Token control system, token control program, and application provision system

Abstract

To provide a token control system, a token control program, and an application provision system that can quickly authorize execution of an application regardless of an increase in the amount of information included in a token.SOLUTION: A token control system 40 includes a token control section that controls a token necessary for executing an application 32. The token is key-value type data including a key as identification information of the token and values representing contents of the token. When tokens stored by a cache system 50 that stores the tokens published by a platform include a token including the key transmitted from a user terminal 90, the token control section authorizes the user terminal 90 to execute the application (S128).SELECTED DRAWING: Figure 11

Description

[Technical Field]

[0001] The present invention relates to a token control system, a token control program, and an application providing system that executes control related to tokens required for executing an application. [Background technology]

[0002] BACKGROUND ART Conventionally, a technique is known in which a computer that publishes an application issues a token to a client, and the client presents the token to use the application (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 7122402 Summary of the Invention [Problem to be solved by the invention]

[0004] However, in conventional technology, as the amount of information included in a token increases, the time required for a computer that publishes an application to verify the token to authorize a client to execute the application increases.

[0005] Therefore, an object of the present invention is to provide a token control system, a token control program, and an application providing system that can quickly grant authority to execute an application even if the amount of information contained in the token increases. [Means for solving the problem]

[0006] The token control system of the present invention comprises a token control unit that performs control regarding tokens necessary for executing applications running on a platform, the token being key-value type data that includes a key as identification information for the token and a value that indicates the entity of the token, and the token control unit is characterized in that if the token held by a token holding unit that holds the tokens issued by the platform includes the key sent by the user terminal, the token control unit grants the user terminal the authority to execute the application.

[0007] With this configuration, the token control system of the present invention grants authority to run an application to a user terminal if the token issued by the platform is key-value type data that includes a key as identification information for the token and a value that indicates the entity of the token, and if the tokens held by the token holding unit include a key sent by the user terminal, therefore, even if the amount of information contained in the token increases, authority to run an application can be granted quickly.

[0008] In the token control system of the present invention, the token may be data having a data structure in a document format.

[0009] With this configuration, the token control system of the present invention can increase the number of token verifications per unit time compared to a configuration in which tokens are managed by a database.

[0010] The token control program of the present invention causes a computer to realize a token control unit that performs control regarding tokens necessary for executing applications running on a platform, the token being key-value type data that includes a key as identification information for the token and a value that indicates the entity of the token, and the token control unit is characterized in that if the token held by a token holding unit that holds the tokens issued by the platform includes the key sent by a user terminal, the token control unit grants the user terminal the authority to execute the application.

[0011] With this configuration, a computer executing the token control program of the present invention grants the user terminal permission to execute an application if the token issued by the platform is key-value type data that includes a key as identification information for the token and a value that indicates the entity of the token, and if the tokens held by the token holding unit include the key sent by the user terminal, therefore, permission to execute an application can be granted quickly even if the amount of information contained in the token increases.

[0012] The application provision system of the present invention comprises a platform, an application running on the platform, a token control unit that controls tokens required to execute the application, and a token holding unit that holds the tokens issued by the platform, wherein the tokens are key-value type data that include a key as identification information for the token and a value that indicates the entity of the token, and the token control unit grants the user terminal the authority to execute the application if the tokens held by the token holding unit include the key sent by the user terminal.

[0013] With this configuration, the application provision system of the present invention grants authority for application execution to a user terminal if the token issued by the platform is key-value type data that includes a key as identification information for the token and a value that indicates the entity of the token, and if the tokens held by the token holding unit include a key sent by the user terminal, therefore, even if the amount of information contained in the token increases, authority for application execution can be granted quickly.

[0014] In the application providing system of the present invention, the token holding unit may be a RAM.

[0015] With this configuration, the application providing system of the present invention can quickly authorize the authority to execute an application because the token is stored in RAM that can be accessed quickly.

[0016] The application provision system of the present invention may include a database separate from the token holding unit for managing information used by the application and the platform, and the application may obtain the entity of the token held by the token holding unit.

[0017] With this configuration, the application provision system of the present invention allows the application to obtain the entity of the token held by a token holding unit that is provided separately from the database for managing information used by the application and platform, thereby reducing the possibility of placing a load on the database for managing information used by the application and platform when authorizing permission to execute the application. [Effects of the Invention]

[0018] The token control system, token control program, and application providing system of the present invention can quickly authorize application execution authority even if the amount of information included in a token increases. [Brief explanation of the drawings]

[0019] [Figure 1] 1 is a block diagram of an information processing system according to an embodiment of the present invention. [Figure 2] FIG. 2 is a block diagram of the application providing system shown in FIG. [Figure 3] 2. (a) is a diagram showing an example of a tenant management table shown in Fig. 2. (b) is a diagram showing an example of a user management table shown in Fig. 2. (c) is a diagram showing an example of a role management table shown in Fig. 2. [Figure 4] FIG. 3 is a block diagram of an example of the token control system shown in FIG. 2 when configured with one computer. [Figure 5] FIG. 3 is a block diagram of an example of the cache system shown in FIG. 2 when configured with one computer. [Figure 6] FIG. 6 is a block diagram of a control unit shown in FIG. 5. [Figure 7] FIG. 7 is a diagram illustrating an example of a token illustrated in FIG. 6. [Figure 8] 2 is a block diagram of an example of the user terminal shown in FIG. 1 when configured by a PC. [Figure 9] FIG. 9 is a block diagram of a control unit shown in FIG. 8. [Figure 10] 2 is a sequence diagram of the operation of the information processing system shown in FIG. 1 when a user logs in to the application providing system. [Figure 11] 2 is a sequence diagram of the operation of the information processing system shown in FIG. 1 when a user uses an application. [Figure 12] 1 when an application acquires the entity of a token. FIG. DETAILED DESCRIPTION OF THE INVENTION

[0020] Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[0021] First, the configuration of an information processing system according to an embodiment of the present invention will be described.

[0022] FIG. 1 is a block diagram of an information processing system 10 according to the present embodiment.

[0023] As shown in Fig. 1, an information processing system 10 includes an application providing system 20 that provides applications used by users. The application providing system 20 is configured with multiple computers. The application providing system 20 may be implemented on-premise or via the cloud.

[0024] The information processing system 10 includes a user terminal 90 used by a user. The information processing system 10 may include at least one other user terminal having a similar configuration to the user terminal 90. The user terminal may be configured, for example, by a PC (Personal Computer).

[0025] The user terminal and the application providing system 20 can communicate with each other via a network 11 such as a LAN (Local Area Network) or the Internet.

[0026] FIG. 2 is a block diagram of the application providing system 20. As shown in FIG.

[0027] 2, the application providing system 20 includes an application execution system 30 that executes applications used by users, a token control system 40 that controls tokens required to execute the applications, and a cache system 50 that stores the tokens. Each of the application execution system 30, the token control system 40, and the cache system 50 may be configured by a single computer such as a PC, or may be configured by multiple computers.

[0028] Hereinafter, the URL (Uniform Resource Locator) for accessing the token control system 40 is assumed to be "https: / / example.com / auth".

[0029] The application execution system 30 includes a platform 31 for executing applications used by users.

[0030] The application execution system 30 includes an application 32 that is executed on the platform 31 and used by a user. The application execution system 30 can include at least one other application other than the application 32 that is executed on the platform 31 and used by a user.

[0031] The application execution system 30 includes a platform 31 and a database 33 for managing information used by the application 32 .

[0032] The database 33 includes a tenant management table 33a for managing the tenants to which the users belong, a user management table 33b for managing the users, and a role management table 33c for managing the roles that may be granted to the users.

[0033] Fig. 3(a) is a diagram showing an example of a tenant management table 33a, Fig. 3(b) is a diagram showing an example of a user management table 33b, and Fig. 3(c) is a diagram showing an example of a role management table 33c.

[0034] Tenants are assigned a tenant ID as identification information within the database 33. Users are assigned a user ID as identification information within the database 33. Roles are assigned a role ID as identification information within the database 33. Role IDs are expressed in hexadecimal.

[0035] The tenant management table 33a shown in Fig. 3(a) includes, for each tenant, a tenant ID, a tenant name as the name of the tenant, and a user ID for each user belonging to the tenant, in association with each other. Some information is omitted from the tenant management table 33a shown in Fig. 3(a).

[0036] The user management table 33b shown in Fig. 3(b) includes, for each user, a user ID, a user name as the user's name, a user password, a display name of the user on a screen provided by the application providing system 20, an email address of the user, and a role ID of a role assigned to the user, all associated with that user. Some information is omitted from the user management table 33b shown in Fig. 3(b).

[0037] The role management table 33c shown in Fig. 3(c) includes a role ID and a role name as the name of the role, in association with each role. The role management table 33c shown in Fig. 3(c) is drawn with some information omitted.

[0038] In the user management table 33b shown in Fig. 3(b), the role ID of a role assigned to a user is represented by the sum of the role IDs of all roles assigned to the user. For example, "0x1001" is the sum of "0x0001" and "0x1000." Therefore, a user assigned the role ID "0x1001" in the user management table 33b shown in Fig. 3(b) is a user assigned two roles: a general user associated with the role ID "0x0001" in the role management table 33c shown in Fig. 3(c), and an administrator associated with the role ID "0x1000" in the role management table 33c shown in Fig. 3(c).

[0039] FIG. 4 is a block diagram of an example of a token control system 40 configured by a single computer.

[0040] As shown in Figure 4, the token control system 40 includes an operation unit 41, which is an operation device such as a keyboard or mouse through which various operations are input; a display unit 42, which is a display device such as an LCD (Liquid Crystal Display) that displays various information; a communication unit 43, which is a communication device that communicates with external devices via a network such as a LAN or the Internet, or directly via a wired or wireless connection without using a network; a memory unit 44, which is a non-volatile memory device such as a semiconductor memory or an HDD (Hard Disk Drive) that stores various information; and a control unit 45 that controls the entire token control system 40.

[0041] The storage unit 44 can store a token control program 44a for executing control related to the token. The token control program 44a may be installed in the token control system 40 during the manufacturing stage of the token control system 40, or may be additionally installed in the token control system 40 from an external storage medium such as a USB (Universal Serial Bus) memory, or may be additionally installed in the token control system 40 from a network.

[0042] The control unit 45 includes, for example, a CPU (Central Processing Unit), a ROM (Read Only Memory) that stores programs and various data, and a RAM (Random Access Memory) that serves as a memory used as a work area for the CPU of the control unit 45. The CPU of the control unit 45 executes programs stored in the storage unit 44 or the ROM of the control unit 45.

[0043] The control unit 45 executes the token control program 44a to implement a token control unit 45a that executes control related to tokens.

[0044] FIG. 5 is a block diagram of an example of a cache system 50 configured by a single computer.

[0045] As shown in Figure 5, the cache system 50 includes an operation unit 51, which is an operation device such as a keyboard or mouse through which various operations are input; a display unit 52, which is a display device such as an LCD that displays various information; a communication unit 53, which is a communication device that communicates with external devices via a network such as a LAN or the Internet, or directly via a wired or wireless connection without using a network; a memory unit 54, which is a non-volatile memory device such as a semiconductor memory or HDD that stores various information; and a control unit 55 that controls the entire cache system 50.

[0046] The storage unit 54 can store a token management program 54a for managing tokens. The token management program 54a may be installed in the cache system 50 during the manufacturing stage of the cache system 50, or may be additionally installed in the cache system 50 from an external storage medium such as a USB memory, or may be additionally installed in the cache system 50 from a network.

[0047] FIG. 6 is a block diagram of the control unit 55.

[0048] 6, the control unit 55 includes, for example, a CPU 56, a ROM 57 that stores programs and various data, and a RAM 58 that serves as a memory used as a work area for the CPU 56. The CPU 56 executes programs stored in the storage unit 54 (see FIG. 5) or the ROM 57.

[0049] The RAM 58 can store the token 58a. The RAM 58 can store tokens having the same configuration as the token 58a in addition to the token 58a. The RAM 58 constitutes a token storage unit that stores the tokens.

[0050] FIG. 7 is a diagram showing an example of the token 58a.

[0051] As shown in FIG. 7, token 58a is data having a data structure in a document format such as a key-value HTML (HyperText Markup Language) format that includes a key as identification information of the token and a value that indicates the entity of the token.

[0052] 7 includes the tenant name of the tenant to which the user belongs, the user name of the user, and the role ID of the role assigned to the user. The type of information included in the value is up to the design.

[0053] As shown in FIG. 5, the control unit 55 executes a token management program 54a to implement a token management unit 55a that manages tokens.

[0054] FIG. 8 is a block diagram of an example of a user terminal 90 when configured as a PC.

[0055] As shown in Figure 8, the user terminal 90 includes an operation unit 91, which is an operation device such as a keyboard or mouse through which various operations are input; a display unit 92, which is a display device such as an LCD that displays various information; a communication unit 93, which is a communication device that communicates with external devices via a network such as a LAN or the Internet, or directly via a wired or wireless connection without using a network; a memory unit 94, which is a non-volatile memory device such as a semiconductor memory or HDD that stores various information; and a control unit 95 that controls the entire user terminal 90.

[0056] The storage unit 94 can store an application usage program 94a for using an application provided by the application providing system 20. The application usage program 94a may be installed in the user terminal 90, for example, during the manufacturing stage of the user terminal 90, or may be additionally installed in the user terminal 90 from an external storage medium such as a USB memory, or may be additionally installed in the user terminal 90 from a network.

[0057] FIG. 9 is a block diagram of the control unit 95.

[0058] 9, the control unit 95 includes, for example, a CPU 96, a ROM 97 that stores programs and various data, and a RAM 98 that serves as a memory used as a work area for the CPU 96. The CPU 96 executes programs stored in the storage unit 94 (see FIG. 8) or the ROM 97.

[0059] The RAM 98 can store a token 98a, which has the same configuration as the token 58a (see FIG. 7).

[0060] 8, the control unit 95 executes the application usage program 94a to implement an application usage unit 95a that uses an application provided by the application providing system 20. The application usage unit 95a knows the URL for accessing the token control system 40.

[0061] Next, the operation of the information processing system 10 will be described.

[0062] First, the operation of the information processing system 10 when a user logs in to the application providing system 20 will be described.

[0063] FIG. 10 is a sequence diagram of the operation of the information processing system 10 when a user logs in to the application providing system 20. As shown in FIG.

[0064] The user can input a combination of his / her own user name and password into the user terminal 90 via the operation unit 91 to instruct the user terminal 90 to log in to the application providing system 20 .

[0065] When instructed to log in to the application providing system 20, the application utilization unit 95a of the user terminal 90 uses "https: / / example.com / auth" as the URL for accessing the token control system 40 to send a request for connection to the application providing system 20 (hereinafter referred to as "connection request") to the token control system 40 (S101), as shown in Fig. 10. The application utilization unit 95a includes the combination of the user name and password entered via the operation unit 91 in the connection request in S101.

[0066] Upon receiving the connection request transmitted in S101, the token control unit 45a of the token control system 40 transfers the received connection request to the platform 31 (S102).

[0067] When the platform 31 receives the connection request transferred in S102, it requests the password associated with the user name included in the received connection request from the database 33 (S103). Therefore, the database 33 checks the password associated with the user name included in the request in S103 in the user management table 33b.

[0068] If the password requested in S103 does not exist, the database 33 transmits a notice to the effect that the password requested in S103 does not exist (hereinafter referred to as a "password non-existence notice") to the platform 31 (S104).

[0069] If the password requested in S103 exists, the database 33 transmits the password requested in S103 to the platform 31 (S105).

[0070] When the platform 31 receives the password sent in S105, it determines whether the password included in the connection request matches the password received from the database 33 (S106).

[0071] When the platform 31 receives the password non-existence notification sent in S104, or determines in S106 that the password included in the connection request does not match the password received from the database 33, it notifies the user terminal 90 of authentication failure (S107).

[0072] When the application use unit 95a of the user terminal 90 receives the notification in S107, it displays the authentication failure on the display unit 91 (S108).

[0073] If the platform 31 determines in S106 that the password included in the connection request matches the password received from the database 33, it requests information associated with the user name included in the connection request from the database 33 (S109). For example, the platform 31 requests the database 33 for the tenant name and role ID associated with the user name included in the connection request. When the tenant name and role ID associated with the user name included in the connection request are requested, the database 33 checks the tenant name associated in the tenant management table 33a with the user ID associated in the user management table 33b with the user name included in the request in S109, and the role ID associated in the user management table 33b with the user name included in the request in S109.

[0074] Upon receiving the request in S109, the database 33 transmits the information requested in S109 to the platform 31 (S110).

[0075] Upon receiving the information transmitted in S110, the platform 31 issues a token corresponding to the user terminal 90 based on the received information (S111). In S111, the platform 31 generates a key for the token.

[0076] When the process of S111 is completed, the platform 31 transmits the token issued in S111 to the cash system 50 (S112).

[0077] Upon receiving the token transmitted in S112, the token management unit 55a of the cache system 50 stores the received token in the RAM 58 (S113).

[0078] When the processing of S112 is completed, the platform 31 transmits the token issued in S111 to the user terminal 90 (S114). The transmission in S114 may be performed via the token control system 40. The token transmitted to the user terminal 90 may be encrypted by the token control system 40, for example.

[0079] When the application use unit 95a of the user terminal 90 receives the token transmitted in S114, it stores the received token in the RAM 98 (S115).

[0080] Next, the operation of the information processing system 10 when a user uses the application 32 will be described.

[0081] FIG. 11 is a sequence diagram of the operation of the information processing system 10 when a user uses the application 32.

[0082] When the user has already logged in to the application providing system 20, the user can instruct the user terminal 90 via the operation unit 91 to use the application 32.

[0083] When instructed to use the application 32, the application use unit 95a of the user terminal 90 uses "https: / / example.com / auth / app1", which is a URL for accessing the token control system 40 with "https: / / example.com / auth" and an additional "app1" indicating the application 32 added, for example, as shown in Fig. 11, to transmit a processing request for the application 32 (hereinafter referred to as a "processing request") to the token control system 40 (S121). The application use unit 95a sets the key in the token stored in the RAM 98 in S115 in the HTTP (Hyper Text Transfer Protocol) header of the processing request to be transmitted in S121. In the processing request in S121, the key in the token may be encrypted.

[0084] When the token control unit 45a of the token control system 40 receives the processing request transmitted in S121, it inquires of the cache system 50 whether or not a token corresponding to the key included in the received processing request is held in the cache system 50 (S122). If the key is encrypted in the processing request, the token control unit 45a decrypts the key.

[0085] When the token management unit 55a of the cache system 50 receives the inquiry in S122, it determines whether or not a token corresponding to the key included in the processing request is held in the RAM 58 (S123). Because the token is held in the RAM 58 as a key-value type, the processing time required for the token management unit 55a to search for the token is O(1).

[0086] When the process of S123 is completed, the token manager 55a notifies the token control system 40 of the result of the determination made in S123 (S124).

[0087] When the token control unit 45a of the token control system 40 receives the notification in S124, if the result of the judgment notified in S124 is not that the token corresponding to the key included in the processing request is held, the token control unit 45a discards the processing request (S125).

[0088] When the process of S125 is completed, the token control unit 45a notifies the user terminal 90 of the authentication failure (S126).

[0089] When the application use unit 95a of the user terminal 90 receives the notification in S126, it displays the authentication failure on the display unit 91 (S127).

[0090] When the token control unit 45a of the token control system 40 receives the notification in S124 and the result of the determination notified in S124 is that the token corresponding to the key included in the processing request is held, the token control unit 45a transfers the processing request to the application 32 that is the target of the processing request (S128). That is, the token control unit 45a authorizes the user terminal 90 to execute the application 32.

[0091] When the application 32 receives the processing request transferred in S128, it executes processing according to the received processing request (S129).

[0092] Next, the operation of the information processing system 10 when the application 32 acquires the entity of the token will be described.

[0093] FIG. 12 is a sequence diagram of the operation of the information processing system 10 when the application 32 acquires the entity of the token.

[0094] When the application 32 needs to acquire the entity of the token, such as the tenant ID of the tenant to which the user belongs or the role of the user, during the execution of processing, the application 32 requests the entity of the token from the platform 31 (S141), as shown in Fig. 12. The application 32 includes the key included in the processing request in the request in S141.

[0095] When the platform 31 receives the request in S141, it requests the entity of the token requested in S141 from the cache system 50 (S142). The platform 31 includes the key included in the request in S141 in the request in S142.

[0096] Upon receiving the request in S142, the token management unit 55a of the cache system 50 transmits to the platform 31, from among the tokens held in the RAM 58, a token corresponding to the key included in the request in S142 (S143).

[0097] Upon receiving the token transmitted in S143, the platform 31 passes the received token to the application 32 (S144).

[0098] As described above, the token control system 40 recognizes that the token issued by the platform 31 is key-value type data that includes a key as identification information for the token and a value that indicates the entity of the token, and if there is a token held in the RAM 58 of the cache system 50 that includes the key sent by the user terminal 90, the token control system 40 grants the user terminal 90 permission to execute the application 32 (S128).Therefore, even if the amount of information contained in the token increases, the permission to execute the application 32 can be granted quickly.

[0099] A database generally has a set upper limit on the number of connections per unit time. However, in the token control system 40, since tokens are data having a document-type data structure, the number of token verifications per unit time can be increased compared to a configuration in which tokens are managed by a database.

[0100] In addition, in the token control system 40, tokens may be managed by a database.

[0101] Since the application providing system 20 stores the token in RAM 58, which is accessible at high speed, the speed of access to the token can be improved compared to when the token is stored in a storage device other than RAM, such as an HDD, and as a result, the authority to execute the application 32 can be granted quickly.

[0102] In the application providing system 20, the token may be stored in a storage device other than the RAM.

[0103] In the application providing system 20, the application 32 obtains the entity of the token held in the RAM 58 of the cache system 50, which is provided separately from the database 33 for managing information used by the platform 31 and the application 32 (S141 to S144), so that when authorization to execute the application 32 is granted, the possibility of placing a load on the database 33 for managing information used by the platform 31 and the application 32 can be reduced.

[0104] In the above, the cache system 50 is realized by a computer different from both the application execution system 30 and the token control system 40. However, the cache system 50 may be realized by a computer common to either the application execution system 30 or the token control system 40. However, since the number of tokens held by the cache system 50 increases as the number of user terminals increases, the performance of the cache system 50, such as its storage capacity, needs to be improved as the number of user terminals increases. Therefore, it is preferable that the cache system 50 be realized by a computer different from both the application execution system 30 and the token control system 40. [Explanation of symbols]

[0105] 20 Application provision system 31 Platform 32 Applications 33 Databases 40 Token Control System (Computer) 44a Token Control Program 45a Token control section 58 RAM (token storage unit) 58a Token 90 user terminals 98a Token

Claims

1. a token control unit that controls tokens required for executing applications that run on the platform; The token is key-value type data including a key as identification information of the token and a value indicating the entity of the token, A token control system characterized in that the token control unit grants the user terminal the authority to execute the application if the token held by a token holding unit that holds the tokens issued by the platform contains the key sent by the user terminal.

2. 2. The token control system according to claim 1, wherein the token is data having a data structure in a document format.

3. A token control unit that controls tokens required for executing applications that run on the platform is implemented in a computer; The token is key-value type data including a key as identification information of the token and a value indicating the entity of the token, A token control program characterized in that the token control unit grants the user terminal the authority to execute the application when the token held by a token holding unit that holds the tokens issued by the platform contains the key sent by the user terminal.

4. Platform and an application that runs on the platform; a token control unit that controls tokens required for executing the application; a token holder that holds the tokens issued by the platform; Equipped with The token is key-value type data including a key as identification information of the token and a value indicating the entity of the token, An application provision system characterized in that the token control unit grants the user terminal the authority to execute the application when the tokens held by the token holding unit include the key sent by the user terminal.

5. 5. The application providing system according to claim 4, wherein the token holding unit is a RAM.

6. a database for managing information used by the application and the platform, separate from the token holding unit; 5. The application providing system according to claim 4, wherein the application acquires the entity of the token held by the token holding unit.

Images