JP2010092376A - Information processing apparatus, information processing method, and information processing program - Google Patents

Abstract

Provided is an information processing apparatus capable of reducing damage caused by a malicious third party attack by controlling the behavior of an external program when an external program is executed. To do.
An information processing apparatus capable of calling a second external program from within the first program and executing the second program, wherein the judging means analyzes the first program. And determining whether or not the second program exists, and prohibiting control means prohibits execution of the second program when the determining means determines that the second program exists. To control.
[Selection] Figure 1

Description

  The present invention relates to an information processing apparatus, an information processing method, and an information processing program that can call an external second program from within the first program and execute the second program.

A program that runs on a terminal device, such as a server that is stored in a storage device in the terminal device (also referred to as local installation), or a server that is connected via a communication line (whether wired or wireless) Some of them are installed from other information processing apparatuses when the program is needed.
For example, a Widget that can be expressed in a Web description language such as HTML (Hyper Text Mark-up Language), XML (extensible Markup Language), etc. and can be executed by a JavaScript (registered trademark) is a locally installed program of the terminal device There is a program placed in an external server or the like that is called from the Widget via a communication line. Note that calls from programs in the terminal device include calls from a Web description language, calls from Java Script, and the like.
For example, as a description for calling an external program in Widget,
<Script Language = “JavaScript1.2” src = “http: //aaa.bbb.ccc/dd.js”>
Or as a description to call the script from the script,
xmlhttp.open = (“post”, ”http: //aaa.bbb.ccc/dd.js”)
There is.

When the domain security model is applied to the Widget and the availability of the method is assigned to each security domain, the external JavaScript called from the Widget is usually the same domain as the security of the activated Widget. Work within.
For example, as shown in the example of FIG. 17, the terminal device 1710 is connected to the Web server 1750 via the Internet 1790. The terminal device 1710 includes an A domain 1720 and a B domain 1730. In the B domain 1730, Widget 1731 operates. When the widget 1731 calls the JavaScript 1732 in the Web server 1750, the JavaScript 1732 operates in the B domain 1730. That is, JavaScript 1732 operates at the same security level as that of Widget 1731 (security level of B domain 1730).

A program placed on an external server or the like called via a communication line has the following risks.
(A1) Man-in-the-Middle attack (replacement of JavaScript in the communication path)
(A2) Replacement of JavaScript due to Web tampering For example, as shown in the example of FIG. 18, a crack 1801 occurs due to the above (A1), and the JavaScript 1732 is replaced during the communication in the Internet 1790, (A2 ) May cause a crack 1802 to replace the JavaScript 1732 in the Web server 1750.
In this case, the replaced JavaScript 1732 that is a malicious program can be executed with the authority of the B domain 1730. For example, it becomes possible to execute a function of acquiring personal information from the terminal device 1710, which cannot be executed except in the B domain 1730, and send it to the attacker's site.

  As a related technology, for example, in Patent Document 1, in the conventional application protection technology, the hash value of the application before and after the download is compared to ensure that the application has not been tampered with during the download. However, since this method cannot counter tampering during execution, the problem is that if the running virtual machine is tampered with, the application cannot be protected, and the program is expressed in an intermediate language independent of the platform. Is converted to a platform-dependent instruction, and the virtual machine is inspected by a virtual machine loader executed by a tamper-proof execution unit that prevents eavesdropping and tampering by a third party. Step to load and loaded virtual The thin address area is notified to the tampering inspection section executed by the tamper resistant execution section, and it is determined at a predetermined timing whether or not the virtual machine address area has been tampered with by the tampering inspection section. A virtual machine falsification inspection method including a step and a step of stopping the execution of the virtual machine when the virtual machine is determined to be falsified as a result of the determination; Yes.

In addition, as an example of implementation for changing the execution authority of a program for each domain, there is Java for mobile terminals. The specification is defined in Non-Patent Document 1.
Also, a similar domain security model has been adopted for native applications from Symbian OS v9 (see Non-Patent Document 2).
OMTP has a general framework for such a security model (see Non-Patent Document 3).
JP 2007-226277 A JSR118 MIDP2 (Mobile Information Device Profile version 2), [Search August 26, 2008], Internet <URL: http://jcp.org/aboutJava/communityprocess/final/jsr118/> [Search on August 26, 2008] Internet <URL: http://www.forum.nokia.com/main/platforms/s60/documents.html> OMTP Application Security Framework, [Search August 26, 2008], Internet <URL: http://www.omtp.org/Publications.aspx>

However, when a program stored in an external server is acquired and executed, an internal program execution policy and an execution policy of a program stored in an external server are set separately. There was no technology that realized the execution authority.
The present invention has been made paying attention to such problems of the conventional technology, and when executing an external program, the behavior of the external program is controlled to control a malicious third. It is an object of the present invention to provide an information processing apparatus, an information processing method, and an information processing program that can reduce damage caused by a person's attack.

The gist of the present invention for achieving the object lies in the inventions of the following items.
[1] An information processing apparatus that can call an external second program from within the first program and execute the second program, analyzing the first program, and executing the second program A determination means for determining whether or not there is a program; and a prohibition control means for controlling the execution of the second program when the determination means determines that the second program exists. An information processing apparatus comprising the information processing apparatus.

  [2] An information processing apparatus capable of calling a second program externally from within the first program and executing the second program, analyzing the first program, and analyzing the second program A determination unit that determines whether or not there is a program; and a permission unit that permits the second program to execute in a domain that does not require authentication when the determination unit determines that the second program exists. An information processing apparatus comprising:

  [3] An information processing apparatus that can call an external second program from within the first program and execute the second program, and stores a rule for whether or not to execute each procedure And determining means for analyzing the first program to determine whether or not there is the second program, and when the determining means determines that the second program is present, An information processing apparatus comprising: an execution authority assigning unit that assigns an execution authority for the procedure in accordance with a rule stored in the storage unit for each procedure in the second program.

  [4] An information processing apparatus capable of calling a second external program from within the first program and executing the second program, analyzing the first program, and executing the second program A determination means for determining whether or not there is a program; and when the determination means determines that the second program exists, the second program is verified by verifying a signature of the second program. An information processing apparatus comprising: an execution authority assigning means for assigning an execution authority to

  [5] The determination unit analyzes the first program before the first program is executed or when the first program is executed, and whether the second program is present. The information processing apparatus according to any one of [1] to [4], wherein the information processing apparatus determines whether or not.

  [6] Among the information processing apparatuses according to [1] to [4], the information processing apparatus includes a plurality of the information processing apparatuses, and selects any one of the plurality of information processing apparatuses. An information processing apparatus comprising: a selection unit; and a control unit configured to perform control so that processing by the information processing apparatus selected by the selection unit is performed.

  [7] An information processing method performed by an information processing apparatus capable of calling a second external program from within the first program and executing the second program, wherein the determining means includes the first program And determining whether or not there is the second program, and when the determination means determines that the second program exists, the prohibition control means executes the second program. An information processing method characterized in that control is performed so as to be prohibited.

  [8] An information processing method performed by an information processing apparatus that can call an external second program from within the first program and execute the second program, wherein the determination means includes the first program And determining whether or not the second program is present. If the determination means determines that the second program is present, the permission means does not require authentication for the second program. An information processing method characterized by permitting execution in a domain.

  [9] An information processing method performed by an information processing apparatus capable of calling a second external program from within the first program and executing the second program, wherein the information processing apparatus A storage unit that stores an execution permission rule; the determination unit analyzes the first program to determine whether the second program is present; If it is determined by the determination means that the second program is present, an execution authority for the procedure is assigned to each procedure in the second program according to the rules stored in the storage means. A characteristic information processing method.

  [10] An information processing method performed by an information processing apparatus that can call an external second program from within the first program and execute the second program, wherein the determination means includes the first program And determining whether or not the second program exists, and the execution right allocating means determines that the second program exists when the determining means determines that the second program exists. An information processing method characterized by assigning an execution right to the second program by verifying a signature.

  [11] An information processing program for causing a computer to function as an information processing apparatus that calls an external second program from within the first program and can execute the second program, Analyzing the first program to determine whether or not the second program exists, and when the determination means determines that the second program exists, the second program An information processing program that functions as prohibition control means for prohibiting execution of the program.

  [12] An information processing program for causing a computer to call an external second program from within the first program and causing the computer to function as an information processing apparatus capable of executing the second program, Analyzing the first program to determine whether or not the second program exists, and when the determination means determines that the second program exists, the second program An information processing program that causes the program to function as a permission unit that permits execution in a domain that does not require authentication.

  [13] An information processing program for causing a computer to call an external second program from within the first program and to function as an information processing apparatus capable of executing the second program, wherein the computer The storage means for storing the execution permission rule for each procedure; the determination means for analyzing the first program to determine whether the second program exists; and the determination means, When it is determined that there is a second program, it is made to function as an execution authority assigning means for assigning an execution right for the procedure in accordance with the rules stored in the storage means for each procedure in the second program. An information processing program characterized by that.

  [14] An information processing program for causing a computer to call an external second program from within the first program and causing the computer to function as an information processing apparatus capable of executing the second program. Analyzing the first program to determine whether or not the second program exists, and when the determination means determines that the second program exists, the second program An information processing program which functions as an execution authority assigning means for assigning an execution authority to the second program by verifying a signature of the program.

The present invention operates as follows.
The information processing apparatus, the information processing method, and the information processing program according to the present invention call a second program outside from the first program and control the execution of the second program.
The determining means analyzes the first program to determine whether or not the second program exists, and the prohibition control means determines that the second program exists by the determining means Controls to prohibit execution of the second program.

  The determining means analyzes the first program to determine whether or not the second program exists, and the permission means determines that the determining means determines that the second program exists. The second program is allowed to execute in a domain that does not require authentication.

  When the judging means analyzes the first program and judges whether or not there is the second program, the execution authority allocating means is judged by the judging means that the second program is present. In this case, an execution right for the procedure is assigned to each procedure in the second program in accordance with the rules stored in the storage means.

The determining means analyzes the first program to determine whether or not the second program exists, and the execution authority allocating means determines that the second program exists by the determining means. In this case, the execution authority for the second program is assigned by verifying the signature of the second program.
By controlling the behavior of external programs, they can reduce damage caused by malicious third party attacks.

  According to the information processing apparatus, the information processing method, and the information processing program according to the present invention, when an external program is executed, by controlling the behavior of the external program, a malicious third party attack The damage that occurs can be reduced.

Hereinafter, an example of a preferred embodiment for realizing the present invention will be described with reference to the drawings.
FIG. 1 shows a conceptual module configuration diagram of a configuration example of the present embodiment.
The module generally refers to a component such as software or hardware that can be logically separated. Therefore, the module in the present embodiment indicates not only a module in a program but also a module in a hardware configuration. Therefore, the present embodiment also serves as an explanation of a program, a system, and a method. However, for the sake of explanation, the words “store”, “store”, and equivalent terms are used. However, when the embodiment is a program, these terms are controlled to be stored in the storage device. I mean. In addition, the modules correspond almost one-to-one with the functions. However, in mounting, one module may be composed of one program, or a plurality of modules may be composed of one program. A plurality of programs may be used. The plurality of modules may be executed by one computer, or one module may be executed by a plurality of computers in a distributed or parallel environment. Note that one module may include other modules. In the following, “connection” includes not only physical connection but also logical connection (data exchange, instruction, reference relationship between data, etc.).
Further, the system or apparatus includes a configuration in which a plurality of computers, hardware, devices, and the like are connected via a network and the like, and includes a case where the system or device is realized by a single computer, hardware, devices, and the like. The term “predetermined” is used in addition to a predetermined meaning, including the meaning according to the situation / state at that time or the situation / state until then.

An outline of the present embodiment will be described.
An information processing apparatus 100 that can change the behavior of a program to be executable and unexecutable according to the security level to which the program such as an application belongs. In the information processing apparatus 100 that is outside the information processing apparatus 100 and that can be executed by a program called according to a program such as an application, has a separate security level and can execute the program according to each level. is there.

  An information processing apparatus 100 according to the present embodiment can call an external program B from within an internal program A and execute the program B. As shown in FIG. 100 includes a program receiving module 110, a program registration module 120, a program execution module 130, and an external call processing module 140, and is connected to an external server or the like via a communication line (whether wired or wireless). ing. For example, the information processing apparatus 100 corresponds to a terminal device capable of data communication such as a mobile phone.

Note that as the program A stored in the information processing apparatus 100, there is Widget or the like (including description in a Web description language). A Widget is a program component that constitutes an application program or a combination thereof, and may itself operate as a single program. In addition, Widget can be a native application, not a method via an interprinter such as JavaScript.
The native application is an application specialized for a CPU (Central Processing Unit), a software platform, an API (Application Program Interface) of the information processing apparatus 100 to be executed. That is, when the information processing apparatus 100 such as a mobile phone reads a native application (native code), the built-in CPU is placed in the memory and executed in a form that can be executed as it is.

The program receiving module 110 receives the program A. For example, there is a Widget as the program A, and for example, it may be determined whether the Widget is to be received by the file extension. Further, the program A may be received from a removable medium or the like in addition to reception from an external server or the like via a communication line.
The program registration module 120 registers the program A received by the program receiving module 110. Here, the registration of the program A is to verify the security level of the acquired program A and to assign a security level.
The program execution module 130 causes the program A received by the program receiving module 110 to be executed according to the security level assigned by the program registration module 120.

  The external call processing module 140 includes an external call control module 141, an external call execution module 142, and an error processing module 143, and performs control related to calling program B, execution thereof, and the like.

  The external call control module 141 analyzes the program A to determine whether there is a call to the program B. As a result of the determination, the external call control module 141 determines that there is a call to the program B in the program A. Control to prohibit execution of.

  Further, the external call control module 141 analyzes the program A, determines whether or not there is a call to the program B, and if it is determined that there is a call to the program B in the program A as a result of the determination, The program B may be allowed to execute in a domain that does not require authentication. “Authentication” refers to permitting or not permitting execution of a program by verifying a certificate or the like. A domain refers to a part or all of a computer under which resources used for information processing are under common control. For example, the behavior of a program is determined by the restriction of a certain policy (rule), and the restriction of the policy. The thing below is said to belong to the domain. More specifically, it refers to a domain in the domain security model. Further, when a virtual computer is built in the computer, one of the virtual computers may be used as a domain.

  Further, the external call control module 141 analyzes the program A to determine whether or not there is a call to the program B, and when it is determined that there is a call to the program B in the program A as a result of the determination, For each procedure in the program B, the execution authority for the procedure may be assigned according to the policy file. The policy file is stored in a storage device in the information processing apparatus 100, and is a restriction file that defines rules relating to the execution authority of the program. This is for permitting or prohibiting execution of a program or a procedure (method) in the program based on the band.

Further, the external call control module 141 analyzes the program A, determines whether or not there is a call to the program B, and if it is determined that there is a call to the program B in the program A as a result of the determination, The execution authority for the program B may be assigned by verifying the signature of the program B.
Further, the determination by the external call control module 141 is that the program A is analyzed before the program A is executed or when the program A is executed, and whether or not the program B is called in the program A. You may make it judge. More specifically, before executing the program A, before the program execution module 130 executes the program A after the program receiving module 110 receives the program A or after the program registration module 120 registers the program A. When the program A is being executed, it means that the program B is called whenever the program execution module 130 is executing the program A.

When the execution of the program B is permitted by the external call control module 141, the external call execution module 142 calls the program B from an external server or the like and causes the program B to be executed.
The error processing module 143 performs error processing when execution of the program B is prohibited by the external call control module 141. For example, the reason for determining that an error has occurred, a measure for the error, and the like are output to a display device such as a display of the information processing apparatus 100. Further, the program A may be changed so as not to call the program B, or the calling process of the program B may be skipped.

FIG. 2 is a flowchart showing an example of processing according to this embodiment.
Hereinafter, Widget will be mainly exemplified as the program A, the program B in the external server or the like will be referred to as an external script, and JavaScript will be mainly exemplified and described.
In step S <b> 202, the program receiving module 110 receives the Widget and introduces it into the information processing apparatus 100. That is, the information processing apparatus 100 can operate the widget.
In step S204, the program registration module 120 registers the security level of the widget introduced in step S202.
In step S206, the program execution module 130 causes the widget to be executed under the security level registered in step S204.
In step S208, the external call control module 141 calls an external script from the widget executed in step S206. In this case, it is determined whether or not to allow execution of the external script.
In step S210, the external call execution module 142 causes the external script called in step S208 to be executed.

FIG. 3 is an explanatory diagram showing a processing example of step S202 shown in the example of FIG. This process is mainly performed by the program receiving module 110.
The terminal device 310 and the server device 320 are connected via the Internet 330. The terminal device 310 corresponds to the information processing apparatus 100 illustrated in the example of FIG. Here, the introduction of the Widget that is performed by the terminal device 310 is to store the Widget 340 outside the terminal device 310 (for example, the server device 320) in the terminal device 310.
The terminal device 310 (the program receiving module 110 of the information processing device 100) determines whether or not to perform the registration process of the Widget 340 based on the file extension among the files stored in the server device 320. For example, “.wgt” and “.swgt” are file extensions of Widget 340.
The server device 320 transmits a file in response to a request from the terminal device 310.
In the example of FIG. 3, the terminal device 310 receives the Widget 340 as a file transfer via the Internet 330. However, the terminal device 310 may receive it as an attached file of an e-mail sent from another terminal device or the like. (Bluetooth (registered trademark)), or via a removable medium such as a memory card.

There are two types of Widgets introduced by the program receiving module 110. In other words, there are those with and without signature information.
FIG. 4 is an explanatory diagram showing an example of a file structure of Widget. A package of Widget without signature information has a file extension “.wgt” as shown in the example of FIG. There is wgt410.
XXX. A file group (XML 411, 412, HTML 413, CSS 414, JavaScript 415, Image 416, Sound 417) as shown in the example of FIG. 4B is packaged (archived) in wgt 410. A package is a grouping of a plurality of files using compression or the like, and examples thereof include ZIP and TAR.

FIG. 5 is an explanatory diagram showing an example of the file structure of a Widget with signature information. As shown in the example of FIG. 5A, the Widget package with signature information has a file extension “.swgt” as XXX. There is swgt510.
XXX. In the swgt 510, a signature information file 511 is packaged in addition to a file group (XML 411, 412, HTML 413, CSS 414, JavaScript 415, Image 416, Sound 417) as shown in the example of FIG. That is, a signature information file 511 that is an electronic signature is attached to determine the security level. The signature information file 511 describes a signature value, a signature method, an electronic certificate, and the like.
As shown in the example of FIG. 5B, the signature information file 511 is distributed separately from the case where it is archived together with the Widget file and the Widget package (from XML 411 to Sound 417). In the latter case, the signature information file 511 may describe location information (URL (Uniform Resource Locator), etc.) of the Widget package. In this case, first, the signature information file 511 is acquired, and then the Widget package is acquired using the position information therein.

FIG. 6 is an explanatory diagram showing a processing example of step S204 shown in the example of FIG. This process is mainly performed by the program registration module 120.
The program registration module 120 is a XXX. wgt410, XXX. The widget is registered based on the swgt 510. Here, the registration of the Widget is to verify the security level of the acquired Widget and assign a security level. The program registration module 120 includes a signature verification module 610. The signature verification module 610 verifies the signature, and the security of the untrusted domain 611, the third party domain 612, or the operator domain 613 Assign a level. The untrusted domain 611 is a domain that does not require authentication. The third party domain 612 is a domain for executing a Widget created by the third party. The operator domain 613 is a domain that executes a widget created by the management company of the information processing apparatus 100. That is, the operator domain 613 can execute a highly reliable Widget, the next level is the third party domain 612, and the lowest level is the untrusted domain 611. Therefore, the operator domain 613 can handle highly confidential data.

The terminal device 310 (program registration module 120) treats Widget (XXX.wgt 410) having no signature information file as an untrusted (Untrusted) domain. That is, the signature verification module 610 is XXX. Since there is no signature information in wgt 410, untrusted domain 611 is assigned.
The terminal device 310 (program registration module 120) verifies the signature information (signature information file 511) of the Widget (XXX.swgt510) using a root certificate incorporated in the terminal device 310 in advance. FIG. 6 is an explanatory view showing an example of the verification process of the signature information. The signature verification module 610 is XXX. The signature information file 511 in the swgt 510 is verified, and the security level of any one of the untrusted domain 611, the third party domain 612, and the operator domain 613 is assigned to Widget.
If the signature information file 511 is a signature associated with a certificate associated with a root certificate incorporated for an operator domain, the signature information file 511 is treated as an operator domain 613.
If linked to a third party domain, it is handled as a third party domain 612.
If it cannot be verified, the registration is failed or treated as an untrusted domain 611.

When performing signature verification by the program registration module 120, registration may be performed by associating the widget with the domain based on the verification at the time of installation of the widget, and the domain is confirmed each time the widget is executed. It may be.
The signature value to be verified by the program registration module 120 may be the signature value of the Widget package itself or the signature value of each file in the Widget package.

FIG. 7 is an explanatory diagram showing an example of the data structure of the policy information table 700. The policy information table 700 is stored as a policy information file in the storage device in the information processing apparatus 100, and is used in the processing examples shown in FIGS.
The policy information table 700 has a function group column 710, an operator domain column 720, a third party domain column 730, and an untrusted domain column 740, and includes an untrusted domain 611, a third party domain 612, an operator domain. The relationship between whether the domain 613 and the function group of the program (Widget, external script, etc.) can be executed is shown. That is, the policy information table 700 shows rules for which functions can be used according to each domain.

The function group column 710 is a grouping of functions provided by the information processing apparatus 100, and the program belongs to one of the groups. For example, when the information processing apparatus 100 is a mobile phone, a telephone function group for providing a function as a telephone, a GPS (Global Positioning System) for measuring the current position of the information processing apparatus 100, and the like. It is divided into a GPS function group for providing functions, a mail group for providing e-mail functions, and an Internet group for providing functions for communicating with other servers via the Internet.
The operator domain column 720 stores whether or not each group in the operator domain 613 can be executed, and functions provided by all function groups, that is, all programs registered as the operator domain 613 can be executed.

The third party domain column 730 stores whether or not each group can be executed in the third party domain 612. Functions provided other than the GPS function group, that is, programs other than the GPS function group registered as the third party domain 612 are stored in the third party domain column 730. It is feasible.
The untrusted domain column 740 stores whether or not each group in the untrusted domain 611 can be executed. The function provided only for the mail group, that is, the program registered as the untrusted domain 611 belongs to the mail function group. Only what is available can be executed.

  The function group column 710 groups programs according to functions, but a policy may be set for each individual method (procedure) or library.

A processing example by the external call processing module 140 will be described with reference to FIGS.
The first processing example shown in the examples of FIGS. 8 and 9 prohibits the calling of the external script itself.
The second processing example shown in the examples of FIGS. 10 and 11 permits execution of an external script in a domain without authentication.
The third processing example shown in the examples of FIGS. 12 and 13 is for restricting whether or not an external script is permitted for each procedure.
In the fourth processing example shown in the examples of FIGS. 14 and 15, the external script also divides the domain by authentication equivalent to Widget and changes the execution authority depending on the domain to which the script belongs.

  FIG. 8 is a flowchart showing a 1-1 example of processing according to this embodiment. This is a process for confirming the calling of an external script before executing Widget. For example, it is performed immediately before execution of Widget, when Widget is introduced, or when Widget is registered. The external call processing module 140 is implemented, for example, in the Widget platform.

In step S802, the external call control module 141 selects a target widget.
In step S804, the external call control module 141 analyzes the file in the Widget selected in step S802. The analysis here is to detect a call to an external script. For example, the presence / absence of an external script file is detected from the description contents of XML 411, HTML 413, JavaScript 415, etc. shown in the example of FIG.

In step S806, the external call control module 141 determines whether there is an external script file based on the analysis result in step S804. That is, it is determined whether there is an external script call. If so, the process proceeds to step S812; otherwise, the process proceeds to step S808.
In step S808, it is determined whether there is another file in the Widget. If there is, the process returns to step S804. Otherwise, the process proceeds to step S810.

In step S810, since the Widget is a call for which no external script is called, the Widget is executed.
In step S812, the error processing module 143 performs error processing. For example, it is displayed on a display device such as a display of the information processing apparatus 100 that the Widget is a call to an external script and that the deletion of the Widget is recommended. As an error process, the call to the external script may be deleted from the widget, or the widget itself may not be executed.

  FIG. 9 is a flowchart showing a 1-2 process example according to this embodiment. This is a process for confirming the calling of an external script during execution of a widget. The external call processing module 140 is mounted in, for example, a JavaScript interpreter. Here, JavaScript is exemplified as the Widget file to be executed.

In step S902, the program execution module 130 starts executing a script (JavaScript) in the Widget.
In step S904, the external call control module 141 in the JavaScript interpreter analyzes the JavaScript that has started execution in step S902.

In step S906, the external call control module 141 determines whether there is an external script call based on the analysis result in step S904. If there is, the process proceeds to step S914; otherwise, the process proceeds to step S908.
In step S908, the program execution module 130 executes JavaScript.

In step S910, the external call control module 141 determines whether or not all scripts (JavaScript) in the Widget have been executed. If so, the process proceeds to step S912. Otherwise, the process returns to step S904.
In step S912, the program execution module 130 ends the processing of the script that started execution in step S902.
In step S914, the error processing module 143 performs error processing. For example, a display device such as a display of the information processing apparatus 100 displays that there is an external script call and terminates the processing. As an error process, the process may be continued by skipping the calling of the external script.

FIG. 10 is a flowchart showing a 2-1 process example according to this embodiment. It is the same as the flowchart shown in the example of FIG. 8 that it is a process of confirming the calling of the external script before executing the widget.
The processing from step S1002 to step S1008 is equivalent to the processing from step S802 to step S808 shown in the example of FIG.
In step S1010, the external call control module 141 acquires an external script.
In step S1012, the external call control module 141 assigns an untrusted domain to the external script acquired in step S1010.

In step S1014, the Widget selected in step S1002 is executed. That is, the part other than the external script operates under the domain assigned to the widget, and the external script part operates under the untrusted domain.
In place of the processing in steps S1010 and S1012, a flag indicating that the script file is an external script file is set, and if the flag is present during execution of the widget, the operation is performed according to the untrusted policy (under the untrusted domain). You may do it.

FIG. 11 is a flowchart showing an example of process 2-2 according to the present embodiment. It is the same as the flowchart shown in the example of FIG. 9 that it is a process of confirming the calling of the external script during execution of the widget.
The processing in step S1102 is equivalent to the processing in step S902 shown in the example of FIG.
In step S1104, the external call control module 141 uses the registration information 1105 to confirm the domain to which the script started in step S1102 belongs. The registration information 1105 is information related to the domain registered for each widget by the process of step S204 illustrated in the example of FIG.

The processing in steps S1106 and S1108 is equivalent to the processing in steps S904 and S906 shown in the example of FIG.
In step S1110, the program execution module 130 or the external call execution module 142 determines whether or not the script to be executed (including the external script that is JavaScript) has execution permission compared to the registered domain. I do. If the execution is permitted, the process proceeds to step S1112. Otherwise, the process proceeds to step S1122.

In step S1112, the program execution module 130 or the external call execution module 142 executes JavaScript.
In step S1114, the external call control module 141 determines whether or not all the scripts (JavaScript) in the Widget have been executed. If so, the process proceeds to step S1116; otherwise, the process returns to step S1106.

In step S1116, the program execution module 130 or the external call execution module 142 ends the processing of the script that has started execution in step S1102.
In step S1118, the external call control module 141 acquires an external script.
In step S1120, the external call control module 141 assigns an untrusted domain to the external script acquired in step S1118.

In step S1122, the error processing module 143 performs error processing. For example, a message indicating that execution is to be performed in a different domain is displayed on a display device such as a display of the information processing apparatus 100. As an error process, the process may be continued by skipping the calling of the external script.
Note that the processing in step S1104 may be performed before script execution, such as when a widget is selected, instead of when the script is executed.
Also, instead of the processing of step S1118 and step S1120, a flag indicating that the script is an external script file is set, and if the flag is present at the time of executing the widget, it operates according to the untrusted policy (under the untrusted domain). You may do it.

FIG. 12 is a flowchart showing a 3-1 process example according to this embodiment. It is the same as the flowchart shown in the example of FIG. 8 that it is a process of confirming the calling of the external script before executing the widget.
The processing from step S1202 to step S1206 is equivalent to the processing from step S802 to step S806 shown in the example of FIG.
In step S1208, the external call control module 141 determines whether or not the widget to be executed is a script file. If it is a script file, the process proceeds to step S1218; otherwise, the process proceeds to step S1210.

The processes in steps S1210 and S1212 are equivalent to the processes in steps S808 and S810 shown in the example of FIG.
In step S1212, the Widget selected in step S1202 is executed. That is, the part other than the external script operates under the domain assigned to the widget, and the external script part operates under the untrusted domain.
In step S1214, the external call control module 141 acquires an external script.
In step S1216, the external call control module 141 sets a flag indicating that it is an external script file for the external script acquired in step S1214.

In step S1218, the external call control module 141 analyzes the script. That is, the script is divided for each method (procedure), and the execution authority corresponding to the method is extracted using the policy file 1219. In the policy file 1219, there is a policy information table 700 shown in the example of FIG.
In step S1220, the external call control module 141 assigns the execution authority extracted in step S1218 to each method.

FIG. 13 is a flowchart illustrating a 3-2 processing example according to the present embodiment. It is the same as the flowchart shown in the example of FIG. 9 that it is a process of confirming the calling of the external script during execution of the widget.
The processing from step S1302 to step S1308 is equivalent to the processing from step S1102 to step S1108 shown in the example of FIG. Registration information 1305 is equivalent to registration information 1105.

In step S1310, the external call control module 141 determines whether or not the widget to be executed is an external script. This determination is based on whether or not a flag is set in step S1322. If it is an external script, the process proceeds to step S1312, otherwise the process proceeds to step S1324.
In step S1312, the external call control module 141 uses the policy file 1313 to determine whether the script has execution authority. If there is an execution right, the process proceeds to step S1314; otherwise, the process proceeds to step S1328.

In step S1314, the program execution module 130 or the external call execution module 142 executes JavaScript.
In step S1316, the external call control module 141 determines whether or not all scripts (JavaScript) in the Widget have been executed. If so, the process proceeds to step S1318; otherwise, the process returns to step S1306.
In step S1318, the program execution module 130 or the external call execution module 142 ends the processing of the script that has started execution in step S1302.

The processes in steps S1320 and S1322 are equivalent to the processes in steps S1214 and S1216 shown in the example of FIG.
In step S1324, the external call execution module 142 determines whether or not the script to be executed (including an external script that is JavaScript) has execution permission compared to the registered domain. If the execution is permitted, the process proceeds to step S1314; otherwise, the process proceeds to step S1326.
In step S1326, the error processing module 143 performs error processing. For example, a message indicating that execution is to be performed in a different domain is displayed on a display device such as a display of the information processing apparatus 100.
In step S1328, the error processing module 143 performs error processing. For example, the fact that there is no execution authority is displayed on a display device such as a display of the information processing apparatus 100.

FIG. 14 is a flowchart illustrating a fourth example of processing according to the present embodiment. It is the same as the flowchart shown in the example of FIG. 8 that it is a process of confirming the calling of the external script before executing the widget.
The processing from step S1402 to step S1408 is equivalent to the processing from step S802 to step S808 shown in the example of FIG.

In step S1410, the Widget selected in step S1402 is executed. That is, the part other than the external script operates under the domain assigned to the widget, and the external script part operates under the domain assigned in step S1416.
In step S1412, the external call control module 141 acquires an external script.
In step S1414, the external call control module 141 verifies the signature corresponding to the external script.
In step S1416, the external call control module 141 assigns a domain to the external script based on the signature verification in step S1414.

FIG. 15 is a flowchart showing a 4-2 process example according to this embodiment. It is the same as the flowchart shown in the example of FIG. 9 that it is a process of confirming the calling of the external script during execution of the widget.
The processing from step S1502 to step S1518 is equivalent to the processing from step S1102 to step S1118 shown in the example of FIG. Registration information 1505 is equivalent to registration information 1105.

In step S1520, the external call control module 141 verifies the signature corresponding to the external script.
In step S1522, the external call control module 141 assigns a domain to the external script based on the signature verification in step S1520.
In step S1524, the error processing module 143 performs error processing. For example, a message indicating that execution is to be performed in a different domain is displayed on a display device such as a display of the information processing apparatus 100.

  Of the processing examples described using the examples of FIGS. 8 to 15, the external call processing module 140 may be configured to perform a plurality of processing. That is, a selection module for selecting one of the plurality of processes is provided in the external call processing module 140, and the external call control module 141 performs control so that the process selected by the selection module is performed. You may do it.

  Note that the hardware configuration of the computer on which the program according to the present embodiment is executed is a general computer as shown in FIG. 16, and more specifically, many processes other than the processing according to the present embodiment. Is a computer that can be a server capable of executing the above. Stores a CPU 1610 that executes programs such as a program receiving module 110, a program registration module 120, a program execution module 130, and an external call processing module 140, a RAM 1630 that stores the programs and data, a program for starting the computer, and the like. ROM 1620, an auxiliary storage device HD 1640, a UI / F 1650 serving as an interface with the operator by inputting data from a keyboard, mouse, or the like by an operator's operation, or outputting data to a CRT or a liquid crystal display, etc. , A removable media reader / writer 1660 for reading from and writing to removable media such as CD-R, a communication line I / F 1670 for connecting to a communication network, and connecting them to a And a bus 1680 for the exchange of data. A plurality of these computers may be connected to each other via a network.

The information processing apparatus 100 may be a personal computer (Personal Computer), a cellular phone, a PDA (Personal Digital Assistant), a navigator system, an information appliance, or the like as long as it can communicate.
In the above-described embodiment, the program execution module 130 executes the program A and the external call execution module 142 executes the program B. However, the program execution module 130 executes the program A and the program B. May be. That is, the program execution module 130 may have the function of the external call execution module 142. Conversely, the external call execution module 142 may cause the program A and the program B to be executed.

Note that the described program can be stored in a recording medium, and in that case, it can be understood as an invention of a “computer-readable recording medium on which a program is recorded”.
The “computer-readable recording medium on which a program is recorded” refers to a computer-readable recording medium on which a program is recorded, which is used for program installation, execution, program distribution, and the like.
The recording medium is, for example, a digital versatile disc (DVD), which is a standard established by the DVD Forum, such as “DVD-R, DVD-RW, DVD-RAM,” and DVD + RW. Standard “DVD + R, DVD + RW, etc.”, compact disc (CD), read-only memory (CD-ROM), CD recordable (CD-R), CD rewritable (CD-RW), Blu-ray disc ( Blu-ray Disc (registered trademark), magneto-optical disk (MO), flexible disk (FD), magnetic tape, hard disk, read-only memory (ROM), electrically erasable and rewritable read-only memory (EEPROM), flash Includes memory, random access memory (RAM), etc. .
The program or a part of the program can be recorded on the recording medium and stored or distributed. Also, by communication, for example, a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a wired network used for the Internet, an intranet, an extranet, etc., or wireless communication It can be transmitted using a transmission medium such as a network or a combination thereof, and can also be carried on a carrier wave.
Furthermore, the program may be a part of another program, or may be recorded on a recording medium together with a separate program.

It is a figure which shows the module structural example of one embodiment of this invention. It is a flowchart which shows the process example by this Embodiment. It is explanatory drawing which shows the process example of step S202 shown in the example of FIG. It is explanatory drawing which shows the file structural example of Widget. It is explanatory drawing which shows the file structural example of Widget with signature information. It is explanatory drawing which shows the process example of step S204 shown in the example of FIG. It is explanatory drawing which shows the example of a data structure of a policy information table. It is a flowchart which shows the 1-1 example of a process by this Embodiment. It is a flowchart which shows the 1-2 process example by this Embodiment. It is a flowchart which shows the 2-1 process example by this Embodiment. It is a flowchart which shows the 2nd-2 process example by this Embodiment. It is a flowchart which shows the 3-1 process example by this Embodiment. It is a flowchart which shows the 3-2 process example by this Embodiment. It is a flowchart which shows the 4th-1 process example by this Embodiment. It is a flowchart which shows the 4-2 process example by this Embodiment. It is a block diagram which shows the hardware structural example of the computer which implement | achieves this Embodiment. It is explanatory drawing which shows the example of a domain security model. It is explanatory drawing which shows the example in case a crack may generate | occur | produce in a domain security model.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 ... Information processing apparatus 110 ... Program reception module 120 ... Program registration module 130 ... Program execution module 140 ... External call processing module 141 ... External call control module 142 ... External call execution module 143 ... Error processing module 310 ... Terminal device 320 ... Server Device 330 ... Internet 340 ... Widget
1710 ... Terminal device 1720 ... A domain 1730 ... B domain 1731 ... Widget
1732 ... JavaScript
1750 ... Web server 1790 ... Internet 1801 ... Crack 1802 ... Crack

Claims (14)

An information processing apparatus that can call an external second program from within the first program and execute the second program,
Analyzing means for analyzing the first program and determining whether or not there is the second program;
An information processing apparatus comprising: a prohibition control unit that performs control so as to prohibit execution of the second program when the determination unit determines that the second program is present. An information processing apparatus that can call an external second program from within the first program and execute the second program,
Analyzing means for analyzing the first program and determining whether or not there is the second program;
An information processing apparatus comprising: permission means for permitting execution of the second program in a domain that does not require authentication when the determination means determines that the second program is present. An information processing apparatus that can call an external second program from within the first program and execute the second program,
Storage means for storing a rule indicating whether or not each procedure can be executed;
Analyzing means for analyzing the first program and determining whether or not there is the second program;
When the determining means determines that the second program is present, execution for assigning an execution right to the procedure according to a rule stored in the storage means for each procedure in the second program An information processing apparatus comprising authority assignment means. An information processing apparatus that can call an external second program from within the first program and execute the second program,
Analyzing means for analyzing the first program and determining whether or not there is the second program;
When it is determined by the determining means that the second program is present, execution authority assigning means for assigning execution authority to the second program by verifying a signature of the second program is provided. An information processing apparatus characterized by that. The determination unit analyzes the first program before executing the first program or when the first program is being executed, and determines whether or not there is the second program. The information processing apparatus according to claim 1, wherein the information processing apparatus is determined. Among the information processing devices according to claim 1, comprising a plurality of the information processing devices,
Selecting means for selecting any one of the plurality of information processing devices;
An information processing apparatus comprising: control means for controlling to perform processing by the information processing apparatus selected by the selection means. An information processing method performed by an information processing apparatus that can call an external second program from within the first program and execute the second program,
The determination means analyzes the first program to determine whether there is the second program,
The prohibition control means performs control so as to prohibit execution of the second program when the judgment means judges that the second program is present. An information processing method performed by an information processing apparatus that can call an external second program from within the first program and execute the second program,
The determination means analyzes the first program to determine whether there is the second program,
The permission means permits the second program to execute in a domain that does not require authentication when the determination means determines that the second program is present. An information processing method performed by an information processing apparatus that can call an external second program from within the first program and execute the second program,
The information processing apparatus includes:
A storage means for storing a rule indicating whether or not each procedure can be executed;
The determination means analyzes the first program and determines whether there is the second program,
When the determination means determines that the second program is present, the execution authority assignment means performs the procedure for the procedure according to the rules stored in the storage means for each procedure in the second program. An information processing method characterized by assigning execution authority. An information processing method performed by an information processing apparatus that can call an external second program from within the first program and execute the second program,
The determination means analyzes the first program to determine whether there is the second program,
The execution authority assigning means assigns an execution right to the second program by verifying a signature of the second program when the judging means judges that the second program exists. An information processing method characterized by the above. An information processing program for causing a computer to call an external second program from within the first program and function as an information processing apparatus capable of executing the second program,
The computer,
Analyzing means for analyzing the first program and determining whether or not there is the second program;
An information processing program that functions as prohibition control means for controlling to prohibit execution of the second program when the determination means determines that there is the second program. An information processing program for causing a computer to call an external second program from within the first program and function as an information processing apparatus capable of executing the second program,
The computer,
Analyzing means for analyzing the first program and determining whether or not there is the second program;
An information processing program that causes the second program to function as a permission unit that permits execution in a domain that does not require authentication when the determination unit determines that the second program is present. An information processing program for causing a computer to call an external second program from within the first program and function as an information processing apparatus capable of executing the second program,
The computer,
Storage means for storing a rule indicating whether or not each procedure can be executed;
Analyzing means for analyzing the first program and determining whether or not there is the second program;
When the determining means determines that the second program is present, execution for assigning an execution right to the procedure according to a rule stored in the storage means for each procedure in the second program An information processing program which functions as an authority assigning means. An information processing program for causing a computer to call an external second program from within the first program and function as an information processing apparatus capable of executing the second program,
The computer,
Analyzing means for analyzing the first program and determining whether or not there is the second program;
When the determination unit determines that the second program is present, the signature of the second program is verified to function as an execution authority assigning unit that assigns execution authority to the second program. An information processing program characterized by that.

Images