JP2010282362A - Access control system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To efficiently control access in a distributed environment. <P>SOLUTION: In an access control system 1, when a policy execution device 30 receives an access request from an operator terminal 10, the policy execution device 30 inquires a policy evaluation device 40 for a policy attribute necessary for accessing a resource device 20, and transmits a policy evaluation request based on a result of the inquiry, to the policy evaluation device 40. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to an access control system capable of efficiently controlling access even in a distributed environment.

  In recent years, the importance of access control technology for controlling specific information and actions based on authority information has increased. For example, action permission type access control is widely used.

  As the access control in the action permission / inhibition format, for example, there is one in which authority information for a document file is security attribute. Specifically, the authority information for the document file assigned to the user is described in an action permission / inhibition format such as “browsing permission” or “editing permission”. This type of authority information is known as an access control matrix (Access Control Matrix) or an access control list (Access Control List). For example, Patent Document 1 discloses a method of setting authority information (rule) in a document file as a “security container”.

  However, it is difficult to describe flexible access control contents such as conditions such as permitted access time and access location and detailed function restrictions in the access control in the action permission / inhibition format.

  For this reason, in recent years, access control in the access control policy format as well as the action availability format has been used. The access control policy is a set of access control rules, and a standard description specification is disclosed (for example, see Non-Patent Document 1). In this access control policy type access control, it is possible to describe permitted conditions and detailed functional restrictions. For example, in access control in the access control policy format, when an access request to a document file is received, it is determined whether or not the file can be opened, and then the control is limited to the functions specified in the access control policy. It becomes possible.

  By the way, in the access control of the access control policy type, the access contents for the policy information of the access control are evaluated from the policy enforcement point (Policy Enforcement Point) for access control to the policy decision point (Policy Decision Point) for evaluating the access control policy. It is necessary to have you do. For example, it requests an evaluation of an access subject (subject), an access action (action), and the like. Generally, authentication of an access subject is performed before access control. At this time, an authentication policy is used as information for determining an authentication method that can prove the access subject, apart from an access control policy. Many.

JP 2001-306521 A

Tim Moses, “eXtensible Access Control Markup Language (XACML) Version 2.0”, [online], [searched May 17, 2007], Internet <URL: http://docs.oasis-open.org/xacml/2.0/ access_control-xacml-2.0-core-spec-os.pdf>

  However, in the conventional access control policy type access control, the policy execution point does not have the policy attribute information necessary for the evaluation of the access control policy, so that access may not be permitted even if an access request is made.

  Supplementally, in the case of a system in a single closed domain, the policy execution point obtains in advance information for executing policy evaluation such as access subject attributes (such as user authentication methods) and environment attributes. This is often the premise. Under such a premise, it is difficult to cause a situation where information necessary for permitting access by evaluating an access control policy at the time of an access request is insufficient.

  However, in a system in a distributed environment that spans multiple domains, the information necessary for the policy decision point to permit access may be insufficient with only the information included in the policy evaluation request described by the policy execution point. . In such a case, the policy attribute information necessary for the policy decision point to perform policy evaluation is not described in the policy evaluation request, so that access is not permitted.

  For example, if a user is authenticated by a different authentication method when a specific authentication method is defined in the policy information, access is not permitted. For this reason, the policy attribute acquisition process needs to be executed again at the policy execution point, and user authentication is requested from the user again. As a result, the policy execution point and the burden on the user increase.

  The present invention has been made in view of the above circumstances, and an object thereof is to provide an access control system capable of efficiently controlling access even in a distributed environment.

  In order to solve the above-described problems, the present invention provides an access control system including a policy execution device and a policy evaluation device for controlling access between an operator terminal and a resource device, wherein the policy execution device includes the operation An access request receiving means for receiving an access request to the resource device from a user terminal, and a policy attribute for inquiring of the policy evaluation device about a policy attribute necessary for access to the resource device when the access request is received When the policy attribute is received from the policy evaluation device, the inquiry condition, the connection condition information acquisition means for acquiring the connection condition information corresponding to the policy attribute, and the connection condition information when the connection condition information is acquired A policy evaluation request means for transmitting a policy evaluation request including the policy evaluation request to the policy evaluation device, and a policy for the policy evaluation request. A policy information storage for storing policy information indicating a connection condition to the resource device, wherein the policy evaluation device comprises access control means for controlling access between the operator terminal and the resource device according to a price response. A policy attribute analysis unit that analyzes a policy attribute corresponding to a policy attribute query from the policy execution device based on the policy information, and responds to the policy execution device with the policy attribute analyzed by the policy attribute analysis unit Policy attribute response means, and when the policy evaluation request is received from the policy execution device, based on the connection condition information and the policy information included in the policy evaluation request, between the operator terminal and the resource device An access device comprising policy evaluation response means for transmitting a policy evaluation response indicating whether or not to permit access to the policy execution device. To provide a control system.

  In the present invention, a collection of devices is expressed as a “system”. However, the present invention is not limited to this, and may be expressed as a “device” or a “program” for each device. It may be expressed as “method”. That is, the present invention can be expressed in any category.

<Action>
Therefore, according to the present invention, when the policy execution apparatus receives an access request from the operator terminal, the policy execution apparatus inquires the policy evaluation apparatus about the policy attributes necessary for access to the resource apparatus. Since the policy evaluation request based on the result is transmitted to the policy evaluation apparatus, it is possible to provide an access control system capable of efficiently controlling access even in a distributed environment.

  According to the present invention, even in an environment where policy execution points and policy decision points are distributed, policy attributes to be acquired by the policy execution points can be determined, and access control can be efficiently performed.

It is a schematic diagram which shows the structure of the access control system which concerns on the 1st Embodiment of this invention. It is a figure which shows an example of the "policy attribute query" concerning the embodiment. It is a figure which shows an example of the "policy evaluation request | requirement" which concerns on the embodiment. It is a figure showing an example of "policy information" concerning the embodiment. It is a figure showing an example of "policy information" concerning the embodiment. It is a figure which shows an example of the "policy attribute response" concerning the embodiment. It is a flowchart for demonstrating operation | movement of the access control system 1 which concerns on the same embodiment. It is a figure for demonstrating the operation | movement of the conventional access control.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

<First Embodiment>
(Configuration of access control system)
FIG. 1 is a schematic diagram showing the configuration of an access control system 1 according to the first embodiment of the present invention.

  The access control system 1 includes a policy execution device 30 and a policy evaluation device 40, and executes access control between the operator terminal 10 and the resource device 20. These devices 10 to 40 are connected to each other via a network. Further, policy information for the resource device 20 is stored in advance in the policy evaluation device 40 as a premise of access control. In the present embodiment, the policy execution device 30 is connected to the external authentication provider 50.

  The operator terminal 10 is a terminal device operated by an operator. The operator aims to access a specific resource device 20 via the operator terminal 10. When the operator terminal 10 accesses the resource device 20, an “access request” from the operator terminal 10 to the resource device 20 is transmitted to the policy execution device 30.

  The resource device 20 is an access target of the operator terminal 10. For example, the resource device 20 stores “resource information” provided by various service providers. For the resource device 20, a connection condition is defined in advance by policy information, and only an access request that satisfies a connection condition corresponding to a specific policy attribute is permitted to access. In the distributed environment system, there are a plurality of resource devices 20 and operator terminals 10 respectively.

  The policy execution device 30 functions as a so-called policy execution point, and includes an access request reception unit 31, a policy attribute inquiry unit 32, a policy attribute query creation unit 33, a connection condition information acquisition unit 34, a policy evaluation request unit 35, and an access. A control unit 36 is provided.

  The access request reception unit 31 receives an access request to the resource device 20 from the operator terminal 10. When receiving the access request, the access request receiving unit 31 sends information on the resource device 20 that the operator terminal 10 is trying to access to the policy attribute inquiry unit 32.

  The policy attribute inquiry unit 32 is used to inquire the policy evaluation apparatus 40 about a policy attribute necessary for access to the resource device 20 when an access request is received from the operator terminal 10. In short, the policy attribute inquiry unit 32 inquires in advance for policy attribute information necessary for making a policy evaluation request to be described later. The policy attribute inquiry unit 32 requests the policy attribute query creation unit 33 to create a policy attribute query when inquiring about policy attributes.

  In the present embodiment, the policy attribute inquiry unit 32 inquires about “authentication method” as the policy attribute. Supplementally, authentication methods include password authentication, IC card authentication, and biometric authentication. Therefore, the policy attribute inquiry unit 32 inquires of the policy evaluation device 40 which of the above authentications is permitted to access the resource device 20. However, it goes without saying that in addition to the authentication method, other conditions such as location and operation application type can be applied to the policy attribute.

  The policy attribute query creating unit 33 creates a “policy attribute query” for inquiring policy attributes. The policy attribute query is used by the policy evaluation device 40 to analyze a necessary policy attribute based on the policy information. Policy information will be described later.

  This policy attribute query has, for example, information having a configuration as shown in FIG. Specifically, the policy attribute query is expressed by an AttributeFindingQuery element e21. The AttributeFindingQuery element e21 has one or more Query elements e22 as child elements, and each Query element is identified by a QueryId attribute. The Query element e22 has a QueryTarget element e23 indicating a policy attribute which is a target to be inquired, and a QueryCondition element e27 indicating a condition for narrowing down. In the example of FIG. 2, Attribute element e25 having AttributeId attribute values “authentication-method” and “identity-provider-url” among Attribute elements that are child elements of Subject element e24 in QueryTarget element e23. It is shown that the element value of e26 is being queried. If there is no designation in the QueryTarget element e23, it is regarded as synonymous with querying all policy attributes that may be applicable. Further, in the example of FIG. 2, it is indicated that the condition for performing the action action “read” is inquired to the resource device 20 corresponding to “Resource-1” from the specification of the AttributeValue elements e28 and e29 of the QueryCondition element e27. Has been. This makes it possible to extract policy attributes that meet this condition from the policy information.

  When the policy attribute is received from the policy evaluation device 40, the connection condition information acquisition unit 34 acquires “connection condition information” corresponding to the received policy attribute. In this embodiment, an authentication device is used as the connection condition information acquisition unit 34, and information based on the authentication method specified by the policy attribute is acquired as connection condition information.

  The authentication device is a device for authenticating whether or not the operator is the user, has a plurality of authentication methods, and performs authentication by a single authentication method or a composite authentication method. At this time, the authentication apparatus may connect to an external authentication apparatus or an authentication provider and perform authentication cooperatively. The authentication device may be a device for executing general authentication, and details of the device configuration are omitted.

  When the connection condition information is acquired by the connection condition information acquisition unit 34, the policy evaluation request unit 35 transmits a “policy evaluation request” including the connection condition information to the policy evaluation apparatus 40. The policy evaluation request is information having a configuration as shown in FIG. 3, for example. Here, the connection condition information is indicated by Attribute elements e31, e32, and e33, and information for the access request destination is indicated by Attribute elements e34 and e35. That is, “User-1” of the Attribute element e31 is an external authentication provider of the URL “http://example1.co.jp/login” of the Attribute element e33 by the password authentication method (“password”) of the Attribute element e32. Authentication is written as connection condition information. Then, as an access request destination, a request for access permission for the “read” action of the Attribute element e35 is requested to “Resource-1” of the Attribute element e34.

  The access control unit 36 controls access between the operator terminal 10 and the resource device 20 in accordance with a policy evaluation response to the policy evaluation request. That is, when the policy evaluation response indicates “Permit”, the access control unit 36 permits access between the operator terminal 10 and the resource device 20 and when the policy evaluation response indicates “Deny”. Then, control for denying access between the operator terminal 10 and the resource device 20 is performed.

  The policy evaluation device 40 functions as a so-called policy evaluation point, and includes a policy information storage unit 41, a policy attribute analysis unit 42, a policy attribute response unit 43, and a policy evaluation response unit 44.

  The policy information storage unit 41 is a memory that stores “policy information” indicating a connection condition to the resource device 20. The policy information may be stored in an external storage device and written at any time.

  In the present embodiment, the policy information will be described using an example of handling a policy file described in XML (eXtensible Markup Language) format. This policy file may be a single file format or a format included in a document file. In this embodiment, a format included in a document file will be described.

  The policy information is a policy file having a structure as shown in FIGS. 4 and 5, for example. In the present embodiment, a description format referring to the XACML V2.0 format shown in Non-Patent Document 1 is adopted as a standard policy description language. This policy file has one or more Policy elements e42. Moreover, you may have PolicySet element e41 as information which summarizes Policy element e42. Further, the PolicySet element may be included in the PolicySet element. The Policy element e42 has a Rule element e47, and the basic contents of access control are described in the Rule element e47. Here, the policy file indicates the basic contents of access control, and includes the components such as “subject”, “action”, “resource”, and “environment”. Contains. Specifically, “subject” (subject) is the subject of access execution, and is indicated by a Subjects element e44. "resource" (resource) is an object for executing access, and is indicated by a Resources element e45. “Action” is an action content of access execution and is indicated by an Actions element e46. “environment” indicates an environment for executing access. Note that the policy description example illustrated in the present embodiment excludes information that is not essentially related to the invention, such as a name space and a data type, in order to simplify the description.

  Further, in the policy information, “authentication method” and “connection destination of an authentication provider (implementer who authenticates the operator)” are set as an example of policy attributes for permitting access to the resource device 20. It shall be. In short, in addition to information on who is an operator who can access the resource device 20, an authentication method to be performed when confirming an operator and information on who should be authenticated are specified. For example, in the example of the policy information of FIGS. 4 and 5, the access element, the access resource, and the access action to be targeted by the Target element e43 immediately below the Policy element e42 are the Subject elements e44, Resources element e45, and Actions element e46, respectively. It is specified by. The authentication method and the authentication provider conditioned on the access subject specified here are specified by the Condition element e48 of the Rule element e47 whose RuleId value is “Rule-1”. Here, it is specified that any of the authentication providers specified by the Attribute elements e50 and e51 whose AttributeId attribute value is “identity-provider-url” authenticates by the password authentication method. The value for identifying the authentication service location of the authentication provider is expressed by a URL. The AttributeId attribute value of the Attribute element e49 indicating the authentication method is represented as “authentication-method”.

  Policy information may be provided from an external directory service or the like. In this case, the policy information storage unit 41 is mounted with a connector for accessing a policy store such as a directory service.

  When the policy attribute response unit 42 receives the policy attribute query from the policy execution device 30, the policy attribute response unit 42 causes the policy attribute analysis unit 43 to analyze the policy attribute and responds to the policy execution device 30 with the analysis result as “policy attribute response”. .

  The policy attribute analysis unit 43 analyzes the policy attribute corresponding to the policy attribute query from the policy execution device 30 based on the policy information. Here, the policy attribute analysis unit 43 is implemented in the form of a local file access program or the like, and acquires policy information from the policy information storage unit 41.

  Specifically, the policy attribute analysis unit 43 extracts the policy attribute from the policy information of the resource device 20 specified by the policy attribute query. The policy attribute response generated by the policy attribute analysis unit 43 is shown, for example, as shown in FIG. The policy attribute response is expressed by an AttributeFindingResponse element e61. The AttributeFindingResponse element e61 has a Response element e62. The Response element e62 is associated with the Query element e22 of the policy attribute query by the CorrelationId attribute. The Response element e62 is a set including policy attributes necessary for policy evaluation. Here, the thing that does not include the policy attribute value (Attribute element value) simply indicates that the policy attribute is necessary. The contents including the policy attribute value indicate the policy attribute value that must be included when making the “policy evaluation request”.

  For example, in the Subject element e63, since the Attribute attribute whose attributeId attribute value is “authentication-method” is “password”, it indicates that the password authentication method must be selected. Further, when the FunctionId value of the Apply element e64 is “or”, it indicates that the value is selectable. For example, two attribute values of “http://example1.co.jp/login” and “http://example2.co.jp/login” can be selected as attribute values having an AttributeId attribute of “identity_provider_url” It is required to be authenticated by an authentication provider corresponding to any URL.

  Further, regarding policy information, it may be controlled whether or not to respond with a policy attribute value conforming to the policy attribute query. That is, an attribute (Quariable attribute) indicating whether or not to respond the policy attribute value may be added to the Attribute element corresponding to the policy attribute.

  For example, if the Quariable attribute value is represented by a boolean type (the basic data type that takes the binary values “true = true” and “false = false”), in the example of FIG. Like an attribute value. Since the Quariable attribute value of the Attribute element of this Subject element is “false”, even if this policy attribute is matched, the policy attribute value is not responded. If the Quariable attribute value does not exist, the policy attribute value may be returned, but the Quariable attribute value may be explicitly set to “true”. Note that these determination conditions may be explicitly described in the policy as described above, and further, the policy attribute analysis unit may hold the static setting information.

  When the policy evaluation response unit 44 receives the “policy evaluation request” from the policy execution device 30, the policy evaluation response unit 44 determines whether the operator terminal 10, the resource device 20, or the like is based on the connection condition information and the policy information included in the received policy evaluation request. A “policy evaluation response” indicating whether or not access is permitted is transmitted to the policy execution device 30. In short, in the policy evaluation response unit 44, the policy evaluation response indicating “access permission (Permit)” or “access denial (Deny)” from each element included in the policy evaluation request and the rule elements e47 and e52 of the policy information. Is transmitted to the policy execution device 30.

  The policy execution device 30 and the policy evaluation device 40 may be provided on the same physical device. Further, the resource device 20 may be held inside the policy execution device 30.

(Access control system operation)
Next, the operation of the access control system 1 according to the present embodiment will be described using the flowchart of FIG.

  First, an “access request” for the resource device 20 is transmitted to the policy execution device 30 by the operation of the operator terminal 10 by the operator (S1). As a result, the policy execution device 30 receives an access request from the operator terminal 10 to the resource device 20.

  When the policy execution device 30 receives the access request, the policy execution device 30 inquires the policy evaluation device 40 about the policy attribute necessary for access to the resource device 20. Specifically, the policy attribute inquiry unit 32 transmits a policy attribute query to the policy evaluation device 40 (S2). This policy attribute query is created by the policy attribute query creation unit 33, and describes the elements of the policy attribute to be inquired and the conditions for narrowing down.

  The policy evaluation device 40 receives a policy attribute query from the policy execution device 30 via the policy attribute response unit 42. Subsequently, the policy attribute analysis unit 43 analyzes the policy information stored in the policy information storage unit 41 based on the policy attribute query, and extracts necessary policy attributes (S3).

  Then, the policy evaluation device 40 transmits a policy attribute response describing the policy attribute information analyzed by the policy attribute analysis unit 43 to the policy execution device 30 via the policy attribute response unit 42 (S4).

  When the policy attribute response is received from the policy evaluation device 40 by the policy execution device 30, the policy attribute described in the policy attribute response is read by the policy attribute inquiry unit 32. Here, “password authentication” and “connection destination (URL) of external authentication provider” are read as necessary policy attributes.

  Subsequently, the policy attribute inquiry unit 32 acquires connection condition information corresponding to the policy attribute (S5). Here, the connection condition information is acquired by authenticating the operator of the operator terminal 10 by password authentication by the designated external authentication provider (S6, S7).

Next, the policy execution device 30 transmits a policy evaluation request including the connection condition information acquired via the connection condition information acquisition unit 34 to the policy evaluation device 40 (S8).
When the policy evaluation device 40 receives a policy evaluation request from the policy execution device 30, the policy evaluation response unit 44 uses the connection condition information included in the policy evaluation request and the policy information stored in the policy information storage unit 41. Then, it is determined whether or not access between the operator terminal 10 and the resource device 20 is permitted. This determination result is expressed as permission (Permit) or rejection (Deny). Then, the determination result determined by the policy evaluation response unit 44 is transmitted to the policy execution device 30 as a policy evaluation response (S9).

  The policy execution device 30 controls access between the operator terminal 10 and the resource device 20 in accordance with the policy evaluation response from the policy evaluation device 40 (S10, S11).

  At this time, if the access is permitted, the operator terminal 10 can access the resource device 20 (S12).

(Effect of access control system)
As described above, in the access control system 1 according to the present embodiment, when the policy execution device 30 receives an access request from the operator terminal 10, the policy evaluation device assigns policy attributes necessary for access to the resource device 20. 40, and a policy evaluation request based on the inquiry result is transmitted to the policy evaluation apparatus 40. Therefore, access control can be efficiently performed even in a distributed environment.

  Supplementally, in the conventional access control system, since the policy execution device does not have the policy information of the resource device, the operator is often tentatively authenticated by a password authentication method. On the other hand, depending on the resource device, authentication based on the password authentication method is not permitted, and authentication based on the PKI and the IC card may be requested.

  However, in the conventional access control, the policy execution device cannot grasp the policy attribute necessary for accessing the resource device, and inquires only whether the policy evaluation device can be accessed. Therefore, as shown in FIG. 8, there is a situation where the policy execution request is repeatedly executed until the policy execution device 30S acquires the connection condition information (= PKI + IC card) corresponding to the required policy attribute. On the other hand, in the access control system 1 according to the present embodiment, the policy evaluation apparatus 40 is inquired in advance about the policy attribute to be acquired by the policy execution apparatus 30, so that unnecessary processing such as retransmission of the policy evaluation request is reduced. It is possible to improve the efficiency of the policy evaluation process.

  The policy information of the resource device 20 is complicated, and a distributed environment system that spans a plurality of domains has been constructed. Even in such a situation, according to the access control system 1 according to the present embodiment, as the premise of the access control, the policy execution device 30 inquires the policy evaluation device 40 about the policy attribute. realizable.

  In the access control system according to the present embodiment, authentication information is used as connection condition information, but access control is also performed using GPS (Global Positioning System) information, time stamp information, etc. of the operator terminal. It is also possible.

<Others>
Note that the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. In addition, various inventions can be formed by appropriately combining a plurality of components disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, you may combine a component suitably in different embodiment.

  The method described in the above embodiment includes, as programs that can be executed by a computer, a magnetic disk (floppy (registered trademark) disk, hard disk, etc.), an optical disk (CD-ROM, DVD, etc.), a magneto-optical disk (MO). ), And can be distributed in a storage medium such as a semiconductor memory.

  In addition, as long as the storage medium can store a program and can be read by a computer, the storage format may be any form.

  In addition, an OS (operating system) running on a computer based on an instruction of a program installed in the computer from a storage medium, MW (middleware) such as database management software, network software, and the like realize the above-described embodiment. A part of each process may be executed.

  Furthermore, the storage medium in the present invention is not limited to a medium independent of a computer, but also includes a storage medium in which a program transmitted via a LAN, the Internet, or the like is downloaded and stored or temporarily stored.

  Further, the number of storage media is not limited to one, and the case where the processing in the above embodiment is executed from a plurality of media is also included in the storage media in the present invention, and the media configuration may be any configuration.

  A computer according to the present invention executes each process in the above embodiment based on a program stored in a storage medium, and includes a single device such as a personal computer or a system in which a plurality of devices are connected to a network. Any configuration may be used.

  In addition, the computer in the present invention is not limited to a personal computer, but includes a processing unit, a microcomputer, and the like included in an information processing device, and is a generic term for devices and devices that can realize the functions of the present invention by a program. Yes.

  DESCRIPTION OF SYMBOLS 1 ... Access control system, 10 ... Operator terminal, 20 ... Resource apparatus, 30 ... Policy execution apparatus, 31 ... Access request receiving part, 32 ... Policy attribute inquiry part, 33 ... Policy attribute query creation unit, 34 ... Connection condition information acquisition unit, 35 ... Policy evaluation request unit, 36 ... Access control unit, 40 ... Policy evaluation device, 41 ... Policy information Storage unit 42... Policy attribute analysis unit 43 43 Policy attribute response unit 44. Policy evaluation response unit 50.

Claims (3)

An access control system comprising a policy execution device and a policy evaluation device for controlling access between an operator terminal and a resource device,
The policy execution device
Access request receiving means for receiving an access request to the resource device from the operator terminal;
When the access request is received, policy attribute inquiry means for inquiring of the policy evaluation apparatus about a policy attribute necessary for accessing the resource device
When a policy attribute is received from the policy evaluation device, connection condition information acquisition means for acquiring connection condition information corresponding to the policy attribute;
Policy acquisition request means for transmitting a policy evaluation request including the connection condition information to the policy evaluation device when the connection condition information is acquired;
An access control means for controlling access between the operator terminal and the resource device in response to a policy evaluation response to the policy evaluation request;
The policy evaluation device
Policy information storage means for storing policy information indicating a connection condition to the resource device;
Policy attribute analysis means for analyzing a policy attribute corresponding to a policy attribute query from the policy execution device based on the policy information;
Policy attribute response means for responding to the policy execution device with the policy attribute analyzed by the policy attribute analysis means;
Whether or not to permit access between the operator terminal and the resource device based on the connection condition information and the policy information included in the policy evaluation request when the policy evaluation request is received from the policy execution device Policy evaluation response means for transmitting a policy evaluation response indicating to the policy execution device;
An access control system comprising: The access control system according to claim 1.
The policy execution device
An access control system further comprising means for creating a policy attribute query for querying the policy attribute. In the access control system according to claim 1 or 2,
The policy attribute inquiry means inquires an authentication method as the policy attribute.

Images