KR102227363B1 - System and method for controlling data access of multy hierarchy structure - Google Patents

Abstract

Disclosed is a data access control system and method of a multi-layered structure. In the present invention, it is possible to quickly search for access control rights in a structure having a plurality of hierarchies, and by removing or editing a specific data group through the access control list, it is possible to prevent the occurrence of an unconditional inheritance effect.

Description

Multi-layered data access control system and method TECHNICAL FIELD [SYSTEM AND METHOD FOR CONTROLLING DATA ACCESS OF MULTY HIERARCHY STRUCTURE}

The present invention relates to a data access control system and method of a multi-tiered structure, and more particularly, to a data access control system and method of a multi-tiered structure capable of quickly searching for access control rights in a structure having a plurality of hierarchies. About.

The development of computer technology and communication technology not only brought about many changes in the way companies work, but also created various businesses.

In recent years, the share of IT in the business of a company is increasing, and it is said to differentiate between success and failure of a company.

Corporate IT is used for business management, development and production management, supply management, and customer management, which are the core functions of a company. In each of these functions, IT is used for purposes such as cost reduction, quality improvement, and strategy.

The development of the Internet has brought a drastic change in the business environment, and has faced business challenges such as promotion of new business directions and models, minimization of time to market entry, and competitive integration and division.

In general, access means that a user or a mobile terminal such as a smart phone or tablet PC and a terminal including a desktop PC and a notebook PC perform operations such as reading, writing, and executing data stored in other terminals. it means.

In addition, the access subject may include a terminal and a user of the terminal, another terminal connected through a network, and a user of another terminal.

When the access authority accesses data, it indicates whether access is possible or what actions are allowed to access.

In the case of allowing different subjects to access the plurality of data stored in the terminal, the terminal can grant different access rights to the plurality of access subjects to protect the data. It is called access control.

Particularly, when a directory service is provided in a single system, a conventional access control device may control access of a terminal to data and a data set stored in the access control device.

Here, data and data sets may be distributed in a hierarchically structured storage space. Then, the access control apparatus may control the access of the terminal to the data by defining each terminal that can access each layer.

However, in the conventional access control apparatus, a terminal allowed to access data stored in an upper layer may inherit an access control policy to a lower level so that access to data in a lower layer is possible.

1 is a block diagram illustrating a data access control process of a multi-layer structure according to the prior art.

As shown in FIG. 1,'I' as the highest data set 10,'I'1' and'I'2' as the upper data sets 20 and 21, and the lower data sets 30 and 31 In the hierarchical structure consisting of'I'1' and'I'2', the terminal with access rights to the top data set 10,'I', is the lower data set'I'1' and'I'. 2','I'1' and'I'2' can be accessed.

On the contrary, a terminal with access rights to'I'1' or'I'2', which is a lower data set (30, 31), is'I'2', which is not related to'I'1', which is an upper data set (20). There is a problem that the data of the upper data set 21 cannot be accessed.

Of course, the access control list is also inherited when the lower data set is created by creating an access control list.

However, there is a problem that access rights do not increase as it goes to the lower data set, but the number of accessible data decreases as restrictions increase.

In addition, when the multi-layered structure is composed of, for example,'N' layers, if the terminal has access rights to the data set of the lowest layer'N', when the terminal wants to access the top data set, to check whether there is access rights. There is a problem in that the overall system performance is degraded because the upper data set must be searched continuously and the maximum'N' times must be checked.

Document 1. Korean Registered Patent Publication No. 10-0681114 (Name of invention: User access right control method in access right control system) Document 2. Korean Patent Application Laid-Open Publication No. 10-2018-0090053 (Name of invention: Server providing service and operation method of the server)

In order to solve this problem, an object of the present invention is to provide a data access control system and method of a multi-layered structure capable of quickly searching for access control rights in a structure having a plurality of hierarchies.

In order to achieve the above object, a data access control system of a multi-layered structure according to an embodiment of the present invention is divided into an upper layer and a lower layer, and creates and removes a data group consisting of arbitrary data, and A data group management unit that manages according to a pre-set layer identification information and a dependency relationship; And an access right management unit generating an access control list storing accessible data group information based on the layer identification information of the data group for each layer and a dependency relationship.

In addition, the access control list according to an embodiment of the present invention is characterized in that it further includes at least one execution permission information of read, write, and save.

In addition, the access control list according to an embodiment of the present invention is characterized in that it further includes at least one specific access right in order to have access right to a specific function.

In addition, the access control list according to an embodiment of the present invention is characterized in that it includes information on a data group dependent on a hierarchical structure.

In addition, the access control list according to an embodiment of the present invention is characterized in that it further includes information on a data group that is not dependent on a hierarchical structure.

In addition, in the access control list according to an embodiment of the present invention, when a data group of a lower data group is changed through a hierarchy change, the access authority of the lower data group is changed to the access authority held by the new changed immediate upper data group. It is characterized in that the access rights are readjusted within the range of.

A data access control method of a multi-layered structure according to an embodiment of the present invention includes: a) performing, by a data group management unit, authenticating a terminal requesting an access right to an arbitrary data group; b) when authentication of the terminal is completed, transmitting, by the data group management unit, a pre-stored access control list corresponding to an arbitrary data group to the terminal; And c) when the data group management unit reflects the change in the dependency relationship between the upper and lower layers of the data group, the access right management unit reflects the accessible data group information based on the identification information of the data group by layer. And performing an update of the list.

The access control list according to an embodiment of the present invention is characterized in that it includes at least one of information on a data group dependent on a hierarchical structure and information on a data group not dependent on the hierarchical structure.

The present invention has the advantage of being able to quickly search for access control rights in a structure having a plurality of hierarchies.

In addition, the present invention has the advantage of preventing occurrence of an unconditional inheritance effect by removing or editing a specific data group through the access control list.

1 is a block diagram illustrating a data access control process of a multi-layered structure according to the prior art.
2 is a block diagram schematically illustrating a data access control system of a multi-layered structure according to an embodiment of the present invention.
3 is a block diagram showing the configuration of an access control management server of the data access control system of a multi-layered structure according to the embodiment of FIG. 2.
FIG. 4 is an exemplary view for explaining a process of generating an access control list of the data access control system having a multi-layered structure according to the embodiment of FIG. 2.
FIG. 5 is an exemplary view for explaining the dependency of access right information of the data access control system of a multi-layered structure according to the embodiment of FIG. 2.
6 is an exemplary view for explaining an access control list according to FIG. 4.
7 is a flowchart illustrating an operation process of a data access control system having a multi-layered structure according to an embodiment of the present invention.

Hereinafter, preferred embodiments of a multi-layered data access control system and method according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

In the present specification, the expression that a certain part "includes" a certain component does not exclude other components, but means that other components may be further included.

In addition, terms such as "... unit", "... group", and "... module" mean units that process at least one function or operation, which can be classified into hardware, software, or a combination of the two.

FIG. 2 is a block diagram schematically showing a data access control system of a multi-layered structure according to an embodiment of the present invention, and FIG. 3 is an access control management server of the data access control system of a multi-layered structure according to the embodiment of FIG. FIG. 4 is a block diagram showing the configuration of, and FIG. 4 is an exemplary diagram for explaining a process of generating an access control list of the multi-layered data access control system according to the embodiment of FIG. 2, and FIG. 5 is an embodiment of FIG. 2 An exemplary diagram for explaining the dependency of access right information of a data access control system having a multi-layer structure according to FIG. 6 is an exemplary diagram for explaining an access control list according to FIG. 4, and FIG. 7 is an embodiment of the present invention. This is a flow chart for explaining the operation of a data access control system of a multi-layered structure according to an example.

As shown in FIGS. 2 to 7, the data access control system of a multi-layered structure according to an embodiment of the present invention provides an access control management server 100 to quickly search for access control rights in a structure having a plurality of layers. ), and terminal 1 (200a), terminal 2 (200b) to terminal n (200c) consisting of a plurality of terminals (200).

The access control management server 100 manages a set of divided data having a hierarchical structure in which accessibility is determined according to authority, that is, creation, removal, and change of data groups, and a double layer (multi-layer) to which each data group is connected. As a configuration for managing the inheritance and inclusion relationship between hierarchies of the structure, it includes a data group management unit 110 and an access right management unit 120.

The data group is a set of divided data having a hierarchical structure in a logical concept, and in a service concept, a set of data managed by branches, departments, etc. divided according to the structure of a company.

The data group management unit 110 is configured to include arbitrary data and access rights, and manages including data change, access rights change, and data group removal of a data group having a double-layered structure divided into an upper layer and a lower layer. Perform.

In addition, the data group management unit 110 may classify and manage the data group having a multi-hierarchical structure according to the hierarchy identification information corresponding to the position of the hierarchical structure generated and the dependency relationship.

That is, the independently generated top data group A (300), the top data group B1 (310) and the top data group B2 (311) can be subordinately generated under the top data group A (300), and the A lower data group C1 (320) and a lower data group C2 (321) can be created depending on the lower level of the upper data group B1, and the lowest data group D1 (330) and the lowest data group D2 are dependent on the lower data group C2. In the case of generating 331, information on the position of each data group by layer and dependency relationship may be included.

In addition, the data group management unit 110 may control data that can be accessed and used by a user according to a layer, and may inherit authority control from an upper layer to a lower layer as it is.

That is, the data group creator accessed through the terminal 200 in order to create a data group must have access rights for setting the data group in a multi-layered structure, and basically, the newly created data group is owned by the immediate higher data group. It can be created by assigning access rights within the access rights range.

In addition, the data group management unit 110 can be set so that the lower layer can additionally control the authority within the inherited one when necessary, but the lower layer cannot access data that cannot be used in the upper layer. have.

That is, in the lower layer, the authority can be granted only within the data and functions that can be used in the upper layer.

In addition, the data group management unit 110 may generate an access right 500 configured by further including at least one or more specific access rights in order to have an access right for a specific function in the access control list 400.

In other words, for the convenience of data access, access rights may be organized by grouping access rights appropriate to the nature of the access rights.

As shown in Fig. 5, access rights to the data group essential for sending messages, for example, list (RW) access rights 1 510 for list creation, are subscription (RW) access rights 2 520 is a required condition, and the subscription (RW) access right 2 520 may be configured such that the e-mail (RW) access right 3 530 is included as a required condition.

If an access right that satisfies all essential conditions is not retained for a specific function having the above required conditions, it can be configured so that the setting right for the corresponding function is not granted.

In addition, in the case of a data group having a lower layer, the data group management unit 110 may modify a lower data group, and when modifying a lower data group, the data group manager 110 may modify within the range of the immediate upper data group.

In addition, the data group management unit 110 may move an arbitrary data group to a lower layer of another data group, or may move another data group to a lower layer of the data group.

In addition, the data group management unit 110 may delete a lower data group held in a lower layer of an arbitrary data group, and when deleting a data group including a lower data group, the data group included in the lower layer is also deleted. I can.

The access right management unit 120 creates and manages the access control list 400 storing accessible data group information based on the layer identification information and the dependency relationship of the data group generated for each layer.

The access control list 400 is accessible in a hierarchical structure from an arbitrary data group, and includes data group information of a subordinate higher layer.

That is, when the upper data group 1 310 is created, the B1 access control data 410 is generated, and when the upper data group 2 311 is generated, the B2 access control data 420 is generated, and the lower data group 1 ( 320) is created, C1 access control data 430 is created, when lower data group 2 321 is created, C2 access control data 440 is created, and when lower data group 1 330 is created, D1 access control Data 450 is generated, and when the lowest data group 2 331 is generated, D2 access control data 460 is generated.

In addition, the generated access control data is at least one of read (R), write (W), read-only (RO), and storage, along with information on the accessible data groups 461 and 463, as shown in FIG. 6. It may be configured to include information on the authority (462, 464) for the execution of the.

Through the access control data 400, it is possible to search once without continuing to search for an upper layer.

In addition, since a read request or the like may occur for a data group that is not dependent on a hierarchical structure, information on the data group 463 that is not dependent may be included, and the authority 464 may be set so that only read is possible.

On the other hand, the data group of the upper layer may have the right to set the data group of the immediate lower layer of the corresponding data group, but when the data group of the direct upper layer is changed through the layer change of the lower data group, the lower data group The access rights can be re-adjusted to the range of the access rights held by the new and changed immediate parent data group.

That is, when the lowest data group D1 330 is moved to a lower layer of the upper data group B2 311, for example, it is changed to a lower layer of the upper data group B2 311, which is a new upper data group. New rights may be received within the range of the access rights held by the upper data group B2 311.

The following describes a data access control process of a multi-layered structure according to an embodiment of the present invention.

The data group management unit 110 performs authentication of the terminal 200 requesting access rights to a random data group (S100).

When the authentication of the terminal 200 is completed, the terminal 200 is grouped into access rights related to the task of the responsible role, and the authority is controlled based on the set role, and the function and data are applied according to the assigned role. The data group management unit 110 provides a pre-stored access control list 400 corresponding to the data group accessed to the terminal 200 so as to be accessible (S200).

The data group management unit 110 is a subordinate relationship of the upper layer and the lower layer of the data group in charge of the terminal 200, that is, the variation of the data group dependent on the hierarchical structure and the data group not dependent on the hierarchical structure. And, when the change of the authority according to the change of the subordinate relationship occurs, the subordinate relationship for each layer and the change information of the access authority are reflected through the access authority management unit 120 (S300).

The access right management unit 120 updates the access control list 400 reflecting the data group information that can be accessed and the changed authority based on the identification information of the data group for each layer in which the change has occurred.

Accordingly, it is possible to quickly search for access control authority in a structure having a plurality of hierarchies, and to remove or edit a specific data group through the access control list, thereby preventing the occurrence of an unconditional inheritance effect.

As described above, although it has been described with reference to a preferred embodiment of the present invention, those skilled in the art will variously modify and change the present invention within the scope not departing from the spirit and scope of the present invention described in the following claims. You will understand that you can do it.

In addition, reference numerals in the claims of the present invention are provided for clarity and convenience of description, and are not limited thereto. In the process of describing the embodiments, the thickness of the lines shown in the drawings, the size of components, etc. May be exaggerated for clarity and convenience of description, and the above-described terms are terms defined in consideration of functions in the present invention and may vary according to the intentions or customs of users and operators. Should be made based on the contents throughout this specification.

100: access control management server 110: data group management unit
120: access authority management unit 200: terminal
200a: terminal 1 200b: terminal 2
200c: terminal n 300: highest data group A
310: Upper data group B1 311: Upper data group B2
320: lower data group C1 321: lower data group C2
330: lowest data group D1, 331: lowest data group D2
400: access control list 410, B1 access control data
420: B2 access control data 430: C1 access control data
440: C2 access control data 450: D1 access control data
460: D2 access control data 461, 463: accessible data group
462, 464: authority 500: access authority
510: access rights 1 520: access rights 2
530: access right 3

Claims (8)

A data group management unit 110 that is divided into an upper layer and a lower layer, creates and removes a data group consisting of arbitrary data, and manages the data group according to a pre-set layer identification information and a dependency relationship; And
A data access control system having a multi-layered structure comprising an access right management unit 120 that generates an access control list 400 storing accessible data group information based on the hierarchy identification information of the data group for each hierarchy and the dependency relationship. The method of claim 1,
The access control list 400 further includes at least one execution authorization information of read, write, and save. delete The method of claim 2,
The access control list 400 includes information on data groups dependent on a hierarchical structure. The method of claim 4,
The access control list 400 further includes information on data groups that are not dependent on the hierarchical structure. The method of claim 4,
When the data group of the immediate upper layer is changed through the change of the lower data group layer, the access control list 400 sets the access authority of the lower data group to the range of the access authority held by the new changed immediate upper data group. Data access control system of a multi-layered structure, characterized in that the readjustment. a) performing, by the data group management unit 110, authentication of the terminal 200 requesting access rights to a random data group;
b) when the authentication of the terminal 200 is completed, transmitting, by the data group management unit 110 to the terminal 200, a pre-stored access control list 400 corresponding to an arbitrary data group; And
c) When the data group management unit 110 reflects the change in the dependency relationship between the upper and lower layers of the data group, the access right management unit 120 can access the data group based on the identification information of the data group for each layer. Data access control method of a multi-layered structure comprising the step of performing an update of the access control list 400 reflecting the information. The method of claim 7,
The access control list 400 includes at least one of information on a data group dependent on a hierarchical structure and information on a data group not dependent on the hierarchical structure.

Images