Information processing device, configuration data generation method, and configuration data generation program

Abstract

To provide an information processing device, configuration data generation method, and configuration data generation program with security improved.SOLUTION: An information processing device 100 is provided with an input unit 110 for inputting information about a first resource for which access permissions are to be set, and a source code acquisition unit 120 for acquiring a source code from a second resource accessed by the first resource. The information processing device is also provided with a mapping table 170 for storing correspondences between methods that can be written in the source code and actions on the second resource, and an action detection unit 130 for extracting methods from the source code, comparing them with the mapping table, and detecting actions on the second resource. The information processing device is further provided with an access restriction creation unit for generating access restriction information to be assigned to the first resource based on the detected actions.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present embodiment relates to an information processing device, a setting data generating method, and a setting data generating program. [Background technology]

[0002] In recent years, with the development of cloud service systems (hereinafter referred to as cloud systems), various cloud services such as AWS (registered trademark) and Azure (registered trademark) have been provided and are becoming increasingly popular. In such cloud systems, it is important to improve security by granting resources access rights to other resources. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2004-287810 Summary of the Invention [Problem to be solved by the invention]

[0004] The present embodiment aims to provide an information processing device, a setting data generation method, and a setting data generation program that can improve security. [Means for solving the problem]

[0005] The information processing device of this embodiment includes an input unit that inputs information about a first resource for which access permissions are to be set, and a source code acquisition unit that acquires source code from a second resource accessed by the first resource. The information processing device also includes a mapping table that stores correspondences between methods that can be written in the source code and actions on the second resource. The information processing device also includes an action detection unit that extracts the methods from the source code and compares them with the mapping table to detect the actions on the second resource. The information processing device also includes an access restriction creation unit that generates access restriction information to be assigned to the first resource based on the detected actions. [Brief explanation of the drawings]

[0006] [Figure 1] 1 is a schematic diagram illustrating an example of the configuration of a cloud system including an information processing apparatus according to an embodiment of the present invention. [Figure 2] FIG. 1 is a block diagram illustrating an example of a resource configuration within a cloud service. [Figure 3] FIG. 1 is a schematic block diagram illustrating an example of the configuration of an information processing device according to an embodiment of the present invention. [Figure 4] FIG. 4 is a diagram illustrating an example of the configuration of a mapping table. [Figure 5] 10 is a flowchart illustrating an example of a setting data generation method according to the embodiment. [Figure 6] FIG. 10 is a diagram for explaining a specific example of a mapping table. [Figure 7] FIG. 10 is a schematic block diagram illustrating an example of the configuration of an information processing device according to a modified example of the embodiment. [Figure 8] A diagram illustrating a specific example of a list of methods and actions. [Figure 9] FIG. 10 is a diagram for explaining a specific example of a created mapping table. [Figure 10] FIG. 10 is a diagram illustrating an example of a list of methods for which no corresponding action exists when the names are compared. [Figure 11]FIG. 10 is a diagram for explaining a specific example of a created mapping table. DETAILED DESCRIPTION OF THE INVENTION

[0007] Hereinafter, an embodiment will be described with reference to the drawings.

[0008] FIG. 1 is a schematic diagram illustrating an example of the configuration of a cloud system including an information processing device according to this embodiment. The cloud system is mainly composed of an information processing device 100, a cloud service 200, a communication network 300, and a group of user terminals 400. The information processing device 100 is a device that sets access permissions for resources within the cloud service 200. While a desktop computer is illustrated here, the information processing device 100 may be a computer on a network, a laptop computer, a smartphone, a tablet terminal, or the like. The information processing device 100 may be composed of multiple computers rather than just one computer to perform each process, and may be a virtual device or cloud rather than just an actual device.

[0009] The information processing device 100 is configured to have a main device 101, a storage device 102 for storing various data, and a display device 103 for displaying various data. The main device 101 is a computer device such as a personal computer, and includes a CPU (Central Processing Unit) 101a, RAM (Random Access Memory), and the like. The main device 101 is equipped with memories (not shown) such as a memory (RAM) and a ROM (Read Only Memory). A keyboard 104 and a mouse 105 are also connected to the main device 101 as input devices. The main device 101 executes various programs based on instructions input by the user using these input devices.

[0010] The storage device 102 stores a setting data generation program 106 and a mapping table 170. The setting data generation program 106 sets access permissions for resources included in the cloud system. The mapping table 170 is a table used by the setting data generation program 106, and defines the relationship between resource methods and actions for access targets.

[0011] The user inputs resource information 600 (described later) and executes the setting data generation program 106 on the main device 101, thereby automatically generating the authority to be granted to each resource. The setting data generation program 106 may be stored in a memory (not shown) within the main device 101. Alternatively, the setting data generation program 106 may be stored in a cloud service 200 connected to the main device 101 via a communication network 300 or the like, and downloaded and executed as needed. The input device is not limited to the keyboard 104 and mouse 105. For example, a touch panel, a pen tablet, a microphone, etc. may also be used.

[0012] The cloud service 200 is a cloud service used by a user. The type of cloud service provider does not matter, such as Azure, AWS, etc. The communication network 300 is a communication network that enables communication between the information processing device 100, the cloud service 200, and the user terminal 400.

[0013] The user terminal group 400 includes user terminals 401 used by users who use the cloud service 200. Here, the user terminal 401 is illustrated as a notebook computer, but it may be a desktop computer, a computer integrated with a display, a smartphone, a tablet terminal, a wearable terminal, etc. The number of user terminals 401 included in the user terminal group 400 is not limited to three, and may be any number greater than or equal to one.

[0014] 2 is a block diagram illustrating an example of a resource configuration within a cloud service. A cloud service 200 includes, as resources, a serverless program execution environment 210, a virtual machine 220, a database 230, and storage 240. For example, if the cloud service is AWS, the serverless program execution environment 210 corresponds to "AWS Lambda," the virtual machine 220 corresponds to "EC2," the database 230 corresponds to "DynamoDB," and the storage 240 corresponds to "s3."

[0015] In FIG. 2, dotted lines with arrows indicate access relationships between resources. That is, the resource located at the base end of the arrow accesses the resource located at the tip of the same arrow. For example, the serverless program execution environment 210 accesses the database 230 and the storage 240. The virtual machine 220 accesses the database 230 and the storage 240. In this case, the information processing apparatus 100 of this embodiment sets the access authority of the serverless program execution environment 210 to the database 230, the access authority of the serverless program execution environment 210 to the storage 240, the access authority of the virtual machine 220 to the database 230, and the access authority of the virtual machine 220 to the storage 240.

[0016] Next, the configuration of the information processing device 100 will be described with reference to FIG. 3. FIG. 3 is a schematic block diagram illustrating an example of the configuration of the information processing device according to this embodiment. The information processing device 100 according to the embodiment includes an input unit 110, a source code acquisition unit 120, an action detection unit 130, an access restriction creation unit 140, an output unit 150, and a mapping table 170. Information on resources that are to be subject to access control among resources included in a cloud service 200 (access control target 201 in FIG. 3) is input to the information processing device 100. Furthermore, when multiple instances are set for the resource in the cloud service 200, information on the instance for which access permission is to be set (resource information 600 in FIG. 3) is also input to the information processing device 100.

[0017] The input unit 110 receives input of resource information 600 as information for specifying a target for which access permissions are to be set. When multiple instances are set for one resource in the cloud service 200, the resource information 600 specifies the instance for which access permissions are to be set. Information on the resource (instance) specified by the resource information 600 is output to the source code acquisition unit 120. The resource information 600 input to the input unit 110 may be input in the form of a configuration file, or may be input by a user from an input device such as the keyboard 104. In addition, other information that may be used by the information processing device 100 when creating access permissions, such as information on the workflow of the entire cloud service system and information on a generation format of a template 700 (described later), can also be input from the input unit 110.

[0018] The source code acquisition unit 120 acquires source code from a resource for which access permissions are to be set. Specifically, based on the resource information input from the input unit 110, the source code acquisition unit 120 accesses the resource (access control target 201 in FIG. 3 ) in the cloud service 200 and acquires the source code set in the resource. The source code acquired from the access control target 201 is output to the action detection unit 130.

[0019] The action detection unit 130 analyzes the source code input from the source code acquisition unit 120 and detects an action on the accessed resource. An action is a specific operation from the accessing resource to the accessed resource, such as "read," "write," or "update." A mapping table 170 is used to analyze the source code.

[0020] FIG. 4 is a diagram illustrating an example of the configuration of a mapping table. In the mapping table 170, for example, items such as "access control target," "method," "argument," "argument condition," and "action" are set. An "access control target" is a resource to be accessed. A "method" is a type of function, and is a subroutine in which a series of processes are defined in source code. An "argument" is data to be input to a method. An "argument condition" is a condition to be input to a method. An "action" is an access authority corresponding to a method. Records of methods that may be written in source code are set in advance in the mapping table 170. For example, when a system is built using an SDK (Software Development Kit), records related to methods defined in the SDK are set in the mapping table 170.

[0021] The action detected by the action detection unit 130 is output to the access restriction creation unit 140 .

[0022] The access restriction creation unit 140 creates an access permission to be granted to a target resource (instance) based on the action input from the action detection unit 130. Then, the access restriction creation unit 140 creates a file (template 700 in FIG. 3 ) in which the created access permission is described in a predetermined format. The template 700 is, in other words, setting data for the access permission. The template 700 is output from the information processing device 100 via the output unit 150.

[0023] Next, a method for generating access authority using the information processing device 100 of this embodiment will be described. Fig. 5 is a flowchart illustrating an example of a setting data generation method according to this embodiment. In the following, an example will be described in which access authority is set for "AWS Lambda," which is a serverless program execution environment 210, in a system built on AWS using an SDK.

[0024] First, information about a resource (instance) for which access permissions are to be set is input to the information processing device 100 (S1). In S1, for example, an instance of "AWS Lambda" is input. Next, the source code for the resource input in S1 is acquired (S2). For example, the information processing device 100 accesses "AWS Lambda" to acquire the source code.

[0025] Next, services are discovered from the source code obtained in S2 (S3). A service is synonymous with the resource to be accessed. For example, if AWS resources are configured as shown in Figure 2, "DynamoDB," which is a database 230, and "s3," which is storage 240, are discovered as services. Next, for each service discovered in S3, the following series of steps from S4 to S8 are executed. Here, steps S4 to S8 for "DynamoDB" are explained.

[0026] First, all methods written in the source code obtained in S2 are detected (S4). For each detected method, the following series of steps from S5 to S8 are performed.

[0027] In S5, the mapping table 170 is searched to obtain the record (row) of the target method. FIG. 6 is a diagram illustrating a specific example of a mapping table. FIG. 6 shows a specific example of a mapping table when the cloud service is AWS and a system is constructed using an SDK. The names of the items in FIG. 6 have been changed to match the specific example. That is, "access control target" corresponds to "service," "method" corresponds to "SDK method," and "action" corresponds to "IAM policy action." IAM (Identity Access Management) is a service for managing access permissions to resources in AWS. Access permissions to resources can be set according to the IAM policy settings. The procedure shown in FIG. 5 will be explained below using the specific mapping table in FIG. 6.

[0028] If one of the methods detected in S4 is "putItem", in S5 the record in the fifth row of the mapping table 170a shown in FIG. 6 is obtained.

[0029] Next, it is determined whether the number of retrieved records (number of rows) is greater than one (S6). If it is greater than one (S6, YES), the procedures from S11 to S14 are executed. If it is not greater than one, i.e., if it is one (S6, NO), proceed to S7. In this case, since there is one retrieved record, proceed to S7. In S7, data on the "IAM policy action" for the retrieved record is acquired. Since the "IAM policy action" for the record in row 5 of the mapping table 170a is "PutItem," "PutItem" is acquired in S7. Next, a policy is created based on the action acquired in S7 (S8). For example, in S8, a policy is created that defines that the action "PutItem" is permitted for the resource "DynamoDB." By executing the above series of procedures from S5 to S8 for each of the methods detected in S4, access permissions for "DynamoDB" are set.

[0030] If only one service is detected in S3, the process proceeds to S9 after S8 is completed. If two or more services are detected in S3, the process executes the series of steps from S4 to S8 for the services for which access permissions have not been set. In the example above, "s3" is also detected as a service, so the process returns to S4 and sets access permissions for "s3".

[0031] If one of the methods detected in S4 is "getSignedUrl," then in S5, the records in the fourth and fifth rows from the bottom of the mapping table 170a shown in Fig. 6 are retrieved. In this case, the number of retrieved records (rows) is two. In other words, since this is greater than one (S6, YES), the procedures from S11 to S14 are executed.

[0032] First, the "argument" data of the record acquired in S5 is acquired (S11). Next, the argument character string is acquired from the description location of the method in the source code (S12). Then, the "argument condition" data is acquired for each of the records acquired in S5 (S13). For example, the "argument condition" of the record in the fifth line from the bottom of mapping table 170a is "contains 'getObject'", and the "argument condition" of the record in the fourth line from the bottom is "contains 'putObject'".

[0033] Next, it is determined whether the character string acquired in S12 matches the content acquired in S13 (S14). For example, if the character string "putObject" is acquired in S12, it matches the content of the "argument condition" in the record on the fourth line from the bottom, so it is determined that this record matches (YES in S14). Then, the procedures of S7 and S8 are executed based on that record.

[0034] That is, since the "IAM policy action" in the record in the fourth row from the bottom of the mapping table 170a is "PutObject," "PutObject" is acquired in S7. Next, a policy is created based on the action acquired in S7 (S8). For example, in S8, a policy is created that defines that the action "PutObject" is permitted for the resource "s3." By executing the above series of steps from S5 to S8 for each of the methods detected in S4, access permissions for "s3" are set.

[0035] Once policies have been created for all services detected in S3, a template is created (S9). All policies (access permissions) created in S8 are described in the template according to a specified format. Finally, the template created in S9 is output, completing the series of steps for generating access permissions.

[0036] As described above, the information processing apparatus according to the embodiment can automatically set access permissions using a mapping table that associates methods with access permissions and source code registered for a resource. Since the access permissions set for a resource are based on the content (methods) described in the source code, only the minimum necessary permissions can be granted. Furthermore, the access permission setting data can be generated before the release of the cloud service system. Therefore, unnecessary access permissions are not granted to resources at the time of system release, and only the minimum necessary permissions are granted, thereby improving security.

[0037] Next, a modified example of this embodiment will be described. Fig. 7 is a schematic block diagram illustrating an example of the configuration of an information processing device according to a modified example of this embodiment. The information processing unit 100a according to the modified example shown in Fig. 7 has a configuration in which a mapping table creation unit 160 is added to the information processing device 100 shown in Fig. 1. The same components as those of the information processing device 100 shown in Fig. 1 are assigned the same reference numerals, and their description will be omitted.

[0038] The mapping table creation unit 160 generates a mapping table 170A from a list of methods used in the source code and a list of access permissions granted to resources. A method for creating the mapping table 170A in the mapping table creation unit 160 will be described below with reference to Figs. 8 to 11. Fig. 8 is a diagram illustrating a specific example of a list of methods and actions. Fig. 9 is a diagram illustrating a specific example of the created mapping table. Fig. 10 is a diagram illustrating an example of a list of methods for which no corresponding action exists when comparing names. Fig. 11 is a diagram illustrating a specific example of the created mapping table.

[0039] First, a list of methods used in the source code and a list of access permissions to be granted to resources are input to the mapping table creation unit 160. When the cloud service is AWS and a system is constructed using an SDK, the list of source code is a list of SDK method names, and the list of access permissions is a list of IAM policy action names. Fig. 8 shows an example of the SDK method list (method list 161) and the IAM policy action list (action list 162).

[0040] The mapping table creation unit 160 compares the methods described in the two input lists 161, 162 and extracts pairs of methods with corresponding names. The mapping table 170b is generated with each extracted pair of method and action as one record (see FIG. 9). Note that there is not necessarily a one-to-one correspondence between methods and actions. Multiple actions may be associated with one method. For example, as shown in FIG. 9, the action "GetItem" is associated with two methods, "transactGetItems" and "getItem." The items "service," "argument," and "argument condition" are input from the SDK method specifications, the IAM policy action specifications, etc. These items may also be input by the user.

[0041] For methods described in method list 161 for which no corresponding action is found (see, for example, list 161a in FIG. 10), mapping table creation unit 160 prompts the user to input an action. The user inputs the corresponding action using an input device such as keyboard 104 or mouse 105. At this time, the user also basically inputs the "arguments" and "argument conditions." In this way, mapping table 170c as shown in FIG. 11 is generated even for methods for which no corresponding action is found. Finally, mapping table 170b generated automatically and mapping table 170c generated based on user input are combined to complete the creation of mapping table 170A.

[0042] In this way, by providing the mapping table creation unit 160, even when a method or action is added or deleted, the mapping table 170 can be flexibly changed or modified, and therefore, access rights can be quickly modified, further improving security.

[0043] Although the above description has been given of a case where a public cloud is used as a cloud service constituting a cloud system, a private cloud may also be used. A combination of a public cloud and a private cloud may also be used. Two or more cloud services may also be used.

[0044] Furthermore, in the above description, the information processing device is located outside the cloud service and the two are connected via a communication network, but the information processing device may be located within the cloud service.

[0045] The above describes an embodiment of the present invention, but it is presented by way of example only and is not intended to limit the scope of the invention. This novel embodiment can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, and are also included in the inventions and their equivalents as defined in the claims.

[0046] The present invention is not limited to the above-described embodiment, and the components can be modified and embodied in practice without departing from the spirit of the invention. Furthermore, various inventions can be created by appropriately combining the multiple components disclosed in the above-described embodiment. For example, some of the components shown in the embodiment may be omitted.

[0047] In addition, even if the operational flows in the claims, specifications, and drawings are described using "first," "next," etc. for convenience, this does not mean that they must be performed in that order. Furthermore, it goes without saying that the steps that make up these operational flows can be omitted as appropriate if they do not affect the essence of the invention.

[0048] Of the technologies described here, the controls mainly described in the flowcharts can often be set by a program, and may be stored on a recording medium or a recording unit. The method of recording on this recording medium or recording unit may be recording at the time of product shipment, using a distributed recording medium, or downloading via the Internet.

[0049] In the embodiments, the parts described as "parts" (sections or units) may be configured by combining dedicated circuits or multiple general-purpose circuits, or, if necessary, by combining a processor such as a microcomputer or CPU that operates according to pre-programmed software, or a sequencer such as an FPGA. It is also possible to design the device so that an external device takes over some or all of the control, in which case a wired or wireless communication circuit is involved. Communication may be via Bluetooth (registered trademark), WiFi, a telephone line, USB, or the like. The dedicated circuit, general-purpose circuit, and control unit may be integrated into an ASIC. [Explanation of symbols]

[0050] 100...information processing device, 110...input unit, 120...source code acquisition unit, 130...action detection unit, 140...access restriction creation unit, 150...output unit, 170...mapping table, 200...cloud service, 201...access control target, 600...resource information, 700...template,

Claims

1. an input unit for inputting information on a first resource for which access rights are to be set; a source code acquisition unit that acquires source code from a second resource accessed by the first resource; a mapping table storing correspondences between methods that can be written in the source code and actions on the second resource; an action detection unit that extracts the method from the source code and compares it with the mapping table to detect the action on the second resource; an access restriction generation unit that generates access restriction information to be assigned to the first resource based on the detected action; An information processing device comprising:

2. The information processing apparatus according to claim 1 , further comprising a mapping table creation unit that compares the list of methods that can be written in the source code with the list of actions for the second resource to create the mapping table.

3. The information processing apparatus according to claim 2 , wherein the mapping table creating unit creates the mapping table based on a comparison between the names of the methods and the names of the actions.

4. The information processing apparatus according to claim 1 , wherein the access restriction creating unit creates the access restriction information in accordance with a predetermined description format.

5. Enter the information of the first resource for which you want to set access permissions, obtaining source code from a second resource accessed by the first resource; extracting the method from the source code, and detecting the action on the second resource by comparing the method with a mapping table that stores correspondence between the method that can be described in the source code and an action on the second resource; A setting data generation method for generating access restriction information to be assigned to the first resource based on the detected action.

6. inputting information on a first resource for which access rights are to be set; obtaining source code from a second resource accessed by the first resource; extracting the method from the source code, and detecting the action on the second resource by comparing the method with a mapping table that stores correspondence between the method that can be written in the source code and an action on the second resource; and generating access restriction information to be assigned to the first resource based on the detected action.

Images