JP5581961B2 - Relay device, relay program, and relay method - Google Patents

Description

  The present invention relates to a relay device, a relay program, and a relay method.

  In recent years, a form called SaaS (Software as a Service) that uses a necessary function as a service via the Internet is becoming widespread. The functions used as services include applications provided on the Internet as web services (hereinafter referred to as “web applications”). Since most web applications exchange data using the HTTP (Hyper Text Transfer Protocol) protocol, data access control using a Uniform Resource Locator (URL) is required. For this reason, use of a web application may be limited in terms of security such as wiretapping and spoofing. In particular, there are cases in which data that is classified as a trade secret, such as a company's management strategy, cannot be disclosed to the Internet even if it is encrypted.

  In other words, in a web application that exchanges data using the HTTP protocol, data access restrictions can be specified on a host (domain) basis, but not on a data or file basis. In addition, the OS (Operating System) in the lower layer of the HTTP protocol can control the opening / closing of ports in protocol units (whether HTTP protocol data is passed), but cannot control the opening / closing of ports in individual data or file units. .

  By the way, there is a technology that considers the safety of data that is considered a trade secret. For example, in the first technique, status information in which a server holding the data and an application that issues a transmission instruction for the data is stored is stored for data that is a trade secret. When a data transmission command is issued, if the application that issued the transmission command is registered in the status information and the transmission destination of the transmission command does not match the server registered in the status information, the data transmission Disable the directive.

  In the second technique, the relay device that transfers the data held by the computer via the network receives a transfer request from the request source device for the data, and the access authority of the request source device itself or the request source user Authenticate. Then, the relay device acquires the data for which the transfer request has been received from the computer according to the authentication result, and transfers the acquired data to the request source device via the network.

JP 2005-275669 A JP 2002-41347 A

  However, in the conventional technology that considers the security of data that is classified as confidential information, when data is exchanged using the HTTP protocol, data access can be restricted on a domain (host name) basis. There was a problem that it could not be specified in units.

  Even in the first technique and the second technique, if data is exchanged using the HTTP protocol, data access restrictions cannot be specified in units of data. That is, the first technique and the second technique can be controlled to prohibit access to data that is classified as confidential information by using status information about the data and access authority of the file system such as the requesting device itself. Only.

  As a result, in the conventional technology, when data that is classified as confidential information is stored in the same host as the host that is the data reference destination of the web application, the data that is classified as confidential information is referenced and rewritten from the web application. There is a risk that. In other words, even in the case of a web application executed using SaaS, since it is per host that can be specified as data access restriction, reference is made to confidential data stored in the data reference destination host. May end up.

  It is an object of the disclosed technique to restrict access to data stored in a data storage device in units of data or files even when data is exchanged using the HTTP protocol.

  In one aspect, the relay device includes a first web server connected to the own device via the Internet or a second web server connected to the Internet via the own device, a web client, and the own device. A relay device that relays data to and from a data storage device connected to the Internet via a storage unit that stores a public policy relating to data disclosure for each data stored in the data storage device; The access target data included in the request transmitted from the web client among the data stored in the data storage device is referred to the public policy stored in the storage unit, and the access target data included in the request If there is no restriction on publication, the request is transferred to the first web server, and the request is transferred. If there is a limit to the public data accessed included in Est, and a transfer unit for transferring the request to the first web server.

  According to one aspect of the relay device disclosed in the present application, even when data is exchanged using the HTTP protocol, access to data stored in the data storage device in units of data or files can be restricted.

FIG. 1 is a functional block diagram illustrating the configuration of the relay device according to the first embodiment. FIG. 2 is a functional block diagram illustrating the configuration of the relay device according to the second embodiment. FIG. 3 is a diagram illustrating an example of a data structure of the data management table. FIG. 4 is a diagram illustrating an example of the data structure of the application management table. FIG. 5 is a diagram for explaining a specific example of URL rewriting. FIG. 6 is a diagram illustrating a specific example of a method for referring to a deployment destination of a web application. FIG. 7 is a flowchart illustrating a procedure of relay processing in the relay device according to the second embodiment. FIG. 8 is a sequence diagram of the web application acquisition process in the relay process. FIG. 9 is a sequence diagram of access processing to confidential data in relay processing. FIG. 10 is a diagram for explaining the effect when data is accessed via a relay device. FIG. 11 is a diagram illustrating a computer that executes a relay processing program.

  Hereinafter, embodiments of a relay device, a relay program, and a relay method disclosed in the present application will be described in detail with reference to the drawings. The present invention is not limited to the embodiments.

  FIG. 1 is a functional block diagram illustrating the configuration of the relay device according to the first embodiment. As shown in FIG. 1, the relay device 1 is connected to a web client 2, an internal web server 3, and an in-house storage device 6, and is connected to an external web server 4 via the Internet 5. The form in which the relay device 1 connects to the web client 2, the internal web server 3, and the in-house storage device 6 without going through the Internet 5 is, for example, an in-house LAN (Local Area Network) or an in-house intranet.

  The relay device 1 relays data among the external web server 4 or the internal web server 3, the web client 2, and the in-house storage device 6. The web client 2 is a personal computer that uses a web service, for example. The internal web server 3 is a web server in the management of the relay device 1 that implements a web application provided on the Internet 5 as a web service. The external web server 4 is a web server that executes a web application as a web service and is not managed by the relay device 1. The external web server 4 is, for example, a web server incorporating SaaS (Software as a Service) or a web server under a cloud environment. Such an environment in which the web application of the external web server 4 can be downloaded and executed and maintained in the management of the relay device 1 is referred to as an on-premises environment. On the other hand, an environment in which a web application can be executed by the external web server 4 outside the management of the relay device 1 is referred to as an off-premises environment.

  The in-house storage device 6 stores data that is restricted in publication and data that is not restricted in publication. For example, data that is restricted in disclosure refers to confidential data such as confidential data.

  The relay device 1 includes a storage unit 11 and a transfer unit 12. The storage unit 11 stores a disclosure policy related to data disclosure for each data stored in the in-house storage device 6. For example, the storage unit 11 stores, for each data, a policy indicating that there is a restriction on disclosure and a policy indicating that there is no restriction on disclosure.

  The transfer unit 12 refers to the public policy stored in the storage unit 11 for the access target data included in the HTTP request transmitted from the web client 2 among the data stored in the in-house storage device 6. Further, the transfer unit 12 transfers the HTTP request to the external web server 4 in the off-premises environment when there is no restriction on the disclosure of the access target data included in the HTTP request. The external web server 4 receives the HTTP request, and takes in the data to be accessed from the in-house storage device 6 via the relay device 1 in order to execute the web application in the own device in response to the HTTP request. Then, the external web server 4 executes a web application using the fetched data, and notifies the web client 2 via the relay device 1 of the processing result corresponding to the data that is not restricted for publication.

  On the other hand, the transfer unit 12 transfers the HTTP request to the sandbox of the internal web server 3 in the on-premises environment when there is a restriction on the access target data included in the HTTP request. The internal web server 3 receives the HTTP request, and takes in the data to be accessed from the in-house storage device 6 via the relay device 1 in order to execute the web application downloaded to the sandbox in response to the HTTP request. Then, the internal web server 3 executes the web application safely in the sandbox using the fetched data, and notifies the web client 2 via the relay device 1 of the processing result corresponding to the data that is restricted in publication. Will be. Note that the sandbox of the present embodiment refers to a security model that prevents an unauthorized operation of the system by operating a program received from outside in a protected area. Since the program to be executed enters the protected area and is operated in a state where other programs and data cannot be operated, so that the system will not be affected even if the program runs away or tries to run a virus it can.

  In this way, the relay device 1 can selectively determine whether to transfer the HTTP request to the web server in the off-premises environment or the on-premises environment based on the disclosure policy of the data to be accessed included in the HTTP request. For this reason, since the relay apparatus 1 can transfer the HTTP request to the web server in the on-premises environment with respect to the access target data that is restricted in disclosure, it is possible to prevent the access target data from flowing out to the off-premises environment. On the other hand, the relay device 1 can transfer an HTTP request to a web server in an off-premise environment for access-targeted data that is not restricted to be published. Can be prevented.

  In addition, since the relay device 1 allows the web application to fetch the data to be accessed from the in-house storage device 6 through the own device with a URL that can be uniquely identified, the access destination of the data to be accessed is determined. It can be specified in data units. As a result, even when data whose release is restricted is stored in the same host as the access destination host of the access target data, the relay device 1 refers to the data whose release is restricted from the web application. Can be prevented.

[Configuration of Relay Device According to Second Embodiment]
FIG. 2 is a functional block diagram illustrating the configuration of the relay device according to the second embodiment. As shown in FIG. 2, the relay device 1 </ b> A is connected to the web client 2, the internal web server 3, and the in-house storage device 6, and is connected to the external web server 4 via the Internet 5. The form in which the relay device 1 connects to the web client 2, the internal web server 3, and the in-house storage device 6 without going through the Internet 5 is, for example, an in-house LAN (Local Area Network) or an in-house intranet.

  The internal web server 3 is a web server in an on-premises environment and is a web server in the management of the relay device 1. The external web server 4 is a web server in an off-premise environment and is a web server outside the management of the relay device 1. The external web server 4 refers to a web server in a cloud environment, for example. The in-house storage device 6 stores data used in web applications in an on-premises environment and an off-premises environment. The internal storage device 6 includes, for example, confidential data that cannot be disclosed to the external web server 4 and data that can be disclosed to the external web server 4. The internal storage device 6 may include data that cannot be disclosed to either the external web server 4 or the internal web server 3.

  The relay device 1A includes a control unit 20 and a storage unit 30. The relay device 1A is an example of the relay device 1 according to the first embodiment. The control unit 20 includes a request reception unit 21 that controls an HTTP request, a request analysis unit 22, a distribution unit 23, a request transfer unit 24, and a data relay unit 25. In addition, the control unit 20 includes a response reception unit 26 that controls an HTTP response, a response analysis unit 27, a URL rewriting unit 28, and a response transfer unit 29. The distribution unit 23, the request transfer unit 24, and the response transfer unit 29 are examples of the transfer unit 12 according to the first embodiment. The control unit 20 is, for example, an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array) or an electronic circuit such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit).

  The storage unit 30 includes a data management table 31 and an application management table 32. The data management table 31 is an example of the storage unit 11 according to the first embodiment. The storage unit 30 is, for example, a semiconductor memory device such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk.

  The request reception unit 21 receives various HTTP requests and outputs the received HTTP requests to the request analysis unit 22. For example, the request receiving unit 21 receives an HTTP request transmitted from the web client 2 and indicating an execution request for the web application, and outputs the received HTTP request to the request analyzing unit 22. This HTTP request includes the URL of the web application requested to be executed and the URL of the data to be accessed.

  The request reception unit 21 is transmitted from the web application as a result of starting processing based on the HTTP request from the web client 2 later in the web application of the internal web server 3 in the on-premises environment or the external web server 4 in the off-premises environment. An HTTP request indicating an access request for data necessary for execution of processing based on the HTTP request is received. That is, when an HTTP request from the web client 2 is processed by a web application in an on-premises environment or an off-premises environment, data necessary for execution is not directly accessed from the web application, but indirectly via the relay device 1A. Make it accessible. This description will be described later.

  The request analysis unit 22 analyzes the HTTP request received by the request reception unit 21.

  The distribution unit 23 determines a web application to which the HTTP request should be distributed, based on the public policy related to the disclosure of the access target data included in the HTTP request analyzed by the request analysis unit 22. Specifically, the distribution unit 23 refers to a public policy stored in a data management table 31 described later for access target data included in the HTTP request analyzed by the request analysis unit 22. In addition, the distribution unit 23 determines that the HTTP request is distributed to the web application of the external web server 4 when the referred public policy is not confidential, for example. Then, the distribution unit 23 outputs an HTTP request whose destination is the web application of the external web server 4 to the request transfer unit 24.

  The distribution unit 23 determines that the HTTP request is distributed to the internal web server 3 in the on-premises environment when the referred public policy is, for example, confidential. Then, the distribution unit 23 registers the URL of the web application included in the HTTP request and the identification number of the data to be accessed stored in the data management table 31 in association with each other in the application management table 32. Further, the distribution unit 23 outputs an HTTP request for requesting the external web server 4 to transfer a web application to the request transfer unit 24.

  Here, the data structure of the data management table 31 will be described with reference to FIG. FIG. 3 is a diagram illustrating an example of the data structure of the data management table 31. As shown in FIG. 3, the data management table 31 stores a data ID 31a and a confidential data URL 31b in association with each other. The data ID 31a indicates a data identification number. The confidential data URL 31b indicates the URL of confidential data among the data permitted to be accessed from the web application. In other words, the confidential data URL 31b indicates the URL of data that is restricted from being disclosed outside the company. It is assumed that the data management table 31 is created in advance before relay processing is performed.

  The data structure of the application management table 32 will be described with reference to FIG. FIG. 4 is a diagram illustrating an example of the data structure of the application management table 32. As shown in FIG. 4, the application management table 32 stores a service provider web application URL 32a, a data ID 32b, and a web application deployment location URL 32c in association with each other. The service provider web application URL 32 a indicates a web server that provides a web application service, that is, a URL in the external web server 4 here. The data ID 32 b indicates an identification number of data accessed from the web application, and is associated with the data ID 31 a of the data management table 31. The web application deployment location URL 32c indicates the URL of the location where the web application is deployed, that is, the URL of the internal web server 3 here. In the present embodiment, deployment refers to placing a compiled program or class file of a web application so that the web client 2 can execute the program.

  Returning to FIG. 2, the request transfer unit 24 transfers various HTTP requests to the external web server 4. For example, if the HTTP request for the web application is distributed to the internal web server 3 in the on-premises environment by the distribution unit 23, the request transfer unit 24 sends an HTTP request for requesting the transfer of the web application to the external web server 4. Forward.

The request transfer unit 24 transfers the HTTP request for the web application to the external web server 4 when the sorting unit 23 distributes the HTTP request for the web application to the external web server 4. At this time, the URL of the data to be accessed included in the HTTP request is a URL rewritten so as to be indirectly accessed via the relay device 1A. The rewriting of the URL is performed by the distribution unit 23, for example.

  The response reception unit 26 receives an HTTP response corresponding to the HTTP request transferred by the request transfer unit 24 from the external web server 4, and outputs the received HTTP response to the response analysis unit 27. For example, the response receiving unit 26 receives from the external web server 4 an HTTP response to an HTTP request for requesting transfer of a web application. That is, the response reception unit 26 acquires the web application requested to be transferred by the request transfer unit 24 from the external web server 4. Then, the response accepting unit 26 outputs the accepted web application to the response analyzing unit 27.

  The response analysis unit 27 analyzes the HTTP response received by the response reception unit 26.

  The URL rewriting unit 28 acquires a web application from the external web server 4 and deploys the acquired web application in the sandbox of the internal web server 3. Specifically, the URL rewriting unit 28 acquires a web application that is an HTTP response analyzed by the response analysis unit 27, and deploys the acquired web application to the sandbox of the internal web server 3. Then, the URL rewriting unit 28 acquires the URL of the web application deployment destination, and updates the application management table 32 by associating the acquired URL with the data ID 32b of the data to be accessed.

  Further, the URL rewriting unit 28 rewrites the URL including the data access path so that the access path of the data to be used used in the deployed web application passes through its own device. Specifically, the URL rewriting unit 28 rewrites the URL of the data to be accessed included in the HTTP response so as to pass through the relay device 1A. That is, the URL rewriting unit 28 does not directly access the data to be accessed from the web application, but indirectly accesses the data from the web application via the relay device 1A.

  Here, a specific example of rewriting the URL of the data to be accessed by the URL rewriting unit 29 will be described with reference to FIG. FIG. 5 is a diagram for explaining a specific example of URL rewriting. FIG. 5A shows a URL before rewriting, and FIG. 5B shows a URL after rewriting. As shown in FIG. 5A, the URL before rewriting the data to be accessed is described as a query character string so that the confidential data (U1) that is the data to be accessed is directly accessed. Yes. On the other hand, as shown in FIG. 5B, the URL after the rewriting of the access target data describes that the confidential data that is the access target data is indirectly accessed. That is, the confidential data (U3) is rewritten by the URL rewriting unit 28 so as to be accessed after passing through the relay server (U2). Here, the URL after rewriting is URL encoded in order to convert a symbol such as a character string other than alphanumeric characters into a safe form.

  Returning to FIG. 2, the URL rewriting unit 28 outputs a processing request to the web application using the URL of the web application deployment destination and the URL of the data in which the URL has been rewritten, to the response transfer unit 29.

  The response transfer unit 29 transfers various HTTP responses according to each HTTP response. For example, the response transfer unit 29 transfers an HTTP response corresponding to the processing request to the web application by the URL rewriting unit 28 to the internal web server 3. That is, if the data disclosure policy included in the HTTP request transmitted from the web client 2 is confidential, the response transfer unit 29 sends the HTTP request indirectly via the external web server 4 to the internal web server. Will be transferred to the 3 sandbox. Note that the URL of the data included in the HTTP request is a URL rewritten by the URL rewriting unit 28 so as to be accessed via the relay device 1A. As a result, the internal web server 3 transmits, based on the HTTP response, an HTTP request indicating an access request for the data to the relay device 1A based on the URL of the data in order to access the data to be accessed necessary for processing. Will be.

  The data relay unit 25 determines whether or not to permit access to the data requested to be accessed by the HTTP request. Specifically, the data relay unit 25 determines whether or not a public policy is stored in the data management table 31 for the data to be accessed included in the HTTP request analyzed by the request analysis unit 22. Then, the data relay unit 25 determines that the access can be permitted when the public policy is stored for the data to be accessed. On the other hand, if the public policy is not stored for the data to be accessed, the data relay unit 25 determines that the access is unauthorized and determines that access is not permitted.

  Further, when determining that the access to the data to be accessed can be permitted, the data relay unit 25 determines whether or not the deployment destinations of the web application match based on the application management table 32. To do. More specifically, the data relay unit 25 refers to the data ID 31 a of the access target data stored in the data management table 31. Then, the data relay unit 25 refers to the web application deployment location URL 32c corresponding to the data ID that matches the referenced data ID 31a from the application management table 32. Then, the data relay unit 25 determines whether or not the referred web application deployment location URL 32c matches the deployment destination of the requested web application. If the referenced web application deployment location URL 32c matches the requested deployment destination of the web application, the data relay unit 25 determines that the access is normal and determines that the access is permitted. On the other hand, when the referenced web application deployment location URL 32c does not match the requested deployment destination of the web application, the data relay unit 25 determines that the access is unauthorized and determines that access is not permitted.

  Here, a specific example of a method of referring to the deployment destination of the requested web application by the data relay unit 25 will be described with reference to FIG. FIG. 6 is a diagram illustrating a specific example of a method for referring to a deployment destination of a web application. 6A is an example of referring to a Referer described in a referer header of an HTTP request, and FIG. 6B is an example of referring to a transmission source IP address in TCP / IP communication. .

  As shown in FIG. 6A, the deployment destination of the web application is the transmission source (d1) described in the Referer header of the HTTP request. For this reason, the data relay unit 25 can refer to the deployment destination of the web application from the Referer header of the HTTP request.

  As shown in FIG. 6B, when a web application is deployed on a server basis, the deployment destination of the web application is the source IP address d2 described in the packet header part in TCP / IP communication. Become. For this reason, the data relay unit 25 can refer to the deployment destination of the web application from the packet header part in the TCP / IP communication.

  Returning to FIG. 2, when it is determined that access is permitted, the data relay unit 25 acquires the data to be accessed from the in-house storage device 6, and uses the acquired data as a web request for data access. Pass to application.

  The data relay unit 25 determines whether or not the public policy is stored in the data management table 31 for the access target data included in the HTTP request, and permits the access when the public policy is stored. It was determined that it was possible. However, the data relay unit 25 is not limited to this, and the predetermined identification information included in both the access request for the data to be accessed and the HTTP request at the time of the access request is determined before the determination of the public policy. It may be determined whether or not they match. In this case, if they match, the data relay unit 25 determines whether or not the public policy is stored in the data management table 31 for the data to be accessed, and when the public policy is stored, It is determined that access can be permitted. The predetermined identification information may be, for example, a user identification ID, an HTTP request identification ID, or a session ID, and is included in both the access request and the HTTP request. It only needs to be information.

[Procedure for Relay Processing According to Second Embodiment]
Next, the relay processing procedure according to the second embodiment will be described with reference to FIG. FIG. 7 is a flowchart illustrating a procedure of relay processing according to the second embodiment.

  First, the request receiving unit 21 determines whether an HTTP request indicating a web application execution request has been received from a user (web client 2) (step S11). If it is determined that the HTTP request has not been received from the user (step S11; No), the request receiving unit 21 proceeds to step S11 in order to wait for the HTTP request.

  On the other hand, when it is determined that the HTTP request has been received from the user (step S11; Yes), the distribution unit 23 determines whether the access target data included in the HTTP request is confidential data ( Step S12). Specifically, the distribution unit 23 determines whether or not the URL of the access target data included in the HTTP request is stored in the confidential data URL 31 b of the data management table 31.

  If it is determined that the access target data is confidential data (step S12; Yes), the distribution unit 23 registers the URL of the web application and the data ID of the access target data in the application management table 32 (step S12). S13). Specifically, the distribution unit 23 associates the URL of the web application included in the HTTP request with the data ID 31 a of the data to be accessed stored in the data management table 31 and registers it in the application management table 32.

  Subsequently, the distribution unit 23 transfers the HTTP request for requesting transfer of the web application to the external web server 4 that is the service provider via the request transfer unit 24 (step S14). Then, the response reception unit 26 acquires a web application from the service provider. Then, the URL rewriting unit 28 deploys the acquired web application in the sandbox of the internal web server 3 and receives the URL of the web application at the deployment destination (step S15).

  Then, the URL rewriting unit 28 updates the received application URL to the application management table 32c in association with the data ID 32b of the access target data. Then, the URL rewriting unit 28 rewrites the URL of the data to be accessed so as to pass through the relay device 1A, and requests the web application to perform processing (step S16).

  Subsequently, the request reception unit 21 receives an HTTP request indicating an access request for data to be accessed necessary for execution from the web application (step S17). The HTTP request includes the URL of data to be accessed. That is, since the URL of the data to be accessed is rewritten by the URL rewriting unit 28 so as to pass through the relay device 1A, an access request for the data is transmitted from the web application to the relay device 1A.

  Then, the data relay unit 25 determines whether the URL of the access target data included in the HTTP request is a URL that permits access (step S18). If it is determined that the URL of the data to be accessed is a URL that permits access (step S18; Yes), the data relay unit 25 determines that the data is normal data. Then, the data relay unit 25 acquires data to be accessed from the in-house storage device 6, and passes the acquired data to the web application that requested the access (step S19). That is, the data relay unit 25 does not allow the web application to acquire data to be accessed directly from the in-house storage device 6 but indirectly through the relay device 1A. Then, the web application receives the processing result and notifies the user (step S20).

  On the other hand, when it is determined that the URL of the data to be accessed is not a URL permitting access (step S18; No), the data relay unit 25 determines that the access is unauthorized. Then, the data relay unit 25 interrupts the relay process (step S21). Then, the data relay unit 25 notifies the user (web client 2) that there has been unauthorized access (step S22).

  If the distribution unit 23 determines that the access target data included in the HTTP request is not confidential data (step S12; No), for example, the distribution unit 23 sets the URL of the access target data to the relay device 1A. Rewrite to go through. Then, the distribution unit 23 transmits an HTTP request whose destination is the web application to the external web server 4 that is the service provider (step S23). Subsequently, the request reception unit 21 receives an HTTP request indicating an access request for data to be accessed necessary for execution from the web application (step S24), and proceeds to step S18.

  Further, the web application deployed on the internal web server 3 may be deleted from the internal web server 3 every time processing of a request from the web client 2 ends. For example, when the data access request source of S17 or S24 is the web application of the internal web server 3, the relay device 1A requests the internal web server 3 to delete the web application after the processing of S20 or S22. A method may be considered in which the internal web server 3 deletes the web application from its own sandbox based on this request. Alternatively, the operation of the web application may be monitored by the internal web server 3, and the web application may be deleted when a predetermined time has elapsed since the last operation. Then, after deletion, the web application information may be deleted from the application management table 32. With this process, the web application that has finished processing the request from the web client 2 can be deleted from the sandbox of the internal web server 3.

[Sequence of Web Application Acquisition Processing Among Relay Processing According to Second Embodiment]
Next, a web application acquisition process sequence in the relay process according to the second embodiment will be described with reference to FIG. FIG. 8 is a sequence diagram of the web application acquisition process in the relay process according to the second embodiment.

  First, the web client 2 selects a web application and access target data, and transmits an HTTP request indicating a web application execution request (step S31). Here, the contents of the HTTP request are as follows. The POST method is “/ api / input HTTP / 1.1”. The host name is assumed to be the relay device 1A (gw.company.com). The URL of the web application is assumed to be located on the external web server 4 (http://www.cloud.com/api/app1). The URL of the access target data is assumed to be stored in the in-house storage device 6 (http://data.company.com/private/data1.xml). It is assumed that the URL of the access target data is stored in the data management table 31 in association with a data ID (for example, “1”) as confidential data.

  Then, the relay device 1A receives the HTTP request, and determines the public policy for the access target data included in the received HTTP request based on the data management table 31 (step S32). Here, since the URL (http://data.company.com/private/data1.xml) of the access target data is stored in the data management table 31, it is determined that the public policy is confidential. Then, the relay apparatus 1A associates the URL (http://www.cloud.com/api/app1) of the web application included in the HTTP request with the data ID of the access target data and registers it in the application management table 32. (Step S33).

  Subsequently, the relay apparatus 1A determines that the HTTP request is distributed to the internal web server 3 in the on-premises environment because it is determined that the disclosure policy of the access target data is confidential. Then, the relay apparatus 1A transmits an HTTP request for requesting transfer of the web application to the external web server 4 (www.cloud.com) (step S34). Here, the contents of the HTTP request are as follows. The GET method is “/api/app1.war HTTP / 1.1”. The host name is external web server 4 (www.cloud.com).

  Thereafter, the relay device 1A acquires a web application from the external web server 4 (step S35), and deploys the acquired web application to the sandbox of the internal web server 3 (www.company.com) (step S36). Here, the content of the HTTP response is as follows. The POST method is “/ app HTTP / 1.1”. The host name is the internal web server 3 (www.company.com).

  Subsequently, the relay device 1A acquires the URL of the web application deployment destination from the internal web server 3 (step S37), and updates the application management table 32 so as to be the acquired URL (step S38). Here, the URL of the deployment destination stored in the application management table 32 is “http://www.company.com:1111/app/app1”. Then, the relay device 1A rewrites the URL of the data so that the access path of the access target data used in the web application passes through the relay device 1A (step S39).

  Thereafter, the relay device 1A requests the deployment destination web application to perform processing (step S40). Here, the content of the HTTP response is as follows. Let the GET method be "/app/app1?data=...data1.xml". The host name is the internal web server 3 (www.company.com:1111).

[Sequence of access processing to confidential data in relay processing according to embodiment 2]
Next, a sequence of access processing to confidential data in the relay processing according to the second embodiment will be described with reference to FIG. FIG. 9 is a sequence diagram of access processing to confidential data in the relay processing according to the second embodiment.

  When the deployment destination web application of the internal web server 3 is executed, the internal web server 3 transmits an HTTP request indicating a data access request to the relay device 1A in order to request data necessary for processing (step S41). ). Here, the contents of the HTTP request are as follows. The GET method is “http://data.company.com/private/data1.xml HTTP / 1.1”. The host name is assumed to be the relay device 1A (gw.company.com).

  Subsequently, when the relay device 1A acquires the data access request, the relay device 1A determines whether to permit access to the requested data (http: //data,company.com/private/data1.xml). (Step S42). For example, the relay device 1 </ b> A determines whether or not a public policy is stored in the data management table 31. Here, since the public policy is stored in the data management table 31, the relay device 1A determines that access can be permitted. Further, the relay device 1A determines whether the deployment destination of the web application matches based on the application management table 32. Here, it is assumed that the referrer of the HTTP request is “http://www.company.com:1111/app/app1”. Then, since the referrer of the HTTP request matches the deployment destination URL stored in the application management table 32, the relay device 1A determines that the access is normal and determines that the access is permitted.

  Then, the relay device 1A requests the internal storage device 6 to acquire data (step S43). Here, the content of the HTTP response is as follows. The GET method is “/private/data1.xml HTTP / 1.1”. The host name is assumed to be in-house storage device 6 (data.company.com). Then, the relay device 1A acquires data from the in-house storage device 6 (step S44), and transmits the acquired data to the internal web server 3 (step S45). Further, when the relay apparatus 1A receives the processing result notification from the internal web server 3 (step S46), the relay apparatus 1A notifies the web client 2 of the processing result (step S47).

[Effect of Example 2]
According to the second embodiment, the distribution unit 23 of the relay device 1 </ b> A refers to the public policy stored in the data management table 31 for the access target data included in the HTTP request transmitted from the web client 2. If the data is not confidential, the distribution unit 23 transfers the HTTP request to the external web server 4 that is an off-premises environment. On the other hand, if the data is confidential, the distribution unit 23 transfers the HTTP request to the sandbox of the internal web server 3 that is an on-premises environment. According to such a configuration, the relay apparatus 1A can selectively determine whether to transfer the HTTP request to the web server in the off-premises environment or the on-premises environment based on the disclosure policy of the data to be accessed included in the HTTP request. . For this reason, the relay apparatus 1A can transfer the HTTP request to the web server in the on-premises environment with respect to the data to be accessed, which is confidential, and can prevent the data to be accessed from flowing out to the off-premises environment.

  According to the second embodiment, the URL rewriting unit 28 of the relay device 1A acquires the web application related to the HTTP request from the external web server 4 that is an off-premises environment. Then, the URL rewriting unit 28 deploys the acquired web application to the internal web server 3 in the on-premises environment. Then, the URL rewriting unit 28 rewrites the URL that is the access destination of the data so that the access path of the data to be used used in the deployed web application passes through its own device. According to such a configuration, the URL rewriting unit 28 passes the access path of the access target data used in the web application via the relay device 1A. For this reason, the URL rewriting unit 29 can designate the data access destination in units of data even when exchanging confidential data using the HTTP protocol. As a result, the URL rewriting unit 28 can prevent outflow of confidential data to the outside.

  Here, the effect of accessing data via the relay device 1A in the WWW (World Wide Web) will be described with reference to FIG. FIG. 10 is a diagram for explaining the effect of accessing data via the relay device 1A. As shown in FIG. 10, the relay device 1A is physically connected to the web client 2, the in-house storage device 6, and the internal web server 3 by Ethernet (registered trademark).

  In the WWW, the web application constructs an HTTP protocol on top of TCP / IP and exchanges data. For this reason, in a web application that operates in the sandbox of the internal web server 3 that exchanges data using the HTTP protocol, data access restrictions can be specified in host units (here, the in-house storage device 6). Cannot be specified. Incidentally, in-house storage device 6 may store confidential data in addition to data to be accessed. In such a case, if the web application of the internal web server 3 directly accesses the in-house storage device 6 for the data to be accessed (a1), there is a possibility of accessing confidential data other than the data.

  However, when the web application of the internal web server 3 indirectly accesses the in-house storage device 6 via the relay device 1A for the data to be accessed (a2), it accesses the confidential data other than the data. Can be prevented. That is, the web application can specify the data access destination in units of data. As a result, it is possible to prevent leakage of confidential data other than access target data.

  According to the second embodiment, when the data relay unit 25 obtains an access request for data whose URL has been rewritten by the URL rewriting unit 28 from the web application, the public policy is stored in the data management table 31 for the data. It is determined whether or not. When it is determined that the public policy is stored for the data, the data relay unit 25 relays the data access process. According to such a configuration, the data relay unit 25 can determine the correspondence between the access target data included in the HTTP request and the data requested to be accessed from the web application, and can access unauthorized data. Can be prevented. As a result, the data relay unit 25 can prevent leakage of confidential data to the outside via the web application.

  According to the second embodiment, the data relay unit 25 determines whether or not the predetermined identification information included in both the access request for the access target data and the HTTP request at the time of the access match. Then, when the predetermined identification information matches, the data relay unit 25 determines whether or not a public policy is stored for the data to be accessed in the data management table 31. When it is determined that the public policy is stored for the access target data, the data relay unit 25 relays the access processing of the access target data. According to such a configuration, the data relay unit 25 can relay the data to be accessed when the predetermined identification information included in both the HTTP request and the access request from the web application matches. Data access can be prevented.

  According to the second embodiment, the data management table 31 includes, for each data accessed from the internal web server 3 or the external web server 4 based on the HTTP request from the web client 2 among the data stored in the internal storage device 6. In addition, the disclosure policy relating to the disclosure of data to the internal web server 3 and the external web server 4 is stored. Then, the distribution unit 23 refers to the public policy stored in the data management table 31 for the access target data included in the HTTP request transmitted from the web client 2. Then, the distribution unit 23 invalidates the transfer of the HTTP request when there is no disclosure policy for either the internal web server 3 or the external web server 4 for the data. According to such a configuration, the distribution unit 23 invalidates the transfer of the HTTP request when there is no disclosure policy for the data in either the internal web server 3 or the external web server 4, so that the confidentiality is further increased. Data leakage to the outside and inside can be prevented.

  Note that the external web server 4 has been described as indicating a web server in a cloud environment, for example. However, the external web server 4 is not limited to this as long as it is a web server that can provide a web service.

  In addition, the on-premises environment is described as meaning an environment maintained in the company and capable of downloading and executing the application of the external web server 4. However, the on-premises environment is not limited to this as long as the application of the external web server 4 can be downloaded and executed.

  The relay device 1A is connected to the web client 2, the internal web server 3 and the in-house storage device 6 via the Internet, for example, in-house LAN (Local Area Network) or in-house intranet. As explained. However, this connection form is not limited to these as long as it is a network communicating with the HTTP protocol.

  Further, the data management table 31 has been described as storing publicly-confidential data that is restricted in public disclosure as a public policy for each data transmitted from the internal web server 3 to the web client 2. However, the data management table 31 stores, for each data transmitted from the internal web server 3 to the web client 2, as confidentiality data including confidential data and confidential data that is restricted to be disclosed externally and internally. It is good as a thing. In this case, the distribution unit 23 further refers to the public policy stored in the data management table 31 for the access target data included in the HTTP request transmitted from the web client 2. Then, the distribution unit 23 may invalidate the transfer of the HTTP request when the data is not disclosed outside or inside the company or when there is no disclosure policy.

  The distribution unit 23 determines that the HTTP request is distributed to the internal web server 3 in the on-premises environment when the public policy related to the access target data included in the HTTP request is, for example, confidential. In this case, the distribution unit 23 registers the identification number of the data to be accessed and the URL of the web application in the application management table 32 in association with each other. The distribution unit 23 has been described as requesting the external web server 4 to transfer the web application in order to deploy the web application to the internal web server 3. However, the distribution unit 23 may determine whether the URL of the web application is registered in the application management table 32. If it is registered, the distribution unit 23 registers the identification number of the data in the application management table 32, and rewrites the HTTP request in which the URL of the data is routed through the relay device 1A to the internal web server It is good also as what is transmitted to 3 web applications. On the other hand, the distribution unit 23 may request the external web server 4 to transfer the web application so that the web application can be deployed on the internal web server 3 when not registered.

[Programs]
The relay device 1A can be realized by mounting the functions such as the sorting unit 23, the URL rewriting unit 28, and the data relay unit 25 on an information processing device such as a known personal computer or workstation. .

  In addition, each component of each illustrated apparatus does not necessarily need to be physically configured as illustrated. That is, the specific mode of distribution / integration of each device is not limited to that shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. For example, the request analysis unit 22, the distribution unit 23, and the data relay unit 25 may be integrated as one unit. On the other hand, the URL rewriting unit 28 may be distributed into a deploying unit that deploys a web application acquired from the external web server 4 and a rewriting unit that rewrites the URL of data used in the web application. Further, the storage unit 30 such as the data management table 31 and the application management table 32 may be connected as an external device of the relay device 1A via a network.

  The various processes described in the above embodiments can be realized by executing a program prepared in advance on a computer such as a personal computer or a workstation. Therefore, in the following, an example of a computer that executes a relay processing program having the same function as the control unit 20 of the relay apparatus 1A illustrated in FIG. 2 will be described with reference to FIG.

  FIG. 11 is a diagram illustrating a computer that executes a relay processing program. As illustrated in FIG. 11, the computer 1000 includes a RAM 1010, a network interface device 1020, an HDD 1030, a CPU 1040, a medium reading device 1050, and a bus 1060. The RAM 1010, the network interface device 1020, the HDD 1030, the CPU 1040, and the medium reading device 1050 are connected by a bus 1060.

  The HDD 1030 stores a relay processing program 1031 having the same function as that of the control unit 20 shown in FIG. The HDD 1030 stores relay processing related information 1032 corresponding to the data management table 31 and the application management table 32 shown in FIG.

  Then, when the CPU 1040 reads the relay processing program 1031 from the HDD 1030 and develops it in the RAM 1010, the relay processing program 1031 functions as the relay processing process 1011. Then, the relay processing process 1011 expands information read from the relay processing related information 1032 and the like appropriately in an area allocated to itself on the RAM 1010, and executes various data processing based on the expanded data.

  The medium reading device 1050 reads the relay processing program 1031 from a medium that stores the relay processing program 1031 or the like even when the relay processing program 1031 is not stored in the HDD 1030. Examples of the medium reading device 1050 include a CD-ROM and an optical disk device. The network interface device 1020 is a device connected to an external device via a network, and corresponds to wired and wireless.

  Note that the relay processing program 1031 is not necessarily stored in the HDD 1030, and the computer 1000 may read and execute the program stored in the medium reading device 1050 such as a CD-ROM. . Further, this program may be stored in another computer (or server) connected to the computer 1000 via a public line, the Internet, a LAN, a WAN (Wide Area Network), or the like. In this case, the computer 1000 reads the program from these via the network interface device 1020 and executes it.

  The following appendices are further disclosed with respect to the embodiments including Examples 1 and 2 described above.

(Supplementary Note 1) First web server connected to own device via the Internet or second web server connected to the Internet via the own device, a web client, and connected to the Internet via the own device A relay device that relays data to and from a data storage device,
A storage unit for storing a disclosure policy relating to data disclosure for each data stored in the data storage device;
The access target data included in the request by referring to the public policy stored in the storage unit for the access target data included in the request transmitted from the web client among the data stored in the data storage device The request is transferred to the first web server if there is no restriction on the publication of the first web server, and if the publication of the access target data included in the request is restricted, the request is transferred to the first web server. And a transfer unit for transferring to the server.

(Supplementary Note 2) When the transfer unit transfers the request to the second web server, the web application related to the request is acquired from the first web server, and the acquired web application is acquired from the second web server. The relay according to claim 1, further comprising: a rewriting unit that is arranged in a server and rewrites the request so that an access path of data to be used used by the arranged web application passes through the own device apparatus.

(Supplementary Note 3) When an access request for access target data whose access path has been rewritten by the rewrite unit is received from a web application arranged in the second web server, a public policy for the access target data is stored in the storage unit. A relay unit that relays the access processing of the access target data when it is determined whether the access policy is stored and when it is determined that the public policy is stored for the access target data. The relay device according to appendix 2.

(Appendix 4) The relay unit
Whether or not a public policy is stored for the access target data in the storage unit when predetermined identification information included in both the access request for the access target data and the request at the time of the access request matches. The relay apparatus according to appendix 3, wherein the relay apparatus relays the access processing of the access target data when the determination is made and it is determined that the public policy is stored for the access target data.

(Supplementary Note 5) The storage unit
For each data accessed from the first web server or the second web server based on a request from the web client among the data stored in the data storage device, the first web server and the second web server Remember the publishing policy for publishing data to other web servers,
The transfer unit
With respect to the access target data included in the request transmitted from the web client, the public policy stored in the storage unit is referred to, and the data is transmitted to both the first web server and the second web server. 5. The relay device according to any one of appendix 1 to appendix 4, wherein the transfer of the request is invalidated when there is no public policy.

(Appendix 6) The transfer unit
If there is no restriction on data disclosure, rewrite the access path of the access target data used in the web application so that it passes through the own device, and transfer the rewritten request to the first web server. The relay device according to appendix 1, characterized by:

(Supplementary Note 7) Connected to the Internet via the first device, the first web server connected to the own device via the Internet or the second web server connected to the Internet via the own device, the web client, and the own device A relay method executed by a relay device that relays data to and from the data storage device,
For the data to be accessed included in the request transmitted from the web client among the data stored in the data storage device, a disclosure policy related to data disclosure is stored for each data stored in the data storage device When the disclosure policy stored in the storage unit is referenced and there is no restriction on the disclosure of the access target data included in the request, the request is transferred to the first web server, and the access included in the request When there is a restriction on disclosure of target data, the request is transferred to the second web server.

(Appendix 8)
For data to be accessed included in a request transmitted from a web client among data stored in a data storage device that stores data, a disclosure policy related to data disclosure is stored for each data stored in the data storage device If there is no restriction on the disclosure of the access target data included in the request with reference to the public policy stored in the storage unit, the request is sent to the first web connected to the own device via the Internet. When there is a restriction on the disclosure of the data to be accessed included in the request, the request is transferred to a second web server connected to the Internet via its own device. Relay program.

1, 1A Relay device 11, 30 Storage unit 12 Transfer unit 2 Web client 3 Internal web server 4 External web server 5 Internet 6 Internal storage device 20 Control unit 21 Request reception unit 22 Request analysis unit 23 Distribution unit 24 Request transfer unit 25 Data Relay unit 26 Response accepting unit 27 Response analyzing unit 28 URL rewriting unit 29 Response transfer unit 31 Data management table 32 Application management table

Claims (7)

A first web server connected to the own device via the Internet or a second web server connected to the Internet via the own device, a web client, and a data storage connected to the Internet via the own device A relay device that relays data to and from the device,
A storage unit for storing a disclosure policy relating to data disclosure for each data stored in the data storage device;
The access target data included in the request by referring to the public policy stored in the storage unit for the access target data included in the request transmitted from the web client among the data stored in the data storage device If the public there is no limit, transferring the request to the first web server, when there are a limited public access target data included in the request, the said request second web And a transfer unit for transferring to the server. When transferring the request to the second web server by the transfer unit, the web application related to the request is acquired from the first web server, and the acquired web application is arranged in the second web server. The relay apparatus according to claim 1, further comprising: a rewriting unit that rewrites the request so that an access path of data to be used used in the arranged web application passes through the own apparatus. When an access request for data to be accessed whose access path has been rewritten by the rewriting unit is received from a web application arranged in the second web server, is a public policy stored for the data to be accessed stored in the storage unit? And a relay unit that relays the access processing of the access target data when it is determined that the public policy is stored for the access target data. The relay device described in 1. The relay unit is
Whether or not a public policy is stored for the access target data in the storage unit when predetermined identification information included in both the access request for the access target data and the request at the time of the access request matches. The relay apparatus according to claim 3, wherein the relay apparatus relays the access processing of the access target data when the determination is made and it is determined that the public policy is stored for the access target data. The storage unit
For each data accessed from the first web server or the second web server based on a request from the web client among the data stored in the data storage device, the first web server and the second web server Remember the publishing policy for publishing data to other web servers,
The transfer unit
With respect to the access target data included in the request transmitted from the web client, the public policy stored in the storage unit is referred to, and the data is transmitted to both the first web server and the second web server. The relay apparatus according to claim 1, wherein when there is no public policy, forwarding of the request is invalidated. A first web server connected to the own device via the Internet or a second web server connected to the Internet via the own device, a web client, and a data storage device connected to the Internet via the own device A relay method executed by a relay device that relays data to and from
For the data to be accessed included in the request transmitted from the web client among the data stored in the data storage device, a disclosure policy related to data disclosure is stored for each data stored in the data storage device When the disclosure policy stored in the storage unit is referenced and there is no restriction on the disclosure of the access target data included in the request, the request is transferred to the first web server, and the access included in the request When there is a restriction on disclosure of target data, the request is transferred to the second web server. On the computer,
For data to be accessed included in a request transmitted from a web client among data stored in a data storage device that stores data, a disclosure policy related to data disclosure is stored for each data stored in the data storage device If there is no restriction on the disclosure of the access target data included in the request with reference to the public policy stored in the storage unit, the request is sent to the first web connected to the own device via the Internet. When there is a restriction on the disclosure of the data to be accessed included in the request, the request is transferred to a second web server connected to the Internet via its own device. Relay program.

Images