JP2000187589A - Component access controller for program system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To automatically perform an access check when a user accesses a recyclable component to be dynamically included by various programs. SOLUTION: When a user 1 makes an access request for a component, an access control module 2 acquires the information of the user 1 from log in information and compares the acquired user information with access information recorded on an access control list 3 to perform access check.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a component access control device of a program system capable of automatically performing a user access check.

[0002]

2. Description of the Related Art A component is a reusable binary program that is dynamically incorporated into various programs as a unit for performing a predetermined process. For example, an object that encapsulates data and procedures in an object-oriented language is This is one example.

Conventionally, there has been known a computer program system that executes one user program using this component. In such a system, two methods are conceivable as access methods for incorporating components into a user program.

[0004] The first method is that when a component to be used is created or referenced, user information such as a user's user name is not specified when the component is actually created and referenced. This is a method that does not perform the check of the person.

A second method is to add user information to a message when creating or referring to a component to be used, and to check a user based on the user information when creating or referring to the message. .

[0006]

However, the conventional component access control device of a program system using the above method has the following disadvantages.

First, in the case of using the first method, it is not necessary to add user information or the like at the time of creating or referencing a component, so that the processing procedure of the user is not complicated, but anyone can access the component. Because you can
Security is low.

In the method using the second method, the security is higher than in the first method since access check is performed at the time of creating and referencing a component. However, since the user information and the like must be added to the message, the use is not possible. The user's processing procedure becomes complicated. Therefore, when accessing a component, it is desirable to be able to automatically perform an access check without adding user information or the like and to ensure security.

[0009]

The present invention employs the following structure to solve the above-mentioned problems. <Structure 1> A component access control device of a program system according to claim 1, wherein a user program accesses a component as a unit for performing a predetermined process, incorporates the accessed component into the user program, and executes the user program. In a computer program system to be executed, access control means for controlling access to a component of a user program is provided, and the access control means, when the user program makes an access request to a component, executes the user program. User information acquiring means for acquiring user information of the user program from a predetermined information source; an access control list in which access information relating to an access right to a component of the user program is registered in advance; Access checking means for comparing the user information obtained by the information obtaining means with the access information registered in the access control list and determining whether or not the user program which has made the access request has an access right based on the comparison result; When the access check means determines that the user has the access right, the access to the component of the user program is permitted. When the access check means determines that the user does not have the access right, the access to the component of the user program is prohibited. Access permission means for permitting.

<Structure 2> In the component access control device of the program system according to the second aspect of the present invention, the predetermined information source is login information.

<Structure 3> In the component access control device of the program system according to the invention of claim 3, a plurality of components are grouped together, and the user program issues an access request using a group name instead of the component. The access control means is configured to perform access control for each group instead of the component.

<Configuration 4> In the component access control device of the program system according to the invention of claim 4, the access information of the access control list is recorded on a portable recording medium.

[0013]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiments of the present invention will be described below using specific examples. <Specific Example 1> In specific example 1, when a component is created, an access check can be automatically performed for a user who has requested access to the component without adding user information to an access request message. Things.

FIG. 1 shows a specific example 1 of a component access control device operating on a computer system.
FIG. 3 is a block diagram showing the configuration. The user 1 is a user program such as an application program using the configuration.

The access control module 2 performs access control in response to an access request from the user 1 according to a flowchart described later. The component group includes various components A, B, C, D,.

The access control list 3 records the access information of the components. The access information is written in the format of "component name: authorized user name: access control contents" as shown in FIG. Register with. Note that the access control module 2 and the access control list 3 correspond to access control means.

FIG. 2 is a block diagram showing a configuration of a computer system in which the component access control device shown in FIG. 1 operates. As shown in FIG. 2, the central processing unit 11, main storage device 12, display 13, pointing device 14, keyboard 15, and magnetic disk device 16 are connected via a bus 17.

The main storage device 12 has a random access memory.
A memory device that includes a memory and stores various data and programs. The display 13 is a display device configured by a CRT or the like that displays a window, a cursor, and the like.

The pointing device 14 is an input device constituted by a mouse or the like for performing various inputs. The keyboard 15 is a pointing device 14
This is an input device for inputting characters and the like in the same manner as described above.

The magnetic disk device 16 is an external storage device for storing various data and programs. The central processing unit 11 is a device that includes a CPU and the like, and controls each device such as inputting data from the pointing device 14 or the like via the bus 17 and performing window display processing on the display 13.

The configuration of the specific example 1 shown in FIG. 1 is stored in the magnetic disk device 16 as data in advance, and the main storage device 1 is connected via the bus 17 when the program is executed.
2 and deployed as software. Then, the program 1 is executed by the central processing unit 11. When the central processing unit 11 is turned on, login information such as a user ID and a password is input, and the login information is stored in the computer system and serves as a predetermined information source of the user information.

<Operation> Next, the operation of the first embodiment will be described.
FIG. 3 is a flowchart for explaining the operation of the access control module 2 of the first embodiment.

In step 1, a message of a request for creating a component is input from the user 1. This creation request is output from the user 1 requesting the creation of a component when the entity of the component incorporated in the application program has not been created yet. For example, the message when creating component A is
It is described as follows. MAKE (Component A) As described above, only the component name to be created need be described in the message, and there is no need to describe user information or the like.

In step 2, information of the user who is currently logged in to the computer system is obtained from the login information. As the user information, the user ID which is one of the login information input at the time of login as described above is used.

In step 3, an access check is performed to determine whether the user 1 who has made the component creation request has the authority to create the component. This access check is performed by comparing the user information acquired in step 2 with the access information recorded in the access control list 3. For example, when an access request to create component A is output from user 1 as user 1, user 1 is registered in access control list 3 as being capable of creating component A. , User 1 has the access right. When it is determined that the user 1 has the access right, the process proceeds to Step 4.

In step 4, a designated component A is created. In step 5, the user 1 as the user 1 is notified that the component A has been created.
Thus, the component A can be incorporated into the application program of the user 1.

Next, for example, when an access request to create the component A is output from the user 2 as the user 1, the user 2 is registered in the access control list 3 as a user who can request the creation of the component A. In step 3, it is determined that the user 2 does not have the access right. At this time, the user 2 is notified that the creation of the component A has not been permitted, and the process ends. Step 2 corresponds to a user information acquisition unit, step 3 corresponds to an access check unit, and steps 4 and 5 correspond to an access permission unit.

<Effect of Specific Example 1> As described above,
According to the specific example 1, when a message of a request for creating a component is input, the access control module 2 acquires the user information of the user 1 from the login information without adding user information to the message, and automatically , The user 1 only needs to specify the component name that he / she wants to create, and the processing procedure of the user 1 becomes easy. Moreover, when there is a creation request from the user 1 who does not have access right, the creation of components is not permitted, so that a highly secure system can be constructed.

Although the user ID is used as the user information in the specific example 1, a password or the like may be used. Further, the user information is not limited to the login information, and other information may be used as the user information.

<Specific Example 2> In a specific example 2, an access check can be automatically performed even when referring to a component. Since the configuration of the specific example 2 is the same as that of the specific example 1, the same reference numerals are given and the description is omitted.

<Operation> Next, the operation of the embodiment 2 will be described.
FIG. 4 is a flowchart for explaining the operation of the access control module 2 according to the second embodiment.

In step 11, the user 1 inputs a message for requesting reference of a component. This reference request is output from the user 1 when there is a user 1 who wants to use the already created component. For example, a message when referring to the component A is described as follows. REFER (Component A) As described above, even at the time of reference, only the component name to be referred need be described in the message, and there is no need to describe user information.

In step 12, information of the user who is currently logged in to the system is obtained from the login information. In step 13, the user information acquired in step 2
By comparing the access information described in the access control list 3 with the access information, an access check is performed to determine whether the user 1 who has requested the creation of the component has the authority to create the component.

For example, when an access request to refer to component A is output from user 1 as user 1, user 1 is registered in access control list 3 as being capable of referring to component A. Therefore, it is determined that the user has the access right. At this time, the process proceeds to step 14 to check whether the specified component A has already been created. If component A has already been created,
Proceed to step 15.

In step 15, the specified component A is obtained. In step 16, the obtained component A is passed to the user 1, the user 1. If the component A has not been created even if the user has the access right, it is determined in step 14 that the specified component A does not exist, the user 1 is notified of the fact, and the execution of the process is stopped. Is done.

Next, for example, when an access request for referring to the component A is output from the user 2 as the user 1, the user 2 is registered in the access control list 3 as a user who can request the reference to the component A. In step 13, it is determined that the user 2 does not have the access right. At this time, the user 2 is notified that the creation of the component A has not been permitted, and the process ends.

<Effect of Specific Example 2> As described above,
According to the specific example 2, when a message for requesting reference of a component is input, the access control module 2 acquires the user information of the user 1 from the login information without adding user information to the message, and automatically , The user 1 only needs to specify the component name that he / she wants to refer to, and the processing procedure of the user 1 becomes easy even when referring to the component. In addition, when there is a reference request from the user 1 who does not have access right, reference to the component is not permitted, so that a highly secure system can be constructed.

When referring to a component, it is also checked whether or not the component has already been created. Therefore, when the component has not been created, useless reference can be omitted.

<Third Embodiment> In the third embodiment, similar components are combined into one, and an access check is performed using the group name.

FIG. 5 is an explanatory diagram showing an example of a component group. When the components A and C are of the same type, the components A and C are grouped as a group name “component TypeA” as shown in FIG.

Similarly, the component B is grouped into the group of "Component Type C", and the component D is grouped into the group of "Component Type C". The user information is also grouped as “user typeType”.

FIG. 6 is an explanatory diagram showing an example of the access control list 3 of the embodiment 3 in which the components grouped as described above are registered using the group name. As shown in FIG. 6, the access control list 3
, Access information is registered in the format of “component type name: permitted user type name: access control content”. The same elements as those in the first embodiment are denoted by the same reference numerals, and description thereof is omitted.

<Operation> Next, the operation of the embodiment 3 will be described.
When the user 1 requests creation or reference of a component, a type name including a component name to be accessed is specified in the message. For example, when specifying the component A, the component TypeA is specified.

When there is an access request, the access control module 2 acquires user information of the user who made the access request from the login information with the user type name, and performs an access check on this user type.

When it is determined that the user type has the access right, access to the component included in the designated component type is permitted. For example, when a request for creating the component TypeA is output from the user TypeA, as shown in FIG. 6, the user TypeA is registered in the access control list 3 as being capable of creating the component TypeA. Determines that the user TypeA has access rights and specifies the specified component TypeA
A and C contained in
Is created.

<Effect of Specific Example 3> As described above,
According to the specific example 3, the access control is performed using the component group name. Therefore, when there are a plurality of similar components, the user 1 does not need to specify the component names to be accessed one by one. , Access requests can be made collectively. Accordingly, if the components are increased and grouped and managed in this manner, access management becomes easy.

If the access information registered in the access control list 3 is stored in an IC card or the like and each user 1 possesses it, even if the number of users 1 increases, The access control can be performed according to the security, and the security can be improved.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of a component access control device of a program system according to a first embodiment of the present invention;

FIG. 2 is a block diagram showing a configuration of a computer system on which the component access control device of FIG. 1 operates.

FIG. 3 is a flowchart for explaining an operation of a specific example 1;

FIG. 4 is a flowchart for explaining the operation of a specific example 2;

FIG. 5 is an explanatory diagram illustrating an example of a component group of a specific example 3.

FIG. 6 is an explanatory diagram illustrating an example of an access control list of a specific example 3 in which components are registered using a group name.

[Explanation of symbols]

 1 user 2 access control module 3 access control list

Claims (4)

[Claims] 1. A computer program system in which a user program accesses a component as a unit for performing predetermined processing, incorporates the accessed component into the user program, and executes the user program. An access control means for performing access control, wherein the access control means, when the user program requests access to a component, user information acquisition means for acquiring user information of the user program from a predetermined information source An access control list in which access information relating to an access right to a component of the user program is registered in advance, and an access control list in which user information obtained by the user information obtaining means is stored. An access check unit that compares the registered access information with the registered access information and determines whether the user program that has made the access request has an access right based on the comparison result; and the access check unit determines that the access right has the access right. Access permission means for permitting access to the component of the user program, and disabling access to the component of the user program when it is determined that there is no access right. A component access control device for a program system. 2. The component access control device according to claim 1, wherein the predetermined information source is login information. 3. A plurality of components are grouped together, wherein the user program is provided instead of components.
Making an access request using a group name, the access control means, instead of the component,
The component access control device for a program system according to claim 1, wherein access control is performed for each group. 4. The component access control device according to claim 3, wherein the access information of the access control list is recorded on a portable recording medium.