Program, server, and method for generating authentication information for web applications

Abstract

To provide a web application server, a web application program, and a web application provision method that can prevent unauthorized use of web applications.SOLUTION: A web application server includes a communication unit and a processor. The processor assigns authentication information to a web application program written in a low-level language in response to a request from a client, sends, to the client, the web application program with the authentication information assigned thereto, and returns, to the client, results of the verification of the authentication information in response to a request for verification of the authentication information from the client in accordance with a request from the web application program when the web application program is started.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a program, a server, and a method for generating authentication information for a web application. [Background technology]

[0002] Online classes have been introduced in recent years. These online classes often use web applications that provide various functions for the classes on a web browser. Web applications are typically stored on a web application server on a network, downloaded from the web application server to a terminal as needed, and executed on the terminal's web browser. Some recent web applications use program code written in machine language or a low-level language similar to machine language. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2003-223329 Summary of the Invention [Problem to be solved by the invention]

[0004] Since web applications are publicly available, there is a possibility that the program code of the web application may be obtained by a third party and the obtained program code may be used illegally in the third party's environment.

[0005] An object of the present invention is to provide a program, a server, and a method for generating authentication information for a web application that can prevent unauthorized use of a web application. [Means for solving the problem]

[0006] A first aspect of the program of the present invention is characterized in that it causes a server computer that provides a web application to a client to function as: means for receiving a request to send the second program from a client that executes the web application, the second program including a first program written in a predetermined script language and a second program written in at least one of a predetermined assembly language or machine language, when executing the web application; means for generating, in response to the received request to send the second program, first authentication information for determining whether the second program can be started on the client and a startup restriction time, which is the time when startup of the second program is permitted; means for assigning the generated first authentication information and the startup restriction time to the second program; and means for transmitting the second program, to which the first authentication information and the startup restriction time have been assigned, to the client. [Effects of the Invention]

[0007] According to the present invention, it is possible to provide a program, a server, and a method for generating authentication information for a web application that can prevent unauthorized use of the web application. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram showing an example of the configuration of a system according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram showing an example of a screen display by a web application running on a web browser of a terminal. [Figure 3] FIG. 3 is a flowchart showing the processing flow of a web application. [Figure 4] FIG. 4 is a flowchart showing the flow of processing by the server when a computing program is requested from a web application. [Figure 5A] FIG. 5A is a diagram illustrating an example of the data structure of a computing program stored in a storage. [Figure 5B]FIG. 5B is a diagram illustrating an example of a calculation program transmitted to the terminal. [Figure 6] FIG. 6 is a flowchart showing the flow of processing when a computing program is started in a terminal. [Figure 7] FIG. 7 is a flowchart showing the flow of processing by the server after the download of the computing program is completed. DETAILED DESCRIPTION OF THE INVENTION

[0009] An embodiment of the present invention will be described with reference to the drawings. Fig. 1 is a diagram showing an example of the configuration of a system 1 according to an embodiment of the present invention. The system 1 is a server-client system including a server 10 and terminals 20a and 20b. The server 10 and the terminals 20a and 20b are communicatively connected via a network 30. The network 30 is, for example, the Internet. The number of terminals is not limited to two.

[0010] The server 10, which serves as a web application server, includes a processor 11, a ROM 12, a RAM 13, a storage 14, and a communication device 15. These are all connected to each other via a system bus 19.

[0011] The processor 11 may be an integrated circuit including a CPU (Central Processing Unit) or the like. The processor 11 controls the operation of the server 10 in accordance with a program stored in the storage 14. A processor other than a CPU, such as an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a GPU (Graphic Processing Unit), may also be used.

[0012] The ROM 12 stores information used for the operation of the processor 11, etc. The RAM 13 is a main storage device for the operation of the processor 11, etc.

[0013] The storage 14 stores various programs, parameters, and the like, such as a server control program used by the processor 11 and an arithmetic program for executing various calculations. In the embodiment, the various programs include web applications executed on the web browsers of the terminals 20a and 20b. In the embodiment, the web application includes a web application for mathematics education. The web application for mathematics education performs various operations, such as displaying various content for mathematics education on the web browser in response to operations on the web browser of the terminals 20a and 20b. In the embodiment, the program code of the web application for mathematics education may be written in a high-level language such as JavaScript (registered trademark). Furthermore, in the embodiment, the web application includes an arithmetic program that is downloaded in response to a request from the web application for mathematics education running on the web browser and executes various calculations specified by the user's operations on the web browser. In the embodiment, the arithmetic program may be written in a low-level language such as WebAssembly. Here, the high-level language refers to JavaScript, scripting languages ​​such as Python and Ruby, or programming languages ​​that are easy for humans to understand, such as C, C++, and Objective C, and that can be converted into a low-level language using, for example, an interpreter or compiler. On the other hand, low-level languages ​​are programming languages ​​that are written in the CPU's instruction set itself or in a format close to it, such as WebAssembly, assembly language, machine code, etc. Here, machine code object code that can be directly executed by the CPU is also included in low-level languages.

[0014] The communication device 15 is a communication unit that includes a circuit for communicating with an external communication network such as the network 30 .

[0015] Terminals 20a and 20b as clients may be electronic devices such as personal computers (PCs), tablet terminals, smartphones, etc. Terminals 20a and 20b may also be scientific calculators with communication functions, etc. Below, the configuration of terminal 20a will be described assuming that terminal 20a and terminal 20b have the same configuration. Note that terminal 20a and terminal 20b do not necessarily have the same configuration.

[0016] The terminal 20a includes a CPU 21, a ROM 22, a RAM 23, a storage 24, an input device 25, a display device 26, and a communication device 27. These are all connected to one another via a system bus 29.

[0017] The CPU 21 is a processor that controls various operations of the terminal 20a. The CPU 21 controls the operations of the terminal 20a by executing various programs in response to input signals from the input device 25 and signals received by the communication device 27. The various programs may be downloaded from the server 10 to the storage 24 via the network 30 and the communication device 27.

[0018] The ROM 22 stores a startup program for the terminal 20a, etc. The RAM 23 is a main storage device for the CPU 21, etc. The storage 24 stores various programs, such as a terminal control program used by the CPU 21, parameters, etc.

[0019] The input device 25 includes a keyboard, a mouse, a touch panel, etc. In response to a user's operation via the input device 25, a signal indicating the content of the user's operation is input to the CPU 21 via the system bus 29.

[0020] The display device 26 is a liquid crystal display, an organic EL display, etc. The display device 26 may be provided integrally with the terminal 20a, or may be provided separately from the terminal 20a. Various images are displayed on the display device 26.

[0021] The communication device 27 is a communication unit including a circuit for communicating with an external communication network such as the network 30 .

[0022] In one example, a user specifies the URL of server 10 in a web browser running on terminal 20a. At this time, a display screen for a web application stored in server 10 is displayed on the web browser of terminal 20a. A request to server 10 is issued in response to an operation on this display screen via input device 25. Server 10 executes processing in response to the request and returns the processing result to terminal 20a as a response. Terminal 20a performs display or the like in response to a user operation in accordance with the response from server 10. Furthermore, an arithmetic program may be downloaded to terminal 20a in response to a request from a web application running on terminal 20a. When the arithmetic program is downloaded, an operation in accordance with the processing of the arithmetic program is executed on the web browser.

[0023] In this way, in the system 1, the web application program and the calculation program that run on the web browser of the terminal 20a or the terminal 20b realize the function of a web application for mathematics education.

[0024] FIG. 2 is a diagram showing an example of a screen display by a web application running on a web browser of terminal 20a.

[0025] The screen 26a displayed on the display device 26 of the terminal 20a includes an upper area 100a and a lower area 100b. The upper area 100a is displayed at the top of the screen 26a. The upper area 100a is elongated compared to the lower area 100b. A new paper creation icon 100c is displayed in the upper area 100a. The lower area 100b is an area located below the upper area 100a on the screen 26a. In the following description, the lower area 100b is also referred to as paper 100. Various "sticky notes" 101 may be displayed on the paper 100. The sticky notes 101 are display areas for displaying various information related to web applications. For example, the sticky notes 101 include formula sticky notes for creating mathematical formulas, graph sticky notes for creating graphs, table sticky notes for creating tables, shape sticky notes for creating shapes, and comment sticky notes for creating comments. The tag 101 may be a floating object. A floating object is an object (display body) that is displayed on the screen and whose display position can be changed at least in response to a user operation.

[0026] Furthermore, calculation processes such as calculating mathematical expressions entered in the sticky note 101, creating graphs, and creating tables are performed by a calculation program. When an operation such as calculating a mathematical expression, creating a graph, or creating a table is performed on the sticky note 101, the web application requests a calculation program from the server 10. The calculation program downloaded in response to the request executes various calculations such as creating a graph of the mathematical expression or creating a table, and passes the calculation results to the web application. In response, the web application displays the calculation results on the sticky note 101.

[0027] In this embodiment, the system 1 is capable of creating various sticky notes starting from a blank piece of paper 100. Note that the same paper 100 as that of the terminal 20a can also be displayed on the terminal 20b.

[0028] The following describes the flow of a series of processes in system 1. Figure 3 is a flowchart showing the flow of processing of a web application. The processing in Figure 3 is periodically executed by, for example, CPU 21 of terminal 20a in accordance with the program code of the web application. Note that when the web application is launched, a login process such as inputting an ID and password may be performed.

[0029] In step S1, the CPU 21 determines whether or not a user has performed an operation to execute a calculation. As described above, after the web application in this embodiment is launched, the paper 100 can be displayed in the web browser. The user can then create various sticky notes 101 on the paper 100 and perform various calculations on the created sticky notes 101, such as calculating mathematical expressions, creating graphs, tables, and diagrams. In step S1, it is determined that a calculation execution operation has been performed by the user when an operation to execute various calculations, such as calculating mathematical expressions, creating graphs, creating tables, and creating diagrams, is performed. If it is determined in step S1 that a calculation execution operation has not been performed, the process proceeds to step S2. If it is determined in step S2 that a calculation execution operation has been performed, the process proceeds to step S3.

[0030] In step S2, the CPU 21 performs other processes. For example, when an operation to move the sticky note 101, which is a floating object, is performed, the CPU 21 updates the display position of the sticky note 101 on the paper 100. After the other processes, the process in FIG. 3 ends.

[0031] In step S3, the CPU 21 requests the server 10 for a calculation program in order to execute the calculation instructed to be executed by the user in response to the request from the web application.

[0032] In step S4, the CPU 21 determines whether or not the calculation program has been received. The process waits until it is determined in step S4 that the calculation program has been received. If the calculation program has not been received within a predetermined time, a timeout process may be performed. If it is determined in step S4 that the calculation program has been received, the process proceeds to step S5.

[0033] In step S5, the CPU 21 starts the calculation program. The processing after the calculation program is started will be described later. Here, the description will be continued assuming that the calculation instructed by the user is executed as a result of starting the calculation program.

[0034] In step S6, the CPU 21 displays the calculation result on the sticky note 101. For example, if a mathematical expression is being calculated, the CPU 21 displays the result calculated by the calculation program based on the mathematical expression input by the user on the sticky note 101. Also, for example, if a graph is being created, the CPU 21 draws a graph created by the calculation program based on a function input by the user on the sticky note 101. Also, for example, if a table is being created, the CPU 21 displays a table created by the calculation program based on data input by the user on the sticky note 101. After these calculation results are displayed, the processing of FIG. 3 ends.

[0035] 4 is a flowchart showing the flow of processing by the server 10 when a computing program is requested from a web application. The processing in FIG. 4 is periodically executed by, for example, the processor 11 of the server 10 after the web application is started on the terminal 20a.

[0036] In step S101, the processor 11 determines whether or not a request for an arithmetic program has been made from a web application on the terminal 20a. If it is determined in step S101 that a request for an arithmetic program has not been made, the process proceeds to step S102. If it is determined in step S101 that a request for an arithmetic program has been made, the process proceeds to step S103.

[0037] In step S102, the processor 11 performs other processing. The other processing is processing that does not involve transmission of the arithmetic program. After the other processing, the processing in FIG. 4 ends.

[0038] In step S103, the processor 11 loads the calculation program from the storage 14 into the RAM 13. FIG. 5A is a diagram showing an example of the data structure of the calculation program stored in the storage 14 in the embodiment. As shown in FIG. 5A, the calculation program in the embodiment has a known section SEC1 and a custom section SEC2. The known section SEC1 stores the actual program code of the calculation program and various data required for calculation processing. On the other hand, no data is normally stored in the custom section SEC2. When a request for the calculation program is received from a web application on the terminal 20a, various data described below is added to the custom section SEC2 in a low-level language.

[0039] In step S104, the processor 11 generates a token as authentication information. The processor 11 then stores the generated token in the storage 14. The token is composed of, for example, a random character string. The token is generated, for example, by a token generation program stored in advance in the storage 14 of the server 10. The token generation algorithm may be any algorithm that can generate a unique character string each time a request from the computing program is received. As will be described later, the token is deleted from the storage 14 after a certain period of time. The processor 11 may also associate the generated token with the terminal 20a and store it in the storage 14. For example, the processor 11 may store the token together with the MAC (Media Access Control) address of the terminal 20a, which is transmitted as information about the terminal 20a. Because the MAC address is an identification value uniquely determined for each communication means provided in the terminal, even if a verification request is received from a malicious terminal using the same token as the token that happens to be stored, the request from the malicious terminal can be deemed fraudulent by comparing the MAC address.

[0040] In step S105, the processor 11 assigns the generated token to the custom section SEC2 of the arithmetic program loaded into the RAM 13.

[0041] In step S106, the processor 11 assigns a start time restriction to the custom section SEC2 of the calculation program loaded into the RAM 13. The start time restriction is the time when the calculation program is permitted to start. The calculation program is prohibited from starting after the start time restriction. The start time restriction is generated by adding an arbitrary time, such as 24 hours, to the current time. This arbitrary time may be specified, for example, by an administrator of the server 10.

[0042] In step S107, the processor 11 assigns a checksum to the custom section SEC2 of the arithmetic program loaded into the RAM 13. As the checksum, for example, a hash character string calculated from the data stored in the known section, the token data, and the activation restriction time can be used.

[0043] In step S108, the processor 11 transmits the arithmetic program loaded into RAM 13 to the terminal 20a. Thereafter, the processing of FIG. 4 ends. As a result, the arithmetic program is provided to the terminal 20a. FIG. 5B is a diagram showing an example of the arithmetic program transmitted to the terminal 20a. As shown in FIG. 5B, when the terminal 20a transmits the arithmetic program, a start limit time is assigned to custom section SEC21 constituting custom section SEC2 of the arithmetic program, a token is assigned to custom section SEC22, and a checksum is assigned to custom section SEC23. As described above, the checksum is calculated from the data of the known section, the start limit time data, and the token data.

[0044] 6 is a flowchart showing the flow of processing when a computing program is started in the terminal 20a. The processing in FIG. 6 is executed by the CPU 21 of the terminal 20a when the computing program is started.

[0045] In step S201, the CPU 21 initializes various parameters for executing the calculation program.

[0046] In step S202, the CPU 21 calculates a checksum from the data of the known section of the downloaded arithmetic program, the data of the start time limit, and the data of the token. The checksum is calculated according to the same generation algorithm as that used by the server 10.

[0047] In step S203, CPU 21 determines whether the calculated checksum matches the checksum assigned to the custom section of the downloaded computing program. If it is determined in step S203 that the calculated checksum does not match the checksum assigned to the custom section of the downloaded computing program, CPU 21 determines that startup of the computing program has failed. In this case, CPU 21 displays, for example, a message on the web browser indicating that startup of the computing program has failed. In other words, if the checksums do not match, it indicates that the computing program may have been tampered with, and startup has failed. If it is determined in step S203 that the calculated checksum matches the checksum assigned to the custom section of the downloaded computing program, processing proceeds to step S204.

[0048] In step S204, the CPU 21 requests the server 10 to verify the validity of the token by transmitting the token stored in the custom section of the computing program. After receiving the verification result of the validity of the token from the server 10, the process proceeds to step S205. The verification of the validity of the token in the server 10 will be explained in detail later, but the verification of the validity of the token is performed by checking whether the same token as the token transmitted from the terminal 20a is also stored in the server 10. When the token is stored in the server 10, information of "OK" is transmitted as the verification result of the validity of the token, and when the token is not stored in the server 10, information of "NG" is transmitted as the verification result of the validity of the token.

[0049] Here, server information, which is information to be queried when requesting verification of the validity of a token, may be encrypted and written in a known section of the computing program. The server information is, for example, the URL of the server 10 to which the verification request is queried. The URL of the server 10 to which the query is queried may be different from the URL of the server 10 from which the web application and the computing program are downloaded. In the computing program written in a low-level language, the URL for the token verification request is further written using an encrypted character string, so that the user of the terminal 20a cannot easily tamper with the URL for the token verification request.

[0050] In step S205, the CPU 21 determines whether the token verification result is OK. If the token verification result is not determined to be OK, that is, if the token verification result is determined to be NG in step S205, the CPU 21 determines that the startup of the computing program has failed. In this case, the CPU 21 displays, for example, a message on the web browser indicating that the startup of the computing program has failed. If the token verification result is NG, this means that the process for starting the computing program has started after a certain period of time has passed since the download of the computing program. In this case, there is a possibility of fraudulent use, and the startup is deemed to have failed. If the token verification result is determined to be OK in step S205, the process proceeds to step S206.

[0051] In step S206, the CPU 21 requests the server 10 to acquire the current time. After the current time is received from the server 10, the process proceeds to step S207.

[0052] In step S207, the CPU 21 determines whether the current time acquired from the server 10 is earlier than the startup restriction time. If it is not determined in step S207 that the current time acquired from the server 10 is earlier than the startup restriction time, it is determined that startup of the computing program has failed. In this case, the CPU 21 displays, for example, a message on the web browser indicating that startup of the computing program has failed. If it is determined in step S207 that the current time acquired from the server 10 is earlier than the startup restriction time, the process proceeds to step S208.

[0053] In step S208, the CPU 21 continues the processing of the calculation program and executes the calculation specified by the user, after which the processing of FIG.

[0054] Here, the checksum comparison process in steps S202-S203, the token verification process in steps S204-S205, and the comparison process between the current time and the activation restriction time in steps S206-S207 do not necessarily have to be performed in the order shown in Fig. 6. In other words, the order of the checksum comparison process in steps S202-S203, the token verification process in steps S204-S205, and the comparison process between the current time and the activation restriction time in steps S206-S207 may be changed as appropriate.

[0055] 7 is a flowchart showing the flow of processing by the server 10 after the download of the arithmetic program is completed. The processing in FIG. 7 is executed by the processor 11 of the server 10 at regular intervals after the download of the arithmetic program is completed.

[0056] In step S301, the processor 11 determines whether or not a token verification request has been received from the terminal 20a. If it is determined in step S301 that a token verification request has been received from the terminal 20a, the process proceeds to step S302. If it is not determined in step S301 that a token verification request has been received from the terminal 20a, the process proceeds to step S303.

[0057] In step S302, the processor 11 verifies the token. Then, the processor 11 transmits the token verification result to the terminal 20a. The process then proceeds to step S303. For example, the processor 11 verifies the token by determining whether a token identical to the token transmitted from the terminal 20a is stored in the storage 14. As described above, the token is deleted from the storage 14 after a certain period of time. Therefore, if a token identical to the token transmitted from the terminal 20a is not stored in the storage 14, the token verification result is NG. On the other hand, if a token identical to the token transmitted from the terminal 20a is stored in the storage 14, the token verification result is OK. Note that if the token is stored in the storage 14 in association with the identification information (e.g., MAC address) of the terminal 20a, the processor 11 may search for the identification information identical to that of the terminal 20a stored in the storage, and if the identification information is found, the processor 11 may verify the token stored in association with the identification information. This double-checks the terminal information and the token, more reliably eliminating fraudulent use.

[0058] In step S303, processor 11 determines whether a request to obtain the current time has been received. If it is determined in step S303 that a request to obtain the current time has been received, the process proceeds to step S304. If it is determined in step S303 that a request to obtain the current time has not been received, the process proceeds to step S305.

[0059] In step S304, the processor 11 acquires the current time and transmits the acquired current time to the terminal 20a. After that, the process proceeds to step S305.

[0060] In step S305, processor 11 determines whether a certain period of time, such as seven days, has passed since the generation of the token. If it is determined in step S305 that the certain period of time has passed since the generation of the token, the process proceeds to step S306. If it is not determined in step S305 that the certain period of time has passed since the generation of the token, the process in FIG. 7 ends.

[0061] In step S306, the processor 11 deletes the token stored in the storage 14. After that, the processing in FIG. 7 ends. The certain period of time until the token is deleted may be arbitrarily determined by, for example, an administrator of the server 10. Alternatively, the token may simply be invalidated without being deleted. For invalidated tokens, the result of token verification in step S302 is NG.

[0062] As described above, according to the embodiment, when a computing program that is a web application that runs on a web browser is requested, a token, a start time limit, and a checksum are attached, and then the computing program is transmitted. Because the computing program is a web application program, there is a possibility that the program code may be read on the web browser, but the token, start time limit, and checksum attached to the computing program itself prevent unauthorized use of the computing program.

[0063] In addition, in this embodiment, the token, the start time limit, and the checksum are stored in a custom section that is part of the program code of the computing program written in a low-level language. Therefore, even if the token, the start time limit, and the checksum can be read from the computing program downloaded to the terminal 20a, they are also written in machine language or a language similar to machine language. As a result, it is difficult to tamper with the token, the start time limit, and the checksum.

[0064] Furthermore, the token is stored in the server 10 for a certain period of time. Therefore, even if the token is tampered with, unauthorized use of the computing program can be prevented. Furthermore, the current time used for comparison with the activation restriction time is not the current time managed in the terminal 20a, but the current time managed in the server 10. Therefore, even if the current time managed in the terminal 20a is tampered with, unauthorized use of the computing program can be prevented. Furthermore, the checksum comparison is performed between the checksum calculated in the server 10 and a checksum newly calculated in the terminal 20a. If the computing program is tampered with, a checksum with a value different from the checksum value calculated in the server 10 will be calculated. In this way, even if the contents of, for example, a known section of the computing program are tampered with, its use can be prevented.

[0065] [Variations] Modifications of the embodiment are described below. In the embodiment, a technology for preventing unauthorized use of a computing program used by an educational web application is provided by assigning a token, a startup time limit, and a checksum to the computing program when the computing program is downloaded. However, the technology for preventing unauthorized use in the embodiment may be applied to web applications written in any low-level language other than the computing program used by the educational web application. For example, the entire web application, including not only the computing program but also the user interface, such as display and responses to user input, may be written in a low-level language, and a program written in JavaScript may simply execute a process to call the web application written in the low-level language. In this way, unauthorized use can be checked when a single web application is launched, and if unauthorized use is suspected, the web application can be prevented from launching. Furthermore, because the majority of the web application program is written in a low-level language, the confidentiality of the program's operation is enhanced.

[0066] In addition, in the embodiments, the educational web application is written in JavaScript and the calculation program is written in WebAssembly, but the description languages ​​for these program codes are also examples.

[0067] In the embodiment, the calculation program is assigned three items: a token, a start time limit, and a checksum. However, it is not necessary to assign all of the token, the start time limit, and the checksum to the calculation program; for example, only the token may be assigned to the calculation program.

[0068] The present invention is not limited to the above-described embodiments, and various modifications can be made in the implementation stage without departing from the spirit of the invention. Furthermore, the embodiments may be implemented in appropriate combinations where possible, and in such cases, the combined effects can be obtained. Furthermore, the above-described embodiments include inventions at various stages, and various inventions can be extracted by appropriately combining the disclosed multiple constituent elements. For example, if some constituent elements are deleted from all the constituent elements shown in the embodiments, and the problem stated in the "Problem to be Solved by the Invention" section can be solved and the effect stated in the "Effect of the Invention" section can be obtained, the configuration from which these constituent elements are deleted can be extracted as an invention.

[0069] The inventions described in the claims of the present application as originally filed are set forth below. [1] The Communications Department and at least one processor; The processor: In response to a request from a client, the authentication information is provided to a web application program written in a low-level language, sending the web application program to the client with the authentication information attached; receiving a request to verify the authentication information from the client in accordance with a request from the web application program when the web application program is started, and returning a result of the verification of the authentication information to the client; Web application server. [2] The web application server according to [1], wherein the processor invalidates the authentication information after a predetermined time has elapsed since the generation of the authentication information. [3] The web application server according to [1] or [2], wherein the processor generates the authentication information each time a request is received from the client. [4] The web application server according to any one of [1] to [3], wherein the low-level language is an assembly language. [5] The web application server according to [4], wherein the assembly language is an assembly language based on WebAssembly. [6] On the client's computer, Sending a request to a server to verify the validity of authentication information written in a program code written in a low-level language; If the authentication information is valid as a result of the verification from the server, continuing the processing described in the program code, and if the authentication information is invalid, stopping the execution of the processing of the program code; A web application program for running the following. [7] A web application program according to [6], wherein server information for identifying the server to which the verification request is to be sent is encrypted and written in the program code. [8] In response to a request from a client, the server transmits to the client a web application program written in a low-level language to which authentication information has been added; the client requests verification of the authentication information in response to a request from the web application program when the web application program is launched; Upon receiving the request to verify the authentication information, the server returns a result of the verification of the authentication information to the client; A web application providing method comprising: [9] The web application providing method according to [8], further comprising invalidating the authentication information after a predetermined time has elapsed since the generation of the authentication information.

[10] A method for providing a web application according to [8] or [9], wherein the authentication information is generated each time a request is made from the client.

[11] A method for providing a web application according to any one of [8] to

[10] , wherein the low-level language is an assembly language.

[12] The method for providing a web application according to

[11] , wherein the assembly language is an assembly language based on WebAssembly. [Explanation of symbols]

[0070] 1 System, 10 Server, 11 Processor, 12 ROM, 13 RAM, 14 Storage, 15 Communication Device, 19 System Bus, 20a, 20b Terminal, 21 CPU, 22 ROM, 23 RAM, 24 Storage, 25 Input Device, 26 Display Device, 27 Communication Device, 29 System Bus, 30 Network.

Claims

1. A server computer that provides web applications to clients is called a a means for receiving, from a client that executes the web application including a first program written in a predetermined script language and a second program written in at least one of a predetermined assembly language and a machine language, a request to transmit the second program when executing the web application; a means for generating, in response to the received transmission request for the second program, first authentication information for determining whether or not the second program can be started in the client, and an activation restriction time that is a time when activation of the second program is permitted; means for assigning the generated first authentication information and the activation restriction time to the second program; means for transmitting the second program to which the first authentication information and the activation restriction time have been assigned to the client; A program characterized by functioning as

2. Furthermore, the computer determining whether a request to obtain the current time has been received from the client; means for acquiring the current time when it is determined that the acquisition request has been received, and transmitting the acquired current time to the client; 2. The program according to claim 1, wherein the program functions as:

3. 2. The program according to claim 1, further comprising: the first authentication information becoming invalid after a predetermined time has elapsed since its generation.

4. the second program is written as a WebAssembly including a known section and a custom section; 2. The program of claim 1, wherein the means for assigning the generated first authentication information to the second program includes means for assigning the generated first authentication information to a custom section of the second program.

5. 2. The program according to claim 1, wherein the second program is a calculation program that executes various calculations designated by a user's operation on a web browser that executes the predetermined web application.

6. A server that provides a web application to a client, receiving a request to transmit a first program written in a predetermined script language and a second program written in at least one of a predetermined assembly language and a machine language from a client that executes the web application when executing the web application; generating first authentication information for determining whether or not the second program can be started on the client in response to the received transmission request for the second program and an activation restriction time that is a time when activation of the second program is permitted; assigning the generated first authentication information and the activation restriction time to the second program; transmitting the second program to which the first authentication information and the activation restriction time have been assigned to the client; A server comprising a control unit.

7. A method for generating authentication information for a web application executed by a server that transmits a web application to a client, comprising: a step of receiving, from a client that executes the web application including a first program written in a predetermined script language and a second program written in at least one of a predetermined assembly language and a machine language, a request to transmit the second program when executing the web application; generating, in response to the received transmission request for the second program, first authentication information for determining whether or not the second program can be started on the client, and an activation restriction time that is a time when activation of the second program is permitted; assigning the generated first authentication information and the activation restriction time to the second program; transmitting the second program to which the first authentication information has been assigned and the activation restriction time to the client; A method for generating authentication information for a web application, comprising:

Images