JP2011209996A - Access control method and access control device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To appropriately control access to a gray zone to which whether to permit access is not explicitly designated.SOLUTION: An access request detection part 21 detects an access request. An access permission/inhibition determination part 3 calculates a similarity between a base point URL and a reference destination URL, and permits access when the similarity is within a similarity range in a determination policy information storage part 11, and also permits access as a hop when the similarity is outside the similarity range and within a hopping range in the determination policy information storage part 11 but rejects access when the similarity being outside the hopping range. When permitting a hop to the reference destination URL, the access permission/inhibition determination part 3 adds "1" to the number of hops and sets the reference destination URL as a base point URL to hold the base point URL. In the next access permission/inhibition determination, the access permission/inhibition determination part 3 determines whether similarity of a reference destination, which is calculated on the basis of the set base point URL, is within the similarity range or the hopping range so as to determine access permission/inhibition.

Description

  The present invention relates to an access control technique for accessing information on a network. More specifically, the present invention relates to an access control method and an access control apparatus for controlling access to a reference destination in a range where access is not explicitly permitted or denied.

  While browsing a Web page provided on the Internet, when reading a plurality of documents linked by a link, an operation to access the next page is performed while following the link provided in the page. A process for determining whether access is possible and controlling access is performed.

  There are a black list method and a white list method as access control methods for determining whether or not a user requests access. The black list method prepares a list (black list) that explicitly enumerates reference destinations that are prohibited from access, and permits access to any reference destination that is not listed in the list. The white list method prepares a list (white list) that explicitly enumerates reference destinations to which access is permitted, and permits access only to the reference destinations enumerated in the list.

  The blacklist method has a problem that the risk due to omission of listing in the blacklist is high, and the whitelist method has a problem that it is difficult to keep the whitelist up-to-date.

  In recent years, methods for restricting access to reference destinations other than the white list and black list that explicitly list access permission / prohibition reference destinations have been studied.

  For example, the first conventional method is a method based on content determination. In addition to the white list and the black list, useful words and prohibited words that can be included in the content are defined, and useful in the reference destination content. Access to the reference destination is determined based on the presence or absence of a word or prohibited word.

  The second conventional method is a method based on the link reference relationship. By searching the link reference relationship collected in advance, the pages for which access is determined are listed in the white list. Rating is performed based on the total number of paths and path distances from the reference destination, and access is determined based on the magnitude relationship between the rating result and the threshold.

  The third conventional method determines whether or not access is possible by determining the importance of each page and each link based on the URL similarity in order to distinguish between a link in the same site and a link from another site. To do. Here, the URL similarity is obtained by quantifying the similarity between two URLs based on the structure of the server name and file path constituting the URL. If the two pages belong to different sites, it is determined that the URL similarity is low, and those with many links from pages with a low URL similarity are determined as important pages.

JP 2001-282797 A JP 2003-248696 A JP 2001-290843 A

  The conventional method of access control has a problem that it is difficult to set and maintain parameters that determine whether access is possible. For example, as in the case of the first conventional method, when a term that is optimal as a useful word or prohibited word is defined and used as a judgment condition, it is difficult to set a useful word or prohibited word, even if the site is not accessible. , If the content contains useful words, the problem arises that access to the page is permitted.

  In addition, as in the second or third conventional method, when an access permission determination condition is the number of paths, a path distance, a similarity between a link source and a link destination, or the like, an optimum threshold value is determined. However, depending on the threshold setting, there is a problem that what is desired to be permitted is prohibited, or conversely, what is desired to be prohibited is permitted. For example, as in the case of the second conventional method, when the number of paths and the path distance are used as judgment conditions, a news site that provides content that constitutes a page using a large number of links, While reading a finely divided article by following a link such as “to page”, a situation occurs in which access is prohibited even while reading a similar page.

  The present invention has been made in view of the above problems, and an object of the present invention is to provide an access control method for efficiently and appropriately performing access control for access to a reference destination to which access is not explicitly permitted or prohibited. Another object of the present invention is to provide an access control apparatus that executes the above access control method.

  An access control method disclosed as an embodiment of the present invention includes: 1) an access request detection processing step for detecting an access request to information existing on a network issued by a client; and 2) an access to information on the network. When the request is received, the information of the reference destination requested for access by the client based on the gray zone specifying information for specifying whether or not the information is in an area where access is explicitly permitted or denied Is not explicitly permitted or prohibited, based on the similarity calculation rule for calculating the similarity between the identifiers of the two information stored in the determination policy information storage unit. A similarity calculation processing step for calculating the similarity between the identifier of the information and the identifier of the information serving as a predetermined base point, and 3) the determination point A similarity range indicating a similarity range in which identifiers of two information are regarded as similar, and a hop possible range indicating a limit of similarity between identifiers of information permitted to be accessed, stored in the information storage unit When the similarity calculated based on the identifier of the reference destination information is determined based on the access permission determination rule to be defined is within the similar range, and the similarity is within the similar range A similarity range determination processing step for determining permission to access the reference destination information; and 4) when the similarity is not within the similar range, based on the access permission determination rule, the reference destination It is determined whether the similarity calculated from the identifier of the information and the identifier of the information serving as the base point is within the hoppable range, and when the similarity is within the hoppable range, the reference destination information Hop possible range determination processing step for deciding whether to allow access to a request to be permitted and determining permission of the access request, and refusing access request to the reference destination information when the similarity is not within the hop possible range And 5) an access permission determination notification processing step of notifying the client of an access permission or access rejection determination result according to the access request.

  According to the access control method described above, when accessing a different page by following a link in the page, the reference destination is the gray zone (that is, an access permission or access prohibition explicitly specified by the administrator). If the information is within the range of (), it is not dependent on the number of times the link is traced, and the access is appropriately made by paying attention to the similarity between the identifier of the currently referenced information and the identifier of the information to be referenced. Can be controlled.

  In other words, even if the information being referred to is content in which a series of information is composed of multiple pages or multiple folders, the identifier of the page referenced by following the link is already permitted and referenced. When the degree of similarity is high, it is determined that the identifier is similar, and control is performed so that a series of pages can be referred to the last page. On the other hand, for other information linked within the page, access is permitted within the predetermined hop limit range based on the similarity to the identifier of the information being referenced, and within the page exceeding the hop limit range. The banner advertisement is controlled to deny access.

  Therefore, since it is not necessary to collect in advance the link reference relationship that is a determination condition for determining whether access can be requested, it is possible to greatly reduce the equipment and cost required for preparation.

  Furthermore, it is possible to more appropriately determine whether or not the latest information can be accessed.

  Also, the access permission determination can be set to an arbitrary strength by setting the access permission determination rules such as the similar range and the hop possible range, and the access can be appropriately controlled.

It is a figure for outlining the access control method disclosed as one embodiment of this invention. It is a figure which shows the structural example of the access control apparatus disclosed as one embodiment of this invention. It is a figure which shows the example of the similarity calculation rule in one embodiment of this invention. It is a figure for demonstrating the similarity calculation of base URL and reference destination URL. It is a figure which shows the example of the access permission determination rule in one embodiment of this invention. It is a figure which shows the example of the domain information in one embodiment of this invention. It is a figure which shows the example of the determination result information in one embodiment of this invention. It is a figure which shows the process of the access control system in one embodiment of this invention. It is a figure which shows the example of the access permission determination request in one embodiment of this invention. It is a figure which shows the example of the access permission determination response in one embodiment of this invention. It is a figure which shows the example of the operation | movement outline | summary of the access control by an access permission determination rule. It is a processing flow figure of an access request detection part. It is a processing flow figure of an access permission judgment part. It is a processing flow figure of an access permission judgment part. It is a processing flowchart of the recording process of determination result information. It is a processing flowchart of the calculation process of the similarity level of the path name part of the reference destination URL in the accessibility determination process. It is a processing flow figure of processing of "confirmation of Lb" of Steps S58 and S513. It is a figure which shows the example of the determination result information in one embodiment of this invention. It is a figure which shows the example of the similar range of a accessibility determination rule, and the candidate of a hop possible range. It is a figure which shows the hardware structural example of the access control apparatus in one embodiment of this invention.

  Hereinafter, an access control method and apparatus disclosed as embodiments of the present invention will be described. In this embodiment, URL (Uniform Resource Locator), which is an identifier of a Web page, is specified as information indicating an identifier of a reference destination of an access request to be determined, taking access control to information existing on the network as an example. It shall be. In the following description, the similarity of a URL, which is an identifier of information existing on a network, may be simply abbreviated as “page similarity” or “similarity”.

[Outline of access control method]
The access control method disclosed as an embodiment of the present invention will be outlined.

  In the disclosed access control method, when a URL other than the URL for which access is explicitly permitted is a reference destination, whether or not the reference destination URL is accessible is determined based on the similarity of the identifier (URL) of the information. 1) Whether or not it can be regarded as a similar Web page (URL) that has already been authorized, and 2) If it cannot be regarded as a similar, it is determined according to how much the similarity between the two is different.

In the access control method, if the reference URL is within the similar range R _i indicating the range that can be regarded as similar based on the similarity to the URL of the already permitted page, access is permitted. In addition, when the reference destination URL exceeds the similar range R _i , if the access is a URL within the hop possible range L _i indicating the limit range where hopping is possible, the number of hops is permitted after allowing access as a hop. Are added to determine the similar range (R _{i + 1} ) and hop possible range (L _{i + 1} ) to be used in the next determination process. Reference destination URL, will prevent access when a URL exceeds the hop range _{L i.}

  The disclosed access control method realizes access control by performing such recursive determination processing.

  FIG. 1 is a diagram for outlining the processing of an access control method disclosed as an embodiment of the present invention. Numbers 01, 10 to 19, 1a to 1c, 20 to 28, 30 and the like in circles shown in FIG. 1 represent Web page URLs.

  It is assumed that a control device that executes the disclosed access control method (hereinafter referred to as an access control device) stores determination policy information including a similarity calculation rule, an access permission determination rule, and the like. In addition, as a similar range R0 in the case of the initial value (the number of hops = 0), a predetermined white list is set, and an access permission determination rule indicating a range where the hop possible range is L0 (related domain) is held. Assume that Also, the initial value of the base point URL described later is a reference source URL in the white list, and the initial value of the hop count is 0.

  The user is referring to the page (01) existing in the white list. As long as the user refers to a page in the white list, an access request is always permitted based on the white list in the similarity range R0, the hop count is set to the initial value (0), and the base page is set to the reference page. The

  When the user tries to access by following the link from the page (01) to the page (10) of the related domain, an access request for the reference destination URL (page (10)) is issued from the client.

  In the above access control device, this access request is detected, and the reference URL (10) is a page (10) outside the range of the similar object range R0 (white list). 10) and the URL of the reference source page (01) referred to at the time of the access request are specified and set as the base point page. Based on the similarity calculation rule, the URL of the reference destination page (10) and the base point page ( 01) The similarity with the URL is calculated.

  Next, in the access control device, if the similarity between the URL of the base page (01) and the URL of the reference page (10) is within the hop possible range, the access request is determined to be permitted, and the number of hops is determined. 1 is added to and the base page is updated to page (10). Thereby, in the next determination process, the similar range R1 and the hop possible range L1 corresponding to the number of hops = 1 are used.

  In this way, the user can refer to the related domain page (10) after the access request is processed.

  After that, the user tries to refer to the continuous page (11) by following the link from the page (10) being referred to.

  When the access control device detects an access request with the page (11) as a reference destination, the URL of the reference destination page (11) is specified from the access request, and the similarity to the URL of the base page (10) is calculated. The reference page (11) is the next page of the reference page (10), and the similarity between the URL of the reference page (10) and the URL of the reference page (11) is quite high.

  When the access control device determines that the similarity of the reference page (11) is the similar object range R1, the access control device determines that the access request to the reference page (11) is permitted, and the number of hops and the base page remain unchanged. Hold.

  Assuming that the similarities of the pages (11) to (1c) with respect to the base page (10) are also within the similar object range R1, the access control device 1 determines that the access request whose reference destination is the pages (11) to (1c) is Judged as permitted.

  Thereby, the user can refer to the related page by following the link from the page (10).

  Thereafter, it is assumed that the user follows a link from the page (10) being referred to and refers to a page (20) of another domain.

  When the access control apparatus detects an access request with the page (20) as a reference destination from the same client, the access control apparatus similarly specifies the URL of the reference destination page (20) and determines the similarity to the URL of the base page (10). calculate. Here, when the similarity of the reference page (20) does not correspond to the similar object range R1, the access control device 1 further determines whether or not the hop possible range L1.

  If the reference destination page (20) is the hop possible range L1, it is determined that the access request is permitted, 1 is added to the number of hops, and the base page is updated to the page (20).

  Thereby, in the next determination process, the similar range R2 and the hop possible range L2 corresponding to the number of hops = 2 are used. Usually, the similar range R2 and the hop possible range L2 are set so as to be narrower than the similar range R1 and the hop possible range L1, that is, the corresponding similarity is higher, but not limited thereto.

  Alternatively, when the user follows the link from the page (10) being referred to and tries to refer to the page (30) of another domain, the access control device similarly accesses the reference page (30) from the access request. Specifically, the similarity to the base page (10) is calculated. Here, when the similarity of the reference page (30) does not correspond to the similar range R1 and the hop possible range L1, the access request is determined to be denied.

  When a page in the white list is referenced from a page in the gray zone, the access control device resets the hop count to 0 and sets the base page as the reference page.

  As described above, assuming that the pages (21) to (28) are a series of pages of the page (20) and each similarity with respect to the base page (20) is also within the similarity range R2, the access control apparatus 1 Access requests whose reference destinations are pages (21) to (28) are determined to be permitted.

  Thereby, the user traces the link from the pages (11) to (1c) that can be regarded as similar to the page (10), refers to the page (20), and further traces the link to the related pages (21) to (21). Reference can be made to (28). On the other hand, the user is prohibited from referring to the page (30) by following the links from the pages (11) to (1c).

  Access is permitted from the page being referred to by setting the similarity range R or the hop possible range L to be limited to the range of pages with higher similarity according to the number of hops in the access permission determination rule. It is possible to control access so that the range of pages to be narrowed gradually. In other words, the range of pages that are allowed in the next access request as the reference page becomes less similar to the reference page by the user following the link from the reference page at the time of the first access request. Access control is realized.

[Configuration example of access control device]
FIG. 2 is a diagram illustrating a configuration example of an access control device disclosed as an embodiment of the present invention.

  The access control device 1 is a device that accepts an access request from the terminal 2 and controls whether to access information existing on the network included in the accepted access request from the terminal 2.

  The terminal 2 is a device for requesting access to information existing on the network by the user using the Web browser unit 20 or the like.

  The terminal 2 includes a web browser unit 20 and an access request detection unit 21.

  The web browser unit 20 issues an access request for information existing on the network that the user is trying to access based on an operation from the user. Further, the Web browser unit 20 controls access to information on the presence of the network or suppression of access according to the determination result information included in the access permission determination response received from the access request detection unit 21.

  When the access request detection unit 21 detects an access request issued by the Web browser unit 20, the access request detection unit 21 sends an access permission determination request for inquiring whether the access control device 1 can access information included in the access request to the access control device 1. To the accessibility determination unit 3. More specifically, the access request detection unit 21 generates an access permission determination request including a reference destination URL, a reference source URL, and previous determination information for the detected access request, and the access permission determination unit of the access control apparatus 1 3 to send.

  In addition, the access request detection unit 21 transmits the determination result information included in the access permission determination response received from the access permission determination unit 3 to the Web browser unit 20 and the determination result information included in the received access permission determination response. Hold.

  The access control device 1 includes a determination policy information storage unit 11, an access permission determination unit 3, a determination result recording unit 5, and a determination result storage unit 12.

  The determination policy information storage unit 11 stores information necessary for the access permission determination unit 3 to determine access permission. Information to be stored includes gray zone identification information, similarity calculation rules, access permission determination rules, and domain information. Details of these pieces of information will be described later.

  The access permission determination unit 3 receives an access permission determination request from the access request detection unit 21, determines access permission based on information acquired from the determination policy information storage unit 11 and the determination result storage unit 12, and the determination result To the access request detection unit 21, and further, the determination result is recorded in the determination result storage unit 12 via the determination result recording unit 5.

  The determination result recording unit 5 stores determination result information indicating the determination result of the accessibility determination unit 3 in the determination result storage unit 12. In addition, when there are a plurality of determination processes for the reference URL, the determination result recording unit 5 adopts the determination result with the smallest number of hops and updates the determination result information.

  The determination result storage unit 12 records the determination result of the access permission determination unit 3. Details will be described later.

[Contents of judgment policy information]
First, the contents of information stored in the determination policy information storage unit 11 will be described.

[Gray zone specific information]
The gray zone specifying information is information for specifying an area for which access permission is not explicitly specified. The gray zone is defined as, for example, a complementary set of URL groups for which access is explicitly specified. One specific example of the gray zone specifying information is a white list in which URLs that are allowed to be accessed by the user are registered. In this case, the URL other than the URLs listed in the white list is a gray zone. Another example of the specific example of the gray zone specifying information is a black list in which a reference destination that always rejects an access request is registered. In this case, URLs other than those listed in the black list are gray zones. Moreover, both a white list and a black list may be used as gray zone specifying information. In this case, the gray zone is other than the URLs listed in the white list and black list.

[Similarity calculation rules]
The similarity calculation rule defines a method for calculating a similarity from a difference between two information identifiers.

  In this embodiment, the URL similarity is used as the similarity. Although the URL similarity is described in detail later, it is quantified so that two URLs are high when they are in the same site and low when they are not in the same site. A URL similarity calculation rule that determines the similarity between two URLs based on the difference between the two URLs, and is realized by information defining the rule or a calculation formula representing the rule.

  FIG. 3 is a diagram illustrating an example of the similarity calculation rule.

  The similarity calculation rule table shown in FIG. 3 is a table showing an example in which the URL similarity calculation rule for the reference URL of the reference URL to be determined and the similarity are classified into arbitrary levels.

  In the table of FIG. 3, the similarity decreases in the order from level 0 to level 15. Level 0 is the highest similarity, and is the case where the server name part and the path name part of the reference destination URL are the same as the base URL.

  Of the descriptions indicating the contents of the similarity calculation rule table definition, “Slightly different” is the file name, folder name, and host name, and the structure of the character string is the same. This represents the case where the half-width characters, the end of the character string, etc. are different. “Different” indicates a file name, folder name, or host name that is different from the above.

  Among the similarity calculation rules in FIG. 3, levels 0 to 13 are rules relating to the calculation of the similarity within the same domain name, and levels 14 to 15 are rules relating to the calculation of the similarity between different domain names. is there.

  In the similarity calculation rule, the granularity and content of the similarity classification can be freely set, and the complexity of the similarity determination level can be adjusted by an arbitrary number of layers.

  For example, by setting the level of similarity divided into levels 1 and 2, it is possible to determine whether or not access is possible by distinguishing whether or not the files constitute the same article in the case of content in which the articles are composed of a plurality of Web pages. It becomes like this.

  In addition, by setting the level of similarity divided into levels 3 to 12, taking into account the placement method and customs of folders and files based on the volume, issue, and article number of online magazines, partial small differences and large differences It becomes possible to distinguish and distinguish.

  Further, by setting the level of similarity divided into levels 14 and 15, the determination can be made in consideration of the relationship between the base URL and the domain of the determination target URL. For sites that provide information using domain names specific to product brands, etc., it is possible to distinguish between information provided in the company's brand name domain and information provided by other organizations It becomes like this.

  The example of the similarity calculation rule shown in FIG. 3 is an example, and is not limited to this. For example, a mirror server of a specific server has the same content even if the server name part of the URL is different. Therefore, even if the server name part is different, a URL having a high path name identity has a high similarity. A similarity calculation rule may be set for.

  When a calculation formula is used as the URL similarity calculation rule, for example, the URL similarity level is obtained by a calculation formula for calculating the sum of the server name portion similarity level Ls and the path name portion similarity level Lp. It may be derived from the similarity.

  As shown in FIG. 4, the partial character strings divided in units of slashes or periods are compared for the character strings of the base URL and the reference URL to be determined.

  In the server name part of the URL, partial character strings are compared in the upward direction from the host name, and in the path name part, the lowest folder of the base URL is set as the current folder, and the current folder corresponds to the upper and lower directions. Partial character strings are compared with each other.

  It is assumed that the similarity level Lp = La + Lb of each part of the path. Here, when there is a difference in the path name part, La is a weight to be added according to the hierarchy position from the current folder for the part with the difference. Lb is set to Lb = 0 when the partial character strings to be compared are the same, Lb = 1 when slightly different, and Lb = 2 when different.

  Further, the similarity level Ls of the server name part is set to Ls = Lc + Lb, and Lc is a weight added according to the number of layers from the host name for the part similar to La, and is equal to or greater than the maximum value of Lp. Like that. When Lb is slightly different, 1 is added when it is different.

[Access rule]
The access permission determination rule is information defined by a combination of the number of hops, the similar range R, and the hop range L as illustrated in FIG. Here, the hop is to perform access within the hop possible range L exceeding the similar range R, and the hop count indicates the number of hops beyond the similar range R. The similar object range R is information indicating the range of similarity of the reference destination URL that can be regarded as similar to the base URL. The hop possible range L is information indicating the range of the similarity of the reference destination URL that can be allowed to be accessed when the similarity of the reference destination URL does not fall within the similar object range R.

Here, the combination {R _i , L _i } of the similar range R _i and the hop possible range L _i corresponding to the hop number i (i = 1 to n) is defined as a number sequence including a number sequence or a calculation formula as an element. It only has to be. For example, a finite group may be defined in advance for {R _i, L _i }, and a group {R _{i + 1} , L _{i + 1} } for the next determination process is set based on the result of the determination process. May be.

  In addition, as an access permission determination rule, a hop possible limit number corresponding to the upper limit of the hop number may be provided.

  Note that a white list may be set as an initial setting of the similar range R.

[Domain information]
The domain information is information that records the domain name and the registrant of the domain name.

  FIG. 6 is a diagram illustrating an example of domain information.

  In the domain information, a domain name and information on a registrant of the domain name are recorded. The domain information is collected by, for example, a search process using a known WHOIS command and stored in the determination policy information storage unit 11.

  Next, the contents of the information stored in the determination result storage unit 12 will be described.

[Judgment result information]
The determination result storage unit 12 stores past determination result information of the accessibility determination unit 3.

  FIG. 7 is a diagram illustrating an example of determination result information recorded in the determination result storage unit 12.

  As shown in FIG. 7A, the determination result information includes the base URL set by the determination result of permission for each reference destination URL of the access request to be determined in the determination process of the access permission determination unit 3, and This information includes the shortest hop count to the base URL.

  In FIG. 7A, the reference line URL d in the fourth line is twice as long as the reference URL (a) and the reference URL (c) up to the reference URL (d) as illustrated in FIG. 7B. Is permitted and is within the similar range R2 with the base URL (c) as the base point.

  When there are a plurality of determination results for the same reference URL, the determination result having the minimum number of hops is adopted, and the base URL and the number of hops are recorded in the determination result storage unit 12 as determination result information. The

[Processing flow of access control system]
The flow of processing of the access control system will be outlined with reference to FIG.

  The determination policy information storage unit 11 of the access control device 1 holds an access permission determination rule in which a white list is set as an initial value of the similar range R (similar range R0 corresponding to the number of hops n = 0). It shall be.

  Step S1: When the user performs an access request operation, the Web browser unit 20 of the terminal 2 issues an access request.

  Step S2: The access request detection unit 21 detects an access request, generates an access permission determination request based on the detected access request, and transmits it to the access permission determination unit 3.

  As illustrated in FIG. 9, the access permission determination request generated by the access request detection unit 21 includes a reference destination URL, a reference source URL, and previous determination information (base URL, number of hops n).

  The reference destination URL is a URL to be accessed, which is specified from the access request from the Web browser unit 20 of the terminal 2. The referrer URL is the URL that was referenced when the access request was made. The previous determination information is information included in the access permission determination response received immediately before detection of the access request, and is information including the base URL and the hop number determined as a result of the determination processing.

  Step S3: When the access permission determination unit 3 receives the access permission determination request, the access permission determination request has received the reference destination URL, the base URL, the number of hops, the similar range Rn, and the hop possible range Ln necessary for the access permission determination. The similarity D with respect to the base URL of the reference destination URL calculated based on the similarity calculation rule is compared with the similarity range Rn and the hop possible range Ln, and the comparison result is obtained. Based on this, access permission / prohibition, hop count, and base URL are determined.

  Details of the processing of the accessibility determination unit 3 will be described later.

  Step S4: The access permission determination unit 3 generates an access permission determination response based on the access permission determination result and transmits the response to the access request detection unit 21.

  The access permission determination response generated by the access permission determination unit 3 includes a determination result and determination information as illustrated in FIG. The determination result indicates whether the access permission determination unit 3 has permitted or denied access to the requested information. The determination information indicates the base URL and the hop number set in the current determination.

  Step S5: The access request detection unit 21 receives an access permission determination response from the access permission determination unit 3, and holds determination information included in the access permission determination response.

  Step S6: The access request detection unit 21 transmits a determination result (permission / rejection) to the Web browser unit 20.

  Step S7: If the determination result is permission, the Web browser unit 20 accesses the reference destination URL and displays the content of the Web page. If the determination result is denied, the web browser unit 20 displays an access denial message.

[Processing by the accessibility determination unit]
Upon receiving the access permission determination request, the access permission determination unit 3 receives the access permission determination request and the determination policy that have received the reference destination URL, the base URL, the number of hops, the similar range R, and the hop permission range L necessary for the access permission determination. The determination is made based on an access permission determination rule in the information storage unit 11 (this process is referred to as a determination condition determination process).

  Next, the access permission determination unit 3 compares the similarity D with respect to the base URL of the reference URL calculated based on the similarity calculation rule in the determination policy information storage unit 11 with the similar object range R and the hop possible range L. Then, access permission / prohibition, the number of hops, and the base URL are determined based on the comparison result (this process is referred to as an access permission determination process).

  At this time, the access permission determination unit 3 determines that the access permission for the access request is permitted when the calculated similarity D is within the adopted similar range R or hop possible range L, and the hop possible range L If it exceeds, access is prohibited.

  Further, when the calculated similarity D exceeds the similar object range R and is within the similar object range L, the access permission determination unit 3 adds 1 to the number of hops and sets the base URL as the reference destination URL. If the reference destination URL is in the white list, the number of hops is set to 0, and the base URL is set as the reference destination URL.

  Further, the access permission determination unit 3 generates an access permission determination response including a determination result (access permission or permission) and determination information (base URL, hop count), and transmits the response to the access request detection unit 21.

[Access permission determination processing example]
An example of access permission determination processing of the access permission determination unit 3 will be described with reference to FIGS.

  FIG. 5 shows a specific example of the access permission determination rule. As described above, in the accessibility determination rule, the similar range Rn and the hop possible range Ln are set corresponding to the number of hops n.

  In addition, each similar object range Rn and hop possible range Ln in FIG. 5 use the similarity calculation rule shown in FIG.

  A white list is set as the similarity range R0 with the number of hops n = 0, and a range of the similarity level 14 (within the related domain) set in the similarity calculation rule of FIG. 3 is set as the hop possible range L0. Is done.

  The similarity range R1 with the number of hops n = 1 is set within level 4 (a range in which the folder name under the path name is different), and the hop possible range L1 is set at level 13 (within the same domain). The The similar range R2 with the number of hops n = 2 is set within level 1 (a range in which the file names are slightly different), and the similar range R2 is set in the hop possible range L2, indicating prohibition of hops. This is because, since the hop possible range Ln and the similar range Rn are in the same range, the permitted range including the hop is limited to the similar range.

  An outline of the operation of the access permission determination unit 3 will be described using the access permission determination rules of FIGS. 11 and 5 and the similarity calculation rule of FIG.

  In FIG. 11, the access permission determination unit 3 always permits access while referring to the white list of the similar object range R0 and maintains the number of hops n = 0. Update the reference URL.

  The access permission determination unit 3 performs access permission determination by a known white list method as access control to the reference destination URL in the similar object range R0.

  Next, when an access permission determination request from the page in the white list to the reference URL (a) outside the similar range R0 (white list) is detected, the access permission determination unit 3 starts from the hop count n = 0. , R0 and L0 of the access permission determination rule are set as determination conditions. Access to the reference URL is determined as access exceeding the similar range R0, and is permitted only within the hop possible range L0.

  The accessibility determination unit 3 uses the reference source URL in the white list as the base URL, calculates the similarity (D0) of the reference URL (a), and the similarity D0 is the hop possible range L0 (similarity in FIG. 3). Access is permitted only within the calculation rule level 14 (related domain)), the number of hops is added, and n = 1 and the base URL is updated to the current reference URL (a). The accessibility determination unit 3 denies access when the similarity D0 exceeds the hopping possible range L0. The access permission determination unit 3 transmits an access permission determination response including determination information of the hop count n = 1, the base URL = the reference URL (a).

  Thereafter (after moving into the gray zone), the access permission determination unit 3 determines the previous determination information (here, hop count n = 1, base URL = reference destination URL (a )) And the like, the similar range R and the hop possible range L are determined.

  Here, when the similarity D between the base URL (a) and the reference destination URL is within the similar object range R1 (level 4 (range in the same folder or lower folder)), access is permitted, and the similar object range R1 is set. If it exceeds, access (hops) is permitted only within the level 13 (same domain) of the hop possible range L1.

  For example, when access to the reference destination URL (b) is detected and the similarity D of the reference destination URL (b) exceeds the similar object range R1 but is within the hop possible range L1, the access is permitted. Is done. The number of hops is added to obtain n = 2, and the base URL is updated to the current reference URL (b).

  As a result, from the next access request, the similarity D between the base URL (b) and the reference URL is limited to within “level 1 (range where the file names are slightly different)” within the similarity range R2. Access beyond the similar range R2 is prohibited by the hop possible range L2 (prohibited). That is, the hop possible range L2 is the same as the similar range R2, and access beyond that range is prohibited.

  Next, processing of the terminal 2 and the access control device 1 will be described in more detail.

  FIG. 12 is a process flow diagram of the access request detection unit 21 of the terminal 2.

  The access request detection unit 21 waits for an access request from the Web browser unit 20 of the client (step S10), and when an access request is detected (Y in step S11), the reference destination URL, reference source URL, and previous determination information from the access request. Is acquired (step S12).

  The access request detection unit 21 generates an access permission determination request including the reference destination URL, the reference source URL, and the previous determination information (base URL, hop number) of the received access permission determination response, and sends it to the access permission determination unit 3. Transmit (step S13).

  Thereafter, when an access permission determination response is received from the access permission determination section 3 and the access permission response is stored as previous determination information (step S14), the access request detection section 21 updates the determination information of the received access permission determination response. Then, the determination result is examined (step S15). If the determination result is permission (“permission” in step S15), the access request detection unit 21 returns permission to the web browser unit 20 (step S16), and if the determination result is rejection (“rejection” in step S15). ”), A rejection is returned to the Web browser unit 20 (step S17), and the process returns to step S10.

  FIG. 13 and FIG. 14 are process flow diagrams of the access permission determination unit 3.

  The access permission determination unit 3 waits for an access permission determination request (step S20), and determines the zone of the reference URL based on the gray zone identification information (step S21).

  If the reference URL is in the white list (“white list” in step S22), the access permission determination unit 3 permits the access permission determination (step S23) and resets the hop count n = 0. The access point determination response including the determination result is returned to the access request detection unit 21 as the base point URL = reference destination URL (step S24).

  When the blacklist is stored as the gray zone specifying information in the determination policy information storage unit 11, if the reference destination URL is in the blacklist (“blacklist” in step S22), the accessibility determination unit 3 rejects the access permission determination (step S26), and performs the process of step S25.

  When the reference URL is neither a white list nor a black list (“gray zone” in step S22), the access permission determination unit 3 determines the current base URL and hop from the determination information of the access permission response request. The number n is determined (step S30).

  If the previous determination information or the access source URL is not included in the access permission response request, the access permission determination section 3 uses the determination result information in the determination result storage section 12 and the reference URL of the access permission determination request. Thus, the base URL and the hop number n are determined by a specific process described later.

  The accessibility determination unit 3 calculates the similarity D of the reference URL based on the base URL (step S31), and calculates the similar range Rn and hop possible range Ln based on the number of hops n (step S32). ).

  The access permission determination unit 3 determines whether the similarity D is within the hop possible range Ln (D ≦ Ln) (step S33). If D ≦ Ln is not satisfied (N in step S33), the access permission determination is denied ( In step S34), the base URL and the number of hops n used in the next determination process are the values determined in step S30 (step S35).

  If D ≦ Ln (Y in step S33), the access permission determination unit 3 determines that the access permission determination is permitted (step S36), and whether the similarity D is within the similar object range Rn (D ≦ Rn). ) Is determined (step S37). If D ≦ Rn (Y in step S37), the determination result recording unit 5 records the determination result in the determination result storage unit 12 (step S38). If D ≦ Rn is not satisfied (N in step S37), the accessibility determination unit 3 adds 1 to the number of hops n used in the next determination process, and sets the reference destination URL as the base URL (step S39).

  The access permission determination unit 3 generates an access permission determination response including the determination result and the determination information, and returns it to the access request detection unit 21 (step S310).

  FIG. 15 is a processing flowchart of determination result information recording processing.

  The determination result recording unit 5 confirms all reference destination URL fields of the determination result information in the determination result storage unit 12 (step S40), and determines that the determination result is determined if the reference destination URL has not already appeared (N in step S41). It adds to result information (step S42).

  If the reference destination URL has already appeared (Y in step S41), the determination result recording unit 5 confirms the shortest hop number m of the corresponding record (step S43), and the hop number n of the current determination result is the shortest hop. If it is smaller than several m (Y in step S44), the corresponding record is replaced with the current determination result (step S45).

  Further, the determination result recording unit 5 confirms all the base URL fields of the determination result information (step S46), and if there is a reference destination URL (Y in step S47), confirms the shortest hop count k of the corresponding record. (Step S48), if the number of hops n of the current determination result is smaller than the shortest hop number k (Y in Step S49), the shortest hop number of the corresponding record is changed to n (Step S410).

  FIG. 16 is a processing flowchart of the similarity level calculation process of the path name part of the reference destination URL in the access permission determination process.

  The accessibility determination unit 3 reads the similarity calculation rule from the determination policy information storage unit 11 (step S50), acquires the base URL and the reference URL (step S51), and sets La for the similarity level La + Lb. Initialization is performed to La = 0 (step S52).

  The accessibility determination unit 3 checks whether or not the base URL and the reference URL are completely matched (step S53). If the two URLs are completely matched (Y in step S53), the similarity level = 0 ( Step S54), the process is terminated.

  If the two URLs do not completely match (N in step S53), the access permission determination unit 3 sets the lowest folder of the base URL as the current folder (cwd), and determines the current folder cwd from the highest folder of the two URLs. It is checked whether or not the paths up to this match (step S55). If the paths from the top folder of the two URLs to the current folder cwd match (Y in step S55), the folder in the path name part of the reference URL is within the range to the same folder dir as the current folder cwd. This is checked (step S56).

  Only when the folder of the reference URL is not within the same folder dir as the current folder cwd (N in Step S56), the access permission determination unit 3 adds 2 to La (Step S57) and determines Lb. (Step S58).

  If the paths from the top folder of the two URLs to the current folder cwd do not match (N in step S55), the accessibility determination unit 3 sets La = 4 (step S59) and checks up to the top folder If not (step S510), the current folder cwd is moved up one level (step S511).

  Further, the accessibility determination unit 3 checks whether or not the paths from the highest level to the current folder cwd moved from the highest level match between the two URLs (step S512), and the paths to the current folder cwd moved from the highest level match. If so (Y in step S512), Lb is determined (step S513). If the paths to the current folder cwd moved from the highest level do not match (N in Step S512), the accessibility determination unit 3 adds 2 to La (Step S514). Furthermore, if La exceeds the maximum value of La, the accessibility determination unit 3 sets La = La maximum value (step S515), and returns to the process of step S510.

  FIG. 17 is a process flow diagram of the “Lb determination” process in steps S58 and S513.

  The accessibility determination unit 3 divides the character string in the lower direction from the currently focused position of the two URLs with a backslash to obtain a partial character string group, compares each partial character string, and determines the difference. Is determined to be about “slightly different” (step S60). If the difference between the partial character string groups being compared is about “slightly different” (Y in step S60), the accessibility determination unit 3 sets Lb = 1 (step S61), and the difference is “slightly”. If it exceeds the “difference” degree (N in step S60), Lb = 2 is set (step S62).

[Base URL and hop count specification processing]
Next, in the process of step S30 in FIG. 14, the base URL and the number of hops n are directly acquired from the access permission determination request or the past determination result, such as when directly accessing a URL that has not been referred to in the past. A process for determining the base URL and the number of hops when this is not possible is described.

  If the base URL or the number of hops cannot be obtained directly from the previous determination information or the past determination result of the access permission determination request, the access permission determination unit 3 includes the past determination results recorded in the determination result storage unit 12. The base URL closest to the reference destination URL and the number of hops thereof are used as determination information to determine whether the reference destination URL is accessible.

  In the determination result information shown in FIG. 18A, it is assumed that the base URL and the shortest hop count are recorded for the reference URLs (a), (b), (c), and (d).

  FIG. 18B is a diagram schematically showing the relationship between the reference destination URLs (a), (b), (c), and (d) recorded in the determination result information of FIG. 18 (A).

  Assume that there is an access request to a reference destination URL (e) that has not been referred to in the past in the relationship of the reference destination URL in FIG.

  The accessibility determination unit 3 extracts the base URLs (a) and (c) in the base URL column in the determination result, calculates the similarity D to each base URL of the reference URL (e), and calculates the URL ( The similarity Da between a)-(e) and the similarity Dc between URL (c)-(e) are obtained.

  Then, the accessibility determination unit 3 compares the similarities Da and Dc, and determines the URL having the minimum similarity (here, the URL (c) in the case of the similarity Dc) as the base URL of the reference destination URL (e). And Furthermore, the accessibility determination unit 3 sets the shortest hop count (2) of the record (# 2) having the base URL (c) in the reference URL column as the hop count n.

  Next, the access permission determination unit 3 determines whether or not the reference destination URL (e) is accessible using the base URL (c) and the hop count (2).

[Process for determining access permission judgment conditions]
Next, a method will be described in which the accessibility determination unit calculates and determines the similar range Rn and the hopping possible range Ln based on the access determination rule in the process of step S32 in FIG.

When access to a reference URL exceeding the similar range R _i is detected when the number of hops is i, a set {R _{i + 1} , L _{i + 1} } of the similar range and hop possible range used in the next determination process is determined. As a technique to do this, the accessibility determination unit 3 can use the first to fourth techniques.

The first to fourth methods are: a) whether the number of elements {R _i , L _i } of the similar range R and the hop possible range L is fixed or variable; b) the state of user browsing (at the time of corresponding browsing) This is based on the combination of whether or not to consider the similarity D _i of the reference URL, the similar range R _i , and the possible hop range L _i .

The fixed number of elements of the similar range and hop possible range set {R _i , L _i } means that the number of hops has an upper limit, and that the number of elements is variable means that the number of hops the upper limit is not, it means that the analog range R _i and hop range Li is to converge to access prohibition, R _i, continues to allow access within the L _i.

Whether or not the user's browsing situation is taken into account corresponds to whether or not the similarity D _i of the reference URL is involved in the determination of R _{i + 1} and L _{i + 1} .

The first method is a case where the elements of {R _i , L _i } are fixed and the user's viewing method is not considered.

The set {R _i , L _i } of the similar range R and the hop possible range L used in the determination process of the access permission determination unit 3 described with reference to FIGS. 5 and 11 corresponds to the first method. To do.

The access permission determination unit 3 determines a set {R _i , L _i } of the similar object range R and the hop possible range L, which is used by the access permission determination unit 3 in the determination process, from i = 0 to n by a similarity calculation rule. It is determined based on the number of hops from the access permission determination rule defined using the specified level.

The second method is a case where the elements of the set {R _i , L _i } are fixed and the user's browsing method is taken into consideration.

The accessibility determination unit 3 determines {R _i , L _i } from the finite elements of the combination {R, L} of the similar object range R and the hop possible range L in consideration of the similarity D _i of the reference URL. To do. As an example, N pairs {R, L} of a similar range R and a hop possible range L are prepared as candidates, and when the similarity D _i of the reference URL exceeds the similar range Ri, L> {R, L} satisfying D _i , that is, a candidate having a hop possible range L _i including similarity D _i is obtained, and one of the corresponding {R, L} is determined as {R _{i + 1} , L _i }. To do.

  FIG. 19 is a diagram illustrating an example of combination candidates.

  In the group candidate table shown in the upper part of FIG. 19A, the hop possible range L, the next similar range R, and the number of candidates (settable number of times) are set for each group candidate.

  The table shown in the lower part of FIG. 19A is a table showing access permission determination rules. In the table indicating the accessibility determination rule, the similar range R0 (white list) with the number of hops n = 0 is set as an initial value.

  As shown in FIG. 19B, it is assumed that an access request to the web page (q) is detected while referring to the web page (p) in the similar object range R0. When the similarity D of the Web page (q) is within the level 14 of the similarity calculation rule in FIG. 3, the accessibility determination unit 3 has a candidate 1 having a hop possible range L within the range. Is selected, L of candidate 1 (within level 14) is set to L0 of the access permission determination rule, R of candidate 1 (within level 1) is set to R1 of the access permission determination rule, and the number of candidates is set to 0. .

  The access permission determination unit 3 permits access to the web page (q) by the hop possible range L0. Further, in the next determination process, the access permission determination unit 3 performs determination in the similar object range R1 (within level 1).

  Next, it is assumed that an access request to the Web page (t) is detected while referring to the Web page (s) in the similar object range R1. When the similarity D of the Web page (q) is within the level 7, the accessibility determination unit 3 includes a plurality of candidates having the hop possible range L within the range of the similarity D, so the minimum number of levels Candidate 4 is selected, L of candidate 4 (within level 8) is set as L1 of the access permission determination rule, and R of candidate 4 (within level 6) is set as R2 of the access permission determination rule. Set to 0.

  The access permission determination unit 3 permits access to the web page (t) by the hop possible range L1, and performs the determination in the similar range R2 (within level 6) in the next determination process.

  Next, it is assumed that an access request to the Web page (t) is detected while referring to the Web page (s) in the similar object range R1. When the similarity D of the Web page (t) is within level 7, the accessibility determination unit 3 includes a plurality of candidates having a hop possible range L within the range of the similarity D, so the minimum number of levels Candidate 4 is selected, L of candidate 4 (within level 8) is set as L1 of the access permission determination rule, and R of candidate 4 (within level 6) is set as R2 of the access permission determination rule. Set to 0.

  Alternatively, it is assumed that an access request to the Web page (u) is detected while referring to the Web page (s) in the similar object range R1. When the similarity D of the Web page (u) is within the level 14, the accessibility determination unit 3 searches for a candidate 1 having a hopable range L within the range of the similarity D. However, since candidate 1 is already used and the number of candidates is 0, prohibition is set in L2 of the access permission determination rule. Therefore, the access permission determination unit 3 denies access to the Web page (u).

The third method is a case where the elements of the set {R _i , L _i } are variable and the user's viewing method is not taken into consideration.

The accessibility determination unit 3 designates R0 and L0 as initial values, and is a calculation formula defined so that R _{i + 1} and L _{i + 1} in the next determination process become a decreasing function with respect to the number of hops n. _i , L _i } is determined. As an example, a calculation formula, a similar level as the analog range R _{i + 1,} parameter α min higher than R _i, i.e. defined to narrow the range of similarity D is applicable, the hop range L _{i + 1} similar levels are defined as parameters β fraction higher than L _i. The number of hops is treated as variable by the parameters α and β.

The fourth method is a case where the elements of the set {R _i , L _i } are variable and the user's browsing method is considered.

The accessibility determination unit 3 designates R0 and L0 as initial values, and R _{i + 1} and L _{i + 1} in the next determination process become a decreasing function for the number of hops n depending on the similarity D of the reference URL. The set {R _i , L _i } is determined by the defined calculation formula.

Degree As an example, a similar level as the analog range R _{i + 1} and hop range L _{i + 1,} and the margin of similarity D _i to hop range L _i, the similarity D _i exceeds the analog range R _i Is determined by a calculation formula that decreases from R _i and L _i by the amount obtained by using the ratio. That is, it is determined by the following calculation formula.

R _{i + 1} = R _i −α + f {(D _i −R _i ) / (L _i −D _i )}
L _{i + 1} = L _i −β + g {(D _i −R _i ) / (L _i −D _i )}
Thus, the number of hops exceeding the similar range R _i is treated as variable.

  FIG. 20 shows a hardware configuration example of the access control apparatus 1.

  As shown in FIG. 20, the access control device 1 can be implemented by a computer 100 that includes a CPU 101, a main storage unit (memory) 103, an input / output interface 105, and an external storage device 110.

  Further, the access control device 1 can be implemented by a program that can be executed by the computer 100. In this case, a program describing the processing contents of the functions that the access control apparatus 1 should have is provided. When the computer 100 executes the provided program, the processing functions of the access control device 1 described above are realized on the computer 100.

  The computer 100 can also read a program directly from a portable recording medium and execute processing according to the program. In addition, each time the program is transferred from the server computer, the computer 100 can sequentially execute processing according to the received program. Further, this program can be recorded on a recording medium readable by the computer 100.

  In the above embodiment, the access control apparatus 1 is physically configured in one computer, and is installed on the route to the network where the Web browser unit 20 as a client and the content to be referred to exist. Explained as a thing.

  However, the access request detection unit 21 of the access control device 1 does not need to be configured in the same computer as other processing units, and may have the following configuration.

  As an example, when a proxy server, a transfer server, or the like (simply referred to as a proxy server) is installed between the client of the Web browser unit 20 and the network where the referenced content exists, the access request detection unit 21 Provided in the proxy server, and other processing units of the access control device 1, an access permission determination unit 3, a determination result recording unit 5, a determination policy information storage unit 11, a determination result storage unit 12 (hereinafter simply referred to as access permission determination) May be configured as an access determination server.

  Further, the entire access control apparatus 1 may be provided in a computer that is a client including the Web browser unit 20.

  In the above-described embodiment, the case where the information identifier of the reference destination is a URL has been described as an example. However, the information identifier is not limited to the URL, and may be a URI (Uniform Resource Identifier).

  As described above, according to the access control apparatus 1, when determining whether or not access within the gray zone is possible, access is always permitted if the access is within a range similar to the reference destination to which access has already been permitted. As a result, it is possible to refer to the final page regardless of how many pieces of article content are divided. On the other hand, for items that are less relevant to articles, such as banner advertisements, the similarity between the URLs of the referenced articles (reference sources) and banner advertisements (reference destinations) is the URL between related contents. Since it is lower than that, access is denied when a limit is set that allows hopping, and the limit is exceeded.

  As described above, it is possible to realize access control for determining whether or not access is possible in accordance with the relevance with the already referenced content even if the access is from a link in the same page.

  Furthermore, according to the access control device 1, since it is not necessary to collect link reference relationships in advance as in the case of control using a known white list or black list, it is possible to greatly reduce the equipment and costs required for advance preparation. It is possible to determine whether or not access is possible to the reference destination.

  Furthermore, according to the access control device 1, the similarity range and the hop possible range can be set according to an arbitrary range and classification, so that it is possible to set the access permission determination to an arbitrary strength.

  Furthermore, since the similarity of URLs is used for the similar object range and the hop possible range, even if the Web page is frequently updated, the access criterion is not easily obsolete, and the strength of the access can be increased. It is also possible to keep it constant.

  The features in the embodiments of the present invention are listed as follows.

(Appendix 1)
An access control method executed by an access control device including a determination policy information storage unit for storing determination policy information,
An access request detection processing step for detecting an access request to information existing on the network issued by the client;
When receiving an access request for information on the network, the client requests access based on gray zone specifying information that specifies whether the information is in an area where access is explicitly permitted or denied. Based on the similarity calculation rule for calculating the similarity between the identifiers of the two information stored in the determination policy information storage unit when the reference destination information is not explicitly permitted or prohibited. A similarity calculation processing step for calculating a similarity between the identifier of the reference destination information and the identifier of the information serving as a predetermined base point;
Hopsable range indicating the similarity range indicating the similarity range in which the identifiers of the two pieces of information are regarded as similar items and the limit of similarity between the identifiers of the information permitted to be accessed, stored in the determination policy information storage unit Is determined based on the access permission determination rule that defines whether the similarity calculated based on the identifier of the reference destination information is within the similar range, and the similarity is within the similar range. If there is, a similar range determination processing step for determining permission to access the reference destination information;
When the similarity is not within the similar object range, the similarity calculated from the identifier of the reference destination information and the identifier of the information serving as the base point is within the hopable range based on the access permission determination rule. If the similarity is within the hop possible range, the access request to the reference destination information is determined to be hoppable, and the access request is permitted, and the similarity is within the hop possible range. A hop possible range determination processing step for determining rejection of an access request to the information of the reference destination if not,
An access control method comprising: an access permission determination notification step of notifying the client of an access permission or access rejection determination result according to the access request.

(Appendix 2)
In the access permission determination rule stored in the determination policy information storage unit, when a similar range and a hop possible range are defined according to the number of hops indicating the permitted number of hops for an access request,
Determination indicating the identifier of the reference destination information in the hop possible range determination processing step, the number of hops indicating the total number of accesses as hops permitted to access the reference destination information, and the identifier of the base information A determination information holding processing step for holding information in a storage unit;
In the similar range determination processing step, based on the number of hops of the determination information, a process of determining a similar range and a hop possible range corresponding to the number of hops from the access permission determination rule is performed. The access control method according to attachment 1.

(Appendix 3)
3. The access control method according to appendix 2, wherein in the similarity calculation processing step, processing for setting an identifier of information serving as a base point of the determination information is performed as an identifier of information serving as the base point.

(Appendix 4)
In the access permission determination rule, when a whitelist listing identifiers of information permitted to be accessed is set as an initial value of the similar object range, before the similarity calculation processing step, the reference destination It is determined whether an identifier of information is an identifier of information listed in the white list, and when the identifier of the information of the reference destination is an identifier of information listed in the white list, access permission is determined and The access control method according to claim 2 or 3, wherein the number of hops of the determination information is initialized, and an identifier of the reference destination information is set as an identifier of information serving as a base point.

(Appendix 5)
Based on the determination result in the similarity determination processing step, the determination result in the hop possible range determination processing step, and the determination information held in the determination information holding processing step, the access is determined. And a determination result recording process step of storing, in the determination result storage unit, determination result information indicating an identifier of information serving as a base point and the number of shortest hops for each identifier of the reference destination information. The access control method according to any one of appendix 4.

(Appendix 6)
In the similarity calculation processing step, a process of setting an identifier of information serving as a base point of the determination result information as an identifier of information serving as the base point;
6. The access control method according to appendix 5, wherein in the similarity range determination processing step, a process of setting the shortest hop number of the determination result information as the hop number is performed.

(Appendix 7)
In the determination result recording processing step, when a plurality of determination results exist for the same reference destination information identifier, a process of updating the determination result information with a determination result that minimizes the number of hops is performed. The access control method according to appendix 6, wherein the access control method is characterized.

(Appendix 8)
The access permission determination rule stored in the determination policy information storage unit calculates a pair of similar range and hop range corresponding to the number of hops based on the similarity of the identifier of the information referred to by the client. And when the access to the reference destination information is permitted as a hop possible, the similarity degree of the identifier of the reference destination information is obtained to determine the degree of excess from the similar range, The processing according to any one of the appendix 2 to the appendix 6, wherein a process is performed to determine a similar range and a hop possible range that are used for determining whether or not the next access request can be accessed based on the obtained excess degree. The access control method described in 1.

(Appendix 9)
The access permission determination rule stored in the determination policy information storage unit defines a set of a similar range and a hop possible range corresponding to the number of hops,
In the hop possible range determination processing step, when access to the reference destination information identifier as hop possible is permitted, the similarity of the identifier of the reference destination information is within the range from the access permission determination rule. (2) searching for a set including a possible hop range and determining a similar range and a possible hop range to be used for determining whether or not the client can access the next access request. Or the access control method according to any one of appendix 6.

(Appendix 10)
The access permission determination rule stored in the determination policy information storage unit includes a rule for setting the similar range by a decreasing function using the hop number,
In the similar item range determination processing step, a process of determining a similar item range corresponding to the number of hops is performed based on the access permission determination rule. The access control method described.

(Appendix 11)
The access permission determination rule stored in the determination policy information storage unit includes a rule for setting the hop possible range by a decreasing function using the hop count,
11. The access control method according to appendix 10, wherein in the hop possible range determination processing step, a process of determining a hop possible range corresponding to the number of hops is performed based on the access permission determination rule.

(Appendix 12)
The access permission determination rule stored in the determination policy information storage unit includes a rule for setting the similar range by a decreasing function,
The decrease function includes an excess amount that is a degree of similarity of the identifier of the reference destination information exceeding the similarity range, and a margin amount that is a margin of the similarity to the hop possible range. The access control method according to any one of appendix 2 to appendix 6, wherein the access control method is defined as a decreasing function using a ratio or an absolute amount.

(Appendix 13)
The access permission determination rule stored in the determination policy information storage unit includes a rule for setting the hop possible range by a decreasing function,
The degree to which the similarity of the identifier of the reference destination information exceeds the similarity range when access as a hop to the identifier of the reference destination information is permitted in the hop possible range determination processing step And an excess amount that is the degree of margin of the similarity with respect to the hop possible range, and the reduction function is determined using a ratio between the excess amount and the margin amount, and the client 13. The access control method according to appendix 12, wherein a process for determining a hop possible range to be used for determining whether or not an access request for the next access request is possible is performed using the reduction function.

(Appendix 14)
Collecting domain information indicating a domain name of the network and a registrant of the domain name, and storing the domain information in the determination policy information storage unit,
When the similarity calculation rule based on the domain name is included in the similarity calculation rule of the determination policy information storage unit,
14. The access control method according to appendix 13, wherein, in the similarity calculation processing step, a process of calculating a partial similarity related to a domain of the reference information identifier is performed based on the domain information.

(Appendix 15)
An access control device for controlling access to information existing on a network,
The similarity calculation rule for calculating the similarity between two information identifiers, the similarity range indicating the range of similarity in which the two information identifiers are regarded as similar, and access to the identifier of the information requested to be permitted A determination policy information storage unit for storing a hop possible range indicating a limit to be performed and an access permission determination rule including the number of hops;
An access request detection unit that performs processing for detecting an access request issued by a client, and processing for notifying a determination result of permission or denial of access by the access request to the client;
Based on the similarity calculation rule, a process of calculating the similarity between the identifier of the reference destination information and the identifier of the information serving as a predetermined base point, and the reference destination information based on the access permission determination rule A process of determining whether or not the similarity of the identifier is within the similar object range, and determining access permission to the information indicated by the identifier of the reference destination information when the similarity is within the similar object range And when the similarity is not within the similar range, it is determined whether the similarity of the identifier of the reference destination information is within the hop possible range based on the access permission determination rule, and the similarity When the degree is within the hop possible range, permission of access that is a hop to the identifier of the reference destination information is determined, and when the similarity is not within the hop possible range, the reference destination information Access control device, characterized in that it comprises an access judging unit that performs a process of determining a denial of access to the information indicated by the identifier.

1 Access control device 2 Terminal (client)
DESCRIPTION OF SYMBOLS 21 Access request detection part 3 Access permission determination part 5 Judgment result recording part 11 Judgment policy information storage part 12 Judgment result storage part 20 Web browser part

Claims (8)

An access control method executed by an access control device including a determination policy information storage unit for storing determination policy information,
An access request detection processing step for detecting an access request to information existing on the network issued by the client;
When receiving an access request for information on the network, the client requests access based on gray zone specifying information that specifies whether the information is in an area where access is explicitly permitted or denied. Based on the similarity calculation rule for calculating the similarity between the identifiers of the two information stored in the determination policy information storage unit when the reference destination information is not explicitly permitted or prohibited. A similarity calculation processing step for calculating a similarity between the identifier of the reference destination information and the identifier of the information serving as a predetermined base point;
Hopsable range indicating the similarity range indicating the similarity range in which the identifiers of the two pieces of information are regarded as similar items and the limit of similarity between the identifiers of the information permitted to be accessed, stored in the determination policy information storage unit Is determined based on the access permission determination rule that defines whether the similarity calculated based on the identifier of the reference destination information is within the similar range, and the similarity is within the similar range. If there is, a similar range determination processing step for determining permission to access the reference destination information;
When the similarity is not within the similar object range, the similarity calculated from the identifier of the reference destination information and the identifier of the information serving as the base point is within the hopable range based on the access permission determination rule. If the similarity is within the hop possible range, the access request to the reference destination information is determined to be hoppable, and the access request is permitted, and the similarity is within the hop possible range. A hop possible range determination processing step for determining rejection of an access request to the information of the reference destination if not,
An access control method comprising: an access permission determination notification step of notifying the client of an access permission or access rejection determination result according to the access request. In the access permission determination rule stored in the determination policy information storage unit, when a similar range and a hop possible range are defined according to the number of hops indicating the permitted number of hops for an access request,
Determination indicating the identifier of the reference destination information in the hop possible range determination processing step, the number of hops indicating the total number of accesses as hops permitted to access the reference destination information, and the identifier of the base information A determination information holding processing step for holding information in a storage unit;
The similarity range determination processing step performs a process of determining a similar range and a hop possible range corresponding to the hop count from the access permission determination rule based on the hop count of the determination information. Item 4. The access control method according to Item 1. The access control method according to claim 2, wherein, in the similarity calculation processing step, a process of setting an identifier of information serving as a base point of the determination information is performed as an identifier of information serving as the base point. In the access permission determination rule, when a whitelist listing identifiers of information permitted to be accessed is set as an initial value of the similar object range, before the similarity calculation processing step, the reference destination It is determined whether an identifier of information is an identifier of information listed in the white list, and when the identifier of the information of the reference destination is an identifier of information listed in the white list, access permission is determined and 4. The access control method according to claim 2, wherein a process of initializing a hop number of the determination information and setting an identifier of the reference destination information as an identifier of information serving as a base point is performed. Based on the determination result in the similarity determination processing step, the determination result in the hop possible range determination processing step, and the determination information held in the determination information holding processing step, the access is determined. 5. A determination result recording process step of storing determination result information indicating an identifier of information serving as a base point and the shortest hop count for each reference destination information identifier in a determination result storage unit. Item 5. The access control method according to any one of Items4. The access permission determination rule stored in the determination policy information storage unit calculates a pair of similar range and hop range corresponding to the number of hops based on the similarity of the identifier of the information referred to by the client. And when the access to the reference destination information is permitted as a hop possible, the similarity degree of the identifier of the reference destination information is obtained to determine the degree of excess from the similar range, 6. The process of determining a similar range and a hop possible range to be used for determining whether or not the next access request can be accessed based on the obtained excess degree. The access control method according to item. The access permission determination rule stored in the determination policy information storage unit defines a set of a similar range and a hop possible range corresponding to the number of hops,
In the hop possible range determination processing step, when access to the reference destination information identifier as hop possible is permitted, the similarity of the identifier of the reference destination information is within the range from the access permission determination rule. 3. A process including: searching for a set including a hop possible range, and determining a similar range and a hop possible range to be used for determining whether or not the client can access the next access request. The access control method according to claim 6. An access control device for controlling access to information existing on a network,
The similarity calculation rule for calculating the similarity between two information identifiers, the similarity range indicating the range of similarity in which the two information identifiers are regarded as similar, and access to the identifier of the information requested to be permitted A determination policy information storage unit for storing a hop possible range indicating a limit to be performed and an access permission determination rule including the number of hops;
An access request detection unit that performs processing for detecting an access request issued by a client, and processing for notifying a determination result of permission or denial of access by the access request to the client;
Based on the similarity calculation rule, a process of calculating the similarity between the identifier of the reference destination information and the identifier of the information serving as a predetermined base point, and the reference destination information based on the access permission determination rule A process of determining whether or not the similarity of the identifier is within the similar object range, and determining access permission to the information indicated by the identifier of the reference destination information when the similarity is within the similar object range And when the similarity is not within the similar range, it is determined whether the similarity of the identifier of the reference destination information is within the hop possible range based on the access permission determination rule, and the similarity When the degree is within the hop possible range, permission of access that is a hop to the identifier of the reference destination information is determined, and when the similarity is not within the hop possible range, the reference destination information Access control device, characterized in that it comprises an access judging unit that performs a process of determining a denial of access to the information indicated by the identifier.

Images