Web Application Access Control via User Permission Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information processing apparatuses, such as MFPs, lack effective access restriction mechanisms for web applications, as current methods rely solely on URL information and do not consider the specific functions implemented by web applications, leading to security issues and impaired convenience.
Innovation Solution
An information processing apparatus equipped with an acquisition unit for user information, a determination unit to assess execution permissions, and a display control unit to manage screen displays based on user permissions, allowing for appropriate restriction of web application execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access restriction is performed based on URL information from bookmark shortcut buttons, then the system can implement basic access control, but it cannot determine the specific function type (print, scan transmission, etc.) of the web application, leading to security vulnerabilities
Solution Approach 1:
The patent segments the access control mechanism into multiple components: URL-based identification, function type classification (print, scan, copy), and user authority levels. Each component handles a specific aspect of access control, allowing the system to make granular decisions about what functions each user can access based on their credentials and the application's function type.
Solution Approach 2:
The patent introduces an intermediary access control mechanism that sits between the bookmark shortcut button and the web application. This intermediary layer analyzes both the URL information and the user's authority credentials, then determines whether to permit or restrict access based on the function type and user permissions, preventing direct unfiltered access to web applications.
2Reliability
If access to browser function is restricted to prevent security issues, then security is improved, but access to legitimate web applications with permitted functions (e.g., print function) is also blocked, impairing convenience
Solution Approach 1:
The patent applies local quality by implementing differentiated access control for different function types within web applications. Instead of a blanket restriction on all browser access, the system evaluates each user's authority credentials against the specific function type (print, scan, copy) of each web application, allowing users to access permitted functions while blocking restricted ones. This enables precise control where each user gets access to the specific functions their credentials permit.
3Ease of operation
If users can access arbitrary web applications via web browser without intervention, then user freedom is maintained, but proper access restriction cannot be executed, creating security risks
Solution Approach 1:
The patent implements preliminary action by performing access control evaluation before users can access web applications. When a user activates a bookmark shortcut button, the system proactively checks the user's authority credentials against the web application's function type and access requirements. This pre-access evaluation prevents unauthorized access attempts before they occur, rather than reacting after unauthorized access is attempted.
Data Source
AI summary
An information processing apparatus capable of requesting a server to execute an application on the server acquires user information, and determines whether execution of the application by a user corresponding to the user information is permitted. The information processing apparatus controls display of a screen for instructing execution of the application to, when it is determined that execution of the application is permitted, display the screen on a display unit, and when it is determined that execution of the application is inhibited, restrict an instruction to execute the application.