JP2000066943A - Method and system for controlling resource access, and storage medium stored with resource access control program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve the investiture efficiency of access right and to attain the efficient audit of access right distribution, the deprivation of access right and the deprivation of the investiture right for access right. SOLUTION: In the case of distributing access right from a subject K-1 to a subject K when the access right is successively distributed to subjects K0 to K-1, the subject K-1 delivers new distribution route information K-1 obtained by adding the information on the subject K-1 to distribution route information K-2 expressing the distribution route of the access right from the subject K0 to the subject K-2 to the subject K. The subject K presents the distribution route information K and a subject identification ticket 71 and requests an access control monitor 51 to access the resource. The monitor 51 refers to distribution action identification information 72 stored in a distribution management means 55, checks the access right distribution route, and after checking the rough, permits the subject K to access.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a resource access control method, a resource access control method, and a storage medium storing a resource access control program, and more particularly to controlling the use of resources such as information stored in a network computer. The present invention relates to a resource access control method, a resource access control method, and a storage medium storing a resource access control program.

[0002]

2. Description of the Related Art Access control in the use of resources such as information stored in a computer is performed as shown in FIG.
An access control matrix 3 that expresses a relationship between a user (subject: its identifier is S) 1 that uses resources such as information and a resource (subject: its identifier is R) that is used, such as information, in a matrix form. Access control monitor (or security core) based on the information of
Has been generally formulated in the past by a model realized by: According to this model, when the subject 1 accesses the target 2, the access control monitor 4 makes a decision based on the access control matrix 3 and controls the access.

[0003] The following three systems (A, B, and C) have been conventionally implemented based on this model. As shown in FIG. 2A, only the effective elements of the access control matrix 3 are subject (S1 to S4), subject (R1 to R4), and access right (O
K, NG) are represented by a triple table 5 composed of a set of three attributes. According to this model, as shown in FIG. 2B, when the subject 1 accesses the target 2, the access control monitor 4 makes a decision based on the triplet table 5 and controls the access.

As shown in FIG. 3 (A), the Otsu system classifies the elements of the triplet table 5 in the A system into individual subjects 1, and the elements of each individual subject 1 (referred to as qualifications or capabilities).
Define the catalog 6 concept for the set of According to this model, as shown in FIG. 3B, when the subject 1 accesses the target 2, the access control monitor 4 sets the qualifications (access rights to the target) included in the catalogs 7 to 9 to each other. A decision is made based on this, and the access is controlled.

[0005] As shown in Fig. 4 (A), in the Hei method, the elements of the triplet table 5 in the instep A method are classified by the subject 2 instead of the subject 1, and the elements of each subject 2 The concept of an access control list 11 is defined for a set.
The access control list 11 is arranged for each target 2. According to this model, as shown in FIG.
When the subject 1 accesses the target 2, the access control monitor 4 makes a determination based on the access control list 11 arranged on the target 2 side and controls the access.

[0006] In order to realize all of the above-mentioned system A, system B, and system B, as shown in the model of FIG. Therefore, it is necessary to keep this relationship up to date. However, there is no problem when the subject 1 and the target 2 are operated in a limited range such as in a single system, but in an operation in a situation where a plurality of independent systems are related to each other, an access right is granted. The range increases, and frequent updating of information corresponding to the access control matrix is required.

In such an environment, when it is desired to distribute access rights widely under reasonable restrictions, it is necessary to be able to distribute access rights under appropriate conditions. In addition, if the access right can be distributed, it means that the relevant distribution act is properly performed with respect to the access based on the access right obtained from the distribution in the sense that the target management party finally grasps the distribution act. It is necessary to enable auditing, and at that time, if there is a problem with the auditing result, it is necessary to be able to deprive access rights distributed in the past in an appropriate range.

Therefore, conventionally, two methods have been considered in order to enable such distribution of access rights. One of the methods (choice method) is to dynamically support the relationship between the subject and the access control matrix or the relationship between the subject and the access control matrix while maintaining the function of the static access control matrix as in the model of FIG. This is a method of realizing the distribution of the access right by changing the association. The other system (both system) is realized by using an access right grant right to update the access control matrix according to an access control model that takes into account access to the access control matrix itself as shown in FIG. It is a method. In FIG. 5, the subject 41 having the right to grant the access right changes the access control matrix 3 via the access control matrix change control monitor 24. The access control monitor 4 performs control based on the access control matrix 3.

FIG. 6 shows the shing system. This system classifies the elements of the triplet table 5 in the first class system, defines the concept of an access control list 21 for a set of elements for each target, and sets each of the three types in the C system that is attached to the target side. Introduces the concept of qualification in the Otsu method, which classifies the subjects of In the Ding system, identification key information such as a public key is used for identification of qualifications, authentication of qualifications is separated from the access control monitor, and identification key information is distributed. This is a method that makes distribution possible. In this method, all the entities having the access right also have the right to grant the access right at the same time. In FIG. 6, the subject 1 having the key (qualification α) for the subject 2 can access the subject 2 and use the resources of the subject 2.

FIG. 7 shows a method according to the model of FIG. This method is a method in which information corresponding to the access control matrix in FIG. 1 is defined, for example, by a structure as shown in FIG. In this method, S1, S2, and S3 are directly granted access rights from the target owner, S4 and S5 are granted access rights from S1, S6 and S7 are granted access rights from S2, and S8 and S9 are granted access rights from S4. This shows a state where the access right has been granted. In the case of this example, the entity that has distributed the access right imposes a restriction that the authority of the recipient to whom the access right has been granted can be changed, so that the person before the distribution of the access right (the distribution ) Can directly or indirectly change the access right of the latter (distributed person), and the latter in the access right distribution chain cannot change the access right of the former. Exercising.

Although the structure of the information is the same as that of the system, no restriction is imposed on the change of the access right by the distributor of the access right and the recipient as in the system of the system. Fig.8
Shown in In this system, the distribution of access rights is the same as in the Bo system, and S1, S2, and S3 are directly granted access rights by the target owner, S4 and S5 are granted access rights from S1, and S6 and S7 are granted access rights from S2. The access right has been granted, and S8 and S9 show the state where the access right has been granted from S4. In this method, regardless of the position where the access right information for each subject is linked, the access right information of all the subjects appearing on the link can be arbitrarily changed / removed, thereby distributing the access right distribution sequence. , It is possible to realize access control information that does not hold.

[0012]

However, in the case of simply providing an access key to an object as in the case of the Ding system, in order to exclude a person to whom the access right has been distributed once, the key is changed and eliminated. It is necessary to either notify the change to the access authority acquirer other than the subject to be performed, or prepare a different access key for each subject, and reduce the load on the subject manager in any case. The problem remains after solving the problem.

[0013] Further, in the Bo method, since there is no restriction on the distribution of the access right, the same subject may exist in the system in some cases. Specifically, a state in which S4 and S6 are the same subject is also possible. Just from the perspective of the subject's access rights,
Although there is no problem in the presence of such duplicate entries, in this method in which it is not possible to determine the details of the access rights that are the basis of each access, in this method, it is necessary to audit how the access was granted with the granted rights. There is a problem.

Further, in the self-method, there is a problem similar to that in the self-method, and in consideration of access auditing, it is necessary to separately manage the history of each change by a log or the like, and there is a problem in realizing the audit function. SUMMARY OF THE INVENTION The present invention has been made in view of the above problems, and improves the efficiency of access right assignment by enabling easy distribution of access rights and access right grant rights, and at the same time, efficiently audits access right distribution. It is intended to make it possible to deprive access rights and deny access right grant rights.

[0015]

According to the present invention, a single computer or a plurality of computers K0 is provided.
To a resource R such as information stored in a computer in a computer network in which the access rights are connected by a communication line, a first entity K-1 for granting an access right and a second entity K-1 for accepting the access right. Subject K
Management means 5 for managing the distribution route information of access rights and access rights
5 wherein the first subject is the order in which the second subject is sequentially given and received the access right generated with each distribution act of the access right to the first subject. To the distribution path information K-1 including the information expressed in
At the same time, the first subject has an identifier R of the resource to be accessed, an identifier K0 of the subject that owns the resource, an identifier of the first subject K-1, and an identifier K of the second subject. A resource access control method characterized in that an access right from the first entity to the second entity is granted by reporting distribution act identification information to the distribution management means.

According to the first aspect of the present invention, the first entity K-1 that grants the access right gives the distribution route information K-1 to the second entity that accepts the access right, and at the same time, The first entity reports the distribution act identification information to the distribution management means, thereby granting the right to access from the first entity to the second entity. Can easily distribute the access right and the right to grant the access right, which are difficult in the conventional method of directly updating the control information according to the above.

At the same time, since the distribution of the access right is performed by transmitting and receiving the existing information called the distribution route information expressing the access right, the access right in the case where the access right is to be widely distributed under reasonable restrictions Can be given or deprived by a specific manager without concentrating all operations. Further, by requesting the access right with the access right distribution route information, efficient audit of the distribution of the access right, deprivation of the access right, and deprivation of the right to grant the access right can be easily realized.

According to a second aspect of the present invention, in the resource access control method of the first aspect, the subject K0 having the resource includes an access control means 51 for controlling access to the resource owned by the subject. And the second subject K
Includes, with respect to the access control means, distribution route information K including information expressing, in the order of the subject, the access right generated in accordance with the act of distributing the access right to the second subject in turn. Requesting access to the resource.

According to the second aspect of the present invention, the second subject K sequentially transmits and receives the access right generated with each distribution act of the access right to the second subject to the access control means. By requesting access to the resource with the distribution path information K including the information expressed in the order of the subjects, the access control means performs distribution from K0 to K1, distribution from K1 to K2,. Distribution path information K (66) indicating distribution from K-2 to K-1 and distribution from K-1 to K
Can be sequentially confirmed according to the route information.

According to a third aspect of the present invention, in the resource access control method according to the second aspect, the access control means 51 is generated in accordance with each distribution act of the access right to the second entity. Access permission / inhibition is controlled on the basis of distribution route information K including information expressed in the order of the parties who have sequentially given and received access rights and distribution act identification information 72 of the distribution management means 55.

According to the third aspect of the invention, the access control means 51 performs access control only by confirming the distribution act identification information based on the distribution route information K and the distribution act identification information of the distribution management means 55. It can be carried out. According to a fourth aspect of the present invention, in the resource access control method according to any one of the first to third aspects, an entity which is a holder or a user of the resource R distributes the resource R within a predetermined range. It is characterized in that the management means 55 is accessed to register, delete or confirm the distribution act identification information 72.

According to the fourth aspect of the present invention, the subject who is the owner or user of the resource R accesses the distribution management means 55 and registers, deletes or confirms the distribution act identification information to access the resource R. Rights can be distributed, access rights can be deleted, or access rights can be confirmed. According to a fifth aspect of the present invention, in the resource access control method according to the second aspect, the request for access to the resource is performed with a ticket created separately, which certifies the qualification.

According to the fifth aspect of the present invention, security can be ensured by making a request for access to the resource accompanied by a ticket proving the qualification. According to a sixth aspect of the present invention, in the resource access control method according to the fourth aspect, the registration, deletion, or confirmation of the distribution act identification information is performed with a separately created ticket proving the qualification. And

According to the invention described in claim 6, registration, deletion or confirmation of the distribution act identification information is performed with a ticket proving the qualification, thereby ensuring security. According to a seventh aspect of the present invention, there is provided a program for causing a computer to execute a resource access control of a resource R such as information stored in a computer in a computer network in which a single computer or a plurality of computers K0 to K are connected by a communication line. In a storage medium storing a resource access control program, a first entity K-1 that grants an access right sends a second entity K that receives an access right to each of the access rights up to the first entity. Distribution information K-1 including information expressing the access right generated in accordance with the distribution act of the subject in the order of the parties who have sequentially received and transmitted the access right.
At the same time, the first subject makes the identifier R of the resource to be accessed, the identifier K0 of the subject who owns the resource, the identifier K-1 of the first subject and the identifier of the second subject By reporting the distribution act identification information having the identifier K to the distribution management means for managing the distribution path information of the access right, the process of granting the access right from the first subject to the second subject can be performed by the computer. This is a storage medium storing a resource access control program to be executed.

According to an eighth aspect of the present invention, in the storage medium storing the resource access control program according to the seventh aspect, the second entity K is provided in the entity K0 that owns the resource. To the access control means 51 for controlling the access of the resources owned by the information representing the access rights generated in accordance with the act of distributing each of the access rights up to the second subject in the order of the subjects that have been sequentially given and received. A process for requesting access to the resource is further executed with the included distribution route information K.

According to a ninth aspect of the present invention, in the storage medium storing the resource access control program of the eighth aspect, the access control means 51 distributes each access right to the second subject K. A process for controlling whether access is allowed or not is performed on the basis of distribution route information K including information expressing the access right generated in accordance with the act in the order of the subjects who have been sequentially given and received and the distribution act identification information 72 of the distribution management means 55. It is further characterized by being executed.

[0027] The invention described in claim 10 is the seventh invention.
10. The storage medium storing the resource access control program according to any one of claims 9 to 9, wherein an entity that is a holder or a user of the resource R accesses the distribution management unit 55 within a predetermined range, Distribution act identification information 7
2 is characterized by further executing a process of registering, deleting, or confirming.

The inventions according to claims 7 to 10 are directed to claims 1 to
4 defines a storage medium in which a program for causing a computer to implement the resource access control method described in 4 is recorded. According to an eleventh aspect of the present invention, in a computer network in which a single computer or a plurality of computers are connected by a communication line, resource access control for resources such as information stored in the computers (hereinafter, referred to as “targets”). In the method, the first means 83 for identifying the subject who is the owner or user of the object, the second means 85 for identifying the object, the third means 86 for controlling whether or not to access the object, the object A fourth means 87 for identifying an act of distributing the access right to the fifth means, a fifth means 88 for managing the validity of the act of distributing by the fourth means, and the fifth means 88 within a predetermined range. Sixth means 89, wherein the subject requests registration, deletion or confirmation of the act of distributing access rights based on the subject's identification by the first means.
A seventh means 90 for expressing the access right to the object with distribution route information that sequentially distributes the access right from the subject to another subject, the subject having obtained the information expressed by the seventh means, An eighth request for requesting access to the target based on the identification of the subject by the first means to the third means associated with the target, based on the identification of the subject by the third means associated with the target. Means 91,
In response to the access request to the object by the eighth means, a ninth check to confirm whether the act of distributing the access right until the entity requesting the access expressed by the seventh means obtains the information has been appropriately performed. A resource access control method characterized by comprising means 94.

An eleventh aspect of the present invention specifies a resource access control method for realizing the resource access control method according to the first to sixth aspects.

[0030]

DESCRIPTION OF THE PREFERRED EMBODIMENTS In the present invention, the distribution of access rights is not directly changed in an access control matrix, but the distribution of distribution route list information expressing the distribution route of access rights, the registration management of the distribution act, the access management, and the like. By realizing it with a protocol for confirming the distribution action by the control monitor, it is possible to distribute the access right efficiently and to audit the access right. Next, embodiments of the present invention will be described with reference to the drawings.

FIG. 9 shows a configuration example of the embodiment of the present invention. In the embodiment shown in FIG. 9, the subjects K0 to K (41 to 4
4), K0 access control monitor 51, document (target) 5
2. Distribution management means 55, subject identification ticket issuing means 70
And a subject identification ticket 71. These are mutually connected by a communication line to form a computer network. However, the subject identification ticket issuing means 70 or the subject identification ticket 71 may be outside the network.

FIG. 9 shows that the access right is distributed from the subject K-1 to the subject K via the subject K0, the subject K1,.
This is an example of a case where a subject K accesses a document (target R) 52. The document (target R) 52 is not limited to a document,
It means general information stored inside or outside the computer K0, and also includes programs and the like accessed from other entities.

The subjects K0-K (41-44) are personifications of the network computers K0-K.
The subject identification ticket issuing means 70 receives authentication of the subjects K0 to K and issuance of an identification ticket 71 proving the subject. The document (target) 52 is accessed as needed. Further, each of the entities K0 to K is provided with distribution path information K0 (61) described later, which expresses, in a list, an insertion structure, or the like, the order of the entities that have sequentially given and received the access right generated with each access right distribution action. Distribution route information K1 (62),
..., distribution path information K-1 (64), distribution path information K (6
6) is handed over to the next entity when distributing the access right.

For example, the distribution route information K of the subject K
(66) is the identifier R of the document (object) to which the access right is to be distributed, the identifier K0 of the owner of the target, the identifier K-1 of the entity to which the authority is distributed, the identifier K of the entity to receive the authority, and via (The identifiers of the subjects are arranged in the order of distribution). Specifically, for example, in the case of the subject K, the distribution path information K (66) is created by attaching the identifier K (65) of the subject K to the distribution path information K-1 (64).

The subject K presents the distribution route information K (66) and the subject identification ticket 71 (and accompanies it), and stores the document 5 stored by the computer K0 in the access control monitor 51 of K0.
Request access to 2. The access control monitor 51 of K0 is a monitor for controlling the access of the computer K0. For example, it controls the access of the document 52 stored by the computer K0. When the subject K presents the distribution route information K (66) and the subject identification ticket 71 and requests the access control monitor 51 of K0 to access the document 52 stored in the computer K0, the access control monitor 51 , K based on the subject identification ticket 71, and then confirms the distribution route based on the distribution route information K (66) and the distribution act identification information 72 of the distribution management unit 55.

The access control monitor 51 is attached to the subject, attached to each group of the subject, attached to a single target, attached to each target group, or independent of the subject and the target. . The document 52 is a document stored by the computer K0, and is accessed from each of the entities K0 to K. The document 52 has an identifier R, which is the identifier K0 of the computer where the document is stored and the local identifier L
It consists of 0. With these identifiers, the document 52
Can be uniquely identified on a computer network.

The distribution management means 55 includes distribution act identification information 7
2 is centrally managed. The distribution act information 72 includes a set of individual distribution identification information. The individual distribution identification information includes the “target owner identifier”, the “distributor identifier” of the entity K-1 which is the access right distributor in the distribution act, and the entity K-1 which is the access right receiver in the distribution act. Set of "destination subject identifier" (R, K0,
K-1, K). The individual distribution identification information of the distribution act identification information 72 is registered in the distribution management unit 55 when each entity distributes the access right.

It should be noted that the entities K0-K are the distribution management means 55
The registration, reference, and deletion of the distribution act identification information can be requested by presenting the subject identification ticket 71 within a predetermined range. Further, the distribution management means 55 is attached to the subject, or attached to each group of the subject, attached to a single target, attached to each target group, or exists independently of the subject and the target.

The subject identification ticket issuing means 70 issues the subject identification ticket 71 using, for example, a Kerberos authentication method (authentication method for an open network developed mainly at Massachusetts Institute of Technology, USA).
By presenting the subject identification ticket 71, the subject K0, the subject K1,..., The subject K-1, and the subject K can be uniquely identified.

The subject K presents the distribution route information K (66) and the subject identification ticket 71, and requests the access control monitor 51 of K0 to access the document 52 stored in the computer K0. In response, the access control monitor 51 of the subject K0 transmits the distribution act identification information 72 of the distribution management unit 55.
, And confirm the access right distribution route. When the distribution route of the access right can be confirmed, access is granted to the subject K.

The distribution of the access right, the cancellation of the access right distribution action, and the confirmation of the access right distribution route are performed in the following procedure. When the access right of the document identified as the object R owned by the subject K0 to which the access right is distributed is distributed to the subject K1,..., The subject K-1, the access right is distributed. In order to newly distribute the access right to the target R to the subject K, the distribution route representing the route from the subject K0 assigned to the subject K-2 to the access right to the subject K-2 is distributed by the subject K-1. New distribution route information K-1 (6) obtained by adding information of the subject K-1 to the information K-2 (63)
4) is delivered to the subject K. At the same time, K-1 designates the distribution act as the "target identifier" of the target R that is the subject of the distribution access right, the "target owner identifier" of the subject K0 that is the subject of the target R, and the access right distribution entity in the distribution act. The set (R, K0, K-1, K) of the "distribution subject entity identifier" of the subject K-1 and the "distribution subject entity identifier" of the subject K which is the access right receiving subject in the distribution act is assigned to the distribution act. The access right distribution is achieved by registering the identification information in the distribution management means.

The cancellation of the distribution act is carried out by the entity that has performed the distribution act to be deleted or the owner of the target R that is the authority of the access right that has been subject to the distribution by the subject's own identification ticket. Based on the identification (presenting its own subject identification ticket), the distribution management unit 55 requests the distribution management unit 55 to delete the distribution identification, and the distribution management unit 55 deletes the distribution act identification information to cancel the distribution act. .

When the subject K accesses the target R of the subject K0, the subject K requests the access control monitor 51 of the K0 along with distribution route information K (66) expressing distribution of access right from the subject K0 to the subject K. K0 access control monitor 51
According to the distribution route information K (66).
5 is checked for each distribution action. Specifically, distribution from K0 to K1, distribution from K1 to K2,
.., The distribution from K-2 to K-1 and the distribution from K-1 to K are sequentially confirmed in accordance with the route information of the distribution route information K (66). When all distribution routes are finally confirmed, the access right is determined to be valid, and the access control monitor 5 of K0
1 permits access.

The processing procedure will be briefly described with reference to FIG. Access rights are distributed from subject B (K-1) to subject E (K) via subject K0, subject K1, ... subject K (K-2), and subject E accesses the target. It is an example. The subject party A adds its own identification K-2 to the route information K-1 and gives 111 to the subject party B. On the other hand,
A report 112 is sent to the distribution management means 55 that the access right has been distributed from Party A to Party B. The distribution management unit 55 updates the distribution destination list 101.

The subject B, like the subject A, has the route information K-
2. Add your own identification K-1 to 2 and give it to subject C
13. Further, the subject Party B reports to the distribution management means 55 that the access right has been distributed from Party B to Hei. The distribution management unit 55 updates the distribution destination list 101. Subject A sends the access control means 51 with the route information K,
An access request is made 115. The access control means 51
In accordance with the distribution route information K, the distribution management means 55 sequentially confirms each distribution act 116. When all the distribution routes are finally confirmed, the access right is determined to be valid, and the access control means 51 permits the subject C to access.

FIG. 10 is a diagram corresponding to claim 11 of the present invention. In the above description, the target R is stored in the subject K0, but another subject may store one or more targets. Similarly, the access control means is the subject K0
However, the configuration may be such that another entity has access control means.

As described above, according to the embodiment of the present invention, when the access right is changed, the access right and the grant of the access right are difficult in the conventional method of directly updating the access control matrix or the control information corresponding thereto. Rights can be easily distributed. At the same time, since the distribution of access rights is performed by giving and receiving existing information called distribution route information that expresses access rights, granting access rights when distributing access rights widely under reasonable restrictions, Deprivation can be performed by a specific manager without concentrating all operations.

Further, by requesting the access right with the access right distribution path information, efficient audit of distribution of the access right, deprivation of the access right, and deprivation of the right to grant the access right can be easily realized. .

[0049]

According to the first aspect of the present invention, the first entity K-1 that grants the access right gives the distribution route information K-1 to the second entity that accepts the access right. At the same time, the first entity reports the distribution act identification information to the distribution management means, thereby granting access rights from the first entity to the second entity, thereby controlling access when changing the access right. It is possible to easily distribute the access right and the right to grant the access right, which are difficult in the conventional method of directly updating the matrix or the control information corresponding thereto.

At the same time, since the distribution of access rights is performed by transmitting and receiving existing information called distribution path information expressing access rights, access rights in a case where access rights are to be widely distributed under reasonable restrictions. Can be given or deprived by a specific manager without concentrating all operations. Further, by requesting the access right with the access right distribution route information, efficient audit of the distribution of the access right, deprivation of the access right, and deprivation of the right to grant the access right can be easily realized.

According to the second aspect of the present invention, the second subject K sequentially transmits and receives the access right generated with each distribution act of the access right to the second subject to the access control means. By requesting access to the resource with the distribution path information K including the information expressed in the order of the subjects, the access control means performs distribution from K0 to K1, distribution from K1 to K2,. Distribution path information K (66) indicating distribution from K-2 to K-1 and distribution from K-1 to K
Can be sequentially confirmed according to the route information.

According to the third aspect of the present invention, the access control means 51 performs access control only by confirming the distribution act identification information based on the distribution route information K and the distribution act identification information of the distribution management means 55. It can be carried out. According to the fourth aspect of the present invention, the entity that is the holder or user of the resource R accesses the distribution management unit 55 and registers, deletes or confirms the distribution act identification information, thereby distributing the access right. , The access right can be deleted or the access right can be confirmed.

According to the fifth aspect of the present invention, security can be ensured by making a request for access to the resource accompanied by a ticket proving the qualification. According to the invention described in claim 6, the registration, deletion, or confirmation of the distribution act identification information is performed with a ticket proving the qualification, thereby ensuring security.

The inventions of claims 7 to 10 are directed to claims 1 to
It is possible to provide a storage medium in which a program for causing a computer to implement the resource access control method described in Item 4 is recorded. The invention according to claim 11 can provide a resource access control method for realizing the resource access control method according to claims 1 to 6.

[Brief description of the drawings]

FIG. 1 is a diagram for explaining a conventional general access control model.

FIG. 2 is a diagram (A method) for explaining an access control method using a conventional triple table.

FIG. 3 is a diagram (Otsu system) for explaining a conventional access control system using qualifications.

FIG. 4 is a diagram (a method) for explaining a conventional access control method using an access control list.

FIG. 5 is a diagram for explaining a conventional general access control model on the assumption that access rights can be distributed.

FIG. 6 is a diagram (ditch system) for explaining a conventional access control system using keys and locks that enables distribution of access rights.

FIG. 7 is a diagram (scheme) for explaining a method for realizing access control information that holds a relationship between distribution and distribution.

FIG. 8 is a diagram (own method) for explaining a method of realizing access control information that does not hold a relationship between distribution and distribution.

FIG. 9 is a diagram for describing an embodiment of an access control method that enables access right distribution according to the present invention.

FIG. 10 is a diagram corresponding to claim 11 of the present invention.

FIG. 11 is a diagram illustrating a processing procedure according to the embodiment of the present invention.

[Explanation of symbols]

 1, 41 to 44 subject (K0 to K) 2 target (R) 3 access control matrix 4, 34 access control monitor 5 triplet table 52 document (target R) 55 distribution management means 61 to 66 distribution route information 70 subject identification ticket issuance Means 71 Subject identification ticket

Claims (11)

[Claims] 1. A resource access control method for resources such as information stored in a computer in a computer network in which a single computer or a plurality of computers are connected by a communication line, a first entity to which an access right is granted, and the access right And a distribution management means for managing distribution path information of the access right, wherein the first subject has an access right to the first subject with respect to the second subject. The distribution path information including the information expressed in the order of the entities that sequentially gave and received the access right generated in accordance with each distribution act is given, and at the same time, the first entity is an identifier of the resource to be accessed, The distribution act identification information having the identifier of the entity that owns the resource, the identifier of the first entity, and the identifier of the second entity is reported to the distribution management means. The access right from the first subject to the second subject by giving the notification. 2. The subject that owns the resource includes access control means for controlling access to the resource owned by the subject, and the second subject provides the second control to the access control means. Requesting access to the resource with distribution path information including information expressing the access right generated in accordance with each act of distributing the access right up to the subject in order of the subject that has been sequentially given and received. Item 2. The resource access control method according to Item 1. 3. The distribution control apparatus according to claim 1, wherein the access control unit includes: 3. The resource access control method according to claim 2, wherein whether access is permitted or not is controlled based on the distribution act identification information of the distribution management unit. 4. An entity that is an owner or user of the resource, accesses the distribution management unit within a predetermined range, and registers, deletes, or confirms the distribution act identification information. The resource access control method according to any one of claims 1 to 3, wherein: 5. The resource access control method according to claim 2, wherein the request for access to the resource is performed with a ticket created separately, which certifies the qualification. 6. The resource access control method according to claim 4, wherein the registration, deletion, or confirmation of the distribution act identification information according to claim 4 is performed with a ticket created separately to prove the qualification. 7. A storage medium storing a resource access control program for causing a computer to execute resource access control of resources such as information stored in a computer in a computer network in which a single computer or a plurality of computers are connected by a communication line. In the first aspect, the first entity that grants the access right sequentially gives and receives the access right generated with each distribution act of the access right to the first entity to the second entity that receives the access right. At the same time, the first subject is the identifier of the resource to be accessed, the identifier of the subject that owns the resource, and the identity of the first subject. A distribution pipe for managing distribution path information of an access right by using distribution act identification information having an identifier and an identifier of the second subject. By reporting to the means, the first storage medium storing the resource access control program for executing a process to grant access rights to the computer from principal to the second principal. 8. The method according to claim 1, wherein the second subject is provided with access control means for controlling access to the resource owned by the subject that owns the resource. 8. The resource access according to claim 7, further comprising the step of requesting access to said resource with distribution route information including information expressed in the order of the parties who have sequentially given and received the access right generated with each distribution action. A storage medium storing a control program. 9. The distribution control apparatus according to claim 8, wherein the access control unit includes: 9. The storage medium storing the resource access control program according to claim 8, further comprising a process of controlling access permission based on the distribution act identification information of the distribution management unit. 10. The subject, who is the owner or user of the resource, accesses the distribution management means within a predetermined range, and further executes processing for registering, deleting or confirming the distribution act identification information. A storage medium storing the resource access control program according to any one of claims 7 to 9. 11. A resource access control method for resources such as information stored in a computer (hereinafter referred to as “target”) in a computer network in which a single computer or a plurality of computers are connected by a communication line, A first means for identifying the owner or user, a second means for identifying the object, a third means for controlling whether or not to access the object, and an act of distributing access rights to the object A fourth means, a fifth means for managing the validity of the distribution act by a fourth means, and the actor distributes the access right to the fifth means within a predetermined range. A sixth means for requesting registration, deletion or confirmation based on the identification of the subject by the first means, the access right to the object is sequentially assigned from the subject to another subject. Seventh means for expressing with the distributed distribution path information, wherein the subject having obtained the information expressed by the seventh means accesses the object which is accompanied by the information and which is the subject of the access right expressed by the information. An eighth means for requesting the third means associated with the object to access the object based on the identification of the subject by the first means; a seventh request for an access request to the object by the eighth means; 9. A resource access control method comprising: ninth means for confirming whether or not an access right distribution act until the subject who has requested access to the information expressed by means has obtained the information has been appropriately performed.