JP2008269625A - Database access control method and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent a malicious access when a proxy agent accesses a database, by simple technique. <P>SOLUTION: An intermediary agent has an access request method which is called out from the proxy agent and cannot be changed from the proxy agent, and receives a database access request from a user to the proxy agent. The intermediary agent generates an access object, sets authentication information not to allow an access from the proxy agent, and transfers the access object to the proxy agent. The proxy agent accesses the database, using the access object received from the intermediary agent. An access result is stored in the access object. The proxy agent acquires the access object, transfers it to the intermediary agent, and the intermediary agent transfers the access result to the user. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a database access control technique, and more particularly to a database access control method and a program therefor when a proxy agent accesses a database as a user's proxy.

  In general, since a plurality of users store data in a database, which user can register, refer to, update, and delete which data is controlled by a database access control mechanism. Hereinafter, registration, reference, update, and deletion of data in the database are collectively referred to as access to the database. For example, in the database access control mechanism, access control is performed so that user B cannot access user A's data and user A cannot access user B's data.

  As a database access control method, conventionally, authentication information such as a user ID and password pair that a user passes to the database is compared with authentication information registered in advance in the database access control mechanism. Permission for access to each data based on the access control list that specifies the user who is trying to access and which data can be accessed for the next specified user There is a method of determining non-permission. This is a method used in many existing databases. In SQL92, which is a language standard for accessing a database, access authority information is added to or deleted from an access control list by a grant statement or a revoke statement. It is stipulated that the access authority to the data is granted to the user and revoked.

  The above access control method is for the case where only the user who stores data in the database accesses the database. On the other hand, as a different form, access to the database may be performed by a proxy agent that accesses the database on behalf of the user instead of the user storing the data. This is done in such a way that the user requests the proxy agent to access the database. This is the case, for example, when the proxy agent provides a function for processing data, and the user has the data stored in the database processed by the proxy agent, and the user receives the processing result. .

  What should be considered when the proxy agent accesses the database on behalf of the user is that the proxy agent must access the database based on the access authority of the client user. For example, when a certain user A requests a proxy agent to access a database, the proxy agent must be controlled so that only data that is permitted to be accessed by the user A can be accessed. That is, in spite of the request from the user A, the proxy agent should not access the data of the user B not authorized by the user A and return the information to the user A. Accessing the database by the proxy agent based on the access authority of the requester's user is called delegation of access authority from the user to the proxy agent.

  The simplest access control method that satisfies the above conditions is that the user passes authentication information such as his / her user ID and password for accessing the database to the proxy agent, and the proxy agent receives the authentication information. There is a method of acquiring the user's data by accessing the database using it.

  Another method is to use digital signature technology or cryptographic communication technology to check whether the user's delegation of access rights to the proxy agent is correct by using a digital certificate, digital signature, encryption, or one-way function. There is what is confirmed by using (see, for example, Patent Document 1 and Patent Document 2).

JP 2001-101054 A JP 2002-163235 A

  However, the method in which the user passes his / her authentication information to the proxy agent and the proxy agent accesses the database using the authentication information is generally a third party entity different from the user. The agent cannot always be trusted. Therefore, for example, when the user A passes authentication information such as a user ID and a password to the proxy agent, the proxy agent holds the authentication information inside and holds it when the user B who is another user accesses it. If the proxy agent does not perform malicious processing such as impersonating the user A using the authentication information that has been stored and allowing the user B to access the data of the user A that should not be permitted The user cannot request processing from the proxy agent.

  In addition, in the method of confirming the delegation of access authority using digital signature technology or cryptographic communication technology, complicated processing such as digital certificate, digital signature, encryption, one-way function, etc. must be performed. There are many steps to exchange key information and authentication information between the proxy agent and the database. In addition, these methods are only related to a method for delegating access authority, and it is not guaranteed that the result of accessing the database based on the delegated access authority is surely returned to the user who is delegating, It is not appropriate for application to proxy agents where users request database access.

  Therefore, an object of the present invention is to provide a mechanism by which a proxy agent cannot access a database maliciously when the proxy agent performs database access on behalf of a user by a simple method.

  The present invention provides a mediation agent function in addition to the proxy agent function in a database access control device in which a proxy agent accesses a database as a user's proxy. The mediation agent is the same as the database access control management entity, and the user can trust the mediation agent.

  The mediation agent receives a database access request from the user to the proxy agent. The mediation agent generates an access object for accessing the database, and passes an access request from the user to the proxy agent and simultaneously passes the generated access object to the proxy agent. The proxy agent accesses the database using the access object received from the mediation agent. The result of accessing the database is stored in the access object. The proxy agent acquires the access object, passes the access object or the access result stored in the access object to the mediation agent, and the mediation agent passes the access result to the user.

  The mediation agent has an access request method that is called from the proxy agent and cannot be changed by the proxy agent, and receives an access request from the user to the proxy agent. This prevents the proxy agent from intercepting the process by creating a method for overriding the access request method of the mediation agent that receives the access request from the user.

  The mediation agent embeds authentication information such as a user ID and password passed from the user to the mediation agent in an access object generated by the mediation agent. By concealing this authentication information so that it cannot be referred to by the proxy agent, the proxy agent cannot access the user authentication information, so the user authentication information cannot be stolen, and the authentication information cannot be stolen. It becomes impossible to access the database by deceiving it as an access from.

  The result of accessing the database is stored in the access object, and the proxy agent cannot directly return the access result stored in the access object to the user, but returns the access result to the mediation agent. Since the access result is returned to the user, it is impossible to return the access result to a user other than the user requested by the proxy agent.

  As a result, the proxy agent can access the database with the access authority of the requested user, and can only return the processing result to the requested user, making it impossible to perform malicious processing. The user can safely request the proxy agent to access his / her data.

  According to the present invention, since the proxy agent cannot access the database with access authority other than the requester's user, and the access result can be returned only to the requester's user, the user can perform a malicious act. Without worrying about this, it is possible to use a database search process and a proxy agent that processes the search result. Thereby, the user can use a proxy agent that performs various useful processes prepared by a third party.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.
FIG. 1 shows a configuration diagram of an entire system to which the present invention is applied. In FIG. 1, 100 is a user terminal device of each user, 200 is a network such as the Internet, 300 is a database access control device according to the present invention, and 400 is a database shared by a plurality of users. The database 400 holds user data, user authentication information registered in advance, and the like. Furthermore, although the database 400 incorporates an access control mechanism, it is omitted in FIG. The database access control apparatus 300 and the database 400 may be either directly connected or connected via a network.

  As will be described later, the database access control apparatus 300 includes a proxy processing unit 310 as a proxy agent function, a mediation processing unit 320 as a mediation agent function, and an access processing unit 330 as an access object function.

  The entity of the database access control apparatus 300 is a computer, and a program as software operates and executes desired processing under the environment of hardware resources such as a CPU and a memory. Here, the database 400 is accessed on behalf of the user, and a process of passing the access result to the user terminal 100 of the corresponding user is executed.

  Hereinafter, an example will be described in which the proxy processing unit 310, the mediation processing unit 320, and the access processing unit 330 of the database access control device 300 are referred to as a proxy agent, a mediation agent, and an access object, respectively, and are implemented as programs in an object-oriented programming language. . The proxy agent 310 is realized as an extended class of the mediation agent 320.

  FIG. 2 shows an example of the entire processing sequence of this embodiment. FIG. 3 shows a processing flow example of the proxy agent 310, and FIG. 4 shows a processing flow example of the mediation agent 320.

  The user requests access to the database 400 by calling an access request method or function (hereinafter abbreviated as a method) from the user terminal device 100 to the proxy agent 310. However, the proxy agent 310 is a class that extends the mediation agent 320, and the method that the user calls is a method in the mediation agent class of the super class, so that the method of the mediation agent 320, not the proxy agent 310, is called as a result. (Procedure 1 in FIG. 2). At that time, the proxy agent 310, which is an extended class, is set so that the method cannot be overridden. For example, in the Java language, add the finalize modifier to the access request method. This prevents the proxy agent 310 from intercepting the process by creating a fake method that overrides the access request method of the mediation agent 320 that receives an access request from the user. Further, when the user calls the method of the mediation agent 320, the search condition and the user authentication information such as the user ID and password are passed by the argument.

  Upon receiving an access request from the user (2001 in FIG. 4), the mediation agent 320 authenticates and identifies the user who requested the access, and holds the authentication information (2002 in FIG. 4). As a method for authenticating and specifying the user, there is a method of using a session ID used in a WWW application. Next, the mediation agent 320 passes the access request from the user to the proxy agent 310 (procedure 2 in FIG. 2, 2003 in FIG. 4). At this time, the mediation agent 320 passes search conditions from the user to the proxy agent 320, but does not pass authentication information.

  By passing the access request from the user from the intermediary agent 320 to the proxy agent 310, the processing of the proxy agent 310 starts. Upon receiving the access request (1001 in FIG. 3), the proxy agent 310 holds the user search conditions (1002 in FIG. 3), and requests the mediation agent 320 to generate an access object for searching the database 400. (Procedure 3 in FIG. 2 and 1003 in FIG. 3). The mediation agent 320 requested to generate the access object generates the access object 330 (2004 and 2005 in FIG. 4) and authentication information (database) such as a user ID and a password for accessing the previously held database. Authentication information) is set in the access object 330 (2006 in FIG. 4). FIG. 5 shows a configuration example of the access object. Initially, the database authentication information and the access result information are NULL. The database authentication information in the access object cannot be referenced from the proxy agent 310. For example, in the case of the Java language, if the scope of the variable that stores the authentication information is set to the default scope without the visibility modifier, and the proxy agent class is set to a different package, the proxy agent class will be changed to the variable that stores the authentication information. Access can be prevented. The mediation agent 320 passes the generated access object 330 to the proxy agent 310 (procedure 4 in FIG. 2, 2007 in FIG. 4).

  Next, the proxy agent 310 that has received the access object 330 from the mediation agent 320 uses the access object 330 to access the database 400 as follows. Upon receiving the access object 330 from the mediation agent 320 (1004 in FIG. 3), the proxy agent 310 sets a search condition or the like in the access object 330 (1005 in FIG. 3), and requests access such as database search or update. (Procedure 5 in FIG. 2, 1006 in FIG. 3). As a method of specifying what kind of access is requested, there are a method of passing an SQL sentence and a method of using a database access method prepared by the access object 330. For example, in the case of FIG. 5, a search condition or the like is set as an argument of the database access method to request access.

  The access object 330 that has received an access request (startup) of the database 400 from the proxy agent 310 connects to the database 400 using the database authentication information held therein and accesses the database 400 (procedure of FIG. 2). 6). The access control mechanism of the database 400 compares the database authentication information passed from the access object 330 with the authentication information registered in advance to identify the user who is trying to access and is permitted to that user. The requested access processing is performed only for the data range, and the access result is returned to the access object 330 (procedure 7 in FIG. 2). The access object 330 that has received the access result from the database 400 stores the access result therein and returns it to the proxy agent 310 (procedure 8 in FIG. 2).

  When the proxy agent 310 receives the access object 330 that has completed the access processing to the database 3400 (1007 in FIG. 3), it returns the access object to the mediation agent 320 (procedure 9, 1008, 1010 in FIG. 3). Further, the proxy agent 310 does not return the received access object 330 to the mediation agent 320 as it is, but takes out the access result stored in the access object, performs processing such as processing, editing, and calculation, and uses the processing result as a result. It is also possible to store it again in the access object 330 and return it to the mediation agent 320 (1008, 1009, 1010 in FIG. 3). Further, the proxy agent 310 may return the access result extracted from the access object 330 or the processing result for the access object 330 instead of returning the access object 330 to the mediating agent 320 as it is. At this point, the processing of the proxy agent 310 ends.

  Upon receiving the access object 330 from the proxy agent 310 (2008 in FIG. 4), the mediation agent 320 returns the received access object or data extracted from the access object to the user terminal 100 of the requesting user ( Procedure 10 in FIG. 2 (2009 in FIG. 4). As a result, the user can obtain the result of accessing the database 400 requested by the proxy agent 310.

  The above-mentioned proxy agent 310 and mediation agent 320 can be realized by using a template method of a design pattern (for example, for example, Hiroshi Yuki “Introduction to Design Patterns Learned in Java Language”, Softbank, pp. 31 “No. (See Chapter 3, Template Method). That is, the mediation agent 320 becomes a super class, and describes a process that becomes a common template, such as a process for authenticating a user, a process for generating an access object 330, and a process for receiving an access result from the proxy agent 310 and returning it to the user. The proxy agent 310 is a subclass and describes specific processing unique to each proxy agent, such as specific search processing for the database 400 and processing for performing desired processing on the access result.

  The access object can be described in a memory, for example, and the proxy agent 310 and the mediation agent 320 can access the memory and perform a predetermined process. In this case, the proxy agent 310 is prevented from accessing the authentication information storage area. In addition, the access processing unit 330 actually accesses the database 400 based on the database access method of the access object as an entity of the access object processing function.

  As described above, a part or all of the processing functions of each unit in the database access control apparatus shown in FIG. 1 can be configured by a computer program, and the program can be executed using the computer to realize the present invention. Alternatively, it is needless to say that the processing procedures shown in FIGS. 2, 3, and 4 can be configured by a computer program and the program can be executed by the computer. In addition, a computer-readable recording medium such as an FD, MO, ROM, memory card, CD, or the like is stored in the computer. In addition, the program can be recorded and stored on a DVD, a removable disk, etc., and the program can be distributed through a network such as the Internet.

It is a block diagram of the whole system to which this invention is applied. It is a processing sequence example by this invention. It is an example of a processing flow of a proxy agent. It is an example of the processing flow of a mediation agent. It is a structural example of an access object.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 User terminal 200 Network 300 Database access control apparatus 310 Proxy processing part (proxy agent)
320 Mediation processing unit (mediation agent)
330 Access processing unit (access object)
400 database

Claims (4)

A database access control method in a database access control apparatus comprising a proxy processing unit connected to a user terminal and accessing a database as a user's proxy, and a mediation processing unit that mediates the proxy processing unit,
The proxy processing unit is a class that extends the mediation processing unit,
Furthermore, the finalize qualifier is attached to the access request method in the mediation processing unit class,
The intermediary processing unit receives an access request from the user terminal, generates an access object for accessing the database, requests the proxy processing unit to access the database, and the proxy Sending the access result or the processing result received from the processing unit to the user terminal,
The proxy processing unit has a step of performing database access using the access object, obtaining an access object in which an access result is stored, and returning the access result or the processing result to the mediation processing unit.
A database access control method. The database access control method according to claim 1,
Set the scope of the variable that stores the database authentication information in the access object to a default corp without a visibility modifier,
Furthermore, the proxy processing part class is set as a different package,
The mediation processing unit further includes setting database authentication information in the access object.
A database access control method. A computer executable program connected to a user terminal and having a proxy processing unit that accesses a database as a user's proxy and a mediation processing unit that mediates the proxy processing unit. ,
The proxy processing unit is a class that extends the mediation processing unit,
Furthermore, the finalize qualifier is attached to the access request method in the mediation processing unit class,
On the computer,
The intermediary processing unit receives an access request from the user terminal, generates an access object for accessing the database, requests the proxy processing unit to access the database, from the proxy processing unit Sending the received access result or processing result to the user terminal;
The proxy processing unit performs database access using the access object, obtains an access object in which an access result is stored, and returns the access result or processing result to the mediation processing unit.
A program for running The program according to claim 3,
Set the scope of the variable that stores the database authentication information in the access object to a default corp without a visibility modifier,
Furthermore, the proxy processing part class is set as a different package,
On the computer,
The mediation processing unit sets database authentication information in the access object;
A program for further execution.

Images