JP2004258743A - Database access control method, database access control system, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent access with a malicious intention when a proxy agent accesses a database by a simple means. <P>SOLUTION: A database access request from a user is received by an intermediary agent. The intermediary agent creates an access object, transfers the access request from a user to the proxy agent and at the same time, transfers the created access object to the proxy agent. The proxy agent performs access to the database by using the access object received from the intermediary agent. A result of database access is stored in an access object. The proxy agent acquires the access object, transfers the access object or the access result stored in the access object to the intermediary agent, and the intermediary agent provides the access result to the user. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a database access control technique, and more particularly, to a database access control method and apparatus when a proxy agent accesses a database on behalf of a user, and a program thereof.
[0002]
[Prior art]
Generally, since a plurality of users store data in a database, an access control mechanism of the database controls which user can register, refer to, update, and delete which data. Hereinafter, registration, reference, update, and deletion of data in the database will be collectively referred to as access to the database. For example, in the access control mechanism of the database, the access control is performed so that the user B cannot access the data of the user A and the user A cannot access the data of the user B.
[0003]
Conventionally, as a method for controlling access to the database, authentication is performed by comparing authentication information such as a set of a user ID and a password that a user passes to the database with authentication information registered in advance in an access control mechanism of the database. The user who is going to be specified is specified, and permission for access to each data is set based on an access control list (Access Control List) in which which data can be accessed for the next specified user is set. , There is a method of determining non-permission. This is a method used for many existing databases. In SQL92 which is a language standard for accessing a database, information of access authority is added to or deleted from an access control list by a grant statement and a revoke statement. It is stipulated that a user is given or revoked access authority to data.
[0004]
The above access control method is for the case where access to the database is limited to the user who stores data in the database. On the other hand, as a different form, there is a case where access to the database is performed not by the user storing the data but by a proxy agent that accesses the database on behalf of the user. This is done in such a way that the user requests a proxy agent to access the database. This is the case, for example, in which a proxy agent provides a function of processing data, and the user has the proxy agent process data stored in the database, and the user receives the processing result. .
[0005]
One thing to consider when the proxy agent accesses the database on behalf of the user is that the proxy agent must access the database based on the access authority of the requester user. For example, when a certain user A requests the proxy agent to access the database, the proxy agent must be access-controlled so that only the data to which the user A is permitted access can be accessed. That is, despite the request of the user A, the proxy agent must not access the data of the user B who is not permitted to the user A and return the information to the user A. Accessing the proxy agent to the database based on the access authority of the requester's user is referred to as transfer of access authority from the user to the proxy agent.
[0006]
The simplest access control method that satisfies the above conditions is that a user passes his / her user ID and password, etc., to the proxy agent to access the database, and the proxy agent sends the authentication information to the proxy agent. There is a method in which a user accesses a database to acquire data of the user.
[0007]
Another method is to use digital signature technology or cryptographic communication technology to check whether the user's delegation of access authority to the proxy agent is correct, using digital certificates, digital signatures, encryption, and one-way functions. There is one that confirms the use (for example, see Patent Documents 1 and 2).
[0008]
[Patent Document 1]
JP 2001-101054 A [Patent Document 2]
Japanese Patent Application Laid-Open No. 2002-163235
[Problems to be solved by the invention]
However, in a method in which a user passes his / her authentication information to a proxy agent, and the proxy agent uses the authentication information to access a database, generally, the proxy agent is an entity of a third party different from the user, and the user Agents cannot always be trusted. Therefore, for example, if the user A passes authentication information such as a user ID and a password to the proxy agent, the proxy agent holds the authentication information internally, and holds the authentication information when another user, User B, accesses it. Denies that the proxy agent does not perform malicious processing such as impersonating the user A using the authentication information that has been set and permitting the user B to access the data of the user A, which should not be permitted to the user B. No, the user cannot request processing from the proxy agent.
[0010]
In the method of confirming the delegation of access authority using digital signature technology or encryption communication technology, complicated processing such as digital certificate, digital signature, encryption, and one-way function must be performed. The exchange of key information and authentication information between the proxy agent and the database must be performed in many steps. Also, these methods are only related to a method for delegating access rights, and there is no guarantee that the result of accessing the database based on the delegated access rights is reliably returned to the delegating user, It is not appropriate for application to a proxy agent where a user requests access to a database.
[0011]
Accordingly, an object of the present invention is to provide a mechanism by which a proxy agent cannot access a database maliciously when a proxy agent accesses a database on behalf of a user by a simple method.
[0012]
[Means for Solving the Problems]
According to the present invention, a mediation agent function is provided in addition to a proxy agent function in a database access control device in which a proxy agent accesses a database on behalf of a user. The mediation agent is assumed to be the same as the management entity of the access control of the database, and the user can trust the mediation agent.
[0013]
The mediation agent receives a database access request from the user to the proxy agent. The mediation agent generates an access object for accessing the database, passes an access request from the user to the proxy agent, and simultaneously passes the generated access object to the proxy agent. The proxy agent accesses the database using the access object received from the mediation agent. The result of accessing the database is stored in the access object. The proxy agent acquires the access object, passes the access object or the access result stored in the access object to the mediation agent, and the mediation agent passes the access result to the user.
[0014]
The mediation agent embeds authentication information such as a user ID and a password passed from the user to the mediation agent in an access object generated by the mediation agent. By hiding the authentication information so that it cannot be referred to by the proxy agent, the proxy agent cannot access the user's authentication information, so that the user's authentication information cannot be stolen, and the authentication information cannot be stolen by another user. It would also be impossible to access the database as if it had been accessed from.
[0015]
Also, the result of accessing the database is stored in the access object, and the proxy agent cannot return the access result stored in the access object directly to the user, but returns the access result to the mediation agent, and the mediation agent Since the access result is returned to the user, it is impossible to return the access result to a user other than the user requested by the proxy agent.
[0016]
As a result, the proxy agent can access the database with the access authority of the requested user and can return the processing result only to the requested user, making it impossible to perform malicious processing. Thus, the user can request the proxy agent to perform a process for accessing his / her data with confidence.
[0017]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.
FIG. 1 shows a configuration diagram of an entire system to which the present invention is applied. In FIG. 1, 100 is a user terminal device of each user, 200 is a network such as the Internet, 300 is a database access control device according to the present invention, and 400 is a database shared by a plurality of users. The database 400 holds user data, user authentication information registered in advance, and the like. Further, although the database 400 has a built-in access control mechanism, it is omitted in FIG. The connection between the database access control device 300 and the database 400 may be either a direct connection or a connection via a network.
[0018]
As described later, the database access control device 300 includes a proxy processing unit 310 as a proxy agent function, a mediation processing unit 320 as a mediation agent function, and an access processing unit 330 as an access object function.
[0019]
The substance of the database access control device 300 is a computer, and a program as software operates under a hardware resource environment such as a CPU and a memory to execute a desired process. Here, a process of accessing the database 400 on behalf of the user and passing the access result to the user terminal 100 of the user is executed.
[0020]
Hereinafter, an example in which the proxy processing unit 310, the mediation processing unit 320, and the access processing unit 330 of the database access control device 300 are referred to as a proxy agent, a mediation agent, and an access object, respectively, and are implemented as programs in an object-oriented programming language will be described. . The proxy agent 310 realizes the mediation agent 320 as an extended class.
[0021]
FIG. 2 shows an example of the entire processing sequence of this embodiment. FIG. 3 shows an example of the processing flow of the proxy agent 310, and FIG. 4 shows an example of the processing flow of the mediation agent 320.
[0022]
The user requests access to the database 400 by calling an access request method or function (hereinafter abbreviated as a method) from the user terminal device 100 to the proxy agent 310. However, the proxy agent 310 is a class that is an extension of the mediation agent 320, and the method called by the user is a method in the superclass mediation agent class, so that the method of the mediation agent 320 is called instead of the proxy agent 310. (Procedure 1 in FIG. 2). At this time, the method is not allowed to be overridden by the proxy agent 310 which is an extended class. For example, in the case of the Java language, a finalize qualifier is added to the access request method. This prevents the proxy agent 310 from creating a fake method that overrides the access request method of the mediation agent 320 that receives a request for access from the user to intercept the processing. Further, when the user calls the method of the mediation agent 320, the search condition and the user authentication information such as the user ID and the password are passed by the argument or the like.
[0023]
Upon receiving the access request from the user (2001 in FIG. 4), the mediation agent 320 authenticates and specifies the user who has requested the access, and holds the authentication information (2002 in FIG. 4). As a method of authenticating and specifying the user, there is a method of using a session ID used in a WWW application. Next, the mediation agent 320 passes the access request from the user to the proxy agent 310 (procedure 2 in FIG. 2, and 2003 in FIG. 4). At this time, the mediation agent 320 passes the search condition from the user to the proxy agent 320, but does not pass the authentication information.
[0024]
By passing the access request from the user from the mediation agent 320 to the proxy agent 310, the processing of the proxy agent 310 starts. Upon receiving the access request (1001 in FIG. 3), the proxy agent 310 holds the search conditions of the user (1002 in FIG. 3), and requests the mediation agent 320 to generate an access object for searching the database 400. (Procedure 3 in FIG. 2 and 1003 in FIG. 3). The mediation agent 320 requested to generate the access object generates the access object 330 (2004 and 2005 in FIG. 4), and authenticates information (database such as a user ID and a password for accessing the previously held database). Authentication information) is set in the access object 330 (2006 in FIG. 4). FIG. 5 shows a configuration example of the access object. Initially, the database authentication information and the access result information are NULL. The database authentication information in this access object cannot be referenced from the proxy agent 310. For example, in the case of the Java language, if the scope of a variable storing authentication information is set to a default scope without a visibility qualifier and the proxy agent class is a different package, the variable storing the authentication information from the proxy agent class becomes Access can be prevented. The mediation agent 320 passes the generated access object 330 to the proxy agent 310 (procedure 4 in FIG. 2 and 2007 in FIG. 4).
[0025]
Next, the proxy agent 310 receiving the access object 330 from the mediation agent 320 uses the access object 330 to access the database 400 as follows. Upon receiving the access object 330 from the mediation agent 320 (1004 in FIG. 3), the proxy agent 310 sets search conditions and the like in the access object 330 (1005 in FIG. 3) and requests access to search or update the database. (Procedure 5 in FIG. 2 and 1006 in FIG. 3). As a method of designating what kind of access is requested, there are a method of passing an SQL statement and a method of using a database access method prepared by the access object 330. For example, in the case of FIG. 5, an access is requested by setting a search condition or the like as an argument of the database access method.
[0026]
The access object 330 that has received the access request (activation) of the database 400 from the proxy agent 310 connects to the database 400 and accesses the database 400 using the database authentication information stored therein (procedure in FIG. 2). 6). The access control mechanism of the database 400 compares the database authentication information passed from the access object 330 with the authentication information registered in advance to identify the user who is going to access, and is authorized by the user. The requested access processing is performed only for the data range, and the access result is returned to the access object 330 (procedure 7 in FIG. 2). The access object 330 receiving the access result from the database 400 stores the access result internally and returns it to the proxy agent 310 (procedure 8 in FIG. 2).
[0027]
Upon receiving the access object 330 that has completed the access processing to the database 3400 (1007 in FIG. 3), the proxy agent 310 returns the access object to the mediation agent 320 (procedure 9, 1008 and 1010 in FIG. 3). Also, the proxy agent 310 does not return the received access object 330 to the mediation agent 320 as it is, but extracts the access result stored in the access object, performs processing such as processing, editing, calculation, and the like. It may be stored in the access object 330 again and returned to the mediation agent 320 (1008, 1009, 1010 in FIG. 3). Further, instead of returning the access object 330 to the mediation agent 320 as it is, the proxy agent 310 may return an access result extracted from the access object 330 or a processing result corresponding thereto. At this point, the processing of the proxy agent 310 ends.
[0028]
Upon receiving the access object 330 from the proxy agent 310 (2008 in FIG. 4), the mediation agent 320 returns the received access object or data extracted from the access object to the user terminal 100 of the requester user (2008). Procedure 10 in FIG. 2 and 2009 in FIG. 4). Thus, the user can obtain the result of accessing the database 400 requested by the proxy agent 310.
[0029]
The proxy agent 310 and the mediation agent 320 described above can be realized using a template method of a design pattern. (For the template method, for example, Hiroshi Yuki, “Introduction to Design Patterns Learned in the Java Language,” Softbank pp. 31 “No. See Chapter 3, Template Method.) That is, the mediation agent 320 becomes a super class, and describes a process serving as a common template such as a process of authenticating a user, a process of generating an access object 330, and a process of receiving an access result from the proxy agent 310 and returning it to the user. The proxy agent 310 becomes a subclass, and describes specific processes specific to each proxy agent, such as a specific search process for the database 400 and a process for performing a desired process on an access result.
[0030]
The access object can be described in, for example, a memory, and the proxy agent 310 and the mediation agent 320 can access the memory and perform a predetermined process. In this case, the proxy agent 310 is prevented from accessing the authentication information storage area. In addition, the access processing unit 330 actually accesses the database 400 based on the database access method of the access object as an entity of the processing function of the access object.
[0031]
As described above, part or all of the processing functions of each unit in the database access control device shown in FIG. 1 can be configured by a computer program, and the program can be executed using a computer to realize the present invention. Alternatively, it goes without saying that the processing procedures shown in FIGS. 2, 3, and 4 can be configured by a computer program, and the computer can execute the program. Further, a program for realizing the processing function by the computer or a program for causing the computer to execute the processing procedure is stored in a computer-readable recording medium such as an FD, an MO, a ROM, a memory card, and a CD. , A DVD, a removable disk, or the like, and can be stored or provided, and the program can be distributed through a network such as the Internet.
[0032]
【The invention's effect】
According to the present invention, since the proxy agent cannot access the database with an access authority other than the requester's user, and can return the access result only to the requester's user, the user can perform malicious acts. Without worry, it becomes possible to use a database search process and a proxy agent that processes the search results. This allows the user to use a proxy agent that performs various useful processes prepared by a third party.
[Brief description of the drawings]
FIG. 1 is a configuration diagram of an entire system to which the present invention is applied.
FIG. 2 is an example of a processing sequence according to the present invention.
FIG. 3 is an example of a processing flow of a proxy agent.
FIG. 4 is an example of a processing flow of a mediation agent.
FIG. 5 is a configuration example of an access object.
[Explanation of symbols]
100 User terminal 200 Network 300 Database access control device 310 Proxy processing unit (proxy agent)
320 Mediation Processing Unit (Mediation Agent)
330 Access Processing Unit (Access Object)
400 database

Claims (3)

In a database access control method when a database access control device accesses a database on behalf of a user,
Requesting the mediation agent for a database access request from the user to the proxy agent;
Generating an access object for the mediation agent to access a database;
The mediation agent passes an access request from a user to the proxy agent and passes the generated access object to the proxy agent;
A step in which the proxy agent accesses the database using the access object received from the mediation agent, and obtains an access object in which a result of accessing the database is stored;
The proxy agent passing the access result stored in the access object or the access object to the mediation agent;
The mediation agent passing the access result to a user;
A database access control method, comprising: A proxy processing unit that accesses a database on behalf of a user, and a database access control device including a mediation processing unit that mediates the proxy processing unit,
The mediation processing unit receives a database access request from a user terminal, generates an access object for accessing the database, requests the proxy processing unit to access the database, and receives the access received from the proxy processing unit. A function of returning a result to the user terminal,
The proxy processing unit accesses the database using the access object, acquires an access object storing the access result, and returns the access object or the access result stored in the access object to the mediation processing unit With the ability to
A database access control device, characterized in that: A computer-executable program for a database access control device to access a database on behalf of a user,
Requesting the mediation agent for a database access request from the user to the proxy agent;
Generating an access object for the mediation agent to access a database;
The mediation agent passes an access request from a user to the proxy agent and passes the generated access object to the proxy agent;
The proxy agent accessing a database using an access object received from the mediation agent;
Storing the result of accessing the database in the access object;
A step in which the proxy agent acquires an access object in which the access result is stored, and passes the access object or the access result stored in the access object to a mediation agent;
The mediation agent passing the access result to a user;
A program characterized by including:

Images