JP2013182436A - Access authority delegation system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To solve problems in which a customer cannot generally approve a permission to access to own data for service providers having different management systems such as tenants in a conventional method of giving a permission from an administrator to a general person, and a customer who is on the side of giving an access authority must perform a complicated operation of giving a roll or a user a permission to access to each piece of data.SOLUTION: An access authority delegation system performs an access permission request from an access tenant (service provider) to a data owner tenant (customer), an administrator of the data owner tenant performs an approval operation in response to the access permission request, and access to data in a customer tenant is performed on the basis of the approval.

Description

  The present invention relates to a system used by a service provider to collect and manage data by entrusting work from a customer.

  The cloud service manages tenants, separates data in units of tenants, and a user can access only data in the tenant to which the user belongs, and access to other tenants is not permitted. However, in order for a service provider to be outsourced by a customer and manage customer data, the service provider must be able to access customer data to be stored in the customer tenant.

  As described above, there is no technology for realizing access from one tenant to data of another tenant.

  The service provider cannot perform the service unless the customer data can be accessed. However, since the customer data may include personal information and confidential information, the service provider is required to be able to access after being approved in advance by the customer.

  Patent Document 1 discloses a role-based access control method, in which access is permitted for each role for each data item and function, and access to the data object and function object is determined by the role set by the user.

JP 2010-108170 A

  In the access control method as described above, access to data and functions is controlled. In general, an administrator gives authority to general users. For this reason, it is impossible to realize that a customer approves access permission for his / her data to service providers with different management systems such as tenants. In addition, there is a problem that a customer who is an access authority must perform a complicated operation of granting access permission to each data for a role or a user.

  In order to solve the above problems, an access management system according to the present invention is a system in which a host computer and a management server are connected to a network, and has the following characteristics.

  A means for managing tenants, a data management means for managing specific data for each tenant, and an access permission request for issuing an access permission request to the second tenant from the first tenant to the second tenant Has issuing means.

  Further, the access permission request information storage means for storing the access permission request information, and the second tenant has an access permission approval means for approving an access permission request from the first tenant. Approval information indicating that the approval has been performed is additionally stored in the access permission request information stored in the access permission request information storage means (403). Then, when the first tenant tries to access the data of the second tenant, “access permission request information from the first tenant to the second tenant” is acquired from the access permission request information storage unit. When the approval information (704) is stored, access to the data is permitted.

  According to the present invention, in a system that separates data in units of tenants like a cloud service, the first tenant data is required based on the access request from the second tenant and the approval from the first tenant. Permitted within the range.

It is a figure which shows the structure of the access management system which concerns on Example 1 of this invention. 2 is a diagram showing an internal configuration of host computers 101 and 102 and a management server 103. FIG. 2 is a diagram showing a functional configuration of host computers 101 and 102. FIG. 3 is a diagram illustrating a functional configuration of a management server 103. FIG. It is a figure which shows the structure of the tenant management table managed by the management server 103. It is a figure which shows the structure of the user management table managed by the management server 103. FIG. 3 is a diagram showing a configuration of an access permission management table managed by a management server 103. FIG. It is a figure which shows the example of a structure of the data table for every tenant managed by the management server 103. FIG. It is a flowchart which shows the flow of a user authentication process. It is a flowchart which shows the flow of a customer registration process. It is a flowchart which shows the flow of an access permission recognition process. It is a flowchart which shows the flow of an access right check process. 6 is a diagram showing an example of a customer registration / access permission request setting screen displayed on the host computer 101. FIG. 6 is a diagram showing an example of an access permission approval setting screen displayed on the host computer 102. FIG.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. The following embodiments do not limit the scope of the claims, and all combinations of features described in the embodiments are not necessarily essential to the solution means of the invention.

<Example 1>
[Overall system configuration (Figure 1)]
The access management system includes host computers 101 and 102 and a management server 103. The host computers 101 and 102 and the management server 103 are communicably connected via a network 105 using a known technology such as a LAN or the Internet.

  The host computer 101 is used by a service provider user. The service provider user uses a service provided by the management server from the host computer 101 or operates customer data held in the management server. In addition, the customer tenant is registered in the management server, and an access permission request process for the customer is performed.

  The host computer 102 is used by customer users. The customer user uses a service provided by the management server from the host computer 102 or operates customer data held in the management server. In addition, an instruction to approve or reject the access permission request from the service provider is given.

  The management server 103 manages a plurality of service provider tenants and customer tenants, and manages each user information. Further, data is managed separately for each tenant, and when accessed by a user belonging to each tenant, the user permits access to the data of the belonging tenant. Further, when there is an access with an access token added, the access token is verified, and when the access token is a regular access token, the access token permits access to tenant data based on the authorization information.

  In this embodiment, the management server 103 is described as being configured by a single server, but the functional configuration of the management server may be divided into a plurality of management servers.

[Configuration of host computers 101 and 102]
(Internal structure (Fig. 2))
The host computer 101 includes a CPU 201 that executes software stored in a ROM 202 or a hard disk 211 that is a large-scale storage device. The CPU 201 generally controls each device connected to the system bus 204. The RAM 203 functions as a main memory, work area, and the like for the CPU 201. A keyboard controller 205 (KBDC) controls an instruction input from a keyboard 209 provided in the host computer 101. The display controller 206 (DISPC) controls the display of the display module 210 (DISPLAY) configured with, for example, a liquid crystal display. The disk controller 207 (DKC) controls the hard disk 211 (HD). The network interface card 208 (NIC) exchanges data bidirectionally with other nodes via the network 105.

(Functional configuration (Fig. 3))
The host computer 101 includes a web browser 301 and an HTTP communication unit 302.

  The web browser 301 interprets the HTML data, draws a screen on the display module 210, accepts a user operation from a keyboard or the like, and transmits a request to the HTTP communication unit 302. The HTTP communication unit 302 receives a communication request from a Web browser, communicates with the image processing apparatus or the like via the NIC 208 and the management server 103 using the HTTP or HTTPS protocol, requests a Web page, receives Web page data, and the like. I do.

[Configuration of Management Server 103]
(Internal structure)
The internal configuration is the same as that of the host computer 101 (see FIG. 2).

(Functional configuration (Fig. 4))
The management server 103 includes an interface unit 401, a tenant / user management unit 402, an access permission management unit 403, and a data management unit 404.

  The interface unit 401 communicates with the host computers 101 and 102 via the NIC 208 and the network 104. When there is a request to the Web page by HTTP / HTTPS from the host computer, the interface unit 401 determines the authentication, access permission state, and the like, and then returns HTML data.

  The tenant / user management unit 402 includes a tenant management table 4021 and a user management table 4022, and performs user authentication processing for each tenant.

  The access permission management unit 403 includes an access permission management table 4031 and manages access permission request information from the service provider tenant to the customer tenant, access permission approval information from the customer tenant, and an access token.

  The data management unit 404 includes a data table 4041 for each tenant. Although only one data table for each tenant is shown in the figure, a plurality of tables may exist for each data.

(Table structure)
Hereinafter, the configuration of each table managed by the management server 103 will be described with reference to FIGS.

(Tenant management table (Fig. 5)
The tenant ID 501 is a column that stores an ID for identifying a tenant.

  The tenant name 502 is a column for storing the display name of the tenant set by the user.

  The tenant type 503 is a column that stores information for determining whether each tenant is a tenant used by a service provider or a tenant used by a customer.

  For example, a row 511 indicates a service provider tenant whose tenant ID is “service provider 1” and whose tenant name is “▲▲ corporation”.

(User management table (FIG. 6))
The tenant ID 601 is a column that stores a tenant ID for identifying the tenant to which the user belongs.

  A user ID 602 is an ID for identifying a user. Issued to be unique at least for each tenant.

  The password 603 is a column for storing a password that is input together with the user ID when the user logs in to the system.

For example, a row 611 indicates a user who belongs to the tenant: service provider 1, has a user ID kato, and a password xxxxx (access permission management table (FIG. 7)).
The owner tenant 701 is a column that stores the tenant ID of a tenant who has data ownership and service usage rights.

  The access tenant 702 is a column that stores the ID of the tenant who has requested access permission for the data and services of the tenant indicated by the owner tenant 701.

  The access permission request 703 is a column indicating which type of data and service the access tenant 702 requests access permission. When there are a plurality of data and services to be accessed, a plurality of types of the data and services are stored.

  The permitted data service 704 is a column that stores data and services that the user of the owner tenant 701 has permitted and approved access to the tenant indicated by the access tenant 702. When there are a plurality of data and services that are permitted / approved for access, a plurality of types of the data and services are stored.

  The access token 705 is a column that stores authorization information indicating that a specific data service of the tenant of the owner tenant 701 can be accessed.

  For example, in row 711, an access permission request for data 1 and data 2 is issued from the service provider 1 tenant to the data service of the customer 1 tenant. Then, it is shown that an access permission request is approved for data 1 and data 2 by the customer 1 tenant.

(Data table for each tenant (Fig. 8))
The tenant ID 801 is a column that stores the tenant ID of a tenant having data ownership.
Data 1 802 and data 2 803 are columns for storing data used in the service. In this figure, there are two data strings, but the number, data type, etc. are arbitrary.

  For example, a row 812 is data owned by the customer 1 tenant. Data 1 can be BBB and data 2 can be 222.

(Processing flow)
Hereinafter, the flow of processing performed in the host computers 101 and 102 and the management server 103 will be described using the flowcharts of FIGS. 9 to 12 and the screen examples of FIGS.

(User authentication process (FIG. 9))
In the host computers 101 and 102, the user uses the web browser 301 to transmit a screen display request to the management server 103. When the request is received by the interface unit 401, the management server 103 confirms the session information based on cookie information or the like, and determines whether the request has already been authenticated. If not authenticated, the user authentication process shown in FIG. 9 is performed.

  A flow of user authentication will be described.

  In step 901, user authentication processing in the management server 103 is started.

  In step 902, the interface unit 401 creates HTML data indicating a login screen and transmits it to the host computer via the network. In the host computer, the HTTP communication unit 302 receives the HTML data, and the Web browser 301 analyzes the HTML data and displays a login screen.

  In step 903, the user inputs the user ID, password, and tenant ID on the login screen. The input information is transmitted to the management server 103 via the HTTP communication unit 302.

  In step 904, the interface unit 401 of the management server 103 transmits the received user ID, password, and tenant ID to the tenant / user management unit 402. Upon receiving these, the tenant / user management 402 refers to the user management table 4022 to check whether there is a user that matches these three information, and determines that the user is a valid user if there is a matching user. .

  If it is determined in step 905 that the user is a valid user in step 904, the process proceeds to step 906. Otherwise, the process proceeds to step 905, where it is determined that the authentication has failed and the interface unit 401 is notified.

  In step 905, the tenant / user management unit 402 notifies the interface unit 401 that the authentication has failed. Then, the interface unit 401 creates HTML data for notifying the interface login failure, transmits it to the host computer, and ends the user authentication process.

  In step 906, the tenant / user management unit 402 notifies the interface unit 401 that authentication is successful. The interface unit 401 sets the user ID and the tenant ID to which the user belongs in the session information. At this time, information indicating that the authentication has been authorized by the management server, such as signature information, may be additionally set in the session information.

  The interface unit 401 further creates HTML data of the Web page requested from the host computer and transmits it to the host computer.

(Customer registration process (FIGS. 10 and 13))
The customer registration and access permission request processing will be described with reference to FIGS.

  In step 1001, the service provider user accesses the management server 103 from the host computer 1 and requests display of a customer registration / access permission request screen. After the user authentication process, the management server 103 creates HTML data of the customer registration / access permission request screen, transmits it to the host computer 1, and displays the customer registration / access permission request screen on the Web browser of the host computer 1.

  (Customer registration / access permission request setting screen displayed on the host computer 101 (FIG. 13)).

  FIG. 13 is an example of a customer registration / access permission request screen.

  Reference numeral 1301 denotes a customer registration / access permission request screen.

  Reference numeral 1302 denotes a text box for setting a tenant ID of a customer tenant to be registered.

  Reference numeral 1303 denotes a text box for setting the tenant name of the customer tenant to be registered.

  Reference numeral 1304 denotes a check box for selecting a service or data for making an access permission request to the customer tenant specified in the above 1302 and 1303.

  Reference numeral 1305 denotes an “OK” button for confirming input information.

  Reference numeral 1306 denotes a “Cancel” button for canceling the customer registration process.

  In step 1002, the service provider inputs customer tenant information and access permission request information on the customer registration / access permission request setting screen 1301 and presses an “OK” button. The input information is transmitted to the interface unit 401 of the management server 103 via the HTTP communication unit.

  In step 1003, the interface unit 401 acquires the user tenant ID from the customer tenant ID, access permission request information, and session information transmitted from the host computer, and transmits the acquired user tenant ID to the access permission management unit 403.

  The access permission management unit 403 registers an access permission record in the access permission management table as follows.

Owner tenant 701 = Customer tenant ID
Access tenant 702 = User tenant ID
Access permission request 103 = service data permission data service 704 specified by the access permission request information = (empty)
In this record, the access permission request 103 is set, but the permission data service 704 is not set, which indicates that access is not permitted from the customer tenant. For example, the state is as shown in a row 712 in FIG.

  This completes the customer registration and access permission request processing.

(Access permission approval process (FIGS. 11 and 14))
The access permission approval process will be described with reference to FIGS.

  In step 1101, the customer user accesses the management server 103 from the host computer 2 and requests display of an access permission approval setting screen. The management server 103 undergoes user authentication processing, and the interface unit 401 acquires the tenant ID to which the customer user belongs from the session information and transmits it to the access permission management unit 403. The access permission management unit 403 acquires a row (access permission record) in which the customer user's belonging tenant ID matches the owner tenant 701 from the access permission management table 4031 and transmits it to the interface unit 401.

  In step 1102, the interface unit 401 refers to the access permission record acquired by the access permission management unit 403, creates HTML data of an access permission approval setting screen, and transmits it to the host computer 2. The host computer 2 analyzes the received HTML data and displays an access permission approval setting screen with a Web browser.

  (Access permission approval setting screen displayed on the host computer 102 (FIG. 14)).

  FIG. 14 is an example of an access permission approval setting screen.

  Reference numeral 1401 denotes an access permission approval setting screen.

  1402 displays the tenant name and tenant ID of the service provider that has requested access permission, and indicates to which service provider the access permission is to be made.

  Reference numeral 1403 denotes a check box for selecting which data service access permission is approved for the service provider tenant displayed in 1402 above.

  Reference numeral 1404 denotes an “OK” button for confirming the input information.

  Reference numeral 1405 denotes a “Cancel” button for canceling the access permission approval process.

  In step 1103, the customer user selects a data service for approving access permission on the access permission approval setting screen 1403. Thereafter, when the “OK” button is pressed, it is determined that the input information has been confirmed, and the information input on the setting screen for access permission approval is transmitted to the interface unit 401 of the management server 103, and the process proceeds to step 1105.

  If Cancel is pressed, access permission approval is canceled.

  In step 1105, the interface unit 401 transmits signature information and the like from the customer user session information and the data service information approved for access permission to the tenant / user management unit 402, and requests issuance of an access token. Upon receiving an access token issuance request, the tenant / user management unit 402 creates an access token indicating that the data service approved for the access permission of the tenant to which the customer user belongs can be accessed. Then, the data is transmitted to the interface unit 401.

  In step 1106, the interface unit 401 transmits, to the access permission management unit 403, the owner tenant 701, the access tenant 702, data service information for which access permission has been approved, and the access token.

  The access permission management unit 403 registers the access permission approval information and the 705 access token in the row 704 that matches the information received by the owner tenant 701 and the access tenant 702 of the access permission management table.

  For example, when the access permission to the data 1 and the data 2 is approved, the state becomes as shown in the row 711 in FIG.

  This is the end of the access permission approval process.

(Access right check process (FIG. 12))
Next, an access right check flow when a service provider user tries to access a customer's data service will be described with reference to FIG.

  The service provider user accesses the management server 103 from the host computer 1, displays the customer tenant list, and selects a customer who needs access to the data service from the customer tenant list.

  The Web browser 301 transmits the tenant ID of the selected customer tenant together with a data service access request to the interface unit 401 of the management server 103 via the HTTP communication unit 302.

  In step 1201, the interface unit 401 acquires the service provider user's belonging tenant ID from the session information.

  In step 1202, the interface unit 401 acquires the customer tenant ID selected by the login user from the request, and transmits these to the access permission management unit 403.

  In step 1203, the access permission management unit 403 acquires a row (access permission record) that matches the following condition from the access permission management table 4031 and transmits it to the interface unit 401.

Owner tenant 701 = Customer tenant ID
Access tenant 702 = Tenant ID to which the service provider user belongs
In step 1204, the access permission management unit 403 refers to the permission data service 704 in the access permission record acquired to determine whether access permission has been approved. If the data service is set in the permitted data service 704, it is determined that the data service is approved, and the process proceeds to step 1206. Otherwise, go to Step 1205.

  In step 1205, since the access permission is not approved, the access is not permitted, and the interface unit 401 is notified that the data access to the customer tenant is denied. When the request from the host computer 1 is an operation menu display for the customer tenant, the interface unit 401 creates HTML data including only a menu that does not require access permission approval and transmits the HTML data to the host computer 1.

  In step 1206, the access permission management unit 403 acquires information on the permission data service 704 and the access token 705 from the access permission record, and returns them to the interface unit 401.

  In step 1207, the interface unit 401 transmits an access token and request information from the host computer to the data management unit 404. The data management unit refers to the request and the access token, and determines whether the access destination customer tenant specified in the request and the data service to be accessed are authorized by the access token. If authorized, access to the data is determined to be permitted, and the row where the tenant ID 801 matches the customer tenant ID is accessed from the data table for each tenant. If the request is data acquisition, the corresponding row is acquired. If the request is a data update, the corresponding row is updated. If the request is data registration, the corresponding line is registered. The data management unit 404 transmits the acquisition, update, and registration results to the interface unit 401.

  The interface unit 401 creates HTML data using the processing result and transmits it to the web browser 301 of the host computer 1.

101 Host computer 102 Host computer 103 Management server

Claims (8)

An access authority delegation system in which a host computer (101, 102) and a management server (103) are connected to a network (104),
Means for managing tenants (402, 4021);
Data management means (404) for managing specific data for each tenant;
An access permission request issuing means (1301) for issuing an access permission request for data of the second tenant from the first tenant to the second tenant;
Access permission request information storage means (403) for storing the access permission request information;
An access permission approval means (1401) for the second tenant to approve an access permission request from the first tenant;
Approval information indicating that the approval has been performed is additionally stored in the access permission request information stored in the access permission request information storage means (403).
When the first tenant tries to access the data of the second tenant, “access permission request information from the first tenant to the second tenant” is obtained from the access permission request information storage means, and the approval information An access authority delegation system that permits access to data when (704) is stored. User management means (4022) for managing user information in tenant units;
User authentication means (402) for authenticating a user and identifying a tenant to which the user belongs;
An access permission request issuing means (1301) in which a user of the first tenant issues an access permission request for data of a second tenant other than the tenant to which the user belongs;
Access permission request display means (1401) for displaying access permission request information from the first tenant for the second tenant user;
An access permission approval means (1401) for the user of the second tenant to approve an access permission request from the first tenant;
When the user of the first tenant tries to access the data of the second tenant, the access permission request information is acquired from the access permission request information storage means, and the approval information is stored, The access authority delegation system according to claim 1, wherein access is permitted. When a user of the second tenant approves an access permission request from the first tenant, access that generates an access token indicating access permission to the data of the second tenant from the authentication information of the user of the second tenant A token generation unit (402), and the access permission request information storage unit (403) stores the access token generated by the access token generation unit,
When the user of the first tenant tries to access the data of the second tenant, the access permission request information and the access token are acquired from the access permission request information storage means, and the approval information is stored. The access authority delegation system according to claim 2, wherein the access token is used to access data. 4. The access authority delegation according to claim 3, wherein the access token generating means (402) generates an access token indicating an access permission for the data whose access permission is approved by the access permission approving means (1401). system. An access authority delegation system in which a host computer (101, 102) and a management server (103) are connected to a network (104),
Means for managing tenants (402, 4021);
Service management means (404) for managing a specific service use authority for each tenant,
An access permission request issuing means (1301) for issuing an access permission request for the service of the second tenant from the first tenant to the second tenant;
Access permission request information storage means (403) for storing the access permission request information;
An access permission approval means (1401) for the second tenant to approve an access permission request from the first tenant;
Approval information indicating that the approval has been performed is additionally stored in the access permission request information stored in the access permission request information storage means (403).
When the first tenant tries to access the service of the second tenant, “access permission request information from the first tenant to the second tenant” is obtained from the access permission request information storage means, and the approval information An access authority delegation system that permits access to a service when (704) is stored. User management means (4022) for managing user information in tenant units;
User authentication means (402) for authenticating a user and identifying a tenant to which the user belongs;
An access permission request issuing means (1301) for a user of the first tenant to issue an access permission request for a service of a second tenant other than the tenant to which the user belongs;
Access permission request display means (1401) for displaying access permission request information from the first tenant for the second tenant user;
An access permission approval means (1401) for the user of the second tenant to approve an access permission request from the first tenant;
When the user of the first tenant tries to access the service of the second tenant, the access permission request information is acquired from the access permission request information storage means, and the approval information is stored, 6. The access authority delegation system according to claim 5, wherein access is permitted. When a user of the second tenant approves an access permission request from the first tenant, access for generating an access token indicating access permission to the service of the second tenant from the authentication information of the user of the second tenant A token generation unit (402), and the access permission request information storage unit (403) stores the access token generated by the access token generation unit,
When the user of the first tenant tries to access the service of the second tenant, the access permission request information and the access token are acquired from the access permission request information storage means, and the approval information is stored. The access authority delegation system according to claim 6, wherein the access token is used to access a service. 8. The access authority delegation system according to claim 7, wherein the access token generation means (402) generates an access token indicating an access permission for the data whose access permission is approved by the access permission approval means (1401). .