JP5811006B2 - Information processing apparatus, information processing method, and information processing program - Google Patents

Description

  The present invention relates to an information processing apparatus, an information processing method, and an information processing program.

  Conventionally, when a web browser acquires a web page in which an API (Application Program Interface) call is embedded, “Same Origin Policy” that prohibits the API from accessing information acquired from Origin different from the Origin of the web page is “Same Origin Policy”. It is prescribed. Origin is, for example, a combination of a scheme, host name, and port number in a URI (Uniform Resource Identifier).

  Here, there is a case where “Same Origin Policy” is avoided for efficient use of information. For example, a user of a web browser can avoid “Same Origin Policy” by setting an Origin, URI, or URL ((Uniform Resource Locator)) that permits access to information to the web browser.

  In addition, there is a technique that includes a node group associated with a URI, and applies a transition rule to a graph in which a node associated with an access source URI that allows access and a node associated with an access destination URI are connected by an edge. (For example, see Patent Document 1 below). The transition rule is a rule for determining that access is possible if there is a node of the access destination URI among the nodes that can transition from the node of the access source URI in the graph indicating the access permission relationship. Further, there is a technique for unifying nodes indicating common character strings after allowing variables to be associated with nodes of a graph indicating knowledge such as a dictionary and grammatical rules (for example, see Patent Document 2 below).

JP 2009-259065 A JP-A-5-204647

  However, when the URI permitting access is set as a graph node as in the above-described prior art, the URI permitting access is set comprehensively, and the amount of setting work by the user increases. In addition, when a plurality of URIs are represented as one URI using a pattern and associated with the nodes of the graph, the nodes are not connected, and the web browser determines that the transition between the nodes cannot be made. Therefore, even if the transition rule is applied, the web browser cannot change from a certain URI node that should originally be allowed to transition to a certain URI node, and accesses a set of URIs that should be determined to be accessible. It is determined to be an impossible URI set. As a result, the web browser prohibits access from a certain URI to be determined to be accessible to a certain URI.

  For example, the user permits access to the URI “B” expressed by using the pattern from the URI “A”, and the URI “B1” to the URI “B” included in the URI “B” expressed by using the pattern. Assume that access to “C” is permitted. In this case, since access from the URI “A” to the URI “B” is permitted and access from the URI “B1” included in the URI “B” to the URI “C” is permitted, the URI “C” to the URI “C” are permitted. Access to should be allowed. However, in the above-described prior art, since the node of URI “B” is not connected to the node of URI “B1”, the web browser cannot transition from the node of URI “B” to the node of URI “B1”. Is determined. Therefore, the web browser determines that the transition from the node of URI “A” to the node of URI “C” cannot proceed even via the node of URI “B” or the node of URI “B1”, and URI “A”. Access to URI “C” is prohibited.

  An object of the present invention is to improve the efficiency of access permission setting.

  According to an aspect of the present invention, a transition source node that is set to be transitionable among nodes associated with an address expressed by a pattern in a language that can be unified by inputting an access source address and an access destination address. Connection information indicating the pair of the destination node and the transition destination node is obtained, and unified information indicating the pair of nodes that can transition between nodes having a common address among the nodes associated with the address is obtained and the address is associated. From among the nodes, identify the node associated with the address that matches the input access source address, and search for a node that can transition from the identified node based on the acquired connection information and unified information. It is determined whether or not the input destination address matches the address associated with the specified node. Information processing apparatus, information processing method, and information processing program for setting from access source address to access destination address prohibited state to access source address to access destination address permitted state Is proposed.

  According to one aspect of the present invention, it is possible to improve the efficiency of access permission setting.

FIG. 1 is an explanatory diagram showing a flow of access permission determination by the information processing apparatus. FIG. 2 is a block diagram of a hardware configuration example of the information processing apparatus 100 according to the embodiment. FIG. 3 is a block diagram illustrating a functional configuration of the information processing apparatus 100. FIG. 4 is an explanatory diagram illustrating an example of the relationship graph 101. FIG. 5 is an explanatory diagram showing an example of a URI expressed by a pattern in a language that can be unified. FIG. 6 is an explanatory diagram illustrating an example of generation of the unified graph 102 by the information processing apparatus 100. FIG. 7 is an explanatory diagram illustrating generation of the unified graph 102 when a node is added to the relationship graph 101. FIG. 8 is a flowchart showing a detailed processing procedure of the unified graph generation processing. FIG. 9 is a flowchart showing a detailed processing procedure of the unification determination processing in step S804. FIG. 10 is an explanatory diagram illustrating an example of determining whether access is possible by the information processing apparatus 100. FIG. 11 is a flowchart (part 1) illustrating a detailed processing procedure of the access permission determination processing. FIG. 12 is a flowchart (part 2) illustrating a detailed processing procedure of the access permission determination processing. FIG. 13 is an explanatory diagram of an example of access permission input. FIG. 14 is a flowchart showing a detailed processing procedure of the access permission setting process.

  Exemplary embodiments of an information processing apparatus, an information processing method, and an information processing program according to the present invention will be explained below in detail with reference to the accompanying drawings.

  FIG. 1 is an explanatory diagram showing a flow of access permission determination by the information processing apparatus. The information processing apparatus 100 is a computer that determines whether or not access from a certain access source URI to a certain access destination URI can be permitted by tracing the relationship graph 101 and the unified graph 102 alternately. Actually, the information processing apparatus 100 determines whether access from a certain access source URI to a certain access destination URI can be permitted using, for example, a web browser.

  The relationship graph 101 is a graph having a group of nodes associated with URIs expressed in a pattern in a language that can be determined to be unified. The relation graph 101 is a graph in which a set of nodes in which an access source URI and an access destination URI, which are set to permit access by a user, are connected by a directed edge. A directed edge is an edge in which a transitionable direction is limited to a direction from a node associated with an access source URI to a node associated with an access destination URI. In other words, it is not possible to transition from the node associated with the access destination URI to the node associated with the access source URI. The relationship graph 101 is input by a user of the information processing apparatus 100, for example.

  The unified graph 102 is a graph in which a set of nodes having the same node group as the relationship graph 101 and associated with a URI expressed in a pattern matching a common URI is connected by an edge. The unified graph 102 is a graph in which each node is connected to each node itself by an edge. The unified graph 102 is generated from the relationship graph 101 by the information processing apparatus 100, for example.

  The access source URI is a URI of a web page with an API call acquired by the information processing apparatus 100. The API call is an API call for accessing a web server and acquiring information from the web server. The access destination URI is a URI of a web page accessed by the API.

  Here, there is a case where a URI of a web page with an API call and a URI of a web page accessed by the API is a URI forbidden to access in accordance with “Same Origin Policy”. Therefore, the information processing apparatus 100 determines whether to permit access from the access source URI to the access destination URI.

  As shown in FIG. 1A, (1) the information processing apparatus 100 receives an input of the relation graph 101 from the user. In the example of FIG. 1, the relationship graph 101 includes nodes N1 to N4. The node N1 is a node associated with the URI “https://a.example.com”. The node N2 is a node associated with the URI “//b.example.net”. The node N3 is a node associated with the URI “https: //@example.net”. The node N4 is a node associated with the URI “https://c.example.com:443”.

  (2) The information processing apparatus 100 generates a unified graph 102 from the relationship graph 101. For example, the information processing apparatus 100 identifies nodes that can be unified from among the nodes N1 to N4. The nodes that can be unified are two nodes that are associated with URIs that are expressed by a pattern in a language that can be unified and matched with a common URI. In the example of FIG. 1, the node N2 and the node N3 have URIs “//b.example.net” and “https: //” that match a common URI (for example, “https://b.example.net”). /@Example.net ”, the nodes can be unified. Next, the information processing apparatus 100 generates a unified graph 102 in which nodes that can be unified are connected. Details of generation of the unified graph 102 from the relationship graph 101 will be described later with reference to FIGS.

  Here, as shown in FIG. 1B, (3) the information processing apparatus 100 acquires a web page with an API. Next, the information processing apparatus 100 detects that the API in the acquired web page has transmitted a request to a certain web page and has received a response. When the information processing apparatus 100 detects that a response has been received, the URI of the web page with the API is input as the access source URI, and the URI accessed by the API call on the web page is input as the access destination URI.

  In the example of FIG. 1, the information processing apparatus 100 inputs an access source URI “https://a.example.com:443” and an access destination URI “https://c.example.com:443”. Accept.

  (4) Next, the information processing apparatus 100 determines whether it is possible to access the access destination URI from the access source URI using the transition rule. The transition rule is a relation graph 101 indicating an access permission relationship, and a node associated with a URI matching an access destination URI is a node that can transition from a node associated with a URI matching an access source URI. If there is, it is a rule that determines that access is possible.

  In the example of FIG. 1, the information processing apparatus 100 specifies the node N1 associated with a URI expressed in a pattern in a language that can be unified and matched with the access source URI. Next, the information processing apparatus 100 searches the relation graph 101 for a node N2 that is adjacent to the node N1 and that can transition from the node N1.

  Then, the information processing apparatus 100 searches the unified graph 102 for a node N3 that is adjacent to the node N2 and can transition from the node N2. Next, the information processing apparatus 100 searches the relationship graph 101 for a node N4 that is adjacent to the node N3 and that can transition from the node N3. Here, the node N4 is associated with a URI expressed in a pattern in a language that can be determined to be unified with the matching access destination URI.

  Therefore, the information processing apparatus 100 determines that the transition from the node N1 associated with the URI matching the access source URI to the node N4 associated with the URI matching the access destination URI is possible. Therefore, the information processing apparatus 100 determines that the access destination URI can be accessed from the access source URI. When it is determined that access is possible, the information processing apparatus 100 permits access to the response from the web page of the access destination URI by the API in the web page of the access source URI. Details of the determination of whether access is possible will be described later with reference to FIGS.

  As described above, the information processing apparatus 100 can use the transition rule for the relation graph 101 including the URI expressed in a pattern in a language that can be determined to be unified. Therefore, the information processing apparatus 100 can improve the efficiency of setting access permission using a language that can be determined to be unified, and can determine whether access is possible using a transition rule.

  In the example of FIG. 1, the URI is used as information indicating the location of the web page in the network, but the present invention is not limited thereto. For example, Origin or URL may be used as information indicating the location of a web page on the network.

(Hardware configuration example of information processing apparatus 100)
FIG. 2 is a block diagram of a hardware configuration example of the information processing apparatus 100 according to the embodiment. In FIG. 2, the information processing apparatus 100 includes a CPU (Central Processing Unit) 201, a ROM (Read Only Memory) 202, a RAM (Random Access Memory) 203, a magnetic disk drive (Hard Disk Drive) 204, and a magnetic disk. 205, an optical disc drive 206, an optical disc 207, a display 208, an I / F (Interface) 209, a keyboard 210, a mouse 211, a scanner 212, and a printer 213. Each component is connected by a bus 200.

  Here, the CPU 201 governs overall control of the information processing apparatus 100. The ROM 202 stores a program such as a boot program. The RAM 203 is used as a work area for the CPU 201. The magnetic disk drive 204 controls reading / writing of data with respect to the magnetic disk 205 according to the control of the CPU 201. The magnetic disk 205 stores data written under the control of the magnetic disk drive 204.

  The optical disk drive 206 controls reading / writing of data with respect to the optical disk 207 according to the control of the CPU 201. The optical disk 207 stores data written under the control of the optical disk drive 206, or causes the computer to read data stored on the optical disk 207.

  The display 208 displays data such as a document, an image, and function information as well as a cursor, an icon, or a tool box. As this display 208, for example, a liquid crystal display, a plasma display, or the like can be adopted.

  An interface (hereinafter abbreviated as “I / F”) 209 is connected to a network 214 such as a LAN (Local Area Network), a WAN (Wide Area Network), and the Internet through a communication line. Connected to other devices. The I / F 209 controls an internal interface with the network 214 and controls data input / output from an external device. For example, a modem or a LAN adapter may be employed as the I / F 209.

  The keyboard 210 includes keys for inputting characters, numbers, various instructions, and the like, and inputs data. Moreover, a touch panel type input pad or a numeric keypad may be used. The mouse 211 performs cursor movement, range selection, window movement, size change, and the like. A trackball or a joystick may be used as long as they have the same function as a pointing device.

  The scanner 212 optically reads an image and takes in image data into the information processing apparatus 100. The scanner 212 may have an OCR (Optical Character Reader) function. The printer 213 prints image data and document data. As the printer 213, for example, a laser printer or an ink jet printer can be adopted. Note that at least one of the optical disk drive 206, the optical disk 207, the display 208, the keyboard 210, the mouse 211, the scanner 212, and the printer 213 may be omitted.

(Functional configuration example of information processing apparatus 100)
Next, a functional configuration example of the information processing apparatus 100 will be described with reference to FIG. FIG. 3 is a block diagram illustrating a functional configuration of the information processing apparatus 100. The information processing apparatus 100 includes an input unit 301, an acquisition unit 302, a generation unit 303, a specification unit 304, a search unit 305, a determination unit 306, a setting unit 307, and an output unit 308. Specifically, the input unit 301, the acquisition unit 302, the generation unit 303, the specification unit 304, the search unit 305, the determination unit 306, the setting unit 307, and the output unit 308 are illustrated in FIG. The functions are realized by causing the CPU 201 to execute a program stored in a storage device such as the ROM 202, the RAM 203, the magnetic disk 205, or the optical disk 207, or by the I / F 209.

  The input unit 301 inputs an access source address and an access destination address. The address is information indicating the location of the web page on the network, and is, for example, Origin, URI, or URL. The access source address is, for example, an Origin, URI, or URL of a web page acquired by the information processing apparatus 100. The access destination address is, for example, an Origin, URI, or URL of a web page that becomes a transmission destination of a request by API call in the web page and returns a response.

  Here, the URI that is the API call generation source in the web page and the URI that is the transmission destination of the request by the API may be a set of URIs whose access is prohibited in accordance with “Same Origin Policy”. Prohibiting access means, for example, prohibiting access to a response returned from the web page of the access destination URI from the API called in the web page of the access source URI.

  Specifically, in the example of FIG. 1, the input unit 301 acquires web page data having an API call that transmits a request to the web server. The web page data is, for example, HTML document data. In the HTML document, an API call is described using, for example, “Java (registered trademark) Script”. Next, when the API of the web page is called, the input unit 301 extracts the URL of the web page having the API call.

  Then, the input unit 301 converts the extracted URL into a URI “https://a.example.com:443” and receives it as an input of the access source URI. Here, more specifically, the input unit 301 converts the URL into a URI, for example, by extracting and connecting the URL scheme, host name, and port number. Moreover, the input part 301 complements a port number, when the port number is abbreviate | omitted. In general, when the port number is omitted, the input unit 301 complements 80 as the port number.

  Further, the input unit 301 extracts a URL that is a transmission destination of a request specified as an argument of the called API, converts the URL to a URI “https://c.example.com:443”, and an access destination URI Accept as input. The URL to URI conversion process is the same as the access source URI conversion process described above.

  Further, the input unit 301 may input the type of response received from the access destination address. Specifically, the input unit 301 receives, for example, an input of a response type “text / html” received by the API. More specifically, for example, the input unit 301 extracts the type of response received by the API from the header data of the received response. Thereby, the determination unit 306 can determine whether or not the access source URI input from the input unit 301 can be accessed. The input data is stored in a storage area such as the RAM 203, the magnetic disk 205, and the optical disk 207, for example.

  The acquisition unit 302 acquires connection information indicating a pair of a transition source node and a transition destination node that are set to be transitionable among nodes associated with addresses expressed by patterns in a language that can be unified. Here, the pattern in the language that can be unified is a pattern in which a set of character strings is represented by a certain character string. The pattern includes, for example, a so-called wild card.

  An address expressed by a pattern in a language that can be unified is an Origin, a URI, or a URL that is expressed by a pattern in a language that can be unified. The URI expressed by a pattern in a language that can be unified includes, for example, a URI that represents an arbitrary schema by omitting the schema. The URI expressed by a pattern in a language that can be unified will be described later with reference to FIG.

  The node with which the address is associated is, for example, the node of the relationship graph 101 described above. The connection information is, for example, the edge of the relation graph 101 described above. The edge is, for example, information associated with the transition source node, and is a pointer indicating a memory address where the transition destination node is stored.

  Specifically, for example, the acquisition unit 302 is input by a user of the information processing apparatus 100 and stored in a storage device such as the ROM 202, the RAM 203, the magnetic disk 205, and the optical disk 207 illustrated in FIG. To get.

  Specifically, the acquisition unit 302 may acquire the relationship graph 101 from, for example, a web server that provides a web page in which an API call is embedded. In this case, the input unit 301 may receive a user's operation of the keyboard 210 and the mouse 211 and input whether to use the relationship graph 101 acquired from the web server. Then, when the input unit 301 inputs that the acquisition unit 302 is not used, the acquisition unit 302 may discard the acquired relationship graph 101.

  The acquisition unit 302 may acquire type information indicating the type of access destination response set as a condition for enabling transition from the transition source node to the transition destination node. The type information is, for example, a response Content-Type. Specifically, for example, the acquisition unit 302 is input by the user of the information processing apparatus 100 as an access destination response type that permits access to an access destination from an API called by an access source. The type “text / html” is acquired.

  Specifically, the acquisition unit 302 may acquire the type information from, for example, a web server that provides a web page in which an API call is embedded. In this case, the input unit 301 may receive a user's operation of the keyboard 210 and the mouse 211 and input whether to use the type information acquired from the web server. Then, when the input unit 301 inputs that the acquisition unit 302 is not used, the acquisition unit 302 may discard the acquired type information.

  The acquisition unit 302 acquires unified information indicating a set of nodes in which nodes having a common address among the nodes associated with the address can transition. The existence of a common address means that the common address matches an address expressed by a pattern in a language that can be unified associated with each node of the node set. Matching addresses means being included in an address group indicated by an address expressed by a pattern in a language that can be unified. The unified information is, for example, the edge of the unified graph 102 described above.

  Specifically, the acquisition unit 302 is input by a user of the information processing apparatus 100, for example, and is stored in a storage device such as the ROM 202, the RAM 203, the magnetic disk 205, and the optical disk 207 illustrated in FIG. To get.

  The acquisition unit 302 may acquire the unified information generated by the generation unit 303. In this case, the generation unit 303 specifies a set of nodes matching the common address from the nodes associated with the addresses, and generates unified information indicating the specified set of nodes. Specifically, for example, the generation unit 303 generates a unified graph 102 by identifying a node that can be unified from the acquired relation graph 101 and adding an edge.

  The acquisition unit 302 may acquire the unified graph 102 from a web server that provides a web page in which an API call is embedded. In this case, the input unit 301 may receive a user's operation of the keyboard 210 and the mouse 211 and input whether to use the unified graph 102 acquired from the web server. Then, when the input unit 301 inputs that the acquisition unit 302 is not used, the acquisition unit 302 may discard the acquired unified graph 102.

  As a result, the search unit 305 uses the relationship graph 101 and the unified graph 102 acquired by the acquisition unit 302 to search for adjacent nodes that can transition from the node associated with the URI that matches the access source URI. Can do. The acquired data is stored in a storage area such as the RAM 203, the magnetic disk 205, and the optical disk 207, for example.

  The identifying unit 304 identifies a node associated with an address that matches the access source address input by the input unit 301 from among the nodes associated with the address. Specifically, in the example of FIG. 1, the identifying unit 304 can be unified to match the access source URI “https://a.example.com:443” from among the nodes N1 to N4 of the relationship graph 101. The node N1 associated with the URI “https://a.example.com” expressed by a pattern in a simple language is specified.

  Further, a case where there is a node associated with a URI “//@example.com” expressed by a pattern in a language that can be unified will be described as an example. In this case, the specifying unit 304 is associated with the URI “//@example.com” expressed by a pattern in a unified language that matches the access source URI “https://a.example.com:443”. You may identify the node that

  Thereby, the search unit 305 can start the search from the node specified by the specifying unit 304. The identified node is stored in a storage area such as the RAM 203, the magnetic disk 205, and the optical disk 207, for example.

  The search unit 305 searches for a node that can transition from the node specified by the specifying unit 304 based on the connection information and the unified information acquired by the acquisition unit 302. Specifically, the search unit 305 searches for a transition destination node that uses the identified node as a transition source node based on, for example, connection information.

  More specifically, in the example of FIG. 1, the search unit 305 searches for a node N2 connected by an edge from the identified node N1 in the relationship graph 101. Thereby, the determination unit 306 can determine whether or not the searched node is associated with a URI expressed by a pattern in a language that can be unified that matches the access destination URI.

  Specifically, for example, the search unit 305 may search for a node that can transition from a node determined not to match by the determination unit 306 based on the unified information. Next, the search unit 305 may search for a transition destination node that makes the searched transitionable node a transition source node based on the connection information.

  More specifically, the search unit 305 searches for the node N3 connected from the node N2 by the edge in the unified graph 102 in the example of FIG. Next, the search unit 305 searches the relationship graph 101 for a node N4 connected by an edge from the searched node N3. Thereby, the determination unit 306 can determine whether or not the searched node is associated with a URI expressed by a pattern in a language that can be unified that matches the access destination URI.

  Specifically, the search unit 305, for example, based on the connection information, the type input by the input unit 301 is the type indicated by the type information acquired by the acquisition unit 302, and the identified node You may search the transition destination node made into a transition origin node.

  Specifically, for example, in the relationship graph 101, the search unit 305 searches for a node connected by an edge associated with the type information “text / html” from the identified node. Further, the search unit 305 may search for nodes connected by edges associated with type information “empty set” indicating an arbitrary type from the identified nodes. Thereby, the determination unit 306 can determine whether or not the searched node is associated with a URI expressed by a pattern in a language that can be unified that matches the access destination URI.

  Based on the unified information, the search unit 305 searches for a node that can transition from the node determined not to match by the determination unit 306. Next, based on the connection information, the search unit 305 determines that the type input by the input unit 301 is the type indicated by the type information acquired by the acquisition unit 302, and the searched transitionable node is the transition source node. Search for the transition destination node.

  Here, a case where a URI that is expressed by a pattern in a language that can be unified that matches the access destination URI is not associated with the searched node will be described as an example. In this case, the search unit 305 searches the unified graph 102 for a node connected by an edge from a node that is not associated with a URI expressed by a pattern in a unified language that matches the access destination URI.

  Next, the search unit 305 searches the relation graph 101 for a node connected by an edge associated with the type information “text / html” from the searched nodes. Thereby, the determination unit 306 can determine whether or not the searched node is associated with a URI expressed by a pattern in a unified language that matches the access destination URI. The searched node is stored in a storage area such as the RAM 203, the magnetic disk 205, and the optical disk 207, for example.

  The determination unit 306 determines whether the access destination address input by the input unit 301 matches the address associated with the node searched by the search unit 305. Specifically, in the example of FIG. 1, the determination unit 306 adds the access destination URI “https: // c” to the URI “https://c.example.com:443” associated with the searched node N4. .Example.com: 443 ”is determined to match.

  In addition, a case where a node associated with a URI “//@example.com” expressed by a pattern in a language that can be unified is searched will be described as an example. In this case, the access destination URI “https://c.example.com:443” is added to the URI “//@example.com” associated with the searched node and expressed by a pattern in a language that can be unified. To match. Therefore, the determination unit 306 determines that there is a match.

  Thereby, the setting unit 307 can permit access to the access destination URI from the API that uses the access source URI as a generation source, using the determination result. The determination result is stored in a storage area such as the RAM 203, the magnetic disk 205, and the optical disk 207, for example.

  When it is determined by the determination unit 306 that the match is made, the setting unit 307 sets from a state in which access from the access source address to the access destination address is prohibited to a state in which access from the access source address to the access destination address is permitted. The state of prohibiting access refers to prohibiting access to the response returned from the web page at the access destination address by the API called in the web page at the access source address.

  Specifically, for example, the setting unit 307 sets the web browser to avoid “Same Origin Policy”. Thereby, the API called by the access source URI in the web browser can access the response sent from the access destination URI.

  If the determination unit 306 determines that there is no match, the information processing apparatus 100 adds the node associated with the access source URI and the node associated with the access destination URI to the relationship graph 101 and connects them by an edge. May be.

  In this case, the input unit 301 inputs permission information indicating whether or not a set of a node associated with the access source URI and a node associated with the access destination URI is set as a transitionable node set from the user. Accept.

  In this case, when the permission information indicates that the permission information is set, the generation unit 303 adds the node associated with the access source URI and the node associated with the access destination URI to the relationship graph 101 and connects them by an edge. As a result, the user of the information processing apparatus 100 can add a set of URIs determined to be inaccessible to the relationship graph and set the set of accessible URIs.

  Here, the information processing apparatus 100 determines whether or not access from the web page URI acquired by the information processing apparatus 100 is permitted to the URI of the web page that is a transmission destination of a request by an API call in the web page and returns a response. However, it is not limited to this. For example, the information processing apparatus 100 may receive an input of a set of an arbitrary access source address and an access destination address from a user and determine whether access is possible.

  Here, the functions of the acquisition unit 302, the identification unit 304, the search unit 305, and the determination unit 306 determine whether access to the URI of the web page that returns a response to the API in the web page from the URI of the web page. The description is omitted for the same reason.

  In this case, the input unit 301 inputs an access source address and an access destination address in response to an operation of the keyboard 210 and the mouse 211 by the user. Specifically, the input unit 301 inputs, for example, the access source URI “https://a.example.com:443” and the access destination URI “https://c.example.com:443”. To do.

  In this case, the output unit 308 outputs the determination result by the determination unit 305. Examples of the output format include display on the display 208, print output to the printer 213, and transmission to an external device by the I / F 209. Alternatively, the data may be stored in a storage area such as the RAM 203, the magnetic disk 205, and the optical disk 207. Thereby, the user of the information processing apparatus 100 can know whether or not the access destination address can be accessed from the input arbitrary access source address.

(Generation of unified graph 102 from relationship graph 101)
Next, details of generating the unified graph 102 from the relationship graph 101 will be described with reference to FIGS. First, an example of the relationship graph 101 will be described with reference to FIG.

  FIG. 4 is an explanatory diagram illustrating an example of the relationship graph 101. As shown in FIG. 4, the relationship graph 101 is a graph including a group of nodes associated with URIs expressed by patterns in a language that can be unified. The relation graph 101 may include nodes associated with URIs expressed without using patterns.

  The relation graph 101 is a graph in which a node associated with an access source URI that is permitted to access and a node associated with an access destination URI are connected by a directed edge. In the example of FIG. 4, the node N1 is connected to the node N2 by a directed edge. Further, the node N3 is connected to the node N4 by a directed edge.

  Further, the relationship graph 101 may associate information specifying the response content-type with the directed edge. In the example of FIG. 4, text / html is associated with the directed edge from the node N1 to the node N2. An empty set is associated with the directed edge from the node N3 to the node N4. An empty set indicates that an arbitrary Content-Type is associated.

  As described above, the URI associated with the node of the relationship graph 101 can be expressed using a pattern in a language that can be unified. The URI can be expressed by omitting the schema, for example. The URI with the schema omitted matches the URI of an arbitrary schema.

  Also, the URI can be expressed by giving @ indicating user information in front of the host name, for example. For example, a URI using @ matches a URI with @ replaced with 0 characters. Further, for example, a URI using @ matches a URI in which @ is replaced with an arbitrary character string ending with “. (Dot)”.

  The URI can be expressed by omitting the port number, for example. The URI with the port number omitted matches the URI of an arbitrary port number. Here, an example of a URI expressed by a pattern in a language that can be unified will be described with reference to FIG.

  FIG. 5 is an explanatory diagram showing an example of a URI expressed by a pattern in a language that can be unified. As shown in FIG. 5A, the URI “//b.example.net” is represented by omitting the schema and the port number. Therefore, the URI “//b.example.net” matches, for example, the URI “http://b.example.net:8080” and the URI “https://b.example.net”.

  As shown in FIG. 5B, the URI “https: //@example.net” is represented by adding user information @ in front of the host name and omitting the port number. Therefore, the URI “https: //@example.net” matches, for example, the URI “https://example.net:8443” and the URI “https://b.example.net”.

  As shown in FIG. 5C, the URI “https://c.example.com:443” does not use a pattern in a language that can be unified. The URI “https://c.example.com:443” matches, for example, the URI “https://c.example.com:443” itself.

  Here, the information processing apparatus 100 identifies URIs that can be unified from URIs expressed by patterns in a language that can be unified, and connects nodes that associate the URIs that can be unified by edges. The unified graph 102 is generated. Next, a generation example of the unified graph 102 by the information processing apparatus 100 will be described with reference to FIG.

  FIG. 6 is an explanatory diagram illustrating an example of generation of the unified graph 102 by the information processing apparatus 100. For example, the information processing apparatus 100 compares the URI “//b.example.net” associated with the node N2 with the URI “https: //@example.net” associated with the node N3.

  Here, the URI schema associated with the node N2 is omitted, and the URI schema associated with the node N3 is “https”. Further, the host name of the URI associated with the node N2 is “b.example.net”, and the user information “@” is added in front of the host name of the URI associated with the node N3 “@ example.net”. It is. The URI port numbers associated with the node N2 and the node N3 are omitted from each other.

  Therefore, the information processing apparatus 100 determines that a common URI (for example, “https://b.example.net”) matches the URIs associated with the node N2 and the node N3, and can be unified. Judge that there is. Then, as illustrated in FIG. 6A, the information processing apparatus 100 connects the node N2 and the node N3 with an edge.

  Further, the information processing apparatus 100 may represent the unified graph 102 by a directed bipartite graph as illustrated in FIG. The left side of the directed bipartite graph shows the URI of the access source, and the right side of the directed bipartite graph shows the URI of the access destination. The information processing apparatus 100 compares the right URI and the left URI in the directed bipartite graph, and if there is a node associated with a URI that can be unified, the information processing apparatus 100 connects from the right to the left with an edge.

  Next, generation of the unified graph 102 when a node is added to the relationship graph 101 will be described with reference to FIG.

  FIG. 7 is an explanatory diagram illustrating generation of the unified graph 102 when a node is added to the relationship graph 101. In the example of FIG. 7, (1) a relationship graph 101 includes a node N5 associated with the URI “https: //@example.com” and a node N6 associated with the URI “http://b.example.net”. To be added. The node N5 is connected to the node N6 by an edge.

  (2) Here, the information processing apparatus 100 also adds the nodes N5 and N6 to the unified graph 102. Next, the information processing apparatus 100 identifies URIs that can be unified with the URIs associated with the added nodes N5 and N6 from the URIs associated with the nodes N1 to N4, and can be unified. Nodes associated with each other are connected by an edge. In the example of FIG. 7, the information processing apparatus 100 connects the node N1 and the node N5, the node N4 and the node N5, and the node N2 and the node N6, respectively.

  Next, a detailed processing procedure of the unified graph generation processing will be described with reference to FIG. The unified graph generation process is a process for creating the unified graph 102 using the relation graph 101 by the information processing apparatus 100 shown in FIGS.

  FIG. 8 is a flowchart showing a detailed processing procedure of the unified graph generation processing. As shown in FIG. 8, first, the information processing apparatus 100 adds the node Na added to the relationship graph 101 to the unified graph 102 (step S801).

  Next, the information processing apparatus 100 determines whether there is an unprocessed node Ni (step S802). Here, the node Ni indicates an arbitrary node. When there is no unprocessed node Ni (step S802: No), the information processing apparatus 100 ends the unified graph generation process.

  On the other hand, when there is an unprocessed node Ni (step S802: Yes), the information processing apparatus 100 selects an unprocessed node Ni (step S803). Next, the information processing apparatus 100 performs the unification determination process illustrated in FIG. 9 on the URI associated with the selected node Ni and the URI associated with the added node Na (step S804).

  Then, the information processing apparatus 100 determines whether or not the determination result of the unification determination process is “possible” for unification (step S805). Here, when it is not unified “possible” (step S805: No), the information processing apparatus 100 returns to step S802.

  On the other hand, if the information processing apparatus 100 is unified “possible” (step S805: Yes), the selected node Ni and the added node Na in the unified graph 102 are connected by an edge (step S806). The process returns to S802.

  Thereby, the information processing apparatus 100 can generate the unified graph 102 from the relationship graph 101 by adding the added node to the unified graph 102 every time a node is added to the relationship graph 101. . Next, a detailed processing procedure of the unification determination process in step S804 will be described with reference to FIG.

  FIG. 9 is a flowchart showing a detailed processing procedure of the unification determination processing in step S804. As illustrated in FIG. 9, the information processing apparatus 100 accepts a set of URIs (step S901). Next, the information processing apparatus 100 decomposes the accepted URI set into a schema, user information, a host name, and a port number (step S902).

  Then, the information processing apparatus 100 determines whether or not the character string has a different schema (step S903). If the schema of any URI in the URI set is omitted, it is determined that the schema is not a different character string.

  Here, when the character strings have different schemas (step S903: Yes), the information processing apparatus 100 proceeds to step S910.

  On the other hand, when the schemas are not different character strings (step S903: No), the information processing apparatus 100 determines whether the host names are the same (step S904). If the host names are the same (step S904: Yes), the information processing apparatus 100 proceeds to step S909.

  On the other hand, when the host names are not the same (step S904: No), the information processing apparatus 100 sets the URI with the shorter host name as URI1 and sets the URI with the longer host name as URI2 in the set of URIs. Setting is made (step S905).

  Next, the information processing apparatus 100 determines whether or not there is user information @ in the URI 1 (step S906). Here, when there is no user information @ (step S906: No), the information processing apparatus 100 proceeds to step S910.

  On the other hand, when there is user information @ (step S906: Yes), the information processing apparatus 100 determines whether or not the host name of URI1 is empty (step S907). Here, when it is empty (step S907: Yes), the information processing apparatus 100 proceeds to step S909.

  On the other hand, if it is not empty (step S907: No), the information processing apparatus 100 determines whether the end of the URI2 host name is “.URI1 host name” (step S908). If the end of the URI2 host name is not “.URI1 host name” (step S908: NO), the information processing apparatus 100 proceeds to step S910.

  On the other hand, if the end of the URI2 host name is “.URI1 hostname” (step S908: Yes), the information processing apparatus 100 determines whether the port number is a different value (step S909). If the port number of any URI in the set of URIs is omitted, it is determined that the port number is not a different value.

  If the port numbers have different values (step S909: Yes), the information processing apparatus 100 outputs “unavailable” (step S910), and ends the unification determination process.

  On the other hand, if the port number is not a different value (step S909: No), the information processing apparatus 100 outputs the unified “possible” (step S911) and ends the unified determination process. As a result, the information processing apparatus 100 can identify a set of nodes to be connected by edges in the unified graph 102.

(Determining whether access is possible)
Next, determination of access permission by the information processing apparatus 100 will be described with reference to FIGS. First, an example of determining whether access is possible by the information processing apparatus 100 will be described with reference to FIG.

  FIG. 10 is an explanatory diagram illustrating an example of determining whether access is possible by the information processing apparatus 100. As shown in FIG. 10A, (1) the information processing apparatus 100 acquires a web page from the web server S1. The acquired web page has an API call. The API is an API that accesses the web server S2 and acquires information from the web server S2. The API is, for example, “XMLHttpRequest” of “Java (registered trademark) Script”.

  Here, when the API is called, the information processing apparatus 100 determines whether or not access from the URI of the web page where the API call is made to the URI accessed by the API is permitted. Therefore, the information processing apparatus 100 converts the URL of a web page with an API call into a URI and sets it as an access source URI, converts the URL accessed through the API into a URI and sets it as an access destination URI, Determine.

  The information processing apparatus 100 converts the URL into a URI, for example, by extracting and connecting the URL scheme, host name, and port number. Further, the information processing apparatus 100 complements the port number when the port number is omitted. Generally, when the port number is omitted, the information processing apparatus 100 complements 80 as the port number.

  Further, the information processing apparatus 100 may acquire the type “text / html” as the type of response of the called API. What kind of response is received by the called API can be acquired from header data of an HTTP response, for example.

  In the example of FIG. 10A, the information processing apparatus 100 includes an access source URI “https://a.example.com:443” and an access destination URI “https://c.example.com:443”. And are set. Further, it is assumed that the information processing apparatus 100 has acquired “text / html” as the API response type.

  As shown in FIG. 10B, (2) the information processing apparatus 100 has a URI “https: ///” matching the access source URI “https://a.example.com:443” from among the nodes. The node N1 associated with “a.example.com” is specified.

  Next, the information processing apparatus 100 searches for a node N2 that can transition from the node N1 by tracing an edge adjacent to the node N1 and associated with the type “text / html” in the relationship graph 101. Adjacent means that the nodes are connected by one edge. Here, the information processing apparatus 100 matches the access destination URI “https://c.example.com:443” with the URI “//b.example.net” associated with the searched node N2. Determine whether or not.

  Then, since the access destination URI does not match the URI associated with the node N2, the information processing apparatus 100 proceeds to the process (3) in FIG. 10C and is adjacent to the node N2 in the unified graph 102. Then, a node that can transition from the node N2 is searched.

  As shown in FIG. 10C, (3) the information processing apparatus 100 searches the unified graph 102 for a node N3 that is adjacent to the node N2 and can be shifted from the node N2. Next, the information processing apparatus 100 proceeds to the process (4) in FIG. 10C, and searches for a node that is adjacent to the node N3 and can be shifted from the node N3 in the relationship graph 101.

  (4) Next, the information processing apparatus 100 can transition from the node N3 by following an edge that is adjacent to the node N3 and associated with the type “empty set” including the type “text / html” in the relationship graph 101. Search for a new node N4. Here, the information processing apparatus 100 adds the access destination URI “https://c.example.com:443” to the URI “https://c.example.com:443” associated with the searched node 4. Whether or not matches.

  The information processing apparatus 100 determines that the access destination URI matches the URI associated with the node N4. Therefore, the information processing apparatus 100 determines that the transition from the node N1 associated with the URI matching the access source URI to the node N4 associated with the URI matching the access destination URI is possible. Judge that there is.

  Next, a detailed processing procedure of the accessibility determination process will be described with reference to FIGS. 11 and 12. The accessibility determination process is a process executed by the information processing apparatus 100 illustrated in FIG.

  FIG. 11 and FIG. 12 are flowcharts showing the detailed processing procedure of the accessibility determination process. As illustrated in FIG. 11, the information processing apparatus 100 receives input of an access source URI and an access destination URI (step S <b> 1101).

  Next, the information processing apparatus 100 determines whether or not the received URIs are the same (step S1102). If the URIs are the same (step S1102: YES), the information processing apparatus 100 outputs “accessible” (step S1103) and ends the access permission determination process.

  On the other hand, when the URIs are not the same (step S1102: No), the information processing apparatus 100 executes the unification determination process for each node on the access source URI and the URI associated with each node of the relation graph 101. (Step S1104). The unification determination process is the process shown in FIG.

  Next, the information processing apparatus 100 extracts the node that is output as “unable” by the unification determination process (step S1105). Through the processes in steps S1104 and S1105, the information processing apparatus 100 performs the unification determination process for the number of nodes, and extracts all nodes that can be unified. Then, the information processing apparatus 100 stores the extracted node in historySet and stack (step S1106).

  Here, historySet is a storage area for storing processed nodes. The information processing apparatus 100 can prevent the processed node from being processed again by referring to the stored contents of the historySet. The stack is a storage area for storing a node waiting for processing.

  Next, the information processing apparatus 100 determines whether the stack is not empty (step S1107). If the stack is not empty (step S1107: Yes), the information processing apparatus 100 proceeds to step S1201 in FIG.

  On the other hand, when the stack is empty (step S1107: No), the information processing apparatus 100 outputs access “impossible” (step S1108), and ends the access permission determination process.

  In FIG. 12, the information processing apparatus 100 selects a node from the stack, and deletes the selected node from the stack (step S1201). Next, the information processing apparatus 100 extracts an edge that is adjacent to the selected node and can be shifted from the selected node in the relationship graph 101 (step S1202).

  Then, the information processing apparatus 100 determines whether there is an unprocessed edge among the extracted edges (step S1203). If there is no unprocessed edge (step S1203: No), the information processing apparatus 100 proceeds to step S1107 in FIG.

  On the other hand, when there is an unprocessed edge (step S1203: Yes), the information processing apparatus 100 selects an unprocessed edge (step S1204). Next, the information processing apparatus 100 determines whether or not the Content-Type associated with the selected edge includes the accessed Content-Type (Step S1205).

  Here, when the Content-Type is not included (step S1205: No), the information processing apparatus 100 returns to step S1203. On the other hand, in the case of including the Content-Type (step S1205: Yes), the information processing apparatus 100 performs processing for the URI and the access destination URI that are adjacent to the selected node and associated with the node that can be shifted by the selected edge. The unification determination process is executed (step S1206). The unification determination process is the process shown in FIG.

  Next, the information processing apparatus 100 determines whether or not the determination result obtained by the unification determination process is “enabled” (step S1207). Here, when it is unified “possible” (step S1207: Yes), the information processing apparatus 100 proceeds to step S1103 in FIG.

  On the other hand, in the case of unification “impossible” (step S1207: No), the information processing apparatus 100 adds a node that can move adjacent to a node whose determination result is unification “impossible” in the unification graph 102. Extract (step S1208).

  Next, the information processing apparatus 100 determines whether there is an unprocessed node among the extracted nodes (step S1209). If there is no unprocessed node (step S1209: NO), the information processing apparatus 100 returns to step S1203.

  On the other hand, when there is an unprocessed node (step S1209: Yes), the information processing apparatus 100 selects an unprocessed node (step S1210). Next, the information processing apparatus 100 determines whether or not the selected node is included in the historySet (step S1211).

  Here, when not included in the historySet (step S1211: No), the information processing apparatus 100 adds the selected node to the historySet and stack (step S1212), and returns to step S1209.

  On the other hand, when it is included in the historySet (step S1211: Yes), the information processing apparatus 100 returns to step S1209. As a result, the user of the information processing apparatus 100 can secure security by prohibiting access to the response of the access destination URI from the access source URI for the combination of the access source URI and the access destination URI that are not permitted. it can.

  Further, the information processing apparatus 100 may cause the user of the information processing apparatus 100 to input whether or not to execute the accessibility determination process. Thereby, the user of the information processing apparatus 100 can prevent the API on the unreliable web page from accessing the information on the web page of the access destination URI.

  Further, the information processing apparatus 100 may accept an input of a set of an arbitrary access source URI and an access destination URI from a user of the information processing apparatus 100. Then, the information processing apparatus 100 may execute an access permission determination process for the accepted URI set. As a result, the user of the information processing apparatus 100 can know whether or not a combination of an arbitrary access source URI and an access destination URI is a set of accessible URIs. As a result, the user of the information processing apparatus 100 can confirm whether the set of URIs determined to be accessible by the relationship graph 101 set by the user is the set of URIs assumed by the user.

  If the information processing apparatus 100 determines that access is impossible, the information processing apparatus 100 allows the user of the information processing apparatus 100 to access the access destination URI from the access source URI determined to be access impossible. You may receive the input of whether to do. Next, an example of access permission input will be described with reference to FIG.

  FIG. 13 is an explanatory diagram of an example of access permission input. As illustrated in FIG. 13, the information processing apparatus 100 displays an attention sentence indicating a risk of avoiding “Same Origin Policy”, an access source URI, an access destination URI, and a Content-Type that are determined as “impossible to access”. Is displayed on the display 208.

  Further, the information processing apparatus 100 displays an input button “OK” indicating that access from the access source URI determined to be “impossible” to the access destination URI is permitted on the display 208. Further, the information processing apparatus 100 displays an input button “Cancel” indicating that access from the access source URI determined to be “impossible” to the access destination URI is not permitted on the display 208.

  Then, the information processing apparatus 100 changes the access source URI from the access URI determined as “impossible” to the access destination URI when the “OK” input button is pressed by the user's operation of the keyboard 210 or the mouse 211. Allow access. As a result, the information processing apparatus 100 can permit only the current access in which the “OK” input button is pressed among the accesses from the access source URI determined as “impossible” to the access destination URI. .

  In addition, when the “OK” input button is pressed, the information processing apparatus 100 displays, in the relationship graph 101, a node associated with the access source URI determined to be “impossible to access” and a node associated with the access destination URI. They may be added and connected by edges. As a result, the information processing apparatus 100 can permit access from the access source URI determined as “impossible” to the access destination URI after the “OK” input button is pressed.

  Next, a detailed processing procedure of the access permission setting process will be described with reference to FIG. The access permission setting process is a process in the case where the “OK” input button by the information processing apparatus 100 shown in FIG.

  FIG. 14 is a flowchart showing a detailed processing procedure of the access permission setting process. As illustrated in FIG. 14, the information processing apparatus 100 receives an access source URI, an access destination URI, and a Content-Type that are determined as “impossible to access” (step S1401).

  Next, the information processing apparatus 100 determines whether there is an edge connecting the access destination address to the access source address in the relationship graph 101 (step S1402). If there is an edge (step S1402: Yes), the information processing apparatus 100 adds Content-Type to the edge (step S1403), and ends the access permission setting process.

  On the other hand, when there is no edge (step S1402: No), the information processing apparatus 100 adds the node associated with the access source URI and the node associated with the access destination URI to the relationship graph 101, and connects them with the edge ( Step S1404).

  Next, the information processing apparatus 100 adds Content-Type to the edge (step S1405). Then, the information processing apparatus 100 updates the unified graph 102 (step S1406), and ends the access permission setting process. As a result, the information processing apparatus 100 can correct the relation graph 101 and the unified graph 102 so that access from the access source URI determined to be “impossible” to the access destination URI is permitted thereafter. it can.

  As described above, the information processing apparatus 100 shifts from the node associated with the access source URI to the node associated with the access destination URI by alternately following the edge of the relation graph 101 and the edge of the unified graph 102. Determine whether it is possible. Next, the information processing apparatus 100 permits access from the access source URI to the access destination URI when the transition is possible.

  Thereby, the information processing apparatus 100 can express the access permission relationship with a URI pattern and can apply the transition rule. As a result, the user of the information processing apparatus 100 can reduce the set amount of the relation graph 101 by expressing the URI for which access is permitted using a pattern, so that the relation graph 101 can be generated efficiently. . The URI may be Origin or URL.

  The information processing apparatus 100 may associate type information indicating the type of response that permits access with the edge of the relationship graph 101. As a result, the information processing apparatus 100 can permit access by limiting the type of response in determining whether access is possible according to the transition rule.

  The information processing apparatus 100 may generate the unified graph 102 from the relationship graph 101. Thereby, the production | generation work of the unified graph 102 by the user of the information processing apparatus 100 can be reduced.

  Further, the information processing apparatus 100 may acquire the relation graph 101 and the unified graph 102 from a web server that provides the web page of the access source URI. Thereby, the user of the information processing apparatus 100 can reduce the generation work of the relation graph 101 and the unified graph 102. Further, in this case, the information processing apparatus 100 causes the user of the information processing apparatus 100 to input whether or not to use the acquired relation graph 101 or the unified graph 102. 101 or the unified graph 102 may be discarded. Thereby, the user of the information processing apparatus 100 can discard the relation graph 101 and the unified graph 102 acquired from an unreliable web server and ensure security.

  Further, the information processing apparatus 100 may accept an input of a set of an arbitrary access source URI and an access destination URI from a user of the information processing apparatus 100. Then, the information processing apparatus 100 may execute an access permission determination process for the accepted URI set. As a result, the user of the information processing apparatus 100 can know whether or not a combination of an arbitrary access source URI and an access destination URI is a set of accessible URIs. As a result, the user of the information processing apparatus 100 can confirm whether the set of URIs determined to be accessible by the relationship graph 101 set by the user is the set of URIs assumed by the user.

  In addition, the information processing apparatus 100 may accept an input from a user of the information processing apparatus 100 as to whether or not to permit access to the access destination URI from the access source URI determined to be “access impossible”. Then, the information processing apparatus 100 adds, to the relationship graph 101, a node associated with an access source URI that is determined as “impossible to access” and a node associated with an access destination URI when permitted by the user. You may connect by. As a result, the information processing apparatus 100 can correct the relation graph 101 and the unified graph 102 so that access from the access source URI determined to be “impossible” to the access destination URI is permitted thereafter. it can.

  The information processing method described in this embodiment can be realized by executing a program prepared in advance on a computer such as a personal computer or a workstation. The information processing program is recorded on a computer-readable recording medium such as a hard disk, a flexible disk, a CD-ROM, an MO, and a DVD, and is executed by being read from the recording medium by the computer. The information processing program may be distributed through a network such as the Internet.

  The following additional notes are disclosed with respect to the embodiment described above.

(Appendix 1) An input unit for inputting an access source address and an access destination address;
A first acquisition unit that acquires connection information indicating a pair of a transition source node and a transition destination node set to be transitionable among nodes associated with addresses expressed by patterns in a language that can be unified;
A second acquisition unit that acquires unified information indicating a set of nodes in which nodes having a common address among the nodes associated with the address can transit;
A identifying unit that identifies a node associated with the address that matches the access source address input by the input unit from among the nodes associated with the address;
Based on the connection information and the unified information acquired by the first and second acquisition units, a search unit that searches for a node that can transition from the node specified by the specifying unit;
A determination unit for determining whether or not the access destination address input by the input unit matches the address associated with the node searched by the search unit;
A setting unit configured to set from a state in which access from the access source address to the access destination address is prohibited to a state in which access from the access source address to the access destination address is permitted when it is determined by the determination unit to match When,
An information processing apparatus comprising:

(Supplementary Note 2) The search unit
Based on the connection information, search for a transition destination node that makes the identified node a transition source node,
The determination unit
Determining whether the access address matches the address associated with the node searched by the search unit;
The information processing apparatus according to appendix 1, wherein

(Supplementary Note 3) The search unit
Based on the unified information, a transitionable node is searched for a transitionable node from a node determined not to be matched by the determination unit, and based on the connection information, the transitionable node is determined as a transition source node. Explore
The determination unit
Determining whether the access address matches the address associated with the node searched by the search unit;
The information processing apparatus according to Supplementary Note 2, wherein

(Appendix 4) The input unit is
Enter the type of response received from the access destination address,
The first acquisition unit includes:
Obtaining type information indicating the type of access destination response set as a condition for enabling transition from the transition source node to the transition destination node,
The search unit
Based on the connection information, a type input by the input unit is a type indicated by the type information acquired by the first acquisition unit, and a transition destination node that makes the specified node a transition source node Explore
The determination unit
Determining whether the access address matches the address associated with the node searched by the search unit;
The information processing apparatus according to appendix 1, wherein

(Supplementary Note 5) The search unit
Based on the unified information, a node that can be transited from a node that is determined not to be matched by the determination unit is searched, and based on the connection information, the type input by the input unit is determined by the first acquisition unit. Search for a transition destination node that is a type indicated by the acquired type information and uses the searched transitionable node as a transition source node,
The determination unit
Determining whether the access address matches the address associated with the node searched by the search unit;
The information processing apparatus according to supplementary note 4, wherein:

(Additional remark 6) It has the unified information production | generation part which produces | generates the said unified information which identifies the group of the node which a common address matches among the nodes which linked | related the said address, and shows the identified group of nodes,
The second acquisition unit includes:
Obtaining unified information generated by the unified information generating unit;
The information processing apparatus according to any one of supplementary notes 1 to 5, wherein:

(Supplementary note 7) The address expressed by the pattern in the language that can be unified is a URI, and a wild card can be used in at least one of the schema, the first half of the host name, and the port number. The information processing apparatus according to any one of 1 to 6.

(Additional remark 8) The output part which outputs the determination result by the said determination part,
The information processing apparatus according to any one of appendices 1 to 7, characterized by comprising:

(Supplementary Note 9) If the determination unit determines that there is no match, whether or not to set a set of a node associated with the access source address and a node associated with the access destination address as a set of transitable nodes N A reception unit for receiving permission information indicating
A connection information generating unit that generates connection information indicating a set of a node associated with the access source address and a node associated with the access destination address, when the permission information received by the reception unit is set;
The information processing apparatus according to any one of appendices 1 to 8, characterized by comprising:

(Supplementary note 10)
Enter the access source address and access destination address,
Acquire connection information indicating a pair of transition source node and transition destination node that is set to be transitionable among nodes associated with addresses expressed by patterns in a language that can be unified,
Obtaining unified information indicating a set of nodes in which nodes having a common address among the nodes associated with the address can transition,
From among the nodes associated with the address, identify the node associated with the address that matches the input access source address,
Based on the acquired connection information and unified information, search for nodes that can transition from the identified node,
Determine whether the input access address matches the address associated with the searched node,
If it is determined to match, from a state of prohibiting access from the access source address to the access destination address, a state of permitting access from the access source address to the access destination address is set.
An information processing method characterized by executing processing.

(Supplementary note 11)
Enter the access source address and access destination address,
Acquire connection information indicating a pair of transition source node and transition destination node that is set to be transitionable among nodes associated with addresses expressed by patterns in a language that can be unified,
Obtaining unified information indicating a set of nodes in which nodes having a common address among the nodes associated with the address can transition,
From among the nodes associated with the address, identify the node associated with the address that matches the input access source address,
Based on the acquired connection information and unified information, search for nodes that can transition from the identified node,
Determine whether the input access address matches the address associated with the searched node,
If it is determined to match, from a state of prohibiting access from the access source address to the access destination address, a state of permitting access from the access source address to the access destination address is set.
An information processing program for executing a process.

DESCRIPTION OF SYMBOLS 100 Information processing apparatus 101 Relation graph 102 Unified graph 301 Input part 302 Acquisition part 303 Generation part 304 Identification part 305 Search part 306 Determination part 307 Setting part 308 Transmission part

Claims (11)

An input unit for inputting an access source address and an access destination address;
A first acquisition unit that acquires connection information indicating a pair of a transition source node and a transition destination node set to be transitionable among nodes associated with addresses expressed by patterns in a language that can be unified;
A second acquisition unit that acquires unified information indicating a set of nodes in which nodes having a common address among the nodes associated with the address can transit;
A identifying unit that identifies a node associated with the address that matches the access source address input by the input unit from among the nodes associated with the address;
Based on the connection information and the unified information acquired by the first and second acquisition units, a search unit that searches for a node that can transition from the node specified by the specifying unit;
A determination unit for determining whether or not the access destination address input by the input unit matches the address associated with the node searched by the search unit;
A setting unit configured to set from a state in which access from the access source address to the access destination address is prohibited to a state in which access from the access source address to the access destination address is permitted when it is determined by the determination unit to match When,
An information processing apparatus comprising: The search unit
Based on the connection information, search for a transition destination node that makes the identified node a transition source node,
The determination unit
Determining whether the access address matches the address associated with the node searched by the search unit;
The information processing apparatus according to claim 1. The search unit
Based on the unified information, a transitionable node is searched for a transitionable node from a node determined not to be matched by the determination unit, and based on the connection information, the transitionable node is determined as a transition source node. Explore
The determination unit
Determining whether the access address matches the address associated with the node searched by the search unit;
The information processing apparatus according to claim 2. The input unit is
Enter the type of response received from the access destination address,
The first acquisition unit includes:
Obtaining type information indicating the type of access destination response set as a condition for enabling transition from the transition source node to the transition destination node,
The search unit
Based on the connection information, a type input by the input unit is a type indicated by the type information acquired by the first acquisition unit, and a transition destination node that makes the specified node a transition source node Explore
The determination unit
Determining whether the access address matches the address associated with the node searched by the search unit;
The information processing apparatus according to claim 1. The search unit
Based on the unified information, a node that can be transited from a node that is determined not to be matched by the determination unit is searched, and based on the connection information, the type input by the input unit is determined by the first acquisition unit. Search for a transition destination node that is a type indicated by the acquired type information and uses the searched transitionable node as a transition source node,
The determination unit
Determining whether the access address matches the address associated with the node searched by the search unit;
The information processing apparatus according to claim 4. A unified information generating unit for identifying a set of nodes matching a common address from the nodes associated with the address, and generating the unified information indicating the identified set of nodes;
The second acquisition unit includes:
Obtaining unified information generated by the unified information generating unit;
The information processing apparatus according to claim 1, wherein the information processing apparatus is an information processing apparatus.   7. The address represented by the pattern in the language that can be unified is a URI, and a wild card can be used in at least one of a schema, a first half of a host name, and a port number. The information processing apparatus according to any one of the above. An output unit for outputting a determination result by the determination unit;
The information processing apparatus according to claim 1, comprising: A permission indicating whether or not to set a set of a node N associated with the access source address and a node associated with the access destination address as a set of transitable nodes N when the determination unit determines that there is no match A reception unit for receiving information;
A connection information generating unit that generates connection information indicating a set of a node associated with the access source address and a node associated with the access destination address, when the permission information received by the reception unit is set;
The information processing apparatus according to claim 1, comprising: Computer
Enter the access source address and access destination address,
Acquire connection information indicating a pair of transition source node and transition destination node that is set to be transitionable among nodes associated with addresses expressed by patterns in a language that can be unified,
Obtaining unified information indicating a set of nodes in which nodes having a common address among the nodes associated with the address can transition,
From among the nodes associated with the address, identify the node associated with the address that matches the input access source address,
Based on the acquired connection information and unified information, search for nodes that can transition from the identified node,
Determine whether the input access address matches the address associated with the searched node,
If it is determined to match, from a state of prohibiting access from the access source address to the access destination address, a state of permitting access from the access source address to the access destination address is set.
An information processing method characterized by executing processing. On the computer,
Enter the access source address and access destination address,
Acquire connection information indicating a pair of transition source node and transition destination node that is set to be transitionable among nodes associated with addresses expressed by patterns in a language that can be unified,
Obtaining unified information indicating a set of nodes in which nodes having a common address among the nodes associated with the address can transition,
From among the nodes associated with the address, identify the node associated with the address that matches the input access source address,
Based on the acquired connection information and unified information, search for nodes that can transition from the identified node,
Determine whether the input access address matches the address associated with the searched node,
If it is determined to match, from a state of prohibiting access from the access source address to the access destination address, a state of permitting access from the access source address to the access destination address is set.
An information processing program for executing a process.

Images