JP4526355B2 - Web processing method, Web processing apparatus, and Web processing program - Google Patents

Description

  The present invention relates to a Web display technique for determining in advance safety at the time of execution of each portlet when a plurality of portlets described using a predetermined description language are combined and displayed.

  In a conventional Web system, content described in HTML (Hypertext Markup Language) or script language is responded to access from a browser. In recent years, information on a plurality of back-end servers is accessed, and a portlet and It has been developed into a Web display system that generates a single screen by synthesizing pieces of content called. Conventionally, the administrator of the Web display system in the company has prepared a dedicated portlet, but it is based on WSRP (Web Services for Remote Portlets) formulated by OASIS (Organization for the Advancement of Structured Information Standards). In addition to conventional portlets dedicated to the company, Web services provided by third parties outside the company have also become a form that users can freely select and use as portlets (for example, Non-Patent Document 1) reference).

Thomas Schaeck, "WSRP Whitepaper", [online], OASIS, September 22, 2002, P.3-7, [October 6, 2003 search], Internet <URL: http: //www.oasis -open.org/committees/download.php/2634/WSRP%20Whitepaper%20-%20rev%202.doc>

  When a script language is used in the conventional web display system, dynamic screen display is possible without communication with a web server, so the script language is a very useful language. It is possible to modify the contents displayed in the browser using the DOM (Document Object Model) interface, or to communicate with other servers to transmit information. There are browsers that support the setting of script execution invalidity and warning messages. Therefore, in the current Web display system, execution of the script language is left to the user's judgment, and in order to safely execute the contents described in the script language, the user needs to analyze the description in the script language sequentially. was there.

  Further, in the case of the Web display system using the prior art WSRP, the problem is particularly remarkable. When using WSRP, a conventional portlet (local portlet) created by an administrator in the company and a company using WSRP are used. Portlets developed by third parties outside the company (remote portlets) are combined and displayed in a single HTML, so local portlets displaying confidential information within the company and malicious remote portlets are one. There is a possibility that it may be synthesized into HTML, and it becomes easy for a malicious remote portlet to modify confidential information or to communicate with an external server to steal confidential information.

  The object of the present invention is to solve the above-mentioned problem, and when content is displayed by combining a plurality of portlets, it is possible to safely display the content by preventing the composition of portlets including instructions that may be falsified or leaked. It is to provide a technology capable of performing the above.

  Another object of the present invention is to provide a technology capable of safely displaying content by performing access control according to the security attribute between the synthesized portlets when the content is displayed by combining a plurality of portlets. It is to provide.

  The present invention generates a content by synthesizing a portlet in which the safety of a written instruction is verified in a Web display device that displays a content by synthesizing a plurality of portlets described using a predetermined description language It is.

  In the Web display device of the present invention (a computer, an information processing device, or a program or object that performs such processing), a Web that displays a content by combining a plurality of portlets described using a predetermined description language When a display request is received from the processing device on the Web browser side, a portlet to be synthesized when the content is displayed is read from the storage device, and then an instruction described in the read portlet is extracted on the storage device. Verify its safety.

  For example, the instructions in the dangerous instruction list storing instructions that can alter or leak the contents of the content are compared with the instructions in the read portlet on the storage device, and which instruction in the read portlet If the read portlet does not correspond to an instruction in the dangerous instruction list, it is determined that the read portlet is safe. If any instruction in the read portlet corresponds to an instruction in the dangerous instruction list, the read is performed. By verifying that the portlet is not secure, the safety of the portlet is verified.

  As a result of the verification, if it is determined that the read portlet is safe, the portlet is stored as content display data on the storage device, and the other portlets determined to be safe and the storage device After the composition, content display data composed of portlets determined to be safe is transmitted to the Web browser side processing device for display.

  In addition, if it is determined that the read portlet is not safe as a result of the verification, single display data for displaying the portlet alone is generated on the storage device, and the portlet is determined to be safe. Apart from the display of the content display data composed of the portlets, it is also possible to perform processing for displaying the portlets that have not been determined to be safe, so that the contents of the portlets can be confirmed.

  According to the present invention, when displaying a content by combining a plurality of portlets, it is possible to display the content safely by preventing the composition of portlets including instructions that may be altered or leaked information. It is.

(Embodiment 1)
A Web display apparatus according to the first embodiment that displays a content by combining a plurality of portlets described using a predetermined description language will be described below.

  FIG. 1 is a diagram showing an overall configuration of a Web display system according to the present embodiment. As shown in FIG. 1, the Web portal processing apparatus 100 of this embodiment includes a portal screen generation processing unit 106 and a safety verification processing unit 107.

  The portal screen generation processing unit 106 reads out a portlet to be synthesized at the time of content display from the storage device, and when it is determined that the read portlet is safe, the portal screen generation processing unit 106 stores the portlet as content display data on the storage device. And a processing unit that synthesizes on the storage device with another portlet determined to be safe. The safety verification processing unit 107 is a processing unit that extracts a command described in the portlet read by the portal screen generation processing unit 106 on the storage device and verifies the safety.

  A program for causing the Web portal processing device 100 to function as the portal screen generation processing unit 106 and the safety verification processing unit 107 is recorded on a recording medium such as a CD-ROM and stored in a magnetic disk or the like, and then loaded into a memory. Shall be executed. The recording medium for recording the program may be a recording medium other than the CD-ROM. The program may be used by installing it from the recording medium into the information processing apparatus, or the program may be used by accessing the recording medium through a network.

  The web portal processing apparatus 100 according to the present embodiment is a web display apparatus that displays a portal screen on a web browser. When a portal screen acquisition request is received from the web browser side processing apparatus 101, the portlet requested by the web browser side processing apparatus 101 is requested. The program is executed to acquire information on the mail system 102 and database 103 in the company and information on the remote portlet provided by the remote portlet providing server 105 via the Internet 104.

  At that time, the portal screen generation processing unit 106 makes an inquiry to the safety verification processing unit 107 in order to verify the safety of the content returned by each portlet. The safety verification processing unit 107 verifies the safety of the script language or the like included in the portlet content, and returns the result to the portal screen generation processing unit 106. The portal screen generation processing unit 106 HTML that displays a screen according to the safety verification result from the unit 107 is automatically generated and responded to the Web browser side processing apparatus 101.

  FIG. 2 is a diagram illustrating a hardware configuration of the Web portal processing apparatus 100 according to the present embodiment. As shown in FIG. 2, the Web portal processing apparatus 100 includes a portal screen generation processing unit 106 and a safety verification processing unit 107 in a memory, and includes a magnetic disk device that stores local portlets and remote portlets.

  FIG. 3 is a diagram illustrating an example of a screen generated by the portal screen generation processing unit 106 according to the present embodiment. As shown in FIG. 3, in the screen display example 200 in the conventional Web display device, a safe portlet that does not include a command that can tamper or leak content and a command that can tamper or leak content And dangerous portlets (including portlets that can change, acquire, and transmit the contents of other portlets) on a single screen.

  FIG. 4 is a diagram showing an example of a conventional portal screen HTML. In FIG. 4, HTML data 210 represents the entire HTML data responding to the Web browser side processing apparatus 101, and a local portlet 211 represents secure portlet HTML data.

  In this example, the A tag 212 displays a hyperlink to http: // xxx, which is a URL storing information related to work in the company. The remote portlet 213 is an example of a dangerous portlet, and an A tag in HTML with the getElementsByTagName instruction in JavaScript in the script instruction 214 (JavaScript is a trademark or registered trademark of Sun Microsystems, Inc. in the United States and other countries). Have access to. Further, the hyperlink of the A tag 212 in the local portlet 211 is changed to http: // yyy by the setAttribute command of the script command 215. As described above, by using a script language such as JavaScript, there is a problem that it is easy to access the information of other portlets within one HTML data and tamper with the contents.

  In the screen display examples 201 and 202 of the Web portal processing apparatus 100 in the present embodiment of FIG. 3, only the contents of the portlets that are first determined to be safe by the safety verification processing unit 107 are synthesized and displayed on one HTML screen. (Screen display example 201). Portlet contents determined to be dangerous are prepared separately in another HTML so that the information of other portlets is not falsified or leaked. Are displayed in this window (screen display example 202). In addition, a warning message may be displayed and the user may select whether to display the safe content screen and the dangerous content screen separately.

  FIG. 5 is a flowchart showing a processing procedure of the portal screen generation processing unit 106 of this embodiment. As shown in FIG. 5, the portal screen generation processing unit 106 of the Web portal processing apparatus 100 reads a portlet to be synthesized when displaying content from the magnetic disk device, and determines that the read portlet is safe. In addition, the portlet is stored as content display data on the memory, and is synthesized with other portlets determined to be safe on the memory. In addition, the safety verification processing unit 107 performs processing for extracting the instructions described in the portlet read by the portal screen generation processing unit 106 on the memory and verifying the safety.

  When the web portal processing apparatus 100 receives a portal screen acquisition request, which is a web display request for displaying a portal screen from the web browser side processing apparatus 101, by the communication apparatus, in step 300, the portal screen generation processing unit 106 selects the web browser. The number of portlets requested by the side processing apparatus 101 is counted, a control variable for repeatedly performing the number of portlets is set, and the processing from step 301 to step 304 is repeated.

  In step 301, the portal screen generation processing unit 106 reads out the portlet requested by the Web browser side processing device 101 from the magnetic disk device. At this time, the data read by the portal screen generation processing unit 106 is HTML data of a portlet such as the local portlet 211 and the remote portlet 213 in FIG.

  Next, the portal screen generation processing unit 106 sends the read portlet data to the safety verification processing unit 107 to inquire about safety. The safety verification processing unit 107 extracts a command described in the portlet received from the portal screen generation processing unit 106 on the memory and verifies the safety, and the verification result is displayed on the portal screen generation processing unit. Return to 106. The portal screen generation processing unit 106 refers to the verification result returned from the safety verification processing unit 107. If the read portlet is determined to be safe by the safety verification processing unit 107, the process proceeds to step 302. move on.

  In step 302, the portlet determined to be safe by the safety verification processing unit 107 is stored in the memory as HTML data for content display, and other portlets determined to be safe are stored in an HTML TABLE tag or the like. Use it to add and synthesize on the memory.

  On the other hand, as a result of referring to the verification result returned from the safety verification processing unit 107 in step 301, if the read portlet is not determined to be safe by the safety verification processing unit 107, the process proceeds to step 303.

  In step 303, the portlet that is not determined to be safe by the safety verification processing unit 107 is stored in the memory as single display HTML data different from the content display HTML data, and the portlet is displayed alone. HTML data is generated. The portlet content is premised on being synthesized, and since HTML tags and BODY tags are not attached, these tags are added to the portlet to generate single display HTML data.

  FIG. 6 is a diagram showing an example of HTML data for single display according to the present embodiment. In FIG. 6, HTML data 600 represents an HTML description example for displaying a portlet that has not been determined to be safe by the safety verification processing unit 107. In this case, in the tag addition units 601 and 602, Only one HTML tag and BODY tag are added to generate one piece of HTML data that can be displayed independently.

  Here, data for outputting a warning message indicating that content that has not been determined to be safe is included, is added to the HTML data 600, and the warning message is displayed when the HTML data 600 is displayed. You may make it output to an output device.

  Step 304 is the end of the iteration corresponding to step 300. After these repetitions are completed, HTML data for content display is generated by adding an HTML tag or a BODY tag to the portlet synthesized for content display. Through the above processing from Step 300 to Step 304, the content screen HTML data for collecting only the portlets that are determined to be safe and the portlet that is not determined to be safe are displayed alone. Single display HTML data is generated.

  Next, in step 305, a script that is activated by a JavaScript onUnload event handler or the like is added to secure content display HTML data, and a process for displaying the single display data in a separate window is described in the script. This script allows the Web browser side processing apparatus 101 to display a secure content portal screen at first, and display the HTML data for single display after closing the safe content screen.

  FIG. 7 is a diagram showing an example of an HTML of a portal screen obtained by synthesizing a secure portlet according to the present embodiment. The HTML data 500 of FIG. 7 is HTML data for content display obtained by synthesizing a safe portlet that responds to the processing device 101 on the Web browser side, and the content of each portlet is combined with a TABLE tag in the portlet combining portion 501. .

  The single display script 502 is a code for calling up the single display HTML data when this screen is finished or when another screen is displayed.

  The portal screen generation processing unit 106 defines a script for generating a new window of single display HTML data in the SCRIPT tag of the single display script 502 by using the window function, and is safe using the onUnload event handler of the BODY tag. By causing the Web browser side processing apparatus 101 to execute the script when the portlet page determined to be closed, the Web browser side processing apparatus 101 displays a portlet that has not been determined to be safe in a separate window. Realize with.

  As shown in FIGS. 7 and 6, HTML data 500 that is HTML data for content display and HTML data 600 that is HTML data for single display are independent data surrounded by different HTML tags, as shown in FIGS. Therefore, the HTML data 500 is not affected by the instruction in the HTML data 600 at the time of display.

  In step 306, the content display HTML data generated as described above is transmitted to the Web browser side processing apparatus 101 by the communication device, and it is determined that the portal screen is a collection of only the portlets determined to be safe and is safe. The HTML data 500 for displaying the portlet that has not been displayed in a separate window is returned to the Web browser side processing apparatus 101.

  FIG. 8 is a diagram showing a configuration of the safety verification processing unit 107 of the present embodiment. As shown in FIG. 8, the safety verification processing unit 400 includes a script language analysis unit 401 and a dangerous instruction list 402.

  The script language analysis unit 401 extracts the instructions described in the portlet read by the portal screen generation processing unit 106 in the memory and compares them with the instructions in the dangerous instruction list 402, thereby ensuring the safety of the portlet. It is a processing unit for verifying the property.

  In the dangerous instruction list 402, a script language instruction using the DOM interface, which is an instruction for referring to and updating HTML contents, is defined. For example, since the getElementsByTagName command can acquire the value of any tag in HTML, there is a risk of leakage of confidential information when combined with a command that communicates with the outside, and the appendChild command etc. Since the value can be changed, there is a risk of information falsification. In addition, classes such as document and element used in the DOM interface instead of the instruction may be defined.

  From the above viewpoint, in the dangerous instruction list 402, instructions and classes that have a risk of information falsification and information leakage are defined. However, since the script language is extended, An input of a command that can be tampered with or leaked may be received from a system administrator by an input device, and the received command may be registered in the dangerous command list 402 in the memory.

  When the script language analysis unit 401 of the safety verification processing unit 107 receives an inquiry about the safety of the portlet from the portal screen generation processing unit 106 in step 301, the script language analysis unit 401 analyzes the portlet received from the portal screen generation processing unit 106 in memory. Then, after extracting the instruction described therein, the extracted instruction and the instruction in the dangerous instruction list 402 are compared to determine whether the extracted instruction matches the instruction in the dangerous instruction list 402 or not. Investigate. If none of the extracted instructions matches the instruction in the dangerous instruction list 402, the portlet determines that the portlet is safe, and if there is even one, the portlet is not safe. The determination result is returned to the portal screen generation processing unit 106.

  For example, when verifying the safety of the remote portlet 213 shown in FIG. 4, the script language analysis unit 401 analyzes the remote portlet 213 on the memory, extracts the getElementsByTagName instruction described therein, and extracts the dangerous instruction list. The command in 402 is compared, and it is detected that the getElementsByTagName command matches the command in the dangerous command list 402, and a determination result that the remote portlet 213 is not safe is returned to the portal screen generation processing unit 106.

  In the above process, the safety verification processing unit 107 verifies the safety of the portlet by comparing with the dangerous instruction list 402. However, there is a possibility of information falsification or information leakage by simulating the instruction processing in the portlet. It may be verified whether it exists.

  That is, a plurality of portlets requested by the Web browser-side processing apparatus 101 are synthesized on a memory to generate content test HTML data, and the script language analysis unit 401 simulates instructions in each portlet in the content test data. To check whether the content of the content is falsified or leaked, that is, whether the content of other portlets is changed or sent to the outside, and the content is not changed or sent to the outside If so, determine that the portlet is safe.

  For example, when verifying the safety of the remote portlet 213 shown in FIG. 4 by simulation, the script language analysis unit 401 synthesizes the local portlet 211 and the remote portlet 213 on the memory and generates the HTML data 210 as HTML data for content testing. Generate and execute the instructions in each portlet in the content test HTML data, that is, the getElementsByTagName instruction and the setAttribute instruction in the remote portlet 213 by the script language analysis unit 401 in a pseudo manner, and the local portlet in the content test HTML data Whether there is a change before and after the execution of 211, or the presence or absence of communication to the outside such as passing a value as a parameter to the outside when referring to an external link.

  In the example of FIG. 4, the hyperlink of the A tag 212 in the local portlet 211 is changed to http: // yyy by executing the getElementsByTagName instruction or the setAttribute instruction in the remote portlet 213, so in the content test HTML data By detecting this change, it is possible to determine that the remote portlet 213 is not safe.

As described above, according to the Web display device of the present embodiment, when a content is generated by combining a plurality of portlets, the content is generated by combining the portlets that have verified the safety of the described instructions. Therefore, when combining a plurality of portlets to display content, it is possible to prevent content from being combined and to display the content safely, including instructions that may cause information falsification or leakage.
(Embodiment 2)
A Web display apparatus according to the second embodiment will be described below in which a content is generated by synthesizing a plurality of portlets, and whether or not it is possible to synthesize based on a security attribute and an access control list.

  FIG. 9 is a diagram showing an overall configuration of the Web portal processing apparatus 100 of the present embodiment. As shown in FIG. 9, the Web portal processing apparatus 100 of this embodiment includes a portal screen layout definition unit 900. The portal screen layout definition unit 900 is a processing unit that receives a selection of a portlet by a portal server administrator or a portal user and generates a portal screen layout definition.

  When the portal screen layout definition in the portal screen layout definition unit 900 accepts an operation for adding a portlet, the safety verification processing unit 107 according to the present embodiment displays the portlet's security attributes and access control list in the portlet attribute table 901. The access control list table 902 is read, and only when it is determined that it is safe to synthesize the portlet based on the security attribute and the access control list, the process of permitting the addition of the portlet is performed.

  A program for causing the Web portal processing apparatus 100 to function as the portal screen layout definition unit 900 and the safety verification processing unit 107 that performs the above-described processing is recorded on a recording medium such as a CD-ROM and stored on a magnetic disk or the like. Suppose that it is loaded into memory and executed. The recording medium for recording the program may be a recording medium other than the CD-ROM. The program may be used by installing it from the recording medium into the information processing apparatus, or the program may be used by accessing the recording medium through a network.

  The Web portal processing apparatus 100 includes a portlet attribute table 901 and an access control list table 902.

  The portlet attribute table 901 is a table that stores information related to security. The access control list table 902 is a table that stores an access control list that describes whether or not a portlet can be combined using the security attribute. The other hardware configuration of the Web portal processing apparatus 100 is the same as that of the first embodiment.

  FIG. 10 is a diagram showing details of the portlet attribute table 901 of this embodiment. The portlet attribute table 901 is a table for storing information related to portlet security.

  The type 1001 indicates whether the portlet is installed and executed locally on the Web portal processing apparatus 100 or executed on a remote server. Since a portlet executed on a remote server is basically outside the management range of the administrator of the Web portal processing apparatus 100, it can be said that it cannot be simply determined whether the portlet is safe or dangerous. In this embodiment, the type 1001 is two types, local or remote, but it is also possible to define in more detail a remote server in the intranet, a remote server outside the intranet, or the like.

  The importance 1002 is an attribute indicating the importance of the portlet content. The sensitivity of information handled by portlets varies. This attribute specifies the sensitivity of the information handled by the portlet, that is, the importance. In this embodiment, an “important” attribute is designated for a portlet that handles highly sensitive information, and a “general” attribute is designated for a portlet that handles information that is not particularly sensitive. In this embodiment, two types of importance, “important” and “general”, are defined, but it is also possible to define the importance more finely, such as “permit only reference to content from other portlets”. In addition, when the degree of importance is undefined, management can be facilitated by assigning “general”.

  The maliciousness level 1003 is an attribute indicating the degree of maliciousness of the portlet. As described in the above embodiment, it is technically possible to wiretap or tamper with contents of other portlets by including in the portlet contents a program language such as JavaScript that refers to or changes the contents in HTML. Is possible. This attribute defines whether the portlet refers to or edits such other portlets, that is, whether it has malicious intent.

  In this embodiment, when the portlet is safe without referring to or editing other portlets, the attribute is “safe”, and when the security level is not verified and the maliciousness is unknown, the attribute is “unverified”. Is specified. In this embodiment, two types of maliciousness, “safe” and “unverified”, are defined, but it is also possible to define maliciousness in more detail, such as “refer to other portlets” and “edit other portlets”. It is. In addition, as with the importance definition method, it is possible to facilitate management, such as assigning “unverified” when the maliciousness level is not defined, and further, commands for referencing and editing in the portlet. It is also possible to support the definition of the malice degree by searching for and displaying.

  FIG. 11 is a diagram showing details of the access control list table 902 of this embodiment. The access control list table 902 stores a definition for determining whether or not a portlet can be combined.

  In this embodiment, it is assumed that an access control expression 1101 is defined for each portlet importance 1100, and the access control expression 1101 is a subset of a set of portlets permitted by an access control expression having a lower importance than itself. Shall be defined. As shown in FIG. 11, in this embodiment, a portlet with importance “important” can be combined only with a portlet with maliciousness “safe”, and a portlet with importance “general” can be combined with any portlet. Is going.

  In addition, in the case of the present embodiment, the importance and maliciousness values are ranked, and the importance is higher in the order of “important” and “general”, and the maliciousness is It is assumed that the degree of maliciousness increases in the order of “unverified” and “safe”.

  FIG. 12 is a flowchart showing a processing procedure of processing at the time of composition according to this embodiment. This process is called when adding a portlet to the portal screen layout. The processing procedure of FIG. 12 will be described based on the additional example shown in FIG.

  FIG. 13 is a diagram showing an example of adding a portlet according to this embodiment. In FIG. 13, [Case A] “Restaurant Menu” portlet is added to the portal screen layout 1300 including three portlets of “management information”, “material order”, and “notification” (additional example 1301), [Case B] A case where a “weather” portlet is added (additional example 1302) is shown. Using the settings of the portlet attribute table 901 in FIG. 10 and the access control list table 902 in FIG. Become.

  First, the processing method will be described. First, for the portlet included in the current portal screen layout 1300 to be added, the highest importance is acquired with reference to the portlet attribute table 901 (step 1200). In the present embodiment, the portal screen layout 1300 includes portlets for “management information”, “material ordering”, and “notification”, so the highest importance is “important”.

  Next, with reference to the access control list table 902, an access control expression 1101 corresponding to the importance acquired in step 1200 is acquired (step 1201). That is, an access control expression “malicious level = safe” corresponding to “important” is acquired.

  Next, the access control expression 1101 acquired in step 1201 verifies whether or not the portlet to be added can be combined. If the result of verifying whether or not composition is possible is composition permission, a portlet is added to the portal screen layout 1300 (step 1203), and if it is not permitted, a message “synthesis not permitted” is output.

  In this embodiment, [Case A] When adding a “canteen menu” portlet (additional example 1301), the malice level of the “canteen menu” portlet is “safe”, and the access control expression “malicious level = safe”. Is satisfied (step 1203). [Case B] When adding a “weather” portlet (additional example 1302), the maliciousness of the “weather” portlet is “unverified” and the access control expression “malicious” Since “degree = safe” is not satisfied, the composition is not permitted (step 1204).

  FIG. 14 is a diagram showing an example of a portlet isolation display according to this embodiment. In the above embodiment, when composition is not permitted, an error message is output and portlet composition is prohibited. However, as shown in FIG. 14, FQDN (Fully Qualified Domain Name) is used and HTML of other portlets is used. It is also possible to isolate and display so that it cannot be referred to.

  In that case, first, for isolation, an FQDN 1401 that is a secondary FQDN for isolation is set in the Web portal processing apparatus 100 in addition to the normal FQDN 1400 for portal screen display. This can be realized by adding an entry to a DNS (Domain Name System) server. If the session of the portal server is maintained with a cookie, the FQDN to be isolated is set to a common subdomain with the FQDN for normal display, and the domain option is normally used for the cookie for session maintenance. It can be shared for use and isolation.

  In the example of FIG. 14, like the non-permitted portlet display example 1404, the non-permitted portlet is displayed in another FQDN and in another window at the time of the click operation 1403, and the temporary portlet embedded with the link is synthesized as a portal screen. (Composite display example 1402). In the above example, a link is embedded in a temporary portlet and displayed in a separate window, but it is also possible to isolate it by inline display using an HTML iframe element. In addition to the maliciousness such as “Unverified”, “Refer other portlets”, and “Edit other portlets”, the maliciousness related to processing contents other than reference / editing such as “Generate window” is also defined. Portlets that may waste resources by creating an infinite number of windows may be prohibited from being isolated and displayed.

  In the above embodiment, an example has been described in which when a portlet is added to the portal screen layout, it is rejected or displayed after being added. On the other hand, when creating an additional candidate list for the portal screen layout, if the safety verification processing unit 107 verifies safety and determines that it is not safe, the portlet may not be displayed as an additional candidate list. Is possible.

  This safety verification process can be realized by the same method as the process of FIG. 12. For example, for a set of additional candidate portlets displayed in the process of the portal screen layout definition unit 900 shown in FIG. The access control list and the security attributes of the “canteen menu” and “weather” portlets are read out by 107, and only when it is determined that it is safe to synthesize, these portlets are displayed as additional candidates. .

  In the above embodiment, the administrator defines the access control list table 902. However, the administrator has an interface for setting the access control list in a batch including the setting of the portal user by the administrator. For the access control list set in a batch, the general user can perform the access control within the range permitted by the administrator by accepting the overwriting of the setting by the portal user and redefining it.

  FIG. 15 is a diagram showing a table configuration for realizing overwriting of the access control list of this embodiment. A default access control list table that can be set only by the administrator as shown in FIG. 15 is provided as an interface for collectively setting the access control list including the portal user settings by the administrator. The processing device 100 receives the setting content from the administrator and updates the default access control list.

  Further, as shown in FIG. 15, this access control list table is provided with a column indicating whether or not a general user can set. When an administrator permits a general user to override the setting override, “Allow” is designated in the setting change column 1500, and the general user can change the access control for the degree of importance permitted to be changed. And

  When the web portal processing apparatus 100 receives an instruction to overwrite the setting of the access control list from a general user, the Web portal processing apparatus 100 refers to the default access control list table and sets the setting change column 1500 of the item for which the overwriting instruction is performed. If the change is permitted, the received setting content is stored in the access control list table dedicated to the user, and the access control list dedicated to the user is set.

  Then, the security verification processing unit 107 first reads the user-specific access control list for the determination target portlet, and reads the default access control list when the user-specific access control list does not exist. To determine whether or not the composition is possible.

  As a result, the administrator can strictly set only important content for access control of content, and can delegate access control settings to users for other content, and easily and finely access while maintaining security. Control can be realized.

  As described above, the Web portal processing apparatus 100 has been described in the present embodiment. However, the present invention is effective when a plurality of contents are combined to generate a single screen. For example, a banner advertisement content is combined to display a screen. The present invention can also be applied to a general Web system that performs display.

  As described above, according to the Web display device of this embodiment, when a plurality of portlets are combined to generate content, whether or not combining is possible is determined based on the security attribute and the access control list. When displaying the content, it is possible to display the content safely by performing access control according to the security attribute between the synthesized portlets.

1 is a diagram illustrating an overall configuration of a Web display system according to a first embodiment. 2 is a diagram illustrating a hardware configuration of a Web portal processing apparatus 100 according to Embodiment 1. FIG. It is a figure which shows the example of the screen produced | generated by the portal screen production | generation process part 106 of Embodiment 1. FIG. It is a figure which shows the example of the HTML of the conventional portal screen. 3 is a flowchart illustrating a processing procedure of a portal screen generation processing unit 106 according to the first embodiment. FIG. 4 is a diagram illustrating an example of single display HTML data according to the first embodiment. It is a figure which shows the example of HTML of the portal screen which synthesize | combined the safe portlet of Embodiment 1. FIG. FIG. 3 is a diagram illustrating a configuration of a safety verification processing unit 107 according to the first embodiment. It is a figure which shows the whole structure of the web portal processing apparatus 100 of Embodiment 2. FIG. It is a figure which shows the detail of the portlet attribute table 901 of Embodiment 2. FIG. FIG. 10 is a diagram illustrating details of an access control list table 902 according to the second embodiment. 10 is a flowchart illustrating a processing procedure of processing at the time of composition according to the second embodiment. It is a figure which shows the example of addition of the portlet of Embodiment 2. FIG. FIG. 10 is a diagram illustrating an example of a portlet isolation display according to the second exemplary embodiment. FIG. 10 is a diagram showing a table configuration for realizing overwriting of an access control list according to the second embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 100 ... Web portal processing apparatus, 101 ... Web browser side processing apparatus, 102 ... Mail system, 103 ... Database, 104 ... Internet, 105 ... Remote portlet provision server, 106 ... Portal screen generation processing part, 107 ... Safety verification processing part , 200 ... Screen display examples, 201 and 202 ... Screen display examples, 210 ... HTML data, 211 ... Local portlet, 212 ... A tag, 213 ... Remote portlet, 214 ... Script instruction, 215 ... Script instruction, 600 ... HTML data, 601 and 602... Tag addition unit, 500. HTML data, 501. Portlet combination portion, 502. Single display script, 400. Safety verification processing unit, 401. Script language analysis unit, 402 ... Danger instruction list, 900. Surface layout definition section, 901 ... portlet attribute table, 902 ... access control list table, 1000 ... portlet, 1001 ... type, 1002 ... importance, 1003 ... malicious degree, 1100 ... importance, 1101 ... access control type, 1300 ... portal Screen layout, 1301 and 1302 ... addition example, 1400 ... FQDN, 1401 ... FQDN, 1402 ... composite display example, 1403 ... click operation, 1404 ... non-permitted portlet display example, 1500 ... setting change column

Claims (6)

In a Web processing method in a Web processing apparatus that includes a storage unit and generates a content by synthesizing a plurality of portlets described using a predetermined description language,
A step of reading out a portlet synthesized at the time of generating predetermined content from the storage means;
Extracting a command described in the read portlet and referring to a pre-stored dangerous command list to determine that it is safe;
Generating the content display data by combining the portlet with another portlet determined to be safe when it is determined that the read portlet is safe;
When the portlet read from the storage means is not determined to be safe, generating single display data for displaying the portlet alone;
It; and a step of adding the single display data in the content display data synthesized based on other portlets is determined to be safe, to display in a separate window instruction W eb Processing method. Receiving a web generation request from the web browser side processing device by a communication means;
Based on the content requested by the Web generation request, only the content display data or both the content display data and the single display data is returned to the Web browser side processing device by communication means. The Web processing method according to claim 1 , further comprising a step. In a Web processing method in a Web processing apparatus that includes a storage unit and generates a content by synthesizing a plurality of portlets described using a predetermined description language,
Determine whether the portlet is secure by referring to the access control list recorded in the storage means corresponding to the portlet to be combined;
If it is determined that the portlet is safe, the portlet is added to the content. If it is determined that the portlet is not safe, the domain name assigned to the Web processing apparatus and the common sub-domain name are related as the portlet call destination. A Web processing method, wherein an instruction using the subdomain name is added to the content in order to display the portlet in a separate window. In a Web processing apparatus that includes a storage unit and generates content by synthesizing a plurality of portlets described using a predetermined description language,
Means for reading out a portlet synthesized at the time of generating predetermined content from the storage means;
Means for extracting the instruction described in the read portlet and judging that it is safe if it does not exist by referring to a pre-stored dangerous instruction list;
Means for generating the portlet as content display data when it is determined that the read portlet is safe, and synthesizing with the other portlet determined to be safe;
When the portlet read from the storage means is not determined to be safe, generating single display data for displaying the portlet alone;
It; and a step of adding the single display data in the content display data synthesized based on other portlets is determined to be safe, to display in a separate window instruction W eb Processing equipment. In a Web processing apparatus that includes a storage unit and generates content by synthesizing a plurality of portlets described using a predetermined description language,
Means for referring to an access control list recorded in the storage means corresponding to the portlet to be combined to determine whether the portlet is safe;
If it is determined to be safe, the portlet is added. If it is determined that the portlet is not safe, the domain name assigned to the Web processing device and a common subdomain name are related as the portlet call destination, and the portlet And a means for adding an instruction using the subdomain name to the content in order to display the content in a separate window. In a Web generation program for causing a Web processing device to function by synthesizing a plurality of portlets described using a predetermined description language and generating content by including a storage unit,
A step of reading out a portlet synthesized at the time of generating predetermined content from the storage means;
Extracting a command described in the read portlet and referring to a pre-stored dangerous command list to be safe if not present;
When it is determined that the read portlet is safe, generating the content display data by combining with the other portlet determined to be safe with the portlet;
When the portlet read from the storage means is not determined to be safe, generating single display data for displaying the portlet alone;
W eb processing program that is characterized in that a step of adding an instruction to display in a separate window of the single data in the content display data synthesized based on other portlets is determined to be safe .

Images