SECURITY POLICY GENERATION

Abstract

The invention provides security policy generation methods and devices for generating a security policy that is set up for an information processing apparatus comprises a step of generating an application model having a transmitter and a receiver of a message decided, for each of a plurality of messages that are communicated, a step of storing in advance a plurality of security patterns with a signer of electronic signature appended to the message as an undecided parameter, a step of selecting a security pattern that is a model of security policy to be setup for the transmitter or receiver of the message, corresponding to each of the plurality of messages included in the application model, and a step of substituting the identification information of the transmitter or receiver of each message included in the application model for the undecided parameter of the security pattern selected corresponding to the message.

Description

FIELD OF THE INVENTION

The present invention relates to a security policy generation method, a security policy generation device, a program and a recording medium. More particularly, this invention relates to a security policy generation method, a security policy generation device, a program and a recording medium for generating a security policy that is set up for a transmitting or receiving message in at least one of a plurality of information processing apparatuses connected via a network.

BACKGROUND ART

In recent years, it is common that an information processing apparatus such as a server apparatus is communicated with another information processing apparatus connected via a network.

The following documents are considered herein:

[Patent Document 1] Published Unexamined Patent Application No. 2002-1008818

[Patent Document 2] Published Unexamined Patent Application No. 2001-101135

[Patent Document 3] Published Unexamined Patent Application No. 2003-196476

[Non-Patent Document 1] A. Nadalin, “WebServices Security Policy (WS-SecurityPolicy)”, 2002. HomepageURL “http://www-106.ibm.com/developerworks/webservices/library/w s-secpol”

[Non-Patent Document 2] E. Christensen, F. Curbera, G. Meredith, and S. Weerawarana, “Web Services Description Language (WSDL) 1.1”, W3C Note, 2001. HomepageURL “http://www.w3.org/TR/wsdl”

Along with the spread of the network such as the Internet, an unfair practice of using altered or falsified data has become a problem. On the contrary, a technique has been conventionally offered in which a security policy defining the restriction on data access, encryption, or electronic signature is generated and set up in the information processing apparatus (refer to patent documents 1 to 3).

According to patent document 1, a relatively complex security policy is simply created by preparing the models of security policy. Also, according to patent document 2, a technique has been offered in which a security policy is selected by the user from among the candidates of security policy settable in an apparatus of setting object. Also, according to patent document 3, a technique has been offered in which a security policy having a specific keyword is selected from among a plurality of security policies represented as a text file that are prepared. With these techniques, the user can be relieved of the trouble taken to select the security policy. Techniques to be mentioned in an embodiment of the invention, referring to non-patent documents 1 and 2, are also described.

The problems to be solved by the invention include the following. In recent years, a plurality of information processing apparatuses having a different administrator from each other typically cooperate with each other to provide the services such as a web service. For example, in the case of an online shopping system by use of credit cards, a purchaser terminal, seller server and card transaction system operate in a coordinated manner. To set up a security policy appropriate to each information processing apparatus in such a system, it is necessary to properly understand the contents or modes, etc. of communications performed between the information processing apparatuses and then perform the setting according to the contents or modes, etc. of the communications.

However, the techniques disclosed in the above described patent documents 1 to 3 aim to support the setting of a security policy with respect to a single information processing apparatus. Accordingly, with any of these techniques, a security policy can not be set up based on the contents, etc. of communications performed between the information processing apparatuses. On the contrary, a problem to be solved by the invention is to set up a suitable security policy for each information processing apparatus according to the whole business process implemented by a plurality of information processing apparatuses having a different administrator from each other.

SUMMARY OF THE INVENTION

Accordingly, an object of the invention is to provide a security policy generation method, security policy generation device, program and recording medium that can solve the above problem. To solve these problems, according to the invention, there is provided a security policy generation method for generating a security policy that decides at least one of an electronic signature to be appended to a message transmitted or received by an information processing apparatus and an encryption method for encrypting the message transmitted or received by the information processing apparatus. The security policy isg set up for the information processing apparatus. A security policy generation method includes: an application model generation step of generating for each of a plurality of messages that are communicated using a distributed application program, an application model having a transmitter and a receiver of the message decided, according to an instruction of the user; a security pattern storage step of storing in advance a plurality of security patterns that are models of security policy having a signer of an electronic signature appended to the message or a decoder for decoding the encrypted message as an undecided parameter; a security pattern selection step of selecting according to an instruction of the user, a security pattern that is a model of security policy to be set up for the transmitter or receiver of the message, corresponding to each of the plurality of messages included in the application model; and a security policy generation step of generating a security policy by substituting the identification information of the transmitter or receiver of each message included in the application model for the undecided parameter of the security pattern selected corresponding to the message.

There are also provided a security policy generation device using the security policy generation method, a program for enabling a computer to operate as the security policy generation device, and a recording medium on which the program is recorded. It is noted that in the above described outlines of the invention, not all essential features of the invention are listed. Subcombinations of these feature groups can also become an invention. Thus, with this invention, a suitable security policy can be set up for each of a plurality of information processing apparatuses for performing a distributed application program.

BRIEF DESCRIPTION OF THE DRAWINGS

Advantageous embodiments of the present invention will now be described, by way of example only, with reference to the drawings, in which:

FIG. 1 shows a configuration of an information processing system 10;

FIG. 2 shows an example of an interface setting information 20;

FIG. 3 shows a configuration of a security policy generation device 30;

FIG. 4 shows an example of a security pattern 400a;

FIG. 5 shows an example of a security pattern 400b;

FIG. 6 shows an exemplary application model;

FIG. 7 shows exemplary security patterns in an application example of the security policy generation device 30 according to the embodiment;

FIG. 8 shows an exemplary security policy obtained by applying an application model;

FIG. 9 shows an exemplary security policy obtained by applying a platform model;

FIG. 10 shows an operational flow of an exemplary process of the security policy generation device 30 creating a security policy;

FIG. 11 shows the details of process S1060; and

FIG. 12 shows an exemplary hardware configuration of a computer 500 working as the security policy generation device 30.

DESCRIPTION OF SYMBOLS

10 . . . Information processing system

20 . . . Interface setting information

30 . . . Security policy generation device

35 . . . Terminal

40 . . . Server

50 . . . Server

60 . . . Authentication server

300 . . . Application model generation part

310 . . . Security pattern storage part

320 . . . Candidate selection part

330 . . . Security pattern selection part

340 . . . Platform model storage part

350 . . . Security policy generation part

400 . . . Security pattern

DETAILED DESCRIPTION OF THE INVENTION

The present invention provides security policy generation methods, security policy generation devices, and program and recording medium that can solve the above problem. To solve the above problem, according to the invention, there are provided (1) a security policy generation method for generating a security policy (2) a security policy generation device using the security policy generation method, (3) a program for enabling a computer to operate as the security policy generation device and (4) a recording medium on which the program is recorded.

The security policy generation method is for generating a security policy that decides at least one of an electronic signature to be appended to a message transmitted or received by an information processing apparatus and an encryption method for encrypting the message transmitted or received by the information processing apparatus. A security policy being set up for the information processing apparatus.

An example security policy generation method includes: an application model generation step of generating for each of a plurality of messages that are communicated using a distributed application program, an application model having a transmitter and a receiver of the message decided, according to an instruction of the user; a security pattern storage step of storing in advance a plurality of security patterns that are models of security policy having a signer of an electronic signature appended to the message or a decoder for decoding the encrypted message as an undecided parameter; a security pattern selection step of selecting according to an instruction of the user, a security pattern that is a model of security policy to be set up for the transmitter or receiver of the message, corresponding to each of the plurality of messages included in the application model; and a security policy generation step of generating a security policy by substituting the identification information of the transmitter or receiver of each message included in the application model for the undecided parameter of the security pattern selected corresponding to the message. With this invention, a suitable security policy can be set up for each of a plurality of information processing apparatuses for performing a distributed application program.

The invention will be described below through embodiments of the invention. The embodiments described below do not limit the invention, and not all the combinations of the features described in an embodiment are essential as the means for solving the problems.

FIG. 1 shows a configuration of an information processing system 10. The information processing system 10 includes a security policy generation device 30, terminal 35, server 40, server 50 and authentication server 60. In the security policy generation device 30, a security policy is set up for at least one of the terminal 35, server 40 and server 50, each being an exemplary information processing system. The security policy decides at least one of an electronic signature to be appended to a message transmitted or received by an information processing apparatus and an encryption method for encrypting the message transmitted or received by the information processing apparatus, each of the electronic signature and encryption method being set up for the information processing apparatus.

The terminal 35, operated by a user purchasing a commodity or service, etc, sends to the server 40 the order information for ordering the commodity as well as the identification number of a credit card, etc. The server 40, operated by a seller selling commodities, etc, sends to the server 50 the identification number of a credit card, etc. received together with the order information, when receiving the order information from the security policy generation device 30. In the server 40, interface setting information 20 is decided which defines the interface regarding services provided by the server 40 for the terminal 35 or server 50.

The server 50, managed by an issuing corporation of a credit card, etc, determines the validity of the identification number and the credit limit, etc. of the credit card identified by use of the identification number, when receiving the identification number from the server 40. Then, the server 50 sends back the determination result to the server 40. In response to this, the server 40 sends to the terminal 35 the information indicating whether or not the order is acceptable.

The authentication server 60 manages encryption key or electronic certificate for the process of encrypting a message or appending an electronic signature to a message. The authentication server 60 issues the encryption key or electronic certificate, etc. in response to a request from the terminal 35, server 40 and server 50. An example of the authentication server 60 is Certified Authority (CA) which issues an X.509-compliant encryption key, etc.

FIG. 2 shows an example of the interface setting information 20. The interface setting information 20 defines the interface of services provided by the server 40 for the terminal 35 or server 50. Specifically, the 1^st to 6^th lines of the interface setting information 20 define a namespace in the interface setting information 20 or in a message transmitted or received by the server 40. With the namespace, the meaning of an identifier, such as a tag used in the interface setting information 20 or the message can be defined.

The 7^th to 10^th lines of the interface setting information 20 define the type of name uniquely used in the interface setting information 20. The 12^th to 20^th lines of the interface setting information 20 define the message format for each of a message inputted for the service processing and a message outputted as the result of the service processing.

The 22^nd to 28^th lines of the interface setting information 20 define a program performing the service processing and the I/O of the program. Specifically, myServices1 specified in operation tag indicates the name of program; message1 specified in input tag indicates the identification information of a message inputted into the program; message4 specified in output tag indicates the identification information of a message outputted from the program. The 30^th to 32^nd lines of the interface setting information 20 define the communication protocol, etc. specifically used in the transmitting or receiving process with respect to the transmitting or receiving of each message. The interface setting information 20 is described using interface description language. For example, it may be described using WSDL (Web Services Description Language). The details of WSDL are described in non-patent document 2, and hence repeated explanation thereof is omitted here.

FIG. 3 shows a configuration of the security policy generation device 30. The security policy generation device 30 includes an application model generation part 300, a security pattern storage part 310, a candidate selection part 320, a security pattern selection part 330, a platform model storage part 340 and a security policy generation part 350. The application model generation part 300 generates for each of a plurality of messages that are communicated using a distributed application program, an application model having a transmitter and a receiver of the message decided, according to an instruction of the user. The application model may further decide for each message the identification information of the message or the intermediary serving as an information processing apparatus that repeats the message.

The distributed application program as used herein means a program which enables a plurality of information processing apparatuses to communicate with each other so that the information processing apparatuses operate according to a request of the user. Thus, the distributed application program may not necessarily be a single dependent program but may be a group of programs installed into each of a plurality of information processing apparatuses.

The security pattern storage part 310 stores a plurality of security patterns that are models of security policy with a signer of electronic signature appended to a message or a decoder for decoding the encrypted message as an undecided parameter. For example, the security pattern storage part 310 may store each of a security pattern for transmitter, a security pattern for receiver and a security pattern for intermediary, each being a model of security pattern settable in each of the transmitter, receiver and intermediary of the message. The security pattern may further include a parameter used in a process of encrypting or decoding a message, a parameter used in a process of generating an electronic signature appended to a message or a parameter used in a process of authenticating the electronic signature as an undecided parameter. As specific examples, a security pattern 400a and a security pattern 400b each stored in the security pattern storage part 3l0 will be described later.

In the candidate selection part 320, the user inputs an instruction for specifying a message and an information processing apparatus for which a security policy is to be set up. Then, according to the determination of whether the information processing apparatus of security policy setting object is any one of a transmitter, a receiver and an intermediary of a message of security policy setting object, the candidate selection part 320 selects the candidates of security pattern which can be set up for the information processing apparatus. In addition, the candidate selection part 320 may select the candidates of security pattern according to the determination of whether there exists an intermediary in the message of setting object. The selected candidates are referred to as a pattern candidate.

The security pattern selection part 330 selects according to an instruction of the user, a security pattern that is a model of security policy to be set up for the transmitter or receiver of the message, corresponding to each of the plurality of messages included in the application model. For example, the security pattern selection part 330 may select according to an instruction of the user, one security pattern from among the candidates of security pattern selected by the candidate selection part 320.

The platform model storage part 340 stores an encryption processing parameter used in a process of encryption or decoding by an information processing apparatus, the encryption processing parameter being specified in advance for each information processing apparatus. In addition, the platform model storage part 340 stores a signature processing parameter used in the process of generating the electronic signature or in the process of authenticating the electronic signature by the information processing apparatus, the signature processing parameter being specified in advance for each information processing apparatus.

The security policy generation part 350 generates a security policy by substituting the identification information of the transmitter or receiver of each message included in the application model for the undecided parameter of the security pattern selected corresponding to the message. In addition, the security policy generation part 350 further substitutes the encryption processing parameter or signature processing parameter in the information processing apparatus of security policy setting object for the undecided parameter of the security pattern. Alternatively, the security policy generation part 350 may substitute the information as inputted by the user for the undecided parameter.

FIG. 4 shows an example of a security pattern 400a. The name of the security pattern 400a is “encrypted message (ET1)”. With the security pattern 400a, a security policy that allows the information processing apparatus to receive only a message encrypted according to a predetermined method can be generated.

Specifically, the security pattern 400a includes descriptive texts described in natural language. A descriptive text “provision of secret message” describing the summary of the security pattern is included in the security pattern 400a. Also, a descriptive text “information leaks” describing the presumed situation with respect to the security pattern is included in the security pattern 400a. This descriptive text indicates the attack or threat to be guarded against using the security policy to be set up, or the countermeasure against these practices.

Accordingly, as compared with a case where only the setting information regarding the information processing apparatus is described, the meaning of the security pattern can be shown so that the user can more easily understand it.

In addition, the security pattern 400a includes transmitter type, receiver type and intermediary type. Specifically, the security pattern 400a includes as the transmitter type any one of the presence attribute (any) indicating the presence of an information processing apparatus for transmitter in the message of security pattern 400a setting object, the presence inhibition attribute (none) indicating the prohibition of the presence of an information processing apparatus for transmitter in the message of security pattern 400a setting object, and the self attribute (self) indicating that the security pattern 400a is a security pattern for transmitter.

Similarly, the security pattern 400a includes as the receiver type any one of the presence attribute (any) indicating the presence of an information processing apparatus for receiver in the message of security pattern 400a setting object, the presence inhibition attribute (none) indicating the prohibition of the presence of an information processing apparatus for receiver in the message of security pattern 400a setting object and the self attribute (self) indicating that the security pattern 400a is a security pattern for a receiver.

Similarly, the security pattern 400a includes as the intermediary type any one of the presence attribute (any) indicating the presence of an information processing apparatus for intermediary in the message of security pattern 400a setting object, the presence inhibition attribute (none) indicating the prohibition of the presence of an information processing apparatus for intermediary in the message of security pattern 400a setting object, and the self attribute (self) indicating that the security pattern 400a is a security pattern for an intermediary.

More specifically, referring to the drawing, the intermediary type is none; therefore the security pattern 400a indicates the inhibition of the presence of an intermediary in the message of security pattern 400a setting object. In the drawing, the transmitter type is any; therefore the security pattern 400a indicates the presence of a transmitter in the message of security pattern 400a setting object.

In the drawing, the receiver type is self; therefore the security pattern 400a indicates that it is a security pattern for receiver.

In addition, the security pattern 400a includes a model of security policy with the name of a message of setting object, the encryption algorithm, the type of cipher and the identification information regarding Certified Authority as an undecided parameter. For example, referring to the drawing, a string of characters enclosed in braces with $ mark indicates an undecided parameter. More specifically, ${ALGORITHM_URL} indicates the location of a program implementing the encryption algorithm. ${TOKEN_TYPE_QNAME} indicates the type of cipher, which specifically indicates the kind of electronic certificate, etc. ${TOKEN_ISSUER_NAME} indicates the identification information regarding the authentication server 60, etc. being an issuer of encryption key.

In the drawing, a model of security policy is represented as text data. Alternatively, the security pattern 400a may hold a model of security policy being divided into a plurality of segments. For example, the security pattern 400a may hold an undecided-parameter segment and a non-undecided parameter segment as fragmentary text data. In this case, a process of retrieving an undecided parameter from the security policy can be made more efficient.

In order to enable the security policy generation part 350 to properly select an undecided parameter to be substituted, the security policy may further include parameter type indicating the definition of information to be stored in the undecided parameter, the parameter type corresponding to each undecided parameter. In this case, each message of an application model may include parameter type indicating the definition of information indicated by a parameter included in the above message, the parameter type corresponding to each parameter. Accordingly, the security policy generation part 350 can quickly select an undecided parameter to be substituted by not scanning text data being a model of security policy but determining the correspondence regarding parameter type.

FIG. 5 shows an example of a security pattern 400b. The name of the security pattern 400b is “signed message (SI1)”. The security pattern 400b, which is a setting for the receiver of a message, includes the transmitter of the message as an undecided parameter and indicates that only the reception of the message with the electronic signature of the transmitter appended thereto is permitted.

Specifically, the security pattern 400b includes descriptive texts described in natural language. A descriptive text “provision of complete message” describing the summary of the security pattern is included in the security pattern 400b. In addition, a descriptive text “message forgery” describing the presumed situation with respect to the security pattern is included in the security pattern 400b. This descriptive text indicates the attack or threat to be guarded against using the security policy to be set up, or the countermeasure against these practices.

Also, the security pattern 400b decides transmitter type, receiver type and intermediary type. More specifically, referring to the drawing, the intermediary type is any; therefore, the security pattern 400b indicates the presence of an intermediary in the message of setting object. Referring to the drawing, the transmitter type is any; therefore, the security pattern 400b indicates the presence of a transmitter in the message of setting object. Referring to the drawing, the receiver type is self; therefore, the security pattern 400b indicates that it is a security pattern for receiver.

In addition, the security pattern 400b includes a model of security policy with the name of a message of setting object, the encryption algorithm, the type of cipher and the identification information regarding Certified Authority as an undecided parameter. For example, referring to the drawing, a string of characters enclosed in braces with $ mark indicates an undecided parameter. More specifically, ${ALGORITHM_URI} indicates the location of a program implementing the encryption algorithm. ${TOKEN_TYPE_QNAME} indicates the type of cipher, which specifically indicates the kind of electronic certificate, etc. ${TOKEN_ISSUER_NAME} indicates the identification information regarding the authentication server 60, etc. being an issuer of encryption key. ${INITIAL_SENDER_NAME} indicates the identification information regarding the transmitter of a message.

In response that the security pattern 400b is selected corresponding to the message, the security policy generation part 350 substitutes the identification information of the transmitter of the message corresponding to the security pattern 400b for the undecided parameter of the security pattern 400b regarding the transmitter. In this way, according to the security policy generation device 30 according to the embodiment, the tag information, etc. indicating the security policy format are prepared in advance as security pattern, thus setting only a different part as undecided parameter according to the message of setting object. Accordingly, a suitable security pattern can be quickly created.

In the drawing, a model of security policy is shown as single text data described in a description language called WS-Security Policy (refer to non-patent document 1). Alternatively, the security pattern 400b may hold a model of security policy using another data format. For example, the security pattern 400b may hold a fragment of that part of security policy that identifies an undecided parameter.

FIG. 6 shows an exemplary application model. Firstly the process of generating an application model will be described with reference to the drawing. The application model generation part 300 defines according to an instruction of the user, the communications of a distributed application program that is processed in a coordinated manner by a plurality of information processing apparatuses. Each communication of the distributed application program is defined based on the business scenario for electric commerce, etc. implemented by the distributed application program.

For example, a terminal 35 sends order information for ordering a commodity, etc. as a message to a server 40. In addition, the terminal 35 sends information regarding payments, such as credit card number, via the server 40 as a message to a server 50. The server 40 sends information regarding commodity price, etc. as a message to the server 50. The server 50 sends information regarding the availability of payment as a message to the server 40. The server 40 sends information regarding commodity receipt, etc. as a message to the terminal 35. The user arranges each of the above described messages in the business scenario on the window by use of GUI. Accordingly, the user can specify the transmitter, receiver, etc. of each message by performing an intuitive operation as in the drawing of an event trace diagram for business.

In response to the above described process, the application model generation part 300 decides the identification information, transmitter, receiver and intermediary for each message. Specifically, regarding message1, the application model generation part 300 specifies the terminal 35 as the transmitter, and specifies the server 40 as the receiver. Regarding message2, the application model generation part 300 specifies the server 40 as the transmitter, and specifies the server 50 as the receiver. Regarding message3, the application model generation part 300 specifies the server 50 as the transmitter, and specifies the server 40 as the receiver. Regarding message4, the application model generation part 300 specifies the server 40 as the transmitter, and specifies the terminal 35 as the receiver.

The application model generation part 300 decides at least one message part included in each message. Specifically, the application model generation part 300 decides part1-a, part1-b and part1-c as a message part included in message1. The application model generation part 300 decides part1-c and part2-a as a message part included in message2. In this case, the transmitter of message part part1-c is the terminal 35; the intermediary of message part part1-c is the server 40; the receiver of message part part1-c is the server 50. In this way, the application model generation part 300 may decide a different transmitter or receiver for each massage part even within the same message. In addition, the application model generation part 300 decides part3-a as a message part included in message3, and decides part4-a as a message part included in message4.

Alternatively, the application model generation part 300 may automatically generate an application model according to the interface setting information 20 provided for the server 40. For example, the application model generation part 300 may automatically generate a message part received by the server 40 according to the message format decided in the interface setting information 20. In this case, it is sufficient for the user to perform the message definition only for information processing apparatuses in which no interface setting information is decided.

The user selects security patterns from a tool box storing a plurality of security patterns on the GUI and arranges the selected security patterns corresponding to the message parts. Consequently, the security pattern selection part 330 can select a security pattern that is a model of security policy set up for the transmitter or receiver of a message part, corresponding to each message part. For example, the security pattern selection part 330 can select security pattern ET1 corresponding to message part part1-a, and can select security pattern SI1 corresponding to message part part1-c.

An example of a process of the information processing system 10 sequentially substituting a value for each undecided parameter of security pattern will now be explained.

FIG. 7 shows exemplary security patterns in an application example of the security policy generation device 30 according to the embodiment. The security pattern selection part 330 selects security patterns corresponding to each of a plurality of messages. For example, referring to the drawing, the security pattern selection part 330 selects security patterns AT1, NT1 and EI1 corresponding to message parts part1-a, part1-b and part1-c shown in FIG. 6, respectively. In the drawing, these selected security patterns are represented as a sequence of linked text data.

The security pattern AT1, a setting for the receiver of the message, includes the receiver of the message as an undecided parameter and indicates that only the reception of the message encrypted using a cipher that the receiver can decode is permitted. AT stands for Authentication. Security pattern AT1 includes ${TOKEN_TYPE_QNAME}, ${TOKEN_ISSUER_NAME}, ${SUBJECT_NAME} and ${MESSAGE_PARTS} as undecided parameters.

${TOKEN_TYPE_QNAME} indicates the type of cipher, and specifically indicates the kind, etc. of electronic certificate. ${TOKEN_ISSUER_NAME} indicates the identification information regarding the authentication server 60, etc. serving as the issuer of encryption key. ${SUBJECT_NAME} indicates a receiver who is permitted to decode the encryption key. ${MESSAGE_PARTS} indicates message parts to be encrypted. Specifically, the message parts indicating the password, etc. for certifying the validity of transmitter are substituted for ${MESSAGE_PARTS}.

Security pattern NT1, a setting for receiver, indicates that only the reception of messages to which the electronic signature of a transmitter is appended is permitted. Accordingly, the transmitter of a message cannot repudiate the fact of transmission of the message, and hence the name NT is employed which stands for Non-repudiation.

Security pattern NT1 includes ${TOKEN_TYPE_QNAME}, ${TOKEN_ISSUER_NAME} and ${MESSAGE_PARTS} as undecided parameters. ${TOKEN_TYPE_QNAME} indicates the type of cipher, and specifically indicates the kind, etc. of electronic certificate. ${TOKEN_ISSUER_NAME} indicates the identification information regarding the authentication server 60, etc. serving as the issuer of encryption key or electronic certificate. ${MESSAGE_PARTS} indicates message parts to which electronic signature is applied. Specifically, the order information of a transmitter ordering commodities, etc. from a receiver is substituted for ${MESSAGE_PARTS}.

Security pattern EI1, a setting for receiver, indicates that only the reception of messages which can not be decoded by an intermediary of the message and at the same time can be decoded by the receiver is permitted. Security pattern EI1 includes ${TOKEN_TYPE_QNAME}, ${TOKEN_ISSUER_NAME}, ${SUBJECT_NAME} and ${MESSAGE_PARTS} as undecided parameters.

${TOKEN_TYPE_QNAME} indicates the type of cipher, and specifically indicates the kind, etc. of electronic certificate. ${TOKEN_ISSUER_NAME} indicates the identification information regarding the authentication server 60, etc. serving as the issuer of encryption key. ${SUBJECT_NAME} indicates a receiver who is permitted to decode the encryption key. ${MESSAGE_PARTS} indicates message parts to be encrypted. Specifically, the ${message_parts} indicating the contents sent from a transmitter to a receiver without the knowledge of an intermediary are substituted for $ {MESSAGE_PARTS}.

FIG. 8 shows an exemplary security policy obtained by applying an application model. The security policy generation part 350 substitutes the identification information of the transmitter or receiver of each message for the undecided parameter of the security pattern selected corresponding to each message. The substituted parameters are underlined.

For example, in response that security pattern AT1 is selected corresponding to message part part1-a, the security policy generation part 350 substitutes the ID of the server 40 being the receiver of the message for variable $ {SUBJECT_NAME} being the undecided parameter regarding the receiver of the security pattern on the 13^th line. On the 34^th line, the security policy generation part 350 substitutes the ID of the server 50 for variable ${SUBJECT_NAME}.

In addition, the security policy generation part 350 substitutes the identification information of each message part for the undecided parameter of the security pattern selected corresponding to the message.

For example, on the 15^th line, the security policy generation part 350 substitutes //UsernameToken indicating the location, etc. of message part part1-a for variable ${MESSAGE_PARTS}.

On the 24^th line, the security policy generation part 350 substitutes //BookInfto indicating the location, etc. of message part part1-b for variable ${MESSAGE_PARTS}. On the 36^th line, the security policy generation part 350 substitutes //CardInfo being the identification information of message part part1-c for variable ${MESSAGE_PARTS}. The parameters such as //CardInfo are shown here as an example; information, etc. indicating the location of the message part (URI: Uniform Resource Indicator) may practically be substituted for the undecided parameters, or text data indicating the message part itself may be substituted.

Alternatively, in order to enable the security policy generation part 350 to properly select an undecided parameter to be substituted for, the security policy may further include parameter type indicating the definition of the information which is to be stored in the undecided parameter, corresponding to each undecided parameter. In this case, each message of application model may include parameter type indicating the definition of the information indicated by each parameter included in the message, the parameter type corresponding to each parameter. Accordingly, the security policy generation part 350 can quickly select an undecided parameter to be substituted for by not scanning text data being a model of security policy but determining the correspondence regarding the parameter type. When the application model has no parameter type corresponding to that of the security policy, the security policy generation part 350 may substitute the parameter type for the undecided parameter instead of performing the substitution process. This allows the definition of undecided parameters to be properly known by the user, thus making it easy to manually decide undecided parameters of security pattern.

As described above with reference to the drawing, the security policy generation part 350 can generate a security policy by replacing with predetermined parameters the variable parts of a model of security policy as represented as text data.

FIG. 9 shows an exemplary security policy obtained by applying a platform model. The security policy generation part 350 further substitute the encryption processing parameter or signature processing parameter for the information processing apparatus of security policy setting object for the undecided parameter of security pattern. For example, on the 8^th, 20^th and 29^th lines, the security policy generation part 350 substitutes parameter X509v3 indicating the standard specification of electronic certificate for variable ${TOKEN_TYPE_QNAME}. On the 9^th, 21^st and 30^th lines, the security policy generation part 350 substitutes parameter VeriSign indicating the encryption key, etc. generated by software from VeriSign, Inc. (a registered trademark) for variable ${TOKEN_ISSUER_NAME}.

As described above, with the security policy generation device 30 according to the embodiment, the undecided parameters of the selected security patterns can be sequentially decided according to the application model and platform model. This makes it possible to easily create an appropriate security policy.

FIG. 10 shows an operational flow of an exemplary process of the security policy generation device 30 creating a security policy. The security pattern storage part 310 stores a plurality of security patterns in advance according to an instruction of the administrator, etc. of the security policy generation device 30 (S1000). The platform model storage part 340 stores a platform model decided for each information processing apparatus in advance according to an instruction of the administrator, etc. of the security policy generation device 30 (S1010).

The application model generation part 300 generates for each of a plurality of messages that are communicated using a distributed application program, an application model having the transmitter, receiver, intermediary, etc. of the message decided, according to an instruction of the user (S1020).

The security policy generation device 30 repeats the following process for each of a plurality of messages included in the application model (S1030). Firstly the candidate selection part 320 selects an information processing apparatus of security policy setting object according to an instruction of the user (S1050).

Then, the candidate selection part 320 selects the candidates of security pattern settable in the information processing apparatus according to the determination of whether the information processing apparatus of security policy setting object is anyone of the transmitter, receiver or intermediary of the message part of security policy setting object (S1060).

The security pattern selection part 330 selects a security pattern that is a model of security policy to be set up for the transmitter or receiver of the message part, corresponding to the message part, according to an instruction of the user (S1070). For example, in the security pattern selection part 330, a security pattern maybe selected from among the candidates of security pattern selected by the candidate selection part 320, which are shown to the user, according to an instruction of the user.

The security policy generation part 350 generates a security policy by substituting the identification information regarding the transmitter or receiver of the message part for the undecided parameter of the security pattern selected corresponding to the message part (S1080). The security policy generation part 350 may further substitute the encryption processing parameter or signature processing parameter for the information processing apparatus of security policy setting object for the undecided parameter of the security pattern. The security policy generation device 30 repeats the above described process for each message part (S1090).

FIG. 11 shows the details of process S1060. The candidate selection part 320 selects as the pattern candidates all the security patterns stored in the security pattern storage part 310 (S1100). If the transmitter of the message part is the information processing apparatus of setting object (S1110: YES), then the candidate selection part 320 removes the security patterns for which the transmitter type of interaction pattern is not self from the pattern candidates (S1120), and then the flow proceeds to S1170.

If the transmitter of the message part is not the information processing apparatus of setting object (S1110: NO), then the candidate selection part 320 determines whether or not the receiver of the message part is the information processing apparatus of setting object (S1130). If so (S1130: YES), then the candidate selection part 320 removes the security patterns for which the receiver type of interaction pattern is not self from the pattern candidates (S1140).

Subsequently, if there exists an intermediary of the message part (S1170: YES), then the candidate selection part 320 removes the security patterns for which the intermediary type is none from the pattern candidates (S1180).

On the other hand, if the receiver of the message part is not the information processing apparatus of setting object (S1130: NO), then the candidate selection part 320 determines whether or not the intermediary of the message part is the information processing apparatus of setting object (S1150). If so (S1150: YES), then the candidate selection part 320 removes the security patterns for which the intermediary type of interaction pattern is not self from the pattern candidates (S1160).

In this way, the candidate selection part 320 can select a suitable security pattern according to the determination of whether the information processing apparatus of setting object is any one of the transmitter, receiver and intermediary of the message part. Accordingly, the number of security pattern options can be reduced; therefore the user can be relieved of the operational load taken to select the security pattern.

FIG. 12 shows an exemplary hardware configuration of a computer 500 working as the security policy generation device 30. The computer 500 includes: a CPU section having a CPU 1000, RAM 1020 and graphic controller 1075 connected to each other via a host controller 1082; an I/O section having a communication interface 1030 connected to the host controller 1082 via an I/O controller 1084, a hard disk drive 1040 and a CD-ROM drive 1060; and a legacy I/O section having a BIOS 1010 connected to the I/O controller 1084, a flexible disk drive 1050 and an I/O chip 1070.

The host controller 1082 connects the RAM 1020 to the CPU 1000 and graphic controller 1075 each accessing the RAM 1020 with high transfer rate. The CPU 1000 operates based on programs stored in the BIOS 1010 and RAM 1020, thus controlling each section. The graphic controller 1075 acquires the image data that the CPU 1000, etc. create on the frame buffer provided in the RAM 1020 and displays the image data on a display unit 1080. Alternatively, the graphic controller 1075 may include therein the frame buffer into which the image data created by CPU 1000, etc. is stored.

The I/O controller 1084 connects the host controller 1082 to the communication interface 1030, hard disk drive 1040 and CD-ROM drive 1060, each being a relatively high-speed I/O unit. The communication interface 1030 communicates with the outside apparatuses via a network. The hard disk drive 1040 stores the programs and data used by the computer 500. The CD-ROM drive 1060 reads programs or data from a CD-ROM 1095 and provides the programs or data for the I/O chip 1070 via the RAM 1020.

The BIOS 1010 and relatively low-speed I/O units, such as the flexible disk drive 1050 and I/O chip 1070 are also connected to the I/O controller 1084. The boot program executed by the CPU 1000 during the startup of the computer 500, the programs dependent on the hardware of the computer 500, and the like are stored in the BIOS 1010. The flexible disk drive 1050 reads programs or data from a flexible disk 1090 and provides the programs or data for the I/O chip 1070 via the RAM 1020.

The I/O chip 1070 serves to connect the flexible disk 1090 and various I/O devices via, for example, a parallel port, serial port, keyboard, mouse port, etc.

The program provided for the computer 500, stored in recording media such as the flexible disk 1090, CD-ROM 1095 or an IC card, etc, is provided by the user. The program is read out from the I/O chip 1070 and/or I/O controller and installed into the computer 500 for execution. The operation of the program executed in the security policy generation device 30 by use of the computer 500, etc. is identical with that of the security policy generation device 30 described with reference to FIGS. 1 to 11, and hence an explanation thereof is omitted.

As shown in the embodiment, the user can define the messages transmitted or received in a distributed application by intuitively operating GUI, etc. According to the defined messages, the security policy generation device 30 can decide the transmitter, receiver, intermediary, etc. of each message. Consequently, a suitable value is assigned to the undecided parameter of the security pattern that is a model of security policy, whereby the security policy is automatically created. Accordingly, the user can be relieved of the operational load taken to create the security policy, and at the same time a suitable security policy can be created.

The previous description is of an advantageous embodiment for implementing the invention, and the technical scope of the invention should not be restrictively interpreted by the description of the embodiment. Those skilled in the art will recognize that many changes or modifications to the embodiment described above are possible within the scope of the invention. It will be apparent from the description of the claims that an embodiment with such changes or modifications applied thereto can also be included in the technical scope of the invention.

The present invention can be realized in hardware, software, or a combination of hardware and software. A visualization tool according to the present invention can be realized in a centralized fashion in one computer system, or in a distributed fashion where different elements are spread across several interconnected computer systems. Any kind of computer system—or other apparatus adapted for carrying out the methods and/or functions described herein—is suitable. A typical combination of hardware and software could be a general purpose computer system with a computer program that, when being loaded and executed, controls the computer system such that it carries out the methods described herein. The present invention can also be embedded in a computer program product, which comprises all the features enabling the implementation of the methods described herein, and which—when loaded in a computer system—is able to carry out these methods.

Computer program means or computer program in the present context include any expression, in any language, code or notation, of a set of instructions intended to cause a system having an information processing capability to perform a particular function either directly or after conversion to another language, code or notation, and/or reproduction in a different material form.

Thus the invention includes an article of manufacture which comprises a computer usable medium having computer readable program code means embodied therein for causing a function described above. The computer readable program code means in the article of manufacture comprises computer readable program code means for causing a computer to effect the steps of a method of this invention. Similarly, the present invention may be implemented as a computer program product comprising a computer usable medium having computer readable program code means embodied therein for causing a function described above. The computer readable program code means in the computer program product comprising computer readable program code means for causing a computer to effect one or more functions of this invention. Furthermore, the present invention may be implemented as a program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform method steps for causing one or more functions of this invention.

It is noted that the foregoing has outlined some of the more pertinent objects and embodiments of the present invention. This invention may be used for many applications. Thus, although the description is made for particular arrangements and methods, the intent and concept of the invention is suitable and applicable to other arrangements and applications. It will be clear to those skilled in the art that modifications to the disclosed embodiments can be effected without departing from the spirit and scope of the invention. The described embodiments ought to be construed to be merely illustrative of some of the more prominent features and applications of the invention. Other beneficial results can be realized by applying the disclosed invention in a different manner or modifying the invention in ways known to those familiar with the art.

Claims

1-10. (canceled)

11. A security policy generation device for generating a security policy that decides at least one of an electronic signature to be appended to a message transmitted or received by an information processing apparatus and an encryption method for encrypting the message transmitted or received by the information processing apparatus, the security policy being set up for the information processing apparatus, said device comprising: an application model generation part for generating an application model having an information processing apparatus, which is a transmitter and a receiver of the message, decided, for each of a plurality of messages that are communicated using a distributed application program processed by cooperating a plurality of information processing apparatuses, according to an instruction of user;a security pattern storage part for storing a plurality of security patterns that are models of security policy with a signer of electronic signature appended to the message or a decoder for decoding the encrypted message as an undecided parameter;a security policy pattern selection part for selecting a security pattern that is a model of security policy to be set up for the information processing apparatus, which is the transmitter or receiver of the message, corresponding to each of the plurality of messages included in the application model, according to an instruction of the user; anda security policy generation part for generating a security policy by substituting the identification information of the information processing apparatus, which is the transmitter or receiver of each message included in the application model, for the undecided parameter of the security pattern selected corresponding to the message.

12. The security policy generation device according to claim 11, wherein the security pattern storage part stores the security pattern including a presence attribute indicating that an intermediary exists in a message, which is a setting object, or including a presence inhibition attribute indicating that an intermediary must not exist in the message, which is a setting object; andthe security policy generation device further comprises:a candidate selection part of selecting a candidate of the security pattern based upon whether or not an intermediary exists in the message, which is a setting object.

13. The security policy generation device according to claim 12, wherein the security pattern storage part stores a security pattern for transmitter, a security pattern for a receiver and a security pattern for an intermediary, which are models of a message transmitter, a receiver, and intermediary, respectively;the candidate selection part selects according to the determination of whether the information processing apparatus of security policy setting object is any one of a transmitter, a receiver and an intermediary of the message of security policy setting object, the candidates of security patterns settable in the information processing apparatus; andthe security pattern selection part selects a security pattern from among the candidates of security patterns selected by the candidate selection step, according to an instruction of the user.

14. The security policy generation device according to claim 11, wherein the security pattern storage part stores a setting, which is to a receiver of a message, and which indicates that a transmitter of a message is considered as undecided parameter and a reception of a message where an electronic signature of said transmitter is appended is permitted, as the security pattern; andthe security policy generation part substitutes identification information of a transmitter of a message corresponding to said security pattern for the undecided parameter about the transmitter of said security pattern, in response to the selection of said security pattern.

15. The security policy generation device according to claim 11, wherein the security pattern storage device stores a setting, which is to a receiver of a message, and which indicates that the receiver of the message is considered as undecided parameter and a reception of a message that is encrypted by a decodable encryption by the receiver, as the security pattern; andthe security policy generation part substitutes identification information of a receiver of a message corresponding to said security pattern for the undecided parameter about the receiver of said security pattern, in response to the selection of said security pattern.

16. The security policy generation device according to claim 11, wherein the message comprises a plurality of message parts;the application model generation part generates, for each message part, the application model having a transmitter and a receiver of the message part decided;the security pattern selection part selects a security pattern that is a model of security policy to be set up for the transmitter or the receiver of the message part, corresponding to each of the plurality of message parts, andthe security policy generation part generates a security policy by substituting the identification information of the transmitter or receiver of each message part for the undecided parameter of the security pattern selected corresponding to the message part.

17. The security policy generation device according to claim 11, further comprising a platform model storage part of storing in advance an encryption processing parameter used in a process of encryption or decoding by the information processing apparatus or a signature processing parameter used in a process of generating the electronic signature or in a process of authenticating the electronic signature by the information processing apparatus, each parameter being specified in advance for each information processing apparatus, wherein the security pattern storage part stores a security pattern that includes as an additional undecided parameter the encryption processing parameter used in the process of encryption or decoding or the signature processing parameter used in the process of generating the electronic signature to be appended to the message or in the process of authenticating the electronic signature; andthe security policy generation part further substitutes the encryption processing parameter or the signature processing parameter in the information processing apparatus of security policy setting object for the undecided parameter of the security pattern.

18. A program for enabling a computer to operate as a security policy generating device for generating a security policy that decides at least one of an electronic signature to be appended to a message transmitted or received by an information processing apparatus and an encryption method for encrypting the message transmitted or received by the information processing apparatus, the security policy being set up for the information processing apparatus, the program enabling the computer to operate as: an application model generation part for generating an application model having an information processing apparatus, which is a transmitter and a receiver of the message, decided, for each of a plurality of messages that are communicated using a distributed application program processed by cooperating a plurality of information processing apparatuses, according to an instruction of user;a security pattern storage part for storing a plurality of security patterns that are models of security policy with a signer of electronic signature appended to the message or a decoder for decoding the encrypted message as an undecided parameter;a security policy pattern selection part for selecting a security pattern that is a model of security policy to be set up for the information processing apparatus, which is the transmitter or receiver of the message, corresponding to each of the plurality of messages included in the application model, according to an instruction of the user; anda security policy generation part for generating a security policy by substituting the identification information of the information processing apparatus, which is the transmitter or receiver of each message included in the application model, for the undecided parameter of the security pattern selected corresponding to the message.

19. The program according to claim 18, wherein the security pattern storage part stores the security pattern including a presence attribute indicating that an intermediary exists in a message, which is a setting object, or including a presence inhibition attribute indicating that an intermediary must not exist in the message, which is a setting object; andthe program further enabling the computer to operate as:a candidate selection part of selecting a candidate of the security pattern based upon whether or not an intermediary exists in the message, which is a setting object.