Patent ID: 12222952

DESCRIPTION OF THE PREFERRED EMBODIMENTS

Embodiments will be described with reference to the drawings. The embodiments described below do not limit the invention according to the claims, and all the elements and combinations described in the embodiments are not necessarily essential for the solution of the invention.

In the following description, a program for realizing each processing functional unit is executed by a processor (for example, a central processing unit (CPU)), thereby performing predetermined processing by appropriately using a storage resource (for example, a memory) and/or a communication interface device (for example, a port). Therefore, the processing performed by each processing functional unit may be processing performed by a processor or a computer having the processor.

In the following description, various types of information are represented in a table format, but the information is not limited to the table format, and may be represented in a format of comma separated values (CSV) or other formats. Since the various types of information do not depend on a data format, for example, an “XXX table” can be referred to as “XXX information”.

In addition, names such as “identification information”, “ID”, and “name” of items including, in item names, information for distinguishing a corresponding record from other records among items in various types of information may be replaced with each other. For example, a “user ID” may be replaced with “user identification information”.

First Embodiment

Configuration of Cooperation System S According to First Embodiment

FIG.1is a block diagram illustrating an example of a schematic configuration of a cooperation system S according to a first embodiment.

InFIG.1, the cooperation system S includes a cooperation source system101, a cooperation destination system102, a client103, and the Internet104that connects the systems.

The cooperation source system101is connected to the cooperation destination system102and the client103. A user operates the client103to perform connection to the cooperation source system101via the Internet104. The operation performed on the cooperation source system101is transferred to the cooperation destination system102via the Internet104as necessary and processed.

The client103is not limited to a terminal that is connected to the cooperation source system101by an operation of the user and transfers a request to the cooperation destination system102. That is, the client103also includes a terminal that is connected to the cooperation destination system102by the operation of the user and directly transmits a request to the cooperation destination system102.

The cooperation source system101retains cooperation source system user information111for authorizing authentication of a user who accesses a provided service.

In the cooperation destination system102, an operation from the cooperation source system101via the Internet104and an operation of directly accessing the cooperation destination system102are possible.

The cooperation destination system102retains cooperation destination system user information121for authorizing authentication of a user who performs an operation. The cooperation destination system102further includes an audit log122for storing a record of an operation by the user.

The client103is a system as an interface for a user to perform connection to the cooperation source system101via the Internet104and use the cooperation source system101. Specifically, the client103is a computer, a smartphone, and a web browser or an application that operate on the computer or the smartphone.

The Internet104is a network that interconnects the cooperation source system101, the cooperation destination system102, and the client103. The Internet104may be replaced with any network such as a local area network (LAN).

Hardware Configuration of Cooperation Destination System102According to First Embodiment

FIG.2is a block diagram illustrating an example of a hardware configuration of the cooperation destination system102according to the first embodiment.

InFIG.2, the cooperation destination system102is configured to include a central processing unit (CPU)202, a memory203, a drive204, and a network interface card (NIC)205. The CPU202, the memory203, the drive204, and the NIC205are connected to each other via a bus201.

The memory203is a main storage device that can be read and written by the CPU202. The memory203is, for example, a semiconductor memory such as an SRAM or a DRAM. The memory203can store a program being executed by the CPU202or provide a work area for the CPU202to execute the program.

The drive204is a secondary storage device that can be read and written by the CPU202. The drive204is, for example, a hard disk device or a solid state drive (SSD). The drive204can retain execution files of various programs and data or user information used for executing the programs. The drive204may include a plurality of hard disk devices or SSDs using a redundant arrays of independent disks (RAID) technology or the like.

The CPU202reads a program stored on the drive204into the memory203and executes the program. The CPU202is connected to the NIC205via the bus201, and can communicate with the cooperation source system101via the Internet104.

The cooperation destination system102may include a plurality of systems using a clustering technology or the like.

Functional Configuration of Cooperation Destination System102According to First Embodiment

FIG.3is a block diagram illustrating an example of a functional configuration of the cooperation destination system102according to the first embodiment. The cooperation destination system102is, for example, a storage system, but is not limited thereto. The cooperation destination system102may be any information processing system that receives a request from a user terminal via another system or directly from the user terminal, processes the request, and outputs a log related to processing. The log is, for example, an audit log, but is not limited thereto. The log may be any log that stores a processing result of a request.

InFIG.3, the cooperation destination system102is configured to include a cooperation request reception unit301that receives an operation request from the cooperation source system101via the Internet104, and a cooperation request processing unit303that processes the received operation request. The cooperation destination system102is configured to further include a cooperation response transmission unit304that transmits, as a response, a processing result of the operation request to the cooperation source system101via the Internet104.

The cooperation destination system102further includes a cooperation user creation unit302that creates a user (cooperation user) who operates the cooperation source system101in the cooperation destination system102, and cooperation destination system user information121that stores user information of the cooperation user and a normal user. The normal user is a user who directly operates the cooperation destination system102from the client103. The cooperation destination system user information121is stored in a predetermined storage unit.

The cooperation destination system102further includes an audit log122that stores an audit log, and an audit log writing unit305that writes an operation of the cooperation request processing unit303to the audit log122.

A gateway, a firewall, or the like may be provided between the cooperation request reception unit301and the cooperation response transmission unit304, and the Internet104. The audit log122may be transferred to an external log data accumulation server (such as a syslog).

Configuration of Cooperation Destination System User Information121According to First Embodiment

FIG.4is a diagram illustrating a configuration of cooperation destination system user information121retained by the cooperation destination system102according to the first embodiment.

The cooperation destination system user information121is used to manage a user (cooperation user) used at the time of cooperation with the cooperation source system101and a normal user of the cooperation destination system102.

The cooperation destination system user information121is managed as information including a user ID401for identifying a user, a cooperation flag402indicating that the user is a user for cooperation with the cooperation source system101, and a cooperation source user name403indicating a user name in the cooperation source system. The cooperation destination system user information121may have other types of information. The cooperation source user name403is an example of cooperation source user identification information.

A record411is an example of the cooperation user. In the record411, the user ID401is a UUID, the cooperation flag402is Yes (the user is a user for cooperation), and the cooperation source user name403is a user name used in the cooperation source system101. On the other hand, a record412is a normal user used in the cooperation destination system102. In this case, the user ID401is a character string such as a name, the cooperation flag402is No (the user is not a user for cooperation), and the cooperation source user name403is NULL.

Functional Configuration of Cooperation Source System101According to First Embodiment

FIG.5is a block diagram illustrating an example of a functional configuration of the cooperation source system101according to the first embodiment.

InFIG.5, the cooperation source system101is configured to include a request reception unit501, a response transmission unit502, a cooperation request transmission unit504, a cooperation response reception unit505, and a request processing unit503.

The request reception unit501receives an operation request from the client103via the Internet104. The response transmission unit502transmits, as a response, a processing result of the operation request to the client103via the Internet104. The cooperation request transmission unit504transmits an operation request to the cooperation destination system102via the Internet104. The cooperation response reception unit505receives a result of the operation request from the cooperation destination system102via the Internet104. The request processing unit503transmits the operation request received by the request reception unit501, from the cooperation request transmission unit504to the cooperation destination system102via the Internet104. The request processing unit503causes the cooperation response reception unit505to receive a transmission result of the operation request via the Internet104, and transmits, as a response, the transmission result of the operation request from the response transmission unit502to the client103via the Internet104.

A gateway, a firewall, or the like may be provided between the request reception unit501, the response transmission unit502, the cooperation request transmission unit504, and the cooperation response reception unit505, and the Internet104.

Configuration of Cooperation Source System User Information111According to First Embodiment

FIG.6is a diagram illustrating a configuration of cooperation source system user information111retained by the cooperation source system101according to the first embodiment.

The cooperation source system user information111is used to manage a user who uses the cooperation source system101. In the cooperation source system user information111, each user is managed as information including a user ID601for identifying the user. The cooperation source system user information111may have other types of information.

Request Processing of Cooperation System S According to First Embodiment

FIG.7is a flowchart illustrating request processing of the cooperation system S according to the first embodiment. The request processing is started when the cooperation source system101receives a request from the client103.

First, the cooperation source system101receives a request from the client103via the Internet104(S711). Then, the cooperation source system101refers to the cooperation source system user information111based on the received request, and authenticates a user who has transmitted the request by using an ID, a password, and the like (S712). As an authentication method used at this time, public key authentication or the like may be used. Then, after the authentication of the user has been completed, the cooperation source system101adds a user name of the user authenticated and operated by the cooperation source system101to the request, and transmits a cooperation request to the cooperation destination system102(S713). The information added in S713may include information other than the user name, for example, an ID of the cooperation source system.

Then, the cooperation destination system102receives the cooperation request transmitted from the cooperation source system101via the Internet104(S721). The cooperation destination system102confirms whether a cooperation user for the user is registered in the cooperation destination system user information121from the user name of the cooperation source system101included in the cooperation request (S722). In a case where the cooperation user is not registered (No in S722), the cooperation destination system102creates the cooperation user (S723) and registers the cooperation user in the cooperation destination system user information121(S723). At this time, a UUID is used as the user ID401so as not to overlap other users. The cooperation flag402is Yes, and the user name in the cooperation source system101included in the cooperation request is stored in the cooperation source user name403.

The cooperation flag402only needs to be able to identify that the user is a user created for cooperation with the cooperation source system101, and does not necessarily need to be Yes. The fact that the cooperation source user name403is not “NULL” may be substituted for the fact that the cooperation flag402is Yes.

In a case where the cooperation user has been registered (Yes in S722) or after the cooperation user has been registered in S723, the cooperation destination system102processes the cooperation request as an operation of the cooperation destination system102by the cooperation user (S724). After completion of the process of S724, the cooperation destination system102transmits the processing result to the cooperation source system101as a cooperation response (S725). The result is output as an audit log (S726). The output of the audit log in S726will be described later with reference toFIGS.8and9.

Then, the cooperation source system101receives the cooperation response from the cooperation destination system102(S714). Thereafter, the cooperation source system101transmits a response based on the received cooperation response, to the client103via the Internet104(S715). The above flow is repeatedly performed every time the client103transmits a request to the cooperation source system101via the Internet104.

In the request processing of the cooperation system S illustrated inFIG.7, it is assumed that the request received by the cooperation destination system102is a request received via the cooperation source system101. However, the request received by the cooperation destination system102includes a request directly transmitted from the client103. Thus, the request includes identification information of a request source system. In a case where identification information of the request source system included in the received request corresponds to the cooperation source system101, the cooperation destination system102executes the processes of S722and S723. On the other hand, in a case where the identification information included in the received request does not correspond to the identification information of the cooperation source system101(the user is a user of the cooperation destination system102or the like), S722and S723are omitted, and the request is processed based on a user ID included in the request received in S724.

Example of Audit Log122According to First Embodiment

FIG.8illustrates an example of the audit log122output by the audit log writing unit305in the cooperation destination system102according to the first embodiment in a form of a table.

An audit log800output by the audit log writing unit305may not be table data, and may be text data using a delimiter such as “, (comma)” in a CSV format.

The audit log800includes a date and time801, a user name802, an operation source803, an operation content804, an operation result805, and the like. The arrangement order of the above items may be interchanged. Some of the items may not be provided, or additional items may be provided.

In the example illustrated inFIG.8, in a record811, “abcdefgh” of a user name802of the cooperation destination system102is converted into “taro. Suzuki” of the user name802of the cooperation source system101and then is output. In the record812, since the user name “jiro.ito” of the cooperation destination system102is a user unique to the cooperation destination system102, the user name802is not converted, and the user name “jiro.ito” of the cooperation destination system102is directly output.

Processing Performed by Audit Log Writing Unit305According to First Embodiment

FIG.9is a flowchart illustrating processing performed by the audit log writing unit305in the cooperation destination system102according to the first embodiment.FIG.9illustrates a flow of detailing S726ofFIG.7.

First, the audit log writing unit305receives the content to be written to the audit log800from the cooperation request processing unit303(S726a).

Then, when the content to be written to the audit log800is received, the audit log writing unit305searches the cooperation destination system user information121of the cooperation destination system102for a user name of a user who has performed the operation, and finds a user having a user name that coincides with the user ID401. The audit log writing unit305checks the cooperation flag402of the cooperation destination system user information121for the found user (S726b). In a case where the cooperation flag402is No (No in S726b), the audit log writing unit305writes the content to be written to the audit log800received from the cooperation request processing unit303as it is (S726d).

On the other hand, in a case where the cooperation flag402is Yes (Yes in S726b), the audit log writing unit305converts the content to be written to the audit log800received from the cooperation request processing unit303. That is, in the content to be written to the audit log800, the user name802is converted into the cooperation source user name403, and an operation source803is converted into the cooperation source system101(S726c). Thereafter, the audit log writing unit305writes the audit log800with the converted content (S726d). The audit log writing unit305performs the processing illustrated in the flow ofFIG.9every time the content to be written to the audit log800is received from the cooperation request processing unit303.

In the above operation flow, the operation from the cooperation source system101to the cooperation destination system102is converted to the audit log122of the cooperation destination system102, the user name802is converted into the user name in the cooperation source system101, and the operation source803is converted into the cooperation source system. As a result, it is possible to reduce the work of matching the UUID and the user name at the time of confirming the audit log122of the cooperation destination system102.

Effects of First Embodiment

In the first embodiment described above, at the time of processing a request from the cooperation source system101, a user name of the cooperation source system101included in the request is converted into a user ID (an ID of a cooperation user) of the cooperation destination system102, and the request is processed. At the time of outputting the log during processing of the request, the ID of the cooperation user is converted into the user name of the cooperation source system101again, and the user name of the cooperation source system101is output to the log.

Therefore, according to the first embodiment, it is possible to store the operation performed by the cooperation source system101in the log of the cooperation destination system102with the user name of the cooperation source system101, while avoiding overlapping of user names between the systems by using the cooperation user. Therefore, at the time of log audit, it is possible to confirm the unique user identification information such as the UUID and the user name of the cooperation source system101without matching the user identification information with the user name of the cooperation source system101.

In addition, in the first embodiment, the log including the cooperation source user identification information converted from the user identification information and the cooperation source system identification information as the identification information of the request source system of the request is output. As a result, it is possible to determine the name of the cooperation source system101that has transmitted the request, on the log.

In the first embodiment, in a case where the cooperation source user name corresponding to the identification information of the user included in the request is not included in the cooperation destination system user information121when the request is received, the following processing is performed. That is, this identification information is used as the cooperation source user name, and the cooperation source user name and new user identification information are registered in the cooperation destination system user information121in association with each other. Furthermore, the identification information of the cooperation source system101included in the request may be associated and registered in the cooperation destination system user information121. In particular, by using the UUID as the new user identification information, it is possible to easily create a cooperation user who avoids overlapping of the user names between the systems, and thus, it is possible to promote system cooperation.

Second Embodiment

In the first embodiment, in the cooperation system S, it is assumed that one cooperation source system101cooperates with one cooperation destination system102. However, the present invention is not limited thereto. In a second embodiment, an example in which a plurality of cooperation source systems101cooperate with one cooperation destination system102in the cooperation system S will be described.

Configuration of Cooperation Destination System User Information121B According to Second Embodiment

FIG.10is a diagram illustrating a configuration of cooperation destination system user information121B retained by a cooperation destination system102according to the second embodiment.

The cooperation destination system user information121B is different from the cooperation destination system user information121in the first embodiment in that an ID of a cooperation source system101(cooperation source system identification information) is stored together with “Yes” in the cooperation flag402. The ID of the cooperation source system101may be any information that can uniquely identify the cooperation source system101in the cooperation system S.

A record411B indicates that the cooperation user name (user ID401) in the cooperation destination system102in which a user (cooperation source user name403) of a system in which the cooperation source system101is identified by “SYS ID1” is “taro.suzuki” is “abcdefgh1”. A record412B indicates that the cooperation user name in the cooperation destination system102in which the user of the system in which the cooperation source system101is identified by “SYS ID2” is “Saburo.tanaka” is “abcdefgh2”. The record412B indicates that the user having the user ID401of “jiro.ito” is a unique user of the cooperation destination system102.

In the second embodiment, in S713of the request processing (FIG.7) of the cooperation system S, the user name of the cooperation source system101and the ID of the cooperation source system101are added to the request, and the cooperation request is transmitted to the cooperation destination system102.

In the second embodiment, in S722, the user ID401and the cooperation flag402of the cooperation destination system user information121are referred to based on the user name of the cooperation source system101and the ID of the cooperation source system101included in the cooperation request. Then, it is confirmed whether the cooperation user for the user corresponding to the combination of the user name of the cooperation source system101and the ID of the cooperation source system101is registered.

In the second embodiment, in S725, the cooperation response is transmitted to the system identified by the ID of the cooperation source system101indicated in the cooperation request received in S721.

In the second embodiment, in S726cof processing (FIG.9) performed by the audit log writing unit305of the cooperation destination system102, when the user name to be written to the audit log is converted into the user name of the cooperation source system, the operation source is converted into the ID of the cooperation source system101. The ID of the cooperation source system101may be shared in advance between the cooperation source system101and the cooperation destination system102at the time of cooperation, or may be transmitted and received together with the cooperation request in S713to S721(FIG.7).

In the second embodiment, in a case where the cooperation source user name corresponding to the identification information of the user included in the request is not included in the cooperation destination system user information121B when the request is received, the following processing is performed. That is, this identification information is used as the cooperation source user name, and the cooperation source user name, new user identification information, and the identification information of the cooperation source system101included in the request are registered in the cooperation destination system user information121B in association with each other. In particular, by using the UUID as the new user identification information, even in a case where a plurality of cooperation source systems101are provided, it is possible to easily create a cooperation user who avoids overlapping of the user names between the systems, and thus, it is possible to promote system cooperation.

Effects of Second Embodiment

In the second embodiment described above, in a case where there are a plurality of cooperation source systems101, the log including the cooperation source user identification information and the cooperation source system identification information of the cooperation source system101among the plurality of cooperation source systems101, as the identification information of the request source system of a request is output. Therefore, even in a case where a plurality of cooperation source systems101are provided, it is possible to determine which cooperation source system101has transmitted the request, on the log.

Although the embodiments according to the present disclosure have been described in detail above, the present disclosure is not limited to the above-described embodiments, and various modifications can be made without departing from the gist of the present disclosure. For example, the above-described embodiments have been described in detail in order to explain the present invention in an easy-to-understand manner, and the above-described embodiments are not necessarily limited to a case including all the described configurations. Regarding some components in the above-described embodiments, other components can be added, deleted, and replaced.

Some or all of the units, the configurations, the functional units, the processing units, and the like described above may be realized in hardware by being designed with an integrated circuit, for example. Further, the above-described respective components, functions, and the like may be realized by software by the processor interpreting and executing a program for realizing the respective functions. Information such as a program, a table, and a file, that realizes each function can be stored in a memory, a recording device such as a hard disk and a solid state drive (SSD), and a recording medium such as an IC card, an SD card, and a DVD.

In the above-described drawings, control lines and information lines considered necessary for the descriptions are illustrated, and not all the control lines and the information lines in the actual one are necessarily shown. For example, in practice, it may be considered that almost all components are connected to each other.

The above-described functions and data arrangement forms of the cooperation source system101and the cooperation destination system102are merely examples. The functions and the data arrangement forms can be changed to an optimum arrangement form from the viewpoint of performance of hardware and software, processing efficiency, communication efficiency, and the like.