JP2016192126A - Security gateway device, method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a security gateway device, method, and program that make it possible to utilize the data accessed by an application by satisfying by-country security conditions.SOLUTION: A security gateway device 10, provided with a security policy database 31 for storing a security policy stipulating a data provision period for each of first domains in correlation to the type of application and the type of data, issues a token in which an effective period for accessing data is set to an application in a first domain on the basis of a privacy certificate 21 and the stipulation of a security policy in a second domain for the first domain. The security gateway device 10 selects data in response to a data acquisition request from an application having a token on the basis of a privacy policy for each of data owners.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a security gateway apparatus, method, and program.

  Conventionally, IT (Information Technology) -related devices such as personal computers and servers are connected to the Internet. In addition, digital information home appliances such as televisions and digital cameras, various sensor devices, and the like are directly connected to the Internet, and such devices are called IoT (Internet of Things) devices. The data collected from the IoT device may include sensitive data related to personal privacy. For this reason, when utilizing these data, it is required to design an architecture from the viewpoint of both security and privacy.

  Non-Patent Document 1 that discloses requirements and functions for utilizing such data is known. In Non-Patent Document 1, requirements for security and privacy are extracted for each use case after clarifying the use cases that utilize the data as described above, and are described in European privacy-related laws and guidelines. Items are organized and functions to be implemented on the platform are extracted.

EU FP7 project iCore, “D2.2 Security requirements for the iCore cognitive management and control framework”, [online], Internet <URL: http: // www. iot-icore. eu / attachments / article / 89 / 20120607_iCore% 20D2.2% 20FINAL. pdf>

  However, Non-Patent Document 1 does not mention a technical solution for satisfying the requirements regarding security and privacy. Also, Non-Patent Document 1 does not mention a method for interpreting complicated conditions defined by data managers and owners, laws and guidelines, and access by applications across borders.

  An object of the present invention is to provide a security gateway device, method, and program that make it possible to use data accessed by an application while satisfying the security conditions of each country.

Specifically, the following solutions are provided.
(1) A security gateway device that extracts data requested from an application provided by a server installed in the first domain from a server installed in the second domain and returns the data to the application. A security policy storage unit that stores a security policy that defines a provision period of the data for each of the first domains in association with a type and a type of the data; and permits the acquisition of the data by the application. Access control for issuing, to the application, a token set with an expiration date for accessing the data, based on a privacy certificate issued by a certificate authority of the domain and a provision period specified in the security policy And a Security gateway device.

In the security gateway device of (1), an expiration date for accessing data is set for an application in the first domain based on a privacy certificate and a security policy rule for the first domain in the second domain. Issue a token.
That is, the security gateway device confirms the permission of accepting data from the second domain in the first domain by the privacy certificate, and at the second domain side that is the data provider, the security policy for the application in the first domain Permits the provision of data based on, and issues a token to obtain the data. An application having a token can use the data within the validity period of the token.
Therefore, the security gateway device can use the data accessed by the application by satisfying the security condition of each country.

  (2) The security policy defines the presence / absence of privacy for each type of the application and the type of data, and processes the data based on the presence / absence of the privacy in response to a request from the application having the token. The security gateway device according to (1), comprising a privacy control unit.

  The security gateway device of (2) processes data based on the presence or absence of privacy defined for each application type and data type in response to a request from the application. Data related to privacy on the side of providing data can be concealed.

  (3) The security gateway device according to (2), wherein the privacy control unit selects the data based on a privacy policy for each owner of the data in response to a request from the application having the token.

  Since the security gateway device of (3) selects data based on the privacy policy for each owner of data in response to a request from the application, only the data for which permission for each owner has been obtained can be provided.

  (4) The privacy policy defines whether to allow the provision of the data for each owner in association with the type of the application and the type of the data, and the privacy control unit includes the privacy control unit. The security gateway device according to (3), wherein data permitted by the owner is extracted based on a policy.

  The security gateway device of (4) extracts data based on the privacy policy for each data owner according to the type of application that requests the data and the type of data, so fine-grained settings for each data owner According to the above, it is possible to control whether or not to provide individual data.

  (5) A user database in which the identifier and attribute of the owner are associated with each other, and when the privacy control unit receives a condition regarding the attribute to be extracted from the application, the condition is determined by the user database. The security gateway device according to (3) or (4), wherein a satisfying owner is specified and data relating to the owner is extracted.

  When the security gateway device of (5) receives a condition relating to the attribute of the data owner separately from the data extraction query, the owner can be identified by referring to the user database, so the query itself is interpreted. The target data can be selected without doing so.

  (6) The security policy is set for each of a plurality of managers, and the access control unit determines whether the token is stored based on a shortest period among the data provision periods associated with the plurality of managers. The security gateway device according to any one of (2) to (5), wherein an expiration date is set.

  Since the security gateway device of (6) provides data based on the shortest period among the provision periods managed by a plurality of administrators, the data is provided under the conditions of the strictest provision period among the conditions of the plurality of administrators. Can protect.

  (7) The security policy is set for each of a plurality of administrators, and the privacy control unit, when the security policy defines that the data is related to privacy by any of the plurality of administrators, The security gateway device according to any one of (2) to (6), wherein the data is determined to be related to privacy.

  The security gateway device (7) determines that data is related to privacy when data is specified to be related to privacy by any of a plurality of administrators. You can protect your data in as safe a condition as possible.

  (8) The access control unit verifies validity of the request for the data from the application using a message authentication code using the token as a common key, according to any one of (1) to (7) Security gateway device.

  Since the security gateway device of (8) verifies the validity of the data request using the common key, it is possible to improve security by preventing impersonation and tampering.

  (9) A method executed by the security gateway device according to (1), wherein the access control unit permits acquisition of the data by the application, and a privacy certificate issued by a certificate authority of the first domain And an access step of issuing to the application a token set with an expiration date for accessing the data based on a certificate and a provision period defined in the security policy.

  The method (9) enables the data accessed by the application to be used by satisfying the security conditions for each country, as in (1).

  (10) A program for causing a computer to execute the steps of the method according to (9).

  The program of (10) can make a computer function so that the data accessed by the application can be utilized by satisfying the security conditions of each country.

  ADVANTAGE OF THE INVENTION According to this invention, it becomes possible to use the data which an application accesses satisfy | fills the security conditions for every country.

It is a block diagram which shows the structure of the security gateway apparatus which concerns on one Embodiment of this invention. It is a figure which shows the example of security policy DB which concerns on one Embodiment of this invention. It is a figure which shows the example of token DB which concerns on one Embodiment of this invention. It is a figure which shows the example of the privacy policy which concerns on one Embodiment of this invention. It is a figure which shows the example of user DB which concerns on one Embodiment of this invention. It is a sequence diagram which shows the token issuing process and data extraction process by the security gateway apparatus which concerns on one Embodiment of this invention. It is a block diagram which shows the structure of the security gateway apparatus in the multi cloud environment based on one Embodiment of this invention. It is a flowchart which shows the example of the issuing process of the token of the security gateway apparatus in a multi cloud environment based on one Embodiment of this invention. It is a flowchart which shows the example of the data extraction process of the security gateway apparatus in a multi cloud environment based on one Embodiment of this invention. It is a flowchart following FIG.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram showing a configuration of a security gateway device 10 according to an embodiment of the present invention.
The security gateway device 10 issues a token based on a security policy in response to a request from an application provided by a server (that is, an application server that provides an application) installed in the first domain. Then, the security gateway device 10 extracts data requested from the application having the token from the database server (referred to as a DB server) installed in the second domain based on the privacy policy, and returns it to the application.
A domain refers to each region that does not share security or privacy policies, such as a country.
The security gateway device 10 includes an access control unit 11, a privacy control unit 12, a security policy storage unit (referred to as security policy DB 31), and a user database (referred to as user DB 32).

<Issuance of tokens>
The access control unit 11 allows data to be accessed based on the privacy certificate 21 issued by the certificate authority of the first domain that allows the application to acquire data and the provision period specified in the security policy. Issue a token with an expiration date to the application.

The security policy DB 31 stores a security policy that defines the data provision period for each first domain (for example, the country where the application server is installed) in association with the application type and the data type.
The application type refers to a type such as an application related to medical care or an application related to provision of position information.
The type of data refers to a type of data related to medical care or data related to position, for example. The data type may be a database serial number without distinguishing a database having privacy (referred to as a privacy database) or a database having no privacy (referred to as a non-privacy database). Further, the data type may be classified into a privacy database or a non-privacy database and used as a serial number of each database.
Further, the security policy defines the presence / absence of privacy (that is, privacy information regarding privacy data or non-privacy data) for each data type. A security policy is set for each of a plurality of administrators.

Specifically, the security policy DB 31 stores a security policy as shown in FIG. FIG. 2 is a diagram showing an example of the security policy DB 31 according to the embodiment of the present invention.
The security policy specifies the data provision period and privacy information for the first domain (for example, the country where the application server is installed) for each data type for a plurality of administrators set for each type of application. To do.
In FIG. 2, “UK” and “JP” represent the country name where the application server is installed, and “h”, “d”, and “m” represent time, day, and month, which are units of the provision period, respectively. , “Privacy” and “Non-privacy” represent privacy information of “with privacy” and “without privacy”, respectively. The numerical value 0 represents that no token is issued. For example, "UK: 1h, JP: 2m, non-privacy" means that the validity period of the token issued to the UK country application is 1 hour, the validity period of the token issued to the JP country application is 2 months, and the privacy information is It represents “no privacy”.

The privacy certificate 21 guarantees a domain (for example, a providing country) from which the application can acquire data and a data type.
Specifically, the privacy certificate 21 includes the issuing country of the privacy certificate 21, the application IP, the application type, the DB server installation country, the data type, and the expiration date.
Here, the issuing country of the privacy certificate 21 refers to the country in which the certificate authority that issues the privacy certificate 21 is installed, and is the same as the country in which the application server is installed.
Application IP refers to the IP address of the application server.
The country where the DB server is installed refers to the country where the DB server that provides data that can be acquired by the application is installed.

When receiving a token issuance request from the application, the access control unit 11 acquires a security policy corresponding to the type of application that requests token issuance from the security policy DB 31.
Next, the access control unit 11 is a provision period to the country of the application (the country where the application server is installed) that is associated with the type of data defined in the privacy certificate 21 based on the acquired security policy. Thus, the respective provision periods associated with the plurality of managers are acquired.
For example, in the case of FIG. 2, if the security policy for application A matches DB1 and the application country (application server installation country) is JP, the access control unit 11 is set by the administrator 1. 2 months, which is the provision period for the JP, 2 hours, which is the provision period for the JP set by the administrator 2, ..., 5 hours, which is the provision period for the JP set by the administrator M , Get.
Next, the access control unit 11 calculates an expiration date based on the shortest period of data provision periods associated with a plurality of managers. In the above case, the access control unit 11 calculates an expiration date obtained by adding 2 hours to the current time based on the acquired shortest providing period of 2 hours.
Next, the access control unit 11 generates a token, associates the calculated expiration date with the generated token, and stores it in the token DB 33.
The access control unit 11 issues a token with an expiration date set to the application.
The token is generated as a common key for the message authentication code.

  FIG. 3 is a diagram illustrating an example of the token DB 33 according to an embodiment of the present invention. As shown in FIG. 3, the token DB 33 stores tokens and predetermined information (that is, application server installation country, application IP, application type, data type, privacy information, and token expiration date). Are stored in association with each other.

<Data extraction>
When receiving a data acquisition request from an application having a token, the access control unit 11 verifies the validity of the request with respect to the request from the application.
Specifically, the access control unit 11 acquires a token based on the token DB 33 by using parameters that constitute a data acquisition request from the application.
Next, the access control unit 11 inputs the concatenation of parameters excluding the message authentication code to a keyed hash function using a token as a key, and calculates a hash value. The message authentication code may be generated using, for example, HMAC-SHA256 (HMAC: Hash-based Message Authentication Code) that uses SHA256 as a hash function.
Next, the access control unit 11 determines that the message authentication code is generated using the issued token because the calculated hash value is the same as the message authentication code.

When the time when the data acquisition request is received is earlier than the expiration date associated with the acquired token, the access control unit 11 determines that the token is within the expiration date.
When the reception time of the data acquisition request is within a certain period from the time stamp included in the parameter (for example, the transmission time of the data acquisition request), the access control unit 11 has the data acquisition request within the certain period. It is determined that
The access control unit 11 verifies the validity of the data acquisition request based on the determination.

In response to a data acquisition request from an application having a token, the privacy control unit 12 processes data based on the presence or absence of privacy.
Specifically, the privacy control unit 12 processes data based on the privacy policy when the privacy information associated with the type of application having the token and the type of data is “with privacy” (for example, Anonymize). The privacy control unit 12 does not process data when the privacy information is “no privacy”.

  The privacy control unit 12 determines that the data is related to the privacy when the security policy defines that the data is related to the privacy by any of the plurality of administrators. In other words, the privacy control unit 12 determines that the data is not related to privacy when all of a plurality of managers are defined as not related to privacy in the security policy.

  In response to a data acquisition request from an application having a token, the privacy control unit 12 selects data based on a privacy policy for each data owner.

  FIG. 4 is a diagram illustrating an example of a privacy policy according to an embodiment of the present invention. As shown in FIG. 4, the privacy policy defines a privacy policy for each data owner for each type of application. Specifically, the privacy policy is associated with the application type, and the data owner authorizes the provision of data for each data type (marked with a circle in FIG. 4) or not (marked with a cross in FIG. 4). It prescribes. The privacy policy is acquired from a server (privacy policy DB 62 of the local cloud 60 described later) installed in the second domain.

  When the privacy control unit 12 receives a condition related to the attribute of the owner of the data to be extracted from the application, the privacy control unit 12 specifies the owner satisfying the condition by the user DB 32, and the owner is determined based on the privacy policy of the specified owner. Extract permitted data.

The user DB 32 associates the owner identifier with the attribute. FIG. 5 is a diagram showing an example of the user DB 32 according to an embodiment of the present invention. As shown in FIG. 5, the user DB 32 stores an identifier of a data owner and an attribute of the owner in association with each data type (for example, databases having different types).
The attribute of the owner is an attribute of the owner of data included in the database, and refers to, for example, an attribute such as male or twenties.

  Specifically, the privacy control unit 12 acquires the identifier of the owner stored in the database requested by the application based on the user DB 32 based on the extraction target attribute specified from the application. Next, the privacy control unit 12 determines whether or not provision is permitted based on the privacy policy corresponding to the type of application and the type of data based on the acquired identifier of the owner. The privacy control unit 12 extracts only the data of the owner that satisfies the attribute condition and permits the data provision, and returns the extracted data to the application.

  FIG. 6 is a sequence diagram showing token issuance and data extraction processing by the security gateway device 10 according to an embodiment of the present invention.

  In step S11, the access control unit 11 receives the privacy certificate 21 from the application.

  In step S12, the access control unit 11 allows the application to access data based on the provision period defined in the security policy corresponding to the application type and the data type described in the privacy certificate 21. Generate a token with an expiration date.

  In step S13, the access control unit 11 issues the generated token to the application.

  In step S14, the access control unit 11 receives a data acquisition request from an application having a token.

  In step S15, the access control unit 11 verifies the validity of the data request from the application.

  In step S <b> 16, when it is verified that the access control unit 11 is valid in step S <b> 15, the access control unit 11 transmits a data acquisition request to the second domain server.

  In step S17, the privacy control unit 12 receives data from the server in the second domain.

  In step S18, the privacy control unit 12 extracts data that is permitted to be provided based on the privacy policy.

  In step S19, the privacy control unit 12 returns the extracted data to the application.

[Examples in a multi-cloud environment]
FIG. 7 is a block diagram showing a configuration of the security gateway device 10 in a multi-cloud environment according to an embodiment of the present invention.
The security gateway device 10 is installed at the contact point between the global cloud 50 and the local cloud 60 in a multi-cloud environment.
The security gateway device 10 extracts the data requested from the application provided by the server installed in the first domain via the global cloud 50 from the local cloud 60 installed in the second domain, and the global cloud 50 Return to the application via

The application requests token issuance via the global query controller 51 of the global cloud 50 using the privacy certificate 21 as a parameter.
The access control unit 11 of the security gateway apparatus 10 sets the expiration date of the token based on the privacy certificate 21 and the validity period of the security policy DB 31, and stores the token in the token DB 33. The access control unit 11 issues a token to the application via the global query controller 51.

  An application having a token is connected via the global query controller 51 of the global cloud 50 to the country where the application server is installed, the application type, the data type, the data owner attribute, the query (request to the DB server), the time stamp ( For example, a data acquisition request is made using the data acquisition request transmission time) and the message authentication code as parameters. The global query controller 51 determines the local cloud 60 that distributes the query according to the content of the query from the application.

The access control unit 11 of the security gateway apparatus 10 verifies the validity of the token, and the privacy control unit 12 passes the application query to the local query controller 61 of the local cloud 60.
The local query controller 61 determines a database to which the query is distributed according to the content of the query passed from the privacy control unit 12, and extracts data based on the query.
The privacy control unit 12 of the security gateway device 10 selects data based on the privacy policy DB 62 from the data extracted by the local query controller 61 and returns the data to the application via the global query controller 51.

  FIG. 8 is a flowchart illustrating an example of token issuing processing of the security gateway apparatus 10 in a multi-cloud environment according to an embodiment of the present invention.

  In step S101, the access control unit 11 receives a token issuance request including the privacy certificate 21 as a parameter from the application.

  In step S <b> 102, the access control unit 11 verifies the validity of the contents described in the privacy certificate 21. More specifically, the access control unit 11 determines whether the issuing country of the privacy certificate 21 (same as the country where the application server is installed) is the same country as the IP address information in the request header. Further, the access control unit 11 determines whether or not the application IP (the IP address of the application server) is the same as the IP address information in the request header. Furthermore, the access control unit 11 determines whether or not the country where the DB server is installed is the same as the country where the security gateway device 10 is installed. Furthermore, the access control unit 11 determines whether or not the current time is earlier than the expiration date. If all the determinations are YES, the access control unit 11 moves the process to step S103, and if any determination is NO, the access control unit 11 moves the process to step S109.

  In step S <b> 103, the access control unit 11 stores the security policy DB 31 using the issuing country of the privacy certificate 21 described in the privacy certificate 21 (the country where the application server is installed), the application type, and the data type. Search for. The access control unit 11 acquires a list of valid periods of tokens and a list of privacy information in the country where the application server is installed, which is defined for each administrator.

  In step S104, the access control unit 11 determines whether the database specified by the data type described in the privacy certificate 21 is the non-privacy DB 63 or the privacy DB 64 from the privacy information list. The access control unit 11 determines the non-privacy DB 63 when all the managers set the non-privacy DB 63, and determines the privacy DB 64 otherwise.

  In step S105, the access control unit 11 determines the shortest period among valid periods set by a plurality of administrators from the valid period list as the valid period of the token. The access control unit 11 calculates the expiration date by adding the determined value of the validity period and the current time.

  In step S106, the access control unit 11 generates a token.

  In step S107, the access control unit 11 includes the token generated in step S106, the application server installation country described in the privacy certificate 21, the application IP, the application type, the data type, the privacy information determined in step S104, And the expiration date of the token calculated in step S105 is associated and stored in the token DB 33.

  In step S108, the access control unit 11 returns a token with an expiration date set to the application. Thereafter, the access control unit 11 ends the process.

  In step S109, the access control unit 11 returns error information indicating that the token issuance request is not normal to the application. Thereafter, the access control unit 11 ends the process.

  9 and 10 are flowcharts illustrating an example of data extraction processing of the security gateway device 10 in a multi-cloud environment according to an embodiment of the present invention.

  In step S201, the access control unit 11 receives a data acquisition request from the application, and uses the parameter application server installation country, the request header IP address information (application IP), the application type, and the data type, The token DB 33 is searched, and the token associated with the information and the expiration date of the token are acquired.

  In step S202, the access control unit 11 determines whether or not the time when the data acquisition request is received is earlier than the token expiration date. If this determination is YES, the access control unit 11 moves the process to step S203, and if this determination is NO, the access control unit 11 moves the process to step S213.

  In step S203, the access control unit 11 links parameters other than the message authentication code (application server installation country, application type, data type, data owner attribute, query, time stamp) in step S201. The obtained token is input to a keyed hash function, and a hash value is calculated. It is determined whether or not the calculated hash value matches the message authentication code. If this determination is YES, the access control unit 11 moves the process to step S204, and if this determination is NO, the access control unit 11 moves the process to step S213.

  In step S204, the access control unit 11 determines whether the reception time of the data acquisition request is within a certain period from the time stamp, using the parameter time stamp. If this determination is YES, the access control unit 11 moves the process to step S205, and if this determination is NO, the access control unit 11 moves the process to step S213.

  In step S205, the access control unit 11 determines whether or not the database designated by the parameter data type is privacy. If this determination is YES, the access control unit 11 moves the process to step 207, and if this determination is NO, the access control unit 11 moves the process to step S206.

  In step S206, the access control unit 11 acquires non-privacy data from the non-privacy DB 63 via the local query controller 61 using a parameter query, and returns the acquired data to the application. Thereafter, the access control unit 11 ends the process.

  In step S207, the privacy control unit 12 searches the user DB 32 using the attribute of the parameter data owner, and acquires a list of the owners of the corresponding data.

  In step S208, the privacy control unit 12 acquires the privacy policy of the owner of the corresponding data from the privacy policy DB 62 using the application type and the list of owners acquired in step S207.

  In step S209, the privacy control unit 12 refers to the privacy policy acquired in step S208, and among the data specified by the data type, a list of owners permitted to provide data (hereinafter, a list of data providers) ).

  In step S210, the privacy control unit 12 acquires privacy data from the privacy DB 64 via the local query controller 61 using a parameter query.

  In step S211, the privacy control unit 12 uses the data provider list created in step 209 to extract only the owner data existing in the provider list from the data acquired in step S210.

  In step S212, the privacy control unit 12 returns the data extracted in step 211 to the application. Thereafter, the access control unit 11 ends the process.

  In step S213, the access control unit 11 returns error information indicating that the data acquisition request is not normal to the application. Thereafter, the access control unit 11 ends the process.

According to the present embodiment, the security gateway device 10 confirms the permission of accepting data from the second domain in the first domain by the privacy certificate 21, and at the second domain side that is the data providing source, Permits the provision of data based on the security policy for the domain application, and issues a token to obtain the data. An application having a token can use the data within the validity period of the token. Therefore, the security gateway device can use the data accessed by the application by satisfying the security condition of each country.
Furthermore, since the security gateway device 10 processes data based on the presence of privacy defined for each application type and each data type in response to a request from the application, the data is processed regardless of the policy on the data receiving side. Data related to the privacy of the provider can be concealed.
Furthermore, since the security gateway device 10 selects data based on a privacy policy for each data owner in response to a request from an application, only the data for which permission for each owner is obtained can be provided.
Furthermore, since the security gateway device 10 extracts data based on the privacy policy for each data owner corresponding to the type of application that requests data and the type of data, the security gateway device 10 follows detailed settings for each data owner. Whether to provide individual data can be controlled.
Furthermore, when the condition regarding the attribute of the data owner is received separately from the data extraction query, the security gateway device 10 can identify the owner who satisfies the condition by referring to the user database, and therefore interprets the query itself. The target data can be selected without any problem.
Furthermore, since the security gateway device 10 provides data based on the shortest period among the provision periods managed by a plurality of administrators, the data is protected under the conditions of the strictest provision period among the conditions of the plurality of administrators. it can.
Furthermore, the security gateway device 10 determines that the data is related to privacy when any of the plurality of administrators defines that the data is related to privacy. You can protect your data in as secure a condition as possible.
Furthermore, since the security gateway device 10 verifies the validity of the data request using the common key, it is possible to improve security by preventing impersonation and tampering.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. The effects described in the embodiments of the present invention are only the most preferable effects resulting from the present invention, and the effects of the present invention are limited to those described in the embodiments of the present invention. is not.

  For example, in the present embodiment, the security gateway device 10 extracts data that can be provided from the acquired data using the list of data providers after acquiring the data, but is not limited thereto. The security gateway device 10 may incorporate the attribute condition of the owner into the query and send it to the local query controller 61 to cause the local query controller 61 to extract data that can be provided.

  A series of processing by the security gateway device 10 can also be performed by software. When a series of processing is performed by software, a program constituting the software is installed in a general-purpose computer or the like. The program may be recorded on a computer-readable recording medium (for example, a removable medium such as a CD-ROM) and distributed to the user, or may be downloaded to the user's computer via a network. May be distributed.

DESCRIPTION OF SYMBOLS 10 Security gateway apparatus 11 Access control part 12 Privacy control part 21 Privacy certificate 31 Security policy DB
32 User DB
33 Token DB
50 Global Cloud 51 Global Query Controller 60 Local Cloud 61 Local Query Controller 62 Privacy Policy DB
63 Non-privacy DB
64 Privacy DB

Claims (10)

A security gateway device that extracts data requested from an application provided by a server installed in a first domain from a server installed in a second domain and returns the data to the application,
A security policy storage unit that stores a security policy that defines a provision period of the data for each first domain in association with the type of application and the type of data;
An expiration date for accessing the data based on a privacy certificate issued by the certificate authority of the first domain that permits the application to acquire the data and a provision period specified in the security policy An access control unit that issues a token set to the application,
A security gateway device comprising: The security policy defines the presence or absence of privacy for each type of application and type of data,
The security gateway device according to claim 1, further comprising: a privacy control unit that processes the data based on presence / absence of the privacy in response to a request from the application having the token.   The security gateway device according to claim 2, wherein the privacy control unit selects the data based on a privacy policy for each owner of the data in response to a request from the application having the token. The privacy policy specifies whether to permit the provision of the data for each owner of the data in association with the type of the application and the type of the data,
The security gateway device according to claim 3, wherein the privacy control unit extracts data permitted by an owner of the data based on the privacy policy. A user database in which an identifier and an attribute of an owner of the data are associated with each other;
The privacy control unit, when receiving a condition regarding the attribute to be extracted from the application, specifies an owner that satisfies the condition by the user database, and extracts data regarding the owner. The security gateway device according to any one of the above. The security policy is set for each of a plurality of administrators,
6. The privacy control unit according to claim 2, wherein the privacy control unit determines that the data is related to privacy when the security policy defines that the data is related to privacy by any of the plurality of administrators. The security gateway device according to claim 1. The security policy is set for each of a plurality of administrators,
The access control unit according to any one of claims 1 to 6, wherein the access control unit sets an expiration date of the token based on a shortest period among the provision periods of the data associated with the plurality of administrators. The security gateway device described.   The security gateway device according to any one of claims 1 to 7, wherein the access control unit verifies validity of the request for the data from the application by using a message authentication code having the token as a common key. A method performed by the security gateway device according to claim 1,
The access control unit allows the data to be acquired based on a privacy certificate issued by a certificate authority of the first domain that permits the application to acquire the data and a provision period specified in the security policy. An access step for issuing to the application a token set with an expiration date for access;
A method comprising: A program for causing a computer to execute the steps of the method according to claim 9.

Images