the Web system (S501). ). When the unique ID management function 14 receives a new unique ID request, it generates a unique ID that is sufficiently long and cannot be predicted, and stores it in the unique ID management table shown in FIG. 3 together with the expiration date specified at the time of the request (S502). ). The unique ID management function 14 notifies the generated unique ID to the “unique ID creation” API (S503). The “unique ID creation” API returns the notified unique ID to the Web application 1 (S504).

  FIG. 6 is a flowchart showing the flow of the calling process of the general-purpose web application. When the general-purpose web application 13 is activated, the common function usage confirmation unit 133 determines whether a unique ID has been designated (S601). If not specified, screen data for displaying a message to that effect is generated and transmitted to the client 2 (S605), and the process is terminated.

    If a unique ID has been designated, the validity of the unique ID is confirmed using a dedicated API “designated unique ID existence check” (S603). If “true” is returned through the dedicated API, the general function is executed (DB search in this embodiment), screen data representing the execution result is generated and transmitted to the client 2 (S604), and the process is performed. finish. If “false” is returned, screen data for displaying a message to that effect is generated and transmitted to the client 2 (S605), and the process ends.

  FIG. 7 is a flowchart showing the flow of the validity confirmation process for the usage identification information. When the unique ID management function 14 receives a request for checking the validity of the unique ID from the general-purpose web application 13 using the dedicated API “specified unique ID existence check”, the unique ID specified in the unique ID management table shown in FIG. It is confirmed whether there is a matching item (S702). If there is no match, “false” is returned to the general-purpose web application 13 through the dedicated API, assuming that the ID is incorrect or has been discarded (S705), and the process is terminated.

  If there is a match, the expiration date is updated (S703), and “true” is returned to the general-purpose web application 13 through the dedicated API, assuming that the unique ID is valid (S705), and the process ends.

  FIG. 8 is a flowchart showing the flow of the usage identification information discarding process. When the Web application 2 is activated, the common function use termination unit 123 transmits a unique ID discard request to the unique ID management function 14 using the “designated unique ID discard” API provided by the Web system (S801). ). When the unique ID management function 14 receives the unique ID discard request, the unique ID management function 14 checks whether or not a unique ID matching the unique ID for which the discard request is requested exists in the unique ID management table shown in FIG. 3 (S802). If there is no match, the process ends. If there is a match, the specified unique ID and expiration date information are deleted from the unique ID management table (S803).

Overall configuration diagram of the present invention Overall configuration diagram of an embodiment of the present invention Configuration example of unique ID management function Overall processing flow of the embodiment Common function usage request processing flow General web application call process flow Flow of validation processing of usage identification information Flow of usage identification information destruction processing Conventional Web application cooperation example 1 Conventional Web application cooperation example 2

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Dynamic content production | generation apparatus 2 Client 3 Communication network 11 Web application 12 Web application development support program 21 Web browser 111 Common function start means 112 Content generation means 113 Common function end means 121 Use start reception means 122 Common function execution means 123 Use end means

Claims (4)

On the computer,
A process for authenticating the client apparatus, a process for generating the session identification information for identifying a session with the authenticated client apparatus, and a use identification when a use request for the first application program is received from the client apparatus and processing for generating information, and generated the use identification information and the process of transmitting both the session identification information to the client device, to execute the first application program is prescribed,
When the usage request for the second application program including the usage identification information is received from the client device, the usage identification information included in the received usage request is generated by executing the first application program . Executing the second application program in which processing for determining whether or not the usage identification information is the same is defined ;
When a request for using the third application program including the session identification information is received from the client device, the received session identification information is the same as the session identification information generated by executing the first application program. Executing the third application program in which processing for determining whether or not there is defined;
A program characterized by that. The second application program executed when a usage request for the second application program including the usage identification information is received from the client device, the usage identification based on an expiration date of the generated usage identification information that the information to determine whether it is valid, according to claim 1, wherein the program characterized by causing a computer to execute. A server apparatus for performing multiple application programs,
When the client device receives the use request of the first application program, wherein the process of authenticating the client device, and generating the session identification information for identifying the session with the authenticated client device, use identification means for executing the processing for generating information, and generated the use identification information and the process of transmitting both the session identification information to the client device, the first application program is prescribed,
When receiving the use request of the second application program including the use identification information from the client device, the usage identification information included in the use request it receives is generated by executing the first application program Means for executing the second application program in which processing for determining whether or not the usage identification information is the same is defined ;
When a request for using the third application program including the session identification information is received from the client device, the received session identification information is the same as the session identification information generated by executing the first application program. Means for executing the third application program in which processing for determining whether or not there is defined;
The server apparatus characterized by having. When receiving the use request of the client device or we first application program, the process of authenticating the client device, and generating the session identification information for identifying the session with the authenticated client device, perform the process of generating the usage identification information, and generated the use identification information and the process of transmitting both the session identification information to the client device, the first application program is prescribed,
When receiving the use request of the second application program including the use identification information from the client device, the usage identification information included in the use request it receives is generated by executing the first application program Executing the second application program in which processing for determining whether or not the usage identification information is the same is defined ,
When a request for using the third application program including the session identification information is received from the client device, the received session identification information is the same as the session identification information generated by executing the first application program. A control method comprising: executing the third application program in which a process for determining whether or not there is defined is executed .

Images