JP4723905B2 - Policy automatic generation method and authorization device - Google Patents

Description

  The present invention relates to a policy generation method for the purpose of protecting electronic information, which is a judgment when controlling the use of information.

  In order to protect valuable information, the importance of access control technology for controlling access and use of the information is increasing. The core of this access control technology is authorization for determining whether or not to provide information.

  As the information usage environment is diversifying, when authorizing, not only the user who requests the use of the information himself / herself determines whether or not it is appropriate to provide the information. It is important to consider whether the situation (context) of the user is appropriate for providing information.

  Since the context changes with the passage of time, a mechanism for stopping the provision of the information is required when the authorization is continuously performed and the state is changed to an inappropriate state for the use of the information.

  Here, continuous authorization is referred to as continuous authorization, and authorization performed when information provision is started is referred to as initial authorization.

  Patent Document 1 identifies whether or not a user of a service is appropriate, and whether or not the user is in a situation where the user can use the service, and the security of the service is infringed by someone other than the user. It discloses a mechanism for continuously monitoring and detecting whether or not the situation is present and controlling the start / interruption / interruption release / termination of the service.

  When authorizing, a policy as a criterion for judgment is required. When performing authorization in consideration of the context, the policy element determines whether or not the context is appropriate in addition to the conditions for determining whether or not the user is appropriate for providing information. The condition to do is necessary. Furthermore, when continuing authorization is required, a separate policy for continuing authorization is required.

  Here, the policy is composed of one or more conditions, and in the case of two or more conditions, the conditions are connected by AND or OR to form a conditional clause. A condition consists of a parameter, an operator, and a reference value. A conditional clause may have a hierarchical structure. A policy for performing continuous authorization is referred to as a continuous authorization policy, and a policy for performing initial authorization is referred to as an initial authorization policy.

As pointed out in Non-Patent Document 1, when the content defined as a policy increases, there is a problem that the policy description cost and the management cost increase. In Non-Patent Document 1, a “master policy” that is easy to set for an information manager is defined as a superordinate concept of a policy for managing resources, and knowledge data describing the master policy, resource profile, and operation know-how The policy description cost and management cost are reduced by automatically generating individual policies using the information called.
JP-A-9-297735 Masataka Kanno, Shunsuke Tanaka, Yuji Sakata, Keiichiro Okuma, Norio Shiratori “Application and Implementation of Policy Control“ Policy Computing ”of Information Network System”, Transactions of Information Processing Society of Japan, 2001, Vol. 42, no. 02, pp126-137.

The following two points are necessary for the continuous authorization policy.
(1) It is possible to set a policy without increasing the burden on the information provider (policy writer).
(2) Continuous authorization can be performed without increasing the load on the authorization device.

  In (1), for example, in the method of rewriting the continuous authorization policy in addition to the initial authorization policy, the policy writer will be further burdened in addition to the burden for describing the conventional initial authorization policy. Can not satisfy the nature of. In (2), the method of diverting the initial authorization policy to the continuous authorization is not efficient because the load on the authorization device at the time of the first authorization is continuously taken to the end of the use of information.

  In Patent Document 1 described above as the prior art, there is no description regarding the policy of continuous authorization. In Non-Patent Document 1, an attempt is made to solve the problem (1) by automatically generating a policy. However, the target policy is only the initial authorization, and the continuous authorization is not considered. Therefore, the above problem (2) at the time of continuous authorization has not been solved in the prior art.

  An object of the present invention is to provide a policy automatic setting method for automatically generating a policy for continuous authorization without increasing the burden on an information provider (policy writer).

  Another object of the present invention is to provide an authorization device that implements the policy automatic setting method.

  In order to achieve the above-described object, the policy automatic generation method of the present invention uses the policy management unit of the authorization device that determines whether or not to permit the use of the information at the start or during the provision of the information. Generate a policy for continuous authorization (continuous authorization policy), which is authorization performed continuously thereafter, based on the policy for initial authorization (initial authorization policy) that was performed when the provision of the service started It is characterized by.

  By automatically generating the continuous authorization policy from the initial authorization policy, the policy description cost can be reduced, and the burden on the information provider is reduced.

  In the embodiment of the present invention, the continuous authorization policy is generated by removing conditions relating to static parameters that do not change during the provision of information from the conditions included in the initial authorization policy. As a result, the number of conditional expressions included in the continuous authorization policy can be reduced. Here, the condition relating to the static parameter is a condition relating to a parameter relating to the attribute indicating the characteristics of the user or the information to be used.

  In another embodiment of the present invention, a continuous authorization policy is generated by extracting a condition for a parameter relating to a context from conditions included in an initial authorization policy. As a result, the number of conditions included in the continuous authorization policy can be reduced.

  In another embodiment of the present invention, when a use request for information from a user is received, and it is determined that the use is permitted after the initial authorization, the conditions to be judged at the time of the continuous authorization are narrowed down based on the result of the initial authorization. Generate a continuous authorization policy. As a result, the number of conditions included in the continuous authorization policy can be reduced.

  In another embodiment of the present invention, for each parameter of the initial authorization policy, the continuous authorization policy is generated based on the discrimination information in which a flag indicating whether or not the parameter is related to the context is associated. Thereby, it is easy to determine the conditions to be extracted in the continuous authorization, and it is possible to efficiently generate the continuous authorization policy.

  The inventions of claims 1 and 6 automatically generate a continuous authorization policy based on the initial authorization policy, so that the policy writer does not need to describe the continuous authorization policy, and more than the conventional work of describing the initial authorization policy. Does not require any burden.

  According to the second aspect of the present invention, the continuous authorization policy is generated by removing the conditions related to static parameters that do not change during the provision of information from the conditions included in the initial authorization policy. It is possible to reduce the number of included conditions and reduce the load on the authorization device required for continued authorization.

  The invention of claim 3 extracts the condition for the parameter related to the context surrounding the user from the conditions included in the initial authorization policy and generates the continuous authorization policy, thereby obtaining the number of conditions included in the continuous authorization policy. As a result, it is possible to reduce the load on the authorization device necessary for the continuous authorization as in the effect of the second aspect.

  The invention of claim 4 narrows down the conditions to be judged at the time of continuous authorization based on the result of the first authorization when the use is permitted after the first authorization is received after receiving a request for use of information from the user. By generating the policy, it is possible to reduce the number of conditions included in the continuous authorization policy, and to reduce the load on the authorization device necessary for the continuous authorization as in the effect of the second aspect.

  According to the invention of claim 5, the continuous authorization policy is generated for each parameter of the initial authorization policy by generating a continuous authorization policy based on the discriminating information associated with the flag indicating whether or not the parameter is related to the context. In this case, it is easy to determine the conditions to be extracted, and it is possible to efficiently generate a continuous authorization policy.

  Next, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram of an authorization device according to an embodiment of the present invention.

  The authorization device includes a usage control unit 1, a situation detection unit 2, an information collection unit 3, an authorization control unit 4, a policy management unit 5, an attribute management unit 6, and an authorization determination unit 7.

  The usage control unit 1 is a part serving as an interface between the user and the authorization device. That is, the usage control unit 1 receives a usage request for information from the user, outputs the usage request to the authorization control unit 4, and receives the final authorization result input from the authorization control unit 4 to actually Providing information to users or refusing to provide information to users.

  The situation detection unit 2 is a part that collects information about a user's context or detects a change in context. That is, the situation detection unit 2 senses the context with the request from the information collection unit 3 as an input, outputs the acquired value to the information collection unit 3, and continues sensing periodically to change to the acquired value. Even if there is, the value is output to the information collecting unit 3. In this way, since the information collecting unit 3 is notified only when there is a change in context, the number of times of authorization is reduced compared with the case where the authorization control unit 4 periodically performs authorization, It is possible to reduce the load on the apparatus. The situation detection unit 2 is specifically an RFID (Radio Frequency Identification) reader that reads a tag attached to a card carried by a person.

  The information collecting unit 3 collects information related to user attributes and contexts. In other words, the information collection unit 3 receives a request for information necessary for authorization from the authorization control unit 4, outputs a request for information regarding the user's attribute to the attribute management unit 6, and sends it to the situation detection unit 2. In response, a request for information about the user's context is output. The information collecting unit 3 receives the input of information from the situation detecting unit 2 and outputs the information to the authorization control unit 4. At the time of continuous authorization, if there is an input for notification of a change in context from the status detection unit 2, this is output to the authorization control unit 4.

  The authorization control unit 4 is a part that controls the entire authorization device. That is, the authorization control unit 4 receives the usage request from the usage control unit 1, requests and acquires the corresponding policy from the policy management unit 5, and is necessary for authorization according to the conditions described in the policy. Since the attribute and context are known, the information collection unit 3 is requested and acquired. Then, the authorization control unit 4 outputs the acquired policy, attribute, and context to the authorization determination unit 7, and outputs the authorization result from the authorization determination unit 7 to the usage control unit 1. In the case of the first authorization, an instruction to automatically generate a continuous authorization policy is output to the policy management unit 5 at the time when the authorization is completed.

  The policy management unit 5 is a part that manages a policy necessary for determination and automatically generates a continuous authorization policy. That is, the policy management unit 5 receives the policy request from the authorization control unit 4 as an input, acquires the corresponding policy, and then outputs the acquired policy to the authorization control unit 4. Further, the policy management unit 5 inputs an instruction for generating a continuous authorization policy from the authorization control unit 4, automatically generates a continuous authorization policy, and stores it in the inside. Details of these processes will be described in the description of FIG.

  The attribute management unit 6 is a part for storing the user's attribute information, and receives the attribute request from the information collection unit 3 and outputs the corresponding attribute information to the information collection unit 3.

  The authorization determination unit 7 is a part that actually determines authorization based on the input from the authorization control unit 4. That is, the authorization determination unit 7 determines whether or not the user attribute information and context satisfy the conditions described in the policy, and outputs the authorization result to the authorization control unit 4.

  FIG. 2 is a block diagram showing the configuration of the policy management unit 5 of FIG. The portion for automatically generating the policy of the present invention is included in this portion. The policy management unit 5 includes a policy storage unit 21, a policy automatic generation unit 22, a control unit 23, and an attribute / context information acquisition unit 24.

  The policy storage unit 21 stores a policy for authorization. That is, the policy storage unit 21 receives the policy acquisition request from the control unit 23, outputs the corresponding policy to the control unit 23, and receives the storage request from the control unit 23 as an input, and the automatically generated continuous authorization Store the policy internally.

  The policy automatic generation unit 22 is a part that automatically generates a continuous authorization policy based on the initial authorization policy. That is, the policy automatic generation unit 22 receives an automatic generation instruction from the control unit 23, automatically generates a policy based on the input information, and then outputs the obtained continuous authorization policy to the control unit 23.

  The control unit 23 serves as an interface with the authorization control unit 4 in FIG. 1 and controls the entire policy management unit 5. That is, the control unit 23 receives the policy acquisition request from the authorization control unit 4 and outputs a corresponding policy acquisition request to the policy storage unit 21. In addition, the control unit 23 inputs the continuous authorization policy automatic generation request from the authorization control unit 4, and requests and obtains the discrimination information by the flag for discriminating the attribute and context from the attribute / context information acquisition unit 24. To do. Then, the control unit 23 outputs the discrimination information and the policy that is the basis of automatic generation to the policy automatic generation unit 22, and acquires the continuous authorization policy that is automatically generated by the policy automatic generation unit 22. The obtained policy is output to the policy storage unit 21 and stored until the next continuation authorization is performed.

  The attribute / context information acquisition unit 24 is a database that stores information for distinguishing attributes and contexts, which is necessary when automatic generation of a continuous authorization policy is performed. The attribute / context information acquisition unit 24 inputs an acquisition request from the control unit 23, Discrimination information for discriminating which of the contexts is output to the control unit 23.

  FIG. 3 is a flowchart showing the initial authorization process among the authorization processes performed in the authorization device of FIG. Hereinafter, the initial authorization processing procedure will be described with reference to FIG.

  First, the usage control unit 1 acquires a request for information usage from a user, and outputs this request to the authorization control unit 4 (step 101). The authorization control unit 4 that has acquired the request requests the policy management unit 5 for the corresponding policy, and acquires the initial authorization policy stored in the policy management unit 5 (step 102). Further, the authorization control unit 4 requests the information collection unit 3 for attributes / contexts required for authorization, and acquires information collected by the information collection unit 3 from the status detection unit 2 and the attribute management unit 6 (steps). 103). The authorization control unit 4 outputs information on the policy and the attribute / context to the authorization judgment unit 7 (step 104). The authorization determination unit 7 determines whether or not the information can be used based on the given information, and returns an authorization result to the authorization control unit 4 (step 105). When it is determined that the information can be used (Yes in Step 105), the authorization control unit 4 performs automatic authorization of the continuous authorization policy to the policy management unit 5 in order to perform continuous authorization for the information that has been provided. The policy management unit 5 automatically generates a policy (step 106). Details of the policy automatic generation processing will be described with reference to FIG. When the automatic policy generation is completed, the authorization control unit 4 notifies the usage control unit 1 of the authorization result, and the usage control unit 1 starts providing information to the user (step 107). This completes the initial authorization process.

  If it is determined in step 105 that the information cannot be used (No in step 105), the authorization control unit 4 notifies the usage control unit 1 of the authorization result, and the usage control unit 1 authorizes the user. The result is notified (step 108), and the initial authorization process ends.

  FIG. 4 is a flowchart of the continuous authorization process among the authorization processes performed in the authorization device of FIG. In the following, the procedure for continuous authorization will be described with reference to FIG.

  First, when the use control unit 1 obtains an information use end request from the user while providing information (Yes in Step 109), the use control unit 1 finishes providing information (Step 116). Then, the continuous authorization process is terminated.

  If there is no request for termination of information use (No in Step 109), the situation detection unit 2 monitors the change in context (Step 110). If no change is detected (No in Step 110), the step continues. 109 → Step 110 is repeated to monitor the end request or the occurrence of a context change.

  When a change in context is detected in step 110 (Yes in step 110), the status detection unit 2 notifies the information collection unit 3 of the change in context and further notifies the authorization control unit 4 of the change. . When the change in context is notified, the authorization control unit 4 requests the policy management unit 5 for the corresponding policy, and acquires the continuous authorization policy stored in the policy management unit 5 (step 111). The authorization control unit 4 requests the information collection unit 3 for information related to the context necessary for authorization, and acquires information collected by the information collection unit 3 from the situation detection unit 2 (step 112). The authorization control unit 4 outputs information about the policy and the context to the authorization determination unit 7, and the authorization determination unit 7 determines whether or not the information can be used based on the given information, and sends an authorization result to the authorization control unit 4. Return (step 113). If it is determined that the information can be used (Yes in step 113), the information can be used continuously. Therefore, the processing from step 109 to step 110 is repeated, and the occurrence of a termination request or a change in context is monitored.

  If it is determined in step 113 that the information cannot be used (No in step 113), the process proceeds to a process for stopping the provision of information. That is, the authorization processing unit 4 notifies the usage control unit 1 of the authorization result, the usage control unit 1 notifies the user of the authorization result (step 114), and stops providing information (step 115). . This is the end of the continuous authorization process.

  FIG. 5 is a flowchart of automatic generation processing of a continuous authorization policy performed in the policy management unit 5 of FIG. With reference to FIG. 5, the processing procedure for automatic policy generation will be described.

  First, the control unit 23 acquires a policy automatic generation instruction from the authorization control unit 4 (step 201). At this time, the initial authorization policy and information related to the initial authorization are acquired together (steps 202 and 203). The former is an extraction source of the continuous authorization policy, and the latter is information used in the processing of step 301 in FIG. It is possible to further narrow down the conditions included in the continuous authorization policy by generating the continuous authorization policy in consideration of which condition in the initial authorization policy was used for the determination of authorization. When the process of step 203 is completed, the control unit 23 determines whether the condition included in the given initial authorization policy is a condition for a parameter related to a user attribute or a condition for a parameter related to a context. Is obtained from the attribute / context information acquisition unit 24 (step 204). The information obtained by the control unit 23 in the above process is output to the policy automatic generation unit 22, and the policy automatic generation unit 22 performs a process of extracting the continuous authorization policy (step 205). Details of the processing in step 205 will be described with reference to FIG. The policy automatic generation unit 22 outputs the generated continuous authorization policy to the control unit 23, and the control unit 23 outputs the acquired policy to the policy storage unit 21 (step 206) to perform automatic generation processing of the continuous authorization policy. finish.

  FIG. 6 is a flowchart of a process for extracting the continuous authorization policy from the initial authorization policy. This processing is performed in the policy automatic generation unit 22. Hereinafter, the procedure of policy extraction processing will be described with reference to FIG.

  First, when the policy automatic generation unit 22 acquires a policy automatic generation instruction from the control unit 23, information regarding which condition is applied in the initial authorization is also acquired. Using this information, a condition for a parameter related to an attribute that is not true in the initial authorization is extracted and deleted (step 301). Next, a condition AND-connected with the condition extracted in step 301 is extracted and deleted (step 302). Since the condition extracted in step 301 is not true even in continuous authorization, the determination result is self-evident. The condition extracted by the process of step 302 does not need to be a criterion for determination in continuous authorization because the condition extracted by step 301 is not true. By deleting these conditions, the conditions included in the initial authorization policy can be greatly reduced.

  The following processing is recursively executed on each subtree from the end portion of the policy tree having a hierarchical structure. First, the processing target is moved to the end of the tree (step 303). If an unprocessed conditional clause remains in the processing target subtree (Yes in step 304), the processing target is transferred to the unprocessed subtree (step 307), and a condition for the attribute-related parameter exists in the conditional clause. It is checked whether or not (step 308). If the condition exists (Yes in step 308), it is checked whether the conditional clauses are connected by AND (step 309). In step 308, if the condition does not exist (No in step 308), or if the conditional clause is AND concatenation in step 309 (Yes in step 309), the condition for the parameter related to the attribute is deleted, and this is used as the value of the conditional clause. (Step 310). If the subtree is OR-connected in step 309 (No in step 309), true is set as the value of the conditional clause (step 310).

  After the above processing is completed, the processing again proceeds to step 304, and it is determined whether an unprocessed conditional clause remains in the subtree at the same depth as the processing target. If no unprocessed items remain (No in step 304), the processing target is moved to a subtree that is one step shallower (step 305). If the root of the policy tree has not been reached at this point (No in step 306), the process proceeds to step 304 again. When the process is finally finished up to the root of the policy tree (Yes in step 306), the policy extraction process is finished.

  FIG. 7 shows an example of a policy for initial authorization in a tree structure. The tree is composed of subtrees (401 to 404) connected by AND or OR, and the portions surrounded by squares (501 to 505) are a group of conditions constituting the policy. Among the conditions, those surrounded by a solid line are conditions for parameters relating to user attributes, and those surrounded by a dotted line are conditions for parameters relating to context. As an example, assuming that the user belongs to the general affairs section and the post is a general employee, first, in steps 301 to 302, the conditions 501 504 and 502 are deleted. Next, in step 303, the processing target moves to the subtree 404. In step 308, No is determined, and in step 310, the condition 505 is extracted. Next, the object of processing moves to the subtree 402, but since the conditional expression of the subtree 402 has already been deleted, the processing moves to the subtree 403. In step 308, Yes is determined, and in 309, Yes is determined. In step 310, the conditional expression 505 is extracted. The processing target moves to the subtree 401, and only the conditional expression 505 is extracted as the final continuous authorization policy. In FIG. 7, the tree including subtrees 401 to 404 is an example of a policy, conditional expressions 501, 503, and 504 are examples of conditions related to attributes, and conditional expressions 502 and 505 are examples of conditions related to contexts.

  Note that the function of the authorization device may be that a program for realizing the function is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read by the computer and executed. Good. The computer-readable recording medium refers to a recording medium such as a flexible disk, a magneto-optical disk, and a CD-ROM, and a storage device such as a hard disk device built in a computer system. Further, the computer-readable recording medium is a medium that dynamically holds the program for a short time (transmission medium or transmission wave) as in the case of transmitting the program via the Internet, and in the computer serving as a server in that case Such as a volatile memory that holds a program for a certain period of time.

It is a block diagram of the authorization apparatus of one Embodiment of this invention. It is a block diagram which shows the detail of the policy management part in an authorization apparatus. It is a flowchart of the process of initial authorization. It is a flowchart of a process of continuous authorization. It is a flowchart of a policy automatic generation process. It is a flowchart of the process which extracts a continuous authorization policy from a first time authorization policy. It is a figure which shows the example of the tree structure of the policy for initial authorization.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Usage control part 2 Situation detection part 3 Information collection part 4 Authorization control part 5 Policy management part 6 Attribute management part 7 Authorization judgment part 21 Policy storage part 22 Policy automatic generation part 23 Control part 24 Attribute / context information acquisition part 101-115 , 201-206, 301-310 Step 401-404 Subtree 501-505 Conditional expression

Claims (3)

A method for automatically generating a policy used for authorization in an authorization device that determines whether or not to permit the use of the information at the start or during provision of information,
The initial authorization policy for the initial authorization performed when the policy management unit starts providing information , and the initial authorization policy of the tree structure in which the conditions included in the initial authorization policy are connected by AND or OR. A first step of storing;
When the authorization control unit determines that the information can be used in the initial authorization, the second instruction outputs an instruction to automatically generate a continuous authorization policy for continuous authorization, which is authorization that is continuously performed thereafter. Steps,
When the policy management unit outputs an instruction to automatically generate the continuous authorization policy, the initial authorization policy and the conditions included in the initial authorization policy are conditions for a parameter relating to a user attribute or context A third step of obtaining information for determining whether the condition for the parameter is related to, and information regarding which condition is applied in the initial authorization,
The policy management unit uses, as a first condition, a condition for a parameter relating to an attribute that is not true in the initial authorization, and a condition AND-connected with the condition, among the conditions included in the initial authorization policy. A fourth step of extracting and deleting the extracted first condition;
Of the conditions included in the initial authorization policy, the policy management unit is AND-connected with other conditions that are conditions for parameters related to attributes from the conditions remaining after deleting the first condition A fifth step of extracting conditions and deleting the extracted conditions;
The policy management unit includes a sixth step in which a condition remaining after deleting the first and second conditions among the conditions included in the initial authorization policy is set as the continuous authorization policy. Method. In the authorization device that determines whether or not to permit the use of the information at the start or during the provision of the information,
Policy management unit for storing an initial authorization policy for initial authorization performed at the start of providing information and having a tree-structured initial authorization policy in which conditions included in the initial authorization policy are connected by AND or OR When,
If it is determined that the information can be used in the initial authorization, an authorization control unit that outputs an instruction to automatically generate a continuous authorization policy for continuous authorization, which is authorization performed continuously thereafter, is provided. And
The policy management unit
When the instruction for automatically generating the continuous authorization policy is output, whether the initial authorization policy and the conditions included in the initial authorization policy are conditions for a user attribute parameter or a context parameter And information on which conditions are applied in the initial authorization,
From the conditions included in the initial authorization policy, the condition for the parameter related to the attribute that is not true in the initial authorization and the condition AND-connected with the condition are extracted as the first condition and extracted. Delete the first condition,
Of the conditions included in the initial authorization policy, the condition remaining after deleting the first condition is a condition for the parameter relating to the attribute and the condition that is AND-connected to another condition is the second condition. And delete the extracted second condition as
The authorization apparatus, wherein the policy management unit sets the condition remaining after deleting the first and second conditions among the conditions included in the initial authorization policy as the continuous authorization policy . A program for causing a computer to operate as the authorization device according to claim 2 .

Images