Information processing device, program, information processing system, and information processing method

Abstract

To provide an information processing device capable of controlling access authorization per resource.SOLUTION: An information processing device comprises an authorization control unit configured to control whether to authorize, for each resource, a request for access to a resource in an information processing system in which a domain unit manages a plurality of resources.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an information processing device, a program, an information processing system, and an information processing method. [Background technology]

[0002] 2. Description of the Related Art Systems are known that execute processing of multiple services in response to requests from users. In such a system, when user authentication is required for each of a plurality of services, a configuration is used in which the user transmits authentication information for each service.

[0003] For example, in such a system, when processing of multiple services is executed in response to a request from a user, if authentication of the user is successful in the first service, authentication of the user is not performed for other subsequent services. On the other hand, in recent years, there has been an increasing need to take security measures that take zero trust into consideration.

[0004] For example, the technology described in Patent Document 1 implements zero-trust measures at the input / output stage to the storage unit, thereby preventing data storage tampering and leakage (see Patent Document 1). [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Publication No. 2022-7746 Summary of the Invention [Problem to be solved by the invention]

[0006] However, the standard zero trust level (for the sake of convenience, referred to as Level 0) achieved through the conventional OAuth 2.0 and OIDC procedures did not allow selective restriction of access to services such as microservices based on the requester's attributes.

[0007] For example, centralized management of service access authorization according to the attribute classification of the requester is a well-known technology, but it has the following four issues (risks): For example, access authorization to microservices is known in the implementation of microservice functions that conform to a distributed, loosely coupled architecture. (Issue 1) There was a problem of decreased availability due to centralized management. (Issue 2) There was a problem of performance degradation due to centralized management. (Issue 3) There was a problem of deterioration in maintainability due to centralized management. (Issue 4) There was a problem of reduced safety due to centralized management.

[0008] The present disclosure has been made in consideration of the above circumstances, and aims to provide an information processing device, a program, an information processing system, and an information processing method that are capable of controlling access authorization for each resource. [Means for solving the problem]

[0009] One aspect of the present disclosure is an information processing device including an authorization control unit that controls whether to authorize a request for access to a resource in an information processing system in which a domain unit manages multiple resources, for each resource.

[0010] One aspect of the present disclosure is a program that enables a computer to implement a function of controlling whether or not to authorize a request for access to a resource in an information processing system in which a domain unit manages multiple resources, for each resource.

[0011] One aspect of the present disclosure is an information processing system in which a domain unit manages multiple resources, and the information processing system includes an information processing device that controls whether to authorize access requests to the resources for each of the resources.

[0012] One aspect of the present disclosure is an information processing method for controlling whether or not a request for access to a plurality of resources in an information processing system in which a domain unit manages the resources is authorized for each of the resources. [Effects of the Invention]

[0013] According to the information processing device, program, information processing system, and information processing method disclosed herein, it is possible to control access authorization for each resource. [Brief explanation of the drawings]

[0014] [Figure 1] FIG. 1 is a diagram illustrating a schematic example of a configuration of an information processing system according to an embodiment (first embodiment). [Figure 2] FIG. 2 is a diagram illustrating an example of a communication signal according to the embodiment. [Figure 3] FIG. 10 is a diagram illustrating an example of person attribute information according to the embodiment. [Figure 4] FIG. 10 is a diagram showing a specific example of information used in access authorization management according to the embodiment. [Figure 5] FIG. 10 is a diagram showing a specific example of information that is not used for access authorization according to the embodiment. [Figure 6] FIG. 10 is a diagram illustrating a schematic example of a configuration of an information processing system according to an embodiment (second embodiment). [Figure 7] FIG. 10 is a diagram illustrating a schematic example of a configuration of an information processing system according to an embodiment (third embodiment). DETAILED DESCRIPTION OF THE INVENTION

[0015] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In this embodiment, for convenience of explanation, levels 0 to 3 are shown as the boundary levels of zero trust, but these are merely examples and may be called by other names, for example.

[0016] (First embodiment) [Information Processing Systems] FIG. 1 is a diagram showing a schematic example of the configuration of an information processing system 1 according to an embodiment (first embodiment).

[0017] The information processing system 1 includes a terminal device 11, a service device 12A which is an information processing device for service A, a service device 12B which is an information processing device for service B, a service device 12C which is an information processing device for service C, and a service device 12D which is an information processing device for service D. Here, in this embodiment, four services, namely, service A to service D, are shown, but the number of services may be any number equal to or greater than one. Furthermore, each of services A to D may be any service, for example, a microservice.

[0018] Each of the services A to D may be called a domain unit, for example. In the example of Fig. 1, each of the domain units is a portion enclosed by a frame corresponding to the service devices 12A to 12D of each of the services A to D. In this embodiment, a case where one domain unit provides one service is shown, but as another example, one domain unit may provide multiple services, or one service may be provided by two or more domain units.

[0019] <Terminal Device> The terminal device 11 is operated by a user (for example, a person). The terminal device 11 includes a user program section 11a. Here, the user-side program section 11a represents a functional section that is realized when the processor of the terminal device 11 executes a user-side program (user-side program). The terminal device 11 includes a processor such as a CPU (Central Processing Unit), and executes a user-side program using the processor. The user-side program is stored in a storage unit provided in the terminal device 11, for example.

[0020] The terminal device 11 may be any device, such as a smartphone, a tablet computer, a notebook computer, or another computer.

[0021] <Communication signal from terminal device> FIG. 2 is a diagram showing an example of a communication signal 101 according to the embodiment. A communication signal 101 is an example of a signal transmitted from the terminal device 11 to the service device 12A of the service A. In this embodiment, the communication signal 101 is used as a request signal for making a request. The communication signal 101 includes authentication information 121 and other information (for convenience of explanation, referred to as other information 122).

[0022] The authentication information 121 is information used to authenticate an authentication target (a target to be authenticated), and in this embodiment, is information used to authenticate the user of the terminal device 11. Here, various information may be used as the authentication information 121. Additionally, as the other information 122, any information may be used. The other information 122 does not have to be included in the communication signal 101 .

[0023] As an example, the authentication information 121 may be stored in the header of the communication signal 101 . As another example, the authentication information may be stored in the footer of the communication signal. As yet another example, the authentication information may be stored in a location other than the header or footer of the communication signal. In the communication signal, for example, the authentication information is stored in a continuous area (for example, a continuous bit area), but as another example, it may be stored in a distributed manner in two or more discrete areas.

[0024] Any protocol may be used as the protocol of the communication signal 101, for example, the HTTP (Hypertext Transfer Protocol) protocol may be used, in which case authentication information may be included in the HTTP header.

[0025] In this embodiment, the subject to be authenticated is a user. In this case, the authentication information 121 may include information representing the attributes of the user. In this case, the authentication information may be called user information or the like. The attribute information is not particularly limited and may include, for example, one or more of the following: user identification information (user ID), information about the user's affiliation such as company or school, name information such as the user's name, location information such as the user's address, information about the user's position or authority, password information, etc.

[0026] <Service A service device> The service device 12A of the service A is configured using, for example, one or more computers. The service device 12A may be, for example, an on-premise server device or a cloud server device.

[0027] The service device 12A includes a transmission / reception layer program unit 31A, an application layer program unit (for convenience of explanation, referred to as an application layer program unit 71A), a domain layer program unit 72A, a data layer program unit 73A, and a business data storage unit 74A. The transmission / reception layer program unit 31A includes a receiving unit 51A, a transmitting unit 52A, and an authorization control unit 53A. The application layer program unit 71A includes an authorization control unit 54A. The domain layer program unit 72A includes an authorization control unit 55A.

[0028] These names are used for convenience of explanation. For example, the transmitting / receiving layer program section may be called the transmitting / receiving layer section, the application layer program section (or the application layer program section) may be called the application layer section (or the application layer section), the domain layer program section may be called the domain layer section, and the data layer program section may be called the data layer section. For example, a functional unit including an application layer program unit, a domain layer program unit, and a data layer program unit may be called a business data processing unit, etc. The business data processing unit may include a business data storage unit.

[0029] The transmission / reception layer program unit 31A represents a functional unit that is realized by the processor of the service device 12A executing a predetermined program (transmission / reception layer program). The functional units include a receiving unit 51A, a transmitting unit 52A, and an authorization control unit 53A. That is, the receiving unit 51A, the transmitting unit 52A, and the authorization control unit 53A are each an example of a functional unit realized by the processor of the service device 12A executing a receiving / transmitting layer program. Here, in this embodiment, the program (receiving layer program) that realizes the functions of the receiving unit 51A, the program (transmitting layer program) that realizes the functions of the transmitting unit 52A, and the program (authorization control program) that realizes the functions of the authorization control unit 53A are separate programs, but as another example, some or all of these may be made into a common program.

[0030] The application layer program unit 71A represents a functional unit that is realized by the processor of the service device 12A executing a predetermined program (an application layer program, which is referred to as an application layer program for the sake of convenience). The functional units include the authorization control unit 54 A. That is, the authorization control unit 54 A is an example of a functional unit that is realized by the processor of the service device 12 A executing an application layer program. Here, in this embodiment, the program that realizes the functions of the authorization control unit 54A (authorization control program) and the program that realizes other functions are separate programs, but as another example, these may be a common program.

[0031] The domain layer program unit 72A represents a functional unit that is realized by the processor of the service device 12A executing a predetermined program (domain layer program). The functional units include an authorization control unit 55 A. That is, the authorization control unit 55 A is an example of a functional unit that is realized by the processor of the service device 12 A executing a domain layer program. Here, in this embodiment, the program that realizes the functions of the authorization control unit 55A (authorization control program) and the program that realizes other functions are separate programs, but as another example, these may be a common program.

[0032] The data layer program unit 73A represents a functional unit that is realized by the processor of the service device 12A executing a predetermined program (data layer program). The business data storage unit 74A stores business data relating to the service A.

[0033] The service device 12A includes a processor such as a CPU, and executes each program (transmission / reception layer program, application layer program, domain layer program, data layer program, and authorization control program for each layer) using the processor. Each program (transmission / reception layer program, application layer program, domain layer program, data layer program, and authorization control program for each layer) is stored in, for example, a storage unit included in the service device 12A. Here, the processor that executes each program (transmission / reception layer program, application layer program, domain layer program, data layer program, and authorization control program for each layer) may, for example, be common to all programs, or common to some programs and different for others, or different for each program.

[0034] The receiving unit 51A has a receiving function. In this embodiment, for the sake of convenience, the receiving unit 51A and the authorization control unit 53A are shown separately, but for example, the functions of the authorization control unit 53A may be included in the receiving unit 51A. The authorization control unit 53A has a function of performing access authorization processing.

[0035] The receiving unit 51A receives a request signal transmitted from the terminal device 11. If the authentication based on the authentication information included in the request signal received from the terminal device 11 is successful and if the authorization control unit 53A determines that the user's attribute information satisfies predetermined authorization conditions (here, level 1 authorization conditions in this embodiment, which are authorization conditions for the service), it grants access authorization to service A to the subject of the authentication (in this embodiment, the user of the terminal device 11). In this case, authorization control unit 53A transmits to application layer program unit 71A a predetermined signal in response to the authorization of the processing of service A. When the processing of service A is executed, transmission unit 52A receives, in response, information on the result of the processing from application layer program unit 71A. Then, the transmitting unit 52A transmits to the terminal device 11 a signal (message) including the result of the processing.

[0036] On the other hand, if the authentication based on the authentication information contained in the request signal received from the terminal device 11 fails, or if the authentication is successful but the authorization control unit 53A determines that the user's attribute information does not satisfy the specified authorization conditions, the authorization control unit 53A does not authorize the subject of the authentication (in this embodiment, the user of the terminal device 11) to access service A (i.e., does not allow access). In this case, the processing of service A is not performed. In this case, the transmission unit 52A may transmit to the terminal device 11, for example, a signal indicating that authentication or authorization has failed.

[0037] Here, the authentication process may be performed by, for example, the authorization control unit 53A (or the receiving unit 51A), or may be performed by an authentication device that exists externally to the service device 12A (external authentication device). When the authentication process is performed by an external authentication device, the authorization control unit 53A (or the receiving unit 51A) transmits the received authentication information and information identifying service A to the authentication device, which then performs authentication process for service A based on the authentication information, and transmits a signal notifying the authorization control unit 53A (or the receiving unit 51A) of the result of the authentication (success or failure). As a result, the authorization control unit 53A (or the receiving unit 51A) obtains the authentication result.

[0038] When external authentication information is used, for example, a different external authentication device may be used for each service, or an external authentication device common to two or more services (or all services) may be used.

[0039] The application layer program unit 71A receives a signal (message) transmitted as a result of authorization by the authorization control unit 53A of the transmission / reception layer program unit 31A. If the authorization control unit 54A determines, based on the signal received from the transmission / reception layer program unit 31A, that the user's attribute information satisfies predetermined authorization conditions (here, level 2 authorization conditions in this embodiment, authorization conditions for functions), it grants the object of authorization (in this embodiment, the user of terminal device 11) access authorization to the application of service A (access authorization to the functions of service A). In this case, authorization control unit 54A transmits a predetermined signal to domain layer program unit 72A in response to authorization of execution of the application of service A. When the processing of service A is executed, application layer program unit 71A receives, in response, information on the result of the processing from domain layer program unit 72A. Then, the application layer program unit 71A transmits a signal (message) including the result of the processing to the transmission / reception layer program unit 31A.

[0040] On the other hand, if the authorization control unit 54A determines that the user's attribute information does not satisfy the specified authorization conditions, it does not authorize the authentication target (in this embodiment, the user of the terminal device 11) to access the application of service A (authorize access to the functions of service A) (i.e., does not permit access). In this case, no processing is performed by the application of service A. In this case, the application layer program unit 71A may, for example, send a signal indicating that authorization has failed to the transmission / reception layer program unit 31A.

[0041] The domain layer program unit 72A receives a signal (message) transmitted as a result of authorization by the authorization control unit 54A of the application layer program unit 71A. If the authorization control unit 55A determines, based on the signal received from the application layer program unit 71A, that the user's attribute information satisfies predetermined authorization conditions (here, level 3 authorization conditions in this embodiment, authorization conditions for information), it grants authorization to the object of authorization (in this embodiment, the user of the terminal device 11) to access the information of service A. In this case, authorization control unit 55A transmits a predetermined signal to data layer program unit 73A in response to authorization to use the information of service A. When processing of service A is executed, domain layer program unit 72A receives information on the result of the processing from data layer program unit 73A in response. Then, the domain layer program unit 72A transmits a signal (message) including the result of the processing to the application layer program unit 71A.

[0042] On the other hand, if the authorization control unit 55A determines that the user's attribute information does not satisfy the specified authorization conditions, it does not authorize the authentication subject (in this embodiment, the user of the terminal device 11) to access the information of service A (i.e., it does not allow access). In this case, the information of service A is not used. In this case, the domain layer program unit 72A may, for example, send a signal indicating that authorization has failed to the domain layer program unit 72A.

[0043] In this embodiment, for service A, boundary defense for each service at level 1 is realized in the transmission / reception layer program unit 31A. In this embodiment, for service A, boundary defense in function units related to level 2 is realized in the application layer program unit 71A. In this embodiment, for service A, boundary defense of information units relating to level 3 is realized in the domain layer program unit 72A.

[0044] Note that any authorization conditions may be used as the level 1 authorization conditions, the level 2 authorization conditions, and the level 3 authorization conditions. For example, among the level 1 authorization conditions, level 2 authorization conditions, and level 3 authorization conditions, two may be the same authorization conditions and the other may be a different authorization condition, or all three may be the same authorization condition, or all three may be different authorization conditions. Furthermore, when one authorization condition includes conditions for multiple types of items, for example, in two or three authorization conditions, the conditions for some items may be the same but the conditions for other items may be different, resulting in different authorization conditions overall.

[0045] Furthermore, in this embodiment, the case where service A has three authorization control units, namely, authorization control unit 53A of transmission / reception layer program unit 31A, authorization control unit 54A of application layer program unit 71A, and authorization control unit 55A of domain layer program unit 72A, has been described. However, for example, a configuration in which only any one of these is provided may be used, or a configuration in which only any two of these are provided may be used.

[0046] In this way, in the service device 12A (information processing device) of service A in this embodiment, it is possible to perform authorization for each resource, such as a service (the service itself), a function, or an information resource, at the layer for each resource.

[0047] <Service equipment for services B to D> The service device 12B of service B includes a transmission / reception layer program unit 31B, an application layer program unit (for convenience of explanation, referred to as an application layer program unit 71B), a domain layer program unit 72B, a data layer program unit 73B, and a business data storage unit 74B. The transmission / reception layer program unit 31B includes a receiving unit 51B, a transmitting unit 52B, and an authorization control unit 53B. The application layer program unit 71B includes an authorization control unit 54B. The domain layer program unit 72B includes an authorization control unit 55B.

[0048] The service device 12C of service C includes a transmission / reception layer program unit 31C, an application layer program unit (for convenience of explanation, referred to as an application layer program unit 71C), a domain layer program unit 72C, a data layer program unit 73C, and a business data storage unit 74C. The transmission / reception layer program unit 31C includes a receiving unit 51C, a transmitting unit 52C, and an authorization control unit 53C. The application layer program unit 71C includes an authorization control unit 54C. The domain layer program unit 72C includes an authorization control unit 55C.

[0049] The service device 12D of service D includes a transmission / reception layer program unit 31D, an application layer program unit (for convenience of explanation, referred to as an application layer program unit 71D), a domain layer program unit 72D, a data layer program unit 73D, and a business data storage unit 74D. The transmission / reception layer program unit 31D includes a receiving unit 51D, a transmitting unit 52D, and an authorization control unit 53D. The application layer program unit 71D includes an authorization control unit 54D. The domain layer program unit 72D includes an authorization control unit 55D.

[0050] As described above, in this embodiment, the four service devices 12A to 12D have the same configuration and operate in the same manner with respect to authorization for each resource (service, function, information).

[0051] Here, when two or more services exist, the business data for each service may, for example, be partly or entirely common to the business data of other services. In the example of Figure 1, some or all of the business data stored in business data storage unit 74A, the business data stored in business data storage unit 74B, the business data stored in business data storage unit 74C, and the business data stored in business data storage unit 74D may be common data. When two or more services exist, the business data for each service may be different from each other.

[0052] <Resource-based border defense> In the service device 12A, when authentication is successful and all authorizations are given in response to a request signal from the terminal device 11, processing is performed in the order of the transmission / reception layer program unit 31A, the application layer program unit 71A, the domain layer program unit 72A, and the data layer program unit 73A. The data layer program unit 73A performs operations such as reading out the business data of service A stored in the business data storage unit 74A. The data layer program unit 73A may perform any processing related to the business data of service A. Furthermore, the response is processed in the order of data layer program section 73A, domain layer program section 72A, application layer program section 71A, and transmission / reception layer program section 31A.

[0053] In this embodiment, resource-based boundary defense is realized in the service device 12A. In the example of FIG. 1, boundaries B1 to B3 of boundary defense of resource units are shown schematically. In this embodiment, in the service device 12A, a level 1 boundary B1 exists between the receiving / transmitting layer program section 31A and the application layer program section 71A, a level 2 boundary B2 exists between the application layer program section 71A and the domain layer program section 72A, and a level 3 boundary B3 exists between the domain layer program section 72A and the data layer program section 73A.

[0054] <Authentication information flow and business information flow> FIG. 1 shows an arrow a0 indicating the flow of a signal containing authentication information, which is information used for authentication, and an arrow b0 indicating the flow of a signal containing business information but not authentication information. In the example of FIG. 1, the flow of signals in the information processing system 1 is shown by distinguishing between a line with an arrow a0 and a line with an arrow b0.

[0055] Here, at the location of the arrow a0 where a signal including authentication information flows, for example, information other than authentication information may also flow. Furthermore, at the location of arrow b0 where a signal flows that does not contain authentication information but does contain business information, information used for authentication (authentication information) does not flow, but for example, information with the same content as the information used for authentication (authentication information) may be included in a form that is not used for authentication. In the line of arrow a0, for example, the type of information flowing (in this example, the type is authentication information or business information) may differ depending on the direction of communication.

[0056] <Example of operation in an information processing system> An example of the operation of the information processing system 1 will be described. The terminal device 11 is operated by the user, and the user-side program section 11a transmits a communication signal (in this embodiment, a request signal) including authentication information to the service device 12A.

[0057] The receiving unit 51A of the service device 12A receives the request signal transmitted from the terminal device 11. If authentication based on the authentication information included in the received request signal is successful, the authorization control unit 53A determines whether to authorize the user to process service A, and if it determines that the user is authorized to process service A, it sends a signal to the application layer program unit 71A to cause the processing of service A to be executed.

[0058] The application layer program unit 71A of the service device 12A receives the signal transmitted from the transmission / reception layer program unit 31A. Based on the received signal, the authorization control unit 54A determines whether to authorize the user for the functions of service A, and if it determines that the user for the functions of service A is authorized, it sends a predetermined signal corresponding to the authorization to the domain layer program unit 72A.

[0059] The domain layer program unit 72A of the service device 12A receives the signal transmitted from the application layer program unit 71A. Based on the received signal, the authorization control unit 55A determines whether to authorize the information on service A to the user, and if it determines that the information on service A is to be authorized to the user, it sends a predetermined signal corresponding to the authorization to the data layer program unit 73A. In this case, application layer program unit 71A, domain layer program unit 72A, and data layer program unit 73A execute predetermined processing and respond (transmit) information on the results of the processing to transmission unit 52A. Then, transmission unit 52A receives the information on the results of the processing from application layer program unit 71A and responds (transmits) the information to terminal device 11.

[0060] [Person attribute information] FIG. 3 is a diagram illustrating an example of person attribute information according to the embodiment. In this example, level 3 (domain layer) access authorization is illustrated. The authorization conditions for access authorization at level 1 (transmission / reception layer) and access authorization at level 2 (application layer) may differ, but are the same as those for access authorization at level 3 (domain layer).

[0061] FIG. 3 shows information necessary for access authorization management and attributes that are not used for access authorization. The information required for access authorization management includes "Name," "Service User ID," "Affiliated Project," "Affiliated Organization Name," "Employee Number," the required "Access Authorization Code A," the optional "Access Authorization Code B," and the optional "Access Authorization Code Z." Attributes that are not used for access authorization include "Department," "Contact Point 1," "Contact Point 2," "Position," "Employment Type," "Office," "Superior," "Job Date / Contract Start Date," "Certifications / Training History," and "Contract Information." In this example, when creating the authorization codes (access permission codes A, B, and Z) required for authorization at each layer, user attributes (name, service user ID, affiliated project, affiliated organization name, and employee number) are required as input. Authorization at each layer (transmission / reception layer, application layer, domain layer) is performed based on the authorization code and the authorization conditions of each layer. The output of the authorization code and the subsequent authorization are performed independently at each layer of each domain unit. Therefore, the output authorization code may be different at each layer of each domain unit even for the same user attributes.

[0062] In the example of FIG. 3, "Name", "Service User ID", "Affiliated Project", "Affiliated Organization Name", and "Employee Number" are used as input (Q). In the example of FIG. 3, the required "access permission code A," the optional "access permission code B," and the optional "access permission code Z" are used as output (V).

[0063] Here, the input to the system is generally called a query (Q) and the output from the system is generally called a value (V). In the example of Figure 3, the user's (the person) "Name," the user's ID "Service User ID," the user's "Affiliated Project," the user's "Affiliated Organization Name," and the user's "Employee Number" are entered in the query (Q) as attributes of the person, and the access authorization corresponding to the key with the same value as the query (Q) in the information managed by the access authorization management mechanism is returned as value (V). In the example of Figure 3, the access authorizations are the mandatory "Access Authorization Code A," the optional "Access Authorization Code B," and the optional "Access Authorization Code Z." "Access authorization code Z" specifies, for example, prohibited actions.

[0064] In this embodiment, the functions of the access authorization management mechanism are realized by authorization control units 55A to 55D in the domain layers of the services A to D shown in FIG. In this embodiment, for example, information corresponding to access rights is organized in advance, and access authorization is performed in accordance with this information at the domain layer of each service.

[0065] Here, the authorization control units 55A to 55D in the domain layer are exemplified, but for example, the functions of the access authorization management mechanism are realized by the authorization control units 53A to 53D in the transmission / reception layer of each of the services A to D shown in FIG. 1, and the functions of the access authorization management mechanism are realized by the authorization control units 54A to 54D in the application layer of each of the services A to D shown in FIG. 1.

[0066] FIG. 4 is a diagram showing a specific example of information used in access authorization management according to the embodiment. FIG. 5 is a diagram showing a specific example of information that is not used for access authorization according to the embodiment. The personal attribute information shown in FIGS. 3 to 5 is merely an example, and any other information may be used.

[0067] In the example of FIG. 4, a five-digit number is used as the "service user ID", but this is not limiting and other information may be used. In addition, in the example of Figure 4, "A3," "A4," and "A5" are exemplified as "access permission code A," "B2" and "B5" are exemplified as "access permission code B," and "Z1" is exemplified as "access permission code Z," but these numbers are examples for the purpose of explanation, and the size of the numbers has no significance.

[0068] <Example of processing by the authorization control unit> Here, an example of processing performed by the authorization control unit 55A of the domain layer program unit 72A of service A will be described by way of example. The same applies to the processes performed by the other authorization control units 53A to 54A, 53B to 55B, 53C to 55C, and 53D to 55D.

[0069] The authorization control unit 55A has, for example, a storage unit, and stores information necessary for determining whether or not to grant authorization in the storage unit. Here, in this embodiment, the information is stored in a memory unit of the authorization control unit 55A, but the information may also be stored in another memory unit, in which case the authorization control unit 55A may not have a memory unit. In this embodiment, the information required to determine whether to grant authorization is the information required for access authorization management shown in Figure 3, and for example, it is sufficient to have at least a set of information related to input (Q) and information on "access authorization code A," "access authorization code B," and "access authorization code Z" related to output (V).

[0070] When the authorization control unit 55A receives an input (Q), it identifies the output (V) corresponding to the input (Q) based on stored information (information necessary to determine whether to authorize), determines whether to authorize based on the access permission code related to the identified output (V), and performs control (control related to authorization) based on the determination result.

[0071] In the example of Figures 1 and 2, the communication signal 101 includes a set of information relating to the input (Q) or information that can indirectly identify such a set of information. In addition, a set of information related to the input (Q) or information that can indirectly identify such a set of information is received by the transmission / reception layer program unit 31A, and this information is sent from the transmission / reception layer program unit 31A to the application layer program unit 71A, and this information is sent from the application layer program unit 71A to the domain layer program unit 72A.

[0072] In this way, the information that is input (Q) to each of the authorization control units 53A to 55A, 53B to 55B, 53C to 55C, and 53D to 55D is configured to be graspable by each of the authorization control units 53A to 55A, 53B to 55B, 53C to 55C, and 53D to 55D. As another example, the information of the communication signal 101 received by the transmission / reception layer program unit 31A may be stored in an arbitrary storage unit, and each of the authorization control units 53A to 55A, 53B to 55B, 53C to 55C, and 53D to 55D may acquire (read) the information. Note that such sharing of information to be input (Q) may be performed for each of the services A to D, or may be performed across multiple services A to D.

[0073] Here, the personal attribute information as shown in Figures 3 to 5 may be stored, for example, in any memory unit and shared by multiple authorization control units (in this embodiment, two or more of authorization control units 53A to 55A, 53B to 55B, 53C to 55C, and 53D to 55D, or all of them). Such sharing of information may be performed for each layer (transmission / reception layer, application layer, domain layer) of the plurality of services A to D, or may be performed for each of the services A to D.

[0074] However, if the authorization conditions (in this embodiment, the input (Q) and the corresponding output (V)) are different for two or more authorization control units, for example, information on the authorization conditions may be stored separately for each, or common information may be stored that makes it possible to grasp the authorization conditions of each authorization control unit.

[0075] In the example of Figure 3, the attribute information "Name," "Service User ID," "Affiliated Project," "Affiliated Organization Name," and "Employee Number" is used as the input (Q) for the authorization conditions, but some of this information may be used, or other information may be used. For example, as in this example, a combination of information on two or more attributes may be used as the input (Q) of the authorization condition. It should be noted that when determining whether or not to grant authorization, the individual user does not necessarily need to be identified. Furthermore, the communication signal 101 serving as a request signal may include, for example, information (itself) that serves as the input (Q) of the authorization condition, or may include other information that can indirectly identify the information.

[0076] In addition, in the example of Figure 3, a case is shown in which the required "access permission code A", the optional "access permission code B", and the optional "access permission code Z" are used as the output (V) of the authorization conditions, but this is not limited to this. For example, it is sufficient if it is possible to determine whether or not to grant authorization (whether or not access authorization is granted), and further, whether or not to grant authorization (whether or not access authorization is granted) may be set for each of multiple items.

[0077] As described above, the information processing system 1 according to this embodiment can control access authorization for each resource. Therefore, in the information processing system 1 of this embodiment, for example, it is possible to solve the problem of decreased availability due to centralized management (Problem 1), it is possible to solve the problem of decreased performance due to centralized management (Problem 2), it is possible to solve the problem of decreased maintainability due to centralized management (Problem 3), it is possible to solve the problem of decreased safety due to centralized management (Problem 4).

[0078] In this embodiment, the resources are services, functions, and information. In this embodiment, taking the service device 12A as an example, if a request from the user of the terminal device 11 is not authorized by the authorization control unit 53A of the transmission / reception layer program unit 31A, service A (itself) cannot be used, and the subsequent application layer program unit 71A cannot be used. Furthermore, if a request from the user of the terminal device 11 is authorized by the authorization control unit 53A of the transmission / reception layer program unit 31A and then not authorized by the authorization control unit 54A of the application layer program unit 71A, a function (application) cannot be used, and the subsequent domain layer program unit 72A cannot be used. Furthermore, if a request from the user of the terminal device 11 is authorized by the authorization control unit 53A of the transmission / reception layer program unit 31A and then not authorized by the authorization control unit 54A of the application layer program unit 71A, then not authorized by the authorization control unit 55A of the domain layer program unit 72A, information (domain layer information) cannot be used, and the subsequent data layer program unit 73A cannot be used.

[0079] <About Zero Trust Level 0> This section explains encapsulation level 0 of the service function and the access authorization function. At this level, the access authorization function for service functions is encapsulated as a unit for providing services, thereby resolving the issues (risks) associated with centralized management. This mechanism provides the following benefits to the extent that the scope of influence is localized to the function: (Effect 0-1) Availability issues can be minimized. (Effect 0-2) Performance issues can be minimized. (Effect 0-3) Maintenance degradation issues can be minimized. (Effect 0-4) Safety degradation issues can be minimized.

[0080] <About Zero Trust Level 1> This section explains encapsulation level 1 of the service function and the access authorization function. At this level, the access authorization function for a microservice is encapsulated within the microservice itself, thereby resolving the challenges (risks) associated with centralized management. This mechanism provides the following benefits to the extent that the scope of impact is localized for each microservice: (Effect 1-1) Availability issues can be minimized. (Effect 1-2) Performance issues can be minimized. (Effect 1-3) Maintenance degradation issues can be minimized. (Effect 1-4) Safety degradation issues can be minimized.

[0081] Here, the standard level of zero trust support using conventional OAuth2.0 and OIDC procedures (for the sake of convenience, we will refer to this as level 0) did not allow for selective restriction of access to the microservice itself based on the requester's attributes. In contrast to this, in the information processing system 1 according to this embodiment, access to the microservice itself can be selectively restricted for each attribute classification of the requester, thereby enabling fine-grained management of access to the service. In the information processing system 1 according to this embodiment, the requester's attribute classification information is examined in the mechanism of the receiving and transmitting layer within the microservice, thereby making it possible to selectively restrict access to the functional layer of the microservice.

[0082] <About Zero Trust Level 2> This section explains encapsulation level 2 between service functions and access authorization functions. At this level, the access authorization function for microservices is encapsulated in the application layer, which is a component of the microservices, thereby resolving the issues (risks) associated with centralized management and enabling more detailed access management. This mechanism provides the following benefits to the extent that the scope of impact is localized to the application layer of the microservice: (Effect 2-1) Availability issues can be minimized. (Effect 2-2) Performance issues can be minimized. (Effect 2-3) Maintenance degradation issues can be minimized. (Effect 2-4) Safety degradation issues can be minimized.

[0083] Even with the Zero Trust Level 1 standard, which strengthens the existing OAuth 2.0 and OIDC procedures, it was not possible to selectively restrict access to multiple functions implemented by microservices based on the requester's attributes. In contrast, in the information processing system 1 according to this embodiment, access to multiple functions implemented by a microservice can be selectively restricted based on the attribute classification of the requester, thereby enabling more detailed management of access to services. In the information processing system 1 according to this embodiment, the attribute classification information of the requester is examined in the application layer mechanism within the microservice, thereby making it possible to selectively restrict access to multiple functions of the microservice. For example, by examining the attribute classification information of the requester in a transaction layer mechanism within the microservice, it is possible to selectively restrict access to multiple functions of the microservice.

[0084] <About Zero Trust Level 3> This section explains encapsulation level 3 between service functions and access authorization functions. At this level, the access authorization function for microservices is encapsulated in the domain layer, which is a component of the microservices, thereby resolving the issues (risks) associated with centralized management and enabling more detailed access management. This mechanism provides the following benefits to the extent that the scope of impact is localized to the domain layer of the microservice: (Effect 3-1) Availability issues can be minimized. (Effect 3-2) Performance issues can be minimized. (Effect 3-3) Maintenance degradation issues can be minimized. (Effect 3-4) Safety degradation issues can be minimized.

[0085] Even with the Zero Trust Level 2 standard, which strengthens the existing OAuth 2.0 and OIDC procedures, it was not possible to selectively restrict access to multiple pieces of information available through the microservice's functions based on the requester's attributes. In contrast, in the information processing system 1 according to this embodiment, access to multiple pieces of information implemented by microservices can be selectively restricted based on the attribute classification of the requester, thereby enabling even more detailed management of access to services. In the information processing system 1 according to this embodiment, the attribute classification information of the requester is examined in the domain layer mechanism within the microservice, thereby making it possible to selectively restrict access to multiple pieces of information in the microservice.

[0086] In the example of Figure 1, the authorization control unit is applied to all of the transmission / reception layer, application layer, and domain layer of multiple services A to D. However, for example, the authorization control unit may be applied to only some of the services (in the example of Figure 1, one, two, or three of services A to D), or the authorization control unit may be applied to only some of the layers (one or two of the transmission / reception layer, application layer, and domain layer), or the authorization control unit may be applied to only some of the layers (one or two of the transmission / reception layer, application layer, and domain layer) of some of the services (in the example of Figure 1, one, two, or three of services A to D).

[0087] (Second embodiment) [Information Processing Systems] FIG. 6 is a diagram showing a schematic example of the configuration of an information processing system 201 according to an embodiment (second embodiment).

[0088] The information processing system 201 includes a terminal device 211 and a service device 212E which is an information processing device for service E. Here, in this embodiment, one service E is shown, but the number of services may be any number equal to or greater than one. Furthermore, service E may be any service, for example, a microservice.

[0089] <Service E service equipment> The service device 212E of the service E is configured using, for example, one or more computers. The service device 212E may be, for example, an on-premise server device or a cloud server device.

[0090] The service device 212E comprises one transmission / reception layer program unit 231, three application layer program units (for convenience of explanation, referred to as application layer program units 271A, 271B, and 271C), three domain layer program units 272A, 272B, and 272C, three data layer program units 273A, 273B, and 273C, and three business data storage units 274A, 274B, and 274C.

[0091] The transmission / reception layer program unit 231 includes a reception unit 251 , a transmission unit 252 , and an authorization control unit 253 . The application layer program units 271A, 271B, and 271C include authorization control units 254A, 254B, and 254C, respectively. The domain layer program units 272A, 272B, and 272C each include an authorization control unit 255A, 255B, and 255C.

[0092] In this embodiment, one reception / transmission layer program unit 231 branches into three application layer program units 271A, 271B, and 271C. The reception / transmission layer program unit 231 exchanges information with each of the application layer program units 271A, 271B, and 271C. Furthermore, there is a one-to-one correspondence between each of application layer program units 271A, 271B, and 271C, each of domain layer program units 272A, 272B, and 272C, each of data layer program units 273A, 273B, and 273C, and each of business data storage units 274A, 274B, and 274C. In other words, three sets from the application layer program units to the business data storage units are connected to one transmission / reception layer program unit 231.

[0093] Here, in this embodiment, compared to the configuration example of one service (for example, service A) shown in Figure 1, it differs in that one transmission / reception layer program unit 231 is branched into three systems (a set from the application layer program unit to the business data storage unit), but it is similar in that each authorization control unit 253, 254A to 254C, 255A to 255C can control whether to grant authorization for each resource.

[0094] In this embodiment, resource-based boundary defense is realized in the service device 212E. In the example of FIG. 6, boundaries B11 to B13 of boundary defense in resource units are shown schematically. In this embodiment, in the service device 212E, a level 1 boundary B11 exists between the transmission / reception layer program section 231 and the application layer program sections 271A to 271C, a level 2 boundary B12 exists between the application layer program sections 271A to 271C and the domain layer program sections 272A to 272C, and a level 3 boundary B13 exists between the domain layer program sections 272A to 272C and the data layer program sections 273A to 273C.

[0095] <Authentication information flow and business information flow> FIG. 6 shows an arrow a1 indicating the flow of a signal including authentication information, which is information used for authentication, and an arrow b1 indicating the flow of a signal including business information but not including authentication information. In the example of FIG. 6, the signal flow in the information processing system 201 is shown by distinguishing between a line with an arrow a1 and a line with an arrow b1. The flow of this information may be the same as in the first embodiment, except for the difference in the system configuration, for example.

[0096] As described above, the information processing system 201 according to this embodiment can obtain the same effect as the first embodiment in that it is possible to control access authorization for each resource. In the example of Figure 6, a configuration example is shown in which one transmission / reception layer program unit 231 branches into three systems (a set from the application layer program unit to the business data storage unit), but the number of branches may be, for example, two, or four or more.

[0097] Here, in this embodiment, an example of a configuration in which one receiving / transmitting layer program unit branches into two or more application layer program units has been shown, but as another example, a configuration in which one application layer program unit branches into two or more domain layer program units may be used, or a configuration in which both of these branching types are mixed may be used. In addition, a device for a service with such a branch (service E in this embodiment) and a device for a service without a branch (services A to D in the example of Figure 1) as shown in Figure 1 may be connected in parallel to a common terminal device (one terminal device).

[0098] (Third embodiment) [Information Processing Systems] FIG. 7 is a diagram showing a schematic example of the configuration of an information processing system 401 according to an embodiment (third embodiment). Here, in this embodiment, an example will be described for zero trust level 3. Therefore, as the configuration of the information processing system 401, only the configuration related to zero trust level 3 will be mainly shown.

[0099] The information processing system 401 includes an MMI (Multi-Modal Interface) 411 and an MME (Multi-Modal Engine) 412. Here, multi-modal is a style of information processing that handles data of different formats simultaneously and in parallel. The MME 412 can use external large language models (LLMs), external LLMs 511. Although the example in FIG. 7 shows the external LLMs 511 inside the MME 412, the external LLMs 511 are provided outside the MME 412. The MME 412 also includes an admission control unit 451 . 7 shows a user 431. The user 431 may be, for example, a single person or a group of two or more people.

[0100] In this embodiment, the MMI 411 includes a function to accept input from one or more humans and a function to accept input from one or more generation AIs. When multiple generation AIs are used, for example, each generation AI is assigned a different perspective. Here, the one or more people making input to the MMI 411 may be, for example, only the user 431, or may be the user 431 and another person, or may be a person other than the user 431.

[0101] 4 shows an outline of the processing performed in the information processing system 401. In the example of FIG. 7, for convenience of explanation, each process is assigned a symbol (T+number), but the value of each symbol has no meaning. Furthermore, the order of processing performed in the information processing system 401 does not necessarily have to be the order described below.

[0102] (Process T1) The business rule manual is provided to the MME 412. (Process T11) In the MME 412, structuring rules are generated based on the business rule manual. (Process T2) The role rules are provided to the MME 412. (Process T12) In the MME 412, a structured rule is generated based on the role rule.

[0103] (Process T21) The MME 412 performs advance preparations based on these structuring rules. (Process T31) The MME 412 generates a business rule library. (Process T32) The MME 412 generates a role type determination rule.

[0104] (Process T41) A question from the user 431 is input to the MME 412 via the MMI 411. (Process T42) The content of the question is confirmed with the MME 412 via the MMI 411.

[0105] (Process T51) In the MME 412, processes for executing questions (processes T61, T62, T71) are performed. (Process T61) The MME 412 passes the question type determination rules and proposal requirements to the external LLM 511. (Process T62) In response to this, the MME 412 receives a proposal type from the external LLM 511. Using this, the content of the question is confirmed (process T42). In this embodiment, for example, by repeating a question and its content confirmation one or more times, it is possible to perform a collaborative iteration with the generation AI.

[0106] In addition, for example, RaR (Rephrase and Respond) may be used to confirm the content of the question. RaR is a method in which the LLM rephrases the user's question in a way that is easy for it to understand, thereby bridging the gap between what a human perceives as clear and what an LLM perceives as clear. As such an LLM, for example, a GPT (Generative Pretrained Transformer) may be used.

[0107] (Process T71) The MME 412 passes the business rules (local rules) and the question to the external LLM 511. (Process T81) In response to this, the MME 412 receives a response from the external LLM 511. Using this, a response is made according to role (perspective).

[0108] In this embodiment, the MME 412 includes a permission control unit 451 for a question from the user 431 . In this embodiment, when a question is sent from user 431 to MME 412, the attribute information of user 431 (e.g., predetermined information such as "name," "service user ID," "affiliated project," "affiliated organization name," and "employee number") is sent along with the question. In MME 412, the permission control unit 451 determines the access authority of resources that can be used when responding (answering) a question from user 431 based on the attribute information of user 431, and controls the answering of the question using only resources that are authorized for use (resources for which access authority is available). The permission conditions (for example, input (Q) and output (V)) referred to by the permission control unit 451 and the processing performed by the permission control unit 451 may be the same as those in the first embodiment, for example. In this embodiment, the resource is, for example, information (information that can be used to answer a question).

[0109] As described above, the information processing system 401 according to this embodiment can obtain the same effect as the first embodiment in that it is possible to control access authorization for each resource.

[0110] In the example of Figure 7, the authorization control unit 751 can determine and authorize the resources (in this example, information) to which the user 431 has access authority at the time of receiving a question from the user 431 (or at the time of confirming the content of the question), so that only information to which the user 431 has access authority is used in the answer to the question.

[0111] [Regarding the above embodiment] A program for implementing the functions of any of the components of any of the above-described devices may be recorded on a computer-readable recording medium and loaded into a computer system for execution. The term "computer system" as used herein includes hardware such as an operating system or peripheral devices. The term "computer-readable recording medium" refers to portable media such as flexible disks, optical magnetic disks, ROMs, and compact discs (CDs) and read-only memories (ROMs), as well as storage devices such as hard disks built into computer systems. The term "computer-readable recording medium" also includes devices that retain a program for a certain period of time, such as volatile memory within a computer system that acts as a server or client when a program is transmitted over a network such as the Internet or a communication line such as a telephone line. Such volatile memory may be, for example, random access memory (RAM). The recording medium may also be, for example, a non-transitory recording medium.

[0112] The above program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by transmission waves in the transmission medium. Here, the "transmission medium" that transmits the program refers to a medium that has the function of transmitting information, such as a network such as the Internet or a communication line such as a telephone line. The above program may also be one that realizes part of the above-mentioned functions. Furthermore, the above program may be a so-called differential file that can realize the above-mentioned functions in combination with a program already recorded in a computer system. A differential file may also be called a differential program.

[0113] Furthermore, the functions of any of the components in any of the above-described devices may be implemented by a processor. For example, each process in the embodiments may be implemented by a processor operating based on information such as a program and a computer-readable recording medium storing information such as the program. Here, the functions of each unit of the processor may be implemented by, for example, individual hardware, or may be implemented by integrated hardware. For example, the processor may include hardware, and the hardware may include at least one of a circuit for processing digital signals and a circuit for processing analog signals. For example, the processor may be configured using one or more circuit devices mounted on a circuit board, or one or both of one or more circuit elements. An integrated circuit (IC) or the like may be used as the circuit device, and a resistor or a capacitor may be used as the circuit element.

[0114] Here, the processor may be, for example, a CPU. However, the processor is not limited to a CPU, and various types of processors such as a GPU (Graphics Processing Unit) or a DSP (Digital Signal Processor) may be used. The processor may also be, for example, a hardware circuit such as an ASIC (Application Specific Integrated Circuit). The processor may also be, for example, composed of multiple CPUs, or may be, for example, composed of a hardware circuit such as a multiple ASIC. The processor may also be, for example, composed of a combination of multiple CPUs and a hardware circuit such as a multiple ASIC. The processor may also include, for example, one or more of an amplifier circuit or a filter circuit that processes analog signals.

[0115] The embodiments of this disclosure have been described in detail above with reference to the drawings, but the specific configuration is not limited to this embodiment, and includes designs within the scope that do not deviate from the gist of this disclosure.

[0116] [Note] (Configuration example 1) to (Configuration example 9) are shown.

[0117] (Configuration example 1) an authorization control unit that controls whether or not to authorize a request for access to a resource in an information processing system in which a domain unit manages a plurality of resources; Information processing device.

[0118] (Configuration example 2) the authorization control unit controls whether to authorize each resource based on authorization conditions that define whether to authorize the access based on user attributes and on the attributes of the user who is the source of the access. The information processing device described in (Configuration Example 1).

[0119] (Configuration example 3) The resources include services for which authorization control is performed at the transmission layer. The information processing device according to (Configuration Example 1) or (Configuration Example 2).

[0120] (Configuration example 4) The resource includes a function for which authorization control is performed at the application layer. The information processing device according to any one of (Configuration Example 1) to (Configuration Example 3).

[0121] (Configuration Example 5) The resource includes information for which authorization control is performed at the domain layer. The information processing device according to any one of (Configuration Example 1) to (Configuration Example 4).

[0122] (Configuration Example 6) With the above configuration, the following configuration may be adopted as one configuration example. The resources include services whose authorization is controlled at the transmission / reception layer, functions whose authorization is controlled at the application layer, and information whose authorization is controlled at the domain layer. The information processing device according to (Configuration Example 1) or (Configuration Example 2).

[0123] (Configuration Example 7) On the computer, A program that realizes a function of controlling whether or not to authorize a request for access to a resource for each resource in an information processing system in which a domain unit manages multiple resources.

[0124] (Configuration Example 8) An information processing system in which a domain unit manages a plurality of resources, an information processing device that controls whether or not to authorize a request for access to the resource for each of the resources; Information processing system.

[0125] (Configuration Example 9) a domain unit controlling whether to authorize a request for access to a plurality of resources in an information processing system that manages the plurality of resources, for each of the resources; Information processing methods. [Explanation of symbols]

[0126] 1, 201, 401...information processing system, 11, 211...terminal device, 11a, 211a...user side program unit, 12A to 12D, 212E...service device, 31A to 31D, 231...transmission / reception layer program unit, 51A to 51D, 251...receiving unit, 52A to 52D, 252...transmitting unit, 53A to 53D, 54A to 54D, 55A to 55D, 253, 254A to 254C, 255A to 255C, 451...authorization control unit, 71A ~71D, 271A~271C...Application layer program section, 72A~72D, 272A~272C...Domain layer program section, 73A~73D, 273A~273C...Data layer program section, 74A~74D, 274A~274C...Business data storage section, 101...Communication signal, 121...Authentication information, 122...Other information, 411...MMI, 412...MME, 431...User, 511...External LLM, B1~B3, B11~B13...Boundary

Claims

1. an authorization control unit that controls whether or not to authorize a request for access to a resource in an information processing system in which a domain unit manages a plurality of resources; Information processing device.

2. the authorization control unit controls whether to authorize each resource based on authorization conditions that define whether to authorize the access based on user attributes and on the attributes of the user who is the source of the access. The information processing device according to claim 1 .

3. The resources include services for which authorization control is performed at the transmission layer.

3. The information processing device according to claim 1.

4. The resource includes a function for which authorization control is performed at the application layer.

3. The information processing device according to claim 1.

5. The resource includes information for which authorization control is performed at the domain layer.

3. The information processing device according to claim 1.

6. The resources include services whose authorization is controlled at the transmission / reception layer, functions whose authorization is controlled at the application layer, and information whose authorization is controlled at the domain layer.

3. The information processing device according to claim 1.

7. On the computer, A program that realizes a function of controlling whether or not to authorize a request for access to a resource for each resource in an information processing system in which a domain unit manages multiple resources.

8. An information processing system in which a domain unit manages a plurality of resources, an information processing device that controls whether or not to authorize a request for access to the resource for each of the resources; Information processing system.

9. a domain unit controlling whether to authorize a request for access to a plurality of resources in an information processing system that manages the plurality of resources, for each of the resources; Information processing methods.

Images