JP2013106251A - Distribution access control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a distribution access control method capable of reducing a communication cost in verifying efficacy of a plurality of right certificates as much as possible.SOLUTION: All nodes 1nac in a distribution access control mechanism 10ac register nullified root certificates when the root certificates have been nullified. When any right certificate following a right certificate issued from the root certificate as a transfer source has been nullified; the right certificate is registered to a specific node 1nac determined based on specific information of the right certificate issued from the root certificate as the transfer source, if the right certificate is any right certificate following the right certificate issued from the root certificate as the transfer source. When clients 3a to 3c transmit operation requests with the right certificate attached to any node 1nac, the requests are made to access the specific node.

Description

  The present invention relates to a distributed access control method suitable for use in a distributed system that executes predetermined processing in a distributed manner.

  There is a distributed system in which predetermined processing is not executed by a single node (computer), but is executed by a plurality of nodes. As an example of a distributed system, there is a distributed file system in which resources (files, directories, folders, etc.) are distributed and stored in a plurality of servers on a network. According to the distributed file system, it is possible to reduce the possibility of losing resources even if some servers are damaged by a disaster or the like. With the spread of cloud computing in recent years, distributed file systems have attracted attention.

  According to the distributed file system, high availability and scalability can be realized. Accesses such as writing resources to the distributed file system and reading resources stored in the distributed file system are controlled by software called an access control mechanism. A distributed management type access control mechanism used in the distributed file system is referred to as a distributed access control mechanism.

  A resource stored in a distributed file system may be shared by multiple users. When accessing a resource stored in the distributed file system, a user is authenticated by a distributed access control mechanism so that only a specific user can access the resource. The range of authority when a user accesses a resource can be set for each user. The distributed access control mechanism controls access to resources according to the scope of authority given to individual users.

  The distributed access control mechanism greatly affects the availability and scalability of the distributed file system. Therefore, in order to improve the availability and scalability of the distributed file system, it is necessary to consider availability and scalability not for the distributed file system alone but for the entire system including the distributed access control mechanism. To achieve high availability, it is necessary that the distributed file system and the distributed access control mechanism have no single point of failure. To achieve high scalability, performance needs to be scaled out.

  Non-Patent Document 1 describes a distributed access control mechanism using an authority certificate as an example of a conventional distributed access control mechanism.

Miltchev, S., Prevelakis, V., Ioannidis, J., Keromytis, A. Smith, J., Secure and flexible global file sharing, Proceedings of the Annual USENIX Technical Conference, Freenix Track, pp.165-178, 2003

  When accessing a distributed system such as a distributed file system via the distributed access control mechanism, the validity of the authority certificate is verified. When the authority certificate is issued by sequentially delegating the authority starting from the root certificate, not only the validity of the authority certificate itself sent to the distributed access control mechanism is verified but also the authority It is also necessary to verify the validity of the authority certificate of all delegation sources of the certificate. That is, when the distributed access control mechanism accesses the distributed system, it is necessary to verify the validity of a plurality of authority certificates.

  When verifying the validity of a plurality of authority certificates, if communication is performed every time the validity of each authority certificate is verified, it is not preferable in terms of communication cost. Therefore, a distributed access control method that can verify the validity of a plurality of authority certificates while reducing the communication cost as much as possible is desired.

  In order to meet such a demand, an object of the present invention is to provide a distributed access control method capable of reducing the communication cost when verifying the validity of a plurality of authority certificates as much as possible.

  In order to solve the above-described problems of the conventional technology, the present invention provides a plurality of the plurality of nodes in the distributed access control mechanism (10ac) configured to include a plurality of nodes (1nac) when a client accesses the server (10). When a server is accessed via any one of the nodes and an operation request is made from the client to the server, an authority certificate (C) is attached to the operation request to any one of the nodes. The authority certificate is issued by sequentially delegating authority starting from the root certificate, and all authority certificates from the root certificate to the authority certificate that is the previous delegation source are issued. A chained certificate list (CCL) indicating specific information to be specified is included, and all the nodes of the plurality of nodes have nothing when one of the root certificates is invalidated. If any authority certificate after the authority certificate issued with the specified root certificate as a delegation source is invalidated, the predetermined root certificate as the delegation source Regardless of the authority certificate issued after the issued authority certificate, the predetermined root certificate is registered in a specific node determined based on the specific information of the authority certificate issued as a delegation source, A distributed access control method is provided in which a specific node is accessed when a client sends the operation request together with the authority certificate to the node.

  In the distributed access control method, a unique node ID is set for each of the plurality of nodes, each authority certificate has a certificate ID as the specific information, and the predetermined root certificate is a delegation source A node having a node ID selected based on a hash value obtained by hashing the certificate ID of the issued authority certificate is selected as the specific node, and the authority certificate issued using the predetermined root certificate as a delegation source It is preferable to register all the invalid authority certificates after the certificate in the specific node.

  According to the distributed access control method of the present invention, the communication cost when verifying the validity of a plurality of authority certificates can be reduced as much as possible.

It is a schematic block diagram which shows the distributed access control mechanism of one Embodiment. It is a schematic block diagram which shows a distributed file system. It is a block diagram which shows the specific structural example of the node which comprises the distributed access control mechanism of one Embodiment. It is a figure for demonstrating capability. It is a figure for demonstrating delegation of authority. 4 is a flowchart showing a procedure SA for issuing an authority certificate C. It is a flowchart which shows the authentication procedure SB of a password. It is a flowchart which shows the update procedure SC at the time of updating the authentication information of the authority certificate C. It is a figure for demonstrating the certificate revocation list | wrist 15 which is the list | wrist of the authority certificate C which became invalid. It is a figure for demonstrating the certificate update list | wrist 16 which is the list | wrist of the authority certificate C updated. It is a flowchart which shows the update procedure SD at the time of updating the authority information of the authority certificate C. It is a flowchart which shows acquisition procedure SE of node public key Knpb. It is a flowchart which shows verification procedure SF of the authority certificate C. It is a figure for demonstrating the distribution method of the certificate revocation list | wrist 15 and the certificate update list | wrist 16. FIG. It is a flowchart which shows the invalidation procedure SG of the authority certificate C. It is a flowchart which shows the invalidation confirmation procedure SH of the authority certificate C.

  Hereinafter, an embodiment of a distributed access control method of the present invention will be described with reference to the accompanying drawings. An embodiment described in detail below shows a case where a distributed access control method is executed by a distributed file system which is an example of a distributed system.

  First, an outline of the distributed file system will be described with reference to FIG. In FIG. 2, the distributed file system 10 includes a plurality of nodes 1n connected to each other via a network. Each node 1n is configured by a computer functioning as a server. The entire distributed file system 10 also functions as one virtual server. A client 3 which is a terminal such as a personal computer owned by the user 2 is connected to the distributed file system 10 via a network such as the Internet. Each of the plurality of nodes 1n is preferably a full mesh network that can be directly connected to any other node 1n.

  Access to the distributed file system 10 such as reading and writing resources is referred to as a request, and from logging in to the distributed file system 10 until logging out is referred to as a session. When the client 3 accesses the distributed file system 10, access from the client 3 is allocated to one node 1n by a mechanism such as a load balancer or DNS round robin for each request or session, and only that one node 1n is allocated. Communicate with.

  Next, an outline of the distributed access control mechanism will be described with reference to FIG. In FIG. 1, the distributed access control mechanism 10ac is composed of a plurality of nodes 1nac connected to each other via a network. Similarly to the distributed file system 10, the distributed access control mechanism 10ac is preferably a full mesh network. In the example shown in FIG. 1, a distributed file system 10 is configured by a node 1n that does not configure the distributed access control mechanism 10ac and a node 1nac that configures the distributed access control mechanism 10ac. The node 1nac is a node in which software that is a distributed access control mechanism is installed, and the node 1n is a node in which the software is not installed.

  FIG. 1 shows that the nodes constituting the distributed file system 10 need not completely match the node 1nac constituting the distributed access control mechanism 10ac. Of course, the distributed file system 10 and the distributed access control mechanism 10ac may be completely matched with all the nodes constituting the distributed file system 10 as the node 1nac constituting the distributed access control mechanism 10ac.

  FIG. 1 shows a state where access from the client 3 is allocated to one node 1nac and communicates with only that one node 1nac by the mechanism such as the load balancer and DNS round robin described in FIG. . In FIG. 1, the client 3a owned by the user 2a, the client 3b owned by the user 2b, and the client 3c owned by the user 2c are each connected to one node 1nac constituting the distributed access control mechanism 10ac.

  Users 2a, 2b, and 2c are collectively referred to as user 2, and clients 3a, 3b, and 3c are collectively referred to as client 3. The secrecy of the communication between the client 3 and the node 1nac and the communication between the nodes 1nac is secured by SSL / TLS (Secure Sockets Layer / Transport Layer Security) or the like. The client 3 is, for example, a personal computer or a PDA (personal digital assistant), and may be any terminal having a function of connecting to a network. The OS (operating system) installed in the terminal is also arbitrary.

  Here, a specific configuration of the node 1nac constituting the distributed access control mechanism 10ac will be described with reference to FIG. As shown in FIG. 3, the client 3 accesses the distributed file system 10 via the node 1nac. The client 3 cannot access the distributed file system 10 without going through the node 1nac. The node 1nac has an access control unit 11 configured by software. Of course, the node 1nac has hardware for operating the access control unit 11 which is software. A unique node ID 12 is set for each node 1nac throughout the distributed access control mechanism 10ac.

  Each node 1nac has a node route table 13 which is a map of node IDs 12 and connection information of all nodes 1nac. The connection information is, for example, a URL or a pair of an IP address and a port number. The node 1nac has a key pair of a node secret key Knpr and a node public key Knpb. The key pair of the node secret key Knpr and the node public key Knpb is different for each node 1nac. The key pair may be updated. The node 1nac has a node public key list 14 which is a list of node public keys Knpb from the past to the present of all the nodes 1nac. The node public key list 14 includes, for each node ID 12, three sets of key pair use start date and time, a node public key Knpb, and a leakage flag as entry information.

  In each node 1nac, a leakage flag is set when leakage of the node secret key Knpr is suspected. That is, when leakage is suspected, the leakage flag is set to a value indicating leakage. Note that setting the leakage flag to a value indicating leakage does not necessarily indicate that the node secret key Knpr has actually been leaked. When a situation in which leakage of the node secret key Knpr is suspected occurs in each node 1nac, the leakage flag is set to a value indicating leakage. The administrator may manually set a leak flag, or the node 1 nac may automatically set a leak flag upon detecting the occurrence of a suspected leak.

  Further, each node 1nac has a certificate revocation list (hereinafter, CRL) 15 and a certificate update list (hereinafter, CUL: Certificate Update List) 16. As will be described in detail later, the CRL 15 and the CUL 16 are distributed and stored in a plurality of nodes 1nac. The entire CRL 15 held by all nodes 1nac becomes the certificate revocation total list, and the entire CUL 16 held by all nodes 1nac becomes the certificate renewal total list.

  Table 1 collectively shows information held by each node 1nac.

  As shown in FIG. 3, when the client 3 accesses the resource of the distributed file system 10, the operation request is transmitted to the node 1 nac along with the authority certificate C. As will be described later, the authority certificate C is issued by the node 1nac.

  The authority certificate C is generally obtained by adding a digital signature to the capability shown in FIG. The capability is access control information for each user. Users A, B, and C shown in FIG. As shown in FIG. 4, the user B is not permitted to read or write to the resource X, is permitted to read the resource Y, and reads to the resource Z. Any writing is allowed. Thus, information indicating what kind of access is permitted / not permitted for each user is the capability.

  Note that information that associates what access is permitted / not permitted to which user in each resource unit is referred to as an ACL (Access Control List). The ACL method using the ACL is used in a centralized management type access control mechanism. This embodiment is a distributed management type access control mechanism using an authority certificate C instead of the ACL method.

  In the node 1nac, the authority certificate C attached to the operation request is valid, the requested operation is permitted in the authority certificate C, and the client 3 (user 2) is the owner of the authority certificate C. If it is authenticated, the operation request is mediated to the distributed file system 10. Whether the authority certificate C is valid refers to the CRL 15 and the CUL 16 that are distributed and stored in the plurality of nodes 1nac. This will be described later. The authentication of the client 3 (user 2) does not have to be performed every time an operation request is made, and the authentication result may be cached and authenticated on a session basis.

  Table 2 shows information included in the authority certificate C.

  The certificate ID included in the authority certificate C does not change even when the authority certificate C described later is updated. The certificate ID is identification information that identifies the authority certificate C. The target resource is the resource X, Y, Z or the like described with reference to FIG. 4, and the permitted operation is the reading or writing, data copying, printing, or deletion described with reference to FIG. In the present embodiment, the user 2 can issue a new authority certificate C having a subset authority based on the authority certificate C that the user 2 owns. The target resource, the permitted operation, and the valid period are authority information indicating the scope of authority.

  The chain certificate list indicates how the authority certificate C is chained. If the chained certificate list is empty, it is a root certificate. It is assumed that at least one root certificate exists. The root certificate may be held by the administrator of the distributed access control mechanism 10ac, or may be issued to a specific user 2 by the administrator. How the root certificate exists is not limited. When the authentication method is limited to password authentication, the information indicating the authentication method shown in Table 2 is not necessary.

  The issuance date / time of the authority certificate C is the issuance date / time when the authority certificate C was first issued when the authority certificate C has not been updated, and when the authority certificate C has been updated as described later. Update date and time. The update date / time is an issue date / time when a new authority certificate C in which the content of the authority certificate C is updated is issued, and the issue date / time includes the update date / time. The issuer node ID is a node ID set in the node 1nac that issued the authority certificate C, and the signature is a digital signature using the node secret key Knpr possessed by the node 1nac that issued the authority certificate C.

An example of authority delegation of the authority certificate C will be described with reference to FIG. The right certificate C that Alice possesses a right certificate C _A as user 2. FIG. 5 shows only a part of information included in the authority certificate C shown in Table 2. CCL in FIG. 5 is a chained certificate list. Certificate ID of authority certificate C _A that Alice owned is A0001, chain certificate list CCL is empty. In other words, the authority certificate C _A is a root certificate.

Assume that Alice delegates authority to Bob as another user 2. The authority of the delegation destination (here, Bob) is within a range not exceeding the authority of the delegation source (here, Alice). The right certificate C that Bob owns the right certificate C _B. Certificate ID authority certificate C _B that Bob owns is B0001, the chained certificate list CCL authority certificate C _B are described A0001 is delegatee certificate ID privileges.

Furthermore, Bob delegates authority to Carol as another user 2. Similarly, the authority of the delegation destination (Carol in this case) does not exceed the authority of the delegation source (here Bob). Carol is an authority certificate C _C the authority certificate C owned. The chained certificate list CCL authority certificate C _C is any certificate ID delegatee authority A0001, B0001 is described. As described above, the chained certificate list CCL indicates a list of all certificate IDs of the transfer source from the root certificate to the immediately preceding certificate when authority is sequentially transferred from the root certificate. From the certificate ID described in the chained certificate list CCL included in the authority certificate C, it can be understood by which authority certificate C the authority is transferred.

  Here, the issuing procedure SA of the authority certificate C by the node 1nac will be described with reference to FIG. The issuing procedure SA of the authority certificate C shown in FIG. 6 is an issuing method of the authority certificate C that is a part of the distributed access control method of the embodiment, and is a step executed by the distributed access control program of the embodiment. This is a step of issuing a part of the authority certificate C.

The user 2 operates the terminal of the client 3 and inputs the authority certificate C of the delegation source (the authority certificate C owned by the user 2), authority information of the authority certificate C to be newly issued, and the initial password pi. Assume that the node 1 nac is instructed to issue a new authority certificate C. The delegation source of authority certificate C and C _P. The access control unit 11 of the node 1nac, at step SA1, the client 3 receives the delegatee authority certificate C _P, and authority information of the authorization certificate C which newly issued, the initial password pi.

In the case of Bob in FIG. 5 delegating authority to Carol, for example, the access control unit 11 issues a new authority certificate C _B owned by Bob and authority certificate C _C to be issued to Carol. The authority information and the initial password pi are received. The initial password pi may be set as appropriate according to a password provision rule previously set by Bob. In the following, for ease of understanding, Bob will supplement the explanation when delegating authority to Carol as appropriate.

In step SA2, the access control unit 11 verifies the authority certificate C _P (authorization certificate C _B ) of the delegation source. It will be specifically described later procedure of verification procedures SF authorization certificate C _P in step SA2. In step SA3, the access control unit 11 authenticates that the user 2 (client 3) is the owner of the authority certificate C _P (authorization certificate C _B ) as the delegation source. Step user 2 SA3 will be described later specific procedure of an authentication procedure SB as the owner of the delegatee authority certificate C _P. If the authentication is successful, the access control unit 11 moves the process to step SA4.

In step SA4, the access control unit 11 compares the authority information of the authority certificate C (authority certificate C _C ) to be newly issued in comparison with the authority certificate _CP (authority certificate C _B ) of the delegation source. It is confirmed whether there is no fraud such as enlargement of time and extension of deadline. If it is not valid (NO), the access control unit 11 terminates the issuance of a new authority certificate C (authority certificate C _C ) in step SA10 without permission. At this time, although not particularly illustrated, the access control unit 11 notifies the user 2 (Bob) that the issuance of the new authority certificate C is not permitted and the reason thereof.

If it is valid in step SA4 (YES), the access control unit 11 generates and sets a certificate ID of the newly issued authority certificate C (authority certificate C _C ) in step SA5. In step SA6, the access control unit 11 generates and sets public authentication information Ioauth using the initial password pi. The public authentication information Ioauth is obtained by the following equation (1). In Expression (1), r ₁ and r ₂ are random numbers, and password is a plain text of the initial password pi. Moreover, a‖b means that a and b are connected (bit combination), H (M) means that a one-way hash function is applied to the message M, and E _Knpb (M) is This means that the message M is encrypted using the node public key Knpb.

Ioauth = r ₁ ‖r ₂ ‖E _Knpb (r ₂ ‖H (r ₁ ‖password))… （1）

In Expression (1), the random numbers r ₁ and r ₂ are used to make the public authentication information Ioauth more irregular, and the random numbers r ₁ and r ₂ may be pseudo-random numbers. The public authentication information Ioauth is a value obtained by encrypting a password using a one-way hash function and encrypting it using a node public key Knpb included in the node 1nac.

In step SA7, the access control unit 11 uses the delegation source authority certificate C _P (authority certificate C _B ) as the chained certificate list CCL of the authority certificate C to be newly issued (authority certificate C _C ). A list obtained by adding the certificate ID of the authority certificate C _P (authority certificate C _B ) of the transfer source to the chained certificate list CCL is set. As described in FIG. 5, the chain certificate list CCL authority certificate C _B describes a A0001 as the certificate ID, is the certificate ID of the right certificate C _B in the chain certificate list CCL by adding B0001, a chained certificate list CCL authority certificate C _C.

In step SA8, the access control unit 11 sets the current time to the issue date and time of the newly issued authority certificate C (authority certificate C _C ) and issues a new authority certificate C to the issuer node ID. The node ID of the node 1nac itself is set. The current time here is the current time up to the date and second. In step SA9, the access control unit 11 digitally signs using the node private key Knpr of the node 1nac that is about to issue a new authority certificate C, and creates a new authority certificate C (authority certificate C _C ) And exit.

  As described above, a new authority in which a certificate ID, new authority information, public authentication information, chained certificate list, issue date / time, issuer node ID, and digital signature are set as a newly issued authority certificate C Certificate C is issued.

A method of transferring the new authority certificate C to the user 2 (client 3) as the delegation destination is arbitrary. For example, if Bob is devolved to Carol, it may be sent directly to right certificate C _C newly issued Carol, Bob and send to Bob may also be transferred to Carol. The node 1nac is holds the authority certificate C _C newly issued, Carol may be transferred to Carol when logging into distributed access control mechanism 10ac.

  As can be seen from the above description, according to the present embodiment, the user 2 can freely set the authority to access the distributed file system 10 for the other users 2 within the scope of the authority that the user 2 has. Can do. Since a specific person such as an administrator of the distributed access control mechanism 10ac does not need to issue the authority certificate C and manage the authority certificate C, the cost of issuing and managing the authority certificate C can be distributed. It becomes possible.

With reference to FIG. 7, a specific procedure of the authentication procedure SB that the user 2 in step SA3 in FIG. 6 is the owner of the authority certificate C of the delegation source (here, the authority certificate C _P ) will be described. The authentication procedure SB shown in FIG. 7 is an authentication method that is a part of the distributed access control method of the embodiment, and is an authentication step that is a part of the steps executed by the distributed access control program of the embodiment.

In FIG. 7, the access control unit 11 receives the authority certificate C (authority certificate C _P ) and password p at step SB1. The password p is a password set when the authority certificate _CP is issued. If the password has not been changed, the password p is the initial password pi. The access control unit 11 acquires the public authentication information Ioauth from the authority certificate C in step SB2. In step SB3, the access control unit 11 acquires the node public key Knpb used when issuing the authority certificate C (authority certificate C _P ) from the node public key list. The specific procedure of the node public key Knpb acquisition procedure SE in step SB3 will be described later.

In step SB4, the access control unit 11 determines whether or not the following equation (2) is satisfied. In Expression (2), c is a value c obtained when the public authentication information Ioauth is divided into random numbers r ₁ and r ₂ and a value c. In other words, c is a value that concatenates the random numbers r ₁ and r ₂ and the value c into the public authentication information Ioauth.

c = E _Knpb (r ₂ ‖H (r ₁ ‖p)) (2)

If Formula (2) is materialized (YES), the access control part 11 will determine that password authentication was materialized in step SB5, and will be complete | finished. If the expression (2) is not established (NO), the access control unit 11 determines that the password authentication is not established in step SB6 and ends. The fact that Expression (2) is satisfied means that the password p input by the user 2 is unidirectionally using a unidirectional hash function and the node used when the authority certificate C (authority certificate C _P ) is issued. The value encrypted using the public key Knpb matches the public authentication information Ioauth.

  In this way, the password p is unidirectional using the one-way hash function, the value encrypted using the node public key Knpb used when issuing the authority certificate C acquired from the node public key list, and the authority By comparing with the public authentication information acquired from the certificate C, it is possible to authenticate that the client 3 (user 2) is the owner of the authority certificate C. In this embodiment, password authentication can be realized using only the authority certificate C and the password p transmitted from the user 2 (client 3).

  By the way, the public authentication information Ioauth is “condition 1: the distributed access control mechanism 10ac (node 1nac) can authenticate the authority certificate C using only the public authentication information Ioauth”, “condition 2: public authentication information. It is information that satisfies the two conditions of “the security of authentication of the authority certificate C can be ensured even when Ioauth is leaked”. When the condition 2 is satisfied, the public certificate information Ioauth can be included in the authority certificate C. By satisfying the condition 1, the distributed access control mechanism 10ac does not need to hold authentication information.

  According to the above equation (1), since the public authentication information Ioauth is unidirectional by the one-way hash function, it is extremely difficult to obtain the password in the reverse direction. Therefore, even if an attacker obtains another person's authority certificate C, the possibility of successful password authentication in the authentication procedure SB of FIG. 7 is extremely low. Furthermore, since the attacker cannot usually know the key pair of the node secret key Knpr and the node public key Knpb, it is extremely difficult to calculate the public authentication information Ioauth.

  In addition, when adopting public key authentication that is generally performed instead of password authentication, a general public key authentication authentication procedure should be used instead of the password authentication authentication procedure SB shown in FIG. Is possible.

  According to the present embodiment, the authority certificate C capable of password authentication can be obtained by adopting the method for issuing the authority certificate C described in FIG. According to the present embodiment, it is possible to authenticate that the user 2 is the owner of the authority certificate C by adopting the authentication method described in FIG. Thus, password authentication is realized.

  Next, update of authentication information will be described. According to the present embodiment, it is possible to update the authentication information in a so-called autonomous manner without depending on a third party such as an administrator. In the conventional distributed access control mechanism as described in Non-Patent Document 1, the secret of the first licensee of the authority certificate C (Alice who owns the root certificate in the example of FIG. 5) is included in the signature of the authority certificate C. I need a key. Therefore, the owner of the authority certificate C (Bob, Carol in the example of FIG. 5) after the delegation destination from the first licenser cannot autonomously update the authentication information. In this embodiment, the authentication information update procedure SC shown in FIG. 8 realizes autonomous update of the authentication information.

  The update procedure SC for updating the authentication information of the authority certificate C will be described with reference to FIG. The update procedure SC of the authority certificate C shown in FIG. 8 is an update method that is a part of the distributed access control method according to the embodiment, and is an update that is a part of the steps executed by the distributed access control program according to the embodiment. It is a step.

  Assume that the user 2 operates the terminal of the client 3 to input the authority certificate C to be updated and new authentication information (password p), and instructs the node 1nac to update the authority certificate C. In FIG. 8, the access control unit 11 receives the authority certificate C to be updated and the new password p in step SC1. The access control unit 11 verifies the authority certificate C in step SC2. A specific procedure of the verification procedure SF of the authority certificate C in step SC2 will be described later. The access control unit 11 authenticates that the user 2 is the owner of the authority certificate C at step SC3.

  The specific procedure of the authentication procedure SB that the user 2 in step SC3 is the owner of the authority certificate C is as described in FIG. However, in step SC3, the user 2 inputs the password p set when the authority certificate C to be updated in the authentication procedure SB is issued, and the node 1nac authenticates as shown in FIG.

  In step SC4, the access control unit 11 creates a new authority certificate C 'by copying the contents of the authority certificate C. In step SC5, the access control unit 11 generates public authentication information Ioauth from the new password p and sets it as a new authority certificate C '. In step SC6, the access control unit 11 sets the current time to the issuance date and time of the new authority certificate C ′, and uses the node secret key Knpr of the node 1nac that is going to update the authority certificate C in step SC7. Digitally sign and issue a new authority certificate C ′. In step SC8, the access control unit 11 returns the new authority certificate C 'to the user 2 and registers the new authority certificate C' in the CUL 16 of the plurality of nodes 1nac.

  As described above, even if the contents of the authority certificate C are updated, the certificate ID does not change. Therefore, the new authority certificate C ′ whose public authentication information Ioauth has been updated maintains the certificate ID of the authority certificate C before the update. The CUL 16 stores a new authority certificate C ′ obtained by updating the public authentication information Ioauth having the certificate ID of the authority certificate C before being updated. The CUL 16 will be described in detail later with reference to FIG. In addition, it will be described later in which node 1nac the new authority certificate C 'is stored in step SC8.

  Thus, in this embodiment, since the distributed access control mechanism 10ac (node 1nac) signs using the node secret key Knpr, the owner of the authority certificate C who intends to update the authority certificate C is the first It is possible to freely update the authentication information regardless of the licensee. When the user 2 can freely create and issue the authority certificate C as in the conventional distributed access control mechanism described in Non-Patent Document 1, when the authority certificate C is verified, You must check for an extension of the deadline. In this embodiment, since the distributed access control mechanism 10ac (node 1nac) issues the authority certificate C, it is possible to confirm whether the authority range has been expanded or the time limit has been extended at the time of issuance. Therefore, the verification cost can be reduced.

  Next, CRL 15 and CUL 16 will be described with reference to FIGS. In the conventional distributed access control mechanism described in Non-Patent Document 1, means for updating the authority certificate C is not explicitly provided. Accordingly, as described above, if the authority certificate C is to be updated, the issued authority certificate C is invalidated and a new authority certificate C is reissued. However, once the authority certificate is revoked, it causes a great side effect. Therefore, in the present embodiment, authority change without side effects is realized by using CUL16.

As shown in FIG. 9 (A), based on the authorization certificate C _A is issued right certificate C _B, right certificate C _C based on the authorization certificate C _B is issued, the authority certificate C _C An authority certificate _CD is issued based on this. Each certificate ID is described in the authority certificates C _{A to} C _D. Disabling right certificate C _B, as shown in FIG. 9 (B), the CRL15 by disabling the right certificate C _B is right certificate C _B are registered. In FIG. 9A and FIG. 10A, x indicates that it is invalid.

If any one certificate ID registered in the CRL 15 is registered in the CRL 15 in any authority certificate C, the authority certificate C becomes invalid. Accordingly, as shown in FIG. 9 (A), comprising a right certificate C _C which issue right certificate C _B, and invalid issued authorization certificates C _D based on the authorization certificate C _C .

On the other hand, the CUL 16 registers information indicating how the authority certificate C has been updated. FIG. 10 (A) shows a state in which right certificate C _B is updated to right certificate C _{B '.} Even if the authority certificate C _B is updated to the authority certificate C _B ′, the certificate ID does not change. As shown in FIG. 10 (B), it is registered that right certificate _{C B} is updated to right certificate _{C B} 'in CUL16. Here, the information is conceptually shown, and information in which the certificate ID of the authority certificate C before update is associated with the contents of the authority certificate C ′ after update is registered in the CUL 16. Since the certificate ID is unchanged, the updated authority certificate C ′ is registered in the CUL 16. In the example of FIG. 10 (A), the CUL16 shown in FIG. 10 (B), right certificate _{C B} updated with B0001 is a certificate ID of the pre-update right certificate _{C B} 'is registered .

  The update procedure SD when updating the authority information of the authority certificate C will be described with reference to FIG. The update procedure SD of the authority certificate C shown in FIG. 11 is an update method that is a part of the distributed access control method of one embodiment, and is an update that is part of the steps executed by the distributed access control program of the one embodiment. It is a step.

The user 2 operates the terminal of the client 3 to update the authority certificate C, the authority information newly set in the authority certificate C to be updated, and the authority certificate owned by the user 2 who is the updater Assume that C is entered and an authority change of the authority certificate C is instructed. The authority certificate C to update who owns the C _U. The access control unit 11, at step SD1, receiving the authorization certificate C to update, and authority information for setting new, the right certificate C _U that renewer owned.

A Bob is updated by in FIG. 5, the following applies for the case of updating the right certificate C _C that Carol owned, the access control unit 11, and authority certificates C _C of Carol to be updated, the newly set receiving the authority information, the authority certificate C _B that Bob owns. Hereinafter, it is assumed that suitably supplement the description of the case where Bob updates the right certificate C _C by Carol for ease of understanding.

In step SD2, the access control unit 11 verifies the authority certificate C (authority certificate C _C ) to be updated and the authority certificate CU (authority certificate C _B ) of the renewer. A specific procedure of the verification procedure SF of the authority certificate C in step SD2 will be described later. In step SD3, the access control unit 11 determines that the authority certificate CU (authority certificate C _B ) owned by the renewer is in the chained certificate list CCL of the authority certificate C (authority certificate C _C ) to be updated. To check if it exists. The fact that the authority certificate CU owned by the updater exists in the chained certificate list CCL of the authority certificate C to be updated means that the authority certificate C that is updated by the authority certificate CU owned by the updater is delegated. It is original.

If the authority certificate CU owned by the renewer does not exist in the chained certificate list CCL of the authority certificate C to be updated (NO), the access control unit 11 in step SD11, the authority certificate C ( The update of the authority certificate C _C ) is terminated with no permission.

If the authority certificate CU owned by the updater is present in the chained certificate list CCL of the authority certificate C to be updated (YES), the access control unit 11 shifts the processing to step SD4. In step SD4, the access control unit 11 determines whether or not the authority information to be newly set is legitimate without improperness such as extension of authority or extension of time limit, as compared with the authority certificate CU owned by the renewer. Check. If it is not valid (NO), the access control unit 11 terminates the update of the authority certificate C (authorization certificate C _C ) as non-permitted in step SD11.

If it is valid (YES), the access control unit 11 shifts the processing to step SD5. In step SD5, the access control unit 11 authenticates that the renewer is the owner of the authority certificate CU (authority certificate C _B ). The specific procedure of the authentication procedure SB that the updater of step SD5 is the owner of the authority certificate CU is as described in FIG. However, in step SD5, the user 2 inputs the password p set when the authority certificate CU owned by the renewer is issued, and the node 1nac authenticates as shown in FIG.

In step SD6, the access control unit 11 creates a new authority certificate C ′ by copying the contents of the authority certificate C to be updated (authority certificate C _C ). In step SD7, the access control unit 11 sets new authority information in the new authority certificate C ′. In step SD8, the access control unit 11 sets the current time as the issuance date and time of the new authority certificate C ′. In step SD9, the access control unit 11 performs a digital signature using the node secret key Knpr of the node 1nac itself to update the authority certificate C, and issues a new authority certificate C ′. In step SD10, the access control unit 11 stores the new authority certificate C ′ having the certificate ID of the authority certificate C to be updated (authority certificate C _C ) in the CUL 16 of the plurality of nodes 1nac, and ends. To do.

  In step SD10, which node 1nac stores the new authority certificate C 'will be described later. If the authority certificate C ′ is registered in the CUL 16 for the same certificate ID, it is overwritten with the authority certificate C ′ having the latest issue date.

  Here, a specific procedure of the node public key Knpb acquisition procedure SE of step SB3 in the authentication procedure SB of FIG. 7 will be described with reference to FIG. The node public key Knpb acquisition procedure SE shown in FIG. 12 is a node public key Knpb acquisition method that is a part of the distributed access control method of the embodiment, and is a step executed by the distributed access control program of the embodiment. This is a step of obtaining a node public key Knpb that is a part.

  In FIG. 12, the access control unit 11 acquires the issue date and time and the issuer node ID from the authority certificate C in step SE1. In step SE2, the access control unit 11 searches the node public key list for entry information that is a combination of the key pair start date and time corresponding to the issuer node ID, the node public key Knpb, and the leakage flag.

  In step SE3, the access control unit 11 acquires entry information having the latest issuance date / time of the authority certificate C and the newest use date / time from the key pair utilization start date / time. In step SE4, the access control unit 11 acquires the node public key Knpb and the leakage flag from the acquired entry information.

  As described above, the node public key list stores the node public keys Knpb of all the nodes 1nac from the past to the present. The node public key Knpb necessary for the verification procedure SF and authentication procedure SB of the authority certificate C is obtained even by the node 1nac that is not in charge of issuing or updating the authority certificate C by the acquisition procedure SE shown in FIG. Can be acquired.

  Next, with reference to FIG. 13, the authority certificate performed in the authority certificate C issuance procedure SA in FIG. 6, the authentication information update procedure SC in FIG. 8, and the authority certificate C update procedure SD in FIG. A specific procedure of the C verification procedure SF will be described. The verification procedure SF of the authority certificate C shown in FIG. 13 is a verification method of the authority certificate C that is a part of the distributed access control method of the embodiment, and is a step executed by the distributed access control program of the embodiment. This is a verification step for a part of the authority certificate C.

  In FIG. 13, the access control unit 11 confirms whether or not the current time is within the validity period of the authority certificate C in step SF1. If it is not within the valid period (NO), the access control unit 11 determines that the authority certificate C is invalid in step SF9 and ends. If it is within the validity period (YES), the access control unit 11 confirms in step SF2 that neither the authority certificate C nor all the authority certificates C included in the chained certificate list are invalid. To do. A specific procedure of the confirmation procedure SH in step SF2 will be described later.

  In step SF3, the access control unit 11 acquires the node public key Knpb and the leak flag used when issuing the authority certificate C from the node public key list. The node public key Knpb and leakage flag acquisition procedure SE in step SF3 is as described with reference to FIG. In step SF4, the access control unit 11 determines whether or not the leakage flag is a value indicating leakage. As described above, if the leakage flag is a value indicating leakage, it means that a situation in which leakage of the node secret key Knpr is suspected has occurred. If the leakage flag is a value indicating leakage (YES), the access control unit 11 determines that the authority certificate C is invalid in step SF9 and ends.

  If the leakage flag is not a value indicating leakage (NO), the access control unit 11 verifies the signature of the authority certificate C using the node public key Knpb in step SF5. Although not particularly illustrated, if the signature verification fails, the authority certificate C is determined to be invalid and the process ends. In step SF6, the access control unit 11 determines whether or not the authority certificate C has been updated. Whether or not the authority certificate C has been updated is determined by whether or not the authority certificate C having the same certificate ID as the certificate ID of the authority certificate C to be checked is registered in the CUL 16. Can be determined.

  If the authority certificate C has not been updated (NO), the access control unit 11 determines that the authority certificate C is valid in step SF7 and ends. If the authority certificate C has been updated (YES), the access control unit 11 updates the authority certificate C registered in the CUL 16 (that is, the latest authority certificate C ′) in step SF8. finish.

  The authority certificate C is always verified at the time of operation using the authority certificate C such as issuance and update of the authority certificate C, in addition to determining whether or not an operation request from the user 2 can be made. For this reason, at the time of verification by the verification procedure SF of FIG. 13, it is guaranteed that it is detected whether all the authority certificates C have been revoked in step SF2 and updated in step SF6.

For example, in FIG. 5, Alice is the right certificate C _A with to change the password is updated to right certificate C _{A '.} Consider the case an attacker attempts to access illegally to obtain distributed access control mechanism 10ac the password and the old authority certificate C _A of Alice. In this case, since the new authority certificate C _A ′ having the certificate ID of Alice's old authority certificate C _A is registered in the CUL 16, the authority certificate C _A is replaced with the latest authority certificate C _A ′. Is done. Therefore, the authentication by the authentication procedure SB in FIG. 7 fails.

As another example, as shown in FIG. 5, when Bob only allows Carol to read /bob/foo.doc as a resource, and later it is necessary to also allow writing to that resource think of. Because Bob's right certificate C _B that includes a write privileges, the update procedure SD authority certificate C described above, Bob has a new authority certificate C 'plus the authority of writing Carol new authorization certificate It can be registered in CUL 16 as C _C ′. Carol does not need to be aware of the update of the authority certificate C _C by Bob, if you run the writing process using the old authority certificate C _C before the update that Carol had, the old authority certificate C _C The writing process is permitted by being replaced with the latest authority certificate _CC ′.

  In the present embodiment, information necessary for the distributed access control mechanism 10ac to control access when accessing the distributed file system 10 is included in the authority certificate C. Each node 1nac does not need to hold information necessary for access control except for the node path table 13, the node public key list 14, CRL15, and CUL16, and each node 1nac independently performs access control. Can be executed. Therefore, in this embodiment, by increasing the number of nodes 1nac that execute access control, it becomes possible to easily eliminate the single point of failure and scale out the performance.

  The node path table 13 is necessary for communication between the nodes 1nac, and the node public key list 14 is necessary for verification of the authority certificate C, password authentication, and the like. Therefore, the node path table 13 and the node public key list 14 are information necessary for all the nodes 1nac constituting the distributed access control mechanism 10ac. The frequency of adding / leaving the node 1nac or updating the key pair is sufficiently lower than the frequency of invalidating or updating the authority certificate C. The data capacity of the node path table 13 and the node public key list 14 is not so large. Therefore, all the nodes 1nac hold the node path table 13 and the node public key list 14 in common. Every node 1nac holds the same information as the node path table 13 and the node public key list 14.

  The CRL 15 and the CUL 16 need to be able to be referenced by all the nodes 1nac in order to check whether the authority certificate C transmitted from the user 2 (client 3) is invalid. If a particular node 1nac holds CRL 15 or CUL 16, that particular node 1nac becomes a single point of failure and at the same time becomes a bottleneck that prevents performance from being scaled out. Therefore, in this embodiment, the CRL 15 and the CUL 16 are distributed, further redundant, and held in the plurality of nodes 1nac.

  As described above, when the CRL 15 and CUL 16 held by each node 1nac are collected by all the nodes 1nac of the distributed access control mechanism 10ac, a certificate revocation total list and a certificate renewal total list are obtained. That is, the certificate revocation total list and the certificate renewal total list are held so as to extend over all nodes 1nac in a form divided into a plurality of CRLs 15 and CULs 16.

  In the present embodiment, the CRL 15 and the CUL 16 are dispersed using a consistent hashing method (Consistent Hashing). A method for distributing CRL 15 and CUL 16 using the consistent hash method will be described with reference to FIG. As shown in FIG. 14, it is assumed that the node ID of each node 1nac is 0, 150, 300, 450, 600, 750. A plurality of nodes 1nac shown in FIG. 14 is a full mesh network as described with reference to FIG. 2, and it is possible to directly communicate with another target node 1nac by referring to the node route table 13. .

  A hash value is obtained by a hash function from the contents of the authority certificate C to be invalidated. Assume that the hash value is 400. The hash function here does not have to satisfy the one-way property, and it is sufficient that the uniformity is satisfied. In the node 1nac arranged in the circular hash space shown in FIG. 14, the node 1nac closest to the hash value 400 in the forward direction is the node 1nac having a node ID of 450. Therefore, the authority certificate C to be revoked is stored in the node 1nac having the node ID 450, and a copy of the authority certificate C to be revoked is stored in the nearby node 1nac. When the redundancy number is r, a copy of the authority certificate C to be invalidated is stored in (r-1) nodes 1nac. FIG. 14 shows a case where the redundancy number r is 3, and the nearby node 1nac is the node 1nac with node IDs 600 and 750.

  When distributing the CRL 15 and CUL 16 using the consistent hash method, the node ID value to be assigned to each node 1nac may be set depending on the range in which the hash value of the authority certificate C is distributed. .

  The authority certificate C revocation procedure SG (registration procedure to the CRL 15) will be described with reference to FIG. The authority certificate C revocation procedure SG shown in FIG. 15 is a method for revoking the authority certificate C, which is a part of the distributed access control method of the embodiment, and is executed by the distributed access control program of the embodiment. This is a step of invalidating the authority certificate C which is a part of the step.

Assume that the user 2 operates the terminal of the client 3 and inputs the authority certificate C to be invalidated and the authority certificate C owned by the user 2. The right certificate C that the user 2 is owned by the procedure of the invalidation and C _U. 15, the access control unit 11 of the node 1nac, at step SG1, receive authorization certificate C _U owning the right certificate C to deactivate. It will be referred to as authority certificates C, and node 1nac having received the C _U and processing nodes. In FIG. 14, illustration of processing nodes is omitted.

The access control unit 11 of the processing node, at step SG2, verifies the authorization certificate C _U owning the right certificate C to deactivate. The specific procedure of the verification procedure SF is as described with reference to FIG. The access control unit 11 of the processing node, at step SG3, the same as the right certificate C that right certificate C _U owned invalidates, confirms whether there exists in the chain certificate list CCL.

Right certificate C _U is not the same as the right certificate C, unless present in a chain certificate list CCL (NO), the user 2 is not authorized to disable authorization certificate C which attempted to invalidate Therefore, the process ends as invalidation is not established in step SG10. Or right certificate C _U is the same as the right certificate C, if present in the chain certificate list CCL (YES), the access control unit 11 of the processing node, at step SG4, the procedure of invalidation user 2 it is to authenticate that it is the owner of the right certificate C _U. The specific procedure of the authentication procedure SB is as described with reference to FIG.

  The access control unit 11 of the processing node obtains the hash value of the authority certificate C in step SG5, and transfers the authority certificate C to the nearest node 1nac based on the hash value in step SG6. In the example of FIG. 14, the node 1nac with the node ID 450 is the transfer destination node. This transfer destination node is referred to as a responsible node.

  In step SG7, the access control unit 11 of the responsible node registers the authority certificate C in the CRL 15 of its own CRL 15 and (r-1) nodes 1nac for copy storage. In step SG8, the access control unit 11 of the responsible node notifies the transfer source processing node of the completion of the invalidation. In step SG9, the access control unit 11 of the processing node notifies the user 2 who has performed the invalidation procedure of the completion of the invalidation.

  In FIG. 15, in step SG7, the responsible node performs (r−1) communications to store a copy of the authority certificate C in the CRL 15 of the nearby node 1nac. It is guaranteed that the r nodes 1nac hold the configuration information (authority certificate C) of the CRL 15 at the time when the completion of the invalidation is notified. As a result, even if (r−1) nodes 1nac fail at the same time, the data in the CRL 15 is not lost.

  With reference to FIG. 16, a specific procedure of the verification procedure SH for revocation of the authority certificate C, which is step SF2 of the verification procedure SF, will be described. The confirmation procedure SH shown in FIG. 16 is a method for confirming the invalidation of the authority certificate C, which is a part of the distributed access control method of the embodiment, and is a part of the steps executed by the distributed access control program of the embodiment. This is a confirmation step of revocation of the authority certificate C. Here again, the node 1nac for confirming the invalidation of the authority certificate C is referred to as a processing node.

  In FIG. 16, the access control unit 11 of the processing node obtains the hash value of the authority certificate C in step SH1. A method for obtaining the hash value of the authority certificate C will be described later. In step SH2, the access control unit 11 of the processing node obtains the node 1nac holding the corresponding CRL 15 including the copy from the hash value of the authority certificate C. The node 1nac that holds the CRL 15 is referred to as a holding node.

  In step SH3, the access control unit 11 of the processing node sends the certificate ID of the authority certificate C to any connectable node among the holding nodes. In step SH4, the access control unit 11 of the holding node confirms whether or not the authority certificate C that matches the transmitted certificate ID is registered in the CRL 15, and sends the confirmation result to the processing node. If registered (YES), the access control unit 11 of the processing node notifies the processing node that it has been invalidated and ends. If it is not registered (NO), the access control unit 11 of the processing node notifies the processing node that it has not been invalidated and ends.

  The authority certificate C can be revoked from any node 1nac by the revocation procedure SG and revocation confirmation procedure SH of the authority certificate C, and it is confirmed whether or not it has been revoked. can do. When verifying the authority certificate C, it is checked whether the authority certificate C having the certificate ID included in the chained certificate list CCL is invalidated in addition to the authority certificate C to be verified. . Accordingly, the confirmation procedure SH in FIG. 16 is repeated by the number of authority certificates C to be chained. At this time, when confirming revocation of a plurality of authority certificates C by referring to the CRL 15 for the same node 1nac, the number of communications can be reduced by confirming the plurality of authority certificates C together. Is preferred.

  In step SH3 of FIG. 16, the certificate ID of the authority certificate C may be sent to any one of the hold nodes that can be connected. At the same time, even if (r-1) nodes 1nac fail, there is one node 1nac that can be connected, and it becomes possible to confirm the invalidation in step SH4.

  The procedure for registering and decentralizing the updated authority certificate C in the CUL 16 is not particularly illustrated, but is substantially the same as the procedure for registering and decentralizing the invalid authority certificate C in the CRL 15 described in FIG. is there. However, the following points are different. In the procedure for registration and decentralization in the CUL 16, in step SG7 in FIG. 15, as described in FIG. 10, the latest authority certificate C ′ having the certificate ID of the authority certificate C before update is registered. .

  Although the confirmation procedure for updating the authority certificate C is not particularly illustrated, it is almost the same as the confirmation procedure SH for invalidating the authority certificate C described with reference to FIG. However, the following points are different. In the confirmation procedure for updating the authority certificate C, if the authority certificate C that matches the certificate ID sent in step SH4 is registered in the CUL 16, the latest authority certificate C ′ is processed in step SH5. Return to

By the way, various methods for obtaining the hash value of the authority certificate C are conceivable, for example, the following methods a and b.
Method a: Hashing the certificate ID of the authority certificate C whose hash value is to be obtained.
Method b: The roots of the authority certificate C described in the chained certificate list CCL of the authority certificate C whose hash value is to be obtained are arranged in order. Then, the certificate ID of the L-th authority certificate C is hashed from the root certificate at the head. However, if the length of the authority certificate C described in the chained certificate list CCL is smaller than L, the certificate ID of the authority certificate C whose hash value is to be obtained is hashed. In this case, it is the same as method a.

Right certificate _C A as shown in FIG. _9, C _B, C C, and then _{C D} linkage, right certificate _{C B,} C C, when registering a _{C D} to CRL15 and disable each method b The case where is adopted will be described. If L is 2, for example, the authority certificates C _{B to} C _D are all registered in the CRL 15 of the same node 1nac. Similarly, when the 2 L in case of disabling all right certificate _C A -C _D, all right certificate _C B -C _D is registered in CRL15 the same node 1Nac, the right certificate _{C A} privilege The certificates are registered in the CRL 15 of the node 1nac different from the certificates C _{B to} C _D. If L is 1, all authority certificates C _{A to} C _D are registered in the CRL 15 of the same node 1nac.

  Since the method a can obtain an unbiased hash value for all authority certificates C, the invalid authority certificate C is distributed evenly to the CRLs 15 of the plurality of nodes 1nac constituting the distributed access control mechanism 10ac. Will be. The method a is a preferable method when it is intended to realize an unbiased distribution.

  On the other hand, in method b, the hash value is biased under specific conditions. The authority certificate C issued by delegation of L times or more always has the same hash value if the authority certificate C of the delegation source is the same in the L-th delegation. Therefore, the authority certificate C issued by the Lth and subsequent delegations is registered in the CRL 15 of the same node 1nac when it is invalidated. When confirming the invalidation of the authority certificate C chained in the above-described invalidation confirmation procedure SH, in the method b, no matter how long the chain of the authority certificate C is, the CRL 15 of at most L nodes 1nac is stored. You can refer to it. The method b is a preferable method when it is desired to reduce the number of times of communication (communication cost) with the node 1nac other than the node 1nac (processing node) with which the client 3 communicates.

  Furthermore, if the following measures are taken, the communication cost for verifying the authority certificate C can be reduced to zero. Method b is adopted and L is set to 2. When distributing the revoked authority certificate C to a plurality of nodes 1nac as described in FIG. 14, the redundant number r is set to the number n of nodes 1nac constituting the distributed access control mechanism 10ac only for the root certificate. That is, when invalidating the root certificate, the root certificate is registered in the CRL 15 of all the nodes 1nac of the distributed access control mechanism 10ac. When the root certificate is invalidated, (n-1) times of communication occurs.

  As described above, when the client 3 accesses the distributed access control mechanism 10ac, the access from the client 3 is allocated to one node 1nac. At this time, the access from the client 3 is allocated to the node 1nac having the CRL 15 for registering the second authority certificate C among the chained authority certificates C including the authority certificate C used by the client 3. To do. The CRL 15 for registering the second authority certificate C is a CRL 15 to be registered when the second authority certificate C is invalidated when the second authority certificate C is not invalidated. That's what it means.

  By applying such a device, in the verification procedure SF of the authority certificate C, when confirming whether all the authority certificates C included in the chained certificate list CCL are invalidated, the client 3 It can be confirmed only by the node 1nac to which the access is assigned. Therefore, there is no need to communicate with another node 1nac, and the communication cost when verifying the authority certificate C is zero.

  Next, a countermeasure for further improving the security of the distributed access control mechanism 10ac of this embodiment will be described. As a measure 1 for improving the security of the distributed access control mechanism 10ac, each node 1nac preferably updates the key pair of the node secret key Knpr and the node public key Knpb that it holds regularly. Since the old node secret key Knpr before the update is discarded, the security is improved.

  Assuming that the attacker has entered the node 1nac, the node 1nac may set the leakage flag of the node public key list only for the entry during the entry period if the entry time can be specified. As a result, the authority certificate C to be invalidated can be limited, and it is possible to minimize the influence when a situation in which the leakage of the node secret key Knpr is suspected occurs.

  As a measure 2 for improving the security of the distributed access control mechanism 10ac, when the authority certificate C is issued or renewed, a plurality of m nodes 1nac confirm the same, and m authority certificates C are included. It is preferable to include the issuer node ID and signature. When each node 1nac verifies the authority certificate C, the authority certificate C is validated when m signatures are included and all the signatures are valid in the authority certificate C verification procedure SF. To do. In this way, although the cost of issuing and updating the authority certificate C is increased by m times, unauthorized access cannot be made unless the node secret key Knpr is leaked from the m nodes 1nac.

  If the node secret key Knpr is leaked from (m-1) nodes or less, it is not necessary to invalidate the existing authority certificate C even after the leak is detected. Even if it is discovered that the node secret key Knpr has been leaked from m or more nodes 1nac, all of the authority certificates C other than the authority certificate C signed with m leaked node secret keys Knpr There is no need to disable. Therefore, even with the measure 2, it is possible to minimize the influence when a situation in which the leakage of the node secret key Knpr is suspected occurs.

  It is more preferable to combine the measures 1 and 2. Since the signatures of the m nodes 1nac are almost simultaneously performed, the node secret key Knpr in the same time zone is used. Even if the attacker obtains the node secret key Knpr in at least two different time periods across the key pair update cycle, the verification of the authority certificate C fails. By shifting the update cycle and update timing of the key pair for each node 1nac, it is possible to make the attack difficult to succeed.

  The present invention is not limited to the embodiment described above, and various modifications can be made without departing from the gist of the present invention. When the distributed access control program is installed in the node 1nac constituting the distributed access control mechanism 10ac, the distributed access control program may be distributed to the node 1nac. The distributed access control program may be recorded on a recording medium, and the distributed access control program may be installed from the recording medium at each node 1nac.

  By the way, how to store resources and how to distribute resources in the distributed file system 10 is not directly related to the present invention. How to store and distribute resources Is optional.

  The present invention is not limited to the distributed file system 10 and can be used for any distributed system that executes predetermined processing in a distributed manner.

1n, 1nac node 2, 2a, 2b, 2c user 3, 3a, 3b, 3c client 10 distributed file system (distributed system, server)
10ac distributed access control mechanism 11 access control unit 12 node ID
13 Node routing table 14 Node public key list 15 Certificate revocation list (CRL)
16 Certificate renewal list (CUL)
C, C _A , C _B , C _C authority certificate CCL chained certificate list
Knpr node private key
Knpb node public key

Claims (2)

When accessing a server from a client, the server is accessed via any one of the plurality of nodes in the distributed access control mechanism configured with a plurality of nodes,
When making an operation request from the client to the server, the operation request is sent to one of the nodes along with an authority certificate,
The authority certificate is issued by sequentially delegating authority starting from the root certificate, and specifies the authority certificate of all delegation sources from the root certificate to the authority certificate that is the previous delegation source Contains a chained certificate list showing information,
If any root certificate is revoked, all nodes of the plurality of nodes register the revoked root certificate,
If any authority certificate after the authority certificate issued with the specified root certificate as the delegation source is revoked, any certificate after the authority certificate issued with the predetermined root certificate as the delegation source Even if it is an authority certificate, the predetermined root certificate is registered in a specific node determined based on the specific information of the authority certificate issued as a delegation source,
The distributed access control method, wherein the specific node is accessed when the client sends the operation request together with the authority certificate to the node. A unique node ID is set for each of the plurality of nodes,
Each authority certificate has a certificate ID as the specific information,
A node having a node ID selected based on a hash value obtained by hashing a certificate ID of an authority certificate issued using the predetermined root certificate as a delegation source is selected as the specific node;
2. The distributed access control method according to claim 1, wherein all invalid authority certificates after the authority certificate issued with the predetermined root certificate as a delegation source are registered in the specific node.

Images