JP2006302191A - Database management system and access control method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a database management system and an access control method in which detail and dynamic access are made possible. <P>SOLUTION: A database management system (1), equipped with a function for processing an access request to an object (42) from a subject (6), is equipped with an access check module (3) for determining success or failure of the access request from the subject (6) and an access control database (5) including relation data referred to by the access check module (3) in order to determine the success or the failure. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a database management system and an access control method for objects.

  The conventional database management system access control method controls only by the rule which object can perform which operation on which object. A subject and an object are a user and a table, respectively, and operations include insertion, change, deletion, reference, and the like. The conventional access control method in the database management system controls which user can perform operations such as insert, change, delete, and refer to which table. In Patent Document 1, an access control system for objects in a distributed network is realized, but only for control related to reference.

  FIG. 4 is a block diagram of an access control engine for restricting access to managed objects on the network of Patent Document 1. In FIG. In FIG. 4, a network management system 100 having an access control engine (ACE) 102 that restricts access to managed objects on the network 106 by an initiator 104 (for example, an application program that operates on behalf of the user). It is shown. Network 106 can be virtually any type of computer-implemented network that uses a management protocol to perform management functions. The access control engine includes an access control database 108. Like the original network itself, the access control database 108 is made up of a hierarchy of objects and includes access control rules that are applied to access requests to determine whether or not to grant access requests. Is done. An access control decision function (ACDF) 110 is a procedure (or set of procedures) that applies access control rules to each access request to determine whether to approve or deny the requested access to the managed object. If the access request targets more than one managed object, some parts of the access request may be allowed, but other parts may not. The access control execution function 112 is a procedure (or set of procedures) for enforcing a decision made by the access control determination function 110. In particular, the access control execution function 112 returns an access denial by the access control determination function 110. If the access is denied, an access denial response is sent. If access is approved, an access request is sent to the appropriate managed object.

Japanese Patent Application Laid-Open No. 2003-259542 executes database unit storing a plurality of data files constituting a hierarchical structure, one or more terminal devices that access a data file in the database unit, and control related to an access request to the data file from the terminal device. A data access control device having an access control means is disclosed, and the database means corresponds to a user master table storing user information for each user and a data file of each of a plurality of data files stored in the database. A menu master table storing data file specific information. The user master table has a user identifier unique to the user, a menu identifier that uniquely determines the hierarchical data menu, and processing authority for the data file for each user. It has a processing authority setting field in which user-specific input authority and inquiry authority are set, and the menu master table is set corresponding to each data file, and a menu identifier for uniquely determining a hierarchical data menu, and a user master A user authority included in the access request from the terminal device, and having an activation authority setting field for setting whether or not the data file can be activated for each user based on the setting of the processing authority setting field of the table. And extracting a corresponding user identifier from the user master table, identifying a menu identifier set corresponding to the user identifier, selecting a data file having the identified menu identifier from the menu master table, and Output as a display menu to the device Refer to the setting value of the processing authority setting field of the user master table according to the setting value of the starting authority setting field of the menu master table, the setting value of the starting authority setting field of the menu master table, and the processing authority setting of the user master table Based on the setting value of the field, the activation of each data file is controlled according to the user. FIG. 5 is a block diagram showing the system configuration of the data access control device disclosed in Patent Document 2. 230 is an access management server, 250 is an information file database, 251 is a user master storing a user master table, and 252 is a menu master table. The stored menu master, 211 to 213 are user terminals, 220 is a network, a plurality of user terminals 211, 212, and 213 are connected to the access management server 230 via the network 220, and the access management server 230 includes a plurality of data An information file database 250 that stores data whose components are files, a user master database 251 that stores individual user information, and a plurality of data files included in the information file database 250 are associated with each data file. In each of the menu master database 252 which stores menu information on the hierarchical structure information of specific information and data files is that has become accessible configuration.
JP 2000-47924 A (FIG. 1) Japanese Patent No. 3382881 (Claim 1)

  Since the granularity of objects in the conventional access control method in the database management system is in units of tables, there is a problem that detailed access control in units of records cannot be performed. Furthermore, there has been a problem in that dynamic access control cannot be performed so that an access of a subject can control an access of another subject.

  The present invention has been made in view of such problems, and provides a database system and an access control method capable of dynamic access using object granularity as records, and prevents data leakage and unauthorized access. The purpose is to do.

According to the first aspect of the present invention, in a database management system having a function of processing an access request to an object from a subject, an access check module for determining pass / fail of an access request from a subject, and the access check module An access management database containing relational data referenced to determine
It is characterized by comprising.
According to a second aspect of the present invention, in the database management system according to the first aspect, the access check module receives an access request from a subject, and performs a request for executing any operation on which object of the subject. It is characterized in that it has a function of analyzing whether or not there is an access and determining pass / fail of access based on the relationship of what operation the object has been executed.
According to a third aspect of the present invention, in the database management system according to the first aspect, the access management database including the relationship data includes an access control rule table including a relationship between objects defined by an administrator, and the access rule control. And a state control table that holds a state of whether the table is valid or not.
According to a fourth aspect of the present invention, in the database management system according to the third aspect, the access control rule table is a description relating to access to a table and a record which are objects.
The invention according to claim 5 is the database management system according to claim 3, wherein the state control table dynamically changes access control. In a database management system access control method having a function of processing an object access request from a subject, a step in which a subject sends a request for an operation on an object to a request control module, and the request control module refers to a user database The authentication control step, the request control module inquires the access check module whether the access to the operation is successful, and the access check module refers to the access management database to determine whether the access is successful. A step of sending the pass / fail result to the request control module, and a step of executing a request to the user data table and returning a response to the subject when the request control module is permitted to access. And a step of returning an error to the subject when the request control module is denied access.

  According to the present invention, it is possible to provide a database system and an access control method in which object granularity is a record and dynamic access is possible. As a result, access control can be designed in detail, so that data leakage and unauthorized access can be prevented.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. Note that the present invention is not limited to the embodiments.

  FIG. 1 is a block diagram of a database management system according to the present invention. In FIG. 1, 1 is a database management system, 2 is a request control module, 3 is an access check module, 4 is a user database, 5 is an access management database, and 6 is a subject S. 41 is a user data table, 42 is an object, 51 is an access control rule table, and 52 is a state control table. The subject (S) 6 transmits the request a of the operation V for the object (O) 42 to the request control module. The request control module that has received the request a inquires the access check module about the pass / fail of the operation V for the object (O) 42 of the subject (S) after completing the authentication of the subject S (request b). The access check module that has received the request b refers to the access management database 5 to determine whether access is successful or not, and transmits the result to the request control module 2 (response f). When access is permitted by the response f, the request control module 2 executes the request d on the user data table 41 and returns the response e to the subject (S) 6. When the request control module 2 is denied access by the response f, an error is returned to the subject (S) 6. In the conventional database management system, the access acceptance / rejection determination method is realized only by whether or not the subject (S) 6 permits the operation (V) to access the object (O) 42. In other words, the pass / fail of access is determined only by the subject (S), operation (V), and object (O) of the access control rule table 51 in FIG. If the access rule <S, V, O> exists in the rule table, the access is permitted, and if not, it is denied. In the present invention, in consideration of the relationship of what kind of object the object O is, more detailed control is possible compared to the conventional access control method. In addition to the subject (S), operation (V), and object (O) in the access control rule table in FIG. 1, relationships are introduced into the rules by object-subject (OS), object-operation (OV), and type (T). To do. The object-subject (OS) and the object-operation (OV) respectively decide whether to permit or deny access when the subject (OS) has performed the operation (OV) on the object (O). It becomes possible to do. Whether to allow or reject is determined by the type T. Whether or not the rule is valid is determined by the state (ST) of the state control table 52. rid is used for the relationship for connecting the access rule of the access control rule table 51 and the state of the state control table 52. For example, when the access control rule table <rid, S, O, V, OS, OV, T> and the state control table <rid, ST> exist, an operation (V) on the object (O) of the subject (S) ) Is permitted (when T is permitted) or rejected (when T is denied) when the operation (OV) is performed on the object (O) by the subject (OS). Whether the subject (OS) has performed an operation (OV) on the object (O) is determined by the state (ST). Here, <O, OS, OV> is expressed as a relationship in which the object (O) is operated (OV) by the subject (OS).

FIG. 2 is an example in which the access check module 3 determines whether access is successful. Rules with rid 1 and 2 in the access control rule table 51 indicate access rules according to the conventional access control method. The rule with rid of 1 allows the user emp to permit operation ins (insertion) to the table R, and the rule with rid of 2 permits the user gm to perform the operation sel (reference) on the table R. The rules with rid 3 and 4 indicate access rules based on the relationship according to the present invention. The rule whose rid is 3 permits (gr) access by the operation upd (change) of the user emp with respect to the record R _emp operated by the user emp. Here, R _emp represents a record in the table R owned by the user emp. The record with rid of 4 denies (rv) access by the operation upd of the user emp with respect to the table R operated by the user gm. The rid of the state control table indicates the rid of the access control rule table, and st indicates the state. In st, there are i (invalid) and v (valid), and only in the case of v, the access rule of the corresponding rid is valid. In the initial state, all are i, but can be changed to v by the access check module 3 in response to the access from the subject.

FIG. 3 is a processing flow of the access check module 3. The processing of the access check module 3 in the database management system 1 will be described with reference to FIG. The user emp is permitted to insert a record into the table R according to the rule whose rid is 1 (S11, S12). Thereafter, the state control table is checked (S20), and the st in the state control table having the rid of 3 is changed to v (S22). In this process, the rule whose rid is 3 in the access control rule table becomes valid, and the user emp can change the table R from the next request transmission (S15, S16). However, since the relationship of <R _emp , emp, ins> is defined in the rule with rid of 3, it can be changed only for the record inserted by the user emp. That is, since the user emp can change only the record inserted by himself / herself in the table R, the change is not allowed for the record inserted by another subject (S11). Records inserted by other subjects are accessed as separate objects. In the conventional access control method, since there is no concept of relationship, it is only possible to control whether or not the user emp can change all the records in the table R. In other words, only access control can be performed on a table basis. In the present invention, since access control based on the relationship is introduced, it is possible to perform access control not in units of tables but in units of records.

  Next, consider a case where the user gm refers to a record inserted by the user emp. The user gm can refer to all the records in the table by the rid 2 rule. As a result of the execution of the reference, the st in the state control table with the rid of 4 is changed to v (S22), and the rule with the rid of 4 becomes valid. Consider a case where the user emp changes a record after referring to the user gm. When the user emp changes a record in the table R, a rule with a rid of 4 is checked in S13, an access rejection determination is made in S14, and an access rejection process is executed in S30. In the conventional access control method, subsequent access control cannot be dynamically changed by access of other subjects. However, in the present invention, since access control based on the relationship is introduced, dynamic access Control becomes possible.

  FIG. 6 is a flowchart showing the access control method of the database management system of the present invention. In step S41, the subject sends a request for an operation to the object to the request control module. In step S42, the request control module refers to the user database and performs authentication. Next, in step S43, the request control module inquires of the access check module whether or not the operation access to the object is successful. Next, in step S44, the access check module refers to the access management database to determine whether or not to access. In step S45, the access check module transmits a pass / fail result to the request control module. In step 46, when it passes, it moves to step S47, and when it fails, it moves to step S48. Step S47 is a pass, executes a request for the user data table, and returns a response to the subject. Step S48 returns an error to the subject in the case of failure.

  According to the present invention, it is possible to design access control in detail, so that it can be expected to be applied to a database management system in which prevention of data leakage and unauthorized access, which are currently problematic, is indispensable.

1 is a block diagram of a database management system showing a first embodiment of the present invention. The figure explaining the definition of the access rule which shows 1st Example of this invention The figure explaining the check method of the access rule of this invention, and the method of operating the state of a state control table Access control engine block diagram of a conventional example Block diagram showing system configuration of conventional example The flowchart which shows the access control method of this invention

Explanation of symbols

1 Database Management System 2 Request Control Module 3 Access Check Module 4 User Database 5 Access Management Database 6 Subject (S)
41 User data table 42 Object (o)
51 Access control rule table 52 Status control table a, b, c, d Request e, f, g, h Response

Claims (6)

In a database management system with a function to process an object access request from a subject,
An access check module that determines whether or not an access request from a subject is acceptable;
An access management database including relational data referenced by the access check module to determine pass / fail;
A database management system characterized by comprising   The access check module receives an access request from a subject, analyzes what operation is performed on which object of the subject, and relates to what operation is performed on the object 2. The database management system according to claim 1, further comprising a function for determining whether or not access is permitted based on the database.   The access management database including the relationship data includes an access control rule table including a relationship between objects defined by an administrator, and a state control table holding a state indicating whether or not the rule of the access rule control table is valid. The database management system according to claim 1, wherein:   4. The database management system according to claim 3, wherein the access control rule table describes a table relating to an object and a rule relating to access to a record and a relation between the rules.   4. The database management system according to claim 3, wherein the status control table dynamically changes an access control rule. In an access control method of a database management system having a function of processing an access request to an object from a subject,
The subject sending a request for an operation on the object to the request control module;
A request control module refers to a user database and authenticates;
The request control module inquires of the access check module whether the access to the operation is successful or not,
An access check module refers to an access management database to determine whether or not to access;
The access check module sending a pass / fail result to the request control module;
If the request control module is granted access, executing a request against the user data table and returning a response to the subject;
If the request control module is denied access, returning an error to the subject;
An access control method for a database management system, comprising:

Images