App development support system, app development support method, and app development support program

Abstract

To provide an app development support system that allows a developer to appropriately determine and manage what kind of authority control is performed on an actual application.SOLUTION: An app development support system according to the present embodiment comprises: a screen display control means that displays a security setting screen displaying a list of logics and their authorities for a master page in a matrix state; and setting means that sets security for the logics of the master page according to a developer's operations on the security setting screen.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an application development support system, an application development support method, and an application development support program. [Background technology]

[0002] Conventionally, an application development support system is disclosed, for example, in Patent Document 1. The system in Patent Document 1 has a program development unit that generates an application program based on an input from a terminal connected to a development environment and visually displays the generated application program, and a communication unit that provides a communication function between multiple users who use the development environment, and that causes a part or all of the application program generated by the program development unit of a development environment used by a first user to be copied so as to be usable in a development environment used by a second user and visually displays the copied application program. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2018-55588 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, Patent Document 1 does not disclose anything about how a developer can appropriately determine and manage what kind of authority control is to be performed on an actual application.

[0005] The present invention has been made in consideration of the above, and aims to provide an application development support system, an application development support method, and an application development support program that enable developers to appropriately determine and manage what kind of authority control will be applied to actual applications. [Means for solving the problem]

[0006] In order to solve the above-mentioned problems and achieve the objective, the present invention provides an application development support system equipped with a control unit, which is characterized in that the control unit is equipped with a screen display control means for displaying a security setting screen that displays a list of logic for a master page and its authorities in a matrix format, and a setting means for setting security for each logic of the master page in accordance with operations by a developer on the security setting screen.

[0007] According to another aspect of the present invention, the security set in the master page may be inherited by child screens subordinate to the master page.

[0008] According to another aspect of the present invention, the screen display control means may be configured to be able to inquire in a list about the security of the master page set for the master page and child screens subordinate to the master page.

[0009] Furthermore, according to one aspect of the present invention, when there is logic information assigned to a subflow for calling another logic from a processing flow included in the logic, the setting means is configured to be able to set a list of the logic information assigned to the subflow in response to a developer's operation on the security setting screen, and the display control means may be configured to be able to recursively query the logic assigned to the subflow in a tree format under the calling logic including the subflow.

[0010] In addition, according to one aspect of the present invention, the screen display control means may be configured to be able to query the corresponding logic displayed in a tree under the calling logic including the subflow for the same security content as the security set for the logic assigned to the subflow in response to a developer's operation on the security setting screen.

[0011] According to an aspect of the present invention, the logic may include at least one of new registration logic, modification logic, deletion logic, inquiry logic, and startup logic.

[0012] According to another aspect of the present invention, the application development support system may be a system capable of developing an application by defining a GUI operation.

[0013] In addition, in order to solve the above-mentioned problems and achieve the objective, the present invention is an application development support method to be executed on an information processing device equipped with a control unit, and is characterized in that it includes a screen display control step executed by the control unit to display a security setting screen that displays a matrix of logic for a master page and a list of its permissions, and a setting step to set security for each logic of the master page in accordance with operations by a developer on the security setting screen.

[0014] In order to solve the above-mentioned problems and achieve the object, the present invention provides an application development support program to be executed by an information processing device having a control unit, the control unit comprising: The present invention is characterized in that the application development support program executes a screen display control step of displaying a security setting screen that displays a matrix of logic for a master page and a list of its authorities, and a setting step of setting security for each logic of the master page in accordance with operations performed by a developer on the security setting screen. Effect of the Invention

[0015] The present invention has an effect of enabling a developer to appropriately determine and manage what kind of authority control is to be performed on an actual application. [Brief description of the drawings]

[0016] [Figure 1] FIG. 1 is a diagram showing an outline of the overall configuration of a system according to an embodiment. [Diagram 2] FIG. 2 is a block diagram showing an example of the configuration of the application development support system. [Diagram 3] FIG. 3 is a block diagram showing an example of the configuration of the business support system. [Figure 4] FIG. 4 is a diagram for explaining a specific example of the process of the control unit of the application development support system. [Diagram 5] FIG. 5 is a diagram for explaining a specific example of the process of the control unit of the application development support system. [Figure 6] FIG. 6 is a diagram for explaining a specific example of the process of the control unit of the application development support system. [Figure 7] FIG. 7 is a diagram for explaining a specific example of the process of the control unit of the application development support system. [Figure 8] FIG. 8 is a diagram for explaining a specific example of the process of the control unit of the application development support system. [Figure 9] FIG. 9 is a diagram for explaining a specific example of the process of the control unit of the application development support system. [Figure 10] FIG. 10 is a diagram for explaining a specific example of the process of the control unit of the application development support system. [Figure 11] FIG. 11 is a diagram for explaining a specific example of the process of the control unit of the application development support system. [Figure 12] FIG. 12 is a diagram for explaining a specific example of the process of the control unit of the application development support system. [Figure 13] FIG. 13 is a diagram for explaining a specific example of the process of the control unit of the application development support system. [Figure 14] FIG. 14 is a diagram for explaining a specific example of the process of the control unit of the task support system. [Figure 15] FIG. 15 is a diagram for explaining a specific example of processing by the control unit of the task support system. [Figure 16] FIG. 16 is a diagram for explaining a specific example of the process of the control unit of the task support system. [Figure 17]FIG. 17 is a diagram for explaining a specific example of the process of the control unit of the task support system. [Figure 18] FIG. 18 is a diagram for explaining a specific example of the process of the control unit of the task support system. [Figure 19] FIG. 19 is a diagram for explaining a specific example of the process of the control unit of the task support system. [Figure 20] FIG. 20 is a diagram for explaining a specific example of the process of the control unit of the application development support system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] Hereinafter, an embodiment of an application development support system, an application development support method, and an application development support program according to the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to the embodiment.

[0018] [1. Overview] The application development support system of the present invention is a system that enables the development of applications, regardless of whether it is a no-code / low-code system or other system, without coding the program source, by simply defining GUI operations for at least the scope of the application's screen layout, events, processing flow, and security settings.

[0019] Here, "no-code" refers to no-code, coding-less, non-coding, etc., and refers to a mechanism that allows application developers to create simple, standardized applications by arranging and combining existing functions and components through GUI operations, etc., without creating or modifying any program source code. "Low-code" refers to low-code, etc., and refers to a mechanism that is basically the same as no-code, but since applications lack flexibility, it allows for flexible customization by partially coding programs or using external APIs as necessary. In addition, the general group of functions that support application development is called the "infrastructure, platform, or development tool," and the term "infrastructure" is used here.

[0020] In the following explanation, a low-code platform will be used as an example of an application development support system, but the present invention is not limited to this and can be applied to all systems that can develop applications by defining GUI operations.

[0021] For example, the importance of security requirements that companies require from information systems such as ERP systems has been growing in recent years. For example, the control requirements in audits include checking whether user privileges are properly managed within the information system. In addition, in the management of My Number, it is legally required to properly manage users who have the privileges to view / edit, etc. In order for companies to properly manage information and carry out their work, information systems such as ERP systems require a mechanism to check the security of each user and ensure that only appropriate users can access and edit information.

[0022] The Ministry of Economy, Trade and Industry's DX report points out the problem that aging systems that have been in operation for decades or more will lead to a decline in Japan's international competitiveness and economic stagnation (the "2025 Cliff" problem). One of the reasons for this aging is that information systems are tightly linked to a company's business operations, and the cost of updating a system that has already been completed is too high.

[0023] As one solution to these problems, a method of system development that reduces costs using a low-code platform (tool) has been attracting attention in recent years. The applicant has been building system platforms that meet the security requirements of companies for many years, and has devised a mechanism that makes it possible to simplify security settings by utilizing this strength and the characteristics of the low-code platform.

[0024] In a low-code platform, the user places controls such as buttons (hereinafter referred to as UI) by dragging and dropping, and assigns separately prepared click events (hereinafter referred to as logic) to the UI. This inevitably means that the UI and logic must be configured independently. In conventional system development using programming, the UI and logic are integrated, and it is not very common to separate them.

[0025] As an example of the system, let us assume a case where deletion process (logic) is executed when the Delete button (UI) is clicked. To ensure security, it is necessary to prevent users without deletion authority from executing the deletion process.

[0026] As mentioned above, in conventional systems, the UI and logic were not independent, so security settings also had to depend on the delete button (UI). If security settings depend on the UI, security settings must be set for each UI on each screen in the system, and as the system becomes larger, security settings and the associated testing become very costly. To be specific, in the case of the delete button example, security settings are required for each delete button (for each screen) in department master maintenance and business unit master maintenance.

[0027] In addition, because security must always be considered when making changes to the system, system changes can only be made by highly skilled personnel. As a result, there is a problem that it becomes difficult to continuously improve the system after it is built (the system tends to become rigid). This increased complexity of system settings is also cited as one of the causes of the "2025 Cliff" problem mentioned above.

[0028] In this invention, the separation of UI and logic is realized by the low-code platform, which makes it possible to apply security to the logic. As a result, in the case of the relationship between the delete button and the delete process mentioned earlier, security can be applied only to the delete process.

[0029] By combining this separation of UI and logic with a mechanism for inheriting logic from a master page, it has become possible to build systems using a low-code platform without worrying too much about security.For the sake of explanation, in this specification, the system (application) created on a low-code platform is referred to as the "execution environment."

[0030] More specifically, the present invention achieves the following: In conventional systems, it was common to develop individual jobs through programming. Therefore, in order to check whether security settings were correctly configured for the entire system, it was necessary to check whether there were any omissions or mistakes in the settings for each job.

[0031] As such, in conventional development methods, there was no mechanism for easily checking security settings, and in order to ensure that security settings were set correctly throughout the entire system, it was common to conduct large-scale testing after the program was completed. As a result, once a system was completed, it was difficult to flexibly change the system, which led to the problem of the system becoming easily outdated.

[0032] Unlike regular jobs used by users, the low-code development platform has a master page that aggregates processes that are commonly used by multiple jobs. In addition to setting the processes to be executed, the master page can also set the security of the user permissions required for execution.

[0033] In this invention, in order to visualize this security information, the vertical axis shows the process and the horizontal axis shows the user permissions, allowing developers to check the overall security settings related to the process in list format, thereby enabling them to properly determine and manage what kind of permission control is applied to the actual application.

[0034] [2. Configuration] [2-1. Overall system configuration] Fig. 1 is a diagram showing an outline of the overall system configuration of an embodiment. In Fig. 1, an application development support system (e.g., a Web server) 100, a business support system (e.g., a Web server) 200, a developer user terminal 300, and a business user terminal 400 are connected to a network 500 and configured to be able to communicate data with each other.

[0035] The application development support system 100 provides, for example, a low-code infrastructure platform (tool) to the developer user terminals 300, etc., and provides a setting screen (for example, a Web page) for generating definition data (including logic information and security information) for business applications. The definition data is the source data for business applications, and is also called "objects," "packages," or "sources." In the following description, the application development support system 100 may be referred to as the "low-code infrastructure."

[0036] The developing user terminals 300... are used by developing users (also called "developers") who are responsible for creating business applications to access the application development support system 100 and create definition data for the business applications. The developing user terminals 300... use a browser, for example, to perform operations on a setting screen provided by the application development support system 100.

[0037] The business support system 200 acquires definition data of a business application from the database of the application development support system 100, and converts the acquired definition data to generate a business application 206a. The business support system 200 executes the generated business application 206a, and provides a business execution screen (e.g., a Web page) to the business user terminals 400.... In the following description, the business support system 200 that executes a business application based on the definition data created by the application development support system 100 may be simply referred to as an "execution environment."

[0038] The business user terminals 400... are used by business users (also called "users") who are responsible for business operations to access the business support system 200 and execute business operations. The business user terminals 400... use, for example, a browser to perform operations on a business execution screen provided by the business support system 200.

[0039] [2-2. Application development support system configuration] The configuration of the application development support system (low-code platform) 100 in Fig. 1 will be described with reference to Fig. 2. Fig. 2 is a block diagram showing an example of the configuration of the application development support system 100 in Fig. 1.

[0040] The application development support system 100 is a workstation or a commercially available desktop or notebook personal computer.

[0041] 2, the application development support system 100 includes a control unit 102, a communication interface unit 104, a storage unit 106, and an input / output interface unit 108. The units included in the application development support system 100 are connected to each other so as to be able to communicate with each other via any communication path.

[0042] The communication interface unit 104 communicatively connects the application development support system 100 to the network 500 via a communication device such as a router and a wired or wireless communication line such as a dedicated line. The communication interface unit 104 has a function of communicating data with other devices via the communication line. Here, the network 500 has a function of communicatively connecting the application development support system 100 with the development user terminals 300, the business support system 200, the server 600, etc., and is, for example, the Internet or a LAN (Local Area Network).

[0043] An input device 112 and an output device 114 are connected to the input / output interface unit 108. The output device 114 may be a monitor (including a home television), a speaker, or a printer. The input device 112 may be a keyboard, a mouse, a microphone, or a monitor that cooperates with a mouse to realize a pointing device function. In the following, the output device 114 may be referred to as the monitor 114, and the input device 112 may be referred to as the keyboard 112 or the mouse 112. An operation performed by a user on the screen of the output device (monitor) 114 using the input device 112 may be simply referred to as a "user operation."

[0044] Various databases, tables, files, etc. are stored in the storage unit 106. Computer programs for cooperating with an OS (Operating System) to give instructions to a CPU (Central Processing Unit) to perform various processes are recorded in the storage unit 106. For example, memory devices such as RAM (Random Access Memory) and ROM (Read Only Memory), fixed disk devices such as hard disks, flexible disks, optical disks, etc. can be used as the storage unit 206.

[0045] The storage unit 106 includes a database 106a and a security configurable master 106b.

[0046] The database 106a is for storing data such as business application definition data (logic information, security information, etc.) The database 106a may be provided externally, for example, in the server 600.

[0047] The security configurable master 106b can be configured as a table or the like in which a control, an action, and a configurable flag indicating whether security can be configured are associated and registered (see FIG. 20). The security configurable master 106b is referenced when security is configured for the action of a control on the setting screen.

[0048] The control unit 102 is a CPU or the like that performs overall control of the application development support system 100. The control unit 102 has an internal memory for storing control programs such as an OS, programs that define various processing procedures, required data, and the like, and executes various information processing based on these stored programs. The control unit 102 conceptually includes a screen control unit 102a, a setting unit 102b, a registration unit 102c, a detection unit 102d, and a master maintenance unit 102e in terms of functions.

[0049] The screen control unit 102a provides the developer user terminal 300 with various setting screens for setting logic information and security information for each logic in response to access from the developer user terminals 300.... The screen control unit 102a may also provide the developer user terminal 300 with a security setting screen that displays a list of logic (processing) and authority for a master page in a matrix format in response to access from the developer user terminals 300.... The screen control unit 102a may also inquire (display) a list of the security of the master page set for the master page and child screens subordinate to the master page. The screen control unit 102a may recursively inquire (display) the logic assigned to a subflow in a tree format under the logic of the caller including the subflow. The screen control unit 102a may inquire (display) the same content as the security set for the corresponding logic displayed in a tree format under the logic of the caller including the subflow in conjunction with the security set for the logic assigned to the subflow in response to the developer's operation on the security setting screen. The screen control unit 102a may provide the developer user terminal 300 with a setting screen for setting the security of the control action in response to access from the developer user terminals 300 . . .

[0050] The setting unit 102b sets logic information and security information for each logic of a master page (parent screen) and a child screen subordinate to the master page in response to an operation of the developer of the developer terminal 300 on the setting screen, and at that time, the logic information and security information set on the master page are inherited by the child screen. The child screen may be configured such that security set on the master page cannot be changed. The setting unit 102b may set security information for logic information assigned to a subflow for calling another logic information from a process flow included in the logic information, and may cause the security information set in the logic information assigned to the subflow to be inherited by the caller logic information including the subflow. The setting unit 102b may set security information for each logic of the master page in response to an operation of the developer of the developer terminal 300 on the above-mentioned security setting screen. When there is logic information assigned to a subflow for calling another logic from a process flow included in the logic, the setting unit 102b may set a list of logic information assigned to the subflow in response to an operation of the developer of the developer terminal 300 on the security screen.

[0051] The security type setting of the business support system 200 (execution environment) targets the combination of user and job, and as a result, the security of the logic contained in the job (screen) is reflected as the operating authority for each user (see Figures 14 and 15).

[0052] The registration unit 102c converts the logic information and security information of the set master page and child screens subordinate to the parent screen into a data format of a predetermined format, and registers the converted data in the database 106a as definition data of a business application.

[0053] When a developer sets security for an action of a control on the setting screen, the detection unit 102d refers to the security configurable master 106b to detect whether or not the action of the control can be set. In this case, the detection unit 102d By referring to the security configurable master 106b, if the action flag of the control is settable, the setting is permitted, and if the action flag of the control is not settable, an error is notified.

[0054] The master maintenance unit 102e performs setting on the security configurable master 106b by registering, adding, editing, etc. data.

[0055] [2-3. Example of business support system configuration] The configuration of the task support system (execution environment) 200 in Fig. 1 will be described with reference to Fig. 3. Fig. 3 is a block diagram showing an example of the configuration of the task support system 200 in Fig. 1.

[0056] The business support system 200 is a workstation or a commercially available desktop or notebook personal computer.

[0057] 3, the business support system 200 includes a control unit 103, a communication interface unit 204, a storage unit 206, and an input / output interface unit 208. The units included in the business support system 200 are connected to each other so as to be able to communicate with each other via any communication path.

[0058] The communication interface unit 204 communicatively connects the business support system 200 to the network 500 via a communication device such as a router and a wired or wireless communication line such as a dedicated line. The communication interface unit 204 has a function of communicating data with other devices via the communication line. Here, the network 500 has a function of communicatively connecting the business support system 200 with the business user terminals 400, the application development support system 100, the server 700, etc., and is, for example, the Internet or a LAN (Local Area Network).

[0059] An input device 212 and an output device 214 are connected to the input / output interface unit 208. In addition to a monitor (including a home television), a speaker or a printer can be used as the output device 214. In addition to a keyboard, a mouse, and a microphone, a monitor that cooperates with a mouse to realize a pointing device function can be used as the input device 212. Note that, hereinafter, the output device 214 may be referred to as the monitor 214, and the input device 212 may be referred to as the keyboard 212 or the mouse 212. Furthermore, an operation performed by a user on the screen of the output device (monitor) 214 using the input device 212 may be simply referred to as a "user operation".

[0060] The storage unit 206 stores various databases, tables, files, etc. The storage unit 206 records computer programs for cooperating with an OS (Operating System) to give instructions to a CPU (Central Processing Unit) to perform various processes. As the storage unit 206, for example, a memory device such as a RAM (Random Access Memory) or a ROM (Read Only Memory), a fixed disk device such as a hard disk, a flexible disk, an optical disk, etc. can be used.

[0061] The storage unit 206 stores a business application 206a. The business application 206a is obtained by converting definition data of a business application created by the application development support system 100, as described above.

[0062] The control unit 202 is a CPU or the like that performs overall control of the application development support system 100. The control unit 202 has an internal memory for storing control programs such as an OS, programs that define various processing procedures, required data, etc., and executes various information processing based on these stored programs. Conceptually, the control unit 202 is provided with an execution unit 202a.

[0063] The execution unit 202a executes the business application 206a in response to access from the business user terminals 400.... Specifically, the execution unit 201a provides a business execution screen in response to access from the business user terminals 400..., and performs processing in response to user operations on the business execution screen of the business user terminal 400. By accessing the business support system 200, a user can execute a predetermined business.

[0064] [3. Specific examples of processing] 1 to 20, a specific example of the processing by the control unit 102 of the application development support system 100 and the control unit 201 of the business support system 200 in this embodiment will be described. Figures 4 to 20 are diagrams for explaining a specific example of the processing by the control unit 102 of the application development support system 100 and the control unit 201 of the business support system 200 in this embodiment.

[0065] (Example 1: Relationship between master page and child screen in low-code platform and add-on method for processing) The relationship between a master page and a child screen in a low-code platform and a method of adding processing will be described with reference to Fig. 4. The setting unit 102b of the application development support system 100 sets logic information and security information for each logic of the master page (parent screen) and child screens subordinate to the master page in response to the operation of the developer of the development user terminal 300 on the setting screen, and at that time, causes the child screen to inherit the logic information and security information set in the master page. In the child screen, it is only possible to change a part of the logic flow of the logic inherited from the master page (within the placeholder).

[0066] A screen that acts as a template for each screen in the system is called a master page. By using a master page that matches the characteristics of each screen, such as for registration processing or report output processing, the development costs for each screen can be reduced. The master page corresponds to the template function of each child screen. The master page (parent screen) and each screen (child screen) have a parent-child relationship, so to speak. One or more areas called "placeholders" are placed on the master page (parent), and controls can only be placed in those areas on the child screen.

[0067] In the first concrete example, security is set by utilizing the relationship between a master page and a screen that inherits it (hereinafter, referred to as a child screen).

[0068] Fig. 4 is a diagram for explaining the relationship between a master page and a child screen, and a method for adding processing. Fig. 4(A) shows a flow setting screen, and Fig. 4(B) shows an execution environment set in the flow setting screen. The following explains the registration screen master page (master page referenced from all registration screens) as an example.

[0069] The registration screen master page is preset with common processes such as new registration, modification, deletion, and inquiry required for registration screens (department master maintenance, etc.). For simplicity, only the deletion process is shown in Figure 4.

[0070] Due to the characteristics of the low-code platform, the delete button (UI) and the delete process (logic) are separated. On the screen for setting the master page delete process on the low-code platform side, by connecting each process (hereafter referred to as "action") such as message display, it can be set as a flowchart (logic flow) that summarizes a series of business processes.

[0071] Among these, the action labeled "placeholder" is a special action for setting specific processing on the child screen that inherits the master page. On the child screen that inherits the master page, the deletion processing on the master page is called and used.

[0072] What can be set on a child screen is (1) for logic flows inherited from a parent screen (master page), only the placeholder actions set on the parent screen, and (2) new logic flows can be created on the child screen, which can be freely set for each child screen. There is no need to configure the flowchart itself or security settings on child screens. This ensures security consistency between pages that inherit from the same master page.

[0073] Therefore, when creating child screens by inheriting a master page, the creator (developer) of each child screen can concentrate on the add-on for each screen process without being concerned about security. Detailed security settings will be explained in Specific Example 3.

[0074] In FIG. 4(A), the permission settings of the master page are inherited by the child screen. The master page and its child screens require deletion permission at run time. In the example shown in FIG. 4(A), the flowchart is set on the master page deletion process setting screen. In this example, the start and action "Display message (Perform deletion process. Are you sure?)", "Yes" action "Placeholder: Child screen deletion process", and "No" action "End process" are set.

[0075] This flowchart is carried over to child screens (department master deletion process setting screen and supplier master deletion process setting screen).

[0076] (Example 2: Differences in security settings between traditional system development and low-code development) Referring to Figures 5 and 6, the differences in security settings between traditional system development and development on a low-code platform will be explained.

[0077] Fig. 5 is a diagram for explaining security settings in conventional systems. For example, on registration screens A and B, security is generally assigned (authorities are set) to each of the new registration button, edit button, delete button, and inquiry button. Although this is intuitive, the UI differs for each screen, so configuration work by specialized engineers is required for each screen. In other words, configuration work is required equal to the number of screens x the number of authorities. As such, security settings in conventional systems have been a heavy burden in system construction.

[0078] Figure 6 is a diagram for explaining security settings on a low-code platform. With security settings on a low-code platform, security settings are configured for each logic on the master page (parent screen), and the logic configured on the master page (parent screen) is inherited by child screens, eliminating the need to configure security settings for each screen.

[0079] In other words, the same logic of the master page can be used for all child screens. Furthermore, even when adding a new registration screen, as long as it inherits the same registration screen's master page, the developer only needs to add on the processing specific to each screen, which enables system development without worrying about security (see Example 1).

[0080] Even if developers have different technical levels, this mechanism allows development with security guaranteed. In the example in Figure 6, logic with security is assigned to the click event of each button (New Registration button, Edit button, Delete button, Inquiry button), but from a security perspective, the control to which it is assigned must be restricted (see Example 5). Control restrictions will be explained in detail in Example 5.

[0081] (Example 3: How to set up security in a low-code platform) A method for setting security in a low-code platform will be described with reference to Figures 7 to 11. The setting unit 102b sets security information for each logic of the master page in response to an operation by the developer of the developer user terminal 300 on a security setting screen that displays a list of logic (processing) and user permissions for the master page in a matrix format.

[0082] In a low-code platform, multiple processes can be set as a flowchart (see Example 1). As mentioned above, depending on the process content to be executed in this flowchart, it is necessary to allow only authorized users to execute the process.

[0083] With a low-code platform, security can be configured using this configured flowchart as a single unit (from here on, this series of flowcharts will be referred to as "logic").

[0084] 7 is a diagram showing an example of a security setting screen. The security setting screen is in a list format with logic (new registration logic, modification logic, deletion logic, inquiry logic, startup logic) on the vertical axis and user authority required for executing logic (none, startup, new, modification, deletion, inquiry, execution, output) on the horizontal axis, and authority can be set by checking a box.

[0085] In the example shown in FIG. 7, the permissions set are "New" for the new registration logic, "Modify" for the modification logic, "Delete" for the deletion logic, "Query" for the inquiry logic, and "Launch" for the startup logic.

[0086] By displaying the logic in a list format in this way, security can be set for all logic at once, preventing forgetting to apply security.

[0087] The security setting screen that has been set can be referenced and can be referenced from the master page and its child screens.

[0088] Furthermore, since logic and security permissions are managed on the master, developers can freely customize data.

[0089] An example of a registration screen master page will be described with reference to Fig. 8, similarly to Fig. 4. The left side of Fig. 8 shows an example of a flow setting screen (same as Fig. 4(A)), and the right side shows an example of a security setting screen. For simplicity of explanation, Fig. 8 shows only the deletion process.

[0090] In Figure 8, the logic set on the master page can only be set as security on the master page. The security settings cannot be changed on child screens that inherit the logic of the master page. Since child screens can only refer to the security settings screen, security consistency is guaranteed.

[0091] The logic information to be registered will be described with reference to Figures 9 and 10. The set logic is serialized and saved in the database 106a in JSON format. One screen is registered as one row of record, and multiple logics are registered within it, linked in a 1:N relationship.

[0092] Among the logic information, the part in bold is the information related to security. The type information of the security type master is embedded in JSON, and security control is performed based on this information on the execution environment side.

[0093] Fig. 9 shows an example of logic information (the vertical axis portion of the table in Fig. 7) registered in database 106a. The example of logic information shown in Fig. 9 includes screen information (screen ID, screen name) and logic data.

[0094] In the example shown in Fig. 9, screen ID "1" has the screen name "Registration Screen Master Page," screen ID "2" has the screen name "Department Registration Screen," and screen ID "3" has the screen name "Customer Registration Screen." Also, Fig. 9 shows an example of logic data, and the logic data of each screen is saved in JSON format.

[0095] Fig. 9 is a diagram showing an example of the security type master (the horizontal axis portion of the list in Fig. 7). The security type master registers security types and security names in association with each other. In the example shown in Fig. 9, security type "0" has the security name "start", security type "1" has the security name "newly added", security type "2" has the security name "modify", security type "3" has the security name "delete", security type "4" has the security name "query", and security type "5" has the security name "report output". Using this security type master makes it easy to set up security.

[0096] Placeholder actions set in the logic of the master page (see example 1) can be redefined as specific logic on child screens.

[0097] Fig. 11 is a diagram for explaining an example of information registered in the database 106a, with the left side showing an example of a flow setting screen, and the right side showing an example of information (Json format) registered in the database. The flow setting screen is the same as Fig. 4(A). For simplicity of explanation, Fig. 11 shows only the deletion process.

[0098] (Example 3-2: How to set up security in a low-code platform (when using subflows)) A method of setting security when a subflow is used in a low-code platform will be described with reference to Figures 12 and 13. The setting unit 102b sets security information for logic information assigned to a subflow for calling another logic information from a processing flow included in the logic information, and causes the security information set in the logic information assigned to the subflow to be inherited by the caller's logic information including the subflow.

[0099] When there is logic information assigned to a subflow for calling another logic from a processing flow included in the logic, the setting unit 102b may set a list of the logic information assigned to the subflow in response to the developer's operation on the security setting screen.

[0100] The screen control unit 102a may recursively inquire about (display) the logic assigned to a subflow in a tree format under the calling logic that includes the subflow.

[0101] The screen control unit 102a may, in conjunction with the security set for the logic assigned to a subflow in response to the developer's operations on the security setting screen, inquire (display) the same content as the set security for the corresponding logic displayed in a tree under the calling logic including the subflow.

[0102] Among the actions that can be used in the logic setting flow (see example 1), there is a function called the subflow call action, which can call another flowchart itself. This allows common logic to be shared between multiple logics. If this subflow is used in the logic, the method for setting security (see example 3) changes slightly.

[0103] Fig. 12 is a diagram for explaining a security setting method (when using subflows) in a low-code platform. In the example shown in Fig. 12, main process A1 calls sub-process B, which calls sub-process C. Main process A2 also calls sub-process B and sub-process D.

[0104] Figure 13 is a diagram explaining security settings when using the subflow in Figure 12. When a subflow is set within logic, security can be set not only for the main process but also for the subprocess. With complex flows, processes may be nested multiple times, so on the security settings screen, as shown in Figure 13, processes called by subprocesses are displayed under the calling main process (a lower layer of the main process).

[0105] If the security settings of a sub-process are changed, the information under the main process (the layer below the main process) is also automatically changed. The example shown in Figure 13 shows the case where the settings of sub-process B are changed. When executing a process, the authorities required for the main process and sub-process are added together, and the process can only be executed if the user has all the necessary authorities (otherwise an error will occur in the authority check).

[0106] (Example 4: Permission check flow when executing a process based on security settings) The flow of checking authority when executing a process based on security settings will be described with reference to FIGS.

[0107] The execution unit 201a of the business support system 200 executes the business application 206a in response to access from the business user terminals 400, . . . and performs the following authority check.

[0108] Security control is performed in the execution environment based on the security information registered in the security settings (see concrete example 3 for information registered in the database 106a).

[0109] 15 is information set by the application development support system (low-code platform) 100. FIG. 14 is information indicating the setting status of the business support system 200 (execution environment), and is setting information different from that of the application development support system 100.

[0110] Fig. 14 is a diagram showing an example of security information settings. The user authority assignment master can be configured with a table or the like in which a value (Guid value) assigned by the system for each user, a value (Guid value) assigned by the system for each job, a security type, and a permission flag (True or False) are associated and registered. The data in the security type master is applied to the security type.

[0111] FIG. 15 is a diagram showing an example of logic information settings. The logic information includes a screen ID, a screen name, logic data, a job ID, and a job name. The logic data used in each screen (e.g., department master maintenance) is saved in JSON format as follows (see specific example 3). Data is extracted from here and used for security checks. In the example of FIG. 15, a security check is performed in the order of master page deletion process inherited from the master page → master page correction process → .... By linking the screen and job information created in the low-code platform, the information of the user authority assignment master in FIG. 14 can be obtained, and it can be determined whether the operating operator (user) has authority. That is, the job ID of the target screen of the logic information is used as a key, and the user authority assignment master is referenced to determine whether the operating operator (user) has authority for the target security type (launch, delete, etc.).

[0112] In the example shown in Figures 14 and 15, for user "1111-aaaa-aaaa-aaaa-aaaaaaaaaaaa," the authority to start, add new, modify, inquire, and output reports is set for job "2222-bbbb-bbbb-bbbb-bbbbbbbbbb" on the department master maintenance screen, but the authority to delete is not set.

[0113] The authority check process executed by the execution unit 201a of the business support system 200 will be described below. Authority checks are performed in two stages: when the screen is launched and when processing is executed. When the screen is launched, checks are performed from the following two points: (1) whether the user has the authority to launch a job, and (2) whether the user has the authority to execute the logic assigned to the controls in the screen.

[0114] The execution unit 201a of the business support system 200 executes the business application 206a to execute, for example, the following processing. Here, an example of the startup processing of the department master maintenance screen will be explained. FIG. 16 shows an example of the department master maintenance registration screen. In the example shown in the figure, the contents of the department master are as follows: department "1" has the department name "Sales Department", department "2" has the department name "Accounting Department", and department "3" has the department name "General Affairs Department", and a New button, a Modify button, a Delete button, and an Inquiry button are displayed.

[0115] FIG. 17 is a flow diagram showing an example of a process for starting up a department master maintenance screen, which is executed by the execution unit of the business support system.

[0116] In the process of FIG. 17, (1) if the start permission check determines that the user does not have the permission, the job cannot be started and the process ends. (2) If the permission check determines that the control is assigned with logic that cannot be executed, it is determined whether the control in question is a button, and if so, it is hidden. By hiding the button, an unauthorized user cannot know that the deletion process can be executed on that screen, thus achieving even stronger security. Regarding user permission, permission checks are performed when a job is started and when processing is executed based on the security information shown in FIG. 14. In the example of FIG. 14, the user is set to not have the deletion permission for a certain job. Since the start permission exists, the job can be started, but the button associated with the logic that requires the deletion permission is started in a hidden state.

[0117] Specifically, in Fig. 17, first, the department master maintenance registration screen is started (step S1). Control is performed by normal business checks (step S2). For example, as an example of control by business checks, if the closing date for a voucher has passed, a button is locked so that a voucher before the closing date cannot be modified.

[0118] By referring to the logic information and security information, it is checked whether the user has the authority to start a job on the department master maintenance screen (step S3), and if the user does not have the authority to start ("No" in step S3), the process ends without starting the job (step S7), and an error is notified that the user does not have the authority. Note that in the example shown in Figures 14 and 15, for user "1111-aaaa-aaaa-aaaa-aaaaaaaaaaaa", the authority to start job "2222-bbbb-bbbb-bbbb-bbbbbbbbbbbb" on the department master maintenance screen is set to Yes.

[0119] If there is authority to start ("Yes" at step S3), the security information is referenced to check whether there is authority to execute the master page deletion process (step S4). If there is authority to execute the master page deletion process ("Yes" at step S4), the process proceeds to step S5. Note that in the example shown in Figures 14 and 15, for user "1111-aaaa-aaaa-aaaa-aaaaaaaaaaa," deletion authority is set to none for job "2222-bbbb-bbbb-bbbb-bbbbbbbbbbbb" on the department master maintenance screen.

[0120] If there is no authority to execute the master page deletion process ("No" in step S4), it is determined whether or not a button is assigned to the master page deletion process (step S8). If a button is not assigned to the master page deletion process ("No" in step S8), proceed to step S5. If a button is assigned to the master page deletion process ("Yes" in step S8), the delete button assigned to the master page deletion process is hidden (step S9) and proceed to step S5. In the example of Figure 14 above, the authority flag for deletion is "false", so the delete button on the department master maintenance screen in Figure 16 is hidden.

[0121] By hiding the button in this way, unauthorized users cannot recognize that deletion processing can be performed on that screen, thereby achieving strong security.

[0122] In step S5, all logic within the screen is checked and the job is started (step S6).

[0123] Controls other than buttons are not hidden even if the authority is not granted in the start-up check, so the business support system 200 needs to check the authority to execute the process after the process is requested. FIG. 18 is a diagram showing an example of the execution logic flow in this case. Specifically, even for a hidden button, there is a possibility that a user may directly POST the process to the business support system 200, so the business support system 200 also needs to check the authority to execute the process. For this reason, the process posted to the business support system 200 is checked again to ensure a robust authority check.

[0124] 18, a processing event is fired from the developer user terminals 300... (step S11), and the processing is POSTed to the business support system 200. The business support system 200 checks whether or not execution authority exists for the master page deletion processing (step S12). If execution authority does not exist ("No" in step S12), the processing is interrupted (step S13), and an error is sent from the business support system 200 to the client. If execution authority exists ("Yes" in step S12), the processing is executed (step S14).

[0125] (Example 4-2: Security settings and judgment method when using subflows) The method of setting and determining security when a subflow is used will be described with reference to the above-mentioned FIGS.

[0126] As shown in Figure 12 above, among the actions that can be used in the logic setting flow (see Example 1), there is a function called a subflow call action that can call another flowchart itself. This allows common logic to be shared between multiple logics.

[0127] When this subflow is used within logic, the security determination method (see example 4) changes slightly, so we will explain it below. For logic that uses subflows, it is necessary to check whether the subflow within each logic has execution permission. Therefore, the security determination method is also controlled as follows:

[0128] Fig. 19 is a diagram showing a flow for explaining an example of job start control when a subflow is used. In Fig. 19, first, it is checked whether the user has the authority to start the job (step S21), and if the user does not have the authority to start the job ("No" in step S21), the job is terminated and an error indicating that the user does not have the authority is notified (step S28).

[0129] If there is authorization to start ("Yes" in step S21), it is checked whether there is authorization to execute Logic A (step S22). If there is authorization to execute Logic A ("Yes" in step S22), the process proceeds to step S23. If there is no authorization to execute Logic A ("No" in step S22), the same process as in FIG. 17 is executed.

[0130] In step S23, it is checked whether or not a subflow exists in logic A (step S23). If there is no subflow in logic A (step S23: No), the process proceeds to step S26. If there is a subflow in logic A (step S23: Yes), the process proceeds to step S26. If there is a subflow in logic A (step S23: Yes), the process proceeds to step S24. If there is authority to execute the subflow (step S24: Yes), the process proceeds to step S25. On the other hand, if there is no authority to execute the subflow (step S24: No), the process proceeds to step S30. If there is no button assigned to logic A (step S30: No), the process proceeds to step S25. If there is no button assigned to logic A (step S30: No), the process proceeds to step S25. If there is an assignment (step S30: Yes), the button assigned to logic A is hidden (step S31), and the process proceeds to step S25.

[0131] In step S25, all subflows in the logic are checked, and all logic in the screen is checked (step S26), after which the job is started (step S27).

[0132] (Example 5: Control of security assignment destination control) Control of security allocation control will be described with reference to Fig. 20. When a developer sets security for an action of a control on a setting screen, the detection unit 102d of the application development support system 100 refers to the security configurable master 106b to detect whether the action of the control can be set. In this case, the detection unit 102d may refer to the security configurable master 106b, and if the flag for the action of the control is settable, permit the setting, and if the flag for the action of the control is not settable, notify an error.

[0133] Figure 20 is a diagram for explaining the control of security allocation destination controls. In a typical system, it is thought that the majority of UIs that link logic to which security settings are assigned, such as master deletion processing and form output processing, are button click events. From a security perspective, being able to assign security settings to any control is undesirable, as it may unintentionally create security holes.

[0134] Especially in low-code platforms, developers without knowledge of security may configure the system. In extreme cases, developers without such expertise may configure abnormal settings, such as assigning a delete process to a radio button check process. Therefore, the low-code platform must limit the allocation of security as much as possible.

[0135] On the other hand, if a strict restriction is imposed such as allocating all security logic only to button click events, there is a concern that the scalability and usability of the system will be impaired.

[0136] Therefore, we devised a mechanism that allows developers to arbitrarily restrict the types of controls to which security logic can be assigned by registering them in the master. This makes it possible to maintain consistency in security settings across the entire system, even in large-scale development where multiple developers are working on a system, without each developer having to be particularly aware of it.

[0137] Controlling such exceptional security settings on the low-code platform also leads to improved usability. If an attempt is made to add security logic to a control type that has restricted settings (e.g., a radio button), the low-code platform will notify an error, allowing the developer to immediately correct the settings.

[0138] Fig. 20(A) shows an example of the security configurable master 106b. The security configurable master 106b can be configured as a table or the like in which controls, actions, and configurable / non-configurable flags indicating whether or not they can be set are associated and registered. In the example shown in the figure, the first line is the control "button", the action "click", and the configurable / non-configurable flag "1 (configurable)", the second line is the control "radio button", the action "check", and the configurable / non-configurable flag "0 (not configurable)", and the third line is the control "table", the action "click", and the configurable / non-configurable flag "0 (not configurable)".

[0139] For example, when a development user attempts to set security that requires modification authority when executing a radio button on the setting screen shown in FIG. 20(B), in the example of the security configurable master 106b, the control “radio button” has its setting feasibility flag set to “0 (not configurable),” so the detection unit 102d notifies an error.

[0140] In addition, if an error occurs on the low-code platform, conversion to the execution environment is not possible, as shown in Figure 20(C). This ensures robust security.

[0141] As described above, the application development support system of this embodiment is equipped with a screen control unit 102a that displays a security setting screen that displays a matrix of logic for a master page and a list of its permissions, and a setting unit 102b that sets the security of each logic of the master page in response to operations performed by a developer on the security setting screen, thereby enabling a developer to appropriately determine and manage what kind of permission control will be applied to an actual application.

[0142] [4. Contribution to the United Nations-led Sustainable Development Goals (SDGs)] This embodiment can contribute to improving business efficiency and promoting appropriate management decisions by companies, thereby contributing to goals 8 and 9 of the SDGs.

[0143] Furthermore, this embodiment can contribute to reducing waste and promoting paperless and electronic systems, thereby contributing to the achievement of SDGs Goals 12, 13, and 15.

[0144] Furthermore, this embodiment can contribute to strengthening control and governance, making it possible to contribute to Goal 16 of the SDGs.

[0145] 5. Other embodiments The present invention may be embodied in various different embodiments other than those described above within the scope of the technical concept set forth in the claims.

[0146] For example, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using known methods.

[0147] In addition, the processing procedures, control procedures, specific names, information including parameters such as registered data and search conditions for each process, screen examples, and database configurations shown in this specification and drawings may be changed as desired unless otherwise specified.

[0148] Furthermore, with regard to the application development support system 100, the components shown in the figures are merely functional concepts, and do not necessarily have to be physically configured as shown in the figures.

[0149] For example, the processing functions of the application development support system 100, particularly the processing functions performed by the control unit 102, may be realized in whole or in part by a CPU and a program interpreted and executed by the CPU, or may be realized as hardware using wired logic. The program is recorded in a non-transient computer-readable recording medium including programmed instructions for causing the information processing device to execute the processes described in the present embodiment, and is mechanically read by the application development support system 100 as necessary. That is, a computer program for giving instructions to the CPU in cooperation with the OS and performing various processes is recorded in the storage unit 106 such as a ROM or HDD (Hard Disk Drive). This computer program is executed by being loaded into a RAM, and constitutes the control unit 102 in cooperation with the CPU.

[0150] In addition, this computer program may be stored in an application program server connected to the application development support system 100 via any network, and it is also possible to download all or a part of it as needed.

[0151] In addition, the program for executing the process described in this embodiment may be stored in a non-transient computer-readable recording medium, or may be configured as a program product. Here, the "recording medium" includes any "portable physical medium" such as a memory card, a Universal Serial Bus (USB) memory, a Secure Digital (SD) card, a flexible disk, a magneto-optical disk, a ROM, an Erasable Programmable Read Only Memory (EPROM), an Electrically Erasable and Programmable Read Only Memory (EEPROM (registered trademark)), a Compact Disk Read Only Memory (CD-ROM), a Magneto-Optical disk (MO), a Digital Versatile Disk (DVD), and a Blu-ray (registered trademark) Disc.

[0152] Moreover, a "program" is a data processing method written in any language or description method, and may be in any form, such as source code or binary code. Note that a "program" is not necessarily limited to a single configuration, but also includes a distributed configuration as multiple modules or libraries, and a program that works with a separate program, such as an OS, to achieve its function. Note that the specific configuration and reading procedure for reading a recording medium in each device shown in the embodiments, as well as the installation procedure after reading, may use well-known configurations and procedures.

[0153] The various databases etc. stored in the memory unit 106 are storage means such as memory devices such as RAM and ROM, fixed disk devices such as hard disks, flexible disks, and optical disks, and store various programs, tables, databases, and web page files etc. used for various processes and providing websites.

[0154] The application development support system 100 may be configured as an information processing device such as a known personal computer or a workstation, or may be configured as the information processing device to which any peripheral device is connected. The application development support system 100 may be realized by installing software (including programs, data, etc.) that causes the information processing device to realize the processing described in this embodiment.

[0155] Furthermore, the specific form of distribution and integration of the devices is not limited to those shown in the drawings, and all or part of them can be functionally or physically distributed and integrated in any unit according to various additions or function additions. In other words, the above-mentioned embodiments can be implemented in any combination, or the embodiments can be implemented selectively. [Explanation of symbols]

[0156] 100 App Development Support System 102 Control section 102a Screen control unit 102b Setting section 102c Registration Department 102d Detection unit 102e Master Maintenance Department 104 Communication interface section 106 Storage section 106a Database 106b Security configurable master 108 Input / Output Interface Section 112 Input Devices 114 Output Device 200 Business Support System 202 Control section 202a Executive Department 204 Communication Interface Section 206 Memory section 206a Business Applications 208 Input / Output Interface Section 212 Input Device 214 Output Device 300 Development user terminal 400 Business user terminal 500 Network 600 Servers 700 Servers

Claims

1. An application development support system including a control unit, The control unit is a screen display control means for displaying a security setting screen on which the logic of the master page and a list of its permissions are displayed in a matrix form; a setting means for setting security for each logic of a master page in response to an operation by a developer on the security setting screen; Equipped with The application development support system is characterized in that the screen display control means is configured to be able to inquire in a list about the security of the set master page for the master page and child screens subordinate to the master page.

2. The application development support system described in claim 1, characterized in that when there is logic information assigned to a subflow for calling another logic from a processing flow included in the logic, the setting means is configured to be able to set a list of the logic information assigned to the subflow in accordance with a developer's operation on the security setting screen, and the screen display control means is configured to be able to recursively query the logic assigned to the subflow in a tree format under the calling logic including the subflow.

3. The application development support system described in claim 2, characterized in that the screen display control means is configured to be able to query the corresponding logic assigned to the subflow in a tree-displayed manner under the calling logic including the subflow for the same content as the security set in response to a developer's operation on the security setting screen.

4. 4. The application development support system according to claim 1, wherein the authority includes at least one of a new registration authority, a modification authority, a deletion authority, an inquiry authority, and a startup authority.

5. 5. The application development support system according to claim 1, wherein the application development support system is a system capable of developing an application by defining a GUI operation.

6. An application development support method executed by an information processing device having a control unit, Executed by the control unit, a screen display control step of displaying a security setting screen on which the logic for the master page and a list of its permissions are displayed in a matrix form; a setting step of setting security for each logic of the master page in response to an operation of the developer on the security setting screen; Including, The application development support method is characterized in that in the screen display control step, the security of the set master page for the master page and child screens subordinate to the master page can be queried in a list.

7. An application development support program to be executed by an information processing device having a control unit, The control unit, a screen display control step of displaying a security setting screen on which the logic for the master page and a list of its permissions are displayed in a matrix form; a setting step of setting security for each logic of the master page in response to an operation of the developer on the security setting screen; It is an application development support program for executing The application development support program is characterized in that the screen display control step is configured to enable a list of master page security settings for the master page and child screens subordinate to the master page to be queried.

Images