EAI flow setting / execution system, EAI flow setting / execution method, and EAI flow setting / execution program

Abstract

To provide an EAI flow setting / execution system capable of safely handling confidential information by mounting a function for encrypting and managing the confidential information.SOLUTION: A database that stores an encryption arbitrary data setting system definition and an EAI flow, the encryption arbitrary data setting system definition including a variable name, a variable value, and an encryption flag that specifies whether the variable value is encrypted, the EAI flow including a task that refers to one or more encryption arbitrary data setting system definitions; When the task refers to the encrypted arbitrary data setting system definition at the time of execution of the EAI flow, if the task is an external system cooperation system task with an arbitrary execution parameter and the encryption flag of the referred encrypted arbitrary data setting system definition = encrypted, the execution means decrypts the variable value on the memory and performs external system cooperation using the decrypted variable value as an arbitrary execution parameter.SELECTED DRAWING: Figure 18

Description

[Technical Field]

[0001] The present invention relates to an EAI flow setting and execution system, an EAI flow setting and execution method, and an EAI flow setting and execution program. [Background technology]

[0002] Conventionally, an EAI (Enterprise Application Integration) system is disclosed in, for example, Patent Document 1. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2006-34112 Summary of the Invention [Problem to be solved by the invention]

[0004] However, in the above-mentioned Patent Document 1, a function for managing confidential information by encryption is not implemented in the system, and therefore confidential information cannot be handled safely.

[0005] The present invention has been made in consideration of the above, and aims to provide an EAI flow setting and execution system, an EAI flow setting and execution method, and an EAI flow setting and execution program that are equipped with a function for cryptographically managing confidential information and are capable of safely handling confidential information. [Means for solving the problem]

[0006] In order to solve the above-mentioned problems and achieve the object, the present invention provides an EAI flow setting and execution system having a control unit, wherein the control unit is configured to be able to access a database that stores encrypted optional data setting system definitions including variable names, variable values, and encryption flags that specify whether or not the variable values ​​are encrypted, and EAI flows including tasks that reference one or more encrypted optional data setting system definitions, and the control unit is equipped with an execution means that executes the EAI flow, wherein, when the EAI flow is executed, if a task references an encrypted optional data setting system definition, and if the task is an external system integration task with optional execution parameters, and the encryption flag of the referenced encrypted optional data setting system definition = encrypted, the execution means decrypts the variable value in memory and uses the decrypted variable value as an optional execution parameter to perform external system integration.

[0007] According to one aspect of the present invention, the control unit further includes a setting means for creating the encrypted arbitrary data setting system definition and the EAI flow in response to an operator's operation on a setting screen and storing them in the database, and when the check state of the encryption flag of the encrypted arbitrary data setting system definition is turned ON on the setting screen, the setting means may display the variable values ​​in a masked state so that they cannot be viewed, and encrypt the variable values.

[0008] According to another aspect of the present invention, the setting unit may control the encryption flag of an encryption arbitrary data setting definition so that the checked state of the encryption flag cannot be released once the definition has been set.

[0009] Furthermore, according to one aspect of the present invention, if the task is not an external system linkage task with optional execution parameters, the execution means may not decrypt the variable value of the encrypted optional data setting system definition, but may adopt it as a variable as is, and execute the task using the adopted variable.

[0010] Furthermore, according to one aspect of the present invention, when the EAI flow is debugged, the execution means may be configured to be able to query undecrypted variable values ​​for the encrypted arbitrary data setting system definition referenced by the task.

[0011] Furthermore, according to one aspect of the present invention, when a task of an EAI flow is to output a specification and the task includes an encrypted arbitrary data setting system definition, the execution means may output the undecrypted variable values ​​of the encrypted arbitrary data setting system definition as they are.

[0012] Furthermore, according to one aspect of the present invention, the encrypted arbitrary data setting system definition may include a common variable definition common to all EAI flows, or a variable definition used individually for each EAI flow.

[0013] Furthermore, according to one aspect of the present invention, the external system integration task with optional execution parameters may include an EXE file execution task, a DLL file call task, a REST API execution task, or a stored procedure execution task.

[0014] According to another aspect of the present invention, the variable value may include a login ID or a login password.

[0015] In addition, in order to solve the above-mentioned problems and achieve the object, the present invention provides an EAI flow setting and execution method executed by an information processing device having a control unit, wherein the control unit is configured to be able to access a database that stores an encrypted arbitrary data setting system definition including a variable name, a variable value, and an encryption flag that specifies whether or not the variable value is encrypted, and an EAI flow including a task that references one or more encrypted arbitrary data setting system definitions, and the execution step is executed by the control unit, and in the execution step, if a task references an encrypted arbitrary data setting system definition when the task is an external system linkage task with an optional execution parameter, and the encryption flag of the referenced encrypted arbitrary data setting system definition = encrypted, the variable value is decrypted in memory, and the decrypted variable value is used as an optional execution parameter to perform external system linkage.

[0016] In addition, in order to solve the above-mentioned problems and achieve the object, the present invention provides an EAI flow setting and execution program to be executed by an information processing device having a control unit, wherein the control unit is configured to be able to access a database that stores an encrypted arbitrary data setting system definition including a variable name, a variable value, and an encryption flag that specifies whether or not the variable value is encrypted, and an EAI flow including a task that references one or more encrypted arbitrary data setting system definitions, and the EAI flow setting and execution program causes the control unit to execute an execution step that executes the EAI flow, wherein in the execution step, when the EAI flow is executed, if a task references an encrypted arbitrary data setting system definition, and the task is an external system integration task with an optional execution parameter, and if the encryption flag of the referenced encrypted arbitrary data setting system definition = encrypted, the variable value is decrypted in memory, and the decrypted variable value is used as an optional execution parameter to perform external system integration. [Effects of the Invention]

[0017] According to the present invention, it is possible to provide an EAI flow setting and execution system that is equipped with a function for encrypting and managing confidential information and is capable of safely handling confidential information. [Brief explanation of the drawings]

[0018] [Figure 1] FIG. 1 is a diagram for explaining the premise of the present invention (regarding a process flow setting tool in EAI). [Figure 2] FIG. 2 is a diagram for explaining the premise of the present invention (regarding a process flow setting tool in EAI). [Figure 3] FIG. 3 is a diagram for explaining the background of the present invention. [Figure 4] FIG. 4 is a diagram for explaining the background of the present invention. [Figure 5] FIG. 5 is a diagram for explaining the outline of the contents of the present invention. [Figure 6] FIG. 6 is a diagram for explaining the outline of the contents of the present invention. [Figure 7] FIG. 7 is a diagram for explaining the details of the process flow setting tool. [Figure 8] FIG. 8 is a diagram for explaining the details of the process flow setting tool. [Figure 9] FIG. 9 is a diagram for explaining the details of the process flow setting tool. [Figure 10] FIG. 10 is a diagram for explaining the details of the process flow setting tool. [Figure 11] FIG. 11 is a diagram for explaining the details of the process flow setting tool. [Figure 12] FIG. 12 is a diagram for explaining the details of the process flow setting tool. [Figure 13] FIG. 13 is a diagram for explaining the conventional specifications and their problems. [Figure 14] FIG. 14 is a diagram for explaining the conventional specifications and their problems. [Figure 15] FIG. 15 is a diagram for explaining the conventional specifications and their problems. [Figure 16] FIG. 16 is a diagram for explaining the conventional specifications and their problems. [Figure 17] FIG. 17 is a diagram for explaining the scope of application of the present invention. [Figure 18] FIG. 18 is a block diagram showing an example of the configuration of an EAI flow setting and execution system according to this embodiment. [Figure 19] FIG. 19 is a diagram for explaining a specific example of the processing of the EAI flow setting and execution system according to this embodiment. [Figure 20] FIG. 20 is a diagram for explaining a specific example of the processing of the EAI flow setting and execution system according to this embodiment. [Figure 21] FIG. 21 is a diagram for explaining a specific example of the processing of the EAI flow setting and execution system according to this embodiment. [Figure 22] FIG. 22 is a diagram for explaining a specific example of the processing of the EAI flow setting and execution system according to this embodiment. [Figure 23] FIG. 23 is a diagram for explaining a specific example of the processing of the EAI flow setting and execution system according to this embodiment. [Figure 24] FIG. 24 is a diagram for explaining a specific example of the processing of the EAI flow setting and execution system according to this embodiment. [Figure 25] FIG. 25 is a diagram for explaining a specific example of the processing of the EAI flow setting and execution system according to this embodiment. [Figure 26A] FIG. 26A is a diagram for explaining a specific example of the processing of the EAI flow setting and execution system according to this embodiment. [Figure 26B] FIG. 26B is a diagram for explaining a specific example of the processing of the EAI flow setting and execution system according to this embodiment. [Figure 27] FIG. 27 is a diagram for explaining a specific example of the processing of the EAI flow setting and execution system according to this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0019] Hereinafter, embodiments of an EAI flow setting and execution system, an EAI flow setting and execution method, and an EAI flow setting and execution program according to the present invention will be described in detail with reference to the accompanying drawings. However, the present invention is not limited to these embodiments.

[0020] [1. Overview] The overview of this invention will be explained in the following order: [1-1. Features of the invention], [1-2. Premise (regarding processing flow setting tools in EAI)], [1-3. Background], [1-4. Outline of the invention's contents], [1-5. Details of the processing flow setting tool], [1-6. Conventional specifications and their issues], and [1-7. Scope of application of this invention].

[0021] [1-1. Features of the present invention] Conventional EAI flow setting and execution systems did not have a function for managing confidential information in an encrypted form, so confidential information had to be encrypted using an external tool and then decrypted in the external program at the linked site.

[0022] This invention provides a mechanism for managing confidential information as encrypted variables in an EAI flow setting and execution system. Specifically, an encryption function is implemented in the variable settings, and the variable information is referenced and set on the various function and processing tasks side.

[0023] This invention can prevent confidential information from being leaked due to UI operations or database access in the EAI flow setting and execution system. It also enables the division of roles between confidential information setting and flow setting, limiting the number of members who have access to confidential customer information. It also prevents unauthorized operations and setting changes aimed at obtaining confidential information.

[0024] [1-2. Prerequisites (About the process flow setting tool in EAI)] The premise of the present invention (regarding a process flow setting tool in EAI) will be described with reference to FIGS.

[0025] (definition) Figure 1 shows an example of an EAI processing flow (hereinafter simply referred to as "flow"). EAI (Enterprise Application Integration) is defined as an approach and technology for integrating different information systems and applications so that they can work together effectively.

[0026] As shown in Figure 1, a series of system interaction processes is defined as a "flow," and a system processing function unit is defined as a "task." In EAI, tasks are defined as flows that link multiple tasks together to execute a series of interaction processes.

[0027] (Flow task settings) Figure 2 shows an example of how flow settings are registered and executed. Tasks are linked in order using GUI operations, allowing system integration processing to be defined without programming. Tasks are divided into "data setting tasks" that set data that can be referenced by subsequent tasks, and "processing execution tasks" that perform the actual processing. "Processing execution tasks" are further classified into four types: "file operation tasks," "data import tasks," "data output tasks," and "external system integration tasks."

[0028] As shown in Figure 2, you set the flow (e.g., variable definition task, EXE execution task) on the Flow Designer screen, set the task contents on the Task Settings screen, convert the flow to binary, and register it in the Flow Setting Master. The Flow Setting Master stores the task type, setting values, etc. There is an execution program corresponding to the task type. Binary data can generally be decoded. The flow execution program obtains the flow from the Flow Setting Master by binary decoding, and executes the flow.

[0029] [1-3. Background] The background will be explained with reference to Figures 3 and 4. In tasks related to external system integration, it is expected that confidential customer information, such as user IDs and passwords for authentication, will be set as execution parameters. It is desirable to properly encrypt confidential information and manage it so that it cannot be viewed or obtained through screen operations or database access. When confidential information items required for integration, such as database connection or email sending, are fixed, a dedicated settings screen is set up and the encryption function is implemented there.

[0030] On the other hand, it is not possible to create a dedicated setting screen for tasks that have different execution parameter items that handle confidential information depending on the specifications of the partner, such as executing an EXE file. Furthermore, due to the system's usage authority control, only the system installer (or multiple people) and the system administrator of the client company can view and edit the flow setting information. In this invention, the problem is a situation in which a system installer who should not know confidential information can obtain the confidential information after decryption.

[0031] Figure 3 is a diagram to explain the characters. In Figure 3, the "confidential information setting person" is one of the system implementation staff (or the customer system administrator). He is in charge of setting up confidential information and knows the customer's confidential information. The "flow setting person" is one of the system implementation staff. He is in charge of setting up the flow and does not have the right to know the customer's confidential information.

[0032] FIG. 4 is a diagram for explaining the use of character strings (confidential information) used in the following embodiments. "loginid" is the login ID (confidential information) when the EXE is executed. "B78FJKB334" is the encrypted login ID. "password" is the login password (confidential information) when the EXE is executed. "K90JH8OK8G" is the encrypted login password. Below, we will explain how to safely manage the confidential information "loginid" and "password."

[0033] [1-4. Summary of the invention] The contents of the invention will be outlined with reference to FIGS.

[0034] (Encryption implementation) An encryption function is implemented in the common variable definition and variable definition task, which can set arbitrary data. This makes it possible to divide the roles between the confidential information setter and the flow setter. Once the confidential information setter sets the confidential information, the flow setter can create and modify flows simply by referencing the variables. Since it can be referenced in a 1:1 correspondence with each item in the execution parameters, it is possible to flexibly respond to the specifications of the linked system.

[0035] Figure 5 is a diagram to explain the remaining issues when implementing encryption functions in the common variable definition and variable definition tasks. Some standard functions still leave the issue of confidential information being able to be obtained after decryption.

[0036] As shown in Figure 5, Example 1: When outputting as text in an output task, or Example 2: When checking intermediate data using the debug execution function, the flow designer can view the decrypted confidential information.

[0037] On the other hand, if a decryption function is not implemented to prevent confidential information from being obtained after decryption, and decryption is performed outside the EAI processing flow, tasks that depend on the method of calling existing programs cannot be used. If it is not possible to implement a decryption function in an application of a standard product from another company, encrypted confidential information cannot be executed even if it is passed. For this reason, it is necessary to distinguish between "tasks in which the value of an encrypted variable is used in an encrypted state" and "tasks in which the value is used in a decrypted state."

[0038] (Decryption implementation) Implement a mechanism to determine whether the decryption function can be used within the execution program depending on the type of referencing task. The conditions are that the task has "undefined execution parameters" and "expected operation in which confidential information is set in the execution parameters." Even if an encrypted variable is referenced in a task that cannot use the decryption function, it will be used in ciphertext. In tasks that can use the decryption function, confidential information that is encrypted and managed on the settings screen and database can be used in plaintext only during execution (integration is possible regardless of the other party's specifications).

[0039] Fig. 6 is a diagram for explaining tasks that cannot be decrypted and tasks that can be decrypted. In Fig. 6, tasks that cannot be decrypted are, for example, output-related tasks such as text output tasks, and since output-related tasks do not have a decryption function implemented, confidential information is output in its encrypted form.

[0040] A task that can be decrypted is, for example, an EXE execution task, and the execution argument is set to "decrypt and replace encrypted variables", making the confidential information available in plain text.

[0041] [1-5. Processing flow setting tool details] The process flow setting tool will be described in detail with reference to FIGS.

[0042] (Tasks / Functions) <Data setting system> Figure 7 is a diagram explaining the tasks and functions of the data setting system. The tasks and functions of the data setting system set data that is referenced and used by various tasks in the flow. It can be referenced from multiple tasks.

[0043] The "Common Variable Definition Settings" has the following processing content: "A task that sets arbitrary data that can be referenced by tasks in multiple flows," the called task is "All processing execution tasks," the setting item is "Undefined," and the encryption is "Optional." The "Variable Definition Task" has the following processing content: "A task that sets arbitrary data that can be referenced by subsequent tasks in the same flow," the called task is "All processing execution tasks," the setting item is "Undefined," and the encryption is "Optional."

[0044] The settings for "Database connection settings," "FTP connection settings," and "Email sending settings" are "fixed" and encryption is "required." If the setting items are "fixed" and encryption is "required," encryption and decryption processing is naturally required during setup and execution. For this reason, a dedicated settings screen is provided to implement the encryption function, so there is no need for conditional branching based on the setting content or reference source task. Therefore, this is outside the scope of this invention.

[0045] <Processing execution system> (1) File operations Figure 8 is a diagram for explaining file operation tasks. File operation tasks are tasks that perform specified file operations (excluding data import and output tasks). For file operation tasks, decryption of encrypted variables is "unavailable."

[0046] (2) Data import system Figure 9 is a diagram for explaining data import tasks. Data import tasks import data from files or databases and create data sources that can be used by subsequent tasks. In data import tasks, decryption of encrypted variables is "unavailable."

[0047] (3) Data output system Figure 10 is a diagram for explaining data output tasks. Data output tasks are tasks that write fixed values ​​and variable data entered in data sources and task settings to files or databases. In data output tasks, decryption of encrypted variables is "unavailable."

[0048] (4) External system integration 11 is a diagram for explaining an external system cooperation task, which is a task for cooperation with another system.

[0049] The "EXE file execution task" is a task that "passes command line arguments to an EXE file in a specified path and executes it," and is "assuming that confidential information can be passed to any execution parameter," and decryption of cryptographic variables is "enabled."

[0050] The "DLL file call task" is a "task that calls and executes a DLL file at a specified path," and is "assuming that confidential information is passed to any execution parameter," and decryption of encrypted variables is "enabled."

[0051] A "REST API execution task" is a "task that executes a REST API service of another system," and is "assuming that confidential information is passed to any execution parameter," and decryption of encrypted variables is "available."

[0052] A "Stored Procedure Execution Task" is a "task that executes a stored procedure registered in a specified database," and is "assuming that confidential information is passed to any execution parameter," and decryption of encrypted variables is "enabled."

[0053] The "FTP download task," "FTP upload task," and "email sending task" are not "assumed to pass confidential information to any execution parameters," and decryption of encrypted variables is "unavailable."

[0054] (Data setting tasks and functional image) Fig. 12 is a diagram for explaining the functional image of the data setting system task in this embodiment. As shown in Fig. 12, (1) each definition has one setting item, and the item is optional (variable definition task, common variable definition). In this example, the caller task has execution argument A: variable definition task A (value (optional): loginid), and execution argument B: common variable definition B (value (optional): password).

[0055] (2) There are multiple setting items for each definition, and the items are fixed (database connection settings, FTP connection settings, email sending settings). In this example, the calling task has DB connection information: Database connection setting A (server name: DatabaseA, connection user: UserA, password: password).

[0056] (Operation type) The tool operations performed in this embodiment are classified according to three purposes: (1) collaboration process settings (flow creation), (2) collaboration process setting data confirmation (flow creation (edit mode) screen information confirmation, specification output), and (3) collaboration process execution (normal execution, debug execution (*includes an element of setting data confirmation to output intermediate data during execution)).

[0057] [1-6. Conventional specifications and their issues] Conventional specifications and their problems will be explained with reference to Figures 13 to 16. As background and problems of the invention, conventional implementations and their problems will be explained. Conventional implementations do not have the function to encrypt and manage internal confidential information, and are managed in plain text. This results in the following problems. There is a problem that confidential information registered by the confidential information setter can be confirmed and obtained by the flow setter through screen operations or database access. There is also a problem that setting values ​​can be output using convenient functions such as specification output and debug execution.

[0058] (common variables) Common variables are variables that can be used in common across all flows within this system. They can be registered, modified, and deleted from screens outside of flow tasks, and are managed in a dedicated master table. Figure 13 is a diagram that explains the conventional implementation of common variables and the issues they pose.

[0059] The "Confidential Information Setter" registers confidential information (plain text) as a common variable on the common variable registration screen, but the "Flow Setter" can view and obtain the value of the common variable in edit mode. In addition, the "Flow Setter" can obtain data from the database (common variable definition master) and view the confidential information.

[0060] (variable definition task) The variable definition task is a task that defines variables that can be used in common by multiple tasks within a flow. Like other tasks, it is managed as binary data within the flow setting master. Figure 14 is a diagram that explains the conventional implementation of the variable definition task and the issues it poses. The "confidential information setter" registers confidential information (plain text) in the variable definition task, but the "flow setter" can check the value from the task setting screen. The "flow setter" can also retrieve data from the database (flow setting master) and check the value of the variable definition.

[0061] (Specification output) The specification output function outputs flow setting information as a specification (xlsx file). Figure 15 is a diagram to explain the conventional implementation of the variable definition task and its issues. The "flow configurator" can check the variable setting values ​​from the specification.

[0062] (Debug run) Debug execution is an execution method that allows you to check the setting values, intermediate data, and processing results of each task after execution. Figure 16 is a diagram that explains the conventional implementation of debug execution and its issues. The "flow setter" can check the variable setting values ​​from the debug data. Note that if a variable is specified as an argument, the value of that variable will not be output.

[0063] [1-7. Scope of the present invention] FIG. 17 is a diagram for explaining the applicable scope of the present invention, showing a table organizing the higher-level, middle-level, and lower-level concepts of the present invention. An "encrypted arbitrary data setting system definition" includes a "common variable definition" and a "variable definition," has an "encryption flag," and defines whether or not to store the variable value in an encrypted state. An "external system linkage system task with optional execution parameters" executes an external system linkage system task including optional execution parameters. The optional execution parameters may include an encrypted arbitrary data setting system definition. Only this task decrypts the encrypted value of the encrypted arbitrary data setting system definition and executes external system linkage. An "external system linkage system task with optional execution parameters" is, for example, an EXE file execution task, a DLL file call task, a REST API execution task, or a stored procedure execution task.

[0064] [2. Configuration] An example of the configuration of the EAI flow setting and execution system 100 according to this embodiment will be described with reference to Fig. 18 etc. Fig. 18 is a block diagram showing an example of the configuration of the EAI flow setting and execution system 100 according to this embodiment.

[0065] 18, the EAI flow setting and execution system 100 includes a control unit 102, a communication interface unit 104, a storage unit 106, and an input / output interface unit 108. The units included in the EAI flow setting and execution system 100 are connected to each other so that they can communicate with each other via any communication path.

[0066] The communication interface unit 104 communicatively connects the EAI flow setting and execution system 100 to the network 300 via a communication device such as a router and a wired or wireless communication line such as a dedicated line. The communication interface unit 104 has a function of communicating data with other devices via the communication line. Here, the network 300 has a function of connecting the EAI flow setting and execution system 100 and the server 200 etc. so that they can communicate with each other, and is, for example, the Internet or a LAN (Local Area Network).

[0067] An input device 112 and an output device 114 are connected to the input / output interface unit 108. The output device 114 may be a monitor (including a home television), a speaker, or a printer. The input device 112 may be a keyboard, a mouse, a microphone, or a monitor that cooperates with a mouse to achieve a pointing device function. In the following, the output device 114 may be referred to as the monitor 114, and the input device 112 may be referred to as the keyboard 112 or the mouse 112.

[0068] Various databases, tables, files, etc. are stored in the storage unit 106. Computer programs that work in conjunction with the OS (Operating System) to issue commands to the CPU (Central Processing Unit) to perform various processes are recorded in the storage unit 106. The storage unit 106 can be, for example, a memory device such as RAM (Random Access Memory) or ROM (Read Only Memory), a fixed disk device such as a hard disk, a flexible disk, an optical disk, etc.

[0069] The storage unit 106 includes a database 106a, etc. The database 106a stores a common variable definition master and a flow setting master.

[0070] The common variable definition master stores common variable definitions including a variable ID, a variable name, a variable value, a comment, and an encryption flag (1: encrypted, 0: not encrypted) that specifies whether the variable value is encrypted or not.

[0071] The flow setting master stores a flow that is made up of multiple tasks.

[0072] The control unit 102 is a CPU or the like that performs overall control of the EAI flow setting and execution system 100. The control unit 102 has an internal memory for storing control programs such as an OS, programs that define various processing procedures, required data, etc., and executes various information processing operations based on these stored programs.

[0073] The control unit 102 is configured to be able to access the database 106a etc. stored in the storage unit 106. Note that the database 106a etc. may be provided in another location (for example, the server 200) as long as the control unit 102 is able to access it.

[0074] The control unit 102 conceptually includes a setting unit 102a and an execution unit 102b.

[0075] The setting unit 102a creates common variable definitions in response to operations by an operator (confidential information setter or flow setter) on the common variable definition setting screen and stores the definitions in the common variable definition master. The confidential information setter sets confidential information, while the flow setter sets other settings. When creating a common variable definition, if the check state of the encryption flag for the variable value is set to ON on the common variable definition setting screen, the setting unit 102a displays the variable value in a masked state so that it cannot be viewed, and encrypts the variable value. The setting unit 102a controls the check state of the encryption flag once set so that it cannot be unchecked.

[0076] The setting unit 102a creates a flow consisting of multiple tasks in response to operator operations on the flow setting screen and task setting screen, and stores the created flow in the flow setting master. The flow setting screen allows a user to select a task that constitutes a flow from a list of tasks, and then sets the task content on the task setting screen. The setting unit 102a may serialize the flow and store it in the flow setting master. When setting a variable definition task for setting a flow-specific variable definition (a "common variable definition" is used in common across all flows, while a "variable definition" is used individually for each flow), if the setting unit 102a checks the encryption flag for the variable value on the task setting screen, the setting unit 102a displays the variable value in a masked state so that it cannot be viewed, and encrypts the variable value. The setting unit 102a controls the check state of the encryption flag once set so that it cannot be unchecked. As described above, the "common variable definition" and the "variable definition" are referred to as "encrypted arbitrary data setting definitions."

[0077] The execution unit (also called the "flow execution program") 102b executes the flows stored in the flow setting master. Here, "execution" can be divided into two modes: normal execution, in which the EAI flow is executed for the intended business, and debug execution, in which the state of the variables and return values ​​held is maintained each time each flow task is executed, and the flow is executed in a viewable state (primarily used by flow setters to check whether the created flow is operating correctly, or to investigate when an error or other problem occurs). Hereinafter, "flow execution" refers to "normal execution" unless specifically referred to as debug execution.

[0078] When the flow is executed, if the task refers to an "encrypted arbitrary data setting system definition," and if the task is an "external system linkage task with optional execution parameters," and if the encryption flag of the "encrypted arbitrary data setting system definition" that it references is set to "encrypted," the execution unit 102b decrypts the variable value in memory and uses the decrypted variable value as an optional execution parameter to link with the external system.

[0079] If the task is not an "external system linkage task with optional execution parameters," the execution unit 102b may not decrypt the variable value of the encrypted optional data setting system definition, but may adopt it as a variable as is, and may execute the task using the adopted variable.

[0080] In the case of debug execution of a flow, the execution unit 102b may be configured to be able to refer to undecrypted variable values ​​for the "encrypted arbitrary data setting system definition" referenced by the task.

[0081] When the task of the flow is to output a specification, if the task includes an "encrypted arbitrary data setting system definition," the execution unit 102b may output undecrypted variable values ​​for the "encrypted arbitrary data setting system definition."

[0082] The "external system linkage task with optional execution parameters" may include an EXE file execution task, a DLL file call task, a REST API execution task, or a stored procedure execution task.

[0083] [3. Specific examples of processing] Specific examples of the processing of the setting unit 102a and the execution unit 102b of the EAI flow setting and execution system 100 of this embodiment will be described with reference to Figures 18 to 27. Figures 19 to 47 are diagrams for explaining specific examples of the processing of the setting unit 102a and the execution unit 102b of the EAI flow setting and execution system 100 of this embodiment.

[0084] [3-1. Encryption Implementation] The EAI flow setting and execution system 100 implements an encryption function for common variable definition and variable definition tasks.

[0085] This makes it impossible to obtain confidential information through screen operations or database access, which was a problem. By referencing encrypted variables, there is no need to enter confidential information into the execution parameters of each task every time (the work can be shared between the confidential information setter and the flow setter). Because it can be referenced in a one-to-one correspondence with each item in the execution parameters, it can flexibly accommodate the specifications (execution parameter items) of the linked system.

[0086] A checkbox has been added to the common variable definition settings and variable definition task settings screen. If the checkbox is selected, the data will be displayed masked on the screen and will be registered in the database in encrypted form. If you open the settings screen in edit mode, you cannot uncheck the encryption checkbox.

[0087] The following issues remain, and will be resolved by improving the decoding implementation. - Some standard functions and operations (output tasks and debug execution) can allow confidential information to be obtained after decryption. On the other hand, if the decryption function is not implemented and decryption is performed externally, encrypted variables cannot be used in tasks that depend on the specifications of existing programs (mainly those that link with external systems).

[0088] It is necessary to distinguish between tasks in which the value of an encrypted variable is used in an encrypted state and tasks in which it is used in a decrypted state.

[0089] In encryption, we will explain using as examples an "EXE execution task" as an external system linkage task that requires confidential information to be set, and a "text output task" as a data output task that the flow setter sets up to obtain confidential information.

[0090] (common variables) FIG. 19 is a diagram illustrating the setting of common variables according to this embodiment. Encryption is performed when the Save button is pressed on the common variable definition setting screen. In FIG. 19, the common variable definition setting screen includes fields for inputting a variable name, comment, and value, a checkbox for specifying whether to encrypt the variable value, a Save button, and a Close button. Checking the encryption checkbox enables encryption of the "variable value." Checking the checkbox and entering an ID (confidential information) in the "variable value" field causes encryption when the Save button is pressed. The variable value is encrypted, and a common variable definition corresponding to the input content is registered in the common variable definition master. The field for inputting the variable value is configured so that confidential information cannot be viewed on the screen when the checkbox is checked using a masking process. In addition, the encryption checkbox cannot be disabled in edit mode. In the example shown in FIG. 19, the variable name "☆☆ID," the comment "This is the user ID of ☆☆.exe," and the variable value "······ (the input "lognid" masked)" are entered on the common variable definition setting screen, and the encryption checkbox is checked.

[0091] The common variable definition master can be configured as a table that associates and registers variable IDs, variable names, variable values, comments, and encryption flags. The "variable ID" is automatically generated. The "variable name" and "comment" are the contents entered on the common variable definition setting screen. The "variable value" is the contents entered on the common variable definition setting screen, and if the encryption checkbox is checked, it is the encrypted value. If it is not checked, it is the entered content (plain text).

[0092] The "encryption flag" is "1" if the encryption checkbox is checked, and "0" if it is not checked. In the example shown in the figure, the fourth line (corresponding to the input example on the common variable definition setting screen) has the variable ID "V00004", variable name "☆☆ID", value "B78FJKB334 (encrypted value of "lognid")", comment "User ID of ☆☆.exe", and encryption flag "1". Because encryption is also managed in the database, the "flow setter" will not be able to know the confidential information even if they retrieve the data.

[0093] (variable definition task) Fig. 20 is a diagram for explaining the setting of a variable definition task in this embodiment. Encryption is performed when a flow is saved on the flow setting screen. In Fig. 20, on the flow setting screen, a task is selected from a task list to create a flow. The content of each task in the flow is set on the task setting screen, and when a save button (not shown) is pressed on the flow setting screen, the set flow is binarized and saved in the flow setting master.

[0094] The task setting screen for variable definitions includes fields for entering a title and comment, a button for selecting the variable type (fixed value, Guid), a field for entering a variable value, and a checkbox for specifying whether to encrypt the variable value. Checking the encryption checkbox enables encryption of the "variable value." Checking the checkbox and entering a password (confidential information) in the "variable value" field encrypts the variable value when the flow is saved (setting the encryption flag to 1), and the flow is serialized and saved in the flow setting master. The variable value entry field is configured so that confidential information cannot be viewed on the screen when the checkbox is checked using masking. In addition, the encryption checkbox cannot be disabled in edit mode. In the example shown in Figure 20, the task setting screen displays the variable name "☆☆Password," the comment "Password for ☆☆.exe," and the value "······ (the entered "password" masked)," and the encryption checkbox is checked. The task ID is automatically generated.

[0095] The flow setting master can be configured with a table that associates and registers flow IDs and flow data (binary). The "variable ID" is automatically generated. The "flow data (binary)" is serialized data of the flow set on the flow setting screen and task setting screen. The fourth line contains the flow ID "F00004" and the flow data (binary) "0x0001000000FFFFFFFF01000000000000000C02000000584F6269633EXE." As shown in Figure 20, even when this flow data is deserialized, the value is K90JH8OK8G (the encrypted value of "Password"). Because the variable value is encrypted in this way, the "flow setter" cannot know the confidential information even if they obtain the data.

[0096] (Flow execution) Fig. 21 is a diagram for explaining flow execution in this embodiment. In Fig. 21, the variable definition tasks are the same as those in Fig. 20. The EXE execution task (task ID: T00002) has the title "Execute ☆☆EXE", the comment "Execute ☆☆.exe", the EXE file path "C¥AppFolder¥☆☆Application.exe", the execution arguments "☆☆ID {common variable ID: V00004}, ☆☆Password {task ID: T00001}", and the reference date "2024 / 1 / 1", and a flow (flow ID: F00004) is registered in the flow setting master.

[0097] The flow data (here, flow data with flow ID: F00004) is obtained from the flow setting master and deserialized. Each task process is obtained in order, and in the variable definition task, the task ID and value are obtained, and if the encryption flag is 1, decryption is performed. In the EXE execution task, arguments are organized, and the common variable with common variable ID "V00004" is obtained from the common variable definition master, and if the encryption flag is 1, decryption is performed. The decrypted common variable and the value of the variable definition task are obtained, and mapping is performed with the corresponding argument. The input value is passed as a command line argument, and the application is executed. Processing of the decryption results is completed within the process memory, so intermediate data cannot be accessed from outside.

[0098] (Specification output) FIG. 22 is a diagram for explaining the execution of a specification output flow according to this embodiment. In FIG. 22, specification output when values ​​are encrypted in the variable definition task and when they are not encrypted is explained. When specifications are output encrypted, they are output as encrypted, so confidential information cannot be confirmed from the specifications. When specifications are output encrypted, they are output as encrypted, so confidential information cannot be confirmed from the specifications. Variables that are not encrypted are output as set values. Common variables are also encrypted and saved in the database, so confidential information is not included in the specifications.

[0099] (remaining assignments) The remaining problem will be explained with reference to Figures 23 and 24. Although it has been possible to prevent confidential information from being obtained through screen operations or database access, the decrypted confidential information can still be viewed using the following standard functions.

[0100] Example 1: Argument data output flow setting from a data output task 23 is a diagram illustrating an example of argument data output flow settings from a data output task. In FIG. 23, a text output task (an example of a data output task) is newly added on the flow setting screen and task setting screen, with the following settings: title "Confidential Information Text Output", comment "Confidential Information will be output", output destination path "C\TextFolder\Confidential Information.txt", and output text "ID: {Common Variable ID: V00004}, Password: {Task ID: T00001}". When this flow is executed, the text output task decrypts the encryption variable and sets it in the output text, resulting in the decrypted confidential information being output.

[0101] Example 2: Checking intermediate data using the debug execution function Figure 24 is a diagram for explaining an example of checking intermediate data using the debug execution function. In Figure 24, the flow is the same as Figure 21. When this flow is debugged by the flow execution program, the confidential information decrypted during execution is output as is. Note that for variables that are not encrypted, the setting values ​​are output as is.

[0102] On the other hand, if the decryption function is not implemented to prevent the acquisition of confidential information after decryption, tasks that depend on the calling method of existing programs cannot be used. FIG. 25 is a diagram illustrating an example of a case where the decryption function is not implemented. In FIG. 25, for example, if the EXE execution task is configured with the execution arguments "Input Value" (argument organization: mapping the corresponding arguments to the ciphertext as is), ☆☆ID "B78FJKB334", ☆☆Password "K90JH8OK8G", and base date "2024 / 1 / 1", it will be impossible to implement the decryption function in applications of standard products from other companies. This means that the application cannot be executed even if the encrypted confidential information is passed.

[0103] [3-2. Decryption Implementation] In response to the remaining issues with encryption implementation, we will implement the decryption function so that it can only be used within the execution process of some reference tasks. This will make it impossible to output confidential information from some standard functions and operations (output tasks, debug execution), which was a remaining issue. In tasks that can use the decryption function, confidential information that is encrypted and managed on the settings screen and database can be used in plain text only during execution (allowing collaboration regardless of the other party's specifications).

[0104] Specifically, a mechanism will be implemented that allows the decryption function to be used only for the minimum number of tasks that "set confidential information in the execution parameters" and "have undefined execution parameters" and that perform external integration (execution, dll, REST API service, etc.). As a result, if an encrypted variable is referenced in a task that cannot use the decryption function, it will be used as ciphertext.

[0105] (Implementation details) · Decryption of encrypted variables is performed when the calling task is executed, not when the variable definition task or common variable is acquired. Implement a mechanism to determine whether decryption processing can be used within the executable program depending on the type of the referencing task. Condition: It is a task that links to an external system and where "confidential information is expected to be set in the execution parameters" and "the execution parameter items are undefined."

[0106] Here, an "EXE execution task" is used as an example of an external system cooperation task that can use the decryption function, and a "text output task" is used as an example of a data output task that cannot use the decryption function. Figures 26A and 26B are diagrams for explaining the implementation details of the decryption function of this embodiment.

[0107] In the figure, the variable definition task is the same as in Figure 20. The EXE execution task is the same as in Figure 21. The text output task is the same as in Figure 23. The "confidential information setter" sets confidential information in the variable definition task. The "flow setter" can complete the setting of subsequent tasks by referring to the setting results, so the division of roles is achieved even if encryption settings are involved in the flow settings. The "flow setter" sets subsequent tasks. In this example, we will explain an example where the "flow setter" adds an output task with the purpose of obtaining confidential information.

[0108] When a flow is executed using the flow execution program, the variable definition task obtains the task ID and value, does not decrypt it, and retains the task ID, value, and encryption flag. The EXE execution task obtains the common variable from the common variable definition master and stores it in memory. It does not decrypt it when obtaining it. If the encryption flag is 1 in memory, the task ID value and common variable are decrypted. The input value is passed to the application as a command line argument, and the application is executed.

[0109] In the text output task, since the decryption function cannot be used, the encrypted variables are set as output text as they are. The variable part is output as text in encrypted form. As a result, confidential information is output as ciphertext.

[0110] (Debug execution) FIG. 27 is a diagram illustrating an example of checking intermediate data using the debug execution function of this embodiment. In the case of debug execution, the decryption function is not used. In FIG. 27, the flow is the same as that in FIG. 24. When this flow is debugged by the flow execution program, the variable definition task cannot use the decryption function, so the variable is output in its encrypted form. In the EXE execution task, if a variable is specified as an argument, the value of the variable is not output.

[0111] As described above, according to this embodiment, the system includes a database 106a that stores encrypted arbitrary data setting system definitions including variable names, variable values, and encryption flags that specify whether or not the variable values ​​are encrypted, and an EAI flow including tasks that reference one or more encrypted arbitrary data setting system definitions, and an execution unit 102b that executes the EAI flow.When the EAI flow is executed, if a task references an encrypted arbitrary data setting system definition, and if the task is an external system linkage task with optional execution parameters, and the encryption flag of the referenced encrypted arbitrary data setting system definition is set to "encrypted," the execution unit 102b decrypts the variable value in memory and uses the decrypted variable value as an optional execution parameter to link with the external system.Therefore, by incorporating a function for cryptographically managing confidential information, it is possible to safely handle confidential information.

[0112] [4. Contribution to the United Nations-led Sustainable Development Goals (SDGs)] This embodiment can contribute to improving business efficiency and promoting appropriate management decisions by companies, thereby contributing to the achievement of SDGs Goals 8 and 9.

[0113] Furthermore, this embodiment can contribute to reducing waste and promoting paperless and electronic systems, thereby contributing to the achievement of SDGs Goals 12, 13, and 15.

[0114] Furthermore, this embodiment can contribute to strengthening control and governance, which can contribute to the achievement of Goal 16 of the SDGs.

[0115] 5. Other Embodiments The present invention may be implemented in various different embodiments other than those described above within the scope of the technical concept set forth in the claims.

[0116] For example, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using known methods.

[0117] Furthermore, the processing procedures, control procedures, specific names, information including parameters such as registered data and search conditions for each process, screen examples, and database configurations shown in this specification and drawings can be changed as desired unless otherwise specified.

[0118] Furthermore, with regard to the EAI flow setting and execution system 100, the components shown in the figures are functional concepts, and do not necessarily have to be physically configured as shown in the figures.

[0119] For example, all or any part of the processing functions of the EAI flow setting and execution system 100, particularly the processing functions performed by the control unit 102, may be implemented by a CPU and a program interpreted and executed by the CPU, or may be implemented as hardware using wired logic. The program is recorded on a non-transitory, computer-readable recording medium containing programmed instructions for causing an information processing device to execute the processes described in this embodiment, and is mechanically read by the EAI flow setting and execution system 100 as needed. That is, a computer program for providing instructions to the CPU in cooperation with the OS and performing various processes is recorded in a storage unit such as a ROM or HDD (Hard Disk Drive). The computer program is executed by being loaded into RAM and cooperates with the CPU to form the control unit.

[0120] In addition, this computer program may be stored in an application program server connected to the EAI flow setting and execution system 100 via any network, and all or part of it may be downloaded as needed.

[0121] Furthermore, the program for executing the processes described in this embodiment may be stored in a non-transitory computer-readable recording medium or configured as a program product. Here, the term "recording medium" includes any "portable physical medium" such as a memory card, a Universal Serial Bus (USB) memory, a Secure Digital (SD) card, a flexible disk, a magneto-optical disk, a ROM, an Erasable Programmable Read Only Memory (EPROM), an Electrically Erasable and Programmable Read Only Memory (EEPROM (registered trademark)), a Compact Disk Read Only Memory (CD-ROM), a Magneto-Optical disk (MO), a Digital Versatile Disk (DVD), and a Blu-ray (registered trademark) disc.

[0122] Furthermore, a "program" is a data processing method written in any language or description method, and does not matter whether it is in the form of source code or binary code. Note that a "program" is not necessarily limited to a single structure, but also includes a structure that is distributed as multiple modules or libraries, or a structure that achieves its function by cooperating with a separate program, such as an OS. Note that the specific configuration and reading procedure for reading a recording medium in each device shown in this embodiment, as well as the installation procedure after reading, can use well-known configurations and procedures.

[0123] The various databases stored in the memory unit 106 are storage means such as memory devices such as RAM and ROM, fixed disk devices such as hard disks, flexible disks, and optical disks, and store various programs, tables, databases, and web page files used for various processes and providing websites.

[0124] The EAI flow setting and execution system 100 may be configured as an information processing device such as a known personal computer or workstation, or may be configured as the information processing device to which any peripheral device is connected. The EAI flow setting and execution system 100 may also be realized by installing software (including programs, data, etc.) that causes the device to perform the processing described in this embodiment.

[0125] Furthermore, the specific form of distribution and integration of the devices is not limited to that shown in the drawings, and all or part of them can be configured by functionally or physically distributing and integrating them in any unit depending on various additions or functional loads. In other words, the above-described embodiments can be implemented in any combination, or embodiments can be implemented selectively. [Explanation of symbols]

[0126] 100 EAI flow configuration and execution system 102 Control section 102a Setting section 102b Executive Department 104 Communication interface unit 106 Storage section 106a Database 108 Input / Output Interface Section 112 Input Device 114 Output Device 200 servers 300 Network

Claims

1. An EAI flow setting and execution system having a control unit, The control unit The system is configured to be able to access a database that stores an encrypted arbitrary data setting system definition including a variable name, a variable value, and an encryption flag that specifies whether or not the variable value is encrypted, and an EAI flow including a task that references one or more encrypted arbitrary data setting system definitions, An execution means for executing the EAI flow, The execution means is an EAI flow setting and execution system characterized in that, when an EAI flow is executed, if a task references an encrypted arbitrary data setting system definition, and if the task is an external system integration task with an optional execution parameter, and if the encryption flag of the referenced encrypted arbitrary data setting system definition is set to "encrypted," the execution means decrypts the variable value in memory and uses the decrypted variable value as an optional execution parameter to integrate with the external system.

2. The control unit further a setting means for creating the encrypted arbitrary data setting system definition and the EAI flow in response to an operator's operation on a setting screen and storing them in the database; The EAI flow setting and execution system described in claim 1, characterized in that when the check state of the encryption flag of the encryption optional data setting system definition is turned ON on the setting screen, the setting means displays the variable value in a masked state so that it cannot be viewed, and encrypts the variable value.

3. 3. The EAI flow setting and execution system according to claim 2, wherein said setting means controls the encryption flag so that it cannot be unchecked once the encryption arbitrary data setting definition has been set.

4. The EAI flow setting and execution system according to claim 1, characterized in that, if the task is not an external system linkage task with optional execution parameters, the execution means does not decrypt the variable value of the encrypted optional data setting system definition, but adopts it as a variable as is, and executes the task using the adopted variable.

5. The EAI flow setting and execution system described in claim 1, characterized in that the execution means, when debugging the EAI flow, makes it possible to query undecrypted variable values ​​for encrypted arbitrary data setting system definitions referenced by tasks.

6. The EAI flow setting and execution system according to claim 1, characterized in that when the task of the EAI flow is specification output and includes an encrypted arbitrary data setting system definition, the execution means outputs the undecrypted variable values ​​for the encrypted arbitrary data setting system definition as is.

7. 2. The EAI flow setting and execution system according to claim 1, wherein the encrypted arbitrary data setting system definition includes a common variable definition common to all EAI flows or a variable definition used individually for each EAI flow.

8. 2. The EAI flow setting and execution system according to claim 1, wherein the external system linkage task with optional execution parameters includes an EXE file execution task, a DLL file call task, a REST API execution task, or a stored procedure execution task.

9. 9. The EAI flow setting and execution system according to claim 1, wherein the variable value includes a login ID or a login password.

10. An EAI flow setting and execution method executed by an information processing device having a control unit, The control unit The system is configured to be able to access a database that stores an encrypted arbitrary data setting system definition including a variable name, a variable value, and an encryption flag that specifies whether or not the variable value is encrypted, and an EAI flow including a task that references one or more encrypted arbitrary data setting system definitions, Executed in the control unit: An execution step of executing the EAI flow, In the execution step, when the EAI flow is executed, if a task references an encrypted arbitrary data setting system definition, and the task is an external system linkage system task with an optional execution parameter, if the encryption flag of the referenced encrypted arbitrary data setting system definition is set to "encrypted", the variable value is decrypted in memory, and the decrypted variable value is used as an optional execution parameter to link with the external system. This is an EAI flow setting and execution method characterized in that

11. An EAI flow setting and execution program to be executed by an information processing device having a control unit, The control unit The system is configured to be able to access a database that stores an encrypted arbitrary data setting system definition including a variable name, a variable value, and an encryption flag that specifies whether or not the variable value is encrypted, and an EAI flow including a task that references one or more encrypted arbitrary data setting system definitions, The control unit an EAI flow setting and execution program for executing an execution step for executing the EAI flow, In the execution step, when the EAI flow is executed, if a task references an encrypted arbitrary data setting system definition, and if the task is an external system linkage system task with an optional execution parameter, and if the encryption flag of the referenced encrypted arbitrary data setting system definition is set to "encrypted", the variable value is decrypted in memory, and the decrypted variable value is used as an optional execution parameter to link with the external system.

Images