JP2003058423A - Method, system, and program for access control - Google Patents

Abstract

PROBLEM TO BE SOLVED: To set an access control level in detail without placing any burden on a user nor administrator. SOLUTION: By the access control method, a user agent 111 is actuated at a request to apply for the use of a resource of another user that one user makes, specifies another user agent 131 associated with the other user and transmits an application for the use of the resource to the other user agent 131 together with its access control level. The user agent 131 requests the other user to acknowledge the use of the resource in response to the resource use application; when the use is acknowledged, necessary information is stored in its access control list and the acknowledgement is reported to the former user agent. The user agent 111 stores necessary information in the access control list on receiving the report.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to access control to in-system resources in a distributed computing system.

[0002]

2. Description of the Related Art In a distributed computing system, access control to resources in the system is conventionally performed by A
This is realized by setting CL (Access Control List). This ACL can be set for each resource such as server, directory, content, etc. There is an administrator who is authorized for each ACL, and only this administrator can set or change the ACL. Has become.

In control using ACL, for example,
In order for the user “b” of the server “B” to be able to access the resource “R” of the server “A”, first, the user “b” uses some means to indicate that he wants to access the resource “R”. Then, the user "b" is registered in the server "A" and the server "B", and the administrator of the resource "R" in the server "A"
It is necessary to set information including the access authority of the user “b” in the ACL related to the resource “R”. After such registration and setting, by the instruction of the user “b”,
User “b” from server “B” to server “A”
Authentication is required, and after the authentication, access to the resource “R” becomes possible according to the setting items in the ACL.

[0004]

In the conventional access control using the ACL, (1) only the administrator can set or change the ACL, so that the user who uses the resource can change the access control level. When requesting changes, it was necessary to perform procedures such as requesting changes to the manager. (2) There is a problem that the burden on the administrator increases as the frequency of setting and changing increases, or the ACL scale increases, that is, the number of objects to be managed increases. there were. This is because the ACL setting for each resource is premised.

(3) As the access control level set in the ACL becomes diverse, there has been a problem that the work of setting and changing becomes complicated. In particular, when the ACL is set for each content, this problem becomes remarkable, and it becomes difficult to set a fine access control level. For this reason, in general, only ACLs for specific groups are currently set, such as being limited to users aged 18 and over. (4) Further, an ACL inquiry is required every time a resource is accessed or a session is established. As a result, there is also a problem that the user has more opportunities to input the ID and password.

[0006] It is an object of the present invention to provide a system capable of finely setting an access control level in a desired unit without burdening a user or an administrator.

[0007]

An object of the present invention is to provide an access control method when a user who uses the system uses resources related to other users, which can be used by each user. Providing a user agent that manages information about resources of other users together with their access levels as an access control list, the user agent being activated in response to a request from a user to use resources of another user, Identifying another user agent for another user, said user agent transmitting to said other user agent a request for use of said resource together with its access control level, said other user agent However, application for using the above resources In response, requesting the other user to approve the resource usage, and the other user agent saves necessary information in its access control list in response to the acceptance of the resource usage approval. At the same time, the method further comprises the step of notifying the user agent that the approval has been given, and the step of storing necessary information in the access control list of the user agent in response to receipt of the notification. This is achieved by a characteristic access control method.

According to the present invention, the information including the access control level is stored in the access control list among the user agents provided for each user. Therefore, resource utilization between users can be realized without setting an access control list for each resource.

In a preferred embodiment, the user agent further collates the information related to the application with the access control list in response to a request from the user to use a resource of another user. , Confirming its contents, transmitting the resource usage request to the other user agent together with its access control level, and the other user agent responding to the resource usage request. Referring to the access control list, collating the information related to the usage request with the information in the access control list, acquiring the resource related to the request, and transmitting the resource to the user agent, The user agent uses the transmitted resource to determine which resource the user is using. And a step of providing a.

Further, in a preferred embodiment of the present invention, the access control level is a resource read,
Includes writing to resources, changing the display format of resources, availability, and / or combinations thereof.

In a more preferred embodiment, the user agent further provides a list of services that can be provided from the service agent that manages the services that can be provided and related information in response to a request from the user to add the services. And presenting the list to the user, and a template including items of data necessary for providing the service to the service agent according to selection information from the list from the user. A step of obtaining a service object that is a type, a step of generating a form enumerating items that require user input based on the service object, and presenting the form to the user, and information input to the form by the user According to the access control list of the user And a step of storing the service object information is given. In this way, by using the service object, it is possible to make fine setting.

In another preferred embodiment of the present invention, a user agent relating to a leader of a group composed of a series of users responds to a request from the leader to generate a group agent relating to the group. Requesting an agent manager managing the agent to generate a group agent, and the agent manager generates a group agent related to a group composed of the user group, and at least information about the leader in an access control list. Saving, the user agent saving in the access control list that the associated user has become a group leader, and the group agent configuring the group from the user. Responding to the member and the instruction to notify the registration of the member, the step of notifying each of the user agents related to the member that they will be registered as a member of the group, and the acceptance of the confirmation from the user agent related to the member. Responsive to saving the information about the member in the access control list, and in the user agent for the member, saving in the access control list that the related user has become a member of the group. ing.

In a more preferred embodiment, the user agent is further activated in response to a request from a user to use a resource of another user as a leader or member of a group, and activates the access control list. For reference, a step of identifying a group agent related to the group, a step of transmitting to the group agent a request to use a resource as a group, the group agent, to the other user agent, Transmitting the application for use of the resource together with its access control level, the other user agent, in response to the application for use of the resource, requesting the other user to approve the use of the resource, Other user agents Responding to the acceptance of the approval of the resource use, storing the necessary information in the access control list, and notifying the group agent of the approval, and the group agent, Saving the required information in its access control list in response to receipt of the notification.

Another object of the present invention is an access control system in which a user who uses the system controls the use of resources related to other users. A user agent that manages information about a resource as an access control list together with its access level, the user agent is activated in response to a user's request for use of the resource by another user, User agent specifying means for specifying a user agent, and use application processing means for transmitting a use request for the resource to the other user agent together with the access control level thereof,
The access control is performed in response to the resource use approval request to the other user in response to the resource use application in the other user agent and the notification transmitted to the user agent based on the acceptance of the approval. This is achieved by an access control system characterized in that the list has information storing means for storing necessary information.

Preferably, the user agent is
Access control list collating means for collating information relating to the application with the access control list and confirming the content thereof in response to a request for use of the resource of the other user from the user or another user agent. Have.

Another object of the present invention is a program for allowing a user who uses the system to control access to a computer in order to control the use of resources relating to other users. Providing a user agent for managing information on resources of other available users as an access control list together with its access level, and starting at the user agent in response to a user's request for use of resources of other users Then, a step of identifying another user agent related to the other user, a step of transmitting a use request for the resource to the other user agent together with the access control level thereof, and in the other user agent, The resource In response to the resource use approval request to the other user in response to the user's use application and the notification transmitted to the user agent based on the acceptance of the approval, necessary information is stored in the access control list. And an access control program that causes the computer to execute the steps.

In a preferred embodiment, further, in the user agent, in response to a request from the user or another user agent to use a resource of another user, the information related to the application is provided to the access control. The computer is made to execute the step of checking the contents by checking the list.

[0018]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the accompanying drawings. FIG. 1 is a diagram showing an outline of a data communication system according to an embodiment of the present invention. As shown in FIG. 1, in the data communication system according to the present embodiment, a plurality of servers 14-1 and 14-2 are connected to a network 12 such as the Internet. The servers 14-1 and 14-2 are respectively provided with agent managers 22-1 and 22-2 that manage agents associated with resources described later. For example, the server “A” 22-1 is provided with an agent manager “A” 22-1 that controls an agent associated with a resource accommodated in the resource DB 16-1 of the server “A”.

The resource "10" is stored in the server "A" 14-1.
A resource database (DB) 16-1 accommodating 1, 102, ... And an agent database (DB) 18-1 accommodating the agents 111, 112 ,. There is. The resource “a1” 101 includes the agent “UA
-A1 ”111 is associated and resource“ a1 ”10
2 is associated with the agent “UA-a2” 112.

Similarly, the server "B" 14-2 also has a resource DB 16-2 accommodating the resources 121, ...
, And an agent DB 18-2 accommodating the agents 131, ... For each resource are connected. Here again, the agent "U" is assigned to the resource "b1" 121.
“A-b1” 131 is associated. In this specification, a resource means a server, a directory, a content, or the like. In the present embodiment, users a1, a2 and b1 are assigned resources “a1” and “a”.
2 ”and“ b1 ”are respectively owned, and the permission / inhibition of each access and the setting of the access control level require the approval of the user who owns the resource.

Further, in the network 12, client machines 20-1, ..., 20-used by each user.
n are connected. Each client machine 20 accesses the server to register resources owned by the user who operates the client machine, or changes the contents, or accesses the server to manage resources owned by other users. You can browse and write data, etc., if necessary.

FIG. 2 is a block diagram showing an outline of the configuration of the server according to this embodiment. Although the server 14-1 is shown in FIG. 2, other servers (for example, the server 14-2) have the same configuration.

As shown in FIG. 2, the server 14-1 is
An HTTP server 201 that executes data communication according to TTP, a virtual machine (VM) 202 that executes a Java (registered trademark) program in the server 14-1, a system manager 203 that controls various managers described below, and each user. An agent manager 304 that manages agents and a service manager 305 that manages various services such as applications are provided.

A user agent (eg, "UA-
The "a1" 111 and "UA-a2" 112) are activated by the agent manager 111 or given necessary instructions. For example, the user agent “UA-a1” 111 has services 311, 31 including an application owned by the user “a1”.
2 can be managed.

Here, in the service, a business card exchange service that refers to business card data between users or supplies business card data to the other party, a user can describe desired items, and this can be described by other users. Manage a diary service that can be referred to under a specified access right, manage user's schedule, refer to this under another user's specified access right, or write a new schedule The schedule service etc. which can do are included. Needless to say, the services include those that provide some kind of data to the user by other applications. In addition, the resources according to this embodiment are
It includes the above services, service names and data required to provide the services, and user information.

The access control procedure using the server 14 thus configured will be described in more detail. FIG. 3 is a flowchart illustrating a procedure executed when the user b1 uses the resource a1 owned by the user a1 between the user b1 and the user a1. As a premise that the process shown in FIG. 3 is executed, the user a
1 has already set the user information, registered the resource a1, set the user agent UA-a1, and registered the service information using the resource a1. These settings and registration will be described later.

A client machine (for example, the client machine 20-1) operated by the user b1 in this process is referred to as a client b1.
A client machine (for example, the client machine 20-n) operated by is referred to as a client machine a1. Also, the user agent UA for the user b1
-B1 is managed by the server B (see reference numeral 14-2 in FIG. 1) and is a user agent UA for the user a1.
a1 is managed by the server A (see reference numeral 14-1 in FIG. 1).

When the user b1 operates the client machine b1 and logs in to the server B (step 30)
1), the server B responds to this, by the agent manager “B” (see reference numeral 22-2 in FIG. 1; hereinafter, “AM”).
B ". ) To start the UA-b1 (step 302). The AMB activates UA-b1 (step 303). Then, the client machine b1 gives an instruction to the UA-b1 to apply for the use of the resource a1 (step 304).
In the usage application, the other user (user a
The information specifying 1) and the information indicating the access level described later are included.

The UA-b1 responds to the instruction by sending the server A
(See reference numeral 14-1 in FIG. 1) is requested to use the resource a1 (step 305). In response to this, the server A sends U to the agent manager “A” (see reference numeral 22-1 in FIG. 1; hereinafter referred to as “AMA”).
The start of A-a1 is instructed (step 306). AMA
Responds to the instruction by sending the resource a to the UA-a1.
The usage application for No. 1 is transmitted (step 307). For this usage application, the user who is the applicant (user b1)
It includes information that identifies the access point and information that indicates the access level.

The UA-a1 notifies the client a1 that the user b1 has requested to use the resource a1 at a certain access level, for example, by mail (step 308). Of course, a method other than mail may be used, for example, an application that pops up on the screen of the display device of the client a1 may be used to notify the application. User a1
When the client operates the client a1 to instruct the UA-a1 to permit (step 309), the information indicating permission is UA.
It is transmitted from -a1 to UA-b1 via AMA (steps 310 and 311). It should be noted that an agreement may be made in advance between the users a1 and b1 to allow the resource a1 to be used under a predetermined access level. For example, the user a1 may be notified by e-mail notification.
However, it may be known for the first time that the use of the resource a1 is required. Further, the UA-a1 saves necessary items in the access control list (ACL) (step 312). When the UA-b1 also receives the information indicating the permission, the UA-b1 stores necessary items in the ACL (step 31).
3).

5 (a) and 5 (b) are diagrams showing an example of the ACL according to the present embodiment.
In FIG. 5A, the ACL includes a contract list 501, which is a list of resource names in which a user related to the UA agrees to use the resource with another user, and each resource listed in the list. , Passport groups 502-1 and 502-2 in which the name of the UA and the access control level related to the resource are described. For example, in the passport 502-1, regarding the resource a1, it is shown that the related UA is UA-a1 and the access control level is “R / W”, that is, reading and writing of the resource are permitted. ing.
In the passport 502-2, the resource a2
Regarding, regarding the related UA, it is indicated that the related UA is UA-a2, and the access control level is “R, modification”, that is, reading of the resource and change of the display format are permitted. In the present embodiment, for example, read, write, delete, modify, and combinations thereof are used as access control levels. Of course, this is an example, and it goes without saying that other levels may be set.

On the other hand, in FIG. 5B, the passport 511 lists the combinations of the resource name and the associated UA and access control level. Both of them have the same function. Next, as shown in FIG. 3, it is executed after registering necessary items in the ACL,
The procedure for accessing the resource will be described with reference to FIG. Note that FIG. 4 also shows the processing executed when the user b1 uses the resource owned by the user a1.

First, when the client machine b1 logs in to the server B in accordance with the operation of the user b1 (step 401), the server B responds to this by the AMB.
Is instructed to start UA-b1 (step 402). A
The MB activates UA-b1 (step 40).
3). Next, from the client machine b1, UA-b
1 is instructed to use the resource a1 (step 404), the UA-b1 refers to the ACL and confirms the contents of the passport related to the resource a1 (step 405), and the resource name (resource a1), the user agent name (UA-a1) and the related access control level (AC level) are transmitted to the server A to request the use of the resource a1 (step 406).

Server A responds to the receipt of the information by responding to the UA
Instruct the AMA to activate a1 (step 4
07). As a result, UA-a1 becomes active (step 408). Server A then proceeds to step 4
The resource name and the access control level transmitted in 06 are transmitted to UA-a1 (step 409). UA-
The a1 obtains the resource a1 after collating the transmitted resource name and access control level with the access control level related to the resource name stored in its ACL (step 410) (step 41).
1). The resource a1 is transmitted to the client b1 via the UA-b1 (steps 412 and 413). As a result, the client b1 enters a state in which the resource a1 can be used.

A case in which correction (change of expression format) is permitted when the user a uses the resource a1 owned by the user a1 in the ACL will be described with reference to FIG. For example, in UA-b1,
When resources are provided by the UA-a1 (step 60
1 or step 412), the UA-b1 obtains the style sheet in which the display format for the user b1 is described based on the access control level described in the passport in the ACL (step 602). Then, UA-b1
Refers to the information in the style sheet, converts the information to be presented to the user, for example, the display format of the content generated from the resource (step 603), and transmits the converted content to the client b1 (step 6).
04 or step 413).

As described above, according to this embodiment, a user agent related to a user can obtain various information (resource name, partner user agent name, access control level, etc.) related to resources available to the user, Also, it manages various information (user name, user agent name, access control level, etc.) regarding other users who use the resources owned by the user. Therefore, the setting at the time of accessing the resource, the actual access, etc. are realized by the operation of the user agent. This makes it possible to realize access to the resources owned by another person without the intervention of the administrator.

Further, according to the present embodiment, when the user owns the resource, the access control list can be set in the user agent of the user, and the information of the resource and the service to be provided can be stored therein. Therefore, it becomes possible to finely set the access control level and the like. Similarly, it is possible to finely set the access control level of the resource used by itself. Furthermore, according to the present embodiment, it is possible to eliminate the need to go through a procedure of requesting a specific third party such as a system administrator for setting-change.

Further, according to this embodiment, the user agent automatically checks and inquires about the access control level. Therefore, the user does not need to be aware of this, and convenience can be improved. Furthermore, a form in which access control is agreed between user agents,
That is, the communication between the user agents is used to store the agreed information (for example, the user name and the access control level) in the ACLs of both user agents, so it is necessary to set the ACL for each resource. There is no.

Next, regarding the new registration to the server by a certain user and the generation of a new user agent,
Description will be added with reference to FIG. 7. Here, the user a1
A case will be described in which the client a1 is operated to newly register with the server A. When the user a1 operates the client a1, the client a1 requests the server A for connection (step 701). Server A
In response to this, sends a registration form for registration to the server A to the client a1 (step 70).
2). After the user a1 fills in predetermined items in the items of the registration form, the completed registration form is transmitted from the client a1 to the server A (step 70).
3). In the present embodiment, the items of the registration form include a desired user ID, name, and email address. For example, if the business card exchange service is assumed to be used as a resource, the items on the registration form may further include the company name, address, telephone number, fax number, and face photo. Is desirable. The server A checks the input items such as whether the required items are filled (step 704), and then the user ID (U
A mail including the ID) and the password (pwd) is transmitted to the client a1 (step 705).

When the client a1 logs in (step 711), the server A checks predetermined items (step 712), and then the user agent (U
Agent manager “A” for instructions to set A)
(AMA) (step 713). In the present embodiment, the UA relating to the user is newly set by accessing within 24 hours after the mail communication in step 705.
Therefore, in step 712, UID and pw
In addition to the user authentication by d, it is determined whether the access is within 24 hours from the mail communication.

AMA follows the instruction of UA setting
The user agent UA-a1 for the user a1 is generated (step 714). Here, step 70
The information in the registration form sent in 3 is also set. In this way, a user agent for a user can be created. After that, the user can register or add information regarding a service provided by the user, which will be described later, to the user agent, and can also register resources of other users to be used in the ACL.

FIG. 8 is a flowchart showing the processing executed when adding the service provided by itself. In this example, the user a1 operates the client a1 to access the server A and sets a new service in the user agent UA-a1 of the user. First, when the client a1 logs in to the server A (step 801), the server A asks the AMA.
The UA-a1 is instructed to be activated (step 802), and the UA-a1 becomes active (step 80).
3). Here, the UA-a1 is directed to the service manager (see the reference numeral 305 in FIG. 2;
A) is requested and necessary information is acquired (step 804). SA is an agent that manages templates of various services that can be provided in the present embodiment. This SA may be referred to as a service agent. The template managed by the SA includes, for example, a service name, a data structure, an ACL format (reading, writing, correction (change), definition of deletion, etc.) for a business card exchange service.

In response to the request from UA-a1, SA
Gives service information including a list of various services that can be provided to the UA-a1 (step 805), and
Transmits the list of available services to the client a1 (step 806). When the user operates the client a1 and selects a new service to be provided, the selection information is transmitted to the UA-a1 (step 8).
07). In response to this, the UA-a1 acquires an object (template) related to the service selected from the SA (step 808), and sets the user a1 to input necessary items (service information setting form).
Is generated and transmitted to the client a1 (step 809). When the setting form in which the necessary items are input is given to UA-a1 (step 810), U
A-a1 sets the input information as a template and stores the set service information (step 811).
As a result, the user a1 can provide a service based on the service information set in the UA-a1.

In the present embodiment, not only a single user uses the resources of another user, but also a user who is a member of a group of one or more users,
You can also use the resources of other users. Figure 9
FIG. 6 is a flowchart showing a process executed in response to a group leader requesting generation of a user agent for a group.

In the example of FIG. 9, the leader of the group is the user a1, and the members of the group include at least the user b1. When the user a1 operates the client a1 and logs in to the server A (step 90)
1), the server A responds to this and sends the UA-a to the AMA.
1 is activated (step 902). AMA is U
A-a1 is activated (step 903).

Then, from the client a1, the UA-a
The instruction to generate the group agent is transmitted to the server 1 (step 904). In response to the acceptance of the instruction, the UA-a1 requests the AMA to generate a group user agent (herein referred to as "GUA") (step 905). When the AMA generates the GUI (step 906), in the generated GUI, the information indicating that the generation requester (here, the user a1) is the group leader is stored in the ACL (step 90).
7). Further, the UA-a1 saves in the ACL that the user a1 has become the leader of the group (step 90).
8).

Next, the user a1 who is the group leader
By the operation of, together with the information showing the members of the group,
The member registration notification instruction is issued from the client a1 to the GUI.
(Step 909), the GUA notifies the member that member registration will be performed (step 910). Here, only the notification to the user b1 who is a member is shown, but in reality, all the members are notified.

The member registration notice is sent from the UA-b1 of the server B.
It is transmitted to the client b1 operated by the user b1 via (user agent of the user b1) (step 911). When a notification (confirmation notification) admitting that registration should be made is transmitted from the client b1 to the UA-b1 (step 912), the UA-b1 transfers this to the GUIA (step 913). In response to this, the GUIA uses the user who has sent the confirmation notification as a member, and
(Step 914). Similarly, UA-b1
Stores in the ACL that the user b1 has become a member of the group agent (step 915).

FIG. 10 is a flowchart showing a process executed when a user agent of a user who owns a certain resource requests to use the resource as a group. In the present embodiment, the group agent is activated by an instruction from the group leader to apply for the use of resources owned by another user. FIG. 10 shows an example in which the user a1 who is the group leader uses the resource (resource b2) owned by the user b2 as a group. The process shown in FIG. 10 is basically similar to that shown in FIG.

In FIG. 3, from the client b1,
The AMB and UA-b1 of the server B are activated, necessary information is transmitted to the server A, and the AMA and UA of the server A are responded to in response to the use application (use application of the resource a1) from the UA-b1. -A1 is activated, and the client a1 operated by the user a1 is requested for permission to use. On the other hand,
At 0, from client a1 to server A's AM
A and UA-a1 are activated, and the use of the resource b2 as a group is also confirmed in response to the application instruction (step 1004), the ACL is confirmed (step 1005), and the group agent GUA related to the group is used.
Is activated (step 1006), and thereafter, the GUA
It is designed to carry out the necessary processing.

More specifically, when the GUA is activated, the AC
UA, which is the user agent for user b2, is searched for L to obtain the group access control level and the like.
-Request the use of the resource b2 to the server B in which b2 exists (step 1009). In response to the usage application, the server B instructs the AMB to activate the UA-b2 (step 1010), and the UA-b2 is activated (step 1011). Subsequent processing (steps 1012 to 1017) is substantially the same as steps 308 to 313 in FIG.

After the use application as shown in FIG. 10, the leader and members of the group can use the resources of other users. FIG. 11 is a flowchart showing a process executed when a member of a group accesses a resource owned by another user b2 as a member of the group. Here, the case where the member a2 of the group uses the resource owned by another user b2 is shown. In FIG. 11, according to the operation of the user a2, the client machine a2 changes to the server A.
When logging in to (step 1101), server A
In response to this, the AMA is instructed to activate the user agent UA-a2 of the user a2 (step 1).
102). As a result, UA-a2 becomes active (step 1103).

Next, from the client machine a2 to UA
When -a2 is instructed to apply to use the resource b2 as a member of the group (step 1104), the UA-a2 confirms the ACL (step 1105) and confirms that the user agent for the group, GUA. Is specified, and an activation instruction is given to the GUI (step 1106), and thereafter, an instruction to apply to use the resource b2 is given (step 1107). G
The UA searches the ACL (step 1108), obtains necessary information, accesses the access control level (AC level), and provides the information specifying the resource b2 to be used and the user agent UA-b2 to the server. B
(Step 1109).

Server B responds to the receipt of the information by AMB.
To start the UA-b2 (step 111).
0). This activates UA-b2. UA
-B2 refers to the ACL and confirms the information regarding the group that has applied for use (step 111
2) The resource b2 is acquired (step 1113).
Thereafter, resource b2 is provided to client a2 via GUA and UA-a2 (step 11).
14, 1115, 1116). In this way, the user a2 can use the resource b2 as a member of the group.

The user a1 who is the leader of the group has the same processing procedure when using the resource b2. Also, when a member (for example, b1) using another server (for example, server B) uses the resource b2, the procedure is substantially the same. FIG. 12 is a flowchart showing the processing in that case. Here again, basically, the same processing as that shown in FIG. 11 is performed. In FIG. 12, for the server A where the GUA exists, the UA
-B1 instructs activation of GUA (step 1206),
The GUA is activated via the AMA (steps 1207, 1208). Also, from the GUA, the usage application is transmitted to the resource b2 to the server B having the resource b2 (step 1211), the AMB activates the UA-b2, and the UA-b2 confirms its own ACL. After that, the resource b2 is acquired, and this is transmitted to the GUA. Further, the GUA that has acquired the resource b2 sends this to the client b via the UA-b1.
It will be transmitted to 2.

According to the present embodiment, the leader and members of a group formed of a series of users can use the resources of other users under the same conditions. Here, a group agent is generated according to an instruction from the leader, and the group agent transmits a registration notification to each member. Further, in response to an instruction from the leader to apply for resource use, the group agent makes an application request for resource use to another user agent related to another user. In this way, by using the group agent, you do not have to go through the troublesome steps of the administrator and the user.
Utilization of resources is realized.

The present invention is not limited to the above embodiments, and various modifications can be made within the scope of the invention described in the claims, and these are also included in the scope of the present invention. It goes without saying that this is what is done. For example, in the above-described embodiment, agents associated with resources (for example, resource a1 (reference numeral 101) and UA-a1 (reference numeral 111) and resource a2 (reference numeral 102) and UA-a2 (reference numeral in FIG. 1). 112) is illustrated, but there are user agents that are not associated with resources, for example, user agents that use only the resources of others. In such a case, the user agent need only have the access control list.

Further, although a plurality of servers (server A and server B) are used in the above embodiment, the present invention can be applied to a single server. Needless to say, the present invention can be applied even if three or more servers are provided. Also,
In this specification, the function of one means may be realized by two or more physical means, or the functions of two or more means may be realized by one physical means.

[0059]

According to the present invention, it is an object of the present invention to provide a system capable of finely setting an access control level in a desired unit without burdening a user or an administrator.

[Brief description of drawings]

FIG. 1 is a diagram showing an outline of a data communication system according to an embodiment of the present invention.

FIG. 2 is a block diagram showing an outline of a configuration of a server according to the present embodiment.

FIG. 3 is a flowchart illustrating a procedure executed when a user uses a resource owned by one user among other users.

FIG. 4 is a flowchart illustrating a procedure executed when a resource owned by one user is used by another user among certain users.

5 (a) and 5 (b) are respectively,
It is a figure which shows the example of ACL concerning this Embodiment.

FIG. 6 is a flowchart illustrating a procedure executed when a resource owned by one user is used by another user among certain users.

FIG. 7 is a flowchart showing a new registration to a server by a user and generation of a new user agent in the present embodiment.

FIG. 8 is a flowchart showing a process executed when adding a service provided by itself.

FIG. 9 is a flowchart showing processing executed in response to a group leader requesting generation of a user agent related to a group in the present embodiment.

FIG. 10 is a flowchart showing a process executed when a user agent of a user who owns a certain resource requests to use the resource as a group in the present embodiment.

FIG. 11 is a flowchart showing a process executed when a member of a group accesses a resource owned by another user b2 as a member of the group in the present embodiment.

FIG. 12 is a flowchart showing a process executed when a member of a group accesses a resource owned by another user b2 as a member of the group in the present embodiment.

[Explanation of symbols]

12 networks 14 servers 16 resource DB 18 Agent DB 20 client machines 22 Agent Manager 111,112 User Agent

   ─────────────────────────────────────────────────── ─── Continued front page    (72) Inventor Kazuhito Hiroshige             4-7-1, Hatchobori, Chuo-ku, Tokyo Japan             Telecom Co., Ltd. (72) Inventor Osamu Imai             10-3 Tenjinmae, Takamatsu City, Kagawa Prefecture             Inside the maker F-term (reference) 5B017 AA07 BA06 BB09 CA16                 5B082 AA01 EA11                 5B085 AE02 AE23 BA07 BG04 BG07

Claims (16)

[Claims] 1. A method for controlling access when a user of a system uses a resource related to another user, wherein information about the resource of another user available to the user is accessed for each user. A step of providing a user agent to be managed as an access control list together with the level; the user agent is activated in response to a user's request for using a resource of another user, and identifies another user agent related to the other user. The user agent transmits the application for using the resource to the other user agent together with the access control level thereof, and the other user agent responds to the application for using the resource. To other users Requesting approval for resource usage, the other user agent responds to the acceptance of the approval for resource usage, stores necessary information in its access control list, and confirms that there is approval. An access control method comprising: notifying a user agent; and, in response to acceptance of the notification, the user agent stores necessary information in its access control list. 2. The user agent, in response to a request from the user to use a resource of another user, collates the information related to the application with the access control list and determines the content thereof. Confirming, transmitting the resource use request to the other user agent together with the access control level thereof, the other user agent responding to the resource use request by performing the access control Referring to the list, collating the information related to the usage request and the information in the access control list, acquiring the resource related to the request, and transmitting to the user agent, the user agent, Providing the transmitted resources to the machine used by the user. Access control method according to claim 1, characterized in that the. 3. The access control level includes reading a resource, writing to a resource, changing a display format of a resource, available time, and / or a combination thereof. The access control method described in. 4. Further, in response to a service addition request from a user, the user agent acquires a list of services that can be provided from a service agent that manages services that can be provided and related information,
A step of presenting the list to the user, and a service object that is a template including necessary data items for providing the service to the service agent according to selection information from the list from the user. To generate a form enumerating the items required for user input based on the service object, and to present the form to the user; and to the user according to the information entered in the form by the user. 4. The access control method according to claim 1, further comprising the step of storing the service object to which the information is given in the access control list. 5. A user agent for a leader of a group composed of a series of users responds to a request for generation of a group agent for the group from the leader to an agent manager for managing the user agent. A step of requesting generation of a group agent, the agent manager generating a group agent relating to a group composed of the user group, and at least storing information regarding a leader in an access control list; Storing in the access control list that the related user has become the leader of the group, the group agent notifying the member of the group and the registration of the member from the user. In response to accepting the instruction from the user agent, informing each of the user agents regarding the member to register as a member of the group; and in response to accepting the confirmation from the user agent regarding the member, the access control list Storing the information about the member in the user agent for the member, and saving in the access control list that the related user has become a member of the group. 5. The access control method according to any one of 1 to 4. 6. The user agent further comprises a user as a group leader or member.
Starting in response to another user's resource application request, referring to the access control list to identify a group agent related to the group, and requesting the group agent to use the resource as a group Transmitting the request, the group agent transmitting the application for using the resource to the other user agent together with the access control level, and the other user agent applying for using the resource In response to requesting the other user to approve the resource usage, and the other user agent saves necessary information in its access control list in response to the acceptance of the resource usage approval. And that there was approval, Notifying a group agent, said group agent responding to the receipt of the notification by:
The access control method according to claim 5, further comprising the step of storing necessary information in the access control list. 7. An access control system in which a user who uses the system controls the use of a resource related to another user, wherein information about the resource of another user available to the user is accessed by the user. A user including a user agent managed as an access control list together with a level, wherein the user agent is activated in response to a user's request for use of a resource from another user, and specifies another user agent related to the other user. An agent specifying means, a usage application processing means for transmitting a usage application of the resource to the other user agent together with the access control level thereof, and a response to the usage application of the resource in the other user agent, The other you Resource access approval request to the user agent, and in response to the notification transmitted to the user agent based on the acceptance of the approval, the access control list includes information storage means for storing necessary information. Access control system. 8. The user agent further checks information related to the application against the access control list in response to a request from the user or another user agent to use a resource of another user. hand,
8. The access control system according to claim 7, further comprising access control list collating means for confirming the contents. 9. In addition, in response to a service addition request from a user, the user agent acquires a list of services that can be provided from a service agent that manages services that can be provided and related information,
The list is in the form of a template including the service list acquisition means to be presented to the user, and items of data necessary for providing the service to the service agent according to the selection information from the list from the user. A service object acquisition unit that acquires a certain service object; and a form generation unit that generates a form listing necessary items for user input based on the service object and presents the form to the user, the information storage unit 9. The method according to claim 7, wherein the service object is provided with the information in the access control list of the user according to the information entered in the form by the user. Access control system. 10. A group agent for a group consisting of a set of users, the group agent having at least information about a leader stored in an access control list, the user agent comprising: The group agent is configured to store the fact that it has become a leader in the access control list, and the group agent responds to a member forming the group and a registration notification instruction of the member from the user, in response to the member. Group registration notifying means for notifying each of the user agents that they will be registered as members of the group, and information for storing information about members in the access control list in response to acceptance of confirmation from the user agent about the members. Storage means 10. The user agent information storage unit having the member, and storing the information that the related user has become a member of a group in an access control list. Access control system according to. 11. The user agent further comprises:
A group agent identification that is activated in response to a user's request to use a resource of another user as a leader or a member of a group and refers to the access control list to identify a group agent related to the group. Means, the group agent, in response to the request to use the resource as a group transmitted from the user agent, to another user agent,
A utilization application means for transmitting the utilization application of the resource together with its access control level, and an authorization request for the utilization of the resource to the other user in response to the utilization application of the resource in the other user agent, and an authorization Upon acceptance, in response to the notification communicated to the group agent,
The access control system according to claim 10, further comprising: information storage means for storing necessary information in the access control list. 12. A program for allowing a user of a system to control access to a computer for controlling the use of a resource related to another user, the other user being available to the user for each user. A step of providing a user agent that manages information about resources of the resource as an access control list together with its access level; and in the user agent, starting in response to a user's request for use of the resource of another user,
Specifying another user agent related to the other user, transmitting a use request for the resource to the other user agent together with the access control level thereof, the resource in the other user agent In response to the resource use approval request to the other user in response to the user's use application and the notification transmitted to the user agent based on the acceptance of the approval, necessary information is stored in the access control list. An access control program that causes the computer to execute steps. 13. The information related to the application is collated with the access control list in the user agent in response to a request for use of a resource of another user from the user or another user agent. The access control program according to claim 12, further comprising causing the computer to execute the step of confirming the contents. 14. Further, in response to a service addition request from a user, the user agent acquires a list of providable services from a service agent that manages providable services and related information, A step of presenting the list to the user, and a service object that is a template including items of data necessary for providing the service to the service agent according to selection information from the list from the user. To generate a form enumerating the items required for user input based on the service object, and to present the form to the user; and to the user according to the information entered in the form by the user. The access control list of the The access control program according to claim 12 or 13, characterized in that the step of storing an object is executed by the computer. 15. A group agent for a group consisting of a series of users, wherein at least a group agent in which information about a leader is stored in an access control list is provided, and in the user agent, a related user is Saving in the access control list that the group has become a leader, in relation to the member in response to receiving an instruction of a member of the group and registration notification of the member from the user in the group agent, Notifying each of the user agents to register as a member of the group; and storing information about the members in an access control list in response to receiving confirmation from the user agent regarding the members. And a step of causing the information storage means of the user agent regarding the member to store in the access control list that the related user has become a member of the group.
15. The access control program according to any one of 1 to 14. 16. The user agent is activated in response to a request from a user as a group leader or member to use a resource of another user, and refers to the access control list to activate the user agent. Identifying a group agent related to a group, and in the group agent, in response to a request for application for use of a resource as a group transmitted from the user agent, application for use of the resource to another user agent With the access control level, and based on the request for approval of resource use to the other user in response to the application for use of the resource in the other user agent, and acceptance of the approval, the group age In response to the notification transmitted to the bets,
16. The access control program according to claim 15, causing the computer to execute a step of storing necessary information in the access control list.