JPH04156618A - Capability distribution system - Google Patents

Abstract

PURPOSE:To remove overhead by means of the inspection of qualification by permitting a function supply space to register the name of a function and the like in a call capability control table and permitting a mediator to return call capability by means of the request of a function request space. CONSTITUTION:The function supply space 3 registration-requests the name of the function, call capability and the type of acknowledgement/non- acknowledgement to the mediator and registers them in the call capability control table 2-1. The function request space 1 corresponds to the transmission request of a request message, the mediator 2 refers to the control table 2 and call capability is returned to a request source when the call capability of the function name is not acknowledged or when the call capability is acknowledged and the request source is acknowledged. When call capability is acknowledged and the request source space is not acknowledged on the other hand, call capability is prevented from being informed. Thus, it becomes unnecessary to inspect qualification in the space 3 receiving the processing request by call capability, and security is maintained while overhead can be removed.

Description

[Detailed Description of the Invention] [Summary] Regarding a capability distribution method for distributing capabilities, it is easy to create a function that is allowed to be used only in a system space, etc., and it is checked whether or not it is allowed to be used in a space that receives a processing request. For the purpose of eliminating the overhead caused by m function provision space, a call capability management table is provided in the mediator to register the function name, call capability, and authorized/non-certified type that are requested for registration from the function provision space. requests the above mediator to register the function name, call capability, and certified/non-certified type at startup, etc., registers it in the above call capability management table, and the function request space requests a call capability that specifies the function name. In response to the request for transmission of a message, the system passes a request message with a predetermined type of authorized/unauthorized added to this request source space to the above-mentioned mediator, and the mediator refers to the above-mentioned call capability management table. When the calling capability of the function name is uncertified, or when the calling capability is authorized and the requesting space is authorized, the calling capability is returned to the requester, while the calling capability is authorized and the requesting space is unauthorized. Configure the call capability not to be notified when

[Industrial application field]

The present invention relates to a capability distribution method for distributing capabilities.

[Prior art and the problem to be solved by the invention: Conventionally, when trying to use a certain function in a certain space, the function name is specified and the mediator is given the calling capability of the space having the function with the function name. A process request is made to this calling capability and the result is received. For this reason, the calling capability of a function that can only be used in the system space was also distributed to all spaces, so the space that received a processing request from a certain space with the calling capability is not qualified to use this function in the space that made the processing request. There is a problem in that it is necessary to check each time whether or not there is a file, and this check generates overhead.

The present invention aims to make it easier to create a function that can be used only in a system space, etc., and to eliminate the overhead caused by checking whether or not use is permitted in a space that receives a processing request.

[Means to solve the problem]

Means for solving the problem will be explained with reference to FIG.

In Figure 1, function request space 1 requests transmission of a request message for a calling capability that specifies a function name, requests processing for the returned calling capability, and receives and receives the results. It is space.

Mediator 2 registers the function name, call capability, and certified/non-certified type in call capability management table 2-1 in response to the registration request from function provision space 3, and registers the function from function request space 1. In response to a request message for a calling capability that specifies a name, the calling capability is sent back.

The call capability management table 2-1 is used to register and manage function names, call capabilities, certified/uncertified types, and the like.

[Effect]

As shown in FIG. 1, the present invention requests the mediator 2 to register the function name, call capability, and authorized/unauthorized type when the function providing space 3 starts up, etc., and creates a call capability management table 2-1. In response to the function request space 1 requesting transmission of a request message for a calling capability with a function name added, the mediator 2 refers to the calling capability management table 2-1 and sends a request message for a calling capability with a function name. When the calling capability is unaccredited or when the calling capability is authorized and the requester space is authorized, the calling capability is returned to the requester.On the other hand, when the calling capability is authorized and the requesting space is unauthorized, the calling capability is returned to the requester. I am trying not to notify you.

Therefore, when function request space 1 requests a call capability by specifying a function name, mediator 2 requests a call capability only when the call capability is uncertified, or when the call capability is authorized and the request source space is authorized. By replying, there is no need to check the qualification in the function providing space 3 that received the processing request based on this call capability (while maintaining security.

It becomes possible to remove the code.

Embodiment] Next, the configuration and operation of an embodiment of the present invention will be sequentially explained in detail using FIGS. 1 to 3.

In FIG. 1, a function request space 1 requests a call capability by a request message specifying a function name,
Receiving and receiving (retrieving) call capabilities,
The receiver is a space in which a processing request is made to the function providing space 3 using the acquired call capability, and the result is received by the receiver. This function request space 1 includes a user space used by users, a system space used by the system, and the like.

The request message from function request space 1 is sent to mediator 2.
Since the former user space is unauthorized, a supervisor (not shown) adds this unauthorization to the request message and passes it to the mediator 2, while the latter system space is authorized, so the request message is sent to Mediator 2. This certification is added to the file and passed to the mediator 2.

Mediator 2 registers the function name, call capability, certified/non-certified type, etc. in call capability management table 2-1 in response to the registration request from function provision space 3, and registers the function name, call capability, certified/non-certified type, etc. In response to a request for a call capability via a request message specifying a function name, the call capability is returned.

The call capability management table 2-1 is used to register function names, call capabilities, and the type of certification/non-certification of the function.

The function providing space 3 is a space that provides functions.

Next, the operations will be explained in the order of FIG.

(2) The function providing space 3 registers the calling capability (PUTCCAP). This is a registration request (for example, PUTCC) to the mediator 2 when the function providing space 3 starts up.
The AP command is issued to request registration), and the function name, call capability, authorized/unauthorized type, etc. are registered in the call capability management table 2-1.

In (1) and (2), the function request space 1 retrieves the call capability (GETCCAP). This means that functional requirement space 1 is
The mediator 2 is requested to send a request message specifying the function name, and the corresponding call capability is retrieved from the call capability management table 2-1 and sent back to the requester.

■ issues a processing request to the calling capability. This makes a processing request to the calling capability that received the reply in ■ and ■, and the function providing space 3 of this calling capability processes this processing request and returns the result.

As mentioned above, when the function provision space 3 starts up, the function name,
The type of call capability and authorized/non-certified is registered in the call capability management table 2-1, and the function request space l specifies the function name and requests the call capability to the mediator 2, and the corresponding function name is When the calling capability is uncertified, or when the calling capability is authorized and the request source space is authorized, the calling capability is returned and a processing request is made to the function providing space 3 based on this calling capability. There is no need to check the qualification in the function providing space 3 that receives a processing request based on the capability, and overhead can be eliminated.

Next, using the flowcharts in Figures 2 and 3,
The operation of the diagram configuration will be explained in detail.

FIG. 2 shows a processing flowchart at the time of activation of the i-function providing space of the present invention.

In FIG. 2, when the function providing space 3 is activated, the function providing space 3 requests the mediator 2 to register the type of function name calling capability authorized/unauthorized that it provides.

■ is the function name for which Mediator 2 received a registration request in ■ call capability Certification/non-certification type is registered in the call capability management table 2-1.

Through the above processing, the function name, call capability, and authorized/unauthorized type are registered when the function providing space 3 is activated.

FIG. 3 shows a processing flowchart when the user space uses a function according to the present invention. . This requests the supervisor to send a request message to the mediator 2 with the function name reply destination (reply destination of user empty rj1)-1) added, as described in the request message (■) in the figure. Upon receiving this transmission request, the supervisor sets the user space authorization/non-authorization type in the area marked ■ where the user space 1-1 cannot be set, and passes the request message to the mediator 2.

Q refers to the call capability management table 2-1 registered in Figure 2 @ based on the function name marked with ■ in the request message received by mediator 2, and certifies the call capability of this function name. /Determine whether the non-certified type is certified or not.

If YES, the type of call capability is authorized, so in [phase], further refer to the type of authorized/unauthorized in ■ of the requesting message to determine whether it is authorized or not.YE
When S (when the request source space of the call capability is authorized, specified: for example, system space), the call capability is returned to the request source with 0), and when NO (the request source of the call capability is returned). When the space is uncertified (for example, when it is a user space), ■ returns an error without returning the calling capability. - On the other hand, if the answer is NO (if the calling capability is uncertified), the calling capability may be notified to all spaces, so the calling capability is returned to the requesting space. In addition, in the case of user space 1-1, it is an uncertified space, and if the calling capability of the function name is registered as uncertified by referring to the calling capability management table 2-1 (■N○ ), the call capability is returned only when

Through the above procedure, the user space 1-1 etc. requests the mediator 2 to send a request message, and the mediator 2 that receives the message sends a request message when the calling capability is uncertified (@No) and when the calling capability is not certified (@No), The capability is authorized and the requesting space is authorized.

When the calling capability is specified (■YES, [phase] YES), the calling capability is returned (0) to the requesting space, and on the other hand, when the calling capability is authorized and the requesting space is not authorized (@
YES, @No), return error ([phase])
becomes possible.

Next, in Figure 3 [phase], using the call capability,
A request is made to the function providing space 3 for processing.

0, in response to a request for processing that specifies the call capability in [phase], the function providing space 3 processes the request and notifies the request source of the result.

By the above procedure, there is no need to check the usage qualification in the function providing space 3, and it is possible to eliminate overhead.

〔Effect of the invention〕

As explained above, according to the present invention, the function providing space 3
registers the function name, call capability, and certified/non-certified type in the call capability management table 2-1 at startup, etc., and when function request space 1 requests a call capability by specifying the function name, the mediator 2 refers to the call capability management table 2-1 and returns the call capability when the call capability is uncertified or when the call capability is authorized and the request source space is authorized. There is no need to check the qualification in the function providing space 3 that receives the processing request based on the calling capability, and the overhead caused by checking the qualification can be eliminated while maintaining security.

[Brief explanation of the drawing]

FIG. 1 is a block diagram of one embodiment of the present invention. FIG. 2 is a flowchart of processing when the function providing space of the present invention is activated. FIG. 3 is a flowchart of processing when the user space uses a function. In the figure, 1: Function request space 2: Mediator 2-1: Call capability management table 3 = Function provision space

Claims (1)

[Scope of Claims] In a capability distribution method that distributes capabilities, a call capability management system that registers the function name, call capability, and certified/uncertified type requested for registration from the function provision space (3). Table (2-1) is used as a mediator (
2), and when the function provision space (3) starts up, etc., the function name, call capability, and certified/uncertified type are sent to the mediator (2).
) and make a registration request to the above call capability management table (2-
1), and in response to the function request space (1) requesting transmission of a call capability request message specifying the function name, the system sends the predetermined authorized/unauthorized type to this request source space. is passed to the above-mentioned mediator (2), and the mediator (2) refers to the above-mentioned call capability management table (2-1) and determines whether the call capability of the function name is uncertified or the call capability is authorized. and when the request source space is authorized, the calling capability is returned to the request source, and on the other hand, when the calling capability is authorized and the request source space is not authorized, the calling capability is not notified. capability distribution method.