Information processing apparatus and program

Abstract

To apply user data in a more suitable mode according to a policy of a movement destination even in a situation where movement occurs between regions having different policies applied when using Web content.SOLUTION: The latest region specifying unit 107 specifies the first region in which the latest user data of the user who is the request source of the connection request is held. The policy acquisition unit 103 acquires a browser use policy of the second region in which the information processing apparatus is deployed. The user data acquisition unit 106 acquires the user data held in the first region. The user data selection unit 105 selects at least a part of the user data based on the browser use policy acquired from the acquired user data. After the rendering of the Web content based on the selected user data is executed, the update region registration unit 109 registers the second region as a region in which the latest user data is held.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an information processing device and a program. [Background technology]

[0002] Conventionally, when web content stored on a web server is displayed on a client such as a PC or smartphone, a web browser running on the client is often used. As disclosed in Patent Document 1, web browsers generally use user data such as cookies for sending and receiving user credential information and cached information of acquired images. In addition, web browsers can set browser usage policies for handling user data in accordance with the execution environment, such as prohibiting the use of third-party cookies for advertising or not saving cache data.

[0003] On the other hand, in a client with limited resources, such as a small printer, it may be difficult to run a web browser. As an example of a means for displaying web content on such a client, web browser technologies such as cloud-based web browsers that perform rendering processing in the cloud, RBI (Remote Browser Isolation), etc. are provided. Such rendering technologies enable the client to obtain rendering results as images via a network and display the rendering results on the screen of a display device, etc. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2017-102675 Summary of the Invention [Problem to be solved by the invention]

[0005] Cloud-based web browsers render web content in a cloud environment, so the user data used for rendering is stored in the cloud environment. However, in typical cloud environments, the execution environment is separated into geographical divisions known as regions. As a result, clients using cloud-based web browsers typically connect to a cloud environment in the same region as the client to minimize geographical network latency. In such a situation, if a user moves to a different region, the region of the cloud environment connected to by the client will also change. Therefore, to maintain the usability of the web browser after the move (e.g., by using cookies to avoid credential entry and by caching to speed up display), it may be necessary to move or copy user data from the source region to the destination region. On the other hand, clients in each region may have different browser usage policies regarding the management of user data depending on the installation environment and purpose. In such a situation, if user data from the cloud environment used by the source client is moved or copied as is to the destination cloud environment, the destination client may end up using data that violates the browser usage policy.

[0006] In consideration of the above problems, the present invention aims to make it possible to apply user data in a more suitable manner depending on the policy of the destination, even in situations where movement occurs between regions where different policies are applied when using web content. [Means for solving the problem]

[0007] The information processing device of the present invention is an information processing device that controls the rendering of web content, and is characterized by having a region identification means that identifies a first region in which the latest user data of a user who is the source of a connection request is held, a policy acquisition means that acquires a browser usage policy of a second region in which the information processing device is deployed, a user data acquisition means that acquires the user data held in the first region identified by the region identification means, a user data selection means that selects at least a portion of user data from the user data acquired by the user data acquisition means based on the browser usage policy acquired by the policy acquisition means, and a registration means that registers the second region as the region in which the latest user data is held after rendering of web content based on the user data selected by the user data selection means is performed. [Effects of the Invention]

[0008] According to the present invention, even in a situation where a user moves between regions where different policies are applied when using Web content, it is possible to apply user data in a more suitable manner according to the policy of the destination. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating an example of a configuration of an information processing device. [Figure 2] 1 is a flowchart showing an example of a configuration of an information processing device. [Figure 3] 10A and 10B are diagrams illustrating an example of a browser usage policy and user data. [Figure 4] FIG. 1 is a diagram illustrating an example of a configuration of an information processing device. [Figure 5] 1 is a flowchart showing an example of a configuration of an information processing device. [Figure 6] FIG. 1 is a diagram illustrating an example of a configuration of an information processing device. [Figure 7]1 is a flowchart showing an example of a configuration of an information processing device. [Figure 8] FIG. 10 is a diagram illustrating an example of a table related to management of security constraints. DETAILED DESCRIPTION OF THE INVENTION

[0010] Preferred embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. In this specification and drawings, components having substantially the same functional configurations are designated by the same reference numerals, and redundant description will be omitted. The embodiment described below shows an example of a specific implementation of the present invention, and is one of the specific embodiments of the configurations described in the claims.

[0011] First Embodiment An information processing device according to a first embodiment of the present disclosure will be described below. 1, an example of the configuration of a rendering processing device 100, which corresponds to an example of an information processing device according to this embodiment, will be described together with the configuration of an information processing system including the rendering processing device 100. The rendering processing device 100, client device 120, Web server 140, and data storage device 150 are connected to each other via a network such as a LAN (Local Area Network) or the Internet so that they can send and receive data to and from each other.

[0012] The rendering processing device 100 receives a request from a client device 120 and executes processing corresponding to the request. Details of the processing by the rendering processing device 100 will be described together with details of the configuration of the rendering processing device 100. The rendering processing device 100 may be realized by, for example, a PC, a server, and a network service. Examples of the network service include cloud computing services such as EC2 provided by Amazon Web Services, Inc. (AWS). There may be multiple rendering processing devices 100, and each of the series of rendering processing devices 100 may be located in a different geographical region and assigned a different network address.

[0013] The client device 120 connects to the rendering processing device 100 and requests rendering of web content stored in the web server 140 using a communication protocol such as HTTP. A plurality of client devices 120 may be included, in which case different network addresses are assigned to each of the client devices 120. The client device 120 may be realized by a device such as a PC, a tablet, a smartphone, or a printer. The display device 130 is connected to the client device 120 and is configured to be able to display images transmitted from the client device 120 .

[0014] The Web server 140 transmits Web content in response to a request from the rendering processing device 100. The Web server 140 can be realized by, for example, a PC, a server, or a cloud computing service such as EC2. The data storage device 150 is connected to the rendering processing device 100 and stores the region of the rendering processing device 100 that each user last used. The data storage device 150 can be realized, for example, by a DB server or a database service such as DynamoDB (registered trademark) provided by AWS. Note that DynamoDB makes it possible to reference data from different regions by using a function called a global table.

[0015] Next, the configuration of the rendering processing device 100 will be described. The CPU 101 controls the overall operation of the rendering processing device 100. The memory 102 provides a working area that the CPU 101 uses when executing various processes. 1, components other than the CPU 101 and the memory 102 may be realized as hardware or software. When components other than the CPU 101 and the memory 102 are realized as software, the components may be realized, for example, by the CPU 101 loading a program stored in a predetermined storage area into the memory 102 and executing the program. Details of each of the components other than the CPU 101 and the memory 102 will be described separately below with reference to FIG. 2, along with the processing of the rendering processing device 100. In this embodiment, for convenience, the rendering processing device 100, the client device 120, the display device 130, the Web server 140, and the data storage device 150 are assumed to be realized as different devices. However, the configuration shown in Fig. 1 is merely an example and does not necessarily limit the configuration of an information processing system including the rendering processing device 100 according to this embodiment. For example, the functions of two or more devices among the series of devices shown in Fig. 1 may be realized by a single device.

[0016] Referring to Figure 2, an example of processing by the rendering processing device 100 according to this embodiment will be described, focusing particularly on the processing of components other than the CPU 101 and memory 102 among the components of the rendering processing device 100 shown in Figure 1.

[0017] In S201, the rendering processing device 100 receives a connection request to the Web server 140 from the client device 120. In S202, the user identification unit 104 identifies the user who is the request source of the connection request received in S201. The user identification unit 104, i.e., the configuration related to identifying the user who is the request source of the connection request, can be realized, for example, by an authentication service such as Cognito provided by AWS. Note that the process related to identifying the user using the authentication service can be realized by known technology, so a detailed description will be omitted. In addition, the method is not particularly limited as long as it is possible to identify the user who is the request source of the connection request to the Web server 140 received from the client device 120.

[0018] In S203, the latest region identification unit 107 identifies the region in which the rendering processing device 100 that last updated the user data is deployed. In the information processing system according to this embodiment, the data storage device 150 manages in a table the region in which the latest user data is stored for each user. However, as long as it is possible to identify the region in which the latest user data is stored for each user, the method for doing so is not particularly limited. As a specific example, the region in which the latest user data is stored may be identified by using the data storage history, etc. For example, Fig. 3(D) shows an example of a region management table for managing the region where the latest user data is saved. In the region management table, a user identifier for identifying each user and information indicating the region where the latest user data is saved (hereinafter also referred to as a saved region) are associated and managed. The region identified by latest region identifying unit 107 corresponds to an example of a first region in which the latest user data of the user who is the source of the connection request is stored.

[0019] In S204, the latest region identifying unit 107 determines whether or not its own region (the region in which the rendering processing device 100 having the latest region identifying unit 107 is deployed) is the latest. If the latest region identification unit 107 determines in S204 that the current region is not the latest, the process proceeds to S205. On the other hand, if the latest region identification unit 107 determines in S204 that the current region is the latest, the process proceeds to S208. In this case, the processes of S205 to S207 are skipped.

[0020] In S205, the policy acquisition unit 103 acquires a browser usage policy from the client device 120. An example of a browser usage policy is a usage policy for cookies, image cache data, etc., set in a web browser application such as Chrome® provided by Google® Inc. Other examples of usage policies include prohibiting the use of third-party cookies used in advertisements, etc., and rules such as clearing the cache when closing the web browser so that data is not saved. In S206, the user data acquisition unit 106 acquires user data from the latest region. In S207, the user data selection unit 105 selects user data that matches the browser usage policy acquired in S205 from the user data acquired in S206.

[0021] Fig. 3(A) shows an example of a table to be referred to when selecting user data by the user data selection unit 105. In the table shown in Fig. 3(A), for each browser usage policy, the type of user data to which the browser usage policy applies and a check function for determining whether the user data conforms to the browser usage policy are associated and managed. Note that, as long as the user data selection unit 105 can select user data that matches the browser usage policy, the method is not necessarily limited to the method using the table exemplified in Fig. 3(A). As a specific example, the user data selection unit 105 may select user data that matches the browser usage policy by using a check script. 3(B) shows an example of user data acquired by the user data acquisition unit 106. The identifier indicates an identifier assigned to identify each individual user data. The data type indicates the data type of the target user data. The data attribute indicates the data attribute set for the target user data. In this embodiment, the user data is shown as a table as shown in Fig. 3(B), but the data format of the user data is not limited to this. As a specific example, the data format of the user data may be JSON, XML, or the like. Figure 3(C) shows an example of the check function described with reference to Figure 3(A), expressed in C language, showing the processing of the check function related to prohibiting third-party cookies. When the data type and data attribute shown in Figure 3(B) are passed as arguments to the check function shown in Figure 3(C), if the data type is a cookie and the connection destination and issuer domains are different, the check function returns false, indicating that the policy does not match. Furthermore, if the above conditions are not met, the check function returns true, indicating that the policy is matched.

[0022] In S208, the rendering unit 108 saves the user data that matches the policy, and then acquires Web content using the saved user data. The rendering unit 108 then renders the acquired Web content and transmits the rendering result to the client device 120. In S209, the updated region registration unit 109 updates the information of the saved region corresponding to the target user in the latest region management table illustrated in FIG. 3(D) to the information of its own region. The region (local region) that is the target of updating the information in the latest region management table by the update region registration unit 109 corresponds to an example of the second region.

[0023] <Second embodiment> An information processing device according to a second embodiment of the present disclosure will be described below. In the first embodiment described above, after Web content is acquired using user data acquired from another region, the updated region registration unit 109 registers the user data of the destination region as the latest. On the other hand, if the region in which the user uses the browser is almost fixed and the movement is only temporary, such as in the case of a business trip, even if the latest user data is saved in the destination region, that region may not be used from the next time onwards. In consideration of the above situation, this embodiment proposes a mechanism that, when a region that is normally used is determined, suppresses the movement of user data the next time the browser is used by reflecting user data updated at the reference destination in the source region.

[0024] An example of the configuration of a rendering processing device 100 according to this embodiment will be described with reference to Fig. 4. The configuration shown in Fig. 4 differs from the configuration shown in Fig. 1 in that it includes a user data update unit 401 that saves used user data in the source region. Therefore, in this embodiment, various explanations will be given focusing on the parts that are different from the first embodiment described above, and detailed explanations of parts that are substantially the same as those in the first embodiment will be omitted.

[0025] An example of the processing of the rendering processing device 100 according to this embodiment will be described with reference to Fig. 5. The series of processing shown in Fig. 5 differs from the series of processing shown in Fig. 2 in that the processing of S501 to S504 has been added. Therefore, the series of processing shown in Fig. 5 will be described focusing particularly on the processing of S501 to S504, and detailed description of the other processing will be omitted. After the rendering unit 108 transmits the rendering result to the client device 120 in S208, the user data update unit 401 determines in S501 whether or not the user data has been acquired from the source region. If the user data update unit 401 determines in S501 that the user data has been acquired from the source region, the process proceeds to S502. On the other hand, if the user data update unit 401 determines in S501 that the user data has not been acquired from the source region, the process proceeds to S211. In this case, the processes of S502 to S504 are skipped.

[0026] In S502, the policy acquisition unit 103 acquires a browser usage policy from the client device 120 of the source region. In this embodiment, the browser usage policy is acquired directly from the client device 120 of the source region, but the route for acquiring the browser usage policy is not particularly limited. As a specific example, the policy acquisition unit 103 may acquire the target browser usage policy via the rendering processing device 100 of the source region. In S503, the user data selection unit 105 selects user data that matches the acquired browser usage policy from the user data present in its own region. Note that the method of acquiring user data that matches the browser usage policy can be substantially the same as the method applied in the processing of S207, so detailed description will be omitted. In S504, the user data update unit 401 updates the user data on the rendering processing device 100 of the source region with the user data selected in S503.

[0027] <Third embodiment> An information processing device according to a third embodiment of the present disclosure will be described below. In the above-described first embodiment, an example of a case where user data is acquired from another region has been described. On the other hand, there may be security restrictions on the movement of personal information between the source and destination regions, such as the EU GDPR regulations. Under such circumstances, if user data including personal information is moved or copied between regions, the security restrictions may be violated. In view of the above circumstances, this embodiment proposes a mechanism that makes it possible to apply an alternative method to moving or copying user data when the user data satisfies the conditions of security restrictions.

[0028] An example of the configuration of the rendering processing device 100 according to this embodiment will be described with reference to Fig. 6. The configuration shown in Fig. 6 differs from the configuration shown in Fig. 1 in that it includes a security constraint determination unit 601 that acquires security constraints between the source region and the destination region, and a workaround implementation unit 602 that executes a workaround method when the security constraint conditions are met. Therefore, in this embodiment, various explanations will be given focusing on the parts that are different from the first embodiment described above, and detailed explanations of parts that are substantially similar to the first embodiment will be omitted.

[0029] An example of processing by the rendering processing device 100 according to this embodiment will be described with reference to Fig. 7. The series of processing shown in Fig. 7 differs from the series of processing shown in Fig. 2 in that the processes of S701, S702, and S703 are added. Therefore, the series of processing shown in Fig. 7 will be described focusing particularly on the processes of S701, S702, and S703, and detailed descriptions of the other processes will be omitted.

[0030] If it is determined in S204 that the latest user data is not stored in the own region, in S701 the security constraint determination unit 601 acquires the region in which the latest user data is stored and the security constraints of the own region.

[0031] For example, FIG. 8 is a diagram showing an example of a table for managing information about each security constraint. In the example shown in FIG. 8, for each security constraint, the security constraint name, data type, referencing region, and avoidance method are associated and managed. The security constraint name is a name for identifying each security constraint. The data type indicates the type of user data that is the target of the security constraint. The referencing region indicates the region in which the security constraint occurs when the latest user data is referenced. The avoidance method indicates how to avoid the effects of the target security constraint when corresponding user data exists. Here, an example of a method for avoiding the influence of security restrictions will be described, focusing particularly on the example shown in FIG. For example, if redirection is set as a workaround, the rendering processing device 100 that receives a connection request to the Web server 140 in S201 applies control to redirect the request to a region that holds the latest user data, allowing for delays. In addition, if the setting change procedure display is set as a workaround method, control is applied to present the user with a change procedure screen (an image such as a JPEG) via the client device 120 in order to prompt the user to change the settings of the region to which they are connected. Furthermore, if re-entry is set as the workaround method, movement or copying of user data that is subject to security restrictions is restricted, and control is applied to accept re-entry of the user data from the user. The above-described avoidance methods are merely examples, and other avoidance methods may be set. The same avoidance method may be set for each region, or different avoidance methods may be set for each region.

[0032] In S702, the security constraint determination unit 601 determines whether or not the conditions of the security constraints acquired in S701 (for example, conditions such as the region of the reference source and the type of user data illustrated in FIG. 8) are met. If the security constraint determination unit 601 determines in S702 that the condition of the security constraint in question is not met, the process proceeds to S205. In this case, the subsequent processes are substantially the same as the example shown in FIG. On the other hand, if the security constraint determination unit 601 determines in S702 that the condition of the security constraint in question is met, the process proceeds to S703.

[0033] In S703, the bypass execution unit 602 executes processing related to bypassing the security constraint in accordance with the bypass method associated with the security constraint.

[0034] <Other embodiments> The present invention can also be realized by supplying a program that realizes one or more functions of the above-described embodiments to a system or device via a network or a storage medium, and having one or more processors in the computer of the system or device read and execute the program. It can also be realized by a circuit (e.g., ASIC) that realizes one or more functions.

[0035] The disclosure of this embodiment also includes the following configurations, programs, and methods. (Configuration 1) An information processing device that controls the rendering of web content, comprising: a region identification means for identifying a first region in which the latest user data of a user who is the source of a connection request is held; a policy acquisition means for acquiring a browser usage policy of a second region in which the information processing device is deployed; and a user data acquisition means for acquiring the user data held in the first region identified by the region identification means. An information processing device characterized by having: a user data selection means for selecting at least a portion of user data from the user data acquired by the user data acquisition means based on the browser usage policy of the second region acquired by the policy acquisition means; and a registration means for registering the second region as a region in which the latest user data is held after rendering of web content based on the user data selected by the user data selection means is performed. (Configuration 2) The information processing device described in configuration 1, characterized in that the policy acquisition means acquires a browser usage policy of the first region, and when rendering of web content based on user data selected by the user data selection means is performed, has an update means for updating the user data of the user stored in the first region with at least some of the user data based on the browser usage policy of the first region. (Configuration 3) An information processing device according to configuration 1 or 2, characterized in that it has a determination means for determining whether or not the conditions of a security constraint between the first region and the second region are met, and an avoidance means for executing processing related to avoiding the influence of the security constraint when the determination means determines that the conditions of the security constraint are met. (Configuration 4) The information processing device according to any one of configurations 1 to 3, wherein the user data acquired by the user data acquisition means includes at least one of a cookie and cache data of a web browser. (Configuration 5) The information processing device described in configuration 3, characterized in that the avoidance means executes one of the following processes related to the avoidance: redirecting to another region, or presenting the user with instructions for changing the region to which the connection is made. (Program 1) A program for causing a computer to function as an information processing device that controls the rendering of web content, characterized in that it has: a region identification means for identifying a first region in which the latest user data of a user who is the source of a connection request is held; a policy acquisition means for acquiring a browser usage policy of a second region in which the information processing device is deployed; a user data acquisition means for acquiring the user data held in the first region identified by the region identification means; a user data selection means for selecting at least a portion of user data from the user data acquired by the user data acquisition means based on the browser usage policy of the second region acquired by the policy acquisition means; and a registration means for registering the second region as the region in which the latest user data is held after rendering of web content based on the user data selected by the user data selection means is executed. (Method 1) A control method for an information processing device that controls the rendering of web content, comprising: a region identification step of identifying a first region in which the latest user data of a user who is the source of a connection request is held; a policy acquisition step of acquiring a browser usage policy of a second region in which the information processing device is deployed; a user data acquisition step of acquiring the user data held in the first region identified in the region identification step; a user data selection step of selecting at least some of the user data from the user data acquired in the user data acquisition step based on the browser usage policy of the second region acquired in the policy acquisition step; and a registration step of registering the second region as the region in which the latest user data is held after rendering of web content based on the user data selected in the user data selection step is executed. [Explanation of symbols]

[0036] 100 Rendering processing device 103 Policy Acquisition Department 105 User data selection section 106 User data acquisition unit 107 Latest Region Identification Section 109 Update Region Registration Section

Claims

1. An information processing device that controls rendering of web content, a region specifying means for specifying a first region in which the latest user data of a user who has made a connection request is stored; a policy acquisition means for acquiring a browser usage policy of a second region in which the information processing device is deployed; a user data acquisition means for acquiring the user data held in the first region identified by the region identification means; a user data selection means for selecting at least a portion of the user data from the user data acquired by the user data acquisition means based on the browser usage policy of the second region acquired by the policy acquisition means; a registering means for registering the second region as a region holding the latest user data after rendering of the web content based on the user data selected by the user data selecting means is executed; An information processing device comprising:

2. the policy acquisition means acquires a browser usage policy for the first region; and an update unit that updates the user data of the user held in the first region with at least a part of the user data selected by the user data selection unit when rendering of the web content is executed based on the user data selected by the user data selection unit, based on a browser usage policy of the first region.

2. The information processing device according to claim 1, wherein:

3. a determination means for determining whether a condition of a security constraint between the first region and the second region is met; an avoidance unit that, when the determination unit determines that the condition of the security constraint is met, executes a process for avoiding the influence of the security constraint; The information processing device according to claim 1 , further comprising:

4. 2. The information processing apparatus according to claim 1, wherein the user data acquired by the user data acquisition means includes at least one of cookies and cache data of a web browser.

5. 4. The information processing device according to claim 3, wherein the avoidance means executes, as the process related to the avoidance, either redirecting to another region or presenting to the user a procedure for changing the region to which the user is connected.

6. Computer, An information processing device that controls rendering of web content, a region specifying means for specifying a first region in which the latest user data of a user who has made a connection request is stored; a policy acquisition means for acquiring a browser usage policy of a second region in which the information processing device is deployed; a user data acquisition means for acquiring the user data held in the first region identified by the region identification means; a user data selection means for selecting at least a portion of the user data from the user data acquired by the user data acquisition means based on the browser usage policy of the second region acquired by the policy acquisition means; a registering means for registering the second region as a region holding the latest user data after rendering of the web content based on the user data selected by the user data selecting means is executed; A program for causing an information processing device to function, comprising:

Images