Information processing device, processing method and program for information processing device

Abstract

To reduce security risks by publishing only necessary resources.SOLUTION: The information processing apparatus is provided with code execution means 204 for executing a source code, and resource publishing means 208 for publishing resources to be published that are included in a public resource list when there is no difference between a resource used by the execution of the code execution means and the public resource list.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to an information processing device, a processing method for an information processing device, and a program. [Background technology]

[0002] In recent years, there has been an increase in cloud computing systems, which allow users to use the information processing environment of a service provider via a network, instead of owning their own information processing device to run applications. A variety of services are being provided using cloud computing systems, such as shopping systems for trading goods over the Internet and video distribution systems. Cloud computing systems, which make it easy to secure and release computing resources and reduce much of the burden of server-side management, will continue to be the standard in system development. When developing a system using a cloud computing system, it is possible to link the system with services provided by each cloud vendor. To do this, it is common to use the proprietary libraries and APIs (Application Programming Interfaces) provided by each cloud vendor.

[0003] Therefore, to build a system that integrates with each cloud service, programs must be written in accordance with the proprietary APIs, libraries, and regulations defined by each cloud vendor. Furthermore, since each cloud vendor implements more than 1,000 version upgrades per year, selecting and using the optimal service at the time of development is crucial when developing a system that utilizes cloud computing systems. This requires system developers to be familiar with the mechanisms and usage (libraries, APIs) of the latest services, as well as new ways of using existing services. However, in reality, it is only possible for one system developer to be familiar with a few services, which creates the challenge of requiring a lot of man-hours to debug and troubleshoot services that the system developer is unfamiliar with.

[0004] To address the issue of increased debugging man-hours, it is common to use a debugger that automatically identifies and resolves errors in source code. Patent Document 1 describes a technology that reduces the debugging man-hours of system developers by sharing debugging information obtained using a debugger among multiple system developers. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Special Publication No. 2018-532169 Summary of the Invention [Problem to be solved by the invention]

[0006] However, Patent Document 1 has a problem of security risk due to the disclosure of debugging information to multiple system participants.

[0007] The purpose of this disclosure is to Included in the public resource list The goal is to reduce security risks by making resources public. [Means for solving the problem]

[0008] The information processing device has a code execution means for executing source code, and a resource publishing means for publishing resources included in the public resource list when there is no difference between the resources used by the execution of the code execution means and the public resource list. The resources available to the code execution means are those included in the public resource list, and when the code execution means attempts to use a resource that is not included in the public resource list, the resource that the code execution means attempts to use is added to the public resource list. . [Effects of the Invention]

[0009] According to the present disclosure, Included in the public resource list By making resources public, you can reduce security risks. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 2 is a block diagram illustrating an example of a hardware configuration of the development support device. [Figure 2] FIG. 2 is a block diagram illustrating an example of a functional configuration of the development support device. [Figure 3] 10 is a flowchart showing a processing flow. [Figure 4] FIG. 1 illustrates an example of a system configuration. [Figure 5] 10 is a flowchart showing the flow of processing by the system. [Figure 6] FIG. 10 is a diagram illustrating an error code acquired by a source code acquisition unit. [Figure 7] FIG. 10 is a diagram showing a resource list updated by a resource list update unit. [Figure 8] FIG. 2 is a block diagram illustrating an example of a functional configuration of the development support device. [Figure 9] 10 is a flowchart showing a processing flow. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, preferred embodiments will be described in detail with reference to the drawings. Note that the configurations shown in the following embodiments are merely examples and are not limited to the configurations shown in the drawings.

[0012] (First embodiment) Using Figures 1 to 7, we will explain the series of processes from obtaining the source code that generates an error, to publishing the resource, resolving the error, and completing the resource publication.

[0013] 1 is a block diagram showing an example of the hardware configuration of a development support device 100 according to the first embodiment. The development support device 100 is an example of an information processing device. The components of the development support device 100 will be described below with reference to FIG. 1.

[0014] The development support device 100 includes a CPU 101, a RAM 102, a ROM 103, a storage device 104, a communication module 105, a power supply 106, an input device 107, and an output device 108, and is, for example, a computer.

[0015] The CPU 101 is a processor that performs arithmetic processing and may be either a single CPU or a multi-CPU. The CPU 101 is capable of processing tasks in threads. The CPU 101 uses the RAM 102 as a work memory and executes programs stored in the ROM 103.

[0016] The storage device 104 is a storage medium that stores programs executed by the CPU 101 and data to be processed by the CPU 101. The storage device 104 may be a hard disk drive (HDD) or a solid state drive (SSD).

[0017] The communication module 105 is a communication interface that connects the development support device 100 to an external computer such as a cloud service. The development support device 100 can use the communication module 105 to input and output data to be stored in the RAM 102 and the storage device 104. The communication module 105 preferably has two input and output ports, one for control and one for data transfer.

[0018] The power supply 106 is a power supply module for the development support device 100, and may have multiple redundant power supplies or may be capable of storing power. The input device 107 is an input device for directly inputting commands to the development support device 100 using a keyboard, mouse, or the like. The output device 108 is an output device for displaying information to the user using a monitor, or the like.

[0019] [Processing in the development support device 100] The processing performed by the development support device 100 of this embodiment will be described below with reference to FIGS.

[0020] 2 is a block diagram showing an example of the functional configuration of a development support device 100 according to the first embodiment. The development support device 100 has a source code acquisition unit 201, a code execution information acquisition unit 202, a public resource list acquisition unit 203, a code execution unit 204, a public resource identification unit 205, and a resource list update unit 206. Furthermore, the development support device 100 has a resource disclosure determination unit 207, a resource disclosure unit 208, a modification code acquisition unit 209, and a resource disclosure termination unit 210.

[0021] The development support device 100 realizes the functions of each unit in Figure 2 by having the CPU 101 read and execute a control program stored in the ROM 103. The development support device 100 may also be configured to include dedicated processing circuits corresponding to each component. The flow of processing performed by each component will be described below.

[0022] 3 is a flowchart showing a processing method of the development support device 100 according to the first embodiment. In step S301, the source code acquisition unit 201 acquires source code that always generates an error from the owner requesting debugging. The code execution information acquisition unit 202 acquires code execution information from the owner requesting debugging. At the same time, the public resource list acquisition unit 203 acquires a list of public resources that can be made public to the outside from the owner requesting debugging.

[0023] Here, code execution information refers to data required to execute source code, including test code, its correct answer data, error data required for test execution, and error files. The public resource list is a list of resources designated by the owner that are required for debugging and can be made public. The public resource list includes databases, files, and related code other than the source code where the error occurred.

[0024] The system that the owner originally wants to create in this embodiment will be described below. In this embodiment, the system that the owner originally wants to create will be described as "an ETL processing system that acquires device logs and executes ETL processing (Extract / Transform / Load) on the log files." The source code where the error occurs is part of this ETL processing system, and once debugging of the error location is completed, an ETL processing system that can execute ETL processing of logs will be completed.

[0025] FIG. 4 is a diagram showing an example of the configuration of an ETL processing system 420 that an owner would like to create. The development support device 100 in FIG. 1 can connect to the ETL processing system 420 in FIG. 4 and can acquire information about the ETL processing system 420. The ETL processing system 420 includes a log storage 403, a queue storage function 404, a log ID queue 405, an ETL processing function 406, an input database 407, an intermediate result database 408, a conversion processing function 409, and a result storage 410. The ETL processing system 420 is started when a log 402 of a device 401, which is one of devices distributed on the market, is stored in the log storage 403. The processing flow of the ETL processing system 420 will be described below.

[0026] 5 is a flowchart showing the processing flow of the ETL processing system 420 that the owner originally wanted to create. In step S501, the device (e.g., printer) 401 outputs the log 402. In step S502, the log storage 403 stores the log 402. When the log 402 is stored, the queue store processing function 404 is started. In step S503, the queue store processing function 404 stores the log ID of the log 402 stored in the log storage 403 in the log ID queue 405.

[0027] In step S504, the ETL processing function 406 obtains a log ID from the log ID queue 405. The processing in step S504 is not limited to being continuous processing from step S501, but may be continuous processing, or may be started after time has passed by a separate timer event.

[0028] In step S505, the ETL processing function 406 acquires the log 402 from the log storage 403 based on the acquired log ID. In step S506, during the processing, the ETL processing function 406 references input parameters from the input database 407. In step S507, during the processing, the ETL processing function 406 outputs the interim results of the ETL processing to the interim result database 408.

[0029] In step S508, the ETL processing function 406 invokes the conversion processing function 409 during the processing. In step S509, the ETL processing function 406 acquires a return value from the conversion processing function 409 during the processing. In step S510, the ETL processing function 406 stores the ETL processing result file in the result storage 410 at the end of the processing.

[0030] 6 is a diagram showing an example of code that is the substance of the ETL processing function 406. The ETL processing function 406 first obtains a log ID from the log ID queue 405 in code 601, and then obtains a log 402 from the log storage 403 in code 602.

[0031] Next, the ETL processing function 406 references input parameters from the input database 407 in code 603, performs part of the ETL processing using the input parameters in code 604, and stores the intermediate results of the ETL processing in the intermediate result database 408 in code 605. Finally, the ETL processing function 406 invokes the conversion processing function 409 in code 606, and stores the ETL processing result file in the result storage 410 in code 607.

[0032] In this embodiment, the code that is the entity of this ETL processing function 406 is source code that contains an error, but once the error is resolved, processing is carried out to the end of code 607, and an ETL processing result file is output to result storage 410. In this embodiment, it is assumed that the owner wants to perform ETL processing of log 402 acquired from device 401 using the above ETL processing system 420 and the above code, but the code contains an error and the ETL processing of log 402 cannot be performed.

[0033] 2 and 3. In step S302, the code execution unit 204 executes the test code included in the code execution information acquired from the code execution information acquisition unit 202. The test code always includes a process for launching the source code acquired from the source code acquisition unit 201. The test code is assumed to be capable of confirming that all errors / bugs included in the source code have been resolved. In this embodiment, it is assumed that an error is first included in the code 604, and even if the test code is executed, the processing will stop between steps S506 and S507 at this stage.

[0034] Here, the resources that the code execution unit 204 can use are limited to those included in the public resource list acquired from the public resource list acquisition unit 203. By limiting the resources that the code execution unit 204 can use, it is possible to prevent people other than the owner from accessing resources that contain confidential information, and to prevent people other than the owner from accessing unnecessary resources.

[0035] 7A is a diagram showing an example of a public resource list in this embodiment. Since the process has progressed up to step S506, the resources accessed by the code execution unit 204 up until the process of step S506 are included in the public resource list in FIG.

[0036] In this embodiment, the code execution unit 204 increases or decreases the authority given to the debugger that executes the code, thereby restricting resources that can be used by persons other than the owner. Specifically, at this point, the code execution unit 204 is granted access authority to the ETL processing function 406, the log file in the log storage 403, the queue storage processing function 404, the log ID queue 405, and the input database 407. The code execution unit 204 outputs the result of the code execution executed using the granted access authority to the resource disclosure determination unit 207. Here, the code execution result is, for example, 1 if all errors / bugs contained in the source code have been resolved, and 0 if errors / bugs still remain in the source code. In addition, the code execution unit 204 outputs the processing start time and processing end time of the code execution to the disclosure resource identification unit 205.

[0037] In step S303, the public resource identification unit 205 identifies the resources used during the execution in step S302 based on the processing start time and processing end time of the code execution obtained from the code execution unit 204. In this embodiment, an activity monitoring service such as Cloud Trail from AWS (Amazon Web Service) is used as a method for identifying the resources used during execution. The activity monitoring service logs account activity across the entire infrastructure, continuously monitors it, and maintains the logs. This makes it possible to detect activities that may cause security vulnerabilities and perform troubleshooting by looking back at past activities, and is therefore at the core of cloud system security. For this reason, all major cloud vendors provide activity monitoring services.

[0038] In this embodiment, the public resource identification unit 205 identifies resources used during code execution based on the log recorded by this activity monitoring service and outputs a resource list. Specifically, the public resource identification unit 205 identifies resources whose activity was confirmed from the time when source code processing started in step S302 to the time when processing ended due to an error as resources used during code execution.

[0039] In this embodiment, the public resource identification unit 205 identifies the resources used during code execution based on logs recorded by activity monitoring means such as an activity monitoring service, but the resource identification method is not limited to this. For example, the public resource identification unit 205 can also identify the used resources by registering specific code that generates resource access in advance and analyzing source code, such as the occurrence of the registered code. The public resource identification unit 205 outputs a resource list of the identified resources to the resource list update unit 206.

[0040] In step S304, the resource list update unit 206 acquires the resource list from the public resource identification unit 205 and the public resource list from the public resource list acquisition unit 203, and updates the resource list used in the code execution in step S302. Here, the public resource list acquired from the public resource list acquisition unit 203 is a list of resources that can be made public and that have been specified in advance by the owner.

[0041] As described above, Fig. 7(a) shows an example of a public resource list. Fig. 7(b) shows an example of a resource list identified by the public resource identification unit 205. In this embodiment, there is no difference between the public resource list in Fig. 7(a) and the identified resource list in Fig. 7(b) at this point, and the resource list update unit 206 does not update the resource list. If the resource list is not to be updated, the process proceeds to step S305. The process when the resource list is updated will be described later. The resource list update unit 206 outputs the resource list to the resource disclosure unit 208, regardless of whether the resource list has been updated or not.

[0042] In step S305, the resource disclosure determination unit 207 checks whether all errors / bugs contained in the source code have been resolved based on the code execution result of the code execution unit 204, and determines whether to start / continue or terminate resource disclosure. If the code execution result is 0, the resource disclosure determination unit 207 determines to start and continue resource disclosure, and if the code execution result is 1, the resource disclosure determination unit 207 determines to terminate resource disclosure.

[0043] In this embodiment, the resource disclosure determination unit 207 determines whether to disclose resources based only on the execution result of the code execution unit 204, but the determination method is not limited to this. For example, the resource disclosure determination unit 207 may compare the correct execution result previously acquired from the code execution information acquisition unit 202 with the execution result acquired by the code execution unit 204, and make a determination based on whether they match. If the determination result is to start or continue disclosure, the resource disclosure determination unit 207 proceeds to step S306, and if the determination result is to end disclosure, proceeds to step S308.

[0044] As described above, processing stops between steps S506 and S507 and an error occurs, so processing proceeds to step S306.

[0045] In step S306, the resource disclosing unit 208 discloses resources to the debugger based on the resource list acquired from the resource list updating unit 206. Specifically, the resource disclosing unit 208 achieves this by granting the debugger authority according to the disclosed resource list. In this embodiment, the resource disclosing unit 208 grants the debugger the authority to view / change resource IDs No. 1 to No. 5 based on the identified resource list in FIG. 7(b).

[0046] In this embodiment, it is assumed that there is only one type of debugger, but the development support device 100 may additionally include a debugger type determination means, and the resource disclosure unit 208 may change the authority to be granted depending on the type of debugger. For example, if there are multiple types of debuggers, such as an in-house debugger, an external novice debugger, and an external veteran debugger, the resource disclosure unit 208 may grant viewing / changing authority to the in-house debugger and grant only viewing authority to the external debugger.

[0047] The resource disclosure unit 208 notifies the debugger of the granted permission information by email, web display, or the like. The debugger, having grasped the granted permission information, performs debugging within the granted permissions and corrects the code. Note that in this embodiment, the resource disclosure unit 208 realizes resource disclosure by granting permissions to the debugger, but the disclosure method is not limited to this. For example, the resource disclosure unit 208 may use a method of duplicating the resources to be disclosed in a separate environment and disclosing the duplicated environment to the debugger, or a method of identifying and masking confidential information portions of the resources or code to be disclosed before disclosing them.

[0048] In step S307, the correction code acquisition unit 209 acquires the corrected code from the debugger. In this embodiment, the debugger corrects the bug in the code in a state where processing stopped between steps S506 and S507 in the flowchart of Fig. 5. Processing continues in the corrected code, but processing stops between steps S507 and S508.

[0049] If the bug is fixed so that processing progresses to the point where interim result database 408 is accessed, executing the code with the fixed bug will attempt to access interim result database 408. However, at this point, interim result database 408 is not included in the public resource list of FIG. 7( a), and there is no authority to access interim result database 408, so access to interim result database 408 is not possible, resulting in an error. However, the activity monitoring service records a log of an attempt to access interim result database 408 as a result of this processing. Based on this log, public resource list acquisition unit 203 adds interim result database 408 to the public resource list of FIG. 7( a). Then, public resource list acquisition unit 203 outputs the public resource list to which interim result database 408 has been added to code execution unit 204 and resource list update unit 206.

[0050] The correction code acquisition unit 209 outputs the correction code acquired from the debugger to the code execution unit 204, and the process proceeds to step S302.

[0051] In step S302, the code execution unit 204 executes the test code for the modified code acquired by the modified code acquisition unit 209, in the same manner as described above.

[0052] In step S303, similarly to the above, the public resource identification unit 205 identifies the resources used during the execution in step S302 based on the processing start time and processing end time of the code execution obtained from the code execution unit 204, but the execution result is different. At the above point in time, the identified resource list was that of Figure 7(b), but the identified resource list at this point in time is that of Figure 7(c). As a result of debugging by the debugger, the processing has progressed, and the identified resource list of Figure 7(c) has the intermediate result database 408 added to the identified resource list of Figure 7(b).

[0053] In step S304, unlike the above, the resource list update unit 206 compares the previously identified resource list (FIG. 7(b)) with the currently identified resource list (FIG. 7(c)) to determine whether there is a difference. As described above, the public resource list output by the public resource list acquisition unit 203 is the same as the resource list in FIG. 7(c). In the first iteration of step S304, the resource list update unit 206 compares the public resource list with the identified resource list, and in the second and subsequent iterations of step S304, it compares the previously identified resource list with the currently identified resource list.

[0054] Unlike the above, the resource list update unit 206 determines that the resource list has been updated because there is a difference between the previous and current identified resource lists, and the process proceeds to code execution in step S302 rather than step S305.

[0055] Thereafter, the process proceeds in the same manner as described above, from step S302 to step S303 to step S304. In step S304, if the resource list update unit 206 confirms that there is no difference between the previous and current identified resource lists, the process proceeds to step S305.

[0056] In step S305, the resource disclosure determination unit 207, as described above, determines whether to start / continue or terminate resource disclosure based on the code execution result of the code execution unit 204. At this point, since the processing is stopped between steps S507 and S508, the code execution result is 0, and the resource disclosure determination unit 207 determines to continue resource disclosure and proceeds to step S306.

[0057] In step S306, the resource disclosing unit 208 discloses resources to the debugger based on the resource list acquired from the resource list updating unit 206. In this embodiment, the resource disclosing unit 208 grants the debugger permission to view / change resource IDs No. 1 to No. 6 based on the identified resource list in Fig. 7(c). Thereafter, the process proceeds to step S307, and the above process is repeated.

[0058] By repeating the above process, the source code containing the error is corrected by the debugger. The resource disclosure unit 208 changes the list of resources to be disclosed in accordance with the correction. Debugging by the debugger progresses further as the number of resources to be disclosed increases, and when debugging is completed, in step S302, the code execution unit 204 executes test code on the debug completion code, and the code execution result becomes 1. Then, in step S305, the resource disclosure determination unit 207 determines to end resource disclosure based on the execution result of the code execution unit 204, and proceeds to step S308.

[0059] In step S308, the resource disclosure termination unit 210 terminates resource disclosure based on the determination result of the resource disclosure determination unit 207, that is, "terminate resource disclosure." Specifically, the resource disclosure termination unit 210 terminates resource disclosure by withdrawing the privileges granted to all debuggers. At this time, the resource disclosure termination unit 210 needs to withdraw privileges not only from the debugger that successfully performed debugging, but also from all debuggers. Furthermore, when terminating resource disclosure, the resource disclosure termination unit 210 notifies the owner that resource disclosure has been terminated. The above is the flow of processing performed by the development support device 100 of this embodiment.

[0060] As described above, in step S302, the code execution unit 204 executes the source code. Specifically, the code execution unit 204 executes the test code that tests the source code.

[0061] In step S304, if there is no difference between the resources used by the execution of the code execution unit 204 and the public resource list, the process proceeds to step S306 via step S305. In step S306, the resource disclosure unit 208 discloses the resources included in the public resource list.

[0062] The resource publishing unit 208 publishes the resources included in the public resource list according to the execution result of the code executing unit 204. In step S305, if the execution result of the code executing unit 204 is the execution result when the source code contains a bug, the process proceeds to step S306. In step S306, the resource publishing unit 208 publishes the resources included in the public resource list.

[0063] In step S302, if the source code has been modified, the code execution unit 204 executes the modified source code. In step S304, if there is no difference between the resources used in the previous execution of the code execution unit 204 and the resources used in the current execution of the code execution unit 204, the process proceeds to step S306 via step S305. In step S306, the resource disclosure unit 208 discloses the resources included in the disclosed resource list.

[0064] The resources available to the code execution unit 204 are those included in the public resource list. If the code execution unit 204 attempts to use a resource that is not included in the public resource list, the resource that the code execution unit 204 attempted to use is added to the public resource list.

[0065] In step S304, if there is a difference between the resources used in the previous execution and the resources used in the current execution, the process proceeds to step S302. In step S302, the code execution unit 204 executes the modified source code again.

[0066] In step S305, if the execution result of the code execution unit 204 is the execution result when the source code does not contain a bug, the process proceeds to step S308. In step S308, the resource disclosure termination unit 210 terminates the disclosure of the resource.

[0067] In step S306, the resource disclosure unit 208 discloses the resources by granting the debugger permission to refer to the resources. The resource disclosure unit 208 may also disclose the resources by duplicating the resources in another environment. The resource disclosure unit 208 may also disclose the resources in a state where some of the resources included in the disclosed resource list are hidden. The resource disclosure unit 208 may also change the resources to be disclosed depending on the type of modifier (debugger) who modified the source code.

[0068] According to this embodiment, the development support device 100 can expose only the minimum resources required for debugging to the debugger when debugging a cloud computing system. This enables the development support device 100 to efficiently implement debugging while minimizing security risks.

[0069] (Second embodiment) In the first embodiment, by limiting the resources that are made public according to the debugger's progress in debugging, it is possible to provide the debugger with an environment that is easy to debug while ensuring security. However, in the first embodiment, there is a security risk that unnecessary resources may be added without permission when a malicious debugger participates in debugging. The second embodiment solves this problem.

[0070] In the second embodiment, this problem is solved by adding a correction code check process between the correction code acquisition process in step S307 and the code execution process in step S302 in Fig. 3. Below, the differences between the second embodiment and the first embodiment will be described.

[0071] Fig. 8 is a block diagram showing an example of the functional configuration of the development support device 100 according to the second embodiment. Fig. 8 is obtained by adding a correction code check unit 811 to Fig. 2. The correction code check unit 811 is provided between the correction code acquisition unit 209 and the code execution unit 204. The correction code acquisition unit 209 outputs the correction code acquired from the debugger to the correction code check unit 811. The source code acquisition unit 201 outputs the source code acquired from the owner to the code execution unit 204 and the correction code check unit 811. The correction code check unit 811 outputs the checked correction code to the code execution unit 204 based on the source code and the correction code. The code execution unit 204 executes test code on the checked correction code.

[0072] Fig. 9 is a flowchart showing the processing method of the development support device 100 according to the second embodiment. Fig. 9 adds step S909 to Fig. 3. Step S909 is provided between step S307 and step S302.

[0073] After step S307, the process proceeds to step S909. In step S909, the modification code check unit 811 inputs the modification code acquired by the modification code acquisition unit 209 and the source code acquired by the source code acquisition unit 201, and checks the modification code based on the modification code and the source code. Specifically, the modification code check unit 811 checks whether the modification code poses a security risk based on the difference between the modification code and the source code.

[0074] Note that the modification code check unit 811 checks based on the previous modification code instead of the source code when performing the modification code check process in step S909 from the second time onwards. That is, in step S909 from the second time onwards, the modification code check unit 811 checks the current modification code based on the current modification code and the previous modification code. Specifically, the modification code check unit 811 checks whether the current modification code poses a security risk based on the difference between the current modification code and the previous modification code.

[0075] The modification code check unit 811 determines whether the difference contains code with a predefined security risk. If the difference contains code with a predefined security risk, the modification code check unit 811 notifies the debugger that "this modification cannot be applied" and proceeds to step S307. If the difference does not contain code with a predefined security risk, the modification code check unit 811 outputs the checked modification code to the code execution unit 204 and proceeds to step S302. Thereafter, the same processing as in FIG. 3 is repeated.

[0076] The predefined code that poses a security risk is, for example, code for connecting to an external network, code for deleting a file, etc. If such code is included in the difference, the modification code check unit 811 determines that the modification code cannot be applied.

[0077] The correction code check unit 811 checks the correction code by checking whether or not a predefined code is included in the above-mentioned difference, but is not limited to this. For example, the correction code check unit 811 can implement a method in which resources that can be added are defined in advance and correction codes that add other resources are not accepted, or a method in which correction codes that add resources are accepted only when the error location has been improved.

[0078] As described above, the modified code check unit 811 checks whether the modified source code contains a security risk. Specifically, the modified code check unit 811 checks whether the difference between the source code before and after the modification contains code that poses a security risk. For example, code that poses a security risk is code for connecting to an external network or code for deleting a file. Also, code that poses a security risk is code for adding resources other than specified resources. If the modified source code does not contain a security risk, the code execution unit 204 executes the modified source code.

[0079] According to this embodiment, the development support device 100 can prevent the application of modification code that adds code that poses a security risk. As a result, the development support device 100 can prevent unnecessary resources from being added without permission when a malicious debugger participates in debugging.

[0080] (Other embodiments) The present disclosure can also be realized by a process in which a program that realizes one or more functions of the above-described embodiments is supplied to a system or device via a network or a storage medium, and one or more processors in the computer of the system or device read and execute the program. The present disclosure can also be realized by a circuit (e.g., ASIC) that realizes one or more functions.

[0081] It should be noted that the above-described embodiments merely illustrate specific examples of implementing the present disclosure, and the technical scope of the present disclosure should not be construed as being limited by these embodiments. In other words, the present disclosure can be implemented in various forms without departing from its technical concept or main features. [Explanation of symbols]

[0082] 201 source code acquisition unit, 202 code execution information acquisition unit, 203 public resource list acquisition unit, 204 code execution unit, 205 public resource identification unit, 206 resource list update unit, 207 resource publication determination unit, 208 resource publication unit, 209 modification code acquisition unit, 210 resource publication termination unit

Claims

1. A code execution means for executing source code; a resource publishing means for publishing a resource included in the public resource list when there is no difference between the resource used by the execution of the code execution means and the public resource list; the resources available to the code execution means are resources included in the public resource list; When the code execution means attempts to use a resource that is not included in the public resource list, the resource that the code execution means attempts to use is added to the public resource list.

2. A code execution means for executing source code; a resource publishing means for publishing a resource included in the public resource list when there is no difference between the resource used by the execution of the code execution means and the public resource list; the code execution means executes the modified source code when the source code is modified; the resource disclosing means, when there is no difference between the resources used in the previous execution of the code execution means and the resources used in the current execution of the code execution means, discloses the resources included in the disclosure resource list; The information processing apparatus is characterized in that the resource publishing means changes the resources to be published depending on the type of person who has modified the source code.

3. 3. The information processing apparatus according to claim 1, wherein the resource publishing means publishes the resources included in the published resource list in accordance with the execution result of the code execution means.

4. 4. The information processing device according to claim 3, wherein the resource publishing means publishes resources included in the published resource list when the execution result of the code execution means is an execution result in which the source code contains a bug.

5. the code execution means executes the modified source code when the source code is modified; An information processing device as described in any one of claims 1, 3, and 4, characterized in that the resource disclosure means discloses the resources included in the disclosure resource list when there is no difference between the resources used in the previous execution of the code execution means and the resources used in the current execution of the code execution means.

6. 6. The information processing apparatus according to claim 2, wherein the code execution means executes the modified source code again if there is a difference between the resources used in the previous execution and the resources used in the current execution.

7. 7. The information processing apparatus according to claim 1, wherein the code execution means executes a test code for testing the source code.

8. 5. The information processing apparatus according to claim 4, further comprising a resource publication termination means for terminating publication of the resource when the execution result of the code execution means is an execution result in which the source code does not contain a bug.

9. 9. The information processing apparatus according to claim 1, wherein the resource publishing means publishes the resource by granting authority to refer to the resource.

10. 9. The information processing apparatus according to claim 1, wherein the resource publishing means publishes the resources included in the published resource list in a hidden state.

11. 7. The information processing apparatus according to claim 2, further comprising a modified code check unit that checks whether the modified source code contains a security risk.

12. 12. The information processing apparatus according to claim 11, wherein the modified code check means checks whether or not a code that poses a security risk is included in a difference between the source code before and after the modification.

13. 13. The information processing apparatus according to claim 12, wherein the code posing a security risk is code for connecting to an external network or code for deleting a file.

14. 13. The information processing apparatus according to claim 12, wherein the code posing a security risk is code for adding a resource other than a specified resource.

15. 15. The information processing device according to claim 11, wherein the code execution means executes the modified source code if the modified source code does not include a security risk.

16. A code execution step of executing source code; a resource publishing step of publishing the resources included in the public resource list when there is no difference between the resources used by the execution of the code execution step and the public resource list; the resources available for use in the code execution step are resources included in the public resource list; A processing method for an information processing device, characterized in that if an attempt is made to use a resource that is not included in the public resource list in the code execution step, the resource that was attempted to be used is added to the public resource list.

17. In a code execution step of executing source code, a resource publishing step of publishing the resources included in the public resource list when there is no difference between the resources used by the execution of the code execution step and the public resource list; In the code execution step, if the source code is modified, the modified source code is executed; the resource publishing step, when there is no difference between the resources used in the previous execution of the code execution step and the resources used in the current execution of the code execution step, publishes the resources included in the published resource list; The processing method of the information processing device, wherein the resource disclosing step changes the resources to be disclosed depending on the type of person who has modified the source code.

18. A program for causing a computer to function as each of the means of the information processing device according to any one of claims 1 to 15.

Images