JP7139898B2 - Information processing device and program - Google Patents

Description

The present invention relates to an information processing apparatus and program.

Patent Document 1 discloses a server system that provides a multi-tenant service, in which a first determination means for determining whether a tenant to which an executor who instructed execution of a function belongs and a tenant to be processed by the function are the same. , the permission means for permitting the executor to execute the function when the first determination means determines that the function is the same, and the function is determined by the tenant to which the executor belongs when the first determination means determines that the function is not the same and a second determination means for determining whether or not processing is possible even if the tenant to be processed by the function is not the same, and the second determination means determines whether the function is the tenant to which the executor belongs and the process by the function If it is determined that the process is possible even if the target tenant is not the same, determine whether the relationship between the tenant to which the executor belongs and the tenant to be processed permits execution of the function. and a third determination means, and when the third determination means determines that the relationship between the tenant to which the executor belongs and the tenant to be processed is a relationship that permits execution of the function, the permission means Disclosed is a server system that permits an executor to execute a function for a processing target tenant.

Patent Document 2 discloses an access authority delegation system in which a host computer and a management server are connected to a network, comprising means for managing tenants, data management means for managing specific data for each tenant, and a first tenant access permission request issuing means for issuing an access permission request for the data of the second tenant from to the second tenant, access permission request information storage means for storing the access permission request information, and the second tenant , access permission approval means for approving an access permission request from the first tenant, and additionally storing approval information indicating that the approval has been made to the access permission request information stored in the access permission request information storage means; When one tenant tries to access the data of the second tenant, the access permission request information storage means acquires the access permission request information from the first tenant to the second tenant, and the approval information is stored. An access authorization delegation system is disclosed that allows access to data when the

Japanese Patent No. 5930847 JP 2013-182436 A

The object of the present invention is to enable users belonging to one of the user groups to access the information of their own user group in other user groups in a multi-tenant configuration in which one system is used by multiple user groups. To provide an information processing device and a program capable of reducing the possibility of allowing a user of another user group to access information of one's own user group, compared to a configuration in which unintentional authorization can be obtained. That is.

In the present invention according to claim 1, in a multi-tenant configuration in which one system is used by a plurality of user groups, each user belonging to the plurality of user groups is authorized to use the system in the user group to which it belongs. and when a user belonging to one of the plurality of user groups is authorized to register new information as information of the user group, the user is granted the plurality of and a control means for controlling the granting means so as not to grant authority to register new information as information of the other user group to another user group among the user groups. be.

In the present invention according to claim 2, when a user belonging to one of the plurality of user groups is authorized to register new information as user group information, the user , when another user group among the plurality of user groups receives a request to grant authority to register new information as information of the other user group, registering the new information as information of the other user group 2. The information processing apparatus according to claim 1, further comprising notification means for notifying that the authority to do so is not granted.

According to a third aspect of the present invention, the authority to register the new information as the information of the user group is the authority to write the new information in a storage area used by the user group to which the authority is granted. 3. The information processing apparatus according to 1 or 2.

In the present invention according to claim 4, when the control means is authorized to register new information as user group information for a user belonging to one of the plurality of user groups, 4. The granting means according to any one of claims 1 to 3, wherein said granting means is controlled so as to grant said user only the authority to browse registered information in another user group among said plurality of user groups. It is an information processing device.

In the present invention according to claim 5, when a user belonging to one of the plurality of user groups is authorized to register new information as information of the user group, , only the authority to browse the registered information when another user group of the plurality of user groups receives a request to grant authority to register new information as information of the other user group 5. The information processing apparatus according to claim 4, further comprising notifying means for notifying that the is to be added.

In the present invention according to claim 6, in a multi-tenant configuration in which one system is used by a plurality of user groups, each user belonging to the plurality of user groups is authorized to use the system in the user group to which it belongs. and when a user belonging to one of the plurality of user groups is authorized to register new information as information of the user group, the user belongs to the plurality of user groups and a control step of controlling other user groups out of the user groups so that they are not authorized to register new information as information of the other user group.

According to the present invention according to claim 1, in a multi-tenant configuration in which one system is used by a plurality of user groups, a user belonging to one of the user groups can access information of his/her own user group in another user group. Information processing device capable of reducing the possibility of allowing users of other user groups to access information of its own user group, compared to the case where it is possible to unintentionally acquire the authority that can be made to can be provided.

According to the present invention according to claim 2, in a multi-tenant configuration in which one system is used by a plurality of user groups, new information is provided to a user belonging to one of the plurality of user groups. Information that makes it possible to make the user aware that other user groups do not have the authority to make their own user group information accessible when they are authorized to register as A processing device can be provided.

According to the present invention according to claim 3, in a multi-tenant configuration in which one system is used by a plurality of user groups, users belonging to any user group can access information of their own user group in other user groups. Information processing device capable of reducing the possibility of allowing users of other user groups to access information of its own user group, compared to the case where it is possible to unintentionally acquire the authority that can be made to can be provided.

According to the present invention according to claim 4, in a multi-tenant configuration in which one system is used by a plurality of user groups, a user belonging to one of the user groups can access information of his/her own user group in another user group. Information processing device capable of reducing the possibility of allowing users of other user groups to access information of its own user group, compared to the case where it is possible to unintentionally acquire the authority that can be made to can be provided.

According to the present invention according to claim 5, in a multi-tenant configuration in which one system is used by a plurality of user groups, new information is provided to a user belonging to one of the plurality of user groups. Information that can make the user aware that only the authority that does not allow other user groups to access the information of the own user group is granted to the user when the authority to register as a user is granted A processing device can be provided.

According to the present invention according to claim 6, in a multi-tenant configuration in which one system is used by a plurality of user groups, a user belonging to one of the user groups can access information of its own user group in another user group. To provide a program capable of reducing the possibility of allowing a user of another user group to access information of one's own user group, compared to the case where an authority that can be made to be unintentionally acquired can be obtained. can do.

It is a figure showing composition of an information processing system of one embodiment of the present invention. 2 is a block diagram showing the hardware configuration of a cloud server 12 according to one embodiment of the invention; FIG. It is a figure which shows the functional structure of the cloud server 12 of one Embodiment of this invention. FIG. 10 is a diagram showing an example of operations in an information processing system of a comparative example; FIG. 10 is a diagram showing an example of operations in an information processing system of a comparative example; FIG. 10 is a diagram showing an example of operations in an information processing system of a comparative example; FIG. 10 is a diagram showing an example of operations in an information processing system of a comparative example; It is a figure which shows an example of the operation|movement in the information processing system of one Embodiment of this invention. (A) is a diagram showing an example of an operation screen in the terminal device 10A, and (B) is a diagram showing an example of an operation screen in the terminal device 10B. It is a figure which shows an example of the operation screen in the terminal device 10B. It is a figure which shows an example of the operation screen in the terminal device 10B. It is a figure which shows an example of the operation screen in the terminal device 10B. It is a figure which shows an example of the operation screen in the terminal device 10B. It is a figure which shows an example of the operation|movement in the information processing system of one Embodiment of this invention.

Next, embodiments of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a diagram showing the configuration of an information processing system according to one embodiment of the present invention.

As shown in FIG. 1, an information processing system according to an embodiment of the present invention includes a cloud server 12 connected to the Internet 14 and a terminal such as a personal computer (hereinafter abbreviated as personal computer) which is an information processing device. It is composed of devices 10A, 10B and 10C.

The information processing system of this embodiment is a multi-tenant system in which one cloud server 12 is shared by a plurality of tenants (customer companies). Here, a tenant is a user group to which at least one user belongs. Users belonging to each tenant are configured to be able to use systems such as software and databases in that tenant with the authority granted in each tenant.

Next, FIG. 2 shows the hardware configuration of the cloud server 12 in the information processing system of this embodiment.

As shown in FIG. 2, the cloud server 12 includes a CPU 21, a memory 22 capable of temporarily storing data, a storage device 23 such as a hard disk drive (HDD), and a user interface including a touch panel or liquid crystal display and a keyboard. A (UI) device 24 and a communication interface (IF) 25 for transmitting and receiving data to and from an external device or the like are provided. These components are connected to each other via a control bus 26 .

The CPU 21 executes predetermined processing based on a control program stored in the memory 22 or storage device 23 to control the operation of the cloud server 12 . In this embodiment, the CPU 21 has been described as reading and executing the control program stored in the memory 22 or the storage device 23. It is also possible to provide

FIG. 3 is a block diagram showing the functional configuration of the cloud server 12 realized by executing the above control program.

The cloud server 12 of this embodiment includes a data communication unit 31, a control unit 32, and a storage unit 33, as shown in FIG.

The data communication unit 31 performs data communication via the Internet 14 with the terminal devices 10A, 10B, and 10C.

The control unit 32 controls the operation of the cloud server 12 and includes a registration unit 41 , an authorization unit 42 , a notification unit 43 and a display control unit 44 .

The registration unit 41 registers new data such as new information as data of each tenant. Specifically, the registration unit 41 writes new data into the storage area of each tenant.

The authorization unit 42 authorizes each user belonging to each tenant to use the system in the tenant to which the user belongs. Here, the authority to use the system is the authority to register new data in the system as the data of each tenant, and the authority to write new data to the storage area used by the authorized tenant. Access authority as a system administrator and access authority as a general user, which is the authority to view data registered as data of each tenant, are included. Specifically, the authority granting unit 42 grants access authority as a system administrator or access authority as a general user to each user belonging to each tenant.

In other words, in this embodiment, there are two types of access rights for users who use the cloud server 12: access rights for system administrators who use and manage each tenant, and access rights for general users who use each tenant. do. The access authority as a system administrator includes the authority to register new data as the data of the tenant to which it belongs and the authority to browse the data registered in the tenant to which it belongs. In other words, a user registered as a system administrator can write new data in the storage area of the tenant to which the user belongs, and view data stored in the storage area of the tenant to which the user belongs.

On the other hand, the access authority as a general user includes the authority to view data registered in the tenant to which the general user belongs, but does not include the authority to register new data as the data of the tenant to which the user belongs. In other words, a user registered as a general user can view the data stored in the storage area of the tenant to which the user belongs, but cannot write new data to the storage area of the tenant to which the user belongs as the data of the tenant to which the user belongs. General users include, for example, persons in charge of tallying.

Then, when a user belonging to one of a plurality of tenants is authorized to register new data as tenant data, the control unit 32 allows the user to register new data among the plurality of tenants. Other tenants are controlled so as not to grant the authority to register new data as the data of the other tenant. In other words, when a user belonging to one of a plurality of tenants is granted access authority as a system administrator, the control unit 32 allows the user to access the system administrator in other tenants. Control not to grant access rights as

When a user belonging to one of a plurality of tenants is authorized to register new data as tenant data, the notification unit 43 allows the user to register other tenants of the plurality of tenants. If the tenant receives a request to grant the authority to register new data as another tenant's data, notify that the authority to register it as the other tenant's data will not be granted. In other words, when a user belonging to one of a plurality of tenants is granted access authority as a system administrator, the notification unit 43 allows the user to access the system as a system administrator in another tenant. When a request for granting access rights to the system administrator is received, it notifies that the access rights for the system administrator will not be granted.

In addition, when a user belonging to one of a plurality of tenants is authorized to register new data as tenant data, the notification unit 43 notifies the user of the plurality of tenants. In our other tenant, when we receive a request to grant the authority to register new data as other tenant's data, we will grant only the authority to view the registered data in the other tenant. Notice. In other words, when a user belonging to one of a plurality of tenants is granted access authority as a system administrator, the notification unit 43 allows the user to access the system as a system administrator in another tenant. When a request for granting access rights is accepted, other tenants will be notified that only access rights as general users will be granted.

Then, when a user belonging to one of a plurality of tenants is authorized to register new data as data of the tenant, the control unit 32 allows the user to register the data of the plurality of tenants. In our other tenants, control so that only the authority to view the registered data is granted. In other words, when a user belonging to one of a plurality of tenants is granted access authority as a system administrator, the control unit 32 allows the user to be granted access rights as a general user in another tenant. Control to grant access rights only.

The storage unit 33 is provided for each tenant, and stores systems such as software and databases in each tenant, and data registered by system administrators. The storage unit 33 also stores user information such as user IDs such as e-mail addresses of users belonging to each tenant for each tenant. In addition, the storage unit 33 stores, for each tenant, information about the authority granted to users belonging to each tenant. Specifically, it stores whether the access authority of the user in each tenant is that of a system administrator or that of a general user.

The display control unit 44 controls screens displayed on the terminal device 10 .

Next, operations of the terminal devices 10A to 10C and the cloud server 12 of the information processing system of this embodiment will be described.

In the following description, an example in which user A and user B of company a and user C of company b share and use the cloud server 12 will be used. Company b is a rival company of company a. A terminal device used by user A is described as a terminal device 10A, a terminal device used by user B as a terminal device 10B, and a terminal device used by user C as a terminal device 10C. Also, when describing the same configuration of the terminal devices 10A to 10C, the terminal device 10 will be referred to.

First, before describing the operation of the information processing system of the present embodiment, the following comparative example will be described for the case where each tenant of the cloud server 12 has only one type of access authority for each user.

[Comparative example]
4 to 7 are diagrams showing comparative examples of the information processing system of this embodiment.

As shown in FIG. 4, User A has access rights to Tenant 1, and can register new data in the storage unit 33A of Tenant 1 and view data stored in the storage unit 33A. . User B has access rights to Tenant 2 and can register new data in the storage unit 33B of Tenant 2 and view data stored in the storage unit 33B. However, since User A does not have access rights to Tenant 2, he cannot register new data in the storage unit 33B of Tenant 2 or view data stored in the storage unit 33B.

In this case, as shown in FIG. 5, User B, who is the administrator of Tenant 2, adds User A's account to Tenant 2 and grants access rights to Tenant 2. It becomes possible to register new data in the storage unit 33B and view data stored in the storage unit 33B.

However, if an e-mail address is used as user A's account and user C knows user A's e-mail address, as shown in FIG. , add user A's account to this trap tenant 3, grant access authority to trap tenant 3, and send "The address of tenant 1's service has been changed" to user A's terminal device 10A. Please re-register the data.” and other phishing emails. Then, User A who received this phishing email may register the data of Tenant 1 in Tenant 3 of the trap, as shown in FIG. As a result, data of company a is stolen by user C of rival company b of company a, and confidential information is leaked. In other words, User A unintentionally makes the data of Tenant 1 accessible in Trap Tenant 3 .

Therefore, in the information processing system of the present embodiment, there are two types of access authority for users who use each tenant of the cloud server 12: access authority as a "system administrator" and access authority as a "general user". , in the cloud server 12, one account (one user) can be registered as a system administrator for only one tenant.

[This embodiment]
8 to 14 are diagrams showing the information processing system of this embodiment.

As shown in FIG. 8, User A is registered as a system administrator in Tenant 1 and User B is registered as a system administrator in Tenant 2 . That is, user A has access authority as a system administrator for tenant 1, and registers (writes) new data in the storage unit 33A of tenant 1, and stores new data in the storage unit 33A. Data can be viewed. User B has access authority as a system administrator to tenant 2, registers new data in the storage unit 33B of tenant 2, and browses data stored in the storage unit 33B. be able to.

On the other hand, since User A does not have access authority to Tenant 2, he cannot register new data in the storage unit 33B of Tenant 2 or browse the data stored in the storage unit 33B. In addition, since user B does not have access rights to tenant 1, he cannot register new data in the storage unit 33A of tenant 1 or view data stored in the storage unit 33A.

In other words, in order for User A to use Tenant 2, User B, who is registered as a system administrator in Tenant 2, must add User A's account to Tenant 2 and grant access rights to Tenant 2. There is

9A shows an operation screen of the terminal device 10A, and FIG. 9B shows an operation screen of the terminal device 10B.

As shown in FIGS. 9A and 9B, user A who is registered as a system administrator in tenant 1 and user B who is registered as a system administrator in tenant 2 are tenant 1 and tenant 2, respectively. 2, another user's account can be added and authorized to use the system in each tenant. Specifically, for example, as shown in FIG. 9B, by clicking the add button 51 on the operation screen of the terminal device 10B, the account addition screen of the tenant 2 as shown in FIG. 10 is displayed, and the user B can grant user A access to tenant 2 .

Then, on the tenant 2 account addition screen as shown in FIG. 10, enter the user ID (e-mail address) of the user A to be added to the tenant 2, and select the role of the account to be the access authority. When the system administrator is selected as the role of the account and the OK button 53 is clicked, an error occurrence screen as shown in FIG. 11 is displayed. In other words, since User A is registered as a system administrator in Tenant 1, he cannot be registered as a system administrator in Tenant 2.

Also, as shown in FIG. 12, on the account addition screen of tenant 2, enter the user ID (e-mail address) of user A to be added to tenant 2, select general user as the role of the account that will be the access authority, and click the OK button. When 53 is clicked, User A is registered as a general user in Tenant 2 and is displayed as a general user on the account management screen of Tenant 2 as shown in FIG.

That is, since user A is registered as a system administrator in tenant 1, he cannot be registered as a system administrator in other tenants. That is, in the cloud server 12 in this embodiment, only one tenant can be registered as a system administrator with one account.

As shown in FIG. 14, User A is registered as a system administrator in Tenant 1, so he has neither the authority to register new data in Tenant 1 nor the authority to view the data in Tenant 1. Granted. In other words, User A can write new data in the storage unit 33A of Tenant 1 and view data stored in the storage unit 33A of Tenant 1 . On the other hand, since User A is registered as a general user in Tenant 2, he is granted the authority to browse the data of Tenant 2, but is not authorized to register new data in Tenant 2. In other words, User A can browse the data stored in the storage unit 33B of Tenant 2, but cannot write new data in the storage unit 33B of Tenant 2.

In other words, User A, who is the system administrator of Tenant 1, cannot be registered as a system administrator in other tenants. Even if granted, user A cannot write new data to the storage unit 33C of the trap tenant 3 because he can only register as a general user in the trap tenant 3. Therefore, user C, who is an attacker, cannot steal the data of company a.

If user A is registered as a general user in tenant 1 and is not registered as a system administrator in another tenant in cloud server 12, for example, the above-described phishing email is sent from an attacker. , even if the access authority to the trap tenant 3 is granted, the user is registered as a system administrator in the trap tenant 3. However, since user A is only doing business as a general user in the cloud server 12, compared to the person who is doing the business of the system administrator, new data is written to the storage unit 33C of the trap tenant 3. It's unlikely to happen. Therefore, user C, who is an attacker, cannot steal the data of company a.

That is, in the cloud server 12, one account can be registered as a system administrator only for one tenant, so the possibility of allowing other companies to access confidential data of the company can be reduced.

[Modification]
In the above embodiment, the case where the present invention is applied to a terminal device such as a personal computer as an information processing device has been described, but the present invention is not limited to this, and can be applied to other devices such as smartphones and tablet terminal devices. The present invention can be similarly applied to the information processing apparatus.

The embodiments of the present invention have been specifically described above. However, the present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the gist of the present invention.

REFERENCE SIGNS LIST 10 terminal device 12 cloud server 31 data communication unit 32 control unit 33 storage unit 41 registration unit 42 authorization unit 43 notification unit 44 display control unit

Claims (6)

In a multi-tenant configuration in which one system is used by a plurality of user groups, granting means for granting each user belonging to the plurality of user groups the authority to use the system in the user group to which it belongs;
When a user belonging to one of the plurality of user groups is authorized to register new information as information of the user group, the user belongs to one of the plurality of user groups a control means for controlling the giving means so that another user group is not authorized to register new information as information of the other user group;
Information processing device with When a user belonging to one of the plurality of user groups is authorized to register new information as information of the user group, the user belongs to one of the plurality of user groups When another user group receives a request to grant the authority to register new information as the information of the other user group, notify that the authority to register it as the information of the other user group is not granted. 2. The information processing apparatus according to claim 1, further comprising notification means. 3. The information processing apparatus according to claim 1, wherein the authority to register the new information as user group information is the authority to write the new information in a storage area used by the user group to which the authority is granted. When a user belonging to one of the plurality of user groups is authorized to register new information as information of the user group, the control means controls the user to register new information in the plurality of user groups. 4. The information processing apparatus according to any one of claims 1 to 3, wherein said granting means is controlled so as to grant only the authority to browse registered information to other user groups of said user groups. When a user belonging to one of the plurality of user groups is authorized to register new information as information of the user group, the user belongs to one of the plurality of user groups Notification means for notifying that only the authority to view the registered information is granted when another user group receives a request to grant the authority to register new information as the information of the other user group. 5. The information processing apparatus according to claim 4, further comprising: In a multi-tenant configuration in which one system is used by a plurality of user groups, each user belonging to the plurality of user groups is granted authority to use the system in the user group to which it belongs;
When a user belonging to one of the plurality of user groups is authorized to register new information as information of the user group, the user belongs to one of the plurality of user groups a control step of controlling other user groups so that they are not authorized to register new information as information of the other user groups;
A program that causes a computer to run

Images