JP5120207B2 - Role-based access control method, program, and computer - Google Patents

Description

  The present technology relates to a role-based access control technology in a process generated on an operating system (OS).

The concept of RBAC that controls access for each role is a general concept in the field of security. However, when RBAC is implemented in the OS, the OS normally recognizes one application executed by one user as one process and can grant different authority for each process. It is not possible to grant different privileges for each session. That is, in many cases, the application side cannot use the RBAC infrastructure of the OS.
JP 2007-41881 A

  When the RBAC base of the OS cannot be used, RBAC is mounted on an individual application. However, there is a problem that it takes time and effort and it is difficult to ensure completeness.

  Therefore, an object of the present technology is to save labor in mounting RBAC on an application and to suppress occurrence of problems.

  This role-based access control method is a method for referring to or updating an object of a data class generated for each data item defined in the authority data that defines the authority permitted for each role for each data item and function. This method is generated at the start of each session on the process in response to a request from the user and a step of detecting a method call to a method of an object of a function class generated for each function specified in the authority data. And acquiring the user identification information from the session object corresponding to the session identifier included in the method call among the session objects including the session identifier and the user identification information including the user identifier of the user and the user role; Object data acquisition step for acquiring a class type representing either a data item or a function and a class identification name representing a data item name or a function name from the method call target object, and a method executed in response to the method call When it is determined that the processing according to is legitimate in the authority data, the legitimacy determining step for determining whether the authority specified from the role, the class type, and the class identifier included in the user identification information is legitimate, Outputting a method call to the target object.

  It is possible to save labor in mounting RBAC on the application and to suppress the occurrence of problems.

[Embodiment 1]
1. FIG. 1 shows a functional block diagram of a program generation system according to an embodiment of the present technology. The program generation system according to the present embodiment includes an authority table 11, a class automatic generator 12 that automatically generates a necessary class using the authority table 11, and a plurality of function classes 131 generated by the class automatic generator 12. A function class storage unit 13 that stores data and a data class storage unit 14 that stores data of a plurality of data classes 141 generated by the automatic class generator 12 are included.

  FIG. 2 shows an example of the authority table 11. In the example of FIG. 2, “application + personal information”, “account information”, “application”, “result”, “order” are assigned to roles such as “customer”, “auditor”, “manager”, “broker”. ”,“ Fund ”,“ Transaction Information ”, and data items such as“ Open Account ”,“ Account Cancellation ”,“ Order of Transaction ”,“ Execute Transaction ”,“ Check Transaction Information ” For each, a reference right r, an update right w, or an execution right x is registered if it should be granted. Such a table is prepared by a developer of a system to be developed in the future.

  Next, processing of the automatic class generator 12 will be described with reference to FIGS. First, the automatic class generator 12 performs a function class generation process (FIG. 3: step S1). This function class generation process will be described with reference to FIGS.

  First, the automatic class generator 12 specifies one unprocessed function in the authority table 11 (step S11). Since the execution right x is defined for the function, one unprocessed function is specified from among the functions for which the execution right x is defined.

  Then, a corresponding function class is generated (step S13). In this process, the function class data of the model is read from, for example, the model storage unit of the automatic class generator 12. Then, in this function class, an automatically generated part that can set a class type and a class identifier is generated (step S15). Thereafter, “function” is set as the type value of the automatically generated portion (step S17). Further, the function name of the function specified in step S11 is set as the value of the class identification name of the automatically generated part (step S19). The function class data generated in this way is stored in the function class storage unit 13 (step S21).

  Thereafter, it is determined whether all functions have been processed (step S23). If there are unprocessed functions, the process returns to step S11. On the other hand, if all functions have been processed, the process ends.

  An example of the structure of the function class generated by such processing is shown in FIG. The function class 131 includes an automatic generation part and a customization part. In the automatic generation part, “function” is set as the value of the class type, and the name of each function (for example, “open account”) is set as the value of the class identifier. The customization part is the part where programmers can freely add and implement data fields and methods.

  If the customization part of all the function classes 131 stored in the function class storage unit 13 is implemented according to the policy described below, the classes required for the RBAC are not leaked for the functions defined in the authority table 11 Will be created.

  Returning to the description of the processing in FIG. 3, the automatic class generator 12 performs data class generation processing (step S3). This data class generation process will be described with reference to FIGS.

  First, the automatic class generator 12 specifies one unprocessed data item in the authority table 11 (step S31). Since the reference right r and the update right w are specified for the data item, one unprocessed data item is specified from the data items for which the reference right r and the update right w are specified.

  Then, a corresponding data class is generated (step S33). In this process, data of a template data class is read from, for example, a template storage unit included in the automatic class generator 12. Then, in this data class, an automatic generation part including the declaration part of the reference method and the update method for the data of the data item related to the process and capable of setting the type and class identifier is generated (step S35). Thereafter, “data” is set as the type value of the automatically generated portion (step S37). Further, the data item name of the data item specified in step S31 is set as the value of the class identification name of the automatically generated part (step S39). And the data of the data class 141 produced | generated in this way are stored in the data class storage part 14 (step S41).

  Thereafter, it is determined whether all data items have been processed (step S43). If there is an unprocessed data item, the process returns to step S31. On the other hand, if all data items have been processed, the process ends.

  An example of the structure of the data class 141 generated by such processing is shown in FIG. The data class 141 includes an automatically generated part. In the automatic generation portion, “data” is set as the value of the class type, and the name of each data item (for example, “account information”) is set as the value of the class identifier. Further, in the case of the data class 141, the automatic generation part includes the declaration part of the reference method and the declaration part of the update method. The specific contents of the reference process of the reference method and the specific contents of the update process of the update method are customization parts, and a part where the programmer performs the necessary process contents.

  As described above, if the customization part of all the data classes 141 stored in the data class storage unit 14 is implemented according to the policy described below, it is necessary for the RBAC with respect to the data items defined in the authority table 11. Class will be created without omission.

  As described above, the function class 131 and the data class 141 are automatically generated from the authority table 11, and the developer develops an application by programming the function class 131 and the data class 141. At this time, in the function class 131 and the data class 141, the automatic generation part is not changed. As described above, in the customization part of the function class 131, data fields and methods can be freely defined. Furthermore, necessary processing contents can be defined for the specific processing portion of the reference method of the data class 141 and the specific processing portion of the update method.

  For the methods of the function class 131 and the methods of other classes in the application, programming is performed so that access to the data items related to the data class 141 is performed using only the reference method and the update method of the data class 141. And

  That is, the entire application program to be constructed has a structure as shown in FIG. The server application 100 other than the function class 131 and the data class 141 calls a method in the customization part of the function classes 131a to 131c when executing the function targeted for RBAC. The method in the customization part of the function classes 131a to 131c is the reference method or update method in the corresponding data class of the data classes 141a to 141c when referring to or updating the data item to be subject to RBAC. To call. Although not shown in FIG. 8, when the server application 100 refers to or updates the data item that is the target of the RBAC, the reference method or the update method of the data classes 141a to 141c is called. To do.

  As described above, the function class 131 and the data class 141 necessary for the RBAC target function and data item are generated using the automatic class generator 12, and then the application program is developed according to the above-described policy. This eliminates the need for the RDAC to make a special judgment or additional implementation on the developer side, thereby reducing the effort of the developer and avoiding mounting omissions.

2. When executing an application program implemented as described above, an authority check unit described in detail below is introduced to perform an authority check during actual execution. The authority checking unit is a common library that checks whether access according to the authority table 11 is performed on the premise of the method call as described above. That is, the authority checking unit is not customized to an individual application program, but is implemented in a form that can be applied to any application program, so that the developer of the application program does not have to create it individually. By such an authority checking unit, the burden on the developer can be reduced, and if the method call as described above is guaranteed, the authority check is performed at the time of execution without omission.

  The system configuration at the time of execution is shown in FIG. A plurality of user terminals 1a and 1b and a server 3 that performs main processing in the present embodiment are connected to a network such as the Internet or an intranet. The server 3 is, for example, a normal computer and has a hardware configuration as described in FIG. The server 3 executes the OS 31 and also executes an object according to the present embodiment in one process on the OS 31. That is, even if the RBAC base is mounted on the OS 31, it cannot be used, and it is necessary to prepare an RBAC for each application.

  In addition, as constituent elements related to the present embodiment, the server application 100 that performs various processes, the object 135 of the function class 131 generated from the authority table 11 as described above, and the authority table in the same manner. 11, an object 145 of the data class 141 generated from 11, an authority checking unit 315 that performs the main processing in the present embodiment with reference to the authority table 11, and a specific method call (in accordance with an instruction from the authority checking unit 315) Specifically, it includes a method call capturing unit 311 that captures a method call of the function class 131, a method call for a reference method or an update method of the data class 141), and outputs the method call to the authority checking unit 315.

  For example, the server application 100 performs authentication processing in response to access from the user terminal 1a, identifies the user identifier and role of the user, and holds user identification information including the user identifier and role. A session object generation unit 110 that generates an object is included. The session object generation unit 110 itself has existed conventionally. The session object 313 generated by the session object generation unit 110 is identified by a session ID, and holds user identification information as described above. The authority checking unit 315 identifies the corresponding session object 313 with the session ID, and acquires user identification information.

  Further, as described above, the method call capturing unit 311 is designated as a target to capture the method call of the function class 131, the method call of the reference method or the update method of the data class 141, and performs the corresponding method call according to the specification. The captured method call is output to the authority checking unit 315. Specifically, all methods are specified when the class type of the class to which the method belongs is “function”, and the reference method and the update method are specified for the class type of the class to which the method belongs “data”. Such functions themselves are well known and will not be described further.

  In FIG. 9, the authority checking unit 315 refers to the customization rule 317, but the customization rule 317 is not used in the present embodiment. This will be described in detail in the third embodiment.

  Next, the operation of the system shown in FIG. 9 will be described with reference to FIGS. First, for example, at the time of user identification such as during authentication processing, the session object generation unit 110 identifies a user identifier (that is, user ID) and role, and generates a session object 313 including user identification information including the user ID and role ( Step S51).

  Further, the authority checking unit 315 requests the method call capturing unit 311 to capture the method call of the function class 131 and the method call of the reference and update methods of the data class 141 (step S53). The method call capturing unit 311 receives the method call capturing request from the authority checking unit 315, and sets the specified method call to be captured (step S55). The setting is held in a storage device such as a main memory.

  After that, when a method call is made by the application program 100 or the like (step S57), the method call capturing unit 311 confirms whether the method call conforms to the setting in step S55, and follows the setting. If there is, it is captured and output to the authority checking unit 315 (step S59). On the other hand, if the method call does not conform to the setting in step S55, it is output as it is to the destination object of the method call.

  When receiving the method call that requested the capture from the method call capturing unit 311 (step S61), the authority checking unit 315 automatically sets the automatically generated items (automatically generated items (set by the automatic class generator 12) from the object of the call target method). That is, the class type and class identification name.The class type is already known and may be excluded. In addition, if there are other items that are automatically set, the data is also included.) Obtain (step S63). The automatically generated item data is held in a storage device such as a main memory.

  Further, the authority checking unit 315 identifies the corresponding session object 313 from the session ID included in the captured method call, and acquires user identification information (user identifier and role) from the session object 313 (step S65). The user identification information is held in a storage device such as a main memory. And a process transfers to the process of FIG.

  Shifting to the description of the processing in FIG. 11, the authority checking unit 315 confirms whether or not the user identification information has been acquired as the processing result of Step S65, that is, whether or not the user identification has been completed (Step S67). If the user identification information cannot be acquired for some reason, that is, if the user identification is not completed, an exception is generated (step S73).

  On the other hand, when the user identification information can be acquired, the authority checking unit 315 updates the authority table 11 with the role included in the user identification information and the class type and class identification name included in the automatically generated item data. The corresponding authority is acquired by searching (step S69).

  Then, the authority checking unit 315 determines from the corresponding authority whether the request processing specified from the method call is permitted, that is, whether the access is valid (step S71). For example, when a method of the function class 131 is called, it is determined whether method execution for the function class 131 is permitted in the authority table 11 (in the example of FIG. 2, an “x” mark is attached). To do.

  For example, if the class type is “function”, the class identifier is “account opening”, and the role is “customer”, the execution is permitted in the authority table 11 (FIG. 2). ”Is acquired, and when the method of the function class 131 whose class type is“ function ”and whose class identification name is“ account opening ”is called, it is determined that the access is valid. On the other hand, if the role is “broker”, it is determined that the access is not authorized because it is not permitted.

  When the reference method or update method of the data class 141 is called, it is determined whether the reference r or update w for the data class 141 is permitted. For example, if the class type is “data”, the class identification name is “order”, and the role is “customer”, in the authority table 11 (FIG. 2), both reference and update are permitted. When the user identification information “customer” is acquired and the update method of the data class 141 with the class type “data” and the class identification name “order” is called, it is determined that the access is valid. The On the other hand, if the role is “broker”, it is determined that the access is not authorized because it is not permitted.

  If it is determined that the access is not legitimate, the authority checking unit 315 generates an exception (step S73). On the other hand, if it is determined that the access is valid, the method call is output to the callee object (step S75). The object 135 of the function class 131 or the object 145 of the data class 141, which is the call destination object, receives the method call and performs the requested processing (step S77). That is, normal processing is performed.

  As described above, an application configuration is adopted in which the method call to be subjected to the authority check is limited to the method call of any method of the function class 131 and the method call of the reference or update method of the data class 141. Therefore, the authority inspection unit 315 prepared in advance can perform necessary and sufficient authority inspection intensively. In other words, verification is performed simply by eliminating the effort of the developer and eliminating leakage.

[Embodiment 2]
1. When creating an application program In general, personal information such as account information may not be referred to or updated by anyone who has a role of customer, so that only the person himself, that is, the owner can refer / update it. Should. Therefore, in the present embodiment, as shown in FIG. 12, the first embodiment is modified so that only the owner has authority for the data item marked with (O) in the authority table 11. To do.

  Specifically, in step S35 of the data class generation process (FIG. 6), the automatic generation portion is generated so as to include the owner field. That is, as shown in FIG. 13A, an owner field for a role that can access data is provided in the automatic generation part of the data class. As a result, the user identifier of the specific owner user is specifically registered in the object of this data class.

2. At the time of program execution The basic system configuration at the time of execution is as shown in FIG. 9 for the first embodiment.

  Also for the processing flow, the automatically generated item data acquired in step S63 in FIG. 10 for the first embodiment includes the data of the owner field, that is, the user identifier of the owner.

  Further, the processing after the terminal A in FIG. 10 is as shown in FIG. 13B. The authority checking unit 315 confirms whether the user identification information has been acquired as the processing result of step S65, that is, whether the user identification has been completed (step S81). If the user identification information cannot be acquired for some reason, that is, if the user identification is not completed, an exception is generated (step S89).

  On the other hand, when the user identification information can be acquired, the authority checking unit 315 updates the authority table 11 with the role included in the user identification information and the class type and class identification name included in the automatically generated item data. The corresponding authority is acquired by searching (step S83).

  Further, the authority checking unit 315 confirms whether the user ID included in the user identification information and the user identifier of the owner included in the automatically generated item data match if the owner limitation is included in the corresponding authority. (Step S85).

  Then, the authority checking unit 315 determines from the corresponding authority whether the request processing specified from the method call is permitted, that is, whether the access is valid (step S87). Specifically, the same determination as in step S71 is performed, and when a method of the function class 131 is called, it is determined whether method execution for the function class 131 is permitted in the authority table 11, Furthermore, when the reference method or update method of the data class 141 is called, it is determined whether the reference r or update w for the data class 141 is permitted. In addition, in step S87, it is confirmed whether the user ID included in the user identification information matches the owner's user identifier.

  If there is a problem with any of these, the authority checking unit 315 generates an exception (step S89). On the other hand, if there is no problem and the access is valid, the authority checking unit 315 outputs a method call to the callee object (step S91). The object 135 of the function class 131 or the object 145 of the data class 141, which is the call destination object, receives the method call and performs the requested processing (step S93). That is, normal processing is performed.

  By adding the above-described modification, the authority checking unit 315 can also confirm access that only the owner can perform.

[Embodiment 3]
In this embodiment, it is assumed that fine access control that cannot be defined only by the authority table 11 as shown in FIGS. 2 and 12 is performed. In this case, since it cannot be dealt with only by the authority table, the customization rule 317 shown in FIG. 9 is introduced. The authority checking unit 315 refers to the authority table 11 and checks whether a customization rule such as (R0) or (R1) as shown in FIG. 14 is defined.

  For example, in the case of R0, the role of manager should not be the same person as the customer when opening an account or canceling the account. In the case of R1, the role of broker is It is a rule that a customer must be approved in advance for ordering or executing a transaction.

  It is assumed that the authority checking unit 315 can acquire not only automatically generated item data but also values of other data fields from the object 145 of the data class 141 and the object 135 of the function class 131.

  In the case of a rule such as R0 set in the account opening function, a data field called a customer ID field is defined in the customization part as shown in FIG.

  At the time of execution, the user ID of the customer of the opening account is set in the customer ID field in the object of the function class 131 related to the account opening. As a result, the authority checking unit 315 can determine whether the user ID (manager user ID) included in the user identification information matches the user ID in the customer ID field.

  In the customer ID field of the function class 131 object related to the account opening, the user ID of the customer of the opening account is set in advance by the method of the object itself or the method of the other function class 131 object. And

  That is, in the present embodiment, the method call of the method of the functional class 131 including itself by the method of the functional class 131 is excluded from the inspection target of the authority inspection unit 315. Specifically, the method calls to be captured by the method call capturing unit 311 are the method call of the method of the function class 131 and the method call of the reference method and the update method of the data class 141. The call source of the method call 131 is limited to the server application 100.

  In the case of a rule such as R1 set in the function of ordering a transaction, a data field called an approval broker is defined in the customization part as shown in FIG.

  Then, at the time of execution, the user ID of the approved broker is set in the approval broker in the object of the function class 131 called the order of the transaction. As a result, the authority checking unit 315 can determine whether the user ID (broker user ID) included in the user identification information matches the user ID in the approval broker field.

  Next, processing contents during program execution will be described. Note that the processing flow of FIG. 10 is almost the same. However, as described above, the method call to be captured, which is set in the method call capturing unit 311 from the authority checking unit 315, excludes the method call from the method of the function class 131, and from the server application 100. The method call is limited by the caller data included in the method call. Thereby, the method call capturing unit 311 captures the method call according to the setting.

  The processing after the terminal A is replaced with processing as shown in FIG. First, the authority checking unit 315 confirms whether user identification information has been acquired as a processing result of step S65, that is, whether user identification has been completed (step S101). If the user identification information cannot be acquired for some reason, that is, if the user identification is not completed, an exception is generated (step S113).

  On the other hand, when the user identification information can be acquired, the authority checking unit 315 updates the authority table 11 with the role included in the user identification information and the class type and class identification name included in the automatically generated item data. The corresponding authority is acquired by searching (step S103).

  Then, the authority checking unit 315 determines whether the acquired authority includes data indicating that the customization rule is set (step S105). If the data indicating that the customization rule is set is not included, the process proceeds to step S111. In the case of shifting to step S111, the same determination as in the first embodiment is performed.

  On the other hand, when the data indicating that the customization rule is set is included, the authority checking unit 315 extracts the customization rule from the customization rule 317 and determines the customization rule from the called object. Data necessary for this is acquired (step S107). For example, in the case of R0 described above, the customer user ID is read from the customer ID field. If it is R1, the user ID of the approved broker is read from the approved broker field.

  Then, the authority checking unit 315 determines whether the current method call conforms to the corresponding customization rule from the user identification information, the automatically generated item data, and the data acquired from the object (step S109). As described above, if it is R0, if the user ID included in the user identification information matches the user ID acquired from the object, it is against the customization rule. For R1, if the user ID included in the user identification information matches the user ID acquired from the object, the customization rule is followed.

  From the data thus obtained, it is determined whether or not the current method call is a legitimate access (step S111). If it is not determined to be legitimate, the authority checking unit 315 generates an exception (step S113). ). On the other hand, if the access is legitimate, the authority checking unit 315 outputs a method call to the call destination object (step S115). The object 135 of the function class 131 or the object 145 of the data class 141, which is a call destination object, receives the method call and performs the requested processing (step S117). That is, normal processing is performed.

  As described above, by defining the customization rule 317 outside the authority checking unit 315 and the authority checking unit 315 performing the above-described processing, various authority confirmations can be performed. It should be noted that a processing unit that performs an authority check on the customization rule instead of the customization rule 317 may be provided outside the authority check unit 315. In that case, in this case, when it is detected that the customization rule is defined, the authority checking unit 315 activates the processing unit, and the processing unit acquires necessary data from the authority checking unit 315. Request to do. Then, the processing unit determines from the data obtained from the authority checking unit 315 whether the customization rule is followed.

[Other embodiments]
Until now, the authority table 11 has been described on the premise that the developer prepares in advance. However, using the use case diagram in UML (Unified Modeling Language), which is often used in development, The authority table 11 may be automatically generated from the use case diagram. This enables automatic generation from the documents required for development, thereby reducing extra work and reducing oversight of authority settings. In addition, use case diagrams can be drawn intuitively, so they are easier to prepare than the authority table format.

  For example, the developer prepares an extended use case diagram as shown in FIG. Usually, in the central system, necessary functions are listed as ellipses, and actors related to the functions are connected by lines. In this example, account opening (Open Account), account cancellation (Close Account), trade order (Receive Trade Order), trade execution (Perform Trade), trade information check (Check Trade Info) are defined as functions. Yes. Note that << A >> represents a function that must be provided. In addition, customers, auditors, managers, and brokers are defined as actors. The customer is related to functions such as opening an account, closing an account, ordering a transaction, executing a transaction, the auditor is related to the function of checking transaction information, and the manager is responsible for the function of opening an account and closing the account. Relatedly, brokers are related to the functions of ordering trades and executing trades.

  In addition to such a normal description, it is necessary to additionally describe data related to each association and an arrow indicating reference / update of the data.

  Specifically, data 1001a of application + personal information (Request + Personal Info) is defined between the customer and the account opening, and an arrow 1001b from the actor to the function representing the reference update authority is also defined. Yes. Similarly, data 1002a called account information (Account Info) is defined between the customer and the account opening, and an arrow 1002b from the function to the actor representing the reference authority is also defined.

  Furthermore, data 1003a called “Result” is defined between the customer and the account cancellation, and an arrow 1003b from the function to the actor representing the reference authority is also defined. Similarly, an application (Rquest) data 1004a is defined between the customer and the account cancellation, and an actor-to-function arrow 1004b representing the reference update authority is also defined.

  Further, data 1005a called “Order” is defined between the customer and the order of the transaction, and an arrow 1005b from the actor to the function representing the reference update authority is also defined.

  Furthermore, data 1006a called “Money” is defined between the customer and the execution of the transaction, and an arrow 1006b from the actor to the function representing the reference update authority is also defined.

  Further, data 1007a called transaction information (Trade Info) is defined between the auditor and the transaction information check, and an arrow 1007b from the function to the actor representing the reference authority is also defined.

  Further, data 1008a of application + personal information (Request + Personal Info) is defined between the manager and the account opening, and an arrow 1008b from the function to the actor representing the reference authority is also defined. Further, data 1009a called account information (Account Info) is defined between the manager and the account opening, and an arrow 1009b from the actor to the function representing the reference update authority is also defined. Further, data 1010a called “Request” is defined between the manager and the account cancellation, and an arrow 1010b from the function to the actor representing the reference authority is also defined. Furthermore, data 1011a called “Result” is defined between the manager and the account cancellation, and an arrow 1011b from the actor to the function representing the reference update authority is also defined.

  Further, data 1012a called “Order” is defined between the broker and the order of the transaction, and an arrow 1012b from the function to the actor representing the reference authority is also defined. Further, data 1013a called money is defined between the broker and the execution of the transaction, and an arrow 1013b from the actor to the function representing the reference update authority is also defined.

  Note that << C2 >> included in the data represents data that should not be leaked, and << I >> represents that tampering is not possible.

  After preparing such data as electronic data, the authority table generation program is caused to execute the following processing.

  Specifically, the connection between the actor and the function is detected, and the actor is set to be given execution authority for the connected function (FIG. 19: step S201). Thus, in the example of FIG. 18, the customer has the authority to execute four functions, the auditor has the authority to execute one function, the manager has the authority to execute two functions, and the broker has two functions. You will get the right to execute the function.

  If data exists between the actor and the function, the flow from the actor to the function (arrow) is detected, and the actor is set to be given reference update authority for the target data (step S203). ). For the data 1001a, the data 1004a, the data 1005a, the data 1006a, the data 1009a, the data 1011a, and the data 1013a, since an arrow from the actor to the function is set, the reference update authority is given to the actor.

  Further, when data exists between the actor and the function, a flow (arrow) from the function to the actor is detected, and the actor is set to be given reference authority for the target data (step S205). . For data 1002a, data 1003a, data 1007a, data 1008a, data 1010a, and data 1012a, an arrow from the function to the actor is set, so that the reference authority is given to the actor.

  Further, a portion where the << C2 >> property is assigned to the data is detected, and setting is made so that only the owner's authority for the target data is given to the target actor (step S207). In FIG. 18, since the << C2 >> property is assigned to all data, all data has the authority of only the owner.

  By executing such processing, an authority table as shown in FIG. 20 is generated. Since this is almost the same as FIG. 12, further explanation is omitted.

  If the above processing is performed, the authority table 11 can be automatically generated.

  Although the embodiment of the present technology has been described above, the present technology is not limited to this. For example, as for the processing flow, as long as the processing result does not change, the order of the steps may be changed or may be executed in parallel.

  Further, an example in which a necessary function is realized by one server has been shown. However, if an environment in which the authority checking unit 315 can operate with a plurality of servers is prepared, a plurality of servers can be connected in parallel or in cooperation. It is also possible to adopt a configuration that operates in the same manner.

  The server and user terminal are computer devices, and as shown in FIG. 21, a memory 2501, a CPU 2503, a hard disk drive (HDD) 2505, a display control unit 2507 connected to the display device 2509, and a removable disk 2511. Drive device 2513, input device 2515, and communication control unit 2517 for connecting to a network are connected by a bus 2519. An operating system (OS) and an application program for executing the processing in this embodiment are stored in the HDD 2505, and are read from the HDD 2505 to the memory 2501 when executed by the CPU 2503. If necessary, the CPU 2503 controls the display control unit 2507, the communication control unit 2517, and the drive device 2513 to perform necessary operations. Further, data in the middle of processing is stored in the memory 2501 and stored in the HDD 2505 if necessary. In the embodiment of the present invention, an application program for performing the above-described processing is stored in a computer-readable removable disk 2511 and distributed, and installed in the HDD 2505 from the drive device 2513. In some cases, the HDD 2505 may be installed via a network such as the Internet and the communication control unit 2517. Such a computer apparatus realizes various functions as described above by organically cooperating hardware such as the CPU 2503 and the memory 2501 described above, the OS, and necessary application programs.

  This embodiment is summarized as follows.

  This role-based access control method is a method for referring to or updating an object of a data class generated for each data item defined in the authority data that defines the authority permitted for each role for each data item and function. This method is generated at the start of each session on the process in response to a request from the user and a step of detecting a method call to a method of an object of a function class generated for each function specified in the authority data. And acquiring the user identification information from the session object corresponding to the session identifier included in the method call among the session objects including the session identifier and the user identification information including the user identifier of the user and the user role; Object data acquisition step for acquiring a class type representing either a data item or a function and a class identification name representing a data item name or a function name from the method call target object, and a method executed in response to the method call When it is determined that the processing according to is legitimate in the authority data, the legitimacy determining step for determining whether the authority specified from the role, the class type, and the class identifier included in the user identification information is legitimate, Outputting a method call to the target object.

  By performing such processing, RBAC can be realized for each session on the process that is judged as one user in the OS. In addition, since the method call for the function class and the data class generated for the data item and function defined in the authority data (the authority table in the embodiment) is captured, it is only determined whether the authority data is complied with. The process of confirming the authority from the captured method call can be made common, and the developer can save the trouble of implementing each application.

  In the object data acquisition step described above, if the detected object of the method invocation is an object of the data class and the target object includes owner data of the target object, the owner data May be included. Then, the legitimacy determination step described above is acquired when the authority that can only be owned by the owner is included in the authority specified from the role, the class type, and the class identifier included in the user identification information in the authority data. A step of determining whether the owner data matches the user identifier included in the user identification information may be included.

  This makes it possible to determine whether or not the data item can be referred to or updated only by the owner.

  Furthermore, when the above-described legitimacy determination step defines additional restriction rules for the authority specified from the role, class type, and class identification name included in the user identification information in the authority data, A step of obtaining restriction rule data, a step of obtaining additional restriction data that is required to be confirmed in the data of the additional restriction rule and defined in the target object, and the additional restriction data satisfies the additional restriction rule. A step of determining whether or not. In this way, customization rules are defined for various authority data, and only processing according to the customization rules is executed.

  A program for causing a computer to execute the method according to the present invention can be created, and the program is a computer-readable storage such as a flexible disk, a CD-ROM, a magneto-optical disk, a semiconductor memory, and a hard disk. Stored in a medium or storage device. Note that data being processed is temporarily stored in a storage device such as a computer memory.

(Appendix 1)
Method call for the reference method or update method of the object of the data class generated for each data item defined in the authority data that defines the authority permitted for each role for each data item and function, or the authority Detecting a method call to a method of an object of a function class generated for each function defined in data;
Included in the method call out of session objects generated at the start of each session on the process in response to a request from the user and including a session identifier and user identification information including the user identifier of the user and the role of the user Obtaining the user identification information from a session object corresponding to the session identifier
An object data acquisition step of acquiring a class type representing either the data item or the function and a class identification name representing a data item name or a function name from the detected object of the method call;
Validity to determine whether the processing by the method executed in response to the method call is valid in the authority specified from the role, the class type, and the class identification name included in the user identification information in the authority data Sex determination step;
Outputting the method call to the target object when it is determined to be valid;
A program that causes a computer to execute.

(Appendix 2)
The object data acquisition step includes
When the detected target object of the method call is an object of the data class and the target object includes owner data of the target object, the method includes the step of obtaining the owner data;
The legitimacy determining step includes
In the authority data, when the authority specified by the role, the class type, and the class identifier included in the user identification information includes an authority that can only be owned by the owner, the acquired owner data is the user The program according to appendix 1, including a step of determining whether or not the user identifier included in the identification information matches.

(Appendix 3)
The legitimacy determining step includes
When an additional restriction rule is defined for the authority specified from the role, the class type, and the class identification name included in the user identification information in the authority data, obtaining data of the additional restriction rule When,
Obtaining additional defined data that is required to be confirmed in the data of the additional restriction rule and is defined in the target object;
Determining whether the additional regulatory data satisfies the additional restriction rule;
Supplementary note 1 or 2 program including.

(Appendix 4)
Method call for the reference method or update method of the object of the data class generated for each data item defined in the authority data that defines the authority permitted for each role for each data item and function, or the authority Detecting a method call to a method of an object of a function class generated for each function defined in data;
Included in the method call out of session objects generated at the start of each session on the process in response to a request from the user and including a session identifier and user identification information including the user identifier of the user and the role of the user Obtaining the user identification information from a session object corresponding to the session identifier
An object data acquisition step of acquiring a class type representing either the data item or the function and a class identification name representing a data item name or a function name from the detected object of the method call;
Validity to determine whether the processing by the method executed in response to the method call is valid in the authority specified from the role, the class type, and the class identification name included in the user identification information in the authority data Sex determination step;
Outputting the method call to the target object when it is determined to be valid;
A role-based access control method executed on a computer.

(Appendix 5)
Method call for the reference method or update method of the object of the data class generated for each data item defined in the authority data that defines the authority permitted for each role for each data item and function, or the authority Means for obtaining a method call for a method of an object of a function class generated for each function defined in data;
Included in the method call out of session objects generated at the start of each session on the process in response to a request from the user and including a session identifier and user identification information including the user identifier of the user and the role of the user Means for obtaining the user identification information from a session object corresponding to the session identifier
An object data acquisition means for acquiring a class type representing either the data item or the function and a class identification name representing a data item name or a function name from the acquired object of the method call;
Validity to determine whether the processing by the method executed in response to the method call is valid in the authority specified from the role, the class type, and the class identification name included in the user identification information in the authority data Sex judgment means,
Means for outputting the method call to the target object when it is determined to be valid;
Having a computer.

It is a functional block diagram at the time of the program creation in embodiment of this technique. It is a figure which shows an example of the authority table in 1st Embodiment. It is a figure which shows the processing flow at the time of program creation. It is a figure which shows the processing flow of a function class production | generation process. It is a figure which shows the structure of a function class typically. It is a figure which shows the processing flow of a data class production | generation process. It is a figure which shows the structure of a data class typically. It is a figure which shows typically the structure of the application after program construction. It is a figure which shows the system configuration | structure at the time of program execution. It is a figure which shows the processing flow at the time of program execution. It is a figure which shows the processing flow at the time of the program execution in 1st Embodiment. It is a figure which shows an example of the authority table in 2nd Embodiment. It is a figure which shows an example of the structure of the data class in 2nd Embodiment. It is a figure which shows the processing flow at the time of the program execution in 2nd Embodiment. It is a figure which shows an example of the authority table in 3rd Embodiment. It is a figure for demonstrating the structure of the function class in 3rd Embodiment. It is a figure for demonstrating the structure of the function class in 3rd Embodiment. It is a figure which shows the processing flow at the time of the program execution in 3rd Embodiment. It is a use case figure used in other embodiment. It is a figure which shows the processing flow of the process for producing | generating an authority table from a use case figure. It is a figure which shows an example of the authority table produced | generated in other embodiment. It is a functional block diagram of a computer.

Explanation of symbols

DESCRIPTION OF SYMBOLS 11 Authority table 12 Class automatic generator 13 Function class storage part 14 Data class storage part 1a, 1b User terminal 3 Server 31 OS
DESCRIPTION OF SYMBOLS 100 Server application 110 Session object production | generation part 311 Method call capture part 313 Session object 315 Authority inspection part 317 Customization rule 135 Function class object 145 Data class object

Claims (5)

Method call for the reference method or update method of the object of the data class generated for each data item defined in the authority data that defines the authority permitted for each role for each data item and function, or the authority Detecting a method call to a method of an object of a function class generated for each function defined in data;
Included in the method call out of session objects generated at the start of each session on the process in response to a request from the user and including a session identifier and user identification information including the user identifier of the user and the role of the user Obtaining the user identification information from a session object corresponding to the session identifier
An object data acquisition step of acquiring a class type representing either the data item or the function and a class identification name representing a data item name or a function name from the detected object of the method call;
Validity to determine whether the processing by the method executed in response to the method call is valid in the authority specified from the role, the class type, and the class identification name included in the user identification information in the authority data Sex determination step;
Outputting the method call to the target object when it is determined to be valid;
A program that causes a computer to execute. The object data acquisition step includes
When the detected target object of the method call is an object of the data class and the target object includes owner data of the target object, the method includes the step of obtaining the owner data;
The legitimacy determining step includes
In the authority data, when the authority specified by the role, the class type, and the class identifier included in the user identification information includes an authority that can only be owned by the owner, the acquired owner data is the user The program according to claim 1, further comprising: determining whether or not the user identifier included in the identification information matches. The legitimacy determining step includes
When an additional restriction rule is defined for the authority specified from the role, the class type, and the class identification name included in the user identification information in the authority data, obtaining data of the additional restriction rule When,
Obtaining additional defined data that is required to be confirmed in the data of the additional restriction rule and is defined in the target object;
Determining whether the additional regulatory data satisfies the additional restriction rule;
The program according to claim 1 or 2, comprising: Method call for the reference method or update method of the object of the data class generated for each data item defined in the authority data that defines the authority permitted for each role for each data item and function, or the authority Detecting a method call to a method of an object of a function class generated for each function defined in data;
Included in the method call out of session objects generated at the start of each session on the process in response to a request from the user and including a session identifier and user identification information including the user identifier of the user and the role of the user Obtaining the user identification information from a session object corresponding to the session identifier
An object data acquisition step of acquiring a class type representing either the data item or the function and a class identification name representing a data item name or a function name from the detected object of the method call;
Validity to determine whether the processing by the method executed in response to the method call is valid in the authority specified from the role, the class type, and the class identification name included in the user identification information in the authority data Sex determination step;
Outputting the method call to the target object when it is determined to be valid;
A role-based access control method executed on a computer. Method call for the reference method or update method of the object of the data class generated for each data item defined in the authority data that defines the authority permitted for each role for each data item and function, or the authority Means for obtaining a method call for a method of an object of a function class generated for each function defined in data;
Included in the method call out of session objects generated at the start of each session on the process in response to a request from the user and including a session identifier and user identification information including the user identifier of the user and the role of the user Means for obtaining the user identification information from a session object corresponding to the session identifier
An object data acquisition means for acquiring a class type representing either the data item or the function and a class identification name representing a data item name or a function name from the acquired object of the method call;
Validity to determine whether the processing by the method executed in response to the method call is valid in the authority specified from the role, the class type, and the class identification name included in the user identification information in the authority data Sex judgment means,
Means for outputting the method call to the target object when it is determined to be valid;
Having a computer.

Images