JP2007087248A - Access controller, access control method, and access control program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To execute sure access control without spoiling convenience to a user in describing policy information. <P>SOLUTION: Conversion tables 40 constituted of concrete policy information describing rules for execution of access control to a resource 200 and abstract policy information describing rules more abstractly than concrete policy information are stored in a conversion table storage part 12 per application 50. A policy information conversion control part 11 references a conversion table 40 corresponding to an application 50 on the basis of abstract policy information inputted through the application 50 to convert the abstract policy information to concrete policy information. An access control execution part 20 executes access control to the resource 200 in accordance with the concrete policy information converted by the policy information conversion control part 11. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an access control apparatus, an access control method, and an access control program that execute access control on resources.

  Conventionally, there are many access control apparatuses that execute access control in the field of security. For example, the access control device stores policy information in which rules for executing access control for resources (software resources, hardware resources) are described, and executes access control for resources according to the policy information. A specific example will be described with reference to Patent Document 1 and Patent Document 2.

  In Patent Document 1, an element management layer for managing devices such as an exchange, a network management layer for managing a network composed of various device groups, and a service management layer for managing various information used when providing a service using the network A hierarchical communication system is disclosed.

  This communication system can convert policy information described from a “user side” viewpoint into policy information corresponding to each layer described from a “service provider side” viewpoint. For this reason, the communication system can execute fine access control in consideration of the “user side” viewpoint.

  In Patent Document 2, both a usage right (policy information) for an application belonging to an application layer and a network access right (policy information) belonging to a network layer are managed. If different from the above, an access control device that converts the setting contents of the network access right into the setting contents of the use right is disclosed.

  This access control device sets the content of the network access right in the network layer to permit / deny in conjunction with the content of the usage right in the application layer being set to permit / deny. In spite of the fact that the use of the application is not permitted, the injustice of starting the application via the network layer can be eliminated.

As described above, Patent Document 1 and Patent Document 2 disclose a technique for converting policy information into other policy information.
JP 2001-43162 A JP 2004-259102 A

  Incidentally, after a request called a system call is issued to the kernel, if the request does not violate the policy information, access control to resources is executed through the kernel. On the other hand, when the request is against the policy information, access control to the resource is not executed.

  In order for such access control to be executed, a user such as an application developer must create specific policy information (hereinafter, specific policy information) describing the contents of the system call. , I had a sense of complexity in creating the policy information.

  On the other hand, it is conceivable to use a technique of converting policy information into other policy information as in Patent Document 1 and Patent Document 2. Specifically, in the initial stage, it is possible to input abstract policy information in which abstract contents are described rather than the contents of the specific policy information. In the access control execution stage, the input abstract policy information is input. A policy conversion technique of converting into specific policy information can be considered. According to this, it is possible to perform reliable access control without impairing the ease with which the user describes policy information.

  However, as the number of applications and the number of execution environments in which the applications can operate increases, the number of combinations in which certain abstract policy information is converted into specific policy information becomes enormous. The number of conversion tables for converting into specific policy information also becomes enormous.

  Therefore, in the policy conversion technique, when a conversion table adapted to all of the application and its execution environment is set, the number of the conversion tables becomes enormous and it is difficult to realize the policy conversion technique.

  Therefore, the present invention has been made in view of the above points, and an access control device capable of performing reliable access control without impairing the convenience of describing policy information by a user, An object is to provide an access control method and an access control program.

  In order to solve the above problems, the first feature of the present invention is that specific policy information in which rules for executing access control to resources are described, and the rules are described more abstractly than the specific policy information. By referring to the conversion table corresponding to the application based on the conversion table storage unit that stores the conversion table configured by the abstract policy information for each application and the abstract policy information input through the application, A gist is provided with a policy information conversion unit that converts abstract policy information into specific policy information, and an access control execution unit that executes access control for resources according to the specific policy information converted by the policy information conversion unit. To do.

  According to such a feature, the access control device refers to the conversion table “only” corresponding to the application being used among the conversion tables stored for each application, and specifies the input abstract policy information. To static policy information.

  That is, the access control device only needs to refer to the conversion table “only” corresponding to the application being used, and it is not necessary to refer to other conversion tables. This eliminates the need to prepare, and can realize reliable access control without impairing the convenience for the user to describe the policy information.

  The second feature of the present invention is that it includes a specific policy information changing unit that changes specific policy information constituting a conversion table corresponding to an application according to the type of execution environment in which the access control device operates. And

  The third feature of the present invention is that correction information for specific policy information is preset, and includes a specific policy information correction unit that changes specific policy information according to the content of the correction information. To do.

  The fourth feature of the present invention is that, when access control for one resource is executed, if a plurality of applications are used simultaneously for access control, the common policy information included in the specific policy information common to the plurality of applications is used. A gist is to use a common variable when a common variable storage unit for storing variables is provided and the access control execution unit executes access control for one resource using a plurality of applications simultaneously.

  A fifth feature of the present invention is summarized as comprising a common variable changing unit that changes a common variable according to the result of access control by the access control execution unit.

  According to the features of the present invention, it is possible to execute reliable access control without impairing the convenience for a user to describe policy information.

(Configuration of access control device)
An access control apparatus according to the present embodiment will be described with reference to the drawings. FIG. 1 is a diagram illustrating an internal configuration of the access control apparatus 100 according to the present embodiment.

  As shown in FIG. 1, the access control apparatus 100 includes a policy information conversion unit 10 and an access control execution unit 20.

  The policy information conversion unit 10 includes a policy information conversion control unit 11, a conversion table storage unit 12, a common variable storage unit 13, and an execution environment information detection unit 14.

  The policy information conversion control unit 11 refers to the conversion table 40 corresponding to the application 50 on the basis of the abstract policy information input via the application 50, thereby abstracting the abstract information input via the application 50. The policy information is converted into specific policy information.

  Here, FIG. 2 shows the relationship between the specific policy information in which the rules for executing access control for the resource 200 are described, and the abstract policy information in which the rules are described more abstractly than the specific policy information. FIG.

  FIG. 3 is a diagram illustrating an example of the contents of abstract policy information and specific policy information. For example, when there is policy information that “if the traffic is 1 Mbps or more, the traffic is suppressed to 800 Mbps”, the abstract policy information for the policy information is, for example, “1” shown in FIG. Content. Further, the specific policy information in which rules more detailed than the abstract policy information are described is, for example, the content “2” shown in FIG.

  As shown in FIGS. 2 and 3, the specific policy information is policy information in which detailed rules for executing access control using a system call or the like are described. Therefore, the user of the access control apparatus 100 If only the specific policy information can be handled, the user has a sense of complexity in creating the policy information. In this embodiment, it is possible to input abstract policy information that is described more abstractly than the specific policy information, so that the user of the access control apparatus 100 eliminates the trouble of describing the policy information. can do.

  The policy information conversion control unit 11 changes the specific policy information constituting the conversion table 40 corresponding to the application 50 in accordance with the type of execution environment in which the access control apparatus 100 operates. The policy information conversion control unit 11 constitutes a specific policy information changing unit.

  The execution environment information includes information on a device on which the access control device 100 operates, for example, software information such as an OS version and a system call sequence, CPU information, and setting conditions for operating resources (Ethernet (registered trademark) type) Hardware information related to information such as

  For example, as illustrated in FIG. 3, when the content of the execution environment is Ethernet (registered trademark) 1 (“eth1 (Ethernet (registered trademark) 1)”), the policy information conversion control unit 11 sets the application 50 to Among the specific policy information constituting the corresponding conversion table 40, “eth1” is set in the portion related to the type of execution environment (see “A” in FIG. 3).

  The policy information conversion control unit 11 changes a common variable, which will be described later, according to the result of access control by the access control execution unit 20. The policy information conversion control unit 11 constitutes a common variable changing unit.

  The conversion table storage unit 12 stores a conversion table 40 composed of abstract policy information and specific policy information for each application 50 (see FIG. 4). As shown in FIG. 4, “before conversion” in the conversion table 40 includes abstract policy information. Specific policy information is included in “after conversion” in the conversion table 40.

  The common variable storage unit 13 is included in the specific policy information corresponding to the plurality of applications 50 when a plurality of applications 50 are simultaneously used for access control when the access control for one resource 200 is executed. It stores the common variables.

  The execution environment information detection unit 14 detects execution environment information 300 indicating the execution environment.

  The access control execution unit 20 operates on the OS 60, and according to the specific policy information converted by the policy information conversion control unit 11, access control (access control using a system call or the like at a mnemonic level) Access control).

  Further, when the access control execution unit 20 executes access control for one resource 200 using a plurality of applications 50 simultaneously, the access control execution unit 20 uses the common variable stored in the common variable storage unit 13 to execute the one resource 200. Execute access control for.

  The policy information correction unit 400 changes the specific policy information converted by the policy information conversion unit 10 according to the content of the correction information for the input specific policy information. The correction information includes policy information for a user who handles the access control device 100, a user such as an application developer, to restrict specific access control. It is assumed that the correction information is preset in the policy information correction unit 400. Policy information correction unit 400 constitutes a specific policy information correction unit.

(Operation of access control device)
Next, the operation of the access control apparatus will be described with reference to the drawings. FIG. 5 is a diagram illustrating the operation of the access control apparatus 100 according to the present embodiment.

  As shown in FIG. 5, in S <b> 101, the application 50 transmits the input abstract policy information to the policy information conversion control unit 11.

  In S <b> 102, the policy information conversion control unit 11 outputs detection instruction information for instructing to detect the execution environment information 300 indicating the execution environment based on the reception of the abstract policy information from the application 50. 14 to send.

  In S103, the execution environment information detection unit 14 detects the execution environment information 300 based on the detection instruction information received from the policy information conversion control unit 11. In S104, the execution environment information 300 is detected by the policy information conversion control unit 11. Send to.

  In step S105, the policy information conversion control unit 11 acquires the conversion table 40 corresponding to the application 50 that is the source of the abstract policy information.

  For example, when the conversion table 40 is included in the application 50, the policy information conversion control unit 11 acquires the conversion table 40 included in the application 50 that is the transmission source of the abstract policy information.

  Alternatively, when the conversion table 40 is stored for each application 50 in the server connected to the network, the policy information conversion control unit 11 sets the conversion table 40 corresponding to the application 50 that is the source of the abstract policy information. Obtain from the server.

  In S106, the policy information conversion control unit 11 selects one of the conversion tables 40 stored in the conversion table storage unit 12 according to the contents of the execution environment information 300 received in S104 (for example, the type of Ethernet (registered trademark)). Set the content of the part.

  For example, as shown in FIG. 4, when the content of the execution environment information 300 is information indicating Ethernet (registered trademark) 1, the policy information conversion control unit 11 sends the abstract policy information transmission source application 50 to the application 50. Among the contents of “after conversion” in the corresponding conversion table 40, “eth1” is set as information indicating Ethernet (registered trademark) 1 in the portion related to the execution environment information 300 (see “A” in FIG. 4). Set.

  Then, the policy information conversion control unit 11 stores the conversion table 40 in the conversion table storage unit 12. When the policy information conversion control unit 11 refers to the same conversion table 40 as the already acquired conversion table 40, the policy information conversion control unit 11 directly refers to the conversion table 40 stored in the conversion table storage unit 12, so that the application 50 or server again. It is not necessary to acquire the conversion table 40 from (not shown), and the time until the conversion table 40 is referred to can be further shortened.

  In S107, the policy information conversion control unit 11 refers to the conversion table 40 stored in the conversion table storage unit 12, and converts the abstract policy information received in S101 into specific policy information.

  For example, when the content of the abstract policy information corresponding to the application 1 being used is “1” shown in FIG. 3, first, the policy information conversion control unit 11 corresponds to the application 1 shown in FIG. Referring to the conversion table 40-1, “if (throughput> 1 Mbps)” as a part of “1” shown in FIG. 3 is changed to “tp = checkIF (“ eth1 ”, TP); IF (tp> 1 Mbps) {F ( )} ". “Tp = checkIF (“ eth1 ”, TP); IF (tp> 1 Mbps) {F ()}” after conversion is part of the specific policy information.

Then, the policy information conversion control unit 11 also uses a process similar to the above as a part of the specific policy information for parts other than “if (throughput> 1 Mbps)” which is a part of “1” shown in FIG. By sequentially converting, the entire abstract policy information (“1” shown in FIG. 3) is converted into specific policy information (“2” shown in FIG. 3).
In S <b> 108, the policy information conversion control unit 11, when the access control for the one resource 200 is executed, if a plurality of applications 50 are simultaneously used for the access control, the policy information conversion control unit 11 corresponds to the plurality of applications 50. Common variables included in the common policy information (specific policy information after conversion) are set in the common variable storage unit 13.

  For example, there is policy information “suppress the communication amount to 800 Mbps when the communication amount is 1 Mbps or more”, and a plurality of applications 50 are used at the same time according to the specific policy information related to the policy information. When the access control for the resource 200 is executed, the policy information conversion control unit 11 sets the common variable included in the specific policy information corresponding to the plurality of applications 50 in the common variable storage unit 13.

  In S109, the policy information conversion control unit 11 transmits the converted specific policy information to the access control execution unit 20.

  In S <b> 110, the access control execution unit 20 executes access control for the resource 200 according to the specific policy information received from the policy information conversion control unit 11.

  In step S <b> 111, the access control execution unit 20 transmits access control execution result information including an access control execution history for the resource 200, changed common variables, and the like to the policy information conversion control unit 11.

  According to such a feature, the access control apparatus 100 refers to the conversion table 40 “only” corresponding to the application 50 being used among the conversion tables 40 stored for each application 50, and the abstract policy Convert information into concrete policy information.

  That is, the access control apparatus 100 only needs to refer to the conversion table 40 “only” corresponding to the application 50 being used, and does not need to refer to any other conversion table. Therefore, it is not necessary to provide the conversion table 40, and it is possible to realize reliable access control without impairing the convenience for the user to describe the policy information.

  Further, when a plurality of applications 50 are simultaneously used for access control when access control for one resource 200 is executed, the access control apparatus 100 is included in the specific policy information in the plurality of applications 50. Set a common variable as a common variable.

  For this reason, the access control device 100 uses the common variable to determine the comprehensiveness based on the plurality of applications 50 even if the abstraction levels of the specific policy information corresponding to each of the plurality of applications 50 executed simultaneously are different. Access control can be performed on one resource 200.

  Next, the operation of the access control apparatus 100 after the access control execution unit 20 transmits the access control execution result information to the policy information conversion control unit 11 in S111 will be described with reference to FIG.

  As illustrated in FIG. 6, in S201, the access control execution unit 20 transmits access control execution result information to the policy information conversion control unit 11. This process is the same as the process of S111 described above.

  In S202, the policy information conversion control unit 11 updates the content of the common variable stored in the common variable storage unit 13 based on the change content of the common variable included in the access control execution result information. To do.

  In S203, the policy information conversion control unit 11 updates specific policy information based on the updated common variable and the like. For example, when the common information used by the plurality of applications 50 is updated, the policy information conversion control unit 11 updates the specific policy information corresponding to each of the plurality of applications 50 using the updated common variable. .

  In S <b> 204, the policy information conversion control unit 11 transmits the updated specific policy information to the access control execution unit 20.

  In S <b> 205, the access control execution unit 20 executes access control for the resource 200 according to the specific policy information received from the policy information conversion control unit 11. When the access control execution unit 20 transmits the access control execution result information to the policy information conversion control unit 11, the access control apparatus 100 repeatedly executes the same processes as in S202 to S205.

  According to this feature, the access control device 100 sequentially changes the common variable according to the result of the access control by the access control execution unit 20, so that the specific policy information corresponding to the plurality of applications 50 that are being executed simultaneously. Therefore, the access control apparatus 100 can execute appropriate access control for one resource 200 in accordance with the changed specific policy information.

  Next, the operation of the access control apparatus 100 when the execution environment is switched as the devices connected to the access control apparatus 100 are switched will be described with reference to FIG.

  As shown in FIG. 7, in S301, the execution environment information detection unit 14 detects that the execution environment has been switched.

  In step S <b> 302, the execution environment information detection unit 14 transmits execution environment information 300 indicating the switched execution environment to the policy information conversion control unit 11.

  In S303, the policy information conversion control unit 11 performs the “after conversion” shown in FIG. 4 in the conversion table 40 stored in the conversion table storage unit 12 based on the execution environment information 300 received from the execution environment information detection unit 14. Among the contents, the execution environment information 300 is set in a portion related to the execution environment information 300 (“A” shown in FIG. 4).

  Since the processing from S304 to S309 is the same as the processing from S106 to S111 described above, detailed description thereof is omitted here.

  According to such a feature, when the execution environment (for example, the type of Ethernet (registered trademark)) is switched and the resource 200 (for example, the resource related to Ethernet (registered trademark)) to be subjected to access control is changed. In this case, the access control apparatus 100 changes the current specific policy information to specific policy information corresponding to the contents of the switched execution environment (for example, a specific information obtained by changing an argument of a system call related to Ethernet (registered trademark)). Policy information).

  For this reason, even if the target resource 200 is changed due to the switching of the execution environment, the access control apparatus 100 changes the specific policy information according to the contents of the execution environment, thereby changing the resource 200 after the change. It is possible to appropriately execute access control for.

  Next, the operation of the access control apparatus 100 when the converted specific policy information is appropriately modified without being used as it is will be described with reference to FIG.

  As shown in FIG. 8, the processing from S401 to S408 is the same as the processing from S101 to S108 shown in FIG. 5 described above, and detailed description thereof will be omitted here.

  In S409, the policy information conversion control unit 11 transmits the converted specific policy information to the policy information correction unit 400.

  In S410, when the correction information corresponding to the specific policy information received from the policy information conversion control unit 11 is set, the policy information correction unit 400 sets the specific policy information according to the content of the correction information. To change.

  In step S <b> 411, the policy information correction unit 400 transmits the changed specific policy information to the policy information conversion control unit 11.

  In step S <b> 412, the policy information conversion control unit 11 transmits the specific policy information received from the policy information correction unit 400 to the access control execution unit 20.

  In S <b> 413, the access control execution unit 20 executes access control for the resource 200 according to the specific policy information received from the policy information conversion control unit 11.

  In S <b> 414, the access control execution unit 20 transmits access control execution result information including the access control execution history for the resource 200 and the changed common variable to the policy information conversion control unit 11.

  According to such a feature, the access control device 100 changes the specific policy information according to the content of the correction information set by a user such as a telecommunications carrier, a service provider, or an application developer who handles the access control device 100. Therefore, the access control apparatus 100 can appropriately execute access control desired by the user.

  The policy information conversion unit 10 in the present embodiment is provided in the access control apparatus 100, but is not limited thereto, and may be provided in a server (not shown) connected to the network. In this case, since the policy information conversion unit 10 is not provided in the access control apparatus 100, the policy information correction unit 400 may be provided in the access control apparatus 100.

  The access control apparatus 100 in this embodiment does not include the policy information correction unit 400, but is not limited thereto, and may include the policy information correction unit 400.

(Access control program)
An access control program that operates in the access control device causes a computer to function as each unit constituting the access control device. The access control program may be recorded on a recording medium. Examples of the recording medium include a hard disk, a flexible disk, a compact disk, an IC chip, and a cassette tape.

  As mentioned above, although an example of the present invention has been described, it is merely a specific example, and the present invention is not particularly limited, and the specific configuration and the like of each part can be appropriately changed in design. In addition, the functions and effects of the embodiments are merely a list of the most preferable functions and effects resulting from the present invention, and the functions and effects of the present invention are not limited to those described in the embodiments.

It is a figure which shows the internal structure of the access control apparatus in embodiment. It is a figure which shows the relationship between the abstract policy information and specific policy information in embodiment. It is a figure which shows the content of the abstract policy information and specific policy information in embodiment. It is a figure which shows the content of the conversion table in embodiment. It is a figure which shows operation | movement of the access control apparatus in embodiment (the 1). It is a figure which shows operation | movement of the access control apparatus in embodiment (the 2). It is a figure which shows operation | movement of the access control apparatus in embodiment (the 3). It is a figure which shows operation | movement of the access control apparatus in embodiment (the 4).

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 ... Policy information conversion part, 11 ... Policy information conversion control part, 12 ... Conversion table storage part, 13 ... Common variable storage part, 14 ... Execution environment information detection part, 20 ... Access control execution part, 40 ... Conversion table, 50 ... Application, 100 ... Access control device, 200 ... Resource, 300 ... Execution environment information, 400 ... Policy information correction unit

Claims (7)

Specific policy information in which rules for executing access control on resources are described, and a conversion table composed of abstract policy information in which the rules are described more abstractly than the specific policy information for each application A conversion table storage unit for storing;
A policy information conversion unit for converting the abstract policy information into the specific policy information by referring to the conversion table corresponding to the application based on the abstract policy information input via the application; ,
An access control execution unit that executes the access control for the resource according to the specific policy information converted by the policy information conversion unit;
An access control device comprising:   2. A specific policy information changing unit that changes the specific policy information constituting the conversion table corresponding to the application according to a type of execution environment in which the access control apparatus operates. The access control device described in 1. Correction information for the specific policy information is preset,
The access control apparatus according to claim 1, further comprising a specific policy information correction unit that changes the specific policy information according to the content of the correction information. When a plurality of applications are simultaneously used for the access control when the access control for one resource is executed, a common variable included in the specific policy information common to the plurality of applications is stored. A common variable storage unit
The access control apparatus according to claim 1, wherein the access control execution unit uses the common variable when executing the access control on the one resource by using the plurality of applications simultaneously. .   The access control apparatus according to claim 4, further comprising a common variable changing unit that changes the common variable according to a result of the access control performed by the access control execution unit. Specific policy information in which rules for executing access control on resources are described, and a conversion table composed of abstract policy information in which the rules are described more abstractly than the specific policy information for each application Memorizing step;
Converting the abstract policy information into the specific policy information by referring to the conversion table corresponding to the application based on the abstract policy information input through the application;
And executing the access control on the resource according to the specific policy information converted by the policy information conversion unit. Computer
Specific policy information in which rules for executing access control on resources are described, and a conversion table composed of abstract policy information in which the rules are described more abstractly than the specific policy information for each application A conversion table storage unit for storing;
A policy information conversion unit for converting the abstract policy information into the specific policy information by referring to the conversion table corresponding to the application based on the abstract policy information input via the application; ,
An access control program that functions as an access control execution unit that executes the access control for the resource according to the specific policy information converted by the policy information conversion unit.

Images