JP6225749B2 - Information processing system and program - Google Patents

Description

  The present invention relates to an information processing system and a program.

  The server that manages the object may process (create, acquire, change, delete, etc.) the object according to the authority of the client that is the processing request source. Here, since the object managed by the server may be created, changed, deleted, etc., if the authority is fixedly linked to the client independently of the object, It may be difficult to process objects flexibly. In addition, it is expected that the development and usability of the system will be improved by configuring the content to be provided according to the authority of the client.

JP 09-251425 A

  An object of the present invention is to provide an information processing system and program capable of providing content according to an authority object related to a request received from a client.

  In the invention according to claim 1, the management information for associating and managing the element name and the element value of the element constituting the content is associated with at least a part of the object in which at least one of the parent and the child is determined, and the authority information is associated A receiving unit that receives a request for a process to be executed including designation of an authorization object that is an object, a target object is set based on the authorization object, and an element name specified by the request is associated with the target object If not, a setting unit that repeatedly executes a process of setting a parent object of the target object as a new target object until a predetermined condition is satisfied, and a target set by the setting unit If the element name specified by the request is associated with the object of Was associated with the object element value is an information processing system including, a response means for responding to the request.

  In the invention according to claim 2, the setting means sets the target object until the target object associated with the element name specified by the request is first found or there is no parent object of the target object. The information processing system according to claim 1, wherein the information processing is repeatedly executed.

  According to a third aspect of the present invention, in the case where the request specifies an object, the response means returns data associated with the object specified by the request, and the response means does not specify the object. The information processing system according to claim 1, wherein the information processing system determines that the request specifies an element name and sets a target object by the setting unit.

  The invention according to claim 4 determines whether or not to accept the request based on a comparison result of information between an owner object that is an object that authorizes the authority information and an object that is a parent of the authority object. The information processing system according to claim 1, wherein the response unit responds to the request when the request is accepted.

  The invention according to claim 5 accepts the request when an owner object that is an object for which the authority information is authorized and an object that is a parent of the authority object match. System.

  According to a sixth aspect of the present invention, the determination means includes: an object that is a parent of an owner object that is an object for which the authority information has been authorized; and an object that is a parent of the owner object and is sequentially connected to the object. The information processing system according to claim 4, wherein the request is accepted when an object that is a parent of the authority object is included.

  The invention according to claim 7 is the information processing system according to any one of claims 4 to 6, wherein the determination unit does not accept the request when the authority object is not managed by the management unit.

  In the invention according to claim 8, the authority information is associated with the management means for associating and managing the element name and element value of the element constituting the content to at least a part of the object for which at least one of the parent and the child is determined. A receiving unit that receives a request for a process to be executed including designation of an authorization object that is an object, a target object is set based on the authorization object, and an element name specified by the request is associated with the target object If not, a setting unit that repeatedly executes a process of setting a parent object of the target object as a new target object until a predetermined condition is satisfied, and a target set by the setting unit If the element name specified by the request is associated with the object of The element values associated with an object is a program for causing a computer to function as a response means for responding to the request.

  According to the first and eighth aspects of the invention, it is possible to provide content according to the authority object related to the request received from the client.

  According to the second aspect of the present invention, it is possible to determine an object from which an attribute value is acquired based on an authority object and an element name relating to a request received from a client.

  According to the third aspect of the present invention, object data can be provided when a request received from a client designates an object, and content data can be provided when content is designated.

  According to the fourth aspect of the present invention, content can be provided when the authority object relating to the request received from the client is appropriate.

  According to the fifth aspect of the present invention, the content can be provided when the owner of the authority object related to the request received from the client is the parent of the authority object.

  According to the sixth aspect of the present invention, the content can be provided when the parent of the authority object related to the request received from the client corresponds to the ancestor of the owner of the authority object.

  According to the seventh aspect of the present invention, it is possible to prevent provision of content in response to a request based on an inappropriate authority.

It is a system configuration figure of the information processing system concerning this embodiment. It is a functional block diagram of an information management device. It is a figure which shows an example of the data structure of an object. It is a figure which shows an example of a prototype base object management table. It is a figure which shows an example of a value management table. It is a figure which shows an example of a data object management table. It is a flowchart which shows an example of the production | generation process of an access token. It is a flowchart which shows an example of the process with respect to the request received from the user terminal. It is a flowchart which shows an example of the verification process of an access token. It is a flowchart which shows an example of the process with respect to the data acquisition request received from the user terminal. It is an example of the tree structure comprised by a prototype base object. It is a figure which shows an example of the data which an object has.

  Hereinafter, an embodiment for carrying out the present invention (hereinafter referred to as an embodiment) will be described with reference to the drawings.

[1. Explanation of system configuration]
FIG. 1 shows a system configuration diagram of an information processing system S according to the present embodiment. As shown in FIG. 1, the information processing system S includes an information management device 10 and one or more user terminals 5, and the information management device 10 and the user terminals 5 can each perform data communication via the network 2. Connected.

  As illustrated in FIG. 1, the information management apparatus 10 includes a control unit 10A, a storage unit 10B, and a communication unit 10C as an example of a hardware configuration.

  The control unit 10A includes a CPU (Central Processing Unit), executes various arithmetic processes and controls each unit of the information management apparatus 10 based on a program stored in the storage unit 10B.

  The storage unit 10B stores a control program such as an operating system of the information management apparatus 10 and data, and is also used as a work memory of the control unit 10A. The program may be supplied to the information management apparatus 10 in a state stored in an information storage medium such as an optical disk, a magnetic disk, a magnetic tape, a magneto-optical disk, or a flash memory, or information may be transmitted via a data communication network such as the Internet. It may be supplied to the management apparatus 10.

  The communication unit 10C includes, for example, a network interface card (NIC), is connected to the network 2 via the NIC, and communicates with the user terminal 5 connected to the network 2.

  In the present embodiment, the information management apparatus 10 manages prototype-based objects. Here, a prototype-based object is an object that has only one parent object (prototype), except for a root object that exists only in a set of prototype-based objects. A root object has its own prototype. Absent. Further, when the object A is a prototype of the object B, the object B is also referred to as an artifact of the object A. Due to the prototype relationship between objects, the entire set of prototype-based objects is represented in a tree structure. If the tree structure constituted by objects is not destroyed, the tree structure can be deformed by reconnecting the prototype. Furthermore, an object managed by the information management apparatus 10 can have an attribute and an attribute value. In the REST (REpresentational State Transfer) architectural style, an object is sometimes called a resource and a value is called an expression. Some objects having values represent authority information called access tokens. An object can be simply a pure identity consisting only of an object identifier and prototype, representing data with a value of any content type, an access token that is a credential that certifies access, or the owner of the object It may be included that represents an entity such as a resource owner or an application (client) that accesses an object under the authorization of the resource owner. These objects are included in one tree structure.

  In the present embodiment, the information management apparatus 10 executes addition, update, reading, deletion, etc. of an object to be managed in accordance with a request received from the user terminal 5. Further, the information management apparatus 10 associates identification information for identifying a function with an authority object called an access token, and the user terminal 5 uses the function associated with the authority object received together with the request from the user terminal 5. The received request will be processed. Hereinafter, an example of a function provided in the information management apparatus 10 in order to realize the above processing will be described in detail.

[2. Description of functions provided in information management apparatus 10]
Next, an example of functions provided in the information management apparatus 10 will be described based on the functional block diagram of the information management apparatus 10 shown in FIG. As shown in FIG. 2, the information management apparatus 10 includes an object information management unit 11, a request reception unit 12, an authority information acquisition unit 13, a verification unit 14, a function object acquisition unit 15, a function object generation unit 16, and a request processing unit. 17. A processing data providing unit 18 is provided.

  The functions of the above-described units included in the information management apparatus 10 are realized by a control unit 10A included in the information management apparatus 10 reading and executing a program stored in a storage unit 10B or a computer-readable information storage medium. It may be good. The program may be supplied to the information management apparatus 10 by an information storage medium such as an optical disk, a magnetic disk, a magnetic tape, a magneto-optical disk, a flash memory, or the information management apparatus via a data communication network such as the Internet. 10 may be supplied. Hereinafter, the details of the functions of the units included in the information management apparatus 10 will be described.

  The object information management unit 11 manages prototype-based object information and data object information. Here, the prototype-based object includes an authority object called an access token associated with authority information. Prototype-based objects are mutable objects and are typically identified by randomly generated IDs. A data object is an immutable object and is typically identified by an ID calculated as a hash value of the corresponding data. The data object includes, for example, a function data object including source code for generating a function object, function object identification information generated from the source code, and the like. Hereinafter, an example of a prototype-based object and a data structure of a data object will be described with reference to FIG. In the example shown in FIG. 3, the specific content of the element is expressed as [element] for the element constituting the data.

  FIG. 3A shows a basic data structure of a prototype-based object. As shown in FIG. 3A, the prototype-based object includes an object identification information id, an object parent (prototype) object identification information proto, an object type type, and an object data content. Including an etag representing the identification information of the data object storing the time, and a time representing the generation date and time of the object. Note that the data structure of the prototype-based object is not limited to the example shown in FIG. 3A, and includes an element other than the elements described above as long as it includes id and proto. It doesn't matter.

  FIG. 3B shows the data structure of the access token. As shown in FIG. 3B, the access token includes {“owner”: the object ID of the owner (owner), “client”: the object ID of the client (client), and “scope”: an identification for identifying the function. Information} information. In the information processing system S according to the present embodiment, an access token is attached to a processing request received from the user terminal 5. Here, the owner is treated as a processing requester and the client is treated as a proxy requester. The identification information of the function data object is stored.

  FIG. 3C shows the data structure of the data object (function data object). As shown in FIG. 3C, the function data object includes a content that stores source code (script), func that is identification information of a function object generated (evaluated) from the source code (script), and data contents. A length indicating the octet length of, and a time indicating the date and time when the data was registered are included. Of course, the data object is not limited to the configuration shown in FIG. For example, a list of clients that have accessed the data may be stored in the data object. In this case, a list of all clients that have accessed a specific octet array can be generated.

  Next, an example of a management table for managing prototype-based objects and data objects having the data structure shown in FIG. 3 will be described with reference to FIGS.

  First, FIG. 4 shows a prototype base object management table for managing information on prototype base objects. As shown in FIG. 4, the prototype base object management table stores an object ID for identifying an object, a prototype ID for identifying a prototype object that is a parent (prototype) of the object, and attribute information of the object in association with each other. For example, the object attribute information includes object type information (type), identification information (tag) of data (object) storing a value (value) stored (associated) with the object, and object generation date and time (time) ) Etc. are included.

  FIG. 5 shows an example of a value management table storing data corresponding to the prototype-based object etag. As shown in FIG. 5, value information is stored in the value management table in association with the ID (key) of the tag. For example, in the case of an access token, the value is application / json {“owner”: object ID of owner (owner), “client”: object ID of client (client), “scope”: identification information for identifying function}. It is described in the data format of the type.

  FIG. 6 shows an example of a data object management table for managing information on data objects (here, function data objects). As shown in FIG. 6, the data object management table includes a data ID for identifying a data object, a content storing a function object source code (script), and function object identification information generated by evaluating the source code ( func), length indicating the octet length of the data content, and time indicating the date and time when the data was registered are stored in association with each other.

  The request reception unit 12 receives a request regarding processing of an object managed by the object information management unit 11 from the user terminal 5. For example, the request reception unit 12 may receive a request from the user terminal 5 in the form of an HTTP request.

  The authority information acquisition unit 13 acquires information on an access token (authority object) related to the request received by the request reception unit 12. For example, the authority information acquisition unit 13 may obtain the access token information from the Authorization field of the HTTP request, or from a cookie if there is a cookie containing the access token information.

  The verification unit 14 verifies whether or not the information of the access token (authorization object) acquired by the authority information acquisition unit 13 is valid. Hereinafter, a specific example of the verification process by the verification unit 14 will be described.

  First, the verification unit 14 determines whether the ID of the access token acquired by the authority information acquisition unit 13 is included in the prototype base object management table managed by the object information management unit 11 (appropriateness of the first condition). If it is not included, it is determined that the verification has failed.

  Next, the verification unit 14 determines whether the data format (type) of the access token is a predetermined type (that is, application / json) when the first condition is satisfied (the second condition If it is not a predetermined type, it is determined that the verification has failed.

  Next, when the second condition is satisfied, the verification unit 14 acquires the value value of the access token (the value of the owner, client, and scope), and each value of the owner, client, and scope is an object. It is determined whether the data is managed by the information management unit 11 (appropriateness of the third condition). If any value is not data managed by the object information management unit 11, it is determined that the verification has failed. .

  Next, when the third condition is satisfied, the verification unit 14 acquires the access token prototype information from the object information management unit 11, and the access token prototype matches the access token owner. Or whether it is included in the owner's prototype chain (the route that connects the owner's parent and then the owner's ancestors in order) (the suitability of the fourth condition), and does not match any of the above In this case, it is determined that the verification has failed.

  Next, when the fourth condition is satisfied, the verification unit 14 determines whether a function object is assigned to the scope information of the access token (appropriateness of the fifth condition), and sets the scope to the scope. When the function object is not assigned, it is determined that the verification is failed, and when the function object is assigned to the scope, it is determined that the verification is successful. Whether or not a function object is assigned to the scope may be determined based on whether or not the function object is acquired by the function object acquisition unit 15 based on the scope information.

  The function object acquisition unit 15 acquires information on the function object associated with the scope from the object information management unit 11 based on the information on the scope of the access token. For example, the function object acquisition unit 15 searches the corresponding record from the data object management table managed by the object information management unit 11 based on the access token scope information (data object ID). Then, the function object acquisition unit 15 refers to the func attribute of the retrieved record, and when the value is stored in the func attribute, obtains the value of the func attribute as function object identification information. In addition, when no value is stored in the func attribute of the retrieved record, the function object acquisition unit 15 generates (evaluates) the function object based on the source code stored in the content attribute. To ask.

  The function object generation unit 16 determines whether the source code related to the request from the function object generation unit 16 can be evaluated as a function. When the function object generation unit 16 cannot evaluate the function as a function, the function object generation unit 16 returns an error to the function object acquisition unit 15 Returns the function object identification information generated based on the source code to the function object acquisition unit 15.

  When an error is returned from the function object generation unit 16, the function object acquisition unit 15 reports the unassigned function object to the verification unit 14, and the function object identification information is returned from the function object generation unit 16. In this case, the identification information of the function object is stored in the value of the func attribute of the corresponding record, and the identification information of the function object assigned to the scope is reported to the verification unit 14.

  The request processing unit 17 includes a verification result notified from the verification unit 1414 about the access token (authorization object) acquired by the authority information acquisition unit 13 for the request received by the request reception unit 12, and a function object for the received access token. Based on the function object acquired by the acquisition unit 15, the processing of the request received by the request reception unit 12 is controlled. For example, if the verification result for the access token related to the request received by the request reception unit 12 is a verification failure, the request processing unit 1715 rejects the processing related to the request and outputs an error to the processing data providing unit 18. It is good to do. If the verification result for the access token related to the request received by the request receiving unit 12 is successful, the request processing unit 1715 determines that the request received by the request receiving unit 1212 is the access token received for the request. Is processed based on the function object acquired by the function object acquisition unit 15, and the execution result is output to the processing data providing unit 1816.

  The processing data providing unit 18 provides the processing result by the request processing unit 17 to the user terminal 5 that is a request source of the request.

[3. Explanation of an example of processing]
Next, an example of processing executed by the information processing system S will be described in detail based on the flowcharts shown in FIGS.

[3.1. Token generation process]
First, an example of access token generation processing executed by the information management apparatus 10 will be described with reference to the flowchart shown in FIG. First, in the flow of FIG. 7, it is assumed that an access token t already exists, and the access token t has a scope in which an object can be created, acquired, updated, and deleted.

  As illustrated in FIG. 7, when the information management apparatus 10 receives a generation request for an object (function data object) f having a source code of a desired function as a value using an access token t, for example, from the user terminal 5 ( S101), an object f is generated (S102). Here, the information management apparatus 10 may notify the user terminal 5 of the identification information (ID) of the object f generated in S102.

  Furthermore, when the information management apparatus 10 receives a request for generating an access token T using the access token t from the user terminal 5, for example, as the owner o, the client c, and the scope f (identification information of the object f) (S103), An access token T is generated (S104). Then, the information management apparatus 10 provides the information on the access token T generated in S104 (the ID of the access token T) to the user terminal 5, for example (S105), and ends the process.

[3.2. Request processing]
Next, an example of request processing using the access token T by the information management apparatus 10 will be described based on the flowchart shown in FIG.

[3.2.1. Request processing (S201 to S203)]
For example, when the information management apparatus 10 receives a request from the user terminal 5 (S201), the information management apparatus 10 acquires an access token related to the request (here, referred to as an access token T) (S202). For example, the information management apparatus 10 may obtain the object ID of the access token from the Authorization field in the HTTP request from the user terminal 5, or may obtain it from the cookie if there is a cookie including the access token information. .

  The information management apparatus 10 executes a verification process based on the access token acquired in S202 (S203). Here, details of the verification process based on the access token will be described based on the flowchart shown in FIG.

[3.2.2. Access token verification process]
FIG. 9 shows a flowchart of the access token verification process. As shown in FIG. 9, the information management apparatus 10 determines whether or not the ID of the access token to be verified exists in the ID managed by the object information management unit 11 (S301). For example, the information management apparatus 10 makes the above determination based on whether or not the ID of the access token to be verified is included in the object ID of the prototype base object management table managed by the object information management unit 11. Good. Then, when the ID of the access token to be verified exists in the ID managed by the object information management unit 11 (S301: Y), the information management apparatus 10 proceeds to S302, and the access to be verified If the token ID does not exist in the ID managed by the object information management unit 11 (S301: N), the verification is failed (S312), and the process returns.

  When the ID of the access token to be verified in S301 exists in the ID managed by the object information management unit 11 (S301: Y), the information management apparatus 10 uses the access token ID as a key to access token The data of the access token is referred to and it is determined whether or not the data format of the access token is valid (S302). For example, the information management apparatus 10 may determine that the type attribute set in the access token is valid if the type attribute is application / json, and otherwise determines that the type attribute is not valid. If the data format of the access token is valid (S302: Y), the information management apparatus 10 proceeds to S303. If the data format of the access token is not valid (S302: N), the information management apparatus 10 determines that the verification has failed. (S312), return.

  When the data format of the access token is valid (S302: Y), the information management device 10 further acquires the owner, client, and scope value (ID) specified for the access token (S303). It is determined whether or not the object ID specified by the client and scope exists in the ID managed by the object information management unit 11 (S304). For example, the information management apparatus 10 performs the above determination based on whether the object ID specified by the owner, client, or scope is included in either the prototype base object management table or the data object management table. Good. If the object ID of the owner, client, or scope specified for the access token is included in the ID managed by the object information management unit 11 (S304: Y), the information management apparatus 10 proceeds to S305. When the object ID of the owner, client, or scope is not included in the ID managed by the object information management unit 11 (S304: N), the verification is failed (S312), and the process returns.

  When the object ID of the owner, client, or scope specified for the access token is included in the ID managed by the object information management unit 11 (S304: Y), the information management apparatus 10 provides access token prototype information. (Object ID of parent object) is acquired (S305). Then, the information management apparatus 10 determines whether or not the prototype object of the access token matches the owner specified for the access token or is included in the owner's prototype chain (a route in which the owner's ancestor objects are sequentially connected). If it is determined (S306) and it is determined that it is included (S306: Y), the process proceeds to S307. If it is determined that it is not included (S306: N), the verification is failed (S312) and the process returns.

  If the prototype object of the access token matches the owner specified for the access token or is included in the prototype chain of the owner (S306: Y), the information management apparatus 10 has an object of the scope specified for the access token. The ID data is referenced (S307). For example, the information management apparatus 10 may refer to the record information stored in the data object management table using the scope object ID as a key.

  The information management apparatus 10 determines whether or not a function object is assigned to the scope data referenced in S307 (S308). For example, the information management apparatus 10 may make the above determination based on whether identification information is stored in the func attribute in the scope data. Then, when the function object is assigned to the scope (S308: Y), the information management apparatus 10 returns as a successful verification (S309). Further, when the function object is not assigned to the scope (S308: N), the information management apparatus 10 determines whether the source code included in the scope data can be evaluated as a function (S310). When the source code included in the scope data can be evaluated as a function in S310 (S310: Y), the information management apparatus 10 generates a function object based on the source code, and generates the function object ID. Is stored in the func attribute of the scope, and the scope data is updated (S311). If the source code included in the scope data cannot be evaluated as a function in S310 (S310: N), the information management apparatus 10 returns a verification failure (S312).

  The above is the flow of the verification process based on the access token. Here, returning to the flowchart shown in FIG. 8, the description will be continued.

[3.2.3. Request processing (S204 to S208)]
As shown in FIG. 8, when the information management apparatus 10 finishes the verification process for the access token (S203), if the result of the verification process for the access token is a verification success (S204: Y), the access token The function object assigned to the scope is acquired (S205). For example, the information management apparatus 10 may acquire the function object identified by the identification information stored in the func attribute in the scope data of the access token.

  Next, the information management apparatus 10 processes the request received in S201 based on the function object associated with the access token acquired in S205 (S206). Then, the information management apparatus 10 provides the processing data generated as a result of the processing in S206 as a response to the request to the user terminal 5 that is the request source (S207), and ends the processing.

  Also, if the result of the access token verification process is a verification failure in S204 (S204: N), the information management apparatus 10 notifies the requesting user terminal 5 of an error (S208). Finish the process. Here, the information management apparatus 10 may notify the user terminal 5 of an error code corresponding to the content (cause) of the verification failure.

  According to the information management apparatus 10 described above, an arbitrary server side process can be associated with an access token. As a result, the processing to be executed can be switched for one endpoint by changing the value of the scope associated with the access token.

[3.3. Specific examples of request processing]
Next, an example of a request process executed in the information management apparatus 10 will be described based on the flowchart shown in FIG. 10 and the object configuration examples shown in FIGS. 11 and 12. In the example described below, it is assumed that the prototype base object is provided with data constituting attributes and attribute values of elements constituting the content (for example, web page) provided to the user terminal 5 and their values. First, a configuration example of an object will be described based on FIG. 11 and FIG.

  FIG. 11 shows a diagram representing a prototype-based object in a tree structure. As shown in FIG. 11, the “root” object P1 is a root object, and the “generic” object P11 is an object whose prototype is P1. Furthermore, the “customer” object P111 and the “Company A” object P112 are objects having P11 as a prototype. “Company B” object P1111 and “Company C” object P1112 are objects having P111 as a prototype. The “development” object P1121 and the “sales” object P1122 are objects having P112 as a prototype. The “user a” object P11211 is an object having P1121 as a prototype. The “access token Ta” object P112111 and “custom content of a” P112112 are objects having P11211 as a prototype.

  FIG. 12 shows an example of data given as an attribute to each object shown in FIG. Each object data includes at least one set of 'attribute' and 'attribute value'.

  Next, based on the flowchart shown in FIG. 10, processing for reading out data related to a request from a prototype-based object and responding will be described. In the example shown in FIG. 10, the access token received when the information management apparatus 10 makes a request from the user terminal 5 is associated with a function that allows reading of object data. To do.

  As illustrated in FIG. 10, when the information management apparatus 10 obtains a uri that is a request URI from, for example, the user terminal 5 (S401), if the uri is in the form of an object ID (S402: Y), It is determined whether or not data of the specified object ID exists (S403). If data exists (S403: Y), the data is read and returned as a response to the request (S404). If there is no data (S403: N), an error is notified (S405), and the process is terminated.

  In addition, when the uri acquired in S401 is not in the object ID format (S402: N), the information management apparatus 10 determines that an attribute name is specified in uri, and receives the request received from the user terminal 5 The object specified by the client information of the access token related to is set as the object of interest (S406).

  Then, the information management apparatus 10 determines whether or not the attribute specified by uri is included in the data attached to the object of interest (S407), and if it is included (S407: Y) ), The data assigned to the object of interest is returned as the attribute value of the attribute related to the request (S408), and the process is terminated.

  In addition, when the data specified by the uri is not included in the data assigned to the object of interest (S407: N), the information management apparatus 10 determines the parent (ie, prototype) of the current object of interest. When there is an object (S409: Y), the parent of the current attention object is set as a new attention object (S410), and the process returns to S407. Further, when there is no parent (ie, prototype) object of the current object of interest in S409 (S409: N), the information management apparatus 10 notifies an error as no corresponding data (S405) and ends the process.

  According to the above object configuration and request processing, the data read function is common, but the client object specified by the access token and the attributes and attribute values assigned to the objects in the prototype chain are Accordingly, the attribute value related to the request can be provided to the user terminal 5.

  The embodiment described above is shown as a specific example, and the invention disclosed in this specification is not limited to the configuration of the specific example or the data storage example itself. Those skilled in the art may make various modifications to the disclosed embodiments, for example, change the data structure and the execution order of the processes. It should be understood that the technical scope of the invention disclosed herein includes such modifications. For example, in the above embodiment, the example in which the identification information of the function data object is specified in the scope of the access token has been described, but the function (command) itself may be fixedly set in the scope.

  S information processing system, 5 user terminal, 10 information management device, 11 object information management unit, 12 request reception unit, 13 authority information acquisition unit, 14 verification unit, 15 function object acquisition unit, 16 function object generation unit, 17 request processing Department, 18 Processing data provision department.

Claims (7)

A management means for associating and managing an element name and an element value of an element constituting the content to at least a part of an object in which at least one of a parent and a child is determined;
An accepting means for accepting a request for processing to be executed including designation of an authorization object that is an object associated with authorization information;
A determination unit that determines whether to accept the request based on a comparison result of information between an owner object that is an object that authorizes the authority information and an object that is a parent of the authority object;
A target object is set based on the authority object, and if the element name specified by the request is not associated with the target object, the parent object of the target object is set as a new target object. Setting means for repeatedly executing the processing until a predetermined condition is satisfied;
When the request is accepted and the element name specified by the request is associated with the target object set by the setting unit, the element value associated with the target object is set. A response means for responding to the request. The setting unit repeatedly executes setting of a target object until a target object associated with an element name specified by the request is first found or until there is no parent object of the target object. The information processing system described. When the request specifies an object, the response means responds with data associated with the object specified by the request,
3. The information processing system according to claim 1, wherein if the request does not specify an object, it is determined that the request specifies an element name, and a target object is set by the setting unit. . The information processing system according to any one of claims 1 to 3, wherein the request is accepted when an owner object that is an object that authorizes the authority information matches an object that is a parent of the authority object. The determination means includes a parent object of the authority object in a path sequentially connecting an object that is the parent of the owner object that is the object for which the authority information is authorized, and an object that is the parent of the owner object. The information processing system according to claim 1, wherein the request is accepted when an object is included. The information processing system according to claim 1, wherein the determination unit does not accept the request when the authority object is not managed by the management unit. A management means for associating and managing an element name and an element value of an element constituting content to at least a part of an object in which at least one of a parent and a child is determined ;
Receiving means for receiving a request for processing to be performed including the designation of the authorization object is an object that authority limit information is associated,
Judgment means for judging whether to accept the request based on a comparison result of information between an owner object that is an authorized object of the authority information and an object that is a parent of the authority object;
A target object is set based on the authority object, and if the element name specified by the request is not associated with the target object, the parent object of the target object is set as a new target object. Setting means for repeatedly executing the process to satisfy a predetermined condition, and
When the request is accepted and the element name specified by the request is associated with the target object set by the setting unit, the element value associated with the target object is set. A program for causing a computer to function as response means for responding to the request.

Images