Program, information processing method, and information processing apparatus

Abstract

To provide a program capable of applying flexible security setting by altering a communication packet from a user terminal to a cloud server on the basis of a set condition.SOLUTION: A program executed by an information processing apparatus in which an application is executed on an operating system causes the information processing apparatus to execute generating a communication packet for a first information processing apparatus different from the information processing apparatus based on IP communication processing in the application, modifying the communication packet based on a first setting condition and a second setting condition for the communication packet, and transmitting the communication packet to the first information processing apparatus.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a program for controlling communication of an information processing device. [Background technology]

[0002] In recent years, with the introduction of remote work, services called SaaS (Software as a Service), which run on cloud servers such as online storage, have been rapidly spreading. In SaaS environments, the cloud servers to which user terminals connect are generally installed outside of closed networks, making it necessary to ensure security that differs from traditional boundary defenses that use VPNs (Virtual Private Networks) and the like.

[0003] For example, Patent Document 1 discloses a method for detecting a man-in-the-middle (MITM) that may attempt to monitor HTTPS (Hypertext Transfer Protocol Secure) communications used in cloud-based platforms. However, if legitimate authentication information is sent to a cloud server from a terminal of an attacker or the like that is different from the user terminal, it is not possible to prevent unauthorized use of cloud services (for example, access authorization to files on online storage). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 7083460 Summary of the Invention [Problem to be solved by the invention]

[0005] The present invention has been made based on the above-mentioned technical background, and aims to provide a program that can apply flexible security settings by modifying communication packets from a user terminal to a cloud server based on set conditions. [Means for solving the problem]

[0006] According to one aspect of the present invention, a program executed by an information processing device on which an application is executed on an operating system generates a communication packet for a first information processing device different from the information processing device based on IP communication processing in the application, modifies the communication packet based on first and second setting conditions for the communication packet, and transmits the communication packet to the first information processing device. Furthermore, according to one aspect of the present invention, an information processing method executed by an information processing device on which an application is executed on an operating system includes generating a communication packet for a first information processing device different from the information processing device based on IP communication processing in the application, modifying the communication packet based on first setting conditions and second setting conditions for the communication packet, and transmitting the communication packet to the first information processing device. Furthermore, according to one aspect of the present invention, a control unit of an information processing device on which an application is executed on an operating system generates a communication packet for a first information processing device different from the information processing device based on IP communication processing in the application, modifies the communication packet based on first and second setting conditions for the communication packet, and transmits the communication packet to the first information processing device. [Effects of the Invention]

[0007] The program according to the present invention has an effect that the information processing device can modify and transmit a communication packet to the first information processing device based on the first set condition and the second set condition. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram showing an example of the configuration of a cloud service system. [Figure 2] FIG. 2 is a block diagram showing an example of the functional configuration of a driver proxy. [Figure 3] 10 is a flowchart showing an example of the flow of a packet transmission process of a user terminal. [Figure 4] FIG. 10 is a diagram showing an example of a flow of packet encapsulation in a user terminal. [Figure 5] FIG. 10 is a diagram showing an example of packet modification relating to a first set condition and a second set condition. [Figure 6] 10 is a flowchart showing an example of a processing flow of a cloud service system. [Figure 7] 10 is a flowchart showing an example of the flow of a service usage restriction setting process. [Figure 8] FIG. 4 is a diagram showing an example of setting management information. [Figure 9] 10 is a flowchart showing an example of the flow of a service login process. [Figure 10] 10 is a flowchart showing an example of the flow of a service usage process. DETAILED DESCRIPTION OF THE INVENTION

[0009] An example of an embodiment of the present invention will be described below with reference to the drawings. In the description of the drawings, the same elements are given the same reference numerals, and duplicate explanations may be omitted. However, the components described in this embodiment are merely examples, and are not intended to limit the scope of the present invention.

[0010] An example of an embodiment for realizing the information processing technology of the present invention will be described. FIG. 1 is a conceptual diagram showing an example of the configuration of a cloud service system 1 according to one aspect of the present embodiment. The cloud service system 1 is composed of, for example, a user terminal 10 which is a terminal of a user who uses various cloud services, an administrator terminal 11 which is a terminal of an administrator who manages users' access rights to various cloud services, a SaaS server 20 which provides various cloud services, an IDP (Identity Provider) server 21 which performs authentication to various cloud services, a setting information management database server 22 which sets and stores user access rights, and a web server 23 which serves as a window for accepting setting management information from the administrator terminal 11.

[0011] For example, each terminal and each server includes a control unit (e.g., control unit 101, control unit 111, control unit 201, control unit 211, control unit 221, control unit 231) and a memory unit (e.g., memory unit 102, memory unit 112, memory unit 202, memory unit 212, memory unit 222, memory unit 232). Each control unit is configured to have, for example, a processor such as a CPU or DSP, or an integrated circuit such as an ASIC. Each storage unit is configured to include, for example, a volatile memory such as a DRAM or a non-volatile memory such as an SRAM.

[0012] Furthermore, for example, each terminal and each server are connected via a network (not shown). The network is, for example, a wired network or a wireless network, and is a communication network that connects each device that constitutes the cloud service system 1 and enables data transmission and reception between them. The network may be, for example, the Internet, a LAN (Local Area Network), a WAN (Wide Area Network), etc.

[0013] The number of user terminals 10 constituting the cloud service system 1 may be one or more. When there are multiple user terminals 10, they are distinguished as, for example, user terminal 10A, user terminal 10B, . . . Furthermore, the number of administrator terminals 11 constituting the cloud service system 1 may be one or more. Note that the user terminal 10 and the administrator terminal 11 may not be distinguished from each other, and the same terminal may be used to access cloud services and set access permissions. In other words, there may be no explicit distinction between users and administrators.

[0014] The user terminal 10A executes, for example, a cloud application 8A and a web browser 8B, which are client application programs (collectively referred to as "cloud applications 8") for using cloud services that run on the user terminal 10A. Then, communications occurring in the cloud application 8A and the web browser 8B are transmitted to the network via (through) a driver proxy 5 that runs on the user terminal 10A.

[0015] Similarly, in the administrator terminal 11, communications occurring in the web browser 8Z may be transmitted to the network via a driver proxy 5 running on the administrator terminal 111. Also, the administrator terminal 11 may communicate directly with the web server 23 without going through the driver proxy 5.

[0016] The cloud service system 1 may include one or more SaaS servers 20. When there are multiple SaaS servers 20 (when multiple services are provided), they are distinguished as, for example, a first SaaS server 20A, a second SaaS server 20B, and so on.

[0017] In the following, as an example of a SaaS configuration, a first SaaS server 20A provides a cloud storage service, and a second SaaS server 20B provides an electronic signature (electronic seal) service. Also, for example, the description will be given assuming that a cloud application 8A is used as an application for using a cloud storage service, and a web browser 8B is used as an application for using a digital signature service.

[0018] Furthermore, for example, the IDP server 21 may provide a single sign-on (SSO) function to the first SaaS server 20A and the second SaaS server 20B. The IDP server 21 may also be called an IDaaS server.

[0019] The server configuration is not limited to this example. For example, the setting information management database server 22 and the web server 23 may be integrated into one server. Also, for example, the IDP server 21 and the setting information management database server 22 may be integrated into one server. Also, for example, the SaaS server 20 and the IDP server 21 may be integrated into one server.

[0020] Furthermore, the arbitrary server may be a server system made up of a plurality of server devices. Furthermore, the server that provides the services of the cloud service system 1 may be said to be a server system that is configured from the SaaS server 20, the IDP server 21, the setting information management database server 22, and the web server 23.

[0021] In the cloud service system 1, for example, when a predetermined communication with a SaaS server 20 or the like occurs in an application program 8 of a user terminal 10, the packet is modified in the driver proxy 5. Then, based on, for example, the terminal information embedded in the modified portion of the packet, the SaaS server 20 reads setting information from the setting information management database server 22 via the IDP server 21 and executes setting change processing such as user authentication and access authorization linked to the terminal information. This enables the SaaS server 20 to block access from user terminals that do not go through the driver proxy 5 (i.e., do not have the driver proxy 5 installed), and to restrict data input / output and transmission / reception in various services provided by SaaS.

[0022] 2 is a block diagram showing an example of the functional configuration of the driver proxy 5 in the user terminal 10 (which may simply be called a "terminal" or an "information processing device") according to one aspect of this embodiment. In FIG. 2, each functional unit shown inside the driver proxy 5 may operate as part of the functional unit (functional block) of the control unit 101 of the user terminal 10, for example, by the driver proxy 5 being read and executed by the control unit 101. Furthermore, the cloud application 8, the driver proxy 5, and the network interface 2 may be programs (which may also be called processes or threads) that run on an OS (Operating System) (not shown) of the user terminal 10.

[0023] The driver proxy 5 includes, for example, a filter driver 6 which is a program that operates in kernel mode 3, and a local proxy 7 which is a program that operates in user mode 4.

[0024] The filter driver 6 includes, for example, a driver interface unit 61, a packet determination unit 62, and an application interface unit 63. The driver interface unit 61 has a function of, for example, interrupting communication (for example, communication based on TCP / UDP 9) occurring in the cloud application 8 and changing the transmission path of the intercepted packet to pass through the driver proxy 5. The driver interface unit 61 also has a function of, for example, transmitting the packet processed by the driver proxy 5 to the network interface 2 for transmitting the packet to the network. The driver interface unit 61 may be, for example, an API unit with a system service for creating a network filtering application provided by the OS, such as WFP (Windows Filtering Platform) or libpcap. The packet determination unit 62 has a function of determining whether to hand over the processing of an intercepted packet to the local proxy 7 or to transmit the packet to the network interface 2, based on a first setting condition, which will be described later, for example. The application interface unit 63 has a function of realizing an interface with the local proxy 7 for packets etc. for which it has been determined that the processing should be taken over by the local proxy 7, for example.

[0025] The local proxy 7 includes, for example, a driver interface unit 71 and a packet analysis and modification unit 72 . The driver interface unit 71 has a function of implementing an interface with the driver interface unit 61 of the filter driver 6, for example. The packet analysis and modification unit 72 has the function of determining whether or not to modify a packet passed from the filter driver 6 based on the second setting condition described below, and also modifies the packet if it is determined that the packet should be modified.

[0026] Here, kernel mode 3 is a program execution mode in which various commands can be executed without any restrictions on the OS in an information processing device, while user mode 4 is a program execution mode in which various commands can be executed with restrictions that prevent the execution of commands that have adverse effects such as stopping the OS. In kernel mode 3, the instruction set for operating the OS can be executed without restriction, so if an inappropriate instruction is executed, it could have a negative impact on the entire system. On the other hand, it has complete access rights to all input / output devices connected to the information processing device. In addition, programs running in kernel mode 3 are processed with priority over programs running in user mode 4, so they can achieve high performance. In user mode 4, the execution of commands that may adversely affect the operation of the information processing device is automatically prevented. Therefore, developing a program that runs in user mode 4 is easier than developing a program that runs in kernel mode 3. However, programs that run in user mode 4 are subject to restrictions, such as the need to go through a device driver to use a device.

[0027] The local proxy 7 may be a program that operates in kernel mode 3. This allows the processing in the driver proxy 5 to be completed in kernel mode 3, thereby speeding up the processing.

[0028] [Packet transmission process procedure] FIG. 3 is a flowchart showing an example of the procedure of communication processing (packet transmission processing) of the user terminal 10 in this embodiment. The processes in these flowcharts are realized, for example, by the control unit 101 of the user terminal 10 reading out the code of each program stored in the storage unit 102 into RAM and executing it.

[0029] Each symbol S in each flowchart represents a step. The flowcharts described below are merely examples of the information processing procedures in this embodiment. Other steps may be added to each flowchart, or some steps may be deleted. To simplify the drawings, reference numerals may be omitted for each step. In the flowcharts, the cloud application program 8A, the web browser 8B, etc. may be collectively referred to as an "application." Communication destinations, including the SaaS server 20, may be referred to as "services."

[0030] In the flowchart, steps indicated by dotted lines indicate operations in user mode 4, and steps indicated by solid lines indicate operations in kernel mode 3. Therefore, steps indicated by solid lines can be executed faster than steps indicated by dotted lines. It can also be said that steps indicated by solid lines have a lighter execution load than steps indicated by dotted lines.

[0031] First, the control unit 101 of the user terminal 10 executes a connection request to a service in accordance with an application (S10). Then, the control unit 101 of the user terminal 10 generates a communication packet (which may simply be called a "packet") for a predetermined service in accordance with the application. The communication packet includes, for example, a header such as an HTTP header and a payload (data). Also, for example, in the case of communication using the HTTPS protocol, the communication packet includes a TLS record header and a TLS payload. Then, the control unit 101 of the user terminal 10 adds a TCP / UDP header and an IP header to the communication packet and performs transmission processing (S15).

[0032] The filter driver 6 receives a communication packet (which may be called an interruption to transmission or a capture) (S20). Then, the packet determination unit 62 of the filter driver 6 executes a determination based on a first set condition for the communication packet received via the driver interface unit 61, for example (S25).

[0033] The first set condition is, for example, a determination condition regarding the TCP / UDP header and / or the IP header of the communication packet. The first set condition may be, for example, the following condition. (A1). Sending to a specified IP address. For example, if the destination IP address is the IP address (or IP address range) of the SaaS server 20, it is determined that the first set condition is met. Note that, for example, if the destination IP address is "localhost (127.0.0.1)", it may be determined that the first set condition is not met. (A2). Sending to a specified port number. For example, if the transmission is to port "80," it is determined that the first set condition is satisfied. Note that, for example, if the transmission is to port "443," it may also be determined that the first set condition is satisfied. (A3). Communication performed using a specified transport layer communication protocol. For example, if the communication is performed using the TCP protocol, it is determined that the first set condition is satisfied. Note that, for example, if the communication is performed using the UDP protocol, it may also be determined that the first set condition is satisfied. (A4) Transmissions made with a given IP protocol version. For example, if the communication is performed using IPv6, it is determined that the first set condition is satisfied. However, for example, if the communication is performed using IPv4, it may also be determined that the first set condition is satisfied. (A5) Any combination of the above conditions (A1) to (A4).

[0034] The first setting condition may be, for example, a determination condition based on inspection of the header of a communication packet, or may be, for example, a determination process based on information from layer 3 (network layer) and layer 4 (transport layer) of the OSI reference model.

[0035] If it is determined that the first setting condition is satisfied (S25: Condition satisfied), for example, the filter driver 6 drops the communication packet (S30). When the communication packet is dropped, the application regards the communication packet as having been successfully transmitted, but the communication packet requested by the application is not actually transmitted outbound. Then, the filter driver 6 generates (copies) a new communication packet based on the dropped communication packet, and transmits it to the local proxy 7 via the application interface unit 63 (S35).

[0036] Unlike this flow, the filter driver 6 may send the communication packet to the local proxy 7 instead of dropping it. In this case, the packet is re-transferred to another endpoint, which has the disadvantage of increasing the communication processing load, but the logic is simpler and therefore easier to implement.

[0037] The local proxy 7 receives the communication packet, for example, via the driver interface unit 71 (S40). Then, the packet analysis / modification unit 72 of the local proxy 7 executes a determination based on the second set condition on the communication packet received via the driver interface unit 71 (S45).

[0038] The second set condition is, for example, a determination condition regarding the header or payload (which may also be called data or body) in the application layer protocol of the communication packet. The second set condition may be, for example, the following condition. (B1). A determination regarding a given URI. (B1-1). Communication to a specified host (domain). For example, if the destination (destination) host name is "saas.example1.com.", it is determined that the second set condition is met. Note that if the destination host name contains a specific character string (for example, "saas"), it may also be determined that the second set condition is met. Also, if the destination host name matches a list containing multiple host names, it may also be determined that the second set condition is met. (B1-2). Communication carried out by a predetermined scheme. For example, if the scheme is "https", it is determined that the second setting condition is met. (B1-3). Communication containing predetermined user information. For example, if the URI contains user information "USER:PASS@", it may be determined that the second set condition is met. If the user information contains an arbitrary user name, it may be determined that the second set condition is met, or if the user information contains a specific user name, it may be determined that the second set condition is met. (B1-4). Communication involving a predetermined path. For example, if the URI contains the path " / ssologin / ", it may be determined that the second setting condition is met. (B1-5). Communications containing a given query or fragment. For example, if the URI contains "?key=login" or "#login", it may be determined that the second setting condition is met. (B1-6). Communication including a predetermined application layer communication protocol. For example, if the URI includes ":443" (HTTPS traffic) or ":80" (HTTP traffic), it may be determined that the second setting condition is met. (B1-7). Communications containing a given MIME type. For example, if the MIME type includes "application / pdf" or "text / html", it may be determined that the second setting condition is met. (B2) Communications regarding designated services. For example, if the traffic identification result for the payload is communication to a "cloud storage service" or communication to an "electronic seal service," it may be determined that the second set condition is satisfied. (B3) Any combination of the above conditions (B1) and (B2). Note that the second set condition may be determined by executing a pattern match using a signature.

[0039] The second setting condition may be, for example, a determination condition based on Deep Packet Inspection (DPI) that targets the payload (data) of a communication packet. The second setting condition may also be, for example, a determination process based on information from Layer 5 (Session Layer) to Layer 7 (Application Layer) of the OSI reference model.

[0040] If it is determined that the second setting condition is satisfied (S45: condition satisfied), for example, the packet analysis and modification unit 72 modifies the communication packet (S50). In modifying the communication packet, the packet analysis and modification unit 72 adds terminal information to the header of the communication packet (e.g., an HTTP header or a TLS record header). Note that the packet analysis and modification unit 72 may also modify the application layer payload of the communication packet (e.g., embedding terminal information, etc.). It may be said that the packet analysis and modification unit 72 modifies, for example, the application layer stack of the communication packet.

[0041] Here, the terminal information may include any of the following elements: Information about the driver proxy 5 of the user terminal 10 For example, information indicating that the driver proxy 5 is installed in the terminal 10. Information about the local IP address of the user terminal 10 For example, the private IP address before NAT conversion by a router, or the IP address of the router that has passed through. Identification information of the user terminal 10 For example, information about IMEI (International Mobile Equipment Identifier). Information about the status of the user terminal 10 For example, location information measured by GNSS using a location calculation information acquisition unit (not shown) provided in the user terminal 10. Also, for example, information related to applications installed in the user terminal 10 (such as a list of applications). Identification information regarding the user who is logged in to the user terminal 10 For example, user ID or group ID. The authentication method used when the user logs in to the user terminal 10 For example, password authentication, biometric authentication, multi-factor authentication, etc. Other information regarding the status of the user terminal 10 For example, information relating to the EEP (Endpoint Protection Platform) and EDR (Endpoint Detection and Response) that indicate the protection status of the user terminal 10.

[0042] The modification of the communication packet in the packet analysis / modification unit 72 may include, for example, the following operations. - Removal of headers and payload contents of communication packets. -Adding headers and payload contents of communication packets. - Modifying the header or payload contents of communication packets. Furthermore, the modification of the communication packet by the packet analysis / modification unit 72 may include issuing an additional communication packet.

[0043] The packet analysis and modification unit 72 may modify the communication packet so that, for example, a predetermined server (for example, a proxy server or an IDP server) is included in the communication path. Also, the packet analysis and modification unit 72 may modify the communication packet so that, for example, authentication information included in the communication packet is rewritten to authentication information for a specific account.

[0044] For example, when the communication packet is altered, the local proxy 7 transmits the altered communication packet to the filter driver 6 via, for example, the driver interface unit 71 (S55).

[0045] For example, if it is determined that the second set condition is not met (S45: condition not met), the local proxy 7 transmits the communication packet to the filter driver 6 without modifying it (S55).

[0046] The filter driver 6 receives a communication packet from the local proxy 7 via the application interface unit 63, for example (S60).

[0047] Then, the filter driver 6 transmits the communication packet to the network interface 2 via the driver interface unit 61, for example (S65).

[0048] For example, if it is determined that the first set condition is not met (S25: condition not met), the filter driver 6 transmits the communication packet to the network interface 2 without dropping it (S65).

[0049] When the network interface 2 receives a communication packet (S70), it refers to, for example, an ARP table and transmits the communication packet from the terminal 10 to an external device (S75).

[0050] FIG. 4 is a diagram showing an example of the flow of packet encapsulation in packet transmission processing based on the TCP / IP protocol stack.

[0051] For example, a communication packet generated in cloud application 8 based on a user operation on a user terminal of a user is input from cloud application 8 in the application layer to filter driver 6 in the internet layer via TCP / UDP 9 in the transport layer. If filter driver 6 determines that the first set condition is not satisfied, the communication packet is transmitted to the outside via network interface 2 in the network interface layer.

[0052] If the filter driver 6 determines that the first setting condition is satisfied, for example, the communication packet is dropped, the stack is broken, and the packet is sent to the local proxy 7. If the local proxy 7 determines that the second setting condition is satisfied, for example, the communication packet is modified and sent to the outside via the network interface 2. If the local proxy 7 determines that the second setting condition is not satisfied, for example, the communication packet is sent to the outside via the network interface 2 without being modified.

[0053] That is, for example, in the user terminal 10 using the driver proxy 5, the transmission paths of communication packets can be roughly divided into the following three paths. (C1): The route when the first set condition is not met. (C2-1): A route when the first set condition is satisfied and the second set condition is satisfied. (C2-2): A route when the first set condition is met but the second set condition is not met.

[0054] As described above, the first determination process for the first set condition can be performed based on inspection of the header portion of the communication packet, and is a determination process that operates in kernel mode 3. Therefore, the first determination process can be performed at high speed and with low load compared to the second determination process for the second set condition that operates in user mode 4 and is based on inspection of the payload. Therefore, the driver proxy 5 can select packets to be modified at high speed and with low load compared to applying DPI to all of the large number of communication packets sent from the user terminal 10.

[0055] FIG. 5 shows an example of a determination process in a combination of the first and second setting conditions. For example, in pattern (P01), if the destination IP address of the communication packet matches "xxxx" and the destination port is "80", the first set condition is met. Also, if the payload of the communication packet contains the character string "GET..." (URI), the second set condition is met. The IP address and port set as conditions may have a certain range (for example, IP address "xxxx / 24" or port "8000-8100"). Furthermore, the character string in the payload may be specified by, for example, a regular expression.

[0056] [Effects of the embodiment] In this embodiment, a user terminal 10 (an example of an information processing device on which an application is executed on an operating system) generates a communication packet for a SaaS server 20 or an IDP server 21 (an example of a first information processing device) based on a connection request (an example of IP communication processing) to a service in a cloud application 8 (an example of an application).The communication packet is then modified based on a first set condition and a second set condition for the communication packet.The present embodiment also illustrates an example of a configuration in which the modified packet or an unmodified packet (an example of a communication packet) is transmitted to the first information processing device. According to this, the information processing device can modify a communication packet for the first information processing device based on the first set condition and the second set condition and transmit the modified packet.

[0057] In addition, this embodiment shows an example of a configuration in which the first setting condition includes a condition regarding the IP header and / or the TCP / UDP header of the communication packet, and the second setting condition includes a condition regarding the TCP / UDP payload of the communication packet. This makes it possible to distinguish between the judgment conditions relating to the IP header in the internet layer and the TCP / UDP header in the transport layer and the judgment conditions relating to the payload in the transport layer and the application layer.

[0058] In addition, this embodiment shows an example of a configuration in which there are kernel mode and user mode operating modes, and the judgment process based on the first setting condition is executed in kernel mode, and the judgment process based on the second setting condition is executed in user mode. This allows the first setting condition, which is easy to judge, to be judged in kernel mode, and the second setting condition, which is more complicated to judge than the first setting condition, to be judged, thereby achieving both implementation feasibility and processing optimization.

[0059] Furthermore, this embodiment shows an example of a configuration in which the first setting condition includes a condition related to the IP address and port of the first information processing device. This makes it possible to realize a determination according to the communication destination IP address and port of the information processing device.

[0060] Furthermore, this embodiment shows an example of a configuration in which the second setting condition includes a condition related to a communication protocol or a URI written in the payload. This makes it possible to realize a judgment based on the inspection results of the communication protocol, payload, etc. of the communication packet.

[0061] Furthermore, this embodiment shows an example of a configuration in which the modification includes modification relating to the addition of terminal information (an example of device information relating to the state of an information processing device) to a communication packet. This allows the information processing device to add device information to a communication packet based on the first setting condition and the second setting condition.

[0062] In addition, this embodiment shows an example of a configuration in which the device information includes information based on the authentication method used when the user logged in (an example of authentication information of an information processing device), or location information measured by GNSS or an IP address (an example of location information of an information processing device). This allows the device information to include authentication information, location information, and the like of the information processing device.

[0063] [Processing Procedure in the Example of the Cloud Service System] FIG. 6 is a flowchart showing an example of a processing procedure of the cloud service system 1 using the driver proxy 5 or the user terminal 10 in which the driver proxy 5 is built.

[0064] For example, in the cloud service system 1, first, the administrator terminal 11 and the server system execute a service usage restriction setting process (S100).

[0065] FIG. 7 shows an example of a flowchart of the service usage restriction setting process. In the following, for example, an example of using a cloud storage service provided by the first SaaS server 20A will be shown, but similar processing can also be performed for services provided by other SaaS servers.

[0066] First, the control unit 111 of the administrator terminal 11 accesses the web server 23 based on, for example, a user operation on the web browser 8Z. Then, the administrator terminal 11 transmits a login request to the setting information management database server 22 via the web server 23. For example, when the setting information management database server 22 authenticates the login request, the setting information management database server 22 authorizes the login (operation) from the administrator terminal 11 via the web server 23 (S110).

[0067] The administrator terminal 11 may be able to log in to the setting information management database server 22 by using, for example, a dedicated application. For example, the setting information management database server 22 may be a server that includes the functions of a web server 23 as a front end.

[0068] The administrator terminal 11 acquires the management setting information based on, for example, a user operation on the web browser 8Z. Then, the administrator terminal 11 transmits the management setting information to the setting information management database server 22 via, for example, the web server 23 (S120).

[0069] FIG. 8 shows an example of the management setting information. The management setting information is composed of, for example, user terminal type definition data and operation authority setting data for each SaaS (in the example of Figure 8, first SaaS operation authority setting data for the first SaaS server 20A and second SaaS operation authority setting data for the second SaaS server 20B).

[0070] The user terminal type definition data is, for example, data relating to the terminal type of the user terminal 10 based on the terminal information of a packet transmitted from the user terminal 10. The user terminal type definition data stores, for example, a terminal type ID and terminal information conditions (in this example, terminal information condition 1 based on terminal information related to user authentication and terminal information condition 2 based on identification information of the user terminal 10) in association with each other. The terminal type ID is identification information relating to the type of the user terminal 10 determined based on the terminal information attached to the packet transmitted from the user terminal 10 and the terminal information condition. For example, if the terminal information attached to the packet matches terminal information condition 1 and terminal information condition 2, the set terminal type ID is assigned to the user terminal 10 that sent the packet.

[0071] In Figure 8, for example, the user terminal 10 assigned to the terminal type ID "C101" is a terminal that "User A" has used (logged in to) by performing "biometric authentication" on the user terminal 10, and the identification information of the user terminal 10 is the identification information of a terminal that has been specified (registered) in advance. Also, for example, the user terminal 10 assigned to the terminal type ID "C103" is a terminal that "User A" has used by performing "password authentication" on the user terminal 10, and the identification information of the user terminal 10 is identification information other than that of a terminal that has been designated (registered) in advance. The same applies to other terminal type IDs. That is, the user terminal 10 corresponding to the terminal type ID "C101" can be identified as a terminal that has been authenticated and managed more strictly than the user terminals 10 corresponding to the terminal type IDs "C102" and "C103." Also, it can be identified that the degree of authentication and management for a certain user A becomes laxer in the order of terminal type ID "C101," terminal type ID "C102," and terminal type ID "C103."

[0072] In addition, in the terminal information condition 1, it may be possible to specify a user group including the user to be authenticated, rather than an individual user.

[0073] The first SaaS operation authority setting data is data for setting authority for each operation (file operation and folder operation in the cloud storage service) in SaaS (in this example, cloud storage service) based on the terminal type ID of the user terminal 10 determined according to the user terminal type definition data. The first SaaS operation authority setting data stores, for example, an operation authority ID, an operation authority, a terminal type ID, and additional terminal information conditions in association with each other.

[0074] The operation authority type ID is identification information related to operation authority. For example, in a cloud storage service, operation authority according to the operation authority type ID may be granted to a file or folder, thereby enabling restriction setting of operation authority for the file or folder.

[0075] The operation authority may be set, for example, according to the setting operation on the administrator terminal 11, to "read and write allowed," which allows any operation as access authority to a file or folder, "read allowed," which allows reading (viewing) but does not allow writing or overwriting, or "not readable," which does not allow both reading and writing operations.

[0076] The terminal type ID is set and stored in association with the terminal type ID defined in the user terminal type definition data according to the user terminal 10 to be associated with the operation authority type ID, for example, by a setting operation on the administrator terminal 11.

[0077] The additional terminal information condition stores terminal information conditions that are defined when granting operation authority based on terminal information other than the terminal information conditions in the user terminal type definition data.

[0078] 8, for example, it is shown that the operation authority with the operation authority type ID "M101" is a read / write operation authority, and that this operation authority is granted to a user terminal 10 determined to have a terminal type ID of "C101." It is also shown that the operation authority with the operation authority type ID "M102" is granted when the terminal is determined to have a terminal type ID of "C101" or "C201" and satisfies the additional terminal information condition "predetermined location information (for example, when the terminal location is in a predetermined workplace)."

[0079] The same applies to the second SaaS operation authority setting data for setting operation authority in the electronic signature service. In the second SaaS operation authority setting data, the operation authority with the operation authority type ID "N103" indicates that operation is possible regardless of the terminal type ID (terminal type is D / C (Don't Care)).

[0080] In this way, the user of the administrator terminal 11 can flexibly assign operation rights (access rights) for services provided by each SaaS (e.g., cloud storage services) according to the terminal type ID assigned based on the degree of authentication and management of the user terminal 10.

[0081] The user terminal type definition data may be defined for each SaaS that can be set in the administrator terminal 11, for example.

[0082] Returning to FIG. 7, when the setting information management database server 22 receives the management setting information from the administrator terminal 11 (S130), it stores the received management setting information in the setting management database and updates it (S140).

[0083] Returning to FIG. 6, in the cloud service system 1, the user terminal 10 and the server system execute a service login process (S200).

[0084] FIG. 9 shows an example of a flowchart of the service login process. First, the control unit 101 of the user terminal 10 transmits service login request information to the first SaaS server 20A, for example, based on a user operation on the cloud application 8A (S210). The login request information may include, for example, authentication information required to log in to the cloud storage service (e.g., an account ID and password for the cloud storage service). Note that the authentication information required for authentication to use the user terminal 10 and the authentication information required to log in to the cloud storage service may be different information (different user IDs, account IDs, and passwords). For example, a packet of login request information sent by a user terminal 10 incorporating a driver proxy 5 to a first SaaS server 20A is assigned terminal information by satisfying the first and second setting conditions described above.

[0085] When receiving login request information from the user terminal 10, the first SaaS server 20A sends (transfers) SaaS account authentication request information including, for example, the account ID of the cloud storage service included in the login request information and terminal information to the IDP server 21 (S220).

[0086] Then, the IDP server 21 executes login authentication to the cloud storage service based on, for example, the SaaS account authentication request information, and determines whether or not authentication is possible (S230). The IDP server 21 may, for example, cooperate with an IDaaS server (not shown) to determine whether or not login to the cloud storage service is permitted. Furthermore, the IDP server 21 may perform login authentication only when, for example, the SaaS account authentication request information includes terminal information.

[0087] If the login authentication to the cloud storage service is successful (S230: authentication successful), the IDP server 21 transmits, for example, setting information acquisition request information including the terminal information of the SaaS account authentication request information to the setting information management database server 22 (S240). Then, the setting information management database server 22, for example, refers to the user terminal type definition data stored in the setting management database and checks the terminal information in the setting information acquisition request information to determine the terminal type ID of the user terminal 10. Then, the setting information management database server 22 transmits setting information including, for example, the first SaaS operation authority setting data and the terminal type ID to the IDP server 21 (S250).

[0088] For example, when the IDP server 21 receives the setting information from the setting information management database server 22, the IDP server 21 transmits the received setting information to the first SaaS server 20A (S260). Then, the first SaaS server 20A executes, for example, a setting change process (S270). In the setting change process, the first SaaS server 20A updates the settings of the operation authority for each operation authority type ID and the terminal type ID of the user terminal 10 that holds the authority, for example, based on the first SaaS operation authority setting data of the received setting information.

[0089] For example, when the first SaaS server 20A executes the setting change process, it transmits to the user terminal 10 login success information indicating that the cloud storage service is now available (S280).

[0090] If login authentication to the cloud storage service fails (S230: authentication failed), for example, the first SaaS server 20A ends the service login process. The first SaaS server 20A may transmit to the user terminal 10 login failure information indicating that login to the cloud storage service has failed.

[0091] 6, for example, when the user terminal 10 receives the login success information, it determines that the login to the cloud storage service has been successful (S300: YES). Then, in the cloud service system 1, the user terminal 10 and the first SaaS server 20A execute the service usage process (S400).

[0092] FIG. 10 shows an example of a flowchart of the service usage process. The user terminal 10 transmits operation request information such as file browsing or file updating to the first SaaS server 20A based on, for example, a user operation on the cloud application 8A (S410). For example, a packet of operation request information sent by a user terminal 10 incorporating a driver proxy 5 to a first SaaS server 20A may be assigned terminal information by satisfying the first and second setting conditions described above.

[0093] When receiving operation request information from the user terminal 10, the first SaaS server 20A determines whether to accept the operation requested by the user terminal 10, for example, based on the operation authority type ID associated with the operation target and the terminal type ID of the user terminal 10 (S420). The operation of linking an operation authority type ID to an operation target (for example, a permission setting operation for a file or folder) may be executed from the administrator terminal 11, or may be executed from the user terminal 10 corresponding to a specific operation authority type ID (for example, the operation authority "permission setting"). Furthermore, multiple operation authority type IDs may be linked to one operation target (for example, one file).

[0094] If it is determined that the operation target can be operated based on the terminal type ID of the user terminal 10 (S420: possible), the first SaaS server 20A executes the operation processing based on the operation request information (S430). Then, the first SaaS server 20A transmits operation result information including the processing result of the operation processing to the user terminal 10 (S440). When receiving the operation result information from the first SaaS server 20A, the user terminal 10 outputs, for example, the operation result information (for example, as a display output on a display unit (not shown) or as a sound output on a sound output unit (not shown)) (S450).

[0095] If it is determined that the operation target is inoperable based on the terminal type ID of the user terminal 10 (S420: inoperable), the first SaaS server 20A sends, for example, inoperable information to the user terminal 10 indicating that the operation based on the operation request information cannot be performed on the operation target (S460). When receiving the inoperable information from the first SaaS server 20A, the user terminal 10 outputs, for example, the inoperable information (S470).

[0096] For example, consider the case where user A logs in with password authentication to the user terminal 10A designated by the administrator terminal 11. This user terminal 10A is set to a terminal type of "C102" based on the terminal information condition. In this case, for example, the first SaaS server 20A determines that the access operation from the user terminal 10A to the folder set with the operation authority type ID "M101" is inoperable. In this case, for example, the first SaaS server 20A determines that a write operation from the user terminal 10A to a file set with the operation authority type ID "M102" is possible if the location information of the user terminal 10A is in a specified position (within a specified range), and determines that the operation is not possible if the location information is outside the specified position (outside the specified range).

[0097] 6, the cloud service system 1 determines, for example, whether to end the process (S900). If it determines not to end the process (S900: NO), the cloud service system 1 returns the process to, for example, the service use authority setting process. When it is determined that the process should be ended (S900: YES), the cloud service system 1 ends the process.

[0098] [Effects of the Example] In this embodiment, the SaaS server 20, the IDP server 21, and the setting information management database server 22 (an example of a server system) that communicate with the user terminal 10 (an example of a first terminal) acquire management setting information (an example of first information related to the usage settings of the server system) and update the setting management database based on the first information (an example of usage setting processing related to a service provided by the server system). Also, an example of a configuration is shown in which login request information and operation request information (an example of second information) related to a request to use the server system are received from the first terminal, and if the second information includes device information, service login processing based on the login request information and operation processing based on the operation request information (an example of authorization processing for authorizing an operation related to the second information) are executed based on the setting information (an example of first authorized setting) based on the first information and the terminal information (an example of device information). According to this, when the second information received from the first terminal includes device information, the server system can authorize operations related to the second information based on a first authorization setting based on the first information and the device information. That is, in the first terminal, an operation relating to the second information can be authorized based on the fact that the device information is assigned based on the first setting condition and the second setting condition.

[0099] Moreover, this embodiment shows an example of a configuration in which the first information is transmitted by the administrator terminal 11 (an example of a second terminal that manages the first terminal). This allows the first authorization setting for the first terminal to be set by the second terminal.

[0100] [Variation (1)] In the above embodiment, the driver proxy 5 is incorporated into the user terminal 10, but the present invention is not limited to this. For example, if the driver proxy 5 is incorporated in the administrator terminal 11, the setting information management database server 22 or the web server 23 may execute login authentication to the setting information management database server when, for example, predetermined information (for example, terminal information of the administrator terminal 11) is included in the header of a packet related to a login request. For example, the setting information management database server 22 may authorize login to the setting information management database server 22 when it determines that the terminal information of the administrator terminal 11 is preset terminal information (for example, a predetermined IMEI registered as a terminal owned by the administrator).

[0101] Note that the setting information management database server 22 may be configured to, for example, execute a process of updating the setting management database based on the management setting information when predetermined information is included in the header of a packet related to the management setting information.

[0102] Furthermore, the setting information management database server 22 may authorize login and setting management database update processing when, for example, the authentication status or location information of the administrator terminal 11 is in a predetermined state.

[0103] This allows the administrator terminal 11 to set the operation authority for the user terminal 10 when the administrator terminal 11 is a specified terminal or when the terminal is in a specified state. This improves security regarding setting changes related to usage restrictions on the server system.

[0104] [Variation (2)] In the above embodiment, in the service login process, the user terminal 10 transmits login request information to the SaaS server 20 such as the first SaaS server 20A, but this is not limiting. For example, the user terminal 10 may be configured to be able to log in to multiple SaaS servers 20 at once using single sign-on. In this case, for example, the user terminal 10 may be configured to transmit login request information to the IDP server 21. When the single sign-on authentication is successful, the IDP server 21 may be configured to transmit SaaS selection request information to the user terminal 10 to allow the user to select a SaaS to use. When the user terminal 10 receives the SaaS selection request information from the IDP server 21, the user terminal 10 selects a SaaS (e.g., a cloud storage service) to be used, for example, based on a user operation on the SaaS selection request information. Then, the user terminal 10 transmits SaaS selection information including the selected service to the IDP server 21. Note that the user terminal 10 may be able to select multiple SaaSs. The IDP server 21 may then send operation authority setting data (e.g., first SaaS operation authority setting data) corresponding to the terminal type ID of the user terminal 10 for which login authentication has been successful to the SaaS server 20 (e.g., cloud storage service) specified in the SaaS selection information.

[0105] As a result, the user terminal 10 can execute single sign-on to set appropriate operation authority for a plurality of SaaS servers 20 for which the user terminal 10 has operation authority, and use the servers.

[0106] [Variation (3)] In the above embodiment, an example in which operation authority is granted according to terminal information in SaaS is illustrated, but the present invention is not limited to this. For example, the terminal information may be information (referred to as "driver operation information") indicating that the driver proxy 5 is installed in the user terminal 10 (that the driver proxy 5 is operating). For example, in the service login process, the IDP server 21 may apply the first authorization setting if the login request information includes terminal information (login from the user terminal 10 on which the driver proxy 5 is running), and may apply the second authorization setting, which is different from the first authorization setting, if the login request information does not include terminal information. For example, the first SaaS operation authority setting data in the management setting information may allow the operation authority to be readable and writable if the terminal information includes driver operation information. Alternatively, the first SaaS operation authority setting data may allow the operation authority to be readable if the terminal information does not include driver operation information or if the terminal information itself cannot be detected. In this example, the first authorization setting may allow the operation authority to be readable and writable, and the second authorization setting may allow the operation authority to be readable.

[0107] That is, for example, different authorization settings may be applied in SaaS to a user terminal 10 that is a company terminal on which a driver proxy 5 is running and a user terminal 10 that is a BOYD (Bring Your Own Device) on which a driver proxy 5 is not running.

[0108] This modified example shows an example of a configuration in which, when the login request information (an example of second information) does not include terminal information (an example of device information), authorization processing is performed based on a second authorization setting that is different from the first authorization setting. According to this, when the second information does not include device information, the authorization process can be executed by applying the second authorization setting that is different from the first authorization setting.

[0109] [Variation (4)] The authentication information required for user authentication to use the user terminal 10 (referred to as "terminal authentication information") and the authentication information required for logging in to the cloud storage service (referred to as "cloud authentication information") may be different information (different user IDs, account IDs, and passwords). 9, for example, the user terminal 10 incorporating the driver proxy 5 transmits login request information to the SaaS server 20 (S210). For example, the login request information is assigned cloud authentication information and terminal information including terminal authentication information by satisfying the first setting condition and the second setting condition.

[0110] The IDP server 21 authenticates the login to the SaaS server 20 based on, for example, the cloud authentication information (S230: authentication successful). In addition, the IDP server 21 transmits, for example, setting information acquisition request information including the terminal authentication information to the setting information management database server 22 (S240). The setting information management database server 22 refers to the user terminal type definition data and checks the terminal authentication information to determine the terminal type ID of the user terminal 10. In this case, the terminal type ID may be determined based on the terminal authentication information.

[0111] That is, even when the same cloud authentication information is used to log in to the SaaS server 20, different terminal authentication information in the user terminal 10 can result in different operation permissions for the services provided by the SaaS server 20. For example, if a user logs in to the user terminal 10 with the account of "User A" and authenticates using the account of "User X" to log in to the SaaS server 20, file write permission is granted. On the other hand, if a user logs in to the user terminal 10 with the account of "User B" and authenticates using the same account of "User X" to log in to the SaaS server 20, file write permission is not granted. This type of operation permission setting can be realized.

[0112] [Variation (5)] The terminal information added to the packet by the user terminal 10 incorporating the driver proxy 5 is not limited to being used in the service login process. For example, in the service usage process, the SaaS server 20 may verify the terminal information (e.g., IMEI, etc.) attached to the operation request information, and if it determines that the terminal is the same as the user terminal 10 used in the service login process, it may determine whether to accept the operation requested by the user terminal 10. This helps prevent hacking such as session hijacking that occurs after logging in to a cloud application.

[0113] The SaaS server 20 may update the terminal type ID of the user terminal 10 each time, for example, based on the terminal information attached to the operation request information. This allows appropriate application of operation authority settings according to the usage status of the user terminal 10, for example, when the user terminal 10 incorporating the driver proxy 5 is moved after logging in to the service and the location information changes.

[0114] Furthermore, when the SaaS server 20 receives operation request information from the user terminal 10, the SaaS server 20 may acquire setting information from the setting information management database server 22 via the IDP server 21. Then, for example, the SaaS server 20 may determine whether or not the operation can be performed on the user terminal 10 based on the terminal type ID of the user terminal 10 based on the operation request information and the acquired setting information. As a result, for example, when the user terminal 10 makes an operation request, the SaaS server 20 can immediately reflect the management setting information updated by the administrator terminal 11 as setting information. As a result, the operation authority setting for the service set by the user of the administrator terminal 11 can be immediately reflected in the service provided by each SaaS server 20. [Explanation of symbols]

[0115] 1. Cloud Service System 5 Driver Proxy 6 Filter Drivers 7. Local Proxy 8. Cloud Applications 10 User terminal 11 Administrator terminal 20 SaaS servers 21 IDP Server 22 Configuration information management database server 23 Web Server

Claims

1. A program executed by an information processing device that executes an application on an operating system, generating a communication packet for a first information processing device different from the information processing device based on an IP communication process in the application; modifying the communication packet based on a first set condition and a second set condition for the communication packet; transmitting the communication packet to the first information processing device; A program that executes the following.

2. 2. The program according to claim 1, the first setting condition includes a condition regarding an IP header and / or a TCP / UDP header of the communication packet, the second setting condition includes a condition regarding a TCP / UDP payload of the communication packet; program.

3. 3. The program according to claim 2, There are two operating modes: a kernel mode in which an instruction set for operating the operating system can be executed, and a user mode in which a part of the instruction set can be executed. the determination process based on the first setting condition is executed in the kernel mode, the determination process based on the second setting condition is executed in the user mode. program.

4. 3. The program according to claim 2, the first setting condition includes a condition related to an IP address and / or a port of the first information processing device; program.

5. 3. The program according to claim 2, the second setting condition includes a condition related to a communication protocol and / or a URI described in the payload; program.

6. 2. The program according to claim 1, The modification includes modification of the assignment of device information regarding the status of the information processing device to the communication packet. program.

7. 7. The program according to claim 6, The device information includes authentication information of the information processing device or information based on location information of the information processing device. program.

8. A program executed by a server system that communicates with a first terminal that executes the program according to claim 6, obtaining first information regarding a usage setting of the server system; Executing a usage setting process for a service provided by the server system based on the first information; receiving second information related to a request to use the server system from the first terminal; If the second information includes the device information, executing an authorization process to authorize an operation related to the second information based on a first authorization setting based on the first information and the device information; A program that executes the following.

9. 9. The program according to claim 8, If the second information does not include the device information, performing the authorization process based on a second authorization setting different from the first authorization setting; A program that executes the following.

10. 9. The program according to claim 8, The first information is transmitted by a second terminal that manages the first terminal. program.

11. 1. An information processing method executed by an information processing device that runs an application on an operating system, comprising: generating a communication packet for a first information processing device different from the information processing device based on an IP communication process in the application; modifying the communication packet based on a first set condition and a second set condition; transmitting the communication packet to the first information processing device; Includes.

12. An information processing device in which an application is executed on an operating system, The control unit of the information processing device generating a communication packet for a first information processing device different from the information processing device based on an IP communication process in the application; modifying the communication packet based on a first set condition and a second set condition; The communication packet is transmitted to the first information processing device.

Images