The present application claims priority from Japanese application serial no. JP2011-076269, filed on Mar. 30, 2011, the content of which is hereby incorporated by reference into this application.
The present invention relates to a technology for connection destination determination device, connection destination determination method, and service collaboration system.
Distributed computing with Web services has become popular in recent years. The Web Service is a kind of application service using the Simple Object Access Protocol (SOAP) to which the Extensible Markup Language (XML) technology is applied on the Hypertext Transfer Protocol (HTTP) that is the typical protocol for the Web. With the advent of the Next Generation Network (NGN) that provides high reliability and communication quality, the distributed computing with Web services is expected to be used not only in relatively closed network, such as company intranet, as it has been used in the past, but also in open network.
With the proliferation of Web services, the process description language has been developed to configure collaboration services in which a plurality of Web services are involved. Typical examples of the process description language include Web Services Business Process Execution Language (WS-BPEL) defined by the Organization for the Advancement of Structured Information Standards (OASIS), and Business Process Modeling Notation (BPMN) defined by the OMG. Collaboration services are defined by describing the order of the execution of Web services as a scenario by using these process description languages.
When a scenario execution device receives a scenario execution request from a user, the scenario execution device interprets the scenario to sequentially execute Web services, and provides the execution result to the user. It is possible to achieve highly functional collaboration services at a low cost by combining the Web services provided by their own provider and the Web services provided by other providers, as the Web services constituting the collaboration services.
Meanwhile, collaboration services are highly sophisticated and complicated, increasing the number of services involved in the collaboration services. Thus, there is a problem of an increase the process load on the scenario execution device. In order to solve this problem, a technology has been developed to distribute collaboration services to be executed by providing a plurality of scenario execution devices.
For example, according to the technology of U.S. Pat. No. 7,584,276, it is possible to monitor the state of the process load of each scenario device as well as the network load, and to reduce the process volume of the scenario when the process load increases. As a result, the efficiency of the process of the whole system can be increased.
Scenario designers need to accurately and precisely describe the order of services to be called as collaboration services, and the service call condition into a scenario. This requires the scenario designers to know all the services to be called according to the authentication state of the user (registered user after authentication, guest user before authentication), resulting in an increase in development costs and operation costs of the scenario.
A principal object of the present invention is to solve the above problems, and achieve collaboration services in which a plurality of Web services are involved at a low cost.
Accordingly, it is an aspect of the present invention to solve the above problems by providing a connection destination determination device used for a service collaboration system. The service collaboration system includes a scenario execution device, a service execution device, and a connection destination determination device. The scenario execution device calls a connection destination service to achieve each of a plurality of collaboration services, based on the scenario that specifies the order of the execution of the collaboration services. The service execution device executes the called connection destination service. The connection destination determination device determines the connection destination service from the collaboration service.
Memory means of the connection destination determination device stores the following data: approval policy data showing a user authentication state for each of the collaboration services in order to allow the collaboration service to be executed; authentication destination list data showing a connection destination of the authentication service to update the user authentication state; and service list data showing a connection destination of service for each of the collaboration services to execute the collaboration service.
A control unit of the connection destination determination device receives a connection destination determination request including the collaboration service, which is a search key, and the user authentication state from the scenario execution device. Then, the control unit performs an approval determination process to determine that the user authentication state of the connection destination request is approved if the user authentication state satisfies the user authentication state corresponding to the collaboration service stored as the search key in the approval policy data. If the user authentication state is determined to be approved in the approval determination process, the control unit obtains the connection destination of service corresponding to the collaboration service, which is the search key, from the service list data. Then, the control unit responds to a source of the connection destination determination request with the obtained connection destination as the connection destination service. On the other hand, if the user authentication state is not determined to be approved in the approval determination process, the control unit obtains the connection destination of authentication service in order to obtain the user authentication state not satisfied in the approval determination process, from the authentication destination list data. Then, the control unit responds to a source of the connection destination determination request with the obtained connection destination as the connection destination service.
Other components will be described below.
According to the present invention, it is possible to achieve collaboration services in which a plurality of Web services are involved at a low cost.
Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings.
As a comparison example,
“Scenario” is a program that defines a series of service calls that starts execution at the point marked “start”, sequentially calls the services (user log-in, and the like) of the connection destination, and complete execution at the point marked “end”.
The services of the connection destination include transaction services relating to product purchase, such as “catalogue presentation a” and “order b”, as well as authentication services necessary for the execution of the transaction services, such as “user log-in” and “credit authentication”.
Thus, the scenario designers need to have knowledge of not only transaction services but also of authentication services. Then, the scenario designers need to design the scenario so as to execute “user log-in” to identify a user and “catalogue presentation a” to recommend selected articles to the identified user, by taking into account the knowledge of both the truncation and authentication services.
In other words, in
According to the “scenario” in
The “connection destination determination process” is the process for identifying the service of the connection destination necessary for the execution of the collaboration service, by using the collaboration service name (such as the catalogue presentation A) as the search key. For example, it is necessary to call the transaction service “catalogue presentation a” to execute the collaboration service “catalogue presentation A”. In addition, it is also necessary to call the authentication service “user log-in” as the preparation process. Hereinafter, the transaction services and the authentication services on the end point side to be called are commonly referred to as “connection destination services (or occasionally simply referred to as “connection destinations”)”. The connection destination service is realized, for example, as a Web service using SOAP in a logical interface through which the execution request and the execution result response are transmitted.
A significant feature of this embodiment shown in
The number of units of each device that constitutes the service collaboration system is not limited to the number shown in
Further, it is shown that the connection destination determination device 1, the service execution device 2, and the scenario execution device 3 are provided as separate components. However, two or more types of the three devices may be housed in one physical computer system. This makes it possible to reduce the setting space of the devices and to reduce the number of wiring cables. As a result, the system can be simplified.
The user terminal 4 transmits to the scenario execution device 3 a request for the execution of the scenario in which the collaboration services are described. Then, the user terminal 4 receives the execution result from the scenario execution device 3.
The scenario execution device 3 executes the scenario in response to the scenario execution request received from the user terminal 4. Then, the scenario execution device 3 requests the service execution device 2 to execute the connection destination services in order to achieve the collaboration services described in the scenario.
The service execution device 2 is a device in which a service execution unit 21 is deployed (or installed) to execute the connection destination services that are requested by the scenario execution device 3. In this embodiment, one or more service execution units 21 are included in one service execution device 2. Note that it is possible to provide a plurality of service execution devices 2 including the service execution unit 21 of the same service content, to distribute the load of the service content in which the load is concentrated.
The connection destination determination device 1 determines the connection destination service as the connection destination to achieve each collaboration service by using the particular collaboration service as the search key, as described in the “connection destination determination process” with reference to
The scenario execution device 3 includes a connection destination request unit 31, a scenario storage unit 34, a request destination list 32 (storage unit thereof), a scenario execution unit 33, and a handover information processing unit 35.
The connection destination request unit 31 makes a query to the connection destination determination device 1 (a connection destination response unit 14) with the collaboration service read by the scenario execution unit 33 as the search key, to obtain the connection destination service necessary for the execution of the particular collaboration service. Then, the connection destination request unit 31 notifies the scenario execution unit 33.
The scenario storage unit 34 stores the scenario which is the definition information of the collaboration services to be executed.
The request destination list 32 stores the identification information (such as the URL and IP address) of the connection destination determination device 1 (the connection destination request unit 31) to which the connection destination determination device 1 refers, for each connection destination determination device 1.
The scenario execution unit 33 identifies the collaboration service to be executed, according to the scenario in the scenario storage unit 34. Then, the scenario execution unit 33 requests for the execution of the service to the service execution unit 21 that corresponds to the connection destination service notified by the connection destination request unit 31. Then, the scenario execution unit 33 receives the execution result from the service execution unit 21. Further, when the execution of the collaboration service is completed, the scenario execution unit 33 transmits the execution result of the collaboration service to the user terminal 4 from which the scenario execution request has been transmitted.
In the configuration in which a plurality of scenario execution devices 3 are present, the handover information processing unit 35 is used to establish data linkage with the scenario execution device of the other device by exchanging the memory content (calculation process data) in the scenario execution device 3, as the handover information, with the scenario execution device 3 of the other device. Thus, the handover information processing unit 35 generates the handover information.
Note that in
The connection destination determination device 1 includes an approval determination unit 11, a policy storage unit 12, an authentication destination list 13 (storage unit thereof), a connection destination response unit 14, a service state collection unit 15, and a service list 16 (storage unit thereof).
The connection destination determination device 1 is configured as a computer including a control unit and a memory unit. The control unit executes the approval determination unit 11, the connection destination response unit 14, and the service state collection unit 15. The memory unit stores the policy storage unit 12, the authentication destination list 13, and the service list 16.
The approval determination unit 11 determines that the client user authentication state is approved if the client user authentication state satisfies the security policy specified for each destination service (transaction service). For example, the client user authentication state means the authentication assertion based on the cookie or Security Assertion Markup Language (SAML) for authentication issued by the identity provider when the client user is authenticated.
The policy storage unit 12 stores the security policy specified for each destination service (transaction service). For example, in
The authentication destination list 13 is a list of authentication services that are the connection destination services to be called to obtain the client user authentication state.
Upon receiving the query for the connection destination with the collaboration service as the search key from the connection destination request unit 31, the connection destination response unit 14 determines the connection destination service for the execution of the collaboration service, based on the approval result in the approval determination unit 11 or other information. Then, the connection destination response unit 14 responds to the connection destination request unit 31.
The service state collection unit 15 collects the service state of the service execution unit 21 and writes out to the service list 16.
The service list 16 is a list of the services of the service execution unit 21, in which each service is associated with the information (such as the URL of the connection destination, the service state) relating to the particular service.
The Table 1 is a table showing the data content (the policy storage unit 12, the authentication destination list 13, and the service list 16) stored in the connection destination determination device 1.
The policy storage unit 12 stores data corresponding to the collaboration service name, which is the search key, and to the approval policy to receive the particular collaboration service. The data stored in the policy storage unit 12 is used as the policy. For example, “Web service A” can be executed without authentication. On the other hand, “Web service B” requires two types of authentication “ID/PW authentication, PKI authentication”, before the execution of the service. Note that the approval policy may include not only the information indicating the authentication type (PKI authentication, and the like), but also detailed authentication information, for example on the identity provider by which the authentication should be performed.
The authentication destination list 13 stores the connection destination (the URL starting with “http://) of the authentication service for each authentication type specified by the approval policy of the policy storage unit 12, together with the load value for each service execution unit 21 of the connection destination. Note that the parameters used in the calculation of the load value may include the CPU usage rate of each service execution device 2, the number of connections established between the service execution device 2 and the scenario execution device 3, the network delay, and the network bandwidth usage rate.
The service list 16 stores the collaboration service name as the search key, the scenario execution device 3 (hereinafter referred to as “assigned execution device”) for calling the connection destination service to execute the particular collaboration service, the connection destination service to be called by the particular scenario execution device 3, and the load value for each service execution unit 21 of the connection destination.
Although it is shown that only the URL is stored in the “connection destination” column of the authentication destination list 13 and the service list 16, it is also possible to store information for building a logical interface for communication. For example, the information for building a logical interface for communication is described by the Web Services Description Language (WSDL).
Further, with respect to the load value stored in the “connection destination load value” column in the authentication destination list 13 and in the service list 16, the load is large as the value is larger. Thus, the load value is not selected for the distribution of the load. Further, the load of all the destination services may not be stored in the “connection destination load value” as the load value. It is possible to store only the load value to be managed by the own device. When the load value stored in the “connection destination load value” column corresponds to the load of a portion of the connection destination services, it is possible to determine a low-load connection destination service by the following roaming procedures 1 to 4.
It is assumed that a plurality of destination determination devices 1 are referred to as “first destination determination device 1”, “second destination determination device 1”, and so on, in the order of receiving queries for destinations.
Procedure 1: If there is a connection destination service with a low load (which is equal to or less than a predetermined threshold) in the connection destination load values managed by the first destination determination device 1, the low load destination service is used.
Procedure 2: If there is no destination service with a low load in the connection destination load values managed by the first destination determination device 1, roaming is performed in the second connection destination determination device 1, which is the other device, to see if there is a connection destination service with a low load in the load values manages by the second destination determination device 1.
Procedure 3: If there is a connection destination service with a low load in the connection destination load values managed by the second destination determination device 1, the low load destination service is used.
Procedure 4: If there is no connection destination service with a low load in the connection destination load values managed by the second destination determination device 1, roaming is performed in the third destination determination device 1, which is the other device, to see if there is a connection destination determination service of a low load in the load values managed by the third destination determination device 1.
(This process is recursively repeated by changing the connection destination determination device 1).
The Table 2 shows the data (the request destination list 32, the scenario storage unit 34) stored in the scenario execution device 3.
The request destination list 32 stores data corresponding to the device name and the URL for each connection destination determination device 1, as the list of the connection destination determination devices 1 in the service collaboration system.
The scenario storage unit 34 stores information in which one row of the table is defined as one scenario. For example, the scenario a of the Table 2 specifies that the collaboration services of the following five lines, which are the scenario content, are executed in this order.
First line: Receive a character string as an input, and store in the variable val0.
Second line: Store the result of the execution of Web service A with val0 into the variable val1.
Third line: Store the result of the execution of Web service B with val1 into the variable val2.
Fourth line: Store the result of the execution of Web service C with val1 and val2 into the variable val3.
Fifth line: Return val3 as the final result.
Note that the description format of the scenario is not limited to the description format shown in the Table 2, and various types of description format such as BPEL and BPMN can also be used.
A computer 9 includes a CPU 91, a memory 92, an external storage device 93 such as a hard disk, a communication device 94 for communicating with other devices through a network 99a such as the Internet or Local Area Network (LAN), an input device 95 such as a keyboard or mouse, an output device 96 such as a monitor or printer, and a reading device 97 for a portable storage medium 99b. Then, all the components are connected by an internal bus 98. Examples of the storage medium 99b are an IC card and a USB memory.
The computer 9 loads a program for realizing the function of each processor shown in
Then, the program that is once stored in the external storage device 93 is loaded from the external storage device 93 into the memory, and then executed by the CPU 91. Alternatively, the program is directly loaded on the memory and is executed by the CPU 91 without being stored in the external storage device 93.
The user terminal 4 receives an operation from a client user, and transmits a scenario execution request to the scenario execution device 3 (S11).
The scenario execution unit 33 executes the scenario specified in the scenario execution request received in S11. In other words, the scenario execution unit 33 executes the process of the steps from S21 to S27, which will be described below, for each collaboration service described in the scenario, as the scenario execution process (S20). Note that, with respect to a plurality of collaboration services (specified by the <FLOW> tag of BPEL, and the like) that can be processed in parallel in the scenario execution process (S20), the process of the steps from S21 to S27 for the plurality of collaboration services can be executed in parallel.
The scenario execution unit 33 transmits a connection destination determination request to the connection destination determination device 1 in order to identify the connection destination service by using the collaboration service as the search key (S21). The connection destination determination request (S21) includes the collaboration service as the search key, as well as the information indicating the client user authentication state.
Note that the scenario execution unit 33 manages the execution progress data (showing how far the execution of the collaboration service has progressed) with respect to the executed scenario. The scenario execution unit 33 compares the executed scenario with the scenario stored in the scenario storage unit 34 to identify the collaboration service to be next executed as the collaboration service which is the search key. For example, in the scenario storage unit 34 of the Table 2, when the (first line) is the execution progress data, the (second line) Web service A is the collaboration service which is the search key.
The connection destination response unit 14 receives the connection destination determination request (S21). Then, the connection destination response unit 14 executes a connection destination determination process to identify the connection destination service by using the collaboration service as the search key (S22, see
The connection destination response unit 14 responds to the connection destination request unit 31 with the identification information (URL) of the connection destination service determined in S22 as well as the identification information of the scenario execution device 3 which is the execution device of the particular destination service, as the connection destination determination response (S23).
When the execution device assigned to the particular destination service in S23 is the own device, the scenario execution device 3 executes S25, described below, by omitting the process involved in the data handover in S24 and S31 described below.
On the other hand, when the execution device assigned to the particular connection destination service in S23 is another device, the scenario execution device 3 (the handover information processing unit 35) generates handover information as data collaboration (S24), and transmits the handover information to the other scenario execution device 3 corresponding to the assigned execution device. Then, the scenario execution device 3 ends the execution process of the own scenario. Note that the handover information is the information necessary for the execution of the connection destination service, which is a data set stored in the memory of the handover source device. Examples of the data set are as follows.
Note that as the connection destination determination response (S23), it is also possible to use a redirect response in which the assigned execution device is specified as the transfer destination. Upon receiving the redirect response, the own scenario execution device 3 can establish a connection to the assigned execution device, which is the other device, to transmit the handover information as data collaboration (S24) by using the connection.
In this way, it is possible to generate the communication channel between the scenario execution devices 3 by only using the HTTP standard library. Thus, there is no need to newly generate a module for generating the corresponding channel.
The scenario execution unit 33 in the assigned execution device transmits a service execution request to the service execution unit 21 shown in the identification information (URL) of the connection destination service in S23 (S25).
The service execution device 2 generates the execution result by executing the corresponding service execution unit 21 according to the service execution request received in S25 (S26). Then, the service execution device 2 responds to the scenario execution unit 33 with the execution result (S27).
The scenario execution device 3 (the handover information processing unit 35) receives the scenario execution request in S11, and completes the scenario execution process of S20 (namely, the process of the steps from S21 to S27). Then, the scenario execution device 3 performs a data handover count process to receive the handover information (the data updated by the service execution in S26) from each scenario execution device 3 (each handover information processing unit 35), which is the other device, to which the data has been handed over in S24 (S31).
Note that the handover information includes the address of the scenario execution device 3 that has received the scenario execution request in S11. Thus, it is possible to identify the scenario execution device 3 to perform the process of S31.
Upon receiving the scenario execution request in S11, the scenario execution device 3 (the scenario execution unit 33) responds to the user terminal 4, which is the source of the request of S11, with the count result of S30 (the process result of S20 in the own device or the other device).
First, as the preparation of the data handover process (S24) from the scenario execution device 3a, which is the handover source, to the connection destination scenario execution device 3b (corresponding to the assigned execution device), which is the handover destination, the connection destination determination device 1 transmits an INVITE message of the Session Initiation Protocol (SIP), which is the call control process (3PCC: 3rd Party Call Control) by a third party, to the scenario execution devices 3a and 3b. In this way, the connection destination determination device 1 establishes a call connection between the scenario execution devices 3a and 3b.
More specifically, the connection destination determination device 1 transmits, as a first connection request, an INVITE message to the scenario execution device 3a (S41) which is the handover source. Then, the connection destination determination device 1 generates an INVITE message, as a second connection request, based on the response to S41 (not shown). The connection destination determination device 1 transmits the second connection request to the scenario execution device 3b which is the handover destination (S42). The two destination requests specify their connection destination devices, respectively. For example, the connection destination of the first destination request is the scenario execution device 3b.
Then, the two scenario execution devices 3 establish a connection based on the received INVITE messages (S43). The data handover (S24) and the data handover count (S31) are transmitted through the connection established in S43.
As described above, the connection destination determination device 1 connects the two scenario execution devices 3 through the call control process by the third party. This makes it possible to control the connection established by the connection destination determination device 1. For example, the connection destination determination device 1 can set the communication quality, the communication bandwidth, the protocol to be used, and the like, which are established in S43, by control messages such as the INVITE message of the connection request. Thus, it is possible to achieve flexible connection management as follows:
Further, the connection destination determination device 1 may provide a connection between the connection destination determination device 1 (corresponding to the assigned execution device) and the service execution device 2, as the call control process by the third party. This connection is used for the service execution request (S25) and the response thereto (S27).
First, the connection destination response unit 14 obtains the approval policy necessary for the execution of the collaboration service specified as the search key, from the policy storage unit 12 (S101). Then, the connection destination response unit 14 determines whether the user authentication state included in the connection destination determination request (S21) satisfies the approval policy (S102). If YES in S102, the process proceeds to S104. If NO in S102, the process proceeds to S103.
As S103, the connection destination response unit 14 obtains the connection destination (for approval) according to each approval type included in the authentication policy, from the authentication destination list 13. Then, the connection destination response unit 14 calls the authentication service to update the user authentication state (S103). Then, the connection destination response unit 14 determines again whether the authentication state of the user satisfies the approval policy (S102). For example, in the authentication destination list 13 of the Table 1, there are two destinations (“http://idpw1” and “http://idpw2/”) of the authentication service for the execution of “ID/PW authentication”. In this case, the connection destination “http://idpw1/” has the lower load value of the two connection destinations, and is selected as the call destination.
As S104, the connection destination response unit 14 obtains, from the service list 16, candidates for the connection destination service (for collaboration) that is necessary for the execution of the collaboration service specified as the search key.
As S105, the connection destination response unit 14 determines one connection destination according to a predetermined condition, from the candidates of S104. For example, when the predetermined condition is to “select a service with low load”, the connection destination response unit 14 selects the connection destination service with the smallest “connection destination load value” in the service list 16. It is also possible that in addition to the “connection destination load value”, the service attribution information (service fee, registered user of the service, and the like) necessary for the determination of the predetermined condition is stored in the service list 16 in advance. In this case, various predetermined conditions such as “select a service with a low service fee” and “select a service for which the user registers” can be used solely or along with other predetermined conditions (such as logical operation with AND/OR operator). Further, the predetermined condition may be to “select a service at random”.
As S106, the connection destination response unit 14 responds to the scenario execution device 3 (the connection destination request unit 31) with the connection destination determined in S103 or in S105.
The connection destination response unit 14 may respond to the scenario execution device 3 with the connection destination (for authentication) determined in S103. This allows the scenario execution device 3 to call the authentication service of the connection destination (for authentication) (first destination response unit).
The connection destination response unit 14 may respond to the scenario execution device 3 with the connection destination (for collaboration) determined in S105. This allows the scenario execution device 3 to call the authentication service of the connection destination (for collaboration) (second destination response unit).
As described above, the major feature of this embodiment is the method in which the connection destination determination device 1 determines the service to be called by the scenario execution device 3 in response to the request of S21 when the scenario is executed (the method shown in
In this way, the proper destination service is selected in the execution of the scenario. As a result, various effects can be obtained as follows:
Number | Date | Country | Kind |
---|---|---|---|
2011-076269 | Mar 2011 | JP | national |