JP2006120013A - Access controller, access control method and program therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an access controller capable of maintaining higher security than in the conventional practice. <P>SOLUTION: A phase determining part 14 step of this access controller 1 receives a command as an instruction from an operating user and reads phase information in a unit of a series of processing at the time of receiving the command from a determination condition storing part 12, and an access control part 13 reads information of access authority associated with a combination of the information of the operating user instructing the received command and the read phase information and recorded in an access authority storing part 11 and determines whether or not to execute processing to an access target object shown by the command received as the instruction from the operating user on the basis of the access authority. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an access control device, an access control method, and a program for determining a program that can be accessed by an operating user based on access authority.

An outline of conventional access control of a UNIX (registered trademark) OS will be briefly described.
First, it is assumed that the user “jdoe” issues a directory deletion request “foo” via the application (command execution a). This request is entrusted from the user mode to the kernel by the system call “rmdir ()” (system call b). Then, in the processing function “vfs_rmdir ()”, a permission check “may_create ()” is called and access control is executed (access control c). Here, the kernel accesses whether or not an access right is given to a combination of a subject (accessing side), an object (access target) program, and a method (access type: for example, command type). Determine based on authority information.

  In the UNIX (registered trademark) OS, permission for “read / write / execute” is given to each object for file owners, groups, and other users, and subject UID (User Identifier) and Access permission / non-permission is determined based on a GID (Group Identifier) (permission check d). If “rmdir: delete directory”, write / execute authority is required for the upper directory to be deleted. If access is permitted, “rmdir”: processing) is executed, and if not permitted, an error is returned to the user (processing e according to the determination result).

  As described above, access control by the OS can impose control on access rights not only for general users but also for administrators. However, since there is always an administrator who has authority to the access right setting itself, all rights of the system are seized by acquiring this user authority illegally. In a UNIX (registered trademark) OS, it has been desired to eliminate various vulnerabilities in which a root user falls under this category and the root authority can be obtained illegally.

  The above-described prior art has the following problems in protecting access control information. That is, the access authority information itself is also an object, and therefore there is always an administrator who can access and change them, so that it is necessary not to pose a risk of falsification of the access authority information. If it is a normal UNIX (registered trademark) OS, the access right (owner, group permission) for each object is changed by a command such as “own / chgrp / chmod” if it is the owner of the object. Is possible. Further, if the administrator authority such as root is given, the access right can be changed for all objects. For this reason, when an unauthorized intrusion is performed in such a manner that root authority is taken, the meaning of protecting each object by the access right is reduced.

For such problems, security such as “force access authority” based on the administrator's access authority setting or “reduced authority” that gives another administrator authority to set access authority by reducing root authority. A highly reliable OS to which these enhancements have been applied has been put into practical use. In addition, a technology has been disclosed that acquires an authority level for operating an application based on an operator code recorded on an ID card and checks whether the application operating authority is satisfied based on the authority level. (For example, refer to Patent Document 1).
JP 2001-92784 A

  Here, in the prior art as described above, for example, in the process of transmitting a file to another server by a series of FTP (File Transfer Protocol) processes, the OS can be accessed at each stage in the series of processes. The permission to access all objects (FTP server setting information, user information to be referred to at the time of authentication, a file to be transferred by FTP, a syslog file as an output destination of log information, etc.) is given as an authority. Each stage in the series of FTP processes includes a stage where the FTP daemon is activated while referring to a setting file based on a command instruction or the like (phase 1), a stage where an authentication request from an FTP connection user is received (phase 2), The step of changing the FTP daemon UID (user ID) to the connected user's UID after successful authentication (phase 3), access to the file to be transmitted (read) or access to the received file based on the instruction from the connected user ( write) (phase 4) and the like.

  However, in the method of granting the access authority common to each stage in the series of processes to the operation user, unauthorized access is performed in the phase 2 stage in the series of processes (for example, a password field or the like at the time of authentication). If the access authority is taken by a user who has made unauthorized access, subsequent operations in Phase 3 and Phase 4 can be processed with the access authority that has been taken. In this case, the unauthorized access user is allowed to perform the processing in phase 3 and phase 4, and security cannot be ensured.

  Accordingly, an object of the present invention is to provide an access control device, an access control method, and a program thereof that can maintain higher security than conventional ones.

  The present invention has been made to solve the above-described problems, and is an access control apparatus that can change access authority information for an access target object recorded in the own apparatus for all operating users who operate the own apparatus. For each predetermined series of processing units, the operating user information, instructions received as instructions from the operating user at each stage in the series of processing units, and the series of instructions by receiving the instructions. Determination condition storage means for storing information of combination of stage designation information indicating which stage of each unit in the processing unit, and access corresponding to each stage in the series of processing units Access authority storage means for storing authority information for each operating user, and an instruction as an instruction from the operating user An operation user who receives an instruction and reads the stage designation information indicating the stage information in the unit of the series of processes when the instruction is received from the determination condition storage means, and the operating user who has instructed the received instruction And the access authority information recorded in the access authority storage means in association with the combination of the information and the stage in the series of processing units indicated by the read stage designation information, and the access authority And an access control means for determining whether or not to execute the process of the access target object indicated by a command received as an instruction from the operating user.

  Further, the present invention is characterized in that the series of processes is a predetermined series of processes performed by one application program based on the operation of the operating user.

  In the present invention, the series of processes is a predetermined series of processes performed by each of the plurality of application programs based on the operation of the operating user, and each stage in the unit of the series of processes is performed for each of the plurality of application programs. The stage of the process is shown.

  In addition, the present invention provides, for each predetermined series of processing units, information on the operating user, instructions received as instructions from the operating user at each stage in the series of processing units, and the series of processes by receiving the instructions. Determination condition storage means for storing information of combination of stage designation information indicating which stage of each unit in the processing unit, and access corresponding to each stage in the series of processing units Access authority storage means for storing authority information for each operating user, and access that can change access authority information for an access target object recorded in the own apparatus for all operating users operating the own apparatus A program to be executed by a computer of a control device, the instruction as an instruction from the operating user An operation user who receives an instruction, reads the stage designation information indicating the stage information in the unit of the series of processes when the instruction is received from the determination condition storage means, and the user who has instructed the received instruction And the access authority information recorded in the access authority storage means in association with the combination of the information and the stage in the series of processing units indicated by the read stage designation information, and the access authority And an access control process for determining whether or not to execute the process of the access target object indicated by the instruction received as an instruction from the operating user.

  According to the present invention, the access control means reads the access authority information corresponding to the stage determined by the state determination means from the access authority storage means at each stage in the series of processes, and uses the access authority information as the access authority information. Based on this, it is determined whether or not to execute the access target object indicated by the instruction instructed by the application program at each stage. Therefore, even if the access authority is acquired by the unauthorized user due to unauthorized access at each stage in the series of processing, the authority is limited to the range given in the relevant phase. Since the user who has made unauthorized access cannot obtain the authority permitted in other phases, it is possible to obtain an effect that higher security can be ensured. This effect, i.e., phase transition suppression, is brought about by the property that in the program that has been attacked by unauthorized access, the subsequent processing logic changes.

Hereinafter, an access control apparatus according to an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing the configuration of the access control apparatus according to the embodiment.
In this figure, reference numeral 1 denotes an access control device. The access control device 1 corresponds to a part of the OS (Operating System) function such as UNIX (registered trademark) of the computer, and actually the computer has other functions in addition to the function of the access control device 1. It has. In the present embodiment, for convenience of explanation, only the function of the access control device 1 will be described.

  In the access control apparatus 1, reference numeral 11 denotes an access authority storage unit that holds an access authority table. Reference numeral 12 denotes a determination condition storage unit, which holds a determination condition table. Reference numeral 13 denotes an access control unit, which determines whether or not to execute a process on an access target object indicated by a command received as an instruction from a certain operating user. Reference numeral 14 denotes a phase determination unit, which performs a process of determining a stage (phase) in a unit of a series of processes when the command is received based on a command received as an instruction from the operating user.

  Then, the access control device 1 executes processing for the access target object indicated by the instruction received as an instruction from the operating user based on the access authority corresponding to the phase based on the phase in the series of processing units. The process which determines whether or not is performed. The OS is an OS that can change the access authority of a general user and the access authority of an administrator user (root user).

FIG. 2 shows the data structure of the access authority table.
FIG. 3 is a diagram illustrating a data configuration of the determination condition table.
Next, the access authority table stored in the access authority storage unit and the determination condition table stored in the determination condition storage unit will be described with reference to FIGS.
First, as shown in FIG. 2, the access authority table includes a UID (user ID) or GID (group ID), an access target object to be accessed in that phase, and an access target object for each phase in a series of processes. Access authority (read / write / execute) information is recorded in association with each other. Based on the access authority table, the access control unit 13 determines whether or not to execute the process on the access target object indicated by the command received as an instruction from the operating user.

From FIG. 3, the determination condition table receives a series of processing types, UID (user ID) or GID (group ID) information, a type of command requested to be executed by the process, and the command. The phase information in the series of processes and the phase information (the transition destination phase) in the series of processes that transition to the next after receiving the command are recorded in association with each other. Then, the phase determination unit 14 determines the access requested to be executed in a series of processes based on the determination condition table. If applicable, the phase determination unit 14 proceeds to a predetermined phase according to the contents of the “transition destination phase”. The transition is performed.
The series of processing may be a unit of processing set in advance, for example, from a user's FTP processing start instruction (FTP command input) to completion of data transfer in FTP (File Transfer Protocol) processing. Even a series of processes may be a series of processes from a first process to a last process using a plurality of applications.

FIG. 4 is a first diagram showing an outline of processing of the access control apparatus.
FIG. 5 is a first processing flow of the access control apparatus.
Next, the first processing flow of the access control apparatus will be described with reference to FIGS.
First, in a series of operations of the process A in the operation of the application A of the user A who is the operating user, the access control unit 13 receives a command for executing a process on the access target object by the program of the application A (step S1a). ). Further, when receiving this command, the access control unit 13 receives a UID (or GID) that is identification information of the user A who has instructed this command. When the access control unit 13 receives the first command as an instruction in the process A from the user A, the access control unit 13 determines that the command is a command instructed in the phase 1 in the process A, and determines the type of the process A and the phase Access authority (1) recorded in the access authority table of the access authority storage unit 11 in association with the information of the type “phase 1”, the UID of the user A, and the access target object processed based on the command ) Is read (step S2a). Here, if the access authority is executable (execute), the access control unit 13 executes processing for the access target object indicated by the accepted command (step S3a).

  In phase 1 of process A, the access control unit 3 detects a command instructed by the user A's UID from the program of the application A. Then, the detected command information, processing A information, and user A UID information are notified to the phase determination unit 14. The phase determination unit 14 records the combination of the command information “command a” notified from the access control unit 13, the process A information, and the user A UID information in the determination condition table of the determination condition storage unit 12. If it is recorded, the information “phase 2” of “transition destination phase” is read (step S4a). Then, the phase determination unit 14 notifies the access control unit 13 of the read “transition destination phase” information (step S5a). As a result, the access control unit 13 determines whether to execute the command instructed by the program of the application A thereafter, the process A, the information of “phase 2” that is the information of “phase of transition destination”, the usage The access authority (2) recorded in the access authority table of the access authority information storage unit 11 in association with the access target object to be processed based on the user A's UID and command (step S6a) Based on the read access authority, it is determined in phase 2 whether or not the process for the access target object indicated by the command indicated by the application A program can be executed. If it is determined that the process for the access target object can be executed, the access control unit 13 executes the process for the access target object indicated by the accepted command (step S7a).

  In phase 2 of process A, the access control unit 3 detects a command instructed by the user A's UID by the program of the application A. Then, the detected command information, processing A information, and user A UID information are notified to the phase determination unit 14. In the phase determination unit 14, a combination of the command information “command b” notified from the access control unit 13, the process A information, and the user A UID information is recorded in the determination condition table of the determination condition storage unit 12. If it is recorded, the information “phase 3” of “transition destination phase” is read (step S8a). Then, the phase determination unit 14 notifies the access control unit 13 of the read “transition destination phase” information (step S9a). As a result, the access control unit 13 determines whether to execute the command instructed by the program of the application A thereafter, the process A, the information of “phase 3” that is the information of “phase of transition destination”, the usage The access authority (3) recorded in the access authority table of the access authority information storage unit 11 in association with the UID of the user A and the access target object processed based on the command is read (step S10a). Based on the read access authority, it is determined whether or not the process for the access target object indicated by the command instructed by the program of the application A in the phase 3 can be executed. If it is determined that the process for the access target object can be executed, the access control unit 13 executes the process for the access target object indicated by the accepted command (step S11a).

  In phase 3 of process A, the access control unit 3 detects a command instructed by the user A's UID by the program of the application A. Then, the detected command information, processing A information, and user A UID information are notified to the phase determination unit 14. The phase determination unit 14 records the combination of the command information “command c” notified from the access control unit 13, the process A information, and the user A UID information in the determination condition table of the determination condition storage unit 12. If it is recorded, the information “phase 4” of “transition destination phase” is read (step S12a). Then, the phase determination unit 14 notifies the read control unit 13 of the read “transition destination phase” information (step S13a). As a result, the access control unit 13 subsequently determines whether to execute the command instructed by the program of the application A, the process A, the information of “phase 4” that is the information of the “transition destination phase”, the usage The access authority (4) recorded in the access authority table of the access authority information storage unit 11 in association with the UID of the user A and the access target object processed based on the command is read (step S14a). Based on the read access authority, it is determined whether or not the process for the access target object indicated by the command instructed by the program of the application A in the phase 3 can be executed. If it is determined that the process for the access target object can be executed, the access control unit 13 executes the process for the access target object indicated by the accepted command (step S15a).

As described above, the example in which each access authority is applied to the application process serving the operating user in each phase of the series of processing by one application program has been described. The control unit 13 reads the access authority corresponding to the phase determined by the state determination unit 14 in each of the phases 1 to 4 in the series of processes A from the access authority table, and based on the access authority, It is determined whether or not to execute the process on the access target object indicated by the command indicated by the program A.
In the conventional access control apparatus / method that does not use the proposed method, in such an unauthorized access situation, an unauthorized operation is performed to the user who has performed unauthorized access, making full use of all the privileges permitted for the application process. Can cause more damage. On the other hand, even if, for example, in Phase 2, a user who has made unauthorized access by attacking the vulnerability of the application process that is providing the service performs unauthorized access through the application process, the access authority is Since it is limited to those permitted in phase 2, and authority in other phases is not given, damage can be further suppressed. By using the proposed method in this way, higher security can be ensured.

FIG. 6 is a second diagram showing an outline of processing of the access control apparatus.
FIG. 7 is a second processing flow of the access control apparatus.
Next, a second processing flow of the access control apparatus will be described with reference to FIGS.
The second processing flow is a flow when a series of processing is processed by a plurality of application programs.
First, in the operation of a series of processing B in the operation of each of the applications A, B, and C of the user B who is an operating user, the access control unit 13 first accesses the program as processing of each program of the application A. Each command for executing processing on the object is received (step S1b). In addition, when receiving these commands, the access control unit 13 receives a UID (or GID) that is identification information of the user B who has instructed the command. In the process B from the user B, when the access control unit 13 receives a command for executing the process from the program of the application A to the object to be accessed, the access control unit 13 indicates that the command is a command instructed in the phase 1 in the process B. Access of the access authority storage unit 11 is determined in association with the type of process B, the information of phase type “phase 1”, the UID of user B, and the access target object to be processed based on the command. The access authority (5) recorded in the authority table is read (step S2b). Here, if the access authority is executable (execute), the access control unit 13 executes processing for the access target object indicated by the accepted command (step S3b).

  In phase 1 of process B, the access control unit 3 detects a command instructed by the user A's UID from the program of the application A. The detected command information, processing B information, and user B UID information are notified to the phase determination unit 14. The phase determination unit 14 records the combination of the command information “command e” notified from the access control unit 13, the process B information, and the user B UID information in the determination condition table of the determination condition storage unit 12. If it is recorded, the information “phase 2” of “transition destination phase” is read (step S4b). Then, the phase determination unit 14 notifies the access control unit 13 of the read “transition destination phase” information (step S5b). As a result, the access control unit 13 subsequently determines whether to execute the command instructed by the program of the application B, the process B, the information of “phase 2” which is the information of “transition destination phase”, The access authority (6) recorded in the access authority table of the access authority information storage unit 11 is read in association with the access object to be processed based on the user B's UID and command (step S6b). Based on the read access authority, it is determined in phase 2 whether or not the process for the access target object indicated by the command instructed by the application B program can be executed. If it is determined that the process for the access target object can be executed, the access control unit 13 executes the process for the access target object indicated by the accepted command (step S7b).

  In phase 2 of process B, the access control unit 3 detects a command instructed by the user B's UID from the program of the application B. The detected command information, processing B information, and user B UID information are notified to the phase determination unit 14. The phase determination unit 14 records the combination of the command information “command f” notified from the access control unit 13, the process B information, and the user B UID information in the determination condition table of the determination condition storage unit 12. If it is recorded, the information “phase 3” of “transition destination phase” is read (step s8b). Then, the phase determination unit 14 notifies the access control unit 13 of the read “transition destination phase” information (step S9b). As a result, the access control unit 13 then determines whether to execute the command instructed from the program of the application C, the process B, the information of “phase 3” that is the information of the “transition destination phase”, Read the access authority (7) recorded in the access authority table of the access authority information storage unit 11 in association with the user B's UID and the access target object processed based on the command (step S10b). Based on the read access authority, it is determined in phase 3 whether or not the process for the access target object indicated by the command instructed by the application C program can be executed. If it is determined that the process for the access target object can be executed, the access control unit 13 executes the process for the access target object indicated by the accepted command (step S11b).

  As described above, the example in which each access authority is applied to the operation user in each phase of the series of processes by the plurality of application programs has been described. However, as shown in the above-described process, the access control unit 13 performs the process B in the series of processes B. In each of the phases 1 to 3, a command that the access authority corresponding to the phase determined by the state determination unit 14 is read from the access authority table, and the commands instructed by the programs of the applications A to C in each phase based on the access authority It is determined whether or not the process for the access target object indicated by is executed. Therefore, for example, even if access authority is acquired by a user who has made unauthorized access due to unauthorized access in Phase 2, the access authority in the next Phase 3 is different from the access authority in Phase 2. Therefore, it is possible to ensure higher security in granting access authority in user operations.

  The access control apparatus described above has a computer system inside. The process described above is stored in a computer-readable recording medium in the form of a program, and the above process is performed by the computer reading and executing this program. Here, the computer-readable recording medium means a magnetic disk, a magneto-optical disk, a CD-ROM, a DVD-ROM, a semiconductor memory, or the like. Alternatively, the computer program may be distributed to the computer via a communication line, and the computer that has received the distribution may execute the program.

  The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

It is a block diagram which shows the structure of the access control apparatus by one Embodiment of this invention. It is a figure which shows the data structure of the access authority table by one Embodiment of this invention. It is a figure which shows the data structure of the determination condition table by one Embodiment of this invention. It is a 1st figure which shows the process outline | summary of the access control apparatus by one Embodiment of this invention. It is a figure which shows the 1st processing flow of the access control apparatus by one Embodiment of this invention. It is a 2nd figure which shows the process outline | summary of the access control apparatus by one Embodiment of this invention. It is a figure which shows the 2nd processing flow of the access control apparatus by one Embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Access control apparatus 11 ... Access authority memory | storage part 12 ... Judgment condition memory | storage part 13 ... Access control part 14 ... Phase determination part

Claims (4)

An access control device capable of changing access authority information for an access target object recorded in the own device for all operation users operating the own device,
For each predetermined series of processing units, the information on the operating user, an instruction received as an instruction from the operating user at each stage in the series of processing units, and the series of processing by receiving the instruction Judgment condition storage means for storing information of a combination of stage designation information indicating which stage of each stage in the unit, and
Access authority storage means for storing information of access authority corresponding to each stage in the series of processing units for each operating user;
A stage determination unit that receives the instruction as an instruction from the operating user and reads the stage designation information indicating the stage information in the series of processing units when the instruction is received from the determination condition storage unit;
The access recorded in the access authority storage means in association with the combination of the information of the operating user who has instructed the received command and the stage in the series of processing units indicated by the read stage designation information. An access control means for reading authority information and determining whether or not to execute the process of the access target object indicated by the instruction received as an instruction from the operating user based on the access authority;
An access control device comprising: The access control apparatus according to claim 1, wherein the series of processes is a predetermined series of processes performed by one application program based on an operation of the operating user. The series of processes is a predetermined series of processes performed by each of a plurality of application programs based on the operation of the operating user,
The access control apparatus according to claim 1, wherein each stage in the series of processing units indicates a stage of processing for each of the plurality of application programs. For each predetermined series of processing units, information on the operating user, an instruction received as an instruction from the operating user at each stage in the series of processing units, and each of the series of processing units by receiving the instruction Judgment condition storage means for storing information of a combination of stage designation information indicating which stage of the stage, and
Access authority storage means for storing information of access authority corresponding to each stage in the series of processing units for each operating user;
With
A program for causing a computer of an access control device that can change access authority information for an access target object recorded in the own device for all operating users who operate the own device,
A stage determination process for receiving the instruction as an instruction from the operating user and reading the stage designation information indicating the stage information in the unit of the series of processes when the instruction is received from the determination condition storage unit;
The access recorded in the access authority storage means in association with the combination of the information of the operating user who has instructed the received command and the stage in the series of processing units indicated by the read stage designation information. An access control process that reads information on authority and determines whether or not to execute the process of the access target object indicated by the instruction received as an instruction from the operating user based on the access authority;
A program that causes a computer to execute.

Images