JP2010282242A - Access control system, access control method, and access control program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the following problem of a conventional access control system: an interpretable access policy includes only a definition of conditions related to an access entity/access object/action or the like, and a definition of accessibility, and does not include the definition of a task, so that it is difficult to implement an access policy including the definition of the task. <P>SOLUTION: A monitoring means 105 controls the accessibility to an input/output event transmitted from a virtualizing means 103, and calls out, in addition thereto, a proper task implementation means 107 via a task implementation interface 108, in response to a task implementation instruction from a policy interpretation part 106. The task implementation interface 108 specifies the implementation means 107 to implement the duty, referring to a task management table 1081, in response to an input from the monitoring means 105 such as the input/output event and a task name/parameter. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to an access control system, an access control method, and an access control program. In particular, in access control, in addition to determining whether or not an access request can be made, it can fulfill duties as incidental conditions such as encryption and log recording. The present invention relates to an access control system, an access control method, and an access control program.

  Machine virtualization technology is attracting attention due to needs such as a reduction in power consumption and operation costs of server devices, which are steadily increasing, and centralized management of personal computers (PCs) in enterprises and thin clients. However, due to insufficient security countermeasure techniques for virtual machines, several virtual machine access control systems have been proposed in recent years.

  As an example, there is an access control system described in Patent Document 1. In the system described in Patent Literature 1, a virtual machine classified into two types of “secret” and “general” and a security gateway that monitors and controls communication between both virtual machines are provided on a user terminal. It has been. The security gateway operates so as to allow only data transmission from the general virtual machine to the secret virtual machine, thereby preventing business data handled in the secret virtual machine from leaking to the general virtual machine.

  Also, for the purpose of information leakage prevention and business auditing, measures such as encryption of data input / output at the time of access and log recording at the time of access are required. As an example of an access control system having an IP encryption function in addition to a function for controlling whether to access a virtual machine, there is a secure messaging router (SMR) described in Non-Patent Document 1. However, what is described in the access policy in SMR is a rule relating to whether access is possible, and does not indicate whether encryption is necessary or not, and the access policy is applied to any communication.

  Necessity of measures such as encryption and log recording, and parameter setting (encryption key, etc.) for implementation are inherently accompanied by conditions related to the access subject, the access object, the action, etc., as in the access permission determination. For example, it is required to be able to flexibly define the necessity and combination of countermeasures in consideration of the risks associated with access objects and actions (communication direction, etc.) and the cost of countermeasures. Specifically, for a virtual machine running on an in-house PC or server device, a wide log is recorded for communication outside the company, and encryption is performed for communication in which important information such as affiliated companies is exchanged. It is preferable that the in-house communication can be defined so that neither log recording nor encryption is performed. From the security manager's point of view, access permission / inhibition control is also a type of the above measures, and it is widely performed to actually block communication with a specific Web server outside the company.

  In view of this situation, it is desirable that the access policy can integrally describe the definition of conditions related to the access subject, access object, action, etc., the definition of accessibility, and the definition of countermeasures to be implemented. For example, XACML (eXtensible Access Control Markup Language), which is one of the OASIS standards, has a syntax that allows the definition of measures to be implemented as “Obligation” along with the above-mentioned conditions and accessability definitions. ing.

  An example of an access control system that implements such an integrated access policy is described in Patent Document 2. As shown in FIG. 34, the system described in Patent Document 2 includes a document management server 20 that communicates with the client device 40 and a security management server 10 that communicates with the document management server 20. The document management server 20 accesses the security management server 10 in response to a request from the application 41 in the client device 40. The security management server 10 is equipped with a security management module 11 that manages security functions. The security management module 11 stores subject classification information 111, resource classification information 112, policy 113, and responsibility detailed information 114 as security information. In the document management server 20, the document management module 21 performs log recording as a duty accompanying access from the application 41 to a document stored in the document management server 20. The responsibility content determination module 22 determines the necessity of log recording and the log recording method according to the description of the predetermined policy 113 and issues an instruction to the document management module 21. With such a configuration, for example, the necessity of log recording and the level of detail of recorded contents can be defined and controlled by an access policy according to actions (viewing, printing, erasing, etc.) on a document.

  Note that there is a system described in Patent Document 3 as a system that performs a predetermined determination based on a policy.

Japanese Patent Laying-Open No. 2006-201845 (FIG. 1) JP 2006-134216 A (FIG. 3) JP 2007-156612 A (FIG. 7) Watanabe, Y., et al., “Bridging the Gap Between Inter-communication Boundary and Internal Trusted Components”, Proceedings of ESORICS 2006, Lecture Notes on Computer Science, vol. 4189, pp. 65-80, 2006 (Fig. 3, 72 pages)

  In the access control system for virtual machines described in Patent Document 1 and Non-Patent Document 1, all of the access policies that can be interpreted include only definitions of conditions relating to access subjects, access objects, actions, etc., and definitions of whether access is possible, Since the responsibility definition is not included, it is difficult to implement the access policy including the responsibility definition.

  The document management module 21 described in Patent Document 2 includes means for determining / controlling whether or not document access is possible. Therefore, the security gateway described in Patent Document 1 is provided with log recording execution means. It is conceivable to configure an access control system including the responsibility for the virtual machine by combining with the responsibility content determination module 22. However, with such a configuration, the responsibilities that can be performed are limited to logging.

  Furthermore, even if the SMR described in Non-Patent Document 1 is added, the responsibility content determination module 22 is specialized in responsibility execution instructions regarding log recording, such as the content of the log to be recorded, and therefore differs from log recording. The responsibility execution instruction cannot be generated for the encryption means inside the SMR having the instruction content (encryption key, encryption algorithm, etc.). That is, any combination of responsibilities cannot be implemented.

  Also, virtual machine input / output events obtained from the virtualization means are generally low-level events. Then, in addition to encryption for each IP packet such as SMR, it is difficult to fulfill the responsibility for application data composed of a plurality of input / output events, such as encryption of electronic mail.

  Furthermore, as another problem unique to the access control system for virtual machines, it is required to reduce the amount of resources used by the access control system itself. The challenge is that the virtual machine and the access control system share and use the limited resources of the physical machine that runs both, so generally use as many resources as possible for the virtual machine that runs useful applications. This is due to a request to assign. Accordingly, it is preferable to identify unnecessary means from various means constituting the access control system and delete the specified means in accordance with the contents of definition of the given access policy.

  An object of the present invention is to provide an access control system that can implement an access policy including definition of responsibilities such as encryption of application data and log recording, in addition to whether access is permitted, in the access control system. Another object of the present invention is to provide an access control system capable of automatically distributing a module for executing an obligation in accordance with the definition of the obligation in the access policy.

  The access control system according to the present invention monitors an input / output event, controls access permission / inhibition based on the input / output event, and requests for execution of responsibility, and predetermined access defining conditions for access permission / inhibition and execution of responsibility. A policy interpreting means for interpreting a policy, wherein a policy interpreting means for responding to the monitoring means by determining whether access is permitted and a duty to be executed based on the access policy in response to an inquiry from the monitoring means, and executing a predetermined responsibility In response to a request for the execution of duties from a plurality of responsibility execution means, the responsibility execution means for executing the corresponding responsibility is identified and called from the plurality of responsibility execution means, and the response of the called responsibility execution means is monitored. And a responsibility implementation interface for transferring to the network.

  A terminal device according to the present invention is a terminal device in an access control system that performs access request determination and performs a predetermined responsibility, monitors an input / output event, controls access permission based on the input / output event, and implements the responsibility A monitoring means for making a request and a means for interpreting a predetermined access policy in which conditions relating to accessibility and responsibility implementation are defined. Access to a query from the monitoring means should be permitted and implemented based on the access policy. Policy interpretation means for determining the responsibility and responding to the monitoring means, a plurality of duty execution means for executing the predetermined responsibility, and a duty execution means for executing the corresponding responsibility in response to the duty execution request from the monitoring means Identifies and calls from multiple responsibility execution means and forwards the response of the called responsibility execution means to the monitoring means Characterized by comprising a Tsutomu implementation interface.

  The server device according to the present invention performs virtualization control for relaying an input / output event between a virtual machine and a device, access permission / inhibition based on the input / output event transmitted from the virtualization unit, and execution of responsibility. Monitoring means and means for interpreting a predetermined access policy that defines access permission and conditions related to the implementation of duties. In response to an inquiry from the monitoring means, the access permission and the duty to be executed are determined based on the access policy. Policy interpreting means responding to the monitoring means, a plurality of duty executing means for executing the predetermined duties, and a plurality of duty executing means for executing the corresponding duties in response to the duty request from the monitoring means. A responsibility execution interface for transferring the response of the called responsibility execution means to the monitoring means; A list of responsibilities defined in the policy and a list of registered responsibilities implementation means, delete unnecessary responsibilities implementation means, and computer management means that requests distribution of the missing responsibilities implementation means. A server device communicably connected to a terminal device provided with responsibility management means for storing duty execution means and distributing the duty execution means to the computer management means in response to a request from the computer management means It is characterized by that.

  An access control method according to the present invention monitors an input / output event, controls access permission / inhibition based on the input / output event and performs a duty request, and monitors a predetermined access policy that defines conditions for access permission / impact execution. In response to an inquiry, the responsibility execution process that determines whether access is permitted and the responsibility to be executed is responded, and the corresponding responsibility is executed according to the request for the execution of the responsibility. It is characterized in that the response of the responsibility execution processing that has been identified and executed is forwarded to the duty execution request source.

  The access control program according to the present invention monitors an input / output event transmitted from a virtualization unit that relays an input / output event between a virtual machine and a device, and determines whether or not an access is permitted based on the input / output event. Monitoring means for requesting execution of control and responsibility, and means for interpreting a predetermined access policy that defines the access permission and conditions related to the implementation of responsibility. Access to inquiries from the monitoring means based on the access policy Policy interpretation means that determines propriety and responsibility to be implemented and responds to the monitoring means, multiple responsibility execution means that implement the specified duties, and implements the corresponding duties according to the request for the responsibility from the monitoring means The responsibility execution means to be executed is identified and called from a plurality of responsibility execution means, and the response of the called responsibility execution means is monitored. Wherein the function as work execution interface means for transferring the unit.

  According to the present invention, various access policies such as accessibility / encryption / log recording can be applied to input / output events that occur with application input / output such as e-mail.

1. 1. First Embodiment 1.1 Configuration FIG. 1 is a block diagram showing a configuration of a first embodiment of an access control system. A computer 100A, which is an example of an access control system, includes a central control unit (CPU) 101, a device 102 such as a secondary storage device and a network interface device, a virtualization unit 103 that generates a virtual CPU, a virtual device, and the like, The machine 104, the monitoring means 105, the policy interpretation means 106, one or more responsibility execution means 107-1 to 107-N, and the responsibility execution interface 108 are provided. Hereinafter, the responsibility execution means 107-1 to 107-N are collectively referred to as the responsibility execution means 107.

  The virtual machine 104 corresponds to a virtual machine image such as a virtual device setting file (a file in which a configuration of a virtual device is recorded) and an OS disk image (a disk image in which an OS is installed). The virtualization means 103 constructs a virtual machine environment, and can be realized by, for example, Xen or VMWare (registered trademark). The virtualization unit 103 relays an input / output event between the virtual machine 104 and the device 102.

  The monitoring unit 105 monitors the virtualization unit 103, hooks the input / output between the virtualization unit 103 and the device 102, determines whether access is possible or the responsibility to be performed according to the obtained input / output event (to be performed) The policy interpretation means 106 is inquired about the responsibility. The query is accompanied by the input / output event obtained. Further, when the monitoring means 105 receives a response to the responsibility instruction (responsibility execution instruction) from the policy interpretation means 106, the monitoring means 105 gives a responsibility execution instruction to the responsibility execution interface 108. The responsibility execution instruction is accompanied by parameters and the like. Then, the monitoring unit 105 receives, as a response, the execution result of the responsibility by the responsibility execution unit 107 from the responsibility execution interface 108.

  The policy interpretation unit 106 interprets the policy stored in the primary storage device or the secondary storage device in response to the inquiry from the monitoring unit 105, and determines whether the monitoring unit 105 can access or not. An instruction is returned to the monitoring unit 105.

  Responsibility implementation means 107 executes a predetermined responsibility in response to a call with a call parameter from responsibility execution interface 108, and outputs the execution result to responsibility execution interface 108.

  As shown in FIG. 2, the responsibility execution interface 108 includes an responsibility management table 1081 stored in the primary storage device or the secondary storage device and a buffer 1082 formed in the primary storage device or the secondary storage device. Have. The responsibility execution interface 108 stores the input / output event and parameter list included in the responsibility execution instruction in the buffer 1082 in accordance with the duty execution instruction from the monitoring unit 105, and refers to the responsibility management table 1081 to execute the appropriate duty execution. Invoke means 107. Further, the output (implementation result) of the responsibility execution unit 107 is stored in the buffer 1082, and the stored data is transferred to the monitoring unit 105 as a response.

  The monitoring unit 105, the policy interpretation unit 106, the responsibility execution interface 108, and the responsibility execution unit 107 can be realized by a program for realizing these functions and the CPU 101 that executes control according to the program.

1.2 Overall Operation The overall operation of this embodiment will be described in detail with reference to the sequence diagram of FIG.

  When the virtual machine 104 performs input / output processing, an input / output event occurs between the virtualization unit 103 and the device 102 (step a1). The monitoring unit 105 obtains an input / output event that occurs between the virtual machine 102 and the device 102 from the virtualization unit 103 (step a2), and makes an inquiry to the policy interpretation unit 106 (step a3). The inquiry includes at least a device name and information on whether it is input or output. Further, as additional information, for example, in the case of input / output to / from a network interface card (NIC), information such as an IP address and a port number is added. At this stage, the generated input / output processing is not yet executed.

  When the policy interpreting means 106 receives the inquiry, it interprets the policy held inside and specifies the responsibility to be implemented. That is, it is determined which processing should be performed by which responsibility execution means 107, and a duty execution instruction is issued to the monitoring means 105 (step a4). The responsibility execution instruction is, for example, “encryption responsibility execution means to perform encryption processing”, “log responsibility execution means to perform log recording processing”, or the like. When a plurality of responsibilities are defined in the access policy (see FIGS. 5 and 6), the responsibilities execution instruction is a list (collection) of responsibilities execution instructions corresponding to the calls of the individual responsibility execution means 107. Each responsibility execution instruction includes a parameter list specified by the access policy, an output destination of the execution result of the responsibility, and the like. For example, with respect to the duty execution means 107 for performing encryption, the parameter list includes designation of an encryption key and an encryption algorithm. In addition, when the access policy stipulates that the encrypted data output from the responsibility execution unit 107 is forcibly output to a specific device 102 such as a tamper-resistant device such as an SD memory card that is password-locked. The designation of the output destination device 102 is included in the responsibility execution instruction. A more detailed operation of the policy interpretation means 106 will be described in section 1.3.

  Next, the monitoring means 105 calls the responsibility execution means 107 designated by the duty execution instruction via the duty execution interface 108 and causes the required duty to be executed (step a5). A more detailed operation will be described in section 1.4. The responsibility execution unit 107 performs predetermined responsibility execution processing such as encryption and log recording, and returns the result to the monitoring unit 105 via the duty execution interface 108. The monitoring unit 105 transfers the response of the responsibility execution unit 107 transferred from the responsibility execution interface 108 to the virtualization unit 103 according to the duty execution instruction. When an output event has occurred, the virtualization unit 103 passes information to the device 102 designated by the responsibility execution instruction, and resumes and completes the interrupted output process. If an input event has occurred, information is passed to the virtual machine 104 to resume and complete the interrupted input process (step a6).

1.3 Details of Policy Interpretation 1.3.1 Detailed Operation of Policy Interpreting Unit 106 Next, the policy interpreting operation (step a4 in FIG. 3) executed by the policy interpreting unit 106 will be described using the flowchart of FIG. To do.

  The policy interpretation means 106 first checks whether there is an unprocessed policy. If there is no policy, the process proceeds to step b5 (step b1). If there is an unprocessed policy, the policy (<policy> tag described in section 1.3.2) is read (step b2). Next, the read policy is compared with the inquiry including the input / output event from the monitoring unit 105, and the condition definition of the policy (<target> tag described in section 1.3.2) and the input / output event are determined. It is determined whether or not they match (step b3). If not, the process returns to step b1.

  If the policy condition definition and the input / output event match, the policy interpreter 106 should interpret and implement the policy responsibility definition (<obligations> tag described in section 1.3.2). The responsibility is specified and a duty execution instruction is generated (step b4). If the responsibility execution instruction has already been generated, the responsibility execution instruction generated in step b4 is added.

  The policy interpreting means 106 outputs the responsibility execution instruction to the monitoring means 105 after processing all the policies (step b5).

1.3.2 Access Policy Description Format and Evaluation Method The access policy according to the present invention includes an access permission condition and an obligation to be executed for an input / output event that occurs between the virtual machine 104 and the device 102. Are described as a set of rules. In the example shown in FIG. 5, two access policies (<policy> tag) named “IP encryption” and “USB logging” are described. Conditions related to the access subject (<subject>), access object (<object>), and action (<action>) are defined in the <target> tag, and responsibilities to be implemented are defined in the <obligation> tag. The <rule> tag is a tag that defines whether access is possible. For example, the description <rule effect = “allow”> means that an input / output event that matches the <target> tag is permitted.

[Condition description format]
In the <target> tag, the access subject, access object, and action objects are referred to as constants sbj, obj, and act, respectively. Each object has several attributes. For example, in the IP encryption policy shown in FIG. 5, attributes such as sbj.type, obj.device, and act.name are referenced, and the type attribute of the access subject (user OS, etc.) This means the device attribute of the access object (device type such as NIC or USB storage) and the name attribute of the action.

  The policy interpretation unit 106 sets these attribute values based on the input / output event acquired from the virtualization unit 103 via the monitoring unit 105. For example, when a certain virtual machine 104 sends out an IP packet, the virtualization means 103 determines the virtual machine attributes such as the ID and type of the virtual machine 104, the device attributes such as the type and IP address of the access destination device, and the action name. And attributes related to the direction of information flow such as input and output are included in the input / output event together with the IP packet body. The policy interpretation unit 106 sets various attribute information included in the input / output event in advance to the corresponding object and attribute, and evaluates the <target> tag.

[Responsibility description format]
The <obligations> tag contains one or more responsibility definitions (<obligation>). For example, referring to FIG. 5, the “IP encryption” policy defines two responsibilities: logging and encryption. Each responsibility is preferably performed in the order of description. However, this does not apply to duties with no side effects that do not involve rewriting of input / output events (particularly, input / output data) such as log recording.

In the responsibility definition in each <obligation> tag, a parameter list to be input to the responsibility execution means 107 is described. For example, referring to FIG. 5, the duty definition related to the log recording of the “IP encryption” policy is a set of three parameter names (name) and values (value) of “item.1” to “item.3”. Thus, a system time attribute (System.time), an access object destination IP address attribute (obj.destination_ipaddr), and the like are designated. The policy interpreting means 106 refers to the definitions of these parameter lists, for example,
<obligation function = “logging”>
<parameter name = “item.1”> System.time </ parameter>
<parameter name = “item.2”> sbj.ipaddr </ parameter>
<parameter name = “item.3”> obj.destination_ipaddr </ parameter>
</ obligation>
The following parameter list is generated from the responsibility definition and included in the responsibility execution instruction.

-Item. 1 = 06-20-2007 13:30:38 (System.time value, ie current time)
-Item. 2 = 10.2.3.4 (value of sbj.ipaddr, ie source IP address)
-Item. 3 = 13.3.1.2.3 (value of obj.destination_ipaddr, that is, destination IP address)

  By including the generated parameter list in the responsibility execution instruction, it is possible to input parameters that are dynamically determined such as the current time to the responsibility execution means 107. As illustrated in FIG. 6, the parameter value may be written down in CNAME format so that an immediate value (lateral) of a long parameter value including a line feed may be described.

  Further, when a plurality of responsibilities are described in one policy, a condition corresponding to the processing result of the previous responsibilities may be attached to the responsibilities. For example, referring to FIG. 6, a <condition> tag is included in the "logging" responsibility definition following the "firewall" responsibility definition. The policy interpreting means 106 includes the condition definition described by the <condition> tag as the duty execution condition in the duty execution instruction. By performing such a process, a control structure of multiple responsibilities based on dynamic conditions (for example, a structure in which another responsibilities execution means 107 is called in accordance with the operation state of a certain responsibilities execution means 107) is an access policy. Can be defined. Therefore, the policy descriptive power is further improved.

1.4 Detailed Operation of Responsibility Implementation With reference to the flowchart of FIG. 7, the responsibility implementation operation executed by the monitoring unit 105, the responsibility implementation interface 108, and the responsibility implementation unit 107 will be described.

  The monitoring means 105 that has received the responsibility execution instruction from the policy interpretation means 106 by the process of step a4 in FIG. 3 calls the responsibility execution interface 107 designated by the responsibility execution instruction with the input / output event to the responsibility execution interface 108. Request (step a5-1). Here, the call request information of the responsibility execution means 107 by the monitoring means 105 includes at least the name of the responsibility execution means 107 (responsibility name), a parameter list specified by an instruction from the policy interpretation means 106, and the virtualization means 103. And input / output events obtained from. Further, when the duty execution condition includes the duty execution condition, the monitoring means 106 evaluates the duty execution condition, and calls the responsibility execution means 107 to the responsibility execution interface 108 only when the result is true. Ask.

  The responsibility execution interface 108 calls the responsibility execution means 107 requested by the monitoring means 105 (step a5-2). At this time, the responsibility execution interface 108 first specifies the responsibility execution means 107 corresponding to the responsibility name specified in the call request using the responsibility management table 1081 (see FIG. 8). Then, the input / output event and parameter list included in the call request are stored in the buffer 1082, and the specified responsibility execution unit 107 is called. As shown in FIG. 8, in the responsibility management table 1081, the responsibility name and the data indicating the duty execution means 107 are set in association with each other.

  At this time, preferably, as shown in FIG. 2, a memory area (input queue) for storing a series of input / output events is secured in the buffer 1082, and those addresses are transmitted to the responsibility execution means 107. Then, the duty execution unit 107 can refer to a plurality of input / output events, and can execute the duty such as encryption for the application data. In FIG. 2, “inbuf” indicates that data is transferred from the input queue to the responsibility execution unit 107. For example, when a block cipher is used, a fixed value (for example, 64 bits) is generally determined for the input data length (block length) of the block cipher by an encryption algorithm. On the other hand, the application data length included in the input / output event varies depending on the device. As a result, application data fragments smaller than the block length are likely to occur. In order to process such a data fragment, a sufficient application data size needs to be stored in the input queue after the arrival of a subsequent input / output event.

  Responsibility execution means 107 waits until an input having a size sufficient for the subsequent processing is obtained, so that the data stored in the input queue is sequentially read and added to the internally provided buffer to obtain a fragment. Integrate application data and check the size.

  Thereafter, the responsibility execution means 107 performs predetermined responsibility execution processing such as encryption and log recording in response to a call from the responsibility execution interface 108, and the result is sent to the monitoring means 105 via the responsibility execution interface 108. It responds (step a5-3).

  At this time, the responsibility execution interface 108 stores the responsibility execution result such as encrypted data from the responsibility execution means 107 in the response queue (see FIG. 2) secured in the buffer 1082. In FIG. 2, “outbuf” indicates that data is stored in the response queue from the responsibility execution unit 107. The responsibility execution interface 108 sequentially transfers the stored data in the response queue to the monitoring means 105 asynchronously with the operation of the responsibility execution means 107. By executing such processing, it is allowed that the number of input / output events input to the responsibility execution unit 107 is different from the number of input / output events output by the responsibility execution unit 107. For example, when encrypting mail data, the size of the encrypted data is generally larger than that of the original data. Then, when re-encoding into a lower-level IP packet, the number of IP packets constituting the encrypted data may be larger than the number of IP packets constituting the original data. In this case, rather than rewriting the original input / output event (= IP packet) in the input queue to an input / output event including encrypted data, a method of adding an input / output event including encrypted data to the response queue is taken. Is desirable.

  Then, the monitoring means 105 transfers the response of the responsibility execution means 107 transferred from the responsibility execution interface 108 to the virtualization means 103 according to the duty execution instruction, or for the next call of the responsibility execution means 107 Re-input to the execution interface 108 (step a5-4). At this time, the monitoring means 105 refers to the responsibility execution instruction to determine whether or not there is a next responsibility execution instruction. If there is, the monitoring means 105 replaces the input / output event with the response of the previous responsibility execution means 107 as follows. Input to responsibility execution means 107. When there is no next responsibility execution instruction, that is, when the last responsibility execution instruction is called, the virtualization means 103 is instructed to transfer the response of the responsibility execution means 107 to the output destination specified by the responsibility execution instruction. If the output destination designation is not included in the responsibility execution instruction, the original output destination specified by the virtual machine 104 is treated as being specified in the responsibility execution instruction.

1.5 Addition / Deletion of Responsibility Execution Means When the responsibility execution means is added, the responsibility execution interface 108 specifies the responsibility execution means name (specifically, data that can identify the responsibility execution means name) and the responsibility (specifically, the responsibility execution means name). , Data that can identify responsibilities) and add them to the responsibility management table. For example, when the log responsibility execution means is installed, the responsibility execution means name “log responsibility execution means” and the responsibility in charge “log recording” are added to the responsibility management table. Further, the responsibility execution interface 108 deletes the item of the responsibility execution means from the responsibility management table when the responsibility execution means is deleted.

1.6 Effects In the present embodiment, the responsibility execution interface 108 unifies the responsibility execution procedures performed between the monitoring means 105 and the responsibility execution means 107, so that various responsibility execution processes can be plugged in. it can. Furthermore, in accordance with the responsibility execution instruction from the policy interpretation means 106, the monitoring means 105 calls the responsibility execution means 107 via the responsibility execution interface 108, so that the access permission and the conditions for executing the responsibility are integratedly described. The policy can be applied to the virtual machine 104.

  Also, at this time, the responsibility execution unit 107 holds the input queue and the response queue in the buffer 1082, makes it possible to refer to a plurality of input / output events from the responsibility execution unit 107, and monitors the response of the responsibility execution unit 107 asynchronously. By transferring to 105, it is possible to perform high-level responsibilities such as encryption of application data for low-level input / output events generated by the virtual machine 104.

1.7 Modification 1 of the first embodiment
In the first embodiment, an example is shown in which one virtual machine 104 is provided in the computer 100A. However, a plurality of virtual machines 104-1 to 104-N may be provided as in the computer 100B shown in FIG. Good. In the case of this configuration, the monitoring unit 105 monitors not only the input / output between the virtual machine and the device 102 but also the input / output between the virtual machine and another virtual machine, and the input / output event between the virtual machines. Can be processed. In this case, the access policy includes one set of access permission conditions and obligations to be executed for input / output events occurring between the virtual machines 104-1 to 104-N and the device 102. And an access permission condition and an obligation to be executed are described as a set of rules for an input / output event occurring between the virtual machine and another virtual machine.

1.8 Modification 2 of the first embodiment
In the first embodiment, the responsibility execution unit 107 internally processes the information received from the monitoring unit 105. However, as shown in FIG. 10, the responsibility execution unit 107 performs the process in cooperation with a server that can communicate over a network. You may go. The responsibility execution means cooperation server 500C shown in FIG. 10 is a server that cooperates with the responsibility execution means 107 in the computer 100C. For example, a log recording server that cooperates with the log responsibility execution means or a key management that cooperates with the encryption duty execution means. It is a server.

  In the case of this configuration, for example, the log responsibility execution unit writes the log to the log recording server, so that the log can be confirmed even when the HDD of the computer fails. In addition, the key can be distributed from a remote location by the encryption duty executing means in cooperation with the key management server.

2. Second Embodiment 2.1 Configuration FIG. 11 is a block diagram showing the configuration of a second embodiment of the access control system. In the second embodiment, the management server 200 includes policy management means 201 and responsibility management means 202, and one or more computers 100D-1 to 100D-N include computer management means 109. Different from one embodiment. Hereinafter, the computers 100D-1 to 100D-N may be collectively referred to as a computer 100D.

  The policy management unit 201 stores the policy created by the administrator in a nonvolatile memory (primary storage device) or secondary storage device provided therein. Further, the policy is distributed to the policy interpretation means 106 of the computers 100D-1 to 100D-N that are clients via a network (communication path).

  The responsibility management unit 202 stores the responsibility execution unit 107 in a nonvolatile memory or a secondary storage device provided therein. In response to a request from the computer management means 109 of the computers 100D-1 to 100D-N, the duty execution means 107 is distributed. The computer management unit 109 compares the access policy stored in the policy interpretation unit 106 with the responsibility management table stored in the responsibility execution interface 108 and identifies the excess or deficiency of the responsibility execution unit 107. Also, the insufficient responsibility execution means 107 is downloaded from the responsibility management means 202, and an entry corresponding to the responsibility management table of the responsibility execution interface 108 is additionally registered. Also, the responsibility execution means 107 itself that is no longer necessary is deleted along with the update of the access policy, and the corresponding entry is deleted from the responsibility management table of the responsibility execution interface 108.

2.2 Operation Next, operations of updating, installing, and updating the policy of the responsibility execution unit 107 according to the second embodiment will be described with reference to the flowchart of FIG. Operations other than these are the same as those in the first embodiment, and a description thereof will be omitted.

  First, the policy interpretation unit 106 of the computer 100D checks whether the policy management unit 201 of the management server 200 has a policy addition, deletion, or modification (step c1).

  When there is a policy addition, the policy interpretation unit 106 downloads the added policy from the policy management unit 201 and stores the policy in a nonvolatile memory (primary storage device) or secondary storage device provided therein. To do. When there is a policy deletion, the policy interpretation unit 106 receives an instruction from the policy management unit 201 as to which policy should be deleted, and deletes the instructed policy. In the case of policy modification, an instruction is received from the policy management means 201 as to which policy should be changed, and the instructed policy is modified (step c2).

  Next, the computer management means 109 refers to the policy stored in the policy interpretation means 106 and obtains the necessary responsibility execution means 107 (step c3). For example, in the example shown in FIG. 6, since the firewall record and the log record are described as responsibilities, it is required that firewall responsibilities execution means and log responsibilities execution means are necessary. Specifically, the computer management means 109 scans each responsibility definition (<obligation> tag) of the access policy stored in the policy interpretation means 106, and sets the responsibility name set corresponding to the responsibility execution means 107 that requires installation. Extract DEMANDED.

  When the required responsibility execution means 107 is requested, the computer management means 109 confirms the already installed responsibility execution means 107, and there is a responsibility execution means 107 to be newly installed and an unnecessary responsibility execution means 107. Whether or not is confirmed (step c4). Specifically, first, the computer management means 109 scans each record of the responsibility management table (see FIG. 8) held by the responsibility execution interface 108 to collect a set of responsibility names corresponding to the installed responsibility execution means 107. Get INSTALLED. Then, the computer management means 109 calculates the collective differences TO_BE_INSTALLED and TO_BE_REMOVED between DEMANDED and INSTALLED, and specifies the responsibility execution means 107 to be installed and the responsibility execution means 107 to be deleted. Here, TO_BE_INSTALLED = DEMANDED−INSTALLED and TO_BE_REMOVED = INSTALLED−DEMANDED.

  Thereafter, when there is the responsibility execution means 107 to be newly installed (that is, when TO_BE_INSTALLED is not empty), the responsibility execution means 107 is downloaded from the responsibility management means 202 and installed. Also, it receives update information from the responsibility management means 202, downloads the updated responsibility execution means 107, and updates it. Further, when there is the responsibility execution means 107 to be deleted (that is, when TO_BE_REMOVED is not empty), the unnecessary responsibility execution means 107 is deleted (step c5).

  As described above, the computer management unit 109 downloads the responsibility execution unit 107 from the responsibility management unit 202. However, as shown in FIG. 13, after executing the process of step c2, the responsibility management means 202 obtains the required responsibility execution means 107 from the policy and distributes the responsibility execution means to the computer management means 109. Good. In the example shown in FIG. 13, the computer management means 109 transmits the responsibility management table held in the responsibility execution interface 108 to the responsibility management means 202 after executing the process of step c2 (step c3 ').

  Then, the responsibility management unit 202 refers to the access policy stored in the policy management unit 201, and in the same manner as the processing of step c3 by the computer management unit 109, the responsibility name corresponding to the responsibility execution unit 107 that requires installation. A set DEMANDED is obtained (step c4 ′).

  Thereafter, the responsibility management means 203 obtains a set INSTALLED of responsibility names corresponding to the installed responsibility implementation means 107 from the sent responsibility management table, calculates a set difference TO_BE_INSTALLED and TO_BE_REMOVED between DEMANDED and INSTALLED, and installs them. The responsibility execution means 107 to be deleted and the responsibility execution means 107 to be deleted are specified (step c5 ′).

  When there is the responsibility execution means 107 to be installed or the responsibility execution means 107 to be deleted, the responsibility management means 203 is an installation including information indicating the responsibility execution means 107 corresponding to each element of TO_BE_INSTALLED and the contents of TO_BE_REMOVED. Information is generated and transmitted to the computer management means 109 (step c6 ′). The computer management unit 109 installs the responsibility execution unit 107 included in the installation information, and deletes the responsibility execution unit 107 specified by TO_BE_REMOVED (step c7 ').

2.3 Effects In this embodiment, the computer management unit 109 ensures that only the responsibility execution unit 107 that is required to be executed by the access policy is stored in the computers 100C-1 to 100C-N. That is, it is possible to reduce unnecessary resource consumption for holding the duty execution unit 107 that is no longer necessary due to an access policy update or the like. In addition, since the responsibility management unit 202 automatically distributes the insufficient responsibility execution unit 107, the operation load on the administrator of the computers 100D-1 to 100D-N can be reduced.

3. Third Embodiment 3.1 Configuration FIG. 14 is a block diagram illustrating a configuration of a third embodiment of an access control system. In this embodiment, the computer 100E, which is an example of an access control system, includes an attribute extraction interface unit 110 and attribute extraction units 111-1 to 111-N in addition to the configuration in the first embodiment or the second embodiment. I have. The attribute extraction interface unit 110 and the attribute extraction units 111-1 to 111 -N can be realized by a program for realizing these functions and the CPU 101 that executes control according to the program. Further, the attribute extraction units 111-1 to 111 -N may be collectively referred to as the attribute extraction unit 111.

  As shown in FIG. 15, the attribute extraction interface unit 110 is formed in the attribute extraction unit management table 1101 stored in the primary storage device or the secondary storage device, and the primary storage device or the secondary storage device. And a buffer 1102. The attribute extraction means management table 1101 describes attribute extraction means names associated with function names. The attribute extraction interface unit 110 refers to the attribute extraction unit management table 1101 and calls one of the appropriate attribute extraction units 111-1 to 111 -N according to the attribute extraction request input from the policy interpretation unit 106. . The response data of the attribute extraction units 111-1 to 111 -N is stored in the buffer 1102, and then the data is sequentially transferred to the policy interpretation unit 106.

  The attribute extraction units 111-1 to 111 -N receive input / output events and other parameter lists from the attribute extraction interface unit 110, and from the input / output events, attributes such as access subjects and objects necessary for determining access policy conditions are obtained. Extract and respond. For example, when the attribute extracting unit is an SMTP mail attribute extracting unit, the SMTP packet is analyzed to extract information about the mail destination, the sender, and the presence / absence of an attached file.

3.2 Operation The condition determination operation of the policy interpretation unit 106 in the computer 100E in the third embodiment is different from the condition determination operation (step b3 in FIG. 4) of the policy interpretation unit 106 in the first embodiment or the second embodiment. . Hereinafter, the condition determination operation of the policy interpretation unit 106 in this embodiment will be described in detail with reference to FIG.

  In the present embodiment, the policy interpretation unit 106 refers to the condition definition (<target> tag) defined in the access policy read in the previous stage, and sets each conditional clause including a binary comparison operator such as “==”. The following steps are repeated while extracting and referring to each conditional clause (step f1).

  First, it is determined whether or not there is a function call in the conditional clause (step f2). Here, the function call is, for example, “IsSmtpRecipient (“ taro@xxx.com ”,“ jiro@yyy.com ”,... com ”,“ jiro@yyy.com ”, etc.). The policy interpretation unit 106 determines whether or not a description according to the syntax appears in the conditional clause by a syntax analysis process for the access policy.

  When a function call is not included in the conditional clause, the true / false value of the conditional clause is calculated by referring to the attribute value of the object as in the process of step b3 in the first embodiment or the second embodiment ( Step f3), returning to step f1.

  When a function call is included, the policy interpretation unit 106 inputs a function name, a parameter list, an input / output event, and the like to the attribute extraction interface 110 and inquires about attribute information. The attribute extraction interface 110 scans the attribute extraction unit management table 1101 based on the function name, specifies the corresponding attribute extraction units 111-1 to 111-N, and calls them (step f4). At this time, as shown in FIG. 15, the attribute extraction interface 110 secures a memory area (input queue) for storing a series of input / output events in the buffer 1102, and transmits those addresses to the attribute extraction unit 111. .

  Thereafter, the called attribute extraction unit 111-1 to 111 -N performs an attribute extraction operation for extracting an attribute from the input / output event while referring to the input queue or parameter list of the attribute extraction interface 110, and the extracted attribute value Is stored in the response queue of the attribute extraction interface 110 (step f5).

  Through the above processing, the attribute extraction unit 111 can refer to a plurality of input / output events, and can extract attribute values from the contents of application data. For example, the mail destination attribute may appear across a plurality of IP packets (= input / output event at the time of mail transmission). In such a case, the attribute extraction unit 111 that extracts the mail destination attribute can correctly extract the mail destination attribute by referring to the input queue that stores a plurality of IP packet sequences.

  Then, the attribute extraction interface 108 transfers the attribute value stored in the response queue to the policy interpretation unit 106, and the policy interpretation unit 106 determines the true / false value of the conditional clause currently being evaluated using the attribute value ( Step f3).

  After completing the evaluation of all the conditional clauses, the policy interpreting means 106 performs the processing of step b4 and step b5 of the policy interpreting means 106 in the first embodiment or the second embodiment based on the truth value of the entire conditional statement. The duty execution instruction is generated by the same processing as that described above, and is output to the monitoring unit 105.

  In step f5, the attribute extraction unit 111-1 to 111-N issues an “INPROC exception” indicating that extraction is not possible when the input / output event sequence necessary for attribute extraction is not stored in the input queue ( Step f6). In this case, the INPROC determination is output to the monitoring unit 105 as a special determination value of the access policy, and the subsequent processing is interrupted (step f7). In this case, the monitoring unit 105 waits for the next input / output event without transferring or blocking the currently referenced input / output event to the virtualization unit 103.

  FIG. 17 is a block diagram showing a configuration of a computer 100F in which the responsibility execution interface 108 and the responsibility execution means 107 in the first and second embodiments are explicitly provided for the computer 100E shown in FIG. FIG. In the configuration shown in FIG. 17, when the monitoring means 105 receives a response to the responsibility execution instruction from the policy interpretation means 106, the monitoring means 105 calls the responsibility execution means 107 designated by the responsibility execution instruction accompanying the input / output event to the responsibility execution interface 108. Request. The responsibility execution interface 108 calls the responsibility execution means 107 requested by the monitoring means 105. Responsibility execution means 107 performs predetermined responsibility execution processing in response to a call from responsibility execution interface 108, and returns the result to monitoring means 105 via responsibility execution interface 108.

3.3 Effects In this embodiment, the attribute extraction unit 111 can be plugged in by the attribute extraction interface 110, so that it is possible to cope with attribute extraction (for example, mail destination information) unique to a new application. It becomes easy. In addition, conditions based on application-specific attributes can be described in the access policy, and the expressiveness of the policy that can be implemented is further improved.

  As described above, in the above embodiment, the access control system according to the first embodiment receives an input / output event transmitted from the virtualization unit 103 that relays an input / output event to the device 102 by the virtual machine 104. Identification / calling of the monitoring means 105 for controlling the permission / denial of the output event, the policy interpretation means 106 for interpreting the access policy, the responsibility execution means 107 for executing the responsibility specified in the access policy, and the responsibility execution means 108 And a responsibility execution interface 109 for performing.

  Each time the monitoring unit 105 receives an input / output event from the virtualization unit 103, the monitoring unit 105 inquires the policy interpretation unit 106 about a control method for the input / output event. The policy interpreter 106 compares a predetermined access policy with the event information included in the query (what virtual machine inputs or outputs what data to which device), interprets the matching policy unit, and inputs the policy unit. An obligation execution instruction including the determination of accessibility to the output event, the name of the obligation to be executed, parameters at the time of execution, and the like is generated, and the obligation execution instruction is returned to the monitoring unit 105.

  In accordance with the duty execution instruction, the monitoring unit 105 relays or blocks the input / output event to the virtualization unit 103 to control access, and to start the execution of the duty requested by the instruction. The output event and the name / parameter of the responsibility are input to the responsibility execution interface 108.

  Responsibility implementation interface 108 refers to responsibility management table 1081 in response to input from monitoring means 105 such as input / output events and responsibility names / parameters, and identifies responsibility input means 107 that should execute the responsibility. After calling the appropriate responsibility execution unit 107 with the output event or parameter, the response is transferred to the monitoring unit 105. When calling the responsibility execution means 107, the responsibility execution interface 108 adds an input / output event to a queue configured in the buffer 1082 provided therein, and causes the responsibility execution means 107 to refer to the contents of the queue.

  Responsibility implementation means 107 performs predetermined operations such as encryption and log in accordance with input / output events and parameters, and returns the result to responsibility implementation interface 108. For example, in the case of the responsibility execution means 107 for encryption, parameters such as input / output data, encryption key, and encryption algorithm designation are received from the monitoring means 105 as parameters, and the designated encryption algorithm and encryption key are used. The input / output data is encrypted, and the encrypted data is returned to the responsibility execution interface 108.

  By adopting such a configuration and unifying the responsibility execution procedures performed between the monitoring means 105 and the responsibility execution means 107 in the responsibility execution interface 108, various responsibility execution processes can be plugged in. it can. Further, by configuring the monitoring means 105 to call the responsibility execution means 107 via the responsibility execution interface 108 in accordance with the responsibility execution instruction from the policy interpretation means 106, the access policy and the conditions for executing the duties are integrated into the access policy. It is possible to describe and apply it automatically. In addition, the responsibility implementation interface 108 includes a buffer 1082 so that a plurality of input / output events can be referred to from the responsibility implementation means 107. For example, the responsibility implementation interface 108 is configured not by an IP packet alone but by an IP packet sequence constituting a series of SMTP Enforcement of application data composed of multiple input / output events, such as encrypting only mail data to be sent.

  In the first embodiment, various accesses such as accessibility / encryption / log recording, etc. for virtual machine input / output generated by application input / output such as e-mail without depending on a specific user OS. Policies can be enforced consistently. The reason is that the policy interpreting means 106 generates an obligation execution instruction by interpreting an access policy in which actions to be performed such as encryption and log recording are added in addition to the access permission rule, and the monitoring means 105 is responsible for This is because the responsibility execution means 107 for executing an appropriate responsibility is called through the responsibility execution interface 108 in accordance with the execution instruction.

  Also, the responsibility such as encryption can be applied not only to low-level input / output data such as IP packets but also to a part of a series of input / output data such as mail data. The reason is that the responsibility execution interface 108 includes a buffer 1082, and a plurality of input / output events can be referred to from the responsibility execution means 107.

  The access control system according to the second embodiment includes a computer management unit 109 in addition to the configuration of the access control system according to the first embodiment. The computer management unit 109 compares the access policy stored in the policy interpreting unit 106 with the list of the responsibility execution unit 107 connected to the responsibility execution interface 108, and determines the responsibility execution unit 107 necessary for applying the access policy. A set is specified, and unnecessary responsibility execution means 107 is deleted, or missing responsibility execution means 107 is added.

  Since the computer management unit 109 is configured to automatically add / delete the responsibility execution unit 107, it is possible to automatically distribute a module for performing the responsibility according to the definition of the responsibility in the access policy. The second object of the present invention can be achieved.

  Further, in a computer configuration in which a finite physical storage resource is shared by the virtual machine 104 and the platform software including the duty execution unit 107, the storage resource used by the platform software can be minimized. The reason is that the management server 200 that manages the access policy implemented in the computers 100D-1 to 100D-N uses the duty management means 202 and the computer management means 109 to handle the duty corresponding to the duty defined in the access policy. The execution unit 107 is automatically installed in the computers 100D-1 to 100D-N, and the responsibility execution unit 107 that is not defined in the policy is automatically deleted from the computer 100, whereby the computers 100D-1 to 100D-N This is because it is assured that the minimum requirement implementation means 107 is provided.

  The access control system according to each of the above embodiments includes the virtualization unit 103 that relays an input / output event between the virtual machine 104 and the device 102, and the monitoring unit 105 receives the input from the virtualization unit 103. Although it was configured to control whether access is possible and to request responsibility based on the output event, the monitoring means inputs events that are input to the physical machine (actual machine) and outputs that are output from the actual machine. The present invention can also be applied to monitoring events.

4). Fourth Embodiment In the third embodiment, the attribute extraction unit 111 that extracts an attribute from input / output data generated by the virtual machine 104 and the attribute extraction method by the attribute extraction unit 111 have been described. Instead, information on the situation related to the position or time related to the access control system (specifically, computer etc.) generated independently of input / output data such as the terminal position and the current time (hereinafter referred to as context information). .) May be extracted.

4.1 Configuration FIG. 18 is a block diagram showing a configuration of the fourth embodiment of the access control system. In the present embodiment, the computer 100J, which is an example of an access control system, replaces the attribute extraction means 111-1 to 111-N in the computer 100E in the third embodiment shown in FIG. Context information extraction means 112-1 to 112 -N for providing context information such as time to the policy interpretation means 106 are provided. The context information extracting means 112-1 to 112-N may be collectively referred to as the context information extracting means 112. The computer 100J preferably also includes attribute extracting means 111-1 to attribute extracting means 111-N shown in FIG. In that case, the effects of the third embodiment can also be obtained. The configuration of the attribute extraction interface 110 is the same as that in the third embodiment, but in this embodiment, the attribute associated with the function name in the attribute extraction unit management table 1101 (see FIG. 15). Instead of the extraction means name, the context information extraction means name is described.

  As shown in FIG. 19, the context information extraction unit 112 includes a state storage unit 1121 that stores the latest state of the context information, and an event issue unit 1122 that notifies the change of the context information.

  The state storage unit 1121 includes a nonvolatile memory, a secondary storage device, and the like, and stores the latest state of context information. Then, the state of the context information is updated in accordance with the change notification from the event issuing unit 1122. The event issuing means 1122 includes a wireless tag device that performs communication with a radio frequency identification (RFID), a sensor device such as a GPS (Global Positioning System) device, a wireless access point detection device, an altime clock device, and the like. The state storage unit 1121 is notified that the state or the like has changed.

4.2 Operation The operation of the access control system according to the fourth embodiment is performed by calling the attribute extraction unit 111 by the attribute extraction interface 110 and the attribute extraction operation of the attribute extraction unit 111 (steps f4 to f7 in FIG. 16). ) Is replaced by the call of the context information extraction unit 112 by the attribute extraction interface 110 and the context information extraction operation (steps j1 to j5 in FIG. 20) by the context information extraction unit 112, and the operation of the third embodiment. Is different. Hereinafter, the context information extraction operation of the policy interpretation unit 106 in this embodiment will be described in detail with reference to the flowchart of FIG. 20 and an explanatory diagram showing an example of the access policy of FIG.

  First, the policy interpreting means 106 calls a function in a conditional clause in the same manner as the policy interpreting means 106 in the third embodiment while sequentially referring to the conditional clause (<condition> tag) of the access policy (step f1) (FIG. 21). In the example shown in FIG. 5, it is confirmed whether TerminalLocation () or the like is included (step f2).

  When a function call is included in the conditional clause, the policy interpretation unit 106 outputs a context information extraction request including at least a function name and a parameter list to the attribute extraction interface 110. The attribute extraction interface 110 scans the attribute extraction unit management table 1101 based on the function name, specifies the corresponding context information extraction unit 112, and calls it (step j1).

  The context information extraction unit 112 called in the process of step j1 refers to the storage contents of the state storage unit 1121 and acquires the latest context information (step j2). Then, the context information is output to the policy interpretation unit 106 via the attribute extraction interface 110 (step j3). Thereafter, the policy interpretation unit 106 makes a condition determination using the input context information (step f3). In the present embodiment, the policy interpretation unit 106 determines whether access is permitted and the responsibility to be implemented according to the situation (context) detected by the context information extraction unit 112.

  Note that the context information extraction unit 112 updates the context information independently of the above-described context information extraction operation (steps j4 and j5). Specifically, when the event issuing unit 1122 detects a change in context information such as sensor information and time information, the state storage unit 1121 is notified of the changed sensor information and time information (step j4). Then, the state storage unit 1121 updates the past context information to the latest information with the information included in the notification from the event issuing unit 1122 (step j5).

4.3 Effects The access control system according to the present embodiment can always realize access control based on the latest position information, sensor information, and time information by the operations of steps j4 and j5 by the context information extraction unit 112, so that sales operations and maintenance can be performed. When carrying the computer 100J for business or the like, it is possible to prevent an information leakage accident caused by inappropriate Internet access while moving.

  In addition, by executing the operation of step j1, it becomes possible to define an access policy that describes a conditional statement combining arbitrary context information, and the use of the computer 100J is restricted to a specific time and a specific office. It is possible to prevent leakage of important data of the dispatched company that frequently occurs in maintenance work.

5). Fifth Embodiment In the fourth embodiment, the context information generated independently of the input / output data is extracted. However, the timing for executing the responsibility is controlled based on the change of the context information. Also good.

5.1 Configuration FIG. 22 is a block diagram showing a configuration of the fifth embodiment of the access control system. In the present embodiment, a computer 100K, which is an example of an access control system, includes responsibility execution means 107 and a responsibility execution interface 108 in addition to the configuration of the computer 100J in the fourth embodiment.

  As in the case of the fourth embodiment, a context information extraction request is input to the attribute extraction interface 110 from the policy interpretation unit 106. Further, in the present embodiment, the attribute extraction interface 110 outputs a context information change notification to the responsibility execution interface 108 when the context information extraction unit 112 detects a change in context information. The context information change notification includes the name of the context information and the latest context information after the change.

  In addition to the configuration in the first embodiment or the second embodiment, the responsibility execution interface 108 includes responsibility execution standby means 1083 including a nonvolatile memory and a secondary storage device. The responsibility execution interface 108 registers the responsibility execution instruction in the responsibility execution standby unit 1083 when the “responsibility execution condition” is included in the responsibility execution instruction input from the monitoring unit 105. When a context information change notification is received from the context information extraction unit 112 that matches the duty execution condition via the attribute extraction interface 110, the duty execution unit 107 corresponding to the duty execution instruction is called, and the duty execution unit 107 Is output to the monitoring means 105.

5.2 Operation FIG. 23 is a flowchart showing the overall operation of the fifth embodiment. Referring to FIG. 23, in the access control system of this embodiment, before the responsibility execution interface 108 in the access control system of the first embodiment calls the responsibility execution means 107 to execute the processing (step a5) for executing the responsibility. The responsibility execution interface 108 is different from the first embodiment in that the responsibility execution interface 108 executes a process of waiting for the duty execution process (step k1) and a process of waiting for a change notification of context information from the attribute extraction interface 110 (step k2). .

First, the monitoring means 105 outputs a duty execution instruction to the duty execution interface 108 through the operations from steps a1 to a4. The responsibility implementation instruction corresponds to the responsibility definition of the access policy as follows. The following responsibility definition is to delete all files under the "/ secret" directory when the content information extraction means 112 receives an SSID (Service Set Identifier) other than "SSID_companyA" from a nearby wireless access point. Means.
<obligation function ＝ ”RemoveFiles”>
<condition> TerminalLocation! = “SSID_companyA” </ condition>
<parameter name = “filename” value = ”/ secret / *” />
</ obligation>

  In response to the responsibility execution instruction including the “responsibility implementation condition” described in the <condition> tag, the responsibility execution interface 108 inputs the responsibility execution instruction to the responsibility execution standby unit 1083 and temporarily performs the subsequent processing. Interrupt. Responsibility execution standby means 1083 is a process in step k1, and displays the responsibility name (LogUpload) included in the responsibility execution instruction and the conditional expression (TerminalLocation! = “SSID_companyA”) in the non-volatile memory or the secondary storage device. Register in a table (not shown).

  Thereafter, the attribute extraction interface 110 receives the context information name (for example, TerminalLocation) and the latest information after the change every time there is a change notification of the context information from any context information extraction means 112 connected to the attribute extraction interface 110. The change notification including the pair with the context information (SSID_CompanyB) is transferred to the responsibility implementation interface 108. The responsibility execution interface 108 that has received the change notification scans the standby table of the duty execution standby means 1083, extracts the conditional expression (TerminalLocation! = “SSID_companyA”) including the name of the context information, and obtains the context information (SSID_CompanyB). To evaluate the truth value of the conditional expression (step k2).

  Only when the conditional expression is true, the responsibility execution interface 108 calls the responsibility execution means 107 corresponding to the responsibility name (RemoveFiles) (step a5).

5.3 Effects Based on the configuration and operation described above, the access control system according to the present embodiment performs duties according to changes in context information. Specifically, the duty execution interface 108 controls the timing at which the duty execution unit 107 executes the duty. Therefore, various access policies can be realized. For example, in the above example, when the computer location is other than CompanyA, that is, when the computer is taken out from the office of CompanyA, the file stored in the predetermined directory (/ secret /) can be deleted. A thorough access policy that prohibits the file from being taken out becomes possible.

  The access control system of the fifth embodiment shown in FIG. 22 is different from the access control system of the first embodiment shown in FIG. 1 in that an attribute extraction interface 110 and context information extraction means 112 for extracting context information are provided. The attribute extraction interface 110 related to context information extraction is incorporated into the access control system of the modification of the first embodiment, the access control system of the second embodiment, or the access control system of the third embodiment. And the context information extracting means 112 may be incorporated.

  An embodiment of the access control system according to the present invention will be described with reference to FIG.

(1) Configuration As shown in FIG. 24, in this embodiment, the computer 100G-1 has a mail destination attribute extraction unit 111G-1 as an attribute extraction unit and a mail encryption duty execution unit 107G-1 as a duty execution unit. And the computer 100G-2 includes mail decryption responsibility execution means 107G-2 as duty execution means.

  The mail destination attribute extraction unit 111G-1 receives the SMTP packet input from the policy interpretation unit 106-1, extracts a list of mail destination addresses, and returns the list to the policy interpretation unit 106-1.

  The mail encryption responsibility execution unit 107G-1 receives the key for encryption from the key management server 500G, encrypts the mail delivered from the monitoring unit 105-1, and monitors the encrypted mail. Responsibility implementation means to return to 1.

  The mail decryption responsibility execution unit 107G-2 receives the key for decryption from the key management server 500G, decrypts the mail delivered from the monitoring unit 105-2, and returns the decrypted mail to the monitoring unit 105-2 Implementation means.

  The key management server 500G distributes the key to the mail encryption duty execution means 107G-1 and the mail decryption duty execution means 107G-2. The key management server 500G may perform authentication before key distribution and limit computers to which keys are distributed. For example, by using SSL client authentication, a malicious third party can be prevented from improperly acquiring a key.

  The mail transmission server 300 is a conventionally used SMTP server, accepts an SMTP mail transmission request from the computer 100G-1, and transfers the mail to the mail reception server 400.

  The mail receiving server 400 is a conventionally used POP server, receives mail from the mail sending server 300, and stores the mail in a secondary storage device provided therein. Further, the stored mail is transmitted in response to the mail reception request by the POP from the computer 100G-2.

  The CPUs 101-1 and 101-2 are the same as the CPU 101 shown in FIG. 1, and the NICs 102-1 and 102-2 are NICs as examples of the device 101 shown in FIG. 1. is there. The virtualization units 103-1 and 103-2 correspond to the virtualization unit 103 shown in FIG. 1, respectively. The virtual machines 104-1 and 104-2 are respectively virtual machines shown in FIG. 1. This corresponds to 104. The monitoring means 105-1 and 105-2 correspond to the monitoring means 105 shown in FIG. 1, respectively. The policy interpretation means 106-1 and 106-2 are respectively policy interpretation means shown in FIG. 106. Responsibility implementation interfaces 108-1 and 108-2 correspond to the responsibility implementation interface 108 shown in FIG. 1. The attribute extraction interface 110-1 corresponds to the attribute extraction interface 110 shown in FIG.

(2) Usage Scene In this embodiment, the computer 100G-1 is used by a user taro from xxx, and the computer 100G-2 is used by a user jiro from yyy. In addition, taro and jiro are members belonging to the xxx-yyy cooperation project such as software joint development, and taro assumes a case where e-mail is sent to jiro or xxx company.

  The key management server 500G may be installed at a third party site such as an Internet service provider (ISP). In this embodiment, the key management server 500G is installed at the xxx company site, and the xxx-yyy linkage project is performed by the security administrator of the xxx company. Suppose that a key (K <xxx, yyy>) for use and a key for exclusive use within the company (K <xxx>) are generated and managed.

  In addition, the mail sending server 300 is operated at the xxx company site, and the mail receiving server 400 is operated at the yyy company site. It is assumed that transmission / reception is also performed.

(2.1) Policy Description Example In this embodiment, the policy illustrated in FIG. 25 is set in the policy interpretation means 106-1 of the computer 100G-1 in order to encrypt the outgoing mail by taro.

In addition,
“Mail to Prj <xxx, yyy>” policy: When the port number of the IP packet transmitted by the virtual machine 104-1 is SMTP, “jiro@yyy.com” “proj-ml@xxx.com”・ Allow access when only one of the above is included. However, the mail data is encrypted with the xxx-yyy linkage project key by the mail encryption duty executing means 107G-1.
“Mail to @ xxx.com” policy: When the port number of the IP packet transmitted by the virtual machine 104-1 is SMTP, access is permitted. However, the mail data is encrypted with the xxx company key by the mail encryption duty execution means 107G-1.

Further, in order for jiro to decrypt the mail from taro, the policy illustrated in FIG. 26 is set in the policy interpretation unit 106-2 of the computer 100G-2. This example policy has the following meaning.
“Mail retrieval” policy: When the port number of the IP packet transmitted by the virtual machine 104G-1 is POP, access is permitted. However, the mail data is decrypted with the xxx-yyy cooperation project key by the mail decryption responsibility execution means 107G-2.

(3) Operation An operation example of the access control system when mail transmission / reception is performed between the computer 100G-1 and the computer 100G-2 according to the above policy will be described. Hereinafter, a mail transmission operation by the computer 100G-1 and a mail reception operation by the computer 100G-2 will be respectively shown.

(3.1) Mail Sending Operation FIG. 27 is a flowchart showing a mail sending operation by the computer 100G-1, the mail sending server 300, and the key management server 500G.

  When an SMTP mail transmission request is issued from the virtual machine 104-1 in the computer 100G-1, a series of IP packets constituting the mail transmission request (hereinafter referred to as an SMTP packet series for convenience) is virtual. The monitoring means 105-1 is reached via the conversion means 103-1 (step d1).

  The monitoring unit 105-1 sequentially inputs the IP packets included in the SMTP packet series to the policy interpretation unit 106-1, and inquires about the duty execution instruction (step d2).

  Since the port number of the IP packet included in the inquiry is SMTP, the policy interpreting means 106-1 sends the IP packet to the mail destination attribute extracting means via the attribute extracting interface 110-1 according to the access policy shown in FIG. Input to 111G-1. The mail destination attribute extracting unit 111G-1 extracts the recipient's mail address list as the receiver attribute (step d3).

  Here, as described in RFC-2821, SMTP designates the recipient's mail address one by one with an RCPT command. In addition, the MAIL command including only the sender's mail address must precede the RCPT command. Therefore, the mail destination attribute extracting unit 111G-1 may not be able to extract the recipient attribute from only the first packet of the SMTP packet series. At this time, as described in section 3.2, the mail destination attribute extraction unit 111G-1 issues an exception signal, the attribute extraction interface 110-1 holds the IP packet in the input queue, and the subsequent RCPT command To buffer everything. Further, when the policy interpreting means 106-1 issues an INPROC determination as an access permission determination result, the monitoring means 105-1 temporarily waits for the transfer of the IP packet to the responsibility implementation interface 108-1. By such an operation, the mail destination attribute extracting unit 111G-1 can extract all the recipient attributes from the SMTP packet series. As a result, it is possible to correctly determine the condition regarding the recipient's mail address, and it is possible to ensure proper access permission determination and duty implementation according to the access policy.

  The monitoring unit 105-1 that has received the INPROC determination preferably generates a pseudo response packet such as a TCP ACK packet and inputs the pseudo response packet to the virtual machine 104-1, and prompts transmission of the subsequent SMTP packet sequence.

  After the mail destination attribute extraction unit 111G-1 completes the extraction of the recipient attribute, the policy interpretation unit 106-1 resumes the evaluation of the access policy, responds with an ALLOW determination as an access permission determination, and performs mail encryption. Such a duty execution instruction is generated and issued to the monitoring means 105-1 (step d4).

  Upon receiving the duty execution instruction related to mail encryption, the monitoring unit 105-1 receives the SMTP packet series, the encryption key parameter (Prj <xxx, yyy>), and the encryption algorithm parameter (AES), and the duty execution interface 108. -1 is input to the mail encryption responsibility execution means 107G-1 and called (step d5).

  The called mail encryption responsibility implementation means 107G-1 inputs the group name “Prj <xxx, yyy>” designated as the parameter relating to the encryption key to the key management server 500G, and xxx-yyy linkage project key K_prj < Get xxx, yyy>. Further, the mail data included in the SMTP packet sequence (strictly, the IP packet sequence following the DATA command) is encrypted using AES, which is the encryption algorithm specified by the encryption key and the parameter (step d6). . At this time, it is desirable to encrypt only the body part or attached file of the mail data.

  Thereafter, IP packets included in the SMTP packet series output by the mail encryption responsibility execution unit 107G-1 are sequentially transmitted via the responsibility execution interface 108-1, the monitoring unit 105-1, and the virtualization unit 103-1. It is transmitted to the server 300 (step d7).

  The mail transmission server 300 transfers the encrypted mail to the mail reception server 400 corresponding to jiro@yyy.com specified by the RCPT command (step d8).

  By the above operation, the mail addressed to jiro@yyy.com from taro@xxx.com is appropriately encrypted with the xxx-yyy linkage project key K_prj <xxx, yyy> as specified in the access policy.

(3.2) Mail Receiving Operation FIG. 28 is a flowchart showing mail receiving operation by the computer 100G-2.

  When the virtual machine 104-2 in the computer 100G-2 transmits a POP mail reception request to the mail reception server 400D, a series of IP packets constituting the mail reception request (referred to as a POP packet series for convenience). ) Reaches the monitoring means 105-2 via the virtualization means 103-2 (step e1). The monitoring unit 105-2 sequentially inputs the IP packets included in the POP packet series to the policy interpretation unit 106-2, and makes an inquiry regarding access permission determination and duty execution instruction (step e2).

  At this time, since the port number of the IP packet included in the inquiry is POP, the policy interpreting means 106-2 responds with an ALLOW determination according to the access policy shown in FIG. Is generated and issued to the monitoring means 105-2 (step e3).

  After that, the monitoring means 105-2 performs the mail decryption duty through the duty implementation interface 108-2 for the POP packet series, the encryption key parameter (Prj <xxx, yyy>), and the encryption algorithm parameter (AES). Input to the means 107G-2 and call it (step e4).

  The called mail decryption responsibility execution means 107G-2 inputs the group name “Prj <xxx, yyy>” designated as the parameter relating to the encryption key to the key management server 500G, and the xxx-yyy linkage project key K <xxx , yyy>. Further, the mail data included in the POP packet sequence (strictly, the sequence of IP packets responding to the RETR command) is decrypted using AES, which is the encryption algorithm specified by the encryption key and the parameter (step e5). At this time, it is desirable to decrypt only the body part or attached file of the mail data.

  Thereafter, the IP packets included in the POP packet series output by the mail decryption responsibility execution unit 107G-2 are sequentially transferred to the virtual machine 104 via the responsibility execution interface 108-2, the monitoring unit 105-2, and the virtualization unit 103-2. -2 (step e6).

  By the above operation, the mail addressed from taro@xxx.com to jiro@yyy.com is appropriately decrypted with the xxx-yyy linkage project key K <xxx, yyy> as defined in the access policy.

(4) Effect As described above, by the mail encryption and mail decryption processing in cooperation with the virtualization means 103-1 and the virtualization means 103-2 included in the computers 100G-1 and 100G-2, (a) the user OS And the protection of mail data that does not depend on the mail application, and (b) the effect that the existing server can be used without the need to newly install the mail sending server 300 or the mail receiving server 400 for each cooperation project between companies. Is obtained.

  Furthermore, since the mail encryption key and the mail decryption key for each group can be specified in the access policy, the mail data can be surely protected. For example, if an email containing addresses other than “jiro@yyy.com” or “proj-ml@xxx.com” such as “suzuki@xxx.com” is sent from the computer 100G-1, the “Mail to joint project” policy Instead, it conforms to the “Mail to@xxx.com” policy, so the company-specific key K <xxx> is applied to mail encryption. This leads to the effect of preventing leakage of confidential documents in xxx if you accidentally add “jiro@yyy.com” when sending an email containing confidential documents of xxx company. . This is because the “Mail retrieval” policy set in the computer 100G-2 used by jiro@yyy.com does not include the designation of the internal decryption key K <xxx>.

  In addition, by adding the responsibility definition regarding log recording to the “Mail to joint project” and “Mail retrieval” policies, it is possible to selectively record the mail transmission / reception log in the cooperation project. In such a case, a higher leakage prevention effect can be obtained, for example, in an outside ordering operation with a high risk of information leakage.

  The first embodiment relates to control of network I / O, but the present invention can also be applied to control of storage I / O such as a hard disk and a USB memory. The storage I / O control method in the first embodiment will be described below using a specific example.

(1) Configuration Referring to FIG. 29, in the configuration of the computer 100A in the first embodiment, the computer 100H in the present example performs the file encryption duty execution means 107H-1 and the file decryption duty execution as the duty execution means 107. Means 107H-2, and file system analysis means 1071H which is a sub-module common to those duty implementation means. The device 102 includes at least a storage device 102H such as a hard disk device or a USB memory device.

  The file encryption responsibility execution unit 107H-1 responds to the I / O event via the file system analysis unit 1071H while reading the I / O event in the input queue in response to the call from the responsibility execution interface 108. Get file information. In addition, file data composed of an I / O event sequence is encrypted from the responsibility implementation interface 108 using an encryption key or encryption algorithm specified as a parameter, and stored in an output queue.

  The file decryption responsibility execution unit 107H-2 reads a file corresponding to the I / O event via the file system analysis unit 1071H while reading the I / O event in the input queue in response to the call from the responsibility execution interface 108. Get information. In addition, using the encryption key and encryption algorithm specified as parameters from the responsibility implementation interface 108, the file data composed of the I / O event series is decrypted and stored in the output queue.

  The file system analysis unit 1071H scans and identifies the storage device 102H based on the I / O event input from the file encryption duty execution unit 107H-1 or the file decryption duty execution unit 107H-2. The file information corresponding to the event is returned.

(2) Operation Hereinafter, operations at the time of file writing and reading by the virtual machine 104 in the computer 100H in this embodiment will be described. As shown in FIG. 30, it is assumed that an access policy in which a file encryption duty and a file decryption duty are defined is given to a write event and a read event for the storage device 102H.

(2.1) Operation at the time of file writing As the file F is written, the virtual machine 104 issues a series of write events to the storage device 102H (corresponding to the processing of step a1 in FIG. 3). Normally, such a write event includes a position (sector number) on the storage device 102H and a data fragment of the file F as shown in FIG. Thereafter, each write event is transmitted to the monitoring unit 105 via the virtualization unit 103 (corresponding to the process of step a2 in FIG. 3), and further transmitted to the policy interpreting unit 106 (process of step a3 in FIG. 3). Equivalent).

  The policy interpretation unit 106 compares the write event with the access policy, and specifies the file encryption duty (File Encryption) as the duty to be executed. Then, it generates a responsibility execution instruction and responds to the monitoring unit 105 (corresponding to the process of step a4 in FIG. 3).

  In accordance with the responsibility execution instruction, the monitoring means 105 inputs the parameter list described in the write event and the responsibility execution instruction to the responsibility execution interface 108 and calls the file encryption responsibility execution means 107H-1 to execute the responsibility ( This corresponds to step a5 in FIG. 3).

  FIG. 32 is a flowchart showing the operation of the file encryption responsibility execution unit 107H-1. The file encryption responsibility execution unit 107H-1 reads the write event from the input queue of the responsibility execution interface 108 (step g1), inputs the read write event to the file system analysis unit 1071H, and acquires the corresponding file information. (Step g2).

  In the process of step g2, the file system analysis unit 1071H searches the file allocation table (FAT) and directory entry in the storage device 102H, and extracts the file information of the file F including the file name and the like. Normally, the FAT holds a list of sector numbers in which files are recorded for each file. Therefore, the file system analysis unit 1071H can specify the head sector number of the corresponding file by searching the list using the sector number included in the write event as a key. In the directory entry, a head sector number is recorded together with file information such as a file name. Therefore, the file system analysis unit 1071H can acquire the file information of the file F corresponding to the write event by searching the directory entry using the head sector number as a key. Further, the file system analysis unit 1071H includes a list of corresponding sector numbers in the FAT in the file information for subsequent processing.

  The file encryption duty execution unit 107H-1 secures a buffer for the file F in the buffer area in the duty execution interface 108 based on the acquired file information, and the data fragment of the file F included in the write event is stored in the buffer area. Is stored (step g3). Since the order of the data fragments in the file F can be calculated by referring to the list of sector numbers in the file information, the file encryption responsibility execution unit 107H-1 stores the write event according to the calculated order.

  In this way, after all of the series of write events are stored in the file F buffer, the file encryption responsibility execution unit 107H-1 scans the write events in the file F buffer in order from the top, The file data fragment included in the write event is replaced with the file data fragment encrypted using the encryption algorithm and encryption key specified in the parameter list (step g4).

  Then, the file encryption responsibility execution unit 107H-1 outputs each writing event stored in the file F buffer to the output queue of the responsibility execution interface 108 (step g5). Thereafter, the encrypted write event in the output queue is transmitted to the storage device 102F via the responsibility execution interface 108, the monitoring unit 105, and the virtualization unit 103 (step g6).

  Through the above operation, the file F ′ obtained by encrypting the file F is stored in the storage device 102H.

(2.2) Operation at the time of reading a file As the file F is read, the virtual machine 104 issues a series of read events to the storage device 102H (corresponding to the processing at step a1 in FIG. 3). Thereafter, the file decryption duty (File Decryption) is specified by the process corresponding to the process of step a4 in FIG. 3, and the file decryption duty execution means 107H-2 is called by the process corresponding to the process of step a5 in FIG. This is the same as the operation at the time of file writing, except that the read event decoded by the process corresponding to the process of step a6 in FIG. 3 is transmitted to the virtual machine 104. However, at the time of reading the file, in the process of step g4 (see FIG. 32), the file decryption duty implementation means 107H-2 uses the encryption algorithm and encryption key specified in the parameter list as the file data fragment contained in the file F buffer. And replace with the decrypted file data fragment.

  Through the processing described above, the file F ′ stored in the storage device 102 </ b> H is read to the virtual machine 104 as a decrypted file F.

(3) Effect With the above configuration and operation, the file on the storage device 102H can be encrypted and decrypted without depending on the OS or application running on the virtual machine 104. By providing the buffer for the file F, the responsibility execution interface 108 accumulates a series of write events and read events that occur for each data fragment of the file in the buffer, and the data encryption of the entire file F is performed. This is because the reference can be made from the means 107H-1 and the file decryption duty implementation means 107H-2.

  Also, encryption and decryption for network I / O as in the first embodiment and encryption and decryption for storage I / O as in the second embodiment can be realized simultaneously. The responsibility execution interface 108 does not distinguish between responsibility execution means for performing encryption and decryption for network I / O and responsibility execution means for performing encryption and decryption for storage I / O, through the input queue and the output queue. This is because the calling operation of the unified responsibility execution means is performed.

  FIG. 33 is a block diagram showing the configuration of the third embodiment of the access control system. The third example is an example of the fourth embodiment shown in FIG.

(1) Configuration As shown in FIG. 33, the computer 100J includes SSID extraction means 112J as the context information extraction means 112 in the fourth embodiment. The SSID extraction unit 112J includes a wireless access point detection device 1122J as the event issuing unit 1122 in the fourth embodiment.

  Further, it is assumed that the access policy shown in FIG. In the access policy shown in FIG. 21, the NIC or virtual machine 104 is configured only when the SSID (Service Set Identifier) received by the computer 100J from the wireless access point 700 near the location of the computer 100J is “SSID_CompanyA”. It is described that access to the USB device is permitted.

(2) Operation When the virtual machine 104 accesses the NIC or USB device, the policy interpretation unit 106 sequentially refers to the <condition> tag in the <conditions> tag in the process of step f1 (see FIG. 20), and the step A function call “TerminalLocation ()” is detected in the process of f2.

  Next, when the policy interpretation unit 106 inputs a context information extraction request with the function name “TerminalLocation” and an empty parameter list to the attribute extraction interface 110 in the process of step j1, the attribute extraction interface 110 performs attribute extraction. By scanning the means management table 1101, it is specified that the context information extraction means 112 corresponding to the context information extraction request is the SSID extraction means 112J.

  Thereafter, in step j2, the SSID extraction unit 112J acquires the SSID stored in the state storage unit 1121. In step j3, the acquired SSID is output to the policy interpretation means 106 via the attribute extraction interface 110.

  The wireless access point detection device 1122J detects the SSID from the wireless access point 700 that exists in the vicinity of the computer 100J. If there is a change in the SSID, the SSID extraction unit 112J notifies the state storage unit 1121 of information indicating that the SSID has changed in the process of step j4.

  When the state storage unit 1121 receives the notification that the SSID has changed to “SSID_ComapanyA” from the SSID extraction unit 112J in the process of step j5, the state storage unit 1121 stores “SSID_ComapanyA” after the change as the latest state. As described above, the SSID extraction unit 112J outputs “SSID_ComapanyA” in the processes of steps j2 and j3.

(3) Effect In this embodiment, the policy interpreter 106 makes a condition determination using context information including information on whether or not the SSID “SSID_CompanyA” has been detected from the wireless access point 700 in the vicinity of the computer 100J. It can be performed. Then, access to the NIC or USB device by the virtual machine 104 can be prohibited. Therefore, network access from the virtual machine 104 can be restricted using an SSID that is generally limited within an office. As a result, it is possible to prevent leakage of arbitrary information created by the virtual machine 104 when the computer 100J is taken out of the office.

  In the present embodiment, detection of the terminal position (computer position) by the wireless access point 700 is taken as an example, but in addition, entry / exit of the office using the context information extraction means 112 having a wireless tag device and a GPS device. Even if a method of detecting the passage state of the gate and latitude / longitude information is used, the effect of restricting access outside the office can be obtained.

  Further, as the event issuing means 1122, a context information extracting means 112 having a clock device (not shown) such as a real-time clock device is used, and a function name (for example, CurrentTime) corresponding to the context information extracting means 112 in the access policy is used. By describing ()) with a <condition> tag, it becomes possible to describe an access policy with the current time as a condition and to perform access control according to the description.

  Furthermore, by using the context information extraction unit 112 having a real-time clock device as the event issuing unit 1122, the important data access in the virtual machine 104 can be limited to working hours.

  The present invention can be applied to a personal computer or a server device having an access control function in a collaborative project between companies or a plurality of companies. Further, the present invention can be applied to a use in which a remote security service is provided by the Internet provider managing the access policy of the customer's personal computer collectively.

It is a block diagram which shows the structure of 1st Embodiment of this invention. It is a block diagram which shows the internal structure of a responsibility implementation interface. It is a flowchart which shows the whole operation | movement of 1st Embodiment of this invention. It is a flowchart which shows operation | movement of a policy interpretation means. It is explanatory drawing which shows an example of an access policy. It is explanatory drawing which shows another example of an access policy. It is a flowchart which shows operation | movement of the responsibility implementation interface in this invention. It is explanatory drawing which shows an example of the responsibility management table | surface. It is a block diagram which shows the modification of 1st Embodiment of this invention. It is a block diagram which shows the other modification of 1st Embodiment of this invention. It is a block diagram which shows the structure of 2nd Embodiment of this invention. It is a flowchart which shows the operation | movement of the update of the access policy by the policy management means in the 2nd Embodiment of this invention, duty management means, policy interpretation means, and computer management means, and the update of duty execution means. It is a flowchart which shows the other operation | movement of the update of the access policy by the policy management means, the responsibility management means, the policy interpretation means, and the computer management means and the update of the responsibility implementation means. It is a block diagram which shows the structure of 3rd Embodiment of this invention. It is a block diagram which shows the internal structure of the attribute extraction interface in 3rd Embodiment of this invention. It is a flowchart which shows the conditional sentence determination operation | movement by the policy interpretation means in 3rd Embodiment of this invention. It is a block diagram which shows the other structural example of 3rd Embodiment of this invention. It is a block diagram which shows the structure of 4th Embodiment of this invention. It is a block diagram which shows the structural example of a context information extraction means. It is a flowchart which shows the conditional sentence determination operation | movement by the policy interpretation means in 4th Embodiment of this invention. It is explanatory drawing which shows the other example of an access policy. It is a block diagram which shows the structure of 5th Embodiment of this invention. It is a flowchart which shows the whole operation | movement of 5th Embodiment of this invention. It is a block diagram which shows the whole structure in 1st Example of this invention. It is explanatory drawing which shows an example of the mail transmission policy in 1st Example. It is explanatory drawing which shows an example of the mail reception policy in 1st Example. It is a flowchart which shows the whole operation | movement which concerns on the mail transmission from the computer in 1st Example. It is a flowchart which shows the whole operation | movement which concerns on the mail reception by the computer in 1st Example. It is a block diagram which shows the structure of the computer in 2nd Example of this invention. It is explanatory drawing which shows an example of the access policy in 2nd Example. It is a conceptual diagram which shows the relationship between the file and write-out event in 2nd Example. It is a flowchart which shows operation | movement of the file encryption duty implementation means in 2nd Example. It is a block diagram which shows the structure of the computer in 3rd Example of this invention. It is a block diagram which shows the structure of the access control system described in patent document 2.

Explanation of symbols

100A, 100B, 100C, 100D-1 to 100D-N, 100E, 100F, 100G-1, 100G-2, 100H Computer 101, 101-1, 101-2 Central processing unit (CPU)
102 device 102-1, 102-2 NIC
103, 103-1, 103-2 Virtualization means 104, 104-1, 104-2 Virtual machines 105, 105-1, 105-2 Monitoring means 106, 106-1, 106-2 Policy interpretation means 107 Duty execution means 107G-1 Mail encryption duty execution means 107G-2 Mail decryption duty execution means 107H-1 File encryption duty execution means 107H-2 File decryption duty execution means 1071H File system analysis means 108 Duty execution interface 1081 Duty management table 1082 Buffer 109 Computer management means 110 Attribute extraction interface 1101 Attribute extraction means management table 1102 Buffer 111 Attribute extraction means 112 Context information extraction means 1121 State storage means 1122 Event issuing means 112J SSID extraction means 1 22J wireless access point detection unit 200 management server 201 the policy management unit 202 responsible management unit 500C work execution means linking server 500G key management server 700 the wireless access point

Claims (27)

Monitoring means for monitoring input / output events, controlling access based on input / output events and requesting implementation of responsibilities;
A means for interpreting a predetermined access policy that defines conditions relating to access permission and execution of responsibilities, and in response to an inquiry from the monitoring means, determines whether access is permitted and responsibilities to be executed based on the access policy. Policy interpretation means responsive to the monitoring means;
A plurality of means for carrying out predetermined responsibilities,
Responsibility for identifying and calling responsibility execution means for executing the corresponding responsibility from the plurality of responsibility execution means and transferring a response of the called responsibility execution means to the monitoring means in response to the duty execution request from the monitoring means An access control system comprising an implementation interface. It has virtualization means to relay input / output events between virtual machines and devices,
The access control system according to claim 1, wherein the monitoring unit performs access permission control and responsibility execution request based on an input / output event transmitted from the virtualization unit. With multiple virtual machines,
The access control system according to claim 2, wherein the monitoring unit also monitors an input / output event between the virtual machine and another virtual machine. The responsibility implementation interface is
Including a responsibility management table in which data capable of identifying the responsibility implementation means name and data capable of identifying the responsibility in charge are set;
The access control according to any one of claims 1 to 3, wherein, according to a duty execution request from the monitoring means, the duty execution means for executing the corresponding duty is specified based on the duty management table. system. Responsibility management means for storing responsibility execution means and distributing responsibility execution means upon request;
Compare the list of responsibilities defined in the access policy with the list of registered responsibility implementation means, delete unnecessary responsibility implementation means, and request the responsibility management means to distribute the missing responsibility implementation means The access control system according to claim 1, further comprising computer management means. The access according to any one of claims 1 to 5, further comprising a responsibility execution means cooperation server that is communicable with the duty execution means via a network and that performs the duty in cooperation with the duty execution means. Control system. A plurality of attribute extraction means for extracting attribute information necessary for access policy condition determination from input / output events;
Attribute extraction for identifying and calling attribute extraction means for performing extraction processing of corresponding attribute information from the plurality of attribute extraction means in response to an inquiry of attribute information, and transferring a response of the called attribute extraction means to the policy interpretation means With an interface,
The policy interpretation means passes an input / output event to the attribute extraction interface and inquires about attribute information regarding the input / output event in order to determine whether access is possible and the responsibility to be executed in response to the inquiry from the monitoring means. The access control system according to any one of claims 1 to 6. Virtualization means for relaying I / O events between the virtual machine and the device;
Monitoring means for controlling access permission and requesting execution of responsibility based on an input / output event transmitted from the virtualization means;
A plurality of attribute extraction means for extracting attribute information necessary for access policy condition determination from input / output events;
Attribute extraction for identifying and calling attribute extraction means for performing extraction processing of corresponding attribute information from the plurality of attribute extraction means in response to an inquiry of attribute information, and transferring a response of the called attribute extraction means to the policy interpretation means Interface,
Means for interpreting a predetermined access policy, and in response to an inquiry from the monitoring means, an input / output event is passed to the attribute extraction interface and an input / output is performed in order to determine whether access is permitted and the responsibility to be implemented. An access control system comprising policy interpretation means for inquiring about attribute information related to events. It is equipped with status detection means for detecting the location status or time status of the access control system,
The access control system according to any one of claims 1 to 8, wherein the policy interpreting unit determines whether access is permitted and a duty to be performed according to a situation detected by the situation detecting unit. The access control system according to claim 9, further comprising duty execution time management means for controlling a timing of executing the duty in accordance with a situation detected by the situation detection means. A terminal device in an access control system that performs access request determination and predetermined responsibility,
Monitoring means for monitoring input / output events, controlling access based on input / output events and requesting implementation of responsibilities;
A means for interpreting a predetermined access policy that defines conditions relating to access permission and execution of responsibilities, and in response to an inquiry from the monitoring means, determines whether access is permitted and responsibilities to be executed based on the access policy. Policy interpretation means responsive to the monitoring means;
A plurality of means for carrying out predetermined responsibilities,
Responsibility for identifying and calling responsibility execution means for executing the corresponding responsibility from the plurality of responsibility execution means and transferring a response of the called responsibility execution means to the monitoring means in response to the duty execution request from the monitoring means A terminal device comprising an implementation interface. It has virtualization means to relay input / output events between virtual machines and devices,
The terminal device according to claim 11, wherein the monitoring unit performs access permission control and a duty execution request based on an input / output event transmitted from the virtualization unit. Compare the list of responsibilities defined in the access policy with the list of registered responsibilities implementation means, delete unnecessary responsibilities implementation means, and remove the missing responsibilities implementation means from the device that distributes the responsibility implementation means. The terminal device according to claim 11, further comprising computer management means for downloading. A plurality of attribute extraction means for extracting attribute information necessary for access policy condition determination from input / output events;
Attribute extraction for identifying and calling attribute extraction means for performing extraction processing of corresponding attribute information from the plurality of attribute extraction means in response to an inquiry of attribute information, and transferring a response of the called attribute extraction means to the policy interpretation means With an interface,
In response to the inquiry from the monitoring means, the policy interpreting means passes an input / output event to the attribute extraction interface and inquires about attribute information related to the input / output event in order to determine the accessibility and the responsibility to be executed. The terminal device according to any one of claims 11 to 13. A terminal device in an access control system that performs access request determination and predetermined responsibility,
Virtualization means for relaying I / O events between the virtual machine and the device;
Monitoring means for controlling access permission and requesting execution of responsibility based on an input / output event transmitted from the virtualization means;
A plurality of attribute extraction means for extracting attribute information necessary for judging the condition of the access policy;
Attribute extraction for identifying and calling attribute extraction means for performing extraction processing of corresponding attribute information from the plurality of attribute extraction means in response to an inquiry of attribute information, and transferring a response of the called attribute extraction means to the policy interpretation means Interface,
Means for interpreting a predetermined access policy, and in response to an inquiry from the monitoring means, an input / output event is passed to the attribute extraction interface and an input / output is performed in order to determine whether access is permitted and the responsibility to be implemented. A terminal device comprising policy interpreting means for inquiring attribute information related to an event. It is equipped with status detection means for detecting the location status or time status of the access control system,
The terminal device according to any one of claims 11 to 15, wherein the policy interpreting unit determines whether access is permitted and a duty to be implemented according to a situation detected by the situation detecting unit. The terminal device according to claim 16, further comprising duty execution time management means for controlling a timing of executing the duty according to a situation detected by the situation detection means. A virtualization unit that relays an input / output event between the virtual machine and the device; a monitoring unit that performs control of accessibility and requests for execution of duties based on the input / output event transmitted from the virtualization unit; And a means for interpreting a predetermined access policy that defines conditions relating to the execution of duties, and in response to an inquiry from the monitoring means, whether access is permitted and duties to be executed are determined based on the access policy, and the monitoring means Responsible policy interpretation means, a plurality of duty execution means for executing a predetermined duty, and a duty execution means for executing the corresponding duty in response to a request for execution of the duty from the monitoring means from the plurality of duty execution means. A responsibility execution interface for identifying and calling and transferring the response of the called responsibility execution means to the monitoring means; Compare the list of responsibilities defined in the access policy with the list of registered responsibilities implementation means, delete unnecessary responsibilities implementation means, and request computer management means to request distribution of the missing responsibilities implementation means. A server device communicably connected to the terminal device provided,
A server apparatus comprising: responsibility management means for storing responsibility execution means and distributing the duty execution means to the computer management means in response to a request from the computer management means. Monitors I / O events, monitors access based on I / O events, and requests responsibility execution,
A means for interpreting a predetermined access policy that defines the conditions for accessibility and the implementation of responsibilities, and responds to inquiries by determining accessibility and responsibilities to be enforced,
In response to a request for the execution of a responsibility, the responsibility execution process for implementing the corresponding responsibility is identified and executed from a plurality of responsibility execution processes, and the response of the executed responsibility execution process is transferred to the requester of the responsibility execution. Access control method. 20. The access control method according to claim 19, wherein access permission control and responsibility execution are requested based on an input / output event transmitted from a virtualization unit that relays an input / output event between a virtual machine and a device. The access control method according to claim 19 or 20, wherein a process of extracting attribute information necessary for determining an access policy condition from an input / output event is performed. Detect the location status or time status of the access control system,
The access control method according to any one of claims 19 to 21, wherein access permission and responsibility to be implemented are determined according to a detected situation. The access control method according to claim 22, wherein timing for performing the duty is controlled according to the detected situation. A program installed in a computer in an access control system that performs access request determination and predetermined responsibility,
Computer
Monitoring means for monitoring an input / output event transmitted from a virtualization means for relaying an input / output event between the virtual machine and the device, and for controlling access permission and requesting execution of responsibility based on the input / output event;
A means for interpreting a predetermined access policy that defines conditions relating to access permission and execution of responsibilities, and in response to an inquiry from the monitoring means, determines whether access is permitted and responsibilities to be executed based on the access policy. Policy interpretation means responsive to the monitoring means;
A plurality of means for carrying out predetermined responsibilities,
Responsibility for identifying and calling responsibility execution means for executing the corresponding responsibility from the plurality of responsibility execution means and transferring a response of the called responsibility execution means to the monitoring means in response to the duty execution request from the monitoring means Access control program to function as an implementation interface means. Computer
A plurality of attribute extraction means for extracting attribute information necessary for access policy condition determination from input / output events;
Attribute extraction for identifying and calling attribute extraction means for performing extraction processing of corresponding attribute information from the plurality of attribute extraction means in response to an inquiry of attribute information, and transferring a response of the called attribute extraction means to the policy interpretation means Function as an interface means,
25. The access control program according to claim 24, wherein an input / output event is passed to the function as the attribute extraction interface means, and attribute information related to the input / output event is queried to determine whether access is permitted and the responsibility to be implemented. . Computer
Function as a status detection means to detect the location status or time status of the access control system,
26. The access control program according to claim 24 or 25, wherein the function as the policy interpreting unit is configured to determine whether access is permitted and the responsibility to be executed according to the status detected by the function as the status detecting unit. Computer
27. The access control program according to claim 26, wherein the access control program is caused to function as a duty execution time management means for controlling a timing of performing a duty in accordance with a situation detected by the situation detection means.

Images