JP2007086893A - Access control method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To simplify access control information of each resource, and implement centralized management of user information. <P>SOLUTION: A system enables user access control by inquiring a user's attributes of a directory server in response to a request for the user's coordinate information from a data, folder or service management means access-requested by the user, dynamically generating the user's access control matrix from a matrix template according to the acquired user's attribute information, computing the user's coordinate information from the matrix, and comparing it with coordinate information held by the data, folder or service management to determine and control the user's access authority. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a system that performs access control based on user information that is centrally managed by a directory server.

  Conventionally, when a user accesses a resource such as data, folder, or service, access control information related to the user's access authority is held for each resource such as data, folder, or service when performing access control that determines the user's authority It was common to do.

  However, in this method, when the scale of users who use these resources such as data, folders, and services increases, the access control information that each resource must hold becomes enormous.

  Also, by having access control information individually for multiple resources, the access control information is enormous, and if the access control authority changes due to user attribute changes, this correction work becomes very complicated. Therefore, there has been a problem that the management cost has increased.

For example, Patent Document 1 can be cited as a conventional example.
JP 2003-280990 A

  As described in the previous section, in the conventional method, when the size of users who use each resource such as data, folders, and services becomes large, the access control information that each resource must hold is enormous. become.

  Also, by having access control information individually for multiple resources, the access control information is enormous, and if the access control authority changes due to user attribute changes, this correction work becomes very complicated. Therefore, there has been a problem that the management cost has increased.

  The present invention solves the above problems, simplifies access control information possessed by each resource, and realizes unified management of user information.

  Based on the user's coordinate information request from the data or folder or service management means requested by the user, the directory server is inquired of the user's attribute, and based on the acquired user attribute information, the matrix template , Dynamically generating an access control matrix of the user, obtaining coordinate information possessed by the user from the matrix, determining the access authority of the user by comparing with the coordinate information possessed by the data or folder, service management, This is a system that enables user access control by enabling control.

  As described above, according to the present invention, based on a request for the coordinate information of the user from the data or folder or service management means requested by the user, the directory server is inquired about the user attribute and obtained. Based on the attribute information of the user, the access control matrix of the user is dynamically generated from the matrix template, the coordinate information of the user is obtained from the matrix, and compared with the coordinate information of the data, folder, or service management. By doing so, it becomes possible to judge and control the access authority of the user, thereby performing the access control of the user.

  Embodiments of the present invention will be described below with reference to the drawings.

  1 and 2 are diagrams showing a network configuration according to an embodiment of the present invention.

  In FIG. 1, reference numeral 101 denotes a directory server. This server performs land reduction management of attribute information related to users.

  The directory server 101 is based on the attribute information related to the user specified from the matrix manager 103, and based on the matrix template that is held, the user access control matrix of the user applied to the template. Is dynamically generated to calculate at which coordinates on the control matrix the logical product of the user information is located.

  The resource management system 105 manages what kind of access rights are allowed for a user located at which coordinate on the control matrix for each managed resource, and is sent from the matrix manager 103. The user's access right is determined by collating with the coordinate data designated in advance as having specific authority for the user's coordinate data and each resource.

  In FIG. 1, the resource management system 105 is a system for managing document data and a folder for storing the document data. The resource management system 105 permits privileges or browsing for individual folders and data managed by the resource management system 105. The coordinates that the user should have are managed for each of these resources.

  The client computer 106 is a terminal used by the user when using the resource of the resource management system managed by the access control system.

  FIG. 2 illustrates that resources managed by the resource management system can be applied not only to specific folders and data as shown in FIG. 1 but also to services provided to users.

  As one of the services provided here, it is possible to implement a document management system as described in FIG.

  In both FIG. 1 and FIG. 2, the directory server 101, the matrix manager 103, and the resource management system 105 are illustrated as separate nodes. However, a single node may have two or three functions. .

  The flow of access control will be described with reference to FIGS.

  When there is an access request from the client computer 106 to a specific resource managed by the resource management system 105 or 205, the resource management system 105 or 205 receives the user information sent from the client computer or the resource management system 105. Alternatively, if there is a step of logging in to 205, the matrix manager 103 is requested to acquire coordinate information of the user based on the user information obtained at the time of login.

  In this step, when the above-described login step exists as a step before accessing the resource, the coordinate information of the user is acquired from the matrix manager 103 in advance and stored in the memory when the user logs in. Therefore, it is possible to reduce the overhead when accessing each resource.

  Upon receiving the user coordinate information acquisition request, the matrix manager 103 acquires the attribute information of the user from the directory server 101, and on the matrix template (FIG. 5) defined or shared for each resource. By mapping the attribute information of the user, an access control matrix (FIGS. 6 and 7) is dynamically generated.

  From the access control matrix (FIGS. 6 and 7) created on the matrix manager 103, a list of the coordinate information of the user (the coordinates at which the attributes of the user intersect on the matrix) is returned to the resource management system 105 or 205.

  The resource management system 105 or 205 that acquired the coordinate information list of the user from the matrix manager 103 determines the access authority of the user based on the coordinate data management table of the managed resource.

  FIG. 3 is a functional block diagram of the matrix manager 103 in this embodiment.

  In FIG. 3, the matrix manager 103 is connected to the network through the communication control unit 301.

  An operation management unit 302 manages logs related to the operation of the matrix manager 103, and manages and records administrator users who log in to the matrix manager 103 and change settings.

  In addition, the operation management unit 302 performs settings for the operation of the matrix manager 103, setting of a matrix template, and the like through the information providing unit 303.

  The user attribute information acquisition unit 304 performs attribute information on a user who has requested access from the client computer 106 to the directory server 101 via the communication control unit 301 and the data transmission unit 305.

  Based on the user attribute information acquired by the user attribute information acquisition unit 304 and the matrix template managed by the matrix DB management device 351, the dynamic matrix generation unit 306 generates a control matrix.

  Based on the matrix generated by the dynamic matrix generation unit 306, the information providing unit 302 creates the coordinate information of the user, and sends the coordinate information of the user to the resource management system through the data transmission unit 305 and the communication control unit 301. .

  FIG. 4 is a functional block diagram of the resource management systems 105 and 205 in the present embodiment.

  In FIG. 4, the communication control unit 401 manages communication between the resource management system 105 or 205 and other nodes.

  The operation management unit 402 manages logs related to the operation of the resource management system 105 or 205, and manages and records administrator users who log in to the node and change settings.

  Reference numeral 403 denotes an information providing unit that provides the client with resources managed by the resource management systems 105 and 205 using the resource management device 452, such as document data, and folders or services for storing the data.

  Reference numeral 404 denotes a coordinate data comparison unit as an access authorized person managed by the coordinate data management device 451 related to the user coordinate data received from the matrix manager 103 and each resource managed by the resource management systems 105 and 205. Comparison with the defined coordinate data is performed, and the access authority of the user is confirmed.

  Based on the comparison result of the coordinate data, the information providing unit 403 provides the user with the resources (documents and folders storing the documents or services) managed by the resource management device 452.

  FIG. 5 is an example of a matrix template in the present embodiment.

  In this embodiment, a two-dimensional matrix template is presented, but a three-dimensional matrix can also be used depending on the usage form of the system.

  In FIG. 5, a template is defined with a belonging organization on the horizontal axis and a post on the vertical axis. Although it is described in a tabular format here, this is for ease of understanding of the GUI when viewed from the administrator user, and in fact, data management is not necessarily performed in the tabular format.

  FIG. 6 is an example of a matrix generated by reflecting user attribute information in the matrix template of FIG. 5, and is managed by the matrix DB management device 351.

  The user (hereinafter referred to as user A) is a department manager of organization A, serves as a section manager of organization B, serves as project chief of project A, participates in task force A, and serves as a group leader in work group B.

  If this is expressed in coordinates, the user A is a user having coordinate information of (1,1), (2,2), (3,3), (4,5), (5,4). .

  Next, FIG. 7 is an example of a matrix generated by reflecting user attribute information in the matrix template of FIG.

  The user (hereinafter referred to as user B) is a general employee of organization A, a group leader of project A, and participates in task force A and work group B.

  When this is expressed in coordinates, the user B is said to be a user having coordinate information of (1,5), (3,4), (4,5), (5,5).

  FIG. 8 is an example of a coordinate data management table.

  In this example, access control information for folder A is represented. A general regular expression can be used to specify the coordinates.

  The user with the coordinates (1,1) has the authority to delete folder A. If this is applied to an example of the matrix template of FIG. 5, it is the department manager of the tissue A that has the coordinates (1,1), and if applied to FIG. 6 and FIG. 7 which are examples of the generated matrix, User A corresponds to this.

  Further, it is possible to read out (1-2, *), and according to FIG. 5, since the user belonging to the organization A or the organization B has the authority, the example of FIG. 6 and FIG. This applies to both user A and user B.

  It is also possible to define the access right using the logical product or logical sum of the coordinate notation itself. For example, according to FIG. 5, the coordinate data (1-2,1-2) && (3, *) is the section manager or department manager of organization A or organization B, and the users who are enrolled in project A Show.

  FIG. 9 is also an example of a coordinate management table.

  In this example, access control information for service B is represented. The user who has the execution right for the application service B is a user having the coordinates of (1-2, *). In the example of the matrix template in FIG. 5, the user who belongs to the organization A or the organization B become.

  It is (1-2, 1-2) who has the authority to make some approval for the execution result of this service, and the department manager or section manager of organization A or organization B.

Example 1 of access control system configuration. Example 2 of access control system configuration. The functional block diagram of the matrix manager 103 in a present Example. The functional block diagram of the resource management systems 105 and 205 in a present Example. An example of a matrix template. Example 1 of generated matrix. Example 2 of generated matrix. An example 1 of a coordinate data management table. An example 2 of a coordinate data management table.

Claims (3)

Using an access control matrix, for each data or folder, service, an access control method for determining the authority to be given to the user depending on which coordinates on the matrix the user is located on,
The active control matrix means has a means for inquiring the attribute of the user to the directory server based on the request for the coordinate information of the user from the data or folder, the service management means, and the access request from the user,
The active control matrix means includes means for dynamically generating the user access control matrix from a matrix template based on the user attribute information obtained from the directory server.
The active control matrix means includes means for transmitting coordinate information possessed by the user to the active control matrix of the user generated in the data or folder or service management procedure,
The data or folder or service management means has means for managing what authority is granted to a user having which coordinate information for each data or folder or service,
An access control method that makes it possible to determine and control the coordinate information held for each data, folder, or service and the access authority of the user based on the coordinate information sent from the active control matrix means. A control method of an access control system that uses an access control matrix to determine the authority to be given to the user depending on which coordinate on the matrix the user is located for each data or folder, service,
The active control matrix means has a means for inquiring the attribute of the user to the directory server based on the request for the coordinate information of the user from the data or folder, the service management means, and the access request from the user,
The active control matrix means includes means for dynamically generating the user access control matrix from a matrix template based on the user attribute information obtained from the directory server.
The active control matrix means includes means for transmitting coordinate information possessed by the user to the active control matrix of the user generated in the data or folder or service management procedure,
The data or folder or service management means has means for managing what authority is granted to a user having which coordinate information for each data or folder or service,
A control method for an access control system capable of determining and controlling the coordinate information held for each data, folder, or service and the access authority of the user based on the coordinate information sent from the active control matrix means . A control method of an access control system that uses an access control matrix to determine the authority to be given to the user depending on which coordinate on the matrix the user is located for each data or folder, service,
The active control matrix means has a means for inquiring the attribute of the user to the directory server based on the request for the coordinate information of the user from the data or folder, the service management means, and the access request from the user,
The active control matrix means includes means for dynamically generating the user access control matrix from a matrix template based on the user attribute information obtained from the directory server.
The active control matrix means includes means for transmitting coordinate information possessed by the user to the active control matrix of the user generated in the data or folder or service management procedure,
The data or folder or service management means has means for managing what authority is granted to a user having which coordinate information for each data or folder or service,
A control method for an access control system capable of determining and controlling the coordinate information held for each data, folder, or service and the access authority of the user based on the coordinate information sent from the active control matrix means A readable storage medium including:

Images