JP2003271555A - Directory function device with access control, directory function method with access control, directory function program with access control, and storage medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To simplify the access control using recursive service by reducing the load of a manager and eliminating the contradiction of service providing. <P>SOLUTION: A client terminal 1 requests the use of a service or resource by use of a user's ID. Each service/resource of service/resource terminals 2-1 to 2-n transmits access control information (ACL) when registering its service content to a directory server 3. The directory server 3 solves the contradiction of a permitted user for dependent service according to the ACL transmitted from the service/resource of the service/resource terminals 2-1 to 2-n and then additionally registers the ACL in an integrated ACL. The directory server 3 accepts the service use request from the client terminal 1 and executes an access control in reference to the integrated ACL. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a directory function device with access control for providing various services on a network to a client terminal, a directory function method with access control, a directory function program with access control and a recording medium.

[0002]

2. Description of the Related Art Conventionally, an access control list (ACL) for services has been provided to a directory function for centralized management, and the directory function has performed access control. this is,
It is called the directory function with access control.

[0003]

However, the conventional directory function with access control has the following problems.

For example, in the case shown in FIG.

1) Since the service user is permitted to use the service A, the service user can use the service A.

2) Since the service A is a service that uses the service B, the service A uses the service B to provide the service. The fact that the service user is using the service A means that the service B is also available.

3) The service user should not be permitted to use the service B. Nevertheless,
By using the service A, the service B can also be used.

For example, in FIG. 6A, service A
When the user is a printer and the service B is a landscape camera, when the service user asks the service A to "print a landscape", he or she can see the landscape that the user should not be able to see through the printer. Will be possible.

Further, in the case as shown in FIG. 6 (b),

1) Since the service user is permitted to use the service A, the service user can use the service A.

2) The service user requests the service A to use the service B. Since service A is a service that cannot use service B, service A
Cannot provide the service requested by the service user.
3) The service user who requested the service should be able to use the service B. Nevertheless, through service A, service B cannot be used.

For example, in FIG. 6B, service A
When the user is a printer and the service B is a landscape camera, the service user requests the service A to print the landscape, and the landscape that the user should be able to see through the printer I can't see.

Further, in the case as shown in FIG.

1) The service user asks the directory function whether or not he has the right to use the service A (access control request).

2) If there is a right to use the service A, a service use permit is issued.

3) Service A asks the directory function if the service user has the right to use service B.

4) If the service user has the right to use the service B, a service use permit is issued.

Thus, the access source (access subject,
Every time the service user changes, an access control request is sent to the directory function. Even when it has a delegation function, it becomes as shown when using the recursive service. The delegation function is a function of successively delegating service usage authority to service usage destinations. Further, the recursive service use means a case where the service needs to use a plurality of other services in order to obtain one service result.

As described above, the conventional directory function with access control has the following problems.

1) If the administrator manages all service provision authorizations, the burden on the administrator increases.

2) When recursive service use occurs,
In some cases, the service is not provided even though the service provision is permitted, or conversely, the service is provided even when the service provision is not permitted.

3) Each time recursive service use occurs,
It is necessary to control access using the directory function. Originally, when a service that can be used by one access control is recursively used, the access control process must be performed many times.

The present invention has been made in view of the above-mentioned circumstances, and can reduce the administrator's burden in the directory function with access control for various services.
In addition, it is possible to eliminate inconsistencies in service provision, and
It is an object to provide a directory function device with access control, a directory function method with access control, a directory function program with access control, and a recording medium capable of simplifying access control for use of recursive service.

[0024]

In order to solve the above problems, according to the invention of claim 1, when a plurality of service providing terminals make a service available to a client terminal, Receiving means for receiving a plurality of access control lists for each service transmitted from the service providing terminal, and the dependency relation of each service are matched based on the plurality of access control lists received by the receiving means. And an integrated access control list creating means for creating the integrated access control list by integrating the plurality of access control lists.

According to the invention of claim 2, claim 1
In the directory function device with access control described,
It is characterized by further comprising access control means for controlling whether to issue the service use license to the client terminal based on the integrated access control list created by the integrated access control list creation means.

In order to solve the above problems,
In the invention according to claim 3, when a plurality of service providing terminals make a service available to the client terminal, the plurality of service providing terminals transmit the service.
Receiving a plurality of access control lists for each service, and integrating the plurality of access control lists based on the received plurality of access control lists so that the dependencies of the services match. And a step of creating an access control list in a computer.

According to the invention described in claim 4,
In the described directory function program with access control, the computer is caused to execute a step of controlling whether or not to issue a service license to the client terminal based on the integrated access control list.

According to the present invention, when the plurality of service providing terminals make the services available to the client terminals, the receiving means provides a plurality of access controls for each service transmitted from the plurality of service providing terminals. A list is received, and the integrated access control list creating means creates a unified access control list by integrating the plurality of access control lists based on the plurality of access control lists so that the dependencies of each service are matched. To do. Therefore, it becomes possible to reduce the burden on the administrator in the directory function with access control for various services, eliminate the contradiction of service provision, and simplify the access control of recursive service use. It becomes possible.

[0029]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings. A. Configuration of the embodiment

FIG. 1 is a block diagram showing the configuration of a network system according to an embodiment of the present invention. 1, a client terminal 1 is used by a service user (user), and requests the use of a service or resource by a user ID (Mr.A, etc.). For example, request "I want the printer to print the landscape".
At this time, sending authentication information such as a password is also included.

Service / Resource Terminals 2-1 to 2-n
Comprises a printer, a camera, etc., and is connected / disconnected to the network 4 by plug & play. Services / Resources The services / resources of the terminals 2-1 to 2-n transmit access control information (ACL) defined by the services or resources when registering the service content in the directory server 3. The ACL of the service is sent to the directory function and automatically registered in the integrated ACL.

The directory server 3 manages a list of services and resources (directory function). The list includes access control information (ACL) in addition to information such as contents and whereabouts of services and resources.

Further, the directory server 3 receives a service use request from the client terminal 1 by the directory function and executes access control according to the following procedure.

By referring to the integrated ACL, it is searched whether the service name and the action are permitted to be executed by the requester. If a dependent service exists during the search, the access control of the dependent service is recursively performed.

Further, the directory server 3 additionally registers the ACL transmitted from the services / resources of the service / resource terminals 2-1 to 2-n in the integrated ACL by the directory function according to the following procedure.

If there is a dependent service in the ACL sent from the service, the authorized user of the dependent service destination is recursively checked and the ACL sent from the service
Check if the service is really acceptable as described in. If there is a contradiction in the authorized user of the dependent service, resolve the contradiction and then register the service.

B. Operation of the embodiment

Next, the operation of this embodiment will be described in detail.

B-1. Overall operation

First, the general operation when creating an integrated ACL will be described. Here, FIG. 2 is a data flow diagram for explaining the general operation of the present embodiment.
The ACLs of the service A and the service B are automatically reflected in the access control information (integrated ACL) of the directory function of the directory server 3 when the respective services are plugged and played, in the procedure as in the following example. (The following procedure is for the ACL of service A and the AC of service B
L, the integrated ACL will be described as an example).

Sa1) When the service A is plugged and played, it sends the ACL of the service A to the directory function of the directory server 3.

Sa2) Similarly, the service B is a plug &
When played, the ACL of the service B is transmitted to the directory function of the directory server 3.

Sa3) In the directory function of the directory server 3, the ACL receiving unit 30 receives the ACLs from the services A and B and supplies them to the ACL analyzing unit 31.

Sa4) In the directory function, the ACL analysis unit 31 causes the ACL of the service A and the A of the service B to be A.
The CL is analyzed, and a predetermined merge method is selected to create (or update) the integrated ACL so that no contradiction occurs.
The details of creating the integrated ACL will be described later.

Next, the services are used in the following order.

Sb1) Mr. A (service user) requests the service usage right requesting unit 10 to use the action a1 of the service A.

Sb2) Mr. A's request is sent to the directory function of the directory server 3,

Sb3) The directory function of the directory server 3 receives the request of Mr. A by the service request receiving unit 33, refers to the integrated ACL by the access control unit (ACL analyzing unit) 34, and A (a1) is Mr. A. Is available,

Sb4) If the service is available, the service usage certificate issuing unit 35 issues the usage certificate of A (a1). At the same time, the usage permit of B (b1) of the recursive service usage destination is also issued.

Sb5) Mr. A uses the action a1 of the service A (hereinafter referred to as A (a1)),
The service usage request unit 11 is presented with the received two usage permits.

Sb6) A (a1) is analyzed by the requested service analysis unit 21, and then the service use request unit 22 requests the use of B (b1) with the use permit of B (b1).

In Sb7) B (b1), the service is provided after being analyzed by the requested service analysis unit 21.

Sb8) A (a1) has obtained the service of B (b1), and provides Mr. A with the service of A (a1).

B-2. Creation of integrated ACL

Next, the operation of creating the integrated ACL, which is performed prior to the use of the above-described service or when the new service is plugged and played, will be described. Here, FIG. 3 is a conceptual diagram showing the access control information (ACL) of each of the service A and the service B.

Sc1) When the service A and the service B are activated, the ACL of the service A and the service B are automatically transmitted to the directory function of the directory server 3 by plug & play.

Sc2) The directory function of the directory server 3 merges the received ACLs of the service A and the service B, respectively. Then, the merged result is an integrated ACL that the directory function has. At this time, if the ACL of the service A and the ACL of the service B are simply added, a contradiction is found. Therefore, the merging method is the method (merge patterns MP1 to MP) described below.
You will have to select one of 3). The selection can be made by the administrator of the directory function.

Sc3) Merge pattern MP1:

According to the ACL of service A shown in FIG. 3A, action a2 of service A (hereinafter, A (a2)
Is used by Mr. A. A (a
2) requires B (b2) and B (b3).
Therefore, when the ACL of the service B shown in FIG. 3B is checked, B (b2) is permitted to be used by Mr.
Mr. A is not permitted to use (b3). Therefore, finally, since A (a2) cannot be used by Mr. A, what deletes Mr. A from the authorized users of A (a2) results in the integrated ACL (→ This approach is adopted in the four integrated ACL examples). In addition, leave Mr. A as the authorized user of A (a2), and B
An integrated ACL for adding Mr. A to the authorized user in (b3) is also conceivable. Which integrated ACL will be determined by the policy of the directory administrator. The details of the policy will be described later.

Sc4) Merge pattern MP2:

As shown in FIG. 3A, A (a2) is
B (b2) and B (b3) are required, and B (b
2) and B (b3) are permitted to be used by Mr. B, as shown in FIG. 3 (b). It is considered that Mr. B who can use B (b2) and B (b3) can also use A (a2), but there is no description in the ACL of service A. In the final merge ACL, Mr. B can be added to the authorized user of the service A (→ this method is adopted in the integrated ACL example according to this embodiment), or Mr. B can be omitted. . Which integrated ACL will be determined by the policy of the directory administrator.

Sc5) Merge pattern MP3:

As shown in FIG. 3A, A (a3) is
B (b4) is required, and B (b4) is shown in FIG.
As shown in (b), A (a3) is required. There is a looped dependency, but the authorized users are different for each service. If there are dependencies of services that are looping like this and the authorized users are different,

A. Is it a conflicting ACL?

B. If they depend on each other, is it better to combine them into one service? When putting together, who should be included in the authorized users (addition and deletion of users)
?

C. If a dependency loop occurs, is the dependency check ended at the point where the loop occurs? (→
This method is adopted in the integrated ACL example according to this embodiment.)

And the final integrated AC
Create L.

Here, FIG. 4 is a conceptual diagram showing an integrated ACL in which the service A and the service B are integrated. In the figure, data (dependency relationship) is registered in advance in the "dependent service". Alternatively, when a new service such as “C service” is registered, if it is a general action of the service, it is automatically registered. For example, if the service is "printer" and the actions are "print out text" and "print out scanner data", the service is automatically registered. In other words, when the service "printer" is added to the integrated ACL, its general actions "print out text" and "print out data from scanner" are automatically added. More generally, when a service object is added, the function of its superset (the function of the superclass inherited by the service object) is also added. In addition, the "authorized user" of the automatically added action
Is blank in the initial stage, that is, before the integration, and for example, when the permission is given to Mr. B according to the policy of the directory function administrator after the execution of the merge pattern MP2, “Mr. It is registered as an authorized user.

B-3. Advantages of this method

A) As described above, the method of reflecting the ACL on the directory function is a person (directory function administrator).
It may also include selection work by. Final ACL
The important decision point before completing is that people can select and confirm.

B) Also, the above-mentioned merge pattern MP1
It is possible to discover a new access control pattern or an inconsistency of access control patterns that has not been found in the ACL for each service like MP2 or MP2.

C) Furthermore, the above-mentioned merge pattern MP
As in No. 3, looped access patterns can be automatically discovered and modified or interpreted.

Here, a policy for creating an integrated ACL in the above-described embodiment will be described. FIG. 5 is a conceptual diagram for explaining a policy when creating an integrated ACL. When the ACL of each service is merged inside the computer to create an integrated ACL, the integrated ACL is created by referring to the policy table shown in FIG. For example, since "transfer" is excluded from the merging policy of the manager group, even if a person (access subject) who belongs to the manager group acquires a person who has an action of "transfer", "transfer" You can create an access control list that you can not take only the actions that you want.

According to the above-described embodiment, when the directory function is first requested to issue a service use permit, what other services are necessary for the directory function to use the requested service? I understand. Therefore, it becomes clear whether the recursive service can be used only by the first access control request to the directory function (in the first place, the integrated ACL is an ACL that takes recursive service usage into consideration). As a result, the directory function can issue a service usage permit including a usage right for the recursive service. It will be possible to issue a permit for all related services at one time.

When the service is dynamically registered in the directory service (plug & play), the ACL is also dynamically registered. The work that has been manually registered until now can be saved.

The ACL transmitted from the service
Describes a dependency relationship for recursive service use, the directory function may create an integrated ACL while searching for the dependency relationship. The integrated ACL facilitates the discovery of complex access control conflicts and ambiguities (such as dependency loops) that have dependencies between services.

Further, since the directory function can perform access control including recursive service use with only one access control, the service user performs access control every time recursive service use occurs. You don't have to ask for a feature. Even if there is a recursive service use, the directory function can overlook the recursive service use destination, so that it can be determined once whether or not the requested service can be finally used.

[0078]

As described above, according to the present invention,
When a plurality of service providing terminals make a service available to a client terminal, the receiving means receives a plurality of access control lists for each service transmitted from the plurality of service providing terminals, and performs integrated access. The control list creating means integrates the plurality of access control lists and creates an integrated access control list based on the plurality of access control lists so that the dependency relationships of each service are matched. It is possible to reduce the burden on the user, eliminate the contradiction of service provision including the right to use the recursive service, and simplify the access control for using the recursive service. Is obtained.

[Brief description of drawings]

FIG. 1 is a block diagram showing a configuration of a network system according to an embodiment of the present invention.

FIG. 2 is a data flow diagram for explaining a schematic operation of the entire embodiment.

FIG. 3 is a conceptual diagram showing access control information (ACL) of each of service A and service B.

FIG. 4 is a conceptual diagram showing an integrated ACL in which the service A and the service B are integrated.

FIG. 5 is a conceptual diagram for explaining a policy when creating an integrated ACL.

FIG. 6 is a conceptual diagram for explaining an operation by a directory function according to a conventional technique.

FIG. 7 is a conceptual diagram for explaining an operation by a directory function according to a conventional technique.

[Explanation of symbols]

1 Client Terminals 2-1 to 2-n Service / Resource Terminal 3 Directory Server 4 Network 10 Service Usage Right Request Unit 11 Service Usage Request Unit 21 Request Service Analysis Unit 22 Service Usage Request Unit 30 ACL Receiving Unit (Receiving Means) 31 ACL Analysis Unit (Integrated Access Control List Creating Means) 32 Integrated ACL (Integrated Access Control List) 33 Service Request Accepting Unit 34 Access Control Unit (Access Control Means) 35 Service Usage License Issuing Unit

Claims (4)

[Claims] 1. Receiving means for receiving a plurality of access control lists for each service transmitted from a plurality of service providing terminals when the plurality of service providing terminals make a service available to a client terminal. And an integrated access control for integrating the plurality of access control lists and creating an integrated access control list based on the plurality of access control lists received by the receiving unit so that the dependencies of each service are matched. A directory function device with access control, comprising: list creating means. 2. Based on the integrated access control list created by the integrated access control list creating means,
2. The directory function device with access control according to claim 1, further comprising access control means for controlling whether to issue a service use permit to the client terminal. 3. When a plurality of service providing terminals make a service available to a client terminal, receiving a plurality of access control lists for each service transmitted from the plurality of service providing terminals. A step of integrating the plurality of access control lists and creating an integrated access control list based on the received plurality of access control lists so that the dependencies of each service are matched. A directory function program with access control characterized in that 4. The directory function program with access control according to claim 3, wherein the computer is caused to execute a step of controlling whether to issue a service use license to the client terminal based on the integrated access control list. .