JP2000330848A - Access control system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To obtain an access control system capable of executing the access control of safe objects in respect of access control between plural objects. SOLUTION: In the access control system, a user ID 204, a password 206 and preparation time 208 are added to an access descriptor 202 to be used for access control and stored in both of an object accessing an accessed object and the accessed object as generation information. When the access descriptor including the generation information does not coincide with the other one and an access can not be permitted, only the generation information is returned to the object. Since the accessing object outputs an access request again by a password corresponding to the returned generation information, flexible and safe access control can be executed.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an access control method for controlling access between a plurality of objects.

[0002]

2. Description of the Related Art In recent years, with the development of Internet technology and intranet technology, an interactive work environment using a network represented by electronic mail has been enhanced.

Further, considering security on the network, even if the user can access the network, it is indispensable to perform access control to allow only authorized users to access objects on the network. FIG. 13 illustrates an access descriptor used for access control. As shown in FIG.
00 is the user ID 2 as the access descriptor 2202
204 and a password 2206.

However, if access control information as shown in FIG. 13 is stolen when passing through a network, there is a problem that unauthorized access can be easily made.

[0005] Regarding the conventional data access control between objects, authentication has been performed to protect the system from unauthorized intrusion. Authentication is an operation that checks that an object is the correct user when accessing the object and gives permission.
D (such as a user name or a user number) and information (a password or a password) known only to a person having the ID.
Judgment and permission are made in pairs. Furthermore, the data was protected from unauthorized access from a user authenticated using encryption. However, due to the recent development of computer technology, there has been a problem that if only encryption is performed, it will be decrypted if there is sufficient time, and security cannot be maintained.

[0006]

SUMMARY OF THE INVENTION The present invention has been made in order to solve the above-mentioned problems, and provides generation information to an access descriptor with respect to access control between a plurality of objects. An object is to easily realize secure access control of an object.

According to the present invention, in a distributed environment, the contents of access control are changed in accordance with the generation of an object. Each object holds generation information.
An object of the present invention is to provide an access control method for comparing the generation information of an object with the access control information by holding the access control information in the generation and performing control for correct access.

[0008]

According to the present invention, in an access control method for controlling access between a plurality of objects using an access descriptor for accessing an object, the access descriptor changes the access descriptor over time. A descriptor change unit, an access descriptor holding unit that holds the access descriptor after the change changed by the access descriptor change unit and the access descriptor before the change,
By comparing at least one of the access descriptor after change and the access descriptor before change held in the access descriptor holding unit with an access descriptor sent from a certain object, An access control determining unit for controlling access from an object is provided.

Further, the access descriptor has information corresponding to real time.

[0010] The above access control method further comprises:
An access descriptor transmitting / receiving unit for transmitting / receiving the changed access descriptor changed by the access descriptor changing unit between objects is provided.

Further, the above-mentioned access control system is characterized in that it is applied to a distributed computer system connecting a plurality of computer systems via a network.

Further, the object accessed by the access control method is an object which has been encrypted in advance so as to be decrypted by a predetermined encryption key, and the predetermined encryption key is used to access the encrypted object. It is characterized as a descriptor.

Further, the encrypted object is a mail object used for electronic mail, and the access control method is applied to an electronic mail system.

[0014]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiment 1 The present invention focuses on the characteristics of the object in computing in a distributed environment, and when exchanging information for performing access control over a network, the information is stolen and sufficient time is taken to decrypt it. It provides a means for secure access even if done.

[0015] The characteristics of an object include, for example, e-mail, which require sufficient security immediately after the data is created, but the degree of security required as time passes. Is smaller, and conversely, objects holding data requiring security regardless of time are immediately deleted.

The present invention provides a simple and secure means for accessing data having such characteristics.

The present invention focuses on the feature that, for example, among the accesses to an object, depending on the data generation, the newer generation has a higher security requirement, and the older it is, the smaller the problem becomes. Access control descriptors are changed in order according to time and generation to prevent access control descriptor information from being stolen or disguised. It is not necessary to change the object for permitting access by the access control descriptor. The object change referred to here means that a process that manages an object of an old generation (a mail server program in the embodiment) transmits information for access permission of an object of an old generation to a new access permission. (For example, if the encryption key is changed, re-encryption, etc.).

Thus, even if the information for access control is changed in accordance with, for example, a change in the user's qualification, the information for past access control is used only for the object holding the past data. The feature of the present invention is that access can be made, so that the latest data cannot be accessed, but only data related to oneself in the past can be accessed.

Hereinafter, an embodiment of the present invention will be specifically described. First, FIG. 1 is a diagram showing an entire configuration of an embodiment of an access control method in a distributed object generation management apparatus of the present invention. Reference numerals 100 and 102 denote computer systems, 104 and 106 denote object A and object B, respectively, 108 denotes a network such as the Internet or an intranet,
The computer systems 100 and 102 are interconnected by a network 108, and the object A1
04 and the object B 106 are distributed computer systems that can communicate with each other.

The computer system 100 shown in FIG.
And 102 are protected by access control, and can access each other according to the contents of the access descriptor.

FIG. 2 shows an example of an access descriptor of an object to be accessed, and FIG. 4 shows an example of an access descriptor of an object to be accessed.

FIG. 2 shows an example of an access descriptor of an object to be accessed. In the figure, reference numeral 200 denotes an object itself, 202 denotes the entire access descriptor of the object 200, 204 denotes user information which is information of a user holding the object, and for example, when a user ID as shown in FIG. Enter, but as another example, enter the user name. Reference numeral 206 denotes user-specific information indicated by the user information, for example, a password, a key for encryption, and the like. The access descriptor 208 is created and applied creation time (time information)
And / or generation information.

FIG. 3 shows an example in which a specific value is held in the access descriptor of the object to be accessed. In 1204, "USERA" is used as the user ID.
However, 1206 uses "BBCCDD" as a password.
However, in 1208, "1998/12/1
415: 30 "respectively.

FIG. 4 shows an example of holding an access descriptor of an object to be accessed. In the figure, 300 indicates the object itself, and 302 indicates the object 3
Reference numeral 304 denotes an entire access descriptor for controlling access to 00, information 304 of a user to whom access is permitted, a user ID and a user name, a password and an encryption key as unique information of the user, A list of information including a set of three pieces of information such as time information applicable to the descriptor and generation information is entered.

FIG. 5 shows an example in which a specific value is held in the access descriptor of the accessed object.
In the example shown in FIG. 5, the creation time is divided into two items, namely, the creation time FROM and the creation time TO so that the range can be specified at the time of the search. However, only one creation time may be held. Absent. Creation time FROM, creation time TO
When the above two items are held, access control is performed as follows. First, a list of access descriptors whose user ID matches the object to be accessed is selected. From the list, a list in which the value of the creation time of the access descriptor of the object to be accessed exists within the range of the two items of the object to be accessed, the creation time FROM and the creation time TO, is searched. Control access by comparing the password in the list with the password of the object being accessed.

When there is only one item for the creation time of the object to be accessed, which list is used for access control depending on the value of the creation time of the object to be accessed, and the password of the determined list is determined. Performs access control. FIG. 6 shows a list obtained by adding generation information to the list shown in FIG. As shown in FIG. 6, not only the creation time but also generation information indicating a count of generations may be provided in the access descriptor.

FIG. 7 is a flowchart showing an algorithm for processing when the generation or time of the access descriptor of the user object changes. The access descriptor changes when, for example, the encryption key or password is changed over time, as shown in FIG.
The generation of the object created after the access descriptor has changed will be different from the generation of the object before the access descriptor has changed. FIG. 8 is an example of a flowchart of processing of an accessed object when actually accessing.

At step 400 in FIG. 7, the access descriptor before the change is stored in the object, and the access descriptor can be taken out by a predetermined method as needed. Next, in step 402, a new access descriptor is created. After this setting, when accessing this object, the first access always uses the new access descriptor. The case where the password is changed will be described with reference to the list of FIG. 5 described above as an example. USERB password 19
It shall be changed at midnight on January 1, 1999. FIG.
USERB's current password held in the access descriptor list of the object to be accessed is 31
4, "MYPASSWORD". At this time, since the change has not been made yet, the creation time TO has no value and is blank like the creation times TO of 310 and 313. At midnight on January 1, 1999, the current password “MYPASSWORD” is changed to a new password “NEWPASWORD”. At this time 31
As shown in FIG. 4, 1999/1/1 00:00:00 is entered in the item of the creation time TO for “MYPASSWORD”. This processing corresponds to storage of the access descriptor 400 in FIG. Also, setting of a new access descriptor (40 in FIG. 7)
As 2), the access descriptor indicated by 313 in FIG. 5 is registered.

In step 500 of FIG. 8, a data access request is received from another object, and an access descriptor for access is received. In step 502, user information and content as its own access descriptor and contents are obtained. , The password and the generation information, and if they match, access is permitted in step 506, and if they do not match, step 504
Then, only generation information (for example, information indicating all generations such as time) is returned to the accessed object. The user information is information for uniquely identifying a user, such as a user ID, and is a numerical value comparison, and the password information is a character string comparison.

When the generation information is returned, the object that has attempted access accesses the access descriptor corresponding to the returned generation information from the past access descriptors before the change stored in step 400 of FIG. Search and try to access again using the found access descriptor before change.

As described above, the access descriptor of the object to be accessed is changed with the passage of time, the history of the access descriptor is provided as generation information, and the object to be accessed is identified by the access descriptor corresponding to the generation information. Since the object is accessed, it is possible to restrict an object to be accessed by the new object.

By having the generation information, it is possible to access the objects of the old generation.
Even if affiliation change, assignment change, organization reorganization, etc. occur, by keeping a history of codes etc. representing affiliation and qualifications, the access descriptor of the object is changed for that purpose without any special modification to the system. You can continue to be involved in work related to the past. Further, even in such a case, access control can be performed for each individual object so that other objects under the same management as the object are not erroneously accessed. For example, if the object is mail, the old mail (object) will read the old access descriptor, but even if it occurs, the new mail (object) will be inaccessible because the access descriptor has been changed, It will not be read. When it is desired to allow a specific object to access a new mail (object), a communication unit (transmitting / receiving unit) for notifying a new access descriptor to the specific object is provided.
A new access descriptor may be notified by the communication means.

As described above, in this embodiment, the computer system controls whether access to the objects in the distributed computer system is permitted or not, and the object A accesses the object B. In this case, there is provided a means for transmitting an access identifier at a past time from the object A to the object B, and a means for determining whether to permit access at the current time using the access identifier at the past time. The access control method for controlling access between objects has been described.

Also, an access control method for controlling access between objects using an access identifier having information according to real time has been described.

In addition, there is provided a means for changing the access identifier of the object in a certain time,
The access control method for controlling access between objects, including means for transmitting and receiving the changed information between objects, has been described.

Also, an access control method using user information and password information of a user at that time as an access identifier has been described.

Also, an access control method between objects which can be applied to a single computer system has been described.

According to the present embodiment, the access descriptor of the past generation can be used as needed by holding the access descriptor of each generation in the form of, for example, a table. Access between objects can be realized in accordance with changing information for access control.

Embodiment 2 In this embodiment, an example will be described in which the above-described embodiment is further applied to an e-mail device that is specifically applied. An e-mail object is an example of an object that has the characteristic that its importance decreases over time. In addition, the object is frequently requested for access from other objects. For example, when a mail server is operated in a company by an intranet or the like, there is a case where the user wants to access the mail server from outside the intranet, for example, from a business trip destination. In the intranet, a firewall is often installed to protect the security of the intranet. In this case, from outside the installed firewall, etc.,
Since it will be connected to the intranet via the normal Internet, it cannot be said that it is a desirable operation in terms of security. Therefore, in order to access the mail object, an operation of arranging a new mail server outside the firewall may be performed. In this case, since the new mail server is outside the firewall, security protection by the firewall cannot be received. Therefore, it is necessary to control unauthorized access to the mail object and control legitimate access to support the access. This case will be described in this embodiment.

FIG. 9 shows an embodiment of an e-mail device. An e-mail server device 600 holds and manages e-mails (also referred to simply as an e-mail server).
Reference numeral 602 denotes a client for a user to read an e-mail, and 603 denotes a network (device) such as the Internet or an intranet. The e-mail server 600 and the client 602 are connected via the network 603 and can be accessed. It is.

Reference numeral 610 denotes a mail spool in the electronic mail server device, which is the delivered mail itself. The mail spool is treated as new mail until the client accesses the mail for the first time. Reference numerals 604 and 606 denote mail objects taken out of the mail spool 610 and managed by the electronic mail server device for each destination. The mail object can be accessed only by a specific user. For example, a plurality of accesses composed of user information such as a user ID and a user name, user-specific information such as a password, and generation information such as time. List of descriptors (Figure 5,
List similar to the list shown in FIG. 6),
The access from the user is controlled using this access descriptor.

Reference numeral 608 denotes a user object on the client 602, which includes user information such as a user name;
It has an access descriptor as shown in FIG. 3, which is composed of user-specific information such as a password and information indicating the generation.

FIG. 10 is a flowchart of a mail management program operating on the electronic mail device shown in FIG.

In step 700, the e-mail server 60
The mail arriving at 0 is spooled for each user, and if there is an access request from the user, the access descriptor is compared in step 702 according to the access request (request), and it is determined that the user is the correct user. If the user is a user, a mail object is created in step 704, and an access descriptor of a user who is permitted to access the mail object is set in the mail object in step 705. As a result of the comparison of 702,
If not, the access request is rejected.

FIG. 11 is a flowchart for accessing the mail object created in FIG. 10 from the client.

At step 800, a request for access to the mail object is received from the user, and the access descriptor sent together with the access request is compared with the list of access descriptors of the mail object. , And only the time information or the generation information of the mail object is returned to the user. The generation information indicates information necessary for identifying a generation. In this embodiment, only one piece of time information (also referred to as time information) is illustrated. However, the present invention is not limited to this, and a plurality of pieces of information may be used as generation information.

In the comparison in step 800, if there is a suitable access descriptor, access is permitted in step 802 and the actual access is made.

If the access descriptor does not match and the access is rejected in step 800, the access request is made using the access descriptor used in that generation based on the generation information transmitted from the mail object. Then, the check in step 800 is executed again.

This embodiment is an embodiment for realizing access to objects of different generations by executing as described above. In the above description, the case where the latest generation is accessed at the first access to the object is described. However, even if the object of the past generation is accessed from the first access using the access descriptor of the past generation. I don't care.

As described above, in this embodiment, regarding the access control of the distributed object, when the access qualification of the user who requests the access is held, the change of the access qualification is accumulated as generation over time,
The access control method in which the access request is made by designating which generation of qualification to access has been described. According to this access control method, flexible access control can be performed with respect to a change in qualification. The mail object may be encrypted with an encryption key for encrypting the object, and a decryption key for decrypting the encrypted mail object may be used as an access descriptor. Further, a password for accessing the mail object may be encrypted. In this case, the encryption key is changed over time. Then, a list (history) of the changed encryption keys is stored, and access control is performed using the list. FIG. 12 shows an example of a key table in the case of managing the generation of an encryption key. If the encryption key is changed over time, if the decryption key is stolen after enough time for decryption, even if old mail may be read, new mail after changing the encryption key will not It will not be read. The decryption key corresponding to the changed encryption key for the new generation is distributed only to objects that have been granted access to the new generation of objects. The distribution method may be sent by e-mail, for example. that time,
The decryption key itself may be encrypted and sent. Further, another distribution method may be adopted. Then, the object having the decryption key for the new generation can access the accessible object using the decryption key for the new generation. Objects without a decryption key for the new generation can use the old available access descriptor of the old generation that was previously available to access the range of objects permitted by the access descriptor. .

[0051]

According to the present invention, an object of an old generation can be accessed, and even if the data is important at the beginning of the generation of the object, the data can be simplified so that its importance decreases with time. Access can be realized in the network and each server without changing the access descriptors of all objects each time user-specific information changes. Even if the data is important at the beginning of the creation of the object, if it is applied to an object that has characteristics that reduce its importance over time, it will not be applied to encryption keys etc.
In particular, in terms of dealing with attacks,
It is valid.

[Brief description of the drawings]

FIG. 1 is a diagram showing an overall configuration of an access control system of the present invention.

FIG. 2 is a diagram illustrating an example of an access descriptor according to the present invention.

FIG. 3 is a diagram illustrating an example of an access descriptor according to the present invention.

FIG. 4 is a diagram showing an example of an access descriptor according to the present invention.

FIG. 5 is a diagram showing an example of an access descriptor according to the present invention.

FIG. 6 is a diagram illustrating an example of an access descriptor according to the present invention.

FIG. 7 is a flowchart of a process when the generation of the access descriptor changes according to the present invention.

FIG. 8 is a flowchart of processing of an accessed object according to the present invention.

FIG. 9 is a configuration diagram when the present invention is applied to electronic mail.

FIG. 10 is a flowchart of a mail management process of the present invention.

FIG. 11 is a flowchart when a mail object of the present invention is accessed from a client.

FIG. 12 is a diagram illustrating an example of a key table when generation management is performed using an encryption key according to the present invention as an access descriptor.

FIG. 13 is a diagram showing a conventional access descriptor.

[Explanation of symbols]

100, 102 computer system, 104 object A, 106 object B, 108 network, 202, 302 access descriptor, 204 user ID, 206 password, 208 creation time, 30
0 object, 323 generation, 324 user I
D, 326 password, 328 creation time FROM,
329 creation time TO, 410 generation, 420 key,
600 email servers, 602 clients, 60
3 Network, 604, 606 mail object, 608 user object.

Claims (6)

[Claims] 1. An access control method for controlling access between a plurality of objects using an access descriptor for accessing an object, wherein an access descriptor changing unit that changes the access descriptor with the passage of time; An access descriptor holding unit for holding the changed access descriptor changed by the access descriptor changing unit and an access descriptor before the change, an access descriptor after the change held in the access descriptor holding unit, And an access control determining unit that controls access from the object by comparing at least one of the access descriptors before the change and the access descriptor sent from the object. Characteristic access control method. 2. The access control method according to claim 1, wherein the access descriptor has information corresponding to real time. 3. The access control method according to claim 1, further comprising an access descriptor transmitting / receiving unit for transmitting / receiving the changed access descriptor changed by the access descriptor changing unit between objects. The access control method according to any one of 1 and 2. 4. The access control method according to claim 1, wherein said access control method is applied to a distributed computer system that connects a plurality of computer systems via a network. 5. An object accessed by the access control method is an object encrypted in advance so as to be decrypted by a predetermined encryption key, and the predetermined encryption key is used to access the encrypted object. 5. The access control method according to claim 1, wherein the access control method is a descriptor. 6. The access control method according to claim 5, wherein the encrypted object is a mail object used for electronic mail, and the access control method is applied to an electronic mail system.