JP2005092891A - Access control agent system, method for preventing confidential information leak or tampering, network system program, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a network system allowing for internetwork access control, even if a plurality of access-controlled networks (LANs) are connected to each other via the Internet. <P>SOLUTION: The system is realized by newly adding onto a conventional Web application system functional blocks; a security policy determining block 21, an access control manager 23, an access information database 24, a policy control block 20, a mobile agent 25, an access control policy design evaluating block 22, and a name/attribute/address solution block 26. An authentication block 27 has an authentication function, equivalent to that of an SAML block 57 in prior art. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an access control agent system incorporated in a network system, and more specifically, prevents information leakage and falsification in a network system using the Internet, and protects personal information by detecting and evaluating a covered channel. The present invention relates to an access control agent system.

At present, various services such as commercial transactions via the Internet, bank settlements, and the progress of electronic libraries have become widespread. In recent years, companies have been federated, and services that allow users to access a portal server with a single sign-on for a plurality of services are being actively provided. A system that realizes these services is generally called a Web application system. However, a case in which personal information is leaked or tampered due to such unauthorized access to a computer system via the Internet or unauthorized access inside the service provider is a major social problem.
To prevent this problem, on the service provider side, “Install a firewall at the Internet boundary to filter IP packets”, “Perform user authentication and server authentication to confirm each other's identity”, “ Introduce technology to prevent eavesdropping inside the Internet by encrypting. In addition, although the minimum guard is performed by restricting user access by controlling access to the database in the deepest part of the system, the network system has a problem of information leakage due to the cover channel. These technical measures are not sufficient. Conventionally, as shown in FIG. 6, the Web application system implementation mode is divided into a presentation layer (View) 50, a business logic layer (Control) 51, and a data layer (Model) 52 in terms of functional models. being called. As a function of each layer, the presentation layer 50 displays a result of exchange with the system side by a Web browser. The business logic layer 51 links client information input from the presentation layer 50 with a database on the data layer side. The data layer 52 also stores user data in a database reliably and consistently. FIG. 6 shows the correspondence between each layer and the client 53, Web server 54, application server 55, and database 56. Here, the client 53 and the Web server 54 are associated with the presentation layer 50, the application server 55 is associated with the business logic layer 51 and the data layer 52, and the database 56 is associated with the data layer 52.

FIG. 7 is an explanatory diagram centering on functional blocks of a conventional business logic layer. The same components will be described with the same reference numerals. In the Web application system, access control to the database 56 is performed in the business logic layer 51. The access control block 51b shown in the business logic layer 51 performs its function. In the SAML block 57 of FIG. 7, it is assumed that a PKI (Public Key Infrastructure) framework called SAML (Security Assertion Markup Language) is used. That is, user authentication and server authentication are performed in the SAML block 57. In each authentication, the identity and subject attributes (in the subject, there are four elements of personal information such as address, name, age, and gender, and information such as occupation, annual income, educational background, and marital status) Based on authentication. In general, Liberty Alliance Project specifications (W3C and OASIS specifications are used) are known. In this Web application system, control is performed on the basis of XML, and the database also targets an RDB (Relational Data Base) or a native XML database. The purpose of introducing XML is to use it as a global infrastructure that is seamless and versatile. The document data by XML is not so much an error even if it is simplified, for example, to simply add a tag indicating the header and body to a report written normally.
Also, as a conventional technique for preventing falsification of information, Japanese Patent Laid-Open No. 2002-149497 discloses a Web content in a server of the provider when the Web content provider provides the user with the Web content via the network. When the falsification is detected by comparing the pre-registered characteristic information about the data included in the data and the characteristic information of the data being provided publicly, and when the falsification is detected, the original web content or the substitute web content prepared in advance A technique for providing a user with a message is disclosed.
Japanese Patent Laid-Open No. 2002-175010 discloses a public web server computer for storing an encrypted web file, an original web server computer connected to the public web server computer through a firewall, and a public web server that receives an access request from a user. Means for performing a tampering check on the encrypted web file when it is determined that the encrypted web file has not been tampered with and decrypting the encrypted web file and transmitting it to the user, and storing the original web server when tampering is detected There is disclosed a homepage falsification preventing system including means for encrypting a corresponding web file stored in an apparatus and updating / recovering a falsified web file of a public web server.
Japanese Patent Laid-Open No. 11-88437 JP 2000-115246 A JP 2000-151715 A JP 2002-149497 A JP 2002-175010 A

However, the above method does not analyze and control the covered channel for the file. In particular, with information having an XML data structure, confidential information and personal information are buried in the body of an XML document, and people are easily leaked. In general, this phenomenon is called Covered Channel. This covered channel is not a phenomenon that occurs only in the XML document database.
The concept of the covered channel will be described with reference to FIG. FIG. 8A is a diagram showing how an information file is transmitted between a plurality of users based on the access matrix of FIG. 8B. FIG. 8B shows an access matrix in which access rights (read rights, write rights) possessed by an object such as a file accessed by an access subject such as a user are arranged in rows and columns. It is a figure which shows an example. In FIG. 8B, the access subject that causes access is arranged with S1, S2, S3, and S4 in the column direction, which corresponds to a user name, a program name, or the like. Further, O1, O2, and O3 are arranged in the row direction in the accessed object, and information such as a directory name and a file name corresponds to this. Access rights are set for the corresponding positions in the frame, R is a read right, W is a write right, and ¬R is a denial of a read right, which means a covered channel to be described later. In this example, the subject S1 has the right to read the objects O1, O2, and O3, and further has the right to write O2. The subject S2 has the right to read the objects O1, O2, and O3, and further has the right to write O3. The subject S3 does not have the right to lead the objects O1 and O2, but has the right to lead only the object O3. The subject S4 has only the right to lead the objects O1, O2, and O3.

An operation example will be described based on this access right. The user S1 reads the file O1 in which the secret information 40 is written from the file server 41. Next, when the user S1 copies and pastes the file O1 to the file O2, at this point, the contents describing the secret information 40 are written to the file O2. The user S2 reads the file O2 and copies and pastes it to the file O3. At this time, the contents describing the secret information 40 are written in the file O3. Next, since the user S3 has the right to read the file O3, the user S3 reads the file O3. Up to this point, the operation is in accordance with the access matrix of FIG. 8B, which is substantially equivalent to the fact that the user S3 who does not originally have the right to read the file O1 has read the secret information 40 of the file O1, and the secret information. Leaked at this point. In general, this phenomenon is called Covered Channel.
The present inventor has disclosed a method of providing an AC server 42 in a network (LAN) to solve a covered channel in Japanese Patent Laid-Open Nos. 11-88437, 2000-115246, and 2000-151715. . In other words, the AC server 42 manages the access matrix of FIG. 8B, analyzes the covered channel, and restricts access so as not to leak confidential information (in the business block layer 51 of FIG. 7). Corresponding). In the case of a closed network space such as a LAN, the access matrix database managed by the AC server 42 is small. However, when the LAN is connected to a wide area network such as the Internet, the AC server 42 has a huge access matrix. Manage and solve the covered channel, but this is virtually impossible.
In addition, XACML (OASIS draft), the standard for Web application systems, introduced the security model RBAC (Role Based Access Control) (ANSI INCITS 359-2004 (approved 19 Feb 04)), which was approved as an ANSI standard in 2004. However, it is not intended for covered channel analysis and evaluation.
SAML is a mechanism for asserting (logically activating) “Subject” for Single Sing On, and only shows a framework for performing authentication in cooperation.
The prior art disclosed in Patent Document 4 is a technique for detecting tampering and providing correct Web content to the user, and cannot prevent tampering in advance.
Further, in the prior art disclosed in Patent Document 5, when falsification is detected, the corresponding web file stored in the storage device of the original web server is encrypted to process the falsified web file of the public web server. The update / recovery process is performed, and it is impossible to prevent falsification in advance as in Patent Document 1.
In view of the above problems, the present invention provides a network system capable of mutual access control even when a plurality of networks (LAN) subjected to access control are connected via the Internet or the like. With the goal.

In order to solve this problem, the present invention provides an access control agent system for detecting and evaluating a covered channel in order to prevent leakage and falsification of confidential information in a network system, wherein the network includes: The system includes an application server that controls access to a database. When a plurality of the network systems are connected via the Internet and information is exchanged between the network systems, the application server is an application provided in each network system. The cover channel is detected in cooperation with a server, and control is performed so that the confidential information is not leaked or tampered with.
In a network system that detects a covered channel and prevents leakage and falsification of confidential information, the covered channel is detected by an access control agent system incorporated in an application server provided in the closed network. It is possible to prevent leakage and falsification of confidential information. However, when a plurality of network systems are connected to each other via the Internet, it becomes difficult to prevent leakage and falsification of confidential information when accessed from the outside. Therefore, in the present invention, access control agent systems incorporated in application servers included in each network system cooperate to detect cover channels while exchanging information related to access control, thereby preventing leakage and falsification of confidential information. To do.

According to a second aspect of the present invention, the access control agent system includes a security policy determination block for describing, storing, and determining the operation of the system, and a command from the security policy determination block. An access control manager that performs analysis and arbitration of access authority, an access information database that stores user names, user attributes, file names, file attributes, and permissions, and the access according to instructions of the security policy determination block As a result of analysis by the control manager, a policy that filters user names, user identities, access requests, and data, and blocks unauthorized and unauthorized access from the database. -The control block, the mobile agent that communicates information necessary for mediation of access authority with the manager of other access control agent systems according to the command of the access control manager, and the formal usage description by the user when designing the system An access control policy design evaluation block that describes an access control policy according to the name, an attribute / address resolution block that searches the Internet for the name and attribute of the user that you want to access, and an authentication block that authenticates the accessed user name and attribute It is characterized by that.
In order to prevent covert channels from leaking and tampering with confidential information, the access control agent systems incorporated in the application servers included in each network system cooperate with each other while exchanging information to detect cover channels. In addition to configuration, access control agent system comprising security policy decision block, access control manager, authentication authorization database, policy promotion block, mobile agent, access control policy design evaluation block, name / attribute / address resolution block and authentication block It is necessary to further provide. The most characteristic point here is that the mobile agent collects access authority to the presentation layer based on the instruction of the access control manager, and the access control agent system embedded in the application server based on the information collects the cover channel. The point of detection and its mechanism are that each network system improves the overall system.

According to a third aspect of the present invention, the security policy determination block controls the access control manager to manage the mobile agent so that no information leakage occurs from distributed individual network systems and databases connected thereto. Features.
The security policy decision block functions as the brain of the application server. In other words, an access control manager is arranged in the security policy determination block, and the mobile agent is managed by an instruction from the access control manager so that each distributed network system does not leak information from around the dedicated application server.
According to a fourth aspect of the present invention, when there is data requested by the user in the database, the security policy determination block permits the data stored in the database according to the access authority of the user, and the user requests the database. When there is no data to be processed, the access request of the user is inquired to another access control agent system.
The security policy determination block of the present invention searches the database and, when there is data requested by the user, permits the data stored in the database with the user's access authority. When there is no data requested by the user in the database, the access request of the user is inquired to another access control agent system.

According to a fifth aspect of the present invention, the security policy is reflected in an access control point in the application server by formally specifying the security policy with respect to access authority on an XML basis.
Under the control of the security policy decision block, the access control policy design evaluation block uses the access control policy design function to design the contents of the access matrix. It is designed as a security policy and described on an XML basis. In the evaluation function, an analysis command is issued to the access control manager so as to perform a covered channel analysis from the specifications such as the described access matrix. Based on the covered channel analyzed by the access control manager, the evaluation function of the access control policy design evaluation block evaluates whether the result is permitted or not. When the result is finally obtained, information is stored in the authentication permission database indicating what kind of subject has what kind of identity (attribute) and what kind of object it has. To do.
According to a sixth aspect of the present invention, the client agent system operates as a client server system that does not use the mobile agent between the client and the application server, and the mobile agent of the application server functions as a mediator of access authority arbitration information between the application servers. And
As one example of the configuration of an access control agent system on the Internet, a mobile agent functions as a mediator of access authority arbitration information between application servers by operating as a client server system that does not use a mobile agent between a client and an application server. To do.

According to a seventh aspect of the present invention, the mobile agent of the application server and the mobile agent of the client exchange access authority requests and control information, and the mobile agent of the application server functions as a mediator of access authority arbitration information between application servers. It is characterized by that.
As another configuration example of the access control agent system on the Internet, the mobile agent of the application server and the mobile agent of the client exchange the access authority request and control information, so that the mobile agent of the application server has access authority between the application servers. It functions as a mediator of mediation information.
An eighth aspect is characterized in that the network system is a Web application system.
Services that allow a user to access a portal server with a single sign-on for a plurality of services are being actively provided. There is a Web application system as a system for realizing these services.
The ninth aspect is characterized in that the network system is a peer-to-peer (P2P) communication system.
In principle, it is possible to incorporate almost the same access control agent system software module into the P2P mechanism.
Claim 10 is a method for preventing leakage and falsification of confidential information in a network system, wherein the network system includes an application server that controls access to a database, and a plurality of the network systems are connected via the Internet. When exchanging information between network systems, the application server detects the covered channel in cooperation with an access control agent system provided in each network system so that the confidential information is not leaked or falsified. It is characterized by controlling.
The present invention has the same effect as that of the first aspect.

The access control agent system includes a security policy determining step for describing, storing, and determining the operation of the system, and a command from the security policy determining step. An access control step for performing analysis and arbitration of access authority; an access information database for storing a user name, a user attribute, a file name, a file attribute, and a permission; and the access according to a command of the security policy determination block As a result of analysis by the control manager, a policy that filters user names, user identities, access requests, and data, and blocks unauthorized and unauthorized access from the database. A control step, a mobile agent step for communicating information necessary for mediation of access authority with the manager function of another access control agent system through the access control step, and a user in accordance with the formal usage description when designing the system. An access control policy design evaluation block describing an access control policy, a name / attribute / address resolution step for searching the name and attribute of a user to be accessed from the Internet, and a step for authenticating the accessed user name and attribute It is characterized by.
The present invention has the same effect as that of the second aspect.
12. The security policy determining step controls the access control step to manage the mobile agent step so that information leakage does not occur from distributed individual network systems and databases connected thereto. It is characterized by.
The present invention has the same effect as that of the third aspect.
According to a thirteenth aspect of the present invention, when there is data requested by the user in the database, the security policy control step permits the data stored in the database according to the access authority of the user, and the user requests the database. When there is no data to be processed, the access request of the user is inquired to another access control agent system.
The present invention has the same effect as that of the fourth aspect.

According to a fourteenth aspect of the present invention, the security policy is reflected in an access control point in the application server by formally specifying the security policy with respect to access authority in an XML base.
The present invention has the same effect as that of the fifth aspect.
According to a fifteenth aspect, the client and the application server operate as a client server system that does not use the mobile agent step, and the mobile agent step of the application server functions as a mediator of access authority arbitration information between the application servers. It is characterized by.
The present invention has the same effect as that of the sixth aspect.
The mobile agent step of the application server and the mobile agent step of the client exchange access authority requests and control information between the mobile agent steps of the application server and the mobile agent step of the application server. It functions as.
The present invention has the same effect as that of the seventh aspect.
A seventeenth aspect is characterized in that the method for preventing leakage of confidential information and the falsification preventing method according to any one of the tenth to sixteenth aspects is programmed so as to be controllable by a computer.
An eighteenth aspect is characterized in that the network system program according to the seventeenth aspect is recorded in a computer-readable format.

According to the first and tenth aspects of the present invention, the access control agent systems incorporated in the application server included in each network system cooperate with each other while exchanging information to detect the cover channel, and leakage and falsification of confidential information. Therefore, even if the network system is expanded, the covered channel can be detected with certainty, and the leakage and falsification of confidential information can be prevented.
Further, in claims 2 and 11, since the mobile agent collects access authority to the presentation layer based on the instruction of the access control manager, and the application server detects the cover channel based on the information, access from the outside Authority can be collected accurately and covered channel can be detected quickly.
Further, in claims 3 and 12, an access control manager is arranged in the security policy control unit, and the mobile agent does not leak information from around the dedicated application server in each distributed network system according to the instruction of the access control manager. Therefore, the security policy control unit only needs to monitor the covered channel based on the information from the access control manager, and the control can be simplified.
In the fourth and thirteenth aspects, when the database is searched and there is data requested by the user, the data stored in the database is permitted by the access authority of the user. In addition, when there is no data requested by the user in the database, the access request of the user is referred to another access control agent system, so that it is possible to respond to the user access request as much as possible, and the covered channel. Information leakage and falsification can be prevented.
Further, in claims 5 and 14, a security policy regarding access authority is formally specified on an XML basis, and this security policy is reflected in an access control point in the application server. On the other hand, the security policy is first formulated and reflected in the technical tool, but the present invention can be implemented in the system from the beginning and can be controlled. it can.

In the sixth and fifteenth aspects, since the client and the application server are operated as a client server system that does not use the mobile agent, the mobile agent can function as a mediator of access authority arbitration information between the application servers.
Further, in claims 7 and 16, since the mobile agent of the application server and the mobile agent of the client exchange the access authority request and control information, the mobile agent of the application server serves as a mediator of access authority arbitration information between the application servers. Can function.
In claim 8, since the network system is a Web application system, the user can access the portal server with a single sign-on for a plurality of services.
Moreover, since the network system is a peer-to-peer communication system, it can be applied to other network systems.
Further, in the seventeenth aspect, by programming the confidential information leakage and tampering prevention method of the present invention in accordance with an OS that can be controlled by the computer, any computer equipped with the OS can be controlled by the same processing method.
Further, in the present invention, the network system program is recorded on a recording medium in a computer-readable format, and the program can be operated anywhere by carrying the recording medium.

Hereinafter, the present invention will be described in detail with reference to embodiments shown in the drawings. However, the components, types, combinations, shapes, relative arrangements, and the like described in this embodiment are merely illustrative examples and not intended to limit the scope of the present invention only unless otherwise specified. .
FIG. 1 is a configuration diagram of a Web application system of the present invention. The Web application system 100 stores information such as an HTML document and an image, and transmits the information in response to a request from client software such as a Web browser, for example, a LAN (Local Area Network). 11, a plurality of user terminals S1 to S4, an application server (hereinafter referred to as an AC server) 12 that controls access to the database, and a database (hereinafter referred to as DB) 13 that stores client data. And comprising. In this example, it is assumed that Web application systems 100 constructed by A company, B company, C company, and D company are connected to each other via the Internet 14.
In the present invention, a single Web application system 100 includes an AC server 12 that controls access to a database in the LAN 11, and a plurality of Web application systems are connected to each other via the Internet 14, and information is exchanged between the Web application systems. When performing the above, the AC server 12 detects a covered channel in cooperation with the AC server provided in each Web application system, and controls so that the confidential information is not leaked or tampered with. That is, in a Web application system that detects a cover channel and prevents leakage and falsification of confidential information, in a closed network, the cover channel is detected by an AC server provided therein, and the confidential information is leaked. And the covered channel has been solved by preventing tampering. However, when a plurality of Web application systems are connected to each other via the Internet, it becomes difficult to prevent leakage and falsification of confidential information when accessed from the outside. Therefore, according to the present invention, the AC server included in each Web application system cooperates with each other while exchanging information to detect a covered channel, thereby preventing leakage and falsification of confidential information.

  FIG. 2 is a functional block diagram of an access control agent system (hereinafter referred to as an AC agent system) of the present invention. The same components will be described with the same reference numerals. This system includes a new Policy Decision Block (hereinafter referred to as a security policy determination block) 21, Access Control Manager Block (hereinafter referred to as an access control manager) 23, Identity and Permission Data Base (hereinafter referred to as access information database) 24, Policy Enforcement Block (hereinafter referred to as policy control block) 20, Access Control Mobile Agent (hereinafter referred to as mobile agent) 25, Access Control Policy Design and This is realized by adding functional blocks of an evaluation block (hereinafter referred to as an access control policy design evaluation block) 22 and an identity name resolution block (hereinafter referred to as a name / attribute / address resolution block) 26. The authentication block 27 has an authentication function equivalent to that of the SAML block 57 in the prior art.

Next, the function of each block in FIG. 2 will be described. The security policy determination block 21 is a central brain part that describes, accumulates, and controls the operation of the security policy related to the access authority, and instructs the authentication block 27 on the attribute of the user accessing the data layer 52. And execute the authentication process. Then, the user who is permitted the first barrier by the authentication can collect the access authority to the access control manager 23 in order to analyze the covered channel, and whether or not the next access to the specific data in the database can be acquired. Is commanded. If there is data requested by the user in the database, the data in the database is permitted with the access authority of the user. When there is no data requested by the user in the database, the access request of the user is inquired to another AC agent system.
The access control manager 23 is a manager function of the AC agent system, and performs coverage channel analysis and access authority arbitration according to instructions from the security policy control unit 21.
The access information database 24 is a database used by the access control manager 23 for analysis of covered channels, and stores a user name, a user attribute (Identity), data (Object), a permission, and the like.
The policy control block 20 filters user names, user identities, access requests, and data (Objects) as a result of analysis by the access control manager 23 according to instructions from the security policy control unit 21. This blocks unauthorized and unauthorized access from the database.
The mobile agent 25 is a mobile agent for exchanging information necessary for arbitration of access authority with the manager function of another AC agent system in accordance with an instruction from the access control manager 23.
The access control policy design evaluation block 22 describes the access control policy according to the formal usage description by the user during system design. The described channel is analyzed and evaluated for the covered channel by the functions of the security policy control unit 21 and the access control manager 23.
The name / attribute / address resolution block 26 is a block for finding out who has what information.

The concept of the AC agent system shown in FIG. 2 is (1) an access control system in which access authority changes can be efficiently communicated with each other and the system can be gradually shifted to an optimum system. (2) Although the above is not a complete access control, it is possible to present limits, and the limits describe and evaluate the access control policy and specific access authority in a formal specification, and reflect this in operational management (E.g. ISO 15408 and ISMS). This is a system that ensures safety. That is, each functional block in FIG. 2 is for realizing the system concept.
The most characteristic point here is that the mobile agent 25 collects access authority to the presentation layer 50 based on an instruction from the access control manager 23, and the application server detects a covered channel based on the information. As the Web application system executes the mechanism, the entire system is improved.
In order to realize such a system concept, “jurisdiction area” and “Community class” in which the Web application system controls access authority are newly defined. FIG. 3A is a diagram in which a Community class and a control method corresponding to the Community class are defined, and FIG. 3B is a diagram illustrating a jurisdiction area. And define it as follows. Critical-Community 30 strictly controls the assertion so that there is no 100% covered channel. The Federated Community 31 detects and controls the presence of a covered channel. Community 32 collects, detects, and controls access authority as much as possible. Individual 33 collects, detects and controls access authority as much as possible.
And there is always a Web application system in a community having four security requirements, and the function shown in FIG. 2 works. The function of the system is that personal information related to privacy completely removes the covered channel. Also remove it from the covered channel around your Community. Also, the access channel from another Community and the access authority related to it are presented to evaluate the covered channel. However, in another community, everything is unknown, so it is incomplete, but it continues. However, it is covered in connection with operation management. In addition, the access authority is specified by a formal description, designed and operated, and the portion that cannot be removed or cannot be completely filtered is covered by the operation.

FIG. 4 is a diagram showing a configuration example of the first embodiment of the present invention. In this embodiment, the Community 45 operates as a client server system that does not use the mobile agent 44 between the client 40 and the application server 42, and the mobile agent 44 of the application server 42 functions as a mediator of access authority arbitration information between the application servers 42. This is the case.
FIG. 5 is a diagram showing a configuration example of the second embodiment of the present invention. In this embodiment, Community 47 performs access authority request and control information exchange between mobile agent 44 of application server 42 and mobile agent 48 of client 40, and mobile agent 44 of application server 42 arbitrates access authority between application servers 42. This is a case of functioning as an information transfer role.
In the third embodiment, the relationship between the application server and the client is a normal client server system, and the application servers use a dedicated protocol, and no agent is used.
In the above embodiment, the Web application system has been described as an example. However, the present invention is not limited to this, and can be applied to other network systems such as a P2P communication system. In particular, since the P2P communication system is operated based on the same communication standard as the above-described Web application system, the present invention can be applied as it is.

The block diagram of the Web application system of this invention. The functional block diagram of the access control agent system of this invention. (A) is a diagram defining Community classes and control methods corresponding to them, and (b) is a diagram showing jurisdiction areas. The figure which shows the structural example of the 1st Embodiment of this invention. The figure which shows the structural example of the 2nd Embodiment of this invention. The figure which shows the implementation | achievement form of the conventional web application system. Explanatory drawing centering on the functional block of the conventional business logic layer. (A) is a diagram showing a state in which an information file is transmitted between a plurality of users based on an access matrix, and (b) is a row and column showing access rights that an access subject has to an accessed object. The figure which shows an example of the access matrix arrange | positioned in.

Explanation of symbols

20 policy control block, 21 security policy decision block, 22 access control policy design evaluation block, 23 access control manager, 24 access information database, 25 mobile agent, 26 name / attribute / address resolution block, 27 authentication block, 50 presentation layer, 51 Business logic layer, 52 Data layer

Claims (18)

An access control agent system for detecting and evaluating a covered channel in order to prevent leakage and falsification of confidential information in a network system,
The network system includes an application server that controls access to a database. When a plurality of network systems are connected via the Internet and information is exchanged between the network systems, the application server is included in each network system. An access control agent system, wherein the cover channel is detected in cooperation with the application server, and control is performed so that the confidential information is not leaked or tampered with. The access control agent system includes a security policy determination block for describing, storing, and determining the operation of the system, which describes a security policy related to access authority.
An access control manager that performs analysis of the covered channel and arbitration of access authority according to a command from the security policy determination block;
An access information database that stores user names, user attributes, file names, file attributes, permissions, etc .;
As a result of analysis by the access control manager according to the instruction of the security policy determination block, the user name, the user identity, the access request, and the data are filtered, and unauthorized access and unauthorized access are filtered from the database. A policy control block to block,
According to the command of the access control manager, a mobile agent that communicates information necessary for arbitration of access authority with the manager function of another access control agent system,
When designing a system, an access control policy design evaluation block in which a user describes an access control policy according to a formal usage description;
A name / attribute / address resolution block that searches the Internet for names and attributes of users you want to access,
The access control agent system according to claim 1, further comprising an authentication block for authenticating the accessed user name and attribute.   The security policy determination block controls the access control manager to manage the mobile agent so that information is not leaked from distributed individual network systems and databases connected thereto. 3. The access control agent system according to 1 or 2.   If there is data requested by the user in the database, the security policy determination block permits the data stored in the database with the access authority of the user, and there is no data requested by the user in the database. The access control agent system according to any one of claims 1 to 3, wherein the access control agent system queries the access request of the user to another access control agent system.   5. The security policy is reflected in an access control point in the application server by formalizing a security policy with respect to access authority on an XML basis. 6. The access control agent system described.   The client and the application server operate as a client server system that does not use the mobile agent, and the mobile agent of the application server functions as a role of transmitting access authority arbitration information between the application servers. Or the access control agent system according to 2.   The mobile agent of the application server and the mobile agent of the client exchange access authority requests and control information, and the mobile agent of the application server functions as a mediator of access authority arbitration information between application servers. The access control agent system according to claim 1 or 2.   The access control agent system according to claim 1, wherein the network system is a Web application system.   The access control agent system according to any one of claims 1 to 7, wherein the network system is a peer-to-peer communication system. A method for preventing leakage and falsification of confidential information in a network system,
The network system includes an application server that controls access to a database. When a plurality of network systems are connected via the Internet and information is exchanged between the network systems, the application server is included in each network system. A secret information leakage and tampering prevention method comprising: detecting the covered channel in cooperation with the access control agent system, and controlling the secret information so that the secret information is not leaked and tampered with. The access control agent system includes a security policy determination step for describing, storing, and determining the operation of the system for a security policy related to access authority;
An access control step for executing analysis of the covered channel and mediation of access authority according to a command from the security policy determination step;
An access information database that stores user names, user attributes, file names, file attributes, permissions, etc .;
As a result of analysis by the access control manager according to the instruction of the security policy determination block, the user name, the user identity, the access request, and the data are filtered, and unauthorized access and unauthorized access are filtered from the database. A policy control step to block;
A mobile agent step for communicating information necessary for arbitration of access authority with a manager function of another access control agent system by the access control step;
When designing a system, an access control policy design evaluation block in which a user describes an access control policy according to a formal usage description;
11. The leakage of confidential information according to claim 10, further comprising: a name / attribute / address resolution step for searching the name and attribute of a user who wants to access from the Internet; and a step of authenticating the accessed user name and attribute. And falsification prevention methods.   The security policy determining step controls the access control step to manage the mobile agent step so that information leakage does not occur from distributed individual network systems and databases connected thereto. Item 12. The method for preventing leakage and falsification of confidential information according to Item 10 or 11.   In the security policy determination step, when there is data requested by the user in the database, the data stored in the database is permitted by the access authority of the user, and there is no data requested by the user in the database. 13. The method for preventing leakage of confidential information and falsification according to any one of claims 10 to 12, wherein the access request of the user is referred to another access control agent system.   14. The security policy is reflected in an access control point in the application server by formalizing a security policy with respect to access authority on an XML basis. How to prevent leakage and falsification of confidential information.   The client server system operates as a client server system that does not use the mobile agent step between the client and the application server, and the mobile agent step of the application server functions as a mediator of access authority arbitration information between the application servers. Item 12. The method for preventing leakage and falsification of confidential information according to Item 10 or 11.   The mobile agent step of the application server and the mobile agent step of the client exchange access authority requests and control information, and the mobile agent step of the application server functions as a mediator of access authority arbitration information between application servers. 12. The method for preventing leakage and falsification of confidential information according to claim 10 or 11.   A network system program, wherein the secret information leakage and tampering prevention method according to any one of claims 10 to 16 is programmed to be controllable by a computer. A recording medium in which the network system program according to claim 17 is recorded in a computer-readable format.

Images