JP2000020313A - Method and system for managing succession of attribute - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable each element belonging to plural sets to individually succeed/deprive attributes from respective sets by dynamically changing the whole attribute of an element succeeding attributes from respective groups in accordance with a change in the state of groups to be succession sources of attributes of the element. SOLUTION: An element (a) belongs to plural sets (groups) A to C. The set A 101 has attributes (x, z), the set B 102 has attributes (x, y) and the set C 103 has attributes (y, z). Attributes succeeded in respective groups are managed in order to individually manage different attributes included in each group and the sum (a sum of set operation and indicating union or OR) is set up as the whole attribute succeeded by the element (a) from respective sets A to C. Since these attributes are managed in each succession source (set), the attributes of the element (a) belonging to these sets A to B are changed when the setting of the attributes of the sets to be succession sources is changed. When the element (a) gets out of these sets A to C, the attributes succeeded by the element (a) are deprived.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an attribute inheritance management method and system, and more particularly to an element inheritance management method in which elements belonging to a plurality of sets can dynamically change the inheritance of attributes from a plurality of sets. Attribute management method and system.

[0002]

2. Description of the Related Art Conventionally, an element managed as a set (group) holds a relation between a set and an element by holding the same attribute in a set unit. Although this management method is simple in processing, it is difficult to express a more complicated situation.

That is, in order to express a complicated situation, it is necessary to manage the common property of each element on the set side. Furthermore, it is necessary to manage a special case where an element belongs to a plurality of sets and a part of the set is modified.

[0004]

As described above, in the conventional management method of maintaining the relationship between a set and an element by holding the same attribute in a set unit, a state in which an element belongs to a plurality of sets, There is a problem that it is difficult to efficiently deal with a change in the state of a set or the like.

As a method of multiple inheritance between classes of an object-oriented program in an object-oriented computer system, for example, Japanese Patent Laid-Open No. 7-191849 discloses that a child class receiving inheritance holds information on an inherited parent class. It has a table for registering parent class information and attribute value information that is information inherited from the parent class. The child class can identify and manage information (attribute values) inherited from multiple parent classes. There has been proposed a computer system in which class information can be protected by information and multiple inheritance can be realized. However, in the system described in Japanese Patent Laid-Open No. 7-191849, inheritance of attributes is performed when an inheritance relationship is established, and all attributes are inherited from a parent class to a child class. Etc. are not performed.

Accordingly, the present invention has been made based on the recognition of the above technical problem, and a purpose thereof is to provide a method and system in which elements belonging to a plurality of sets can individually inherit and strip attributes from each set. Is to provide.

[0007]

In order to achieve the above object, the present invention manages the attributes of a group including one or more elements on a group basis, and manages the attributes of each group for a plurality of groups. Is the total of the attributes that the elements belonging to the plurality of groups inherit from each group, and the attributes of the elements are changed according to a change in the state of the group from which the attributes of the elements are inherited.
It is characterized by being dynamically changeable.

In the present invention, when the setting of the attribute of the group from which the attribute of the element is inherited is changed, the attribute inherited by the element from the group is automatically changed in accordance with the change. At the same time, when the element leaves the group, the attribute inherited from the group by the element is automatically deleted from the attribute of the element.

According to the present invention, the groups have a hierarchical structure, and the logical sum of the attribute of each group is determined for a plurality of upper groups, and the lower group belonging to the plurality of groups is changed from the plurality of upper groups. As a whole of the inherited attributes, the attribute of the lower group is dynamically changeable according to a change in the state of the plurality of upper groups from which the attribute of the element is inherited. It is characterized by the following.

[0010]

Embodiments of the present invention will be described. First, the principle of the present invention will be described. FIG.
It is a figure for explaining the principle of the present invention. In FIG. 1, the element a belongs to a plurality of sets (groups) A, B, and C. The set A has attributes (x, z), the set B has attributes (x, y), and the set C has attributes (y, z). In order to individually manage the different attributes of each set, as shown in FIG. 2, the inherited attributes are managed on a group basis, and their sum (the sum of set operations, union (merge) or logical (Meaning sum) is the entire attribute inherited by each element a from each set.

In this way, by managing the attributes in the inheritance source (set) unit, when the setting of the attribute of the inheritance source set is changed, the attribute of the element belonging to the set is changed. The attribute of each element can be changed according to the state of the set of the inheritance source to which the element belongs, for example, when the element leaves the set, the element strips off the attribute inherited by the set.

As a preferred embodiment to which the present invention is applied, a user accessing a system resource is managed in a group unit, and the user inherits a right which is one of the attributes of the group and assigns the right to the right. In an information processing system configured to allow access to the corresponding resource, the authority held by the group is stored and managed in a unit of the group, and a logical sum of the authority of the group is obtained for a plurality of groups, Means for managing as a whole the rights that the users belonging to the plurality of groups have inherited from each of the groups, and when the setting of the authority of the group from which the user inherits the rights is changed, the change is In response, the authority inherited from the group by the user is changed, and when the user leaves the group, the When the authority that the user inherits from the group is deleted from the authority that the user has, the contents of the authority of the user are changed according to a change in the state of the group from which the authority of the user is inherited. It can be changed dynamically.

[0013]

Next, the present invention is applied to a management system for managing users by users (users) who use the information processing system and user groups (user groups) which manage the users as a group. A description will be given of an embodiment to which is applied.

As shown in FIG. 3, characteristic operations of the system 201 such as a computer system are classified (operation 1, operation 2, and operation 3). , Z are required.

The system administrator sets a usage right (access right) for each user 203 or each user group 202 in order to control the system 201. The user 203 inherits the usage right from the plurality of groups 202 to which the user 203 belongs, and can execute the operation of the system according to the usage right.

Next, the operation of one embodiment of the present invention will be described with reference to FIGS. As an example, the following settings are made.

In order to restrict the use of the system, A and B are set as user groups (FIG. 4).
(See (a)). Group A is given the right to use x and y, and group B is given the right to use z.

First, the users a1 and a2 belong to the group A to inherit the right to use the group (see FIG. 4A). At this time, the users a1 and a2
As shown in (b), it has a usage right (x, y).

In this setting, an example of the operation of the authority of the user will be described. When the user a2 belongs to the group B due to a long business trip, the usage right is changed. That is, the use right of the user a2 is restricted and inherited from the sum (x, y, z) of the attribute of the group A and the attribute z of the group B (see FIG. 4C). The usage right y is stripped (see FIG. 4A), and the usage right of the user a2 becomes (x, z) (see FIG. 4D).

Since the usage right is managed for each inheritance source, the succession and deprivation of the authority in such a situation can all be managed.

Next, another embodiment of the present invention will be described. In the present embodiment, the relationship between the group and the user in FIG. 4 is further expanded, and the case where the group has a hierarchical relationship is applied to the relationship between the group and the upper group.

In this embodiment, as shown in FIG. 5, similarly to the relationship between the user and the group in the above embodiment, the entire use right of the group is directly transferred to the upper group (B'1,
B'2).

A user belonging to the group B treats the sum as a use right of B (the group B returns the sum as its own use right), such as "B: use right 1,...". , Is managed only as attribute information of group B. In this case, there is no need for information on the upper groups B′1 and B′2.

As described above, the group / higher-order group, and further the group / affiliated user, and the inheritance relationship of the usage right can be interconnected by the same management method.

[0025]

As described above, according to the present invention,
There is an effect that the attribute given individually for each element can be set in a group unit or the setting can be individually changed depending on a change in the status of the element.

The reason is that, in the present invention, the inherited authority is managed for each group to which the element belongs, and the attribute of the element is managed by the sum of the whole.

[Brief description of the drawings]

FIG. 1 is a diagram for explaining the principle of the present invention.

FIG. 2 is a diagram for explaining the principle of the present invention.

FIG. 3 is a diagram for explaining one embodiment of the present invention.

FIG. 4 is a diagram for explaining one embodiment of the present invention.

FIG. 5 is a diagram for explaining another embodiment of the present invention.

[Explanation of symbols]

 101 to 103 Set (group) 104 Element 105 Attribute management of set unit 201 System 202 Group 203 User

Claims (7)

[Claims] An attribute of a set including one or a plurality of elements is managed in a set unit, and a sum of attributes of the plurality of sets is determined for each of a plurality of sets. As a whole of the attributes inherited from, the attribute of the element is dynamically changeable according to the change of the state of the set from which the attribute of the element is inherited, Attribute inheritance management method. 2. When the setting of an attribute of a set from which the attribute of the element is inherited is changed, the attribute inherited by the element from the set is automatically changed in accordance with the change. 2. The attribute inheritance management method according to claim 1, wherein when an element leaves a set, an attribute inherited by the element from the set is automatically deleted from attributes of the element. 3. The set has a hierarchical structure, and a lower set belonging to the plurality of sets inherits a sum of attributes of the plurality of sets from a plurality of upper sets. And the attributes of the lower set are:
3. The attribute inheritance management method according to claim 1, wherein the attribute inheritance management method is dynamically changeable in accordance with a change in a state of the plurality of higher-order sets, which is an inheritance source of the attribute of the element. 4. The storage unit manages attributes of each group and manages the logical sum of the attributes of each group with respect to a plurality of groups. The attribute of an attribute belonging to the plurality of groups is inherited from each group. As a whole, when the setting of the attribute of the group from which the attribute of the element is inherited is changed, the attribute inherited from the group by the element is changed according to the change, and the element is When the attribute of the element is removed from the attribute of the element when the element is removed from a group of the plurality of groups, the attribute of the element is changed from the attribute inheritance source of the element. A method according to claim 1, wherein the method is dynamically changeable according to a change in the state of the group. 5. The group has a hierarchical structure, and a lower group belonging to the plurality of groups inherits a logical OR of attributes of the groups from a plurality of upper groups. That the attributes of the lower group are dynamically changeable in response to a change in the status of the plurality of higher groups from which the attributes of the element are inherited. The attribute inheritance management method according to claim 4, wherein the attribute inheritance management method is used. 6. A user who accesses resources of the system is managed on a group basis, and the user inherits a right, which is one of the attributes of the group, and is permitted to access the resource according to the right. In the information processing system configured as described above, means for storing and managing the authority possessed by the group for each group, and the logical OR of the authority for each group for a plurality of groups, Means for managing as a whole the rights inherited from the group, wherein when the setting of the authority of the group from which the user's authority is inherited is changed, the user inherits from the group according to the change. Permissions have changed,
When the user leaves the group, the authority inherited from the group by the user is deleted from the authority possessed by the user, so that the content of the authority of the user is determined by the inheritance source of the authority of the user. An attribute inheritance management system, characterized in that it can be dynamically changed according to a change in the state of a certain group. 7. The group has a hierarchical structure, and a lower group belonging to the plurality of groups inherits a logical sum of attributes of the plurality of groups from a plurality of upper groups. That the attributes of the lower group are dynamically changeable in response to a change in the status of the plurality of higher groups from which the attributes of the element are inherited. The attribute inheritance management system according to claim 6, wherein the attribute inheritance management system is characterized in that: