JP2985514B2 - Computer resource control method - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a communication control system for enabling communication via a network to be protected from infringement by a third party other than the sender and the receiver in communication. And access computer resources on remote computers using communications, in situations where communications over the network can be performed in a manner protected from infringement by third parties other than the sender and recipient in communications. About the method of doing.

[0002]

2. Description of the Related Art In communication via a network,
When a trusted sender and recipient exchange data with each other, the data sent to the recipient is, with considerable certainty, transmitted by the sender and a third party other than the sender can There is a communication means that guarantees that the sender is not falsely transmitted.

A typical configuration of this communication means according to the prior art will be described with reference to the drawings.

FIG. 17 shows an example of the configuration of a communication means 51 according to the prior art.

[0005] This communication means is finer than the transmission means 52,
It comprises three parts, a receiving means 53 and an authentication means 54. Transmission means 52 is means 55 for requesting access to computer resources.
And the receiving means is connected to means 56 for processing access to computer resources.

The operation of these means is based on the function of encryption / decryption, and guarantees reliability as long as the encryption is not decrypted by a third party or the encryption key is not stolen. The transmitting unit 52 and the receiving unit 53 hold encryption keys X and Y that are not disclosed to a third party other than the authentication unit 54, respectively.
The authentication means includes encryption keys X and Y of the related receiving means and transmission means.
Hold both.

Next, the operation of these means will be described. (1) A request from the computer resource access requester 55 extends to the transmission means 52. (2) The transmitting means 52 requests the authentication means 54 for a ticket to be used for reliable communication with the receiving means 53. (3) The authentication unit 54 creates a ticket B including the information A identifying the requesting transmission unit 52, encrypted with the encryption key Y assigned to the reception unit 53 that is the partner. (4) The authentication unit 54 further encrypts the ticket B with the encryption key X assigned to the transmission unit to obtain C, and returns C to the transmission unit 52. (5) The transmitting means 52 decrypts the returned C and takes out the ticket B. The encryption key X required for decryption is transmitted by the authentication means 5
Since only the transmitting means other than 4 is known, other third parties cannot steal this. (6) The transmission unit 52 transmits the access request for the computer resource, the ticket B, and the identification information D of itself to the reception unit 53. (7) The receiving means 53 receives the access request for the computer resource transmitted by the transmitting means 52, the ticket B and the identification information D of the transmitting means by the self-report of the transmitting means 52. (8) The receiving means 53 decrypts the ticket B using the encryption key Y assigned to the receiving means, and extracts information A for identifying the transmitting means 52. (9) The receiving means 53 compares the information A with the identification information D self-reported by the transmitting means. When referring to the same means of transmission,
It is determined that the request is an access request from a valid transmission unit.
Since only the receiving means knows the encryption key Y necessary for decryption for obtaining the information A, other third parties cannot be used as the transmitting means. (10) If it is determined that the access request is from a legitimate transmission means, the access request for the computer resource extends to the access processor.

[0008]

A first problem to be solved by the present invention is to improve the security of communication means realized by the prior art. In the prior art, once a third party successfully intervenes in the relationship between the sender and the recipient and pretends to be the sender, the recipient trusts the third party, The result is that a lot of information is leaked to third parties. If the recipient is control means for computer resources, all contents of the computer resources will be leaked to a third party.

[0009] The first and second inventions aim to improve this problem, and even if the third party succeeds in falsifying that the sender is the sender, the receiver will not leak to the third party. The present invention provides a computer resource control method capable of limiting the range of information to be obtained to a smaller portion than the conventional case.

[0010] The second problem to be solved by the present invention is:
An object of the present invention is to improve the performance of communication means realized by conventional techniques. In the prior art, there is a choice between building a secure trust relationship between the sender and the receiver using the conventional technology or not. On the other hand, building this security imposes a heavy load on computers and networks. In such a situation, there may be a request from a communication user to slightly reduce security and improve performance accordingly. However, in the conventional technology, a certain or moderate security and a moderate load are required. No options are offered.

The third and fourth inventions aim to remedy this problem and provide the user with more or less flexible options of some or moderate security and moderate load as compared to the conventional case. A computer resource control method that can be provided is provided.

[0012]

According to a first aspect of the present invention, there is provided a computer resource control system which is executed on a first computer having computer resources and controls computer resources, and a second computer which controls the computer resources. And a processing means for executing the use of computer resources and connected to the first and second computers and protected from infringement by third parties other than the sender and receiver of the requested communication. Communication means for transmitting data including an identifier of a computer resource, a receiver, and computer resources; and a plurality of communication means for connecting the control means and the communication means of the computer resources.
The communication means for mapping from a set of computer resource identifiers defined by the communication means to a subset of the set of computer resource identifiers controlled by the control means; and the communication means from the processing means via the communication means. When requesting access to a computer resource required for an element of a set of computer resources defined by the means, an identifier of the computer resource in the control means is obtained by using the mapping means, and the identifier is replaced with the obtained identifier. Transfer means for retransmitting an access request to the control means.

According to a second aspect of the present invention, there is provided a computer resource control method which is executed on a first computer having computer resources and controls the computer resources, and which is executed on a second computer and uses the computer resources. One processing means for performing the communication with the sender and the sender of the requested communication connected to the first and second computers while being protected from infringement from a third party other than the sender and the receiver;
Communication means for transmitting data including an identifier of a receiver and computer resources; first communication means between the control means and the communication means; and a plurality of second communication means between the processing means and the communication means Communication means, wherein each of the second communication means maps from a set of computer resource identifiers defined by the second communication means to a subset of a set of computer resource identifiers controlled by the control means. When requesting access from a processing unit to a computer resource required for an element of a set of computer resources defined by the first communication unit, the mapping unit uses the mapping unit to identify a computer resource identifier in the control unit. Requesting, having a transfer means for retransmitting an access request to the control means by replacing the specified identifier with the requested identifier, wherein the first communication means is capable of transmitting an access request, and Checking means for holding a correspondence relationship between a subset of computer resources of the control means and access to the means, and detecting whether an access request arriving at the first communication means is permitted; Upon an access request to computer resources required for an element of a set of computer resources defined by the control means via the communication means,
The detection means checks the validity of the access request, and retransmits the access request to the control means if the access request is valid, and rejects the access request if the access request is not valid.

According to a third aspect of the present invention, there is provided a computer resource control system for controlling a plurality of computer resources executed on a first computer having computer resources, and utilizing the computer resources executed on a second computer. Processing means, and identifiers of the sender, receiver, and computer resources protected from infringement from third parties other than the sender and receiver of the requested communication connected to the first and second computers Communication means for transmitting data including: and one communication means between the control means for computer resources and the communication means, further comprising:
A mapping means for mapping from a set of computer resource identifiers defined by the communication means to a set of computer resource identifiers controlled by the plurality of control means; and a selection means for obtaining control means for controlling elements of the mapped computer resource. A request for access to a computer resource required for an element of a set of computer resources defined by the communication means from the processing means via the communication means, by using the mapping means and the selection means, It has a control means for controlling and a transfer means for obtaining an identifier of a computer resource in the control means, replacing the identifier with the obtained identifier, and retransmitting the access request to the obtained control means.

According to a fourth aspect of the present invention, there is provided a computer resource control method which is executed on a first computer having computer resources and controls the computer resources, and which is executed on a second computer and uses the computer resources. A plurality of processing means for performing the communication with the sender and the sender of the requested communication connected to the first and second computers in a state protected from infringement by a third party other than the sender and the receiver;
Communication means for transmitting data including an identifier of a receiver and computer resources; and one communication means between the processing means and the communication means, wherein the communication means is an arbitrary processing among the processing means Receiving an access request transmitted from the means, changing the access request to a request issued by the communication means, retransmitting the request to the control means using the communication means, and further transmitting a result returned from the control means. Transfer means for retransmitting to the processing means which has requested access.

[0016]

The communication means according to the first aspect of the present invention has an effect of making a set of computer resources provided by one control means appear to be provided by a plurality of control means as viewed from the communication means. is there. In the case where the communication means is not used, there is only one trust relationship between the processing means and the control means, but the communication means is used to virtualize the control means into n control means. In this case, there will be n trust relationships. Thus, if one of the n relationships is compromised by a third party, the remaining (n-1)
The individual relationships remain secure, and the computer resources guaranteed by the remaining relationships do not leak to third parties.

The communication means according to the second aspect of the present invention, when viewed from the communication means, requests access to the computer resources issued from one processing means from a processing means which is virtually different due to a difference in the requested computer resources. Has the effect of appearing to have been issued. The communication means manages the security of one relationship between the processing means and the control means when the communication means is not used.
In the case of virtualizing the number of processing units, the security of n relations between the n processing units and one control unit is managed. Thus, if one of the n relationships is compromised by a third party, the remaining (n-1) relationships will remain secure and the computer resources guaranteed by the remaining relationships will be Do not leak to three parties.

The communication means according to the third invention, which is the reverse of the operation of the first invention, is a set of computer resources provided by a plurality of control means, which is virtually one control unit as viewed from the communication means. Has the effect of pretending to be provided by the means. If the communication means does not use the communication means, and the processing means communicates with the n control means, the communication means must establish n trust relationships between the processing means and the control means. When using the means, adjustment can be made so that n or less trust relationships may be established. Therefore,
As compared with the case where this communication means is not used, the security is reduced, but the load on the processor and the network for maintaining the security can be reduced. The difference from the conventional method is that the security is not lost at all, but is adjusted in a smaller direction.

The communication means according to the fourth aspect of the present invention provides access to computer resources issued from a plurality of processing means, which is the reverse of the operation of the second invention, as viewed from the communication means, virtually as one processing. It has the effect of making it appear as if issued from a means. When the communication means is not used, n
If one processing means communicates with one control means, it manages the security of n relationships between the processing means and the control means,
When using this communication means, adjustments can be made to manage the security of n or less relationships. Therefore, as compared with the case where the communication means is not used, the security is reduced, but the load on the processor and the network for maintaining the security can be reduced. The difference from the conventional method is that the security is adjusted in a smaller direction, rather than being totally lost.

[0020]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiments of each invention will be described with reference to the drawings.

(Embodiment of the First Invention) FIG. 1 is a block diagram showing an embodiment of the first invention. This embodiment includes the following five means as shown in FIG.

1. First computer 1 holding computer resources
Control means 11 which is executed on computer 1 and controls computer resources
1 2. 2. processing means 121 which is executed on the second computer 12 and uses computer resources; The first computer and the second computer are contacted and receive data including the sender's identifier and the receiver's identifier from the sender, and are protected from infringement by a third party other than the sender and the recipient. Communication means 13 for transferring data to the recipient 4. 4. Communication means 14 for communicating between control means 111 and communication means 13 Communication means 15 for communicating between control means 111 and communication means 13 Communication means 14 and 15 include the following 10 as shown in FIG.
It is constituted by means.

(1) Sender, receiver,
Receiving means 1 for receiving data including a computer resource identifier
41 (2) Storage means 14 for extracting and storing identifiers of a sender and a receiver included in data received by receiving means 141
2 (3) Storage means 143 for storing the identifier of one control means defined as the destination to which the data transmitted to the communication means 14 or 15 is transferred, in this embodiment, the identifier of the control means 111 (4) Receiving means Conversion means for receiving the data from 141 and converting the identifier of the computer resource included in the data into an internal identifier indicating the same computer resource as the identifier of the computer resource inside the control means defined in the storage means 143; 144 (5) One character string used when converting the computer resource identifier in the communication means 14 or 15 into the computer resource identifier in the control means defined in the storage means 143 is stored and passed to the conversion means 144. Storage unit 145 (6) Receives data from conversion unit 144 and links the identifier of the sender contained in the data. A conversion means 146 for replacing the identifier of the receiver 14 included in the data with the identifier of the control means defined in the storage means 143 (7) receiving the data from the conversion means 146 and converting the data; Transmission means 147 for transmission to the control means indicated by the receiver's identifier (8) After transmission of the data by the transmission means 147, the reception means 148 (9) waits for a reply from the control means stored in the storage means 143 and receives the reply data A) conversion means 149 for receiving data from the reception means 148 and replacing the identifiers of the sender and the receiver contained in the data with the two identifiers stored in the storage means 142; (10) receiving the data from the conversion means 149 and communicating Next, the operation of this embodiment will be described.

The request for access to the computer resource issued by the processing means 121 is received by the receiving means 141 via the communication means 13.
To arrive. It is necessary that identifiers of a sender, a receiver, and a computer resource are included in a prescribed location inside the arrived data (hereinafter abbreviated as data). Here, the identifier of the sender is the identifier of the unit that has requested the communication unit 13 to transmit data, and the identifier of the recipient is the identifier of the unit to which the communication unit 13 sends data. The receiving means 141 takes a copy of the sender and receiver identifiers from the data and stores it in the storage means 142. Then, the data is passed to the conversion means 144.

The conversion means 144 extracts the identifier of the computer resource contained in the data. In this embodiment, the identifier of the computer resource is in the form of a character string.
Alternatively, the computer resource identifier in 15 is converted into a computer resource identifier in the control means defined in the storage means 143 by adding a character string defined in the storage means 145 to the head thereof. Then, the part of the identifier of the computer resource in the data is rewritten with the obtained identifier inside the control means. Then, the data is converted by the conversion means 1
It is passed to 46.

The conversion means 146 rewrites the identifier of the sender in the data with the identifier of the communication means 14 or 15, and further stores the identifier of the receiver in the data in the storage means 143. Rewrite with an identifier.
Then, the data is passed to the transmitting means 147.

The transmitting means 147 transfers the data to the means indicated by the sender's identifier contained in the data. After the transfer, the receiving means 148 is activated.

The receiving means 148 waits for the arrival of communication from the transfer destination previously transferred by the transmitting means 147, and passes the received data to the converting means 149.

The conversion means 149 rewrites the locations of the sender and receiver identifiers contained in the data with the sender and receiver identifiers stored in the storage means 142. Then, the rewritten data is passed to the transmitting means 1410. Transmission means 1410 simply passes this on to communication means 13.

The processing of the conversion means 144 for converting the identifier of the computer resource will be described with reference to FIG.

First, a computer resource identifier is extracted from the data (step S11). The identifier is a string string
Let it be represented by g11. Next, the identifier stored in the storage unit 145 is extracted (step S12).
The storage unit 145 stores the character string string1 as an identifier.
2 is stored. In the present embodiment, the identifier of the computer resource inside the control means is to add the identifier stored in the storage means 145 to the head of the identifier extracted from the data, ie, string12 + string.
g11 (this is referred to as string13) is obtained (step S13). For example, string12
Is “/ root” and string11 is “/ te”
st / src ”, string12 + str
ing11 becomes “/ root / test / src”. Finally, the obtained identifier string12 + str
In ing11, the place where string11 was placed in the data is rewritten (step S14).

As described in the above embodiment, the two communication means 14 and 15 are connected to the control means 111 connected thereto.
Has a role of sharing computer resources controlled by the communication means 13 and supplying the computer resources to the communication means 13. The effect of this embodiment will be described with reference to FIG. A set indicated by X in the figure is a set of computer resource identifiers controlled by the control unit 111. Two communication means 14 and 15 are connected to this control means.
4 is in charge of A which is a subset of X, and communication means 15 is X
In charge of B, which is a subset of. Assuming that the processing means 121
It is assumed that two pairs of trust relationships have been established using the communication means 13 between the communication means 14 and 15 in order to use the computer resources of the control means 111. At this time, if the third party succeeds in infringing this and succeeding in becoming the processing means 121 in the trust relationship between the communication means 14 and the processing means 121, the communication resource 14 Set A can be infringed by a third party. However, if the trust relationship between the communication means 15 and the processing means 121 has not been violated, the computer resources of the subset B will not be violated by a third party at this point.
When the present invention is not used, the processing unit 121 and the control unit 11
1 is directly subject to a third party attack.
Once this trust relationship is violated, all of the computer resources of the set X can be violated by a third party at once. As described above, the first invention has an effect of minimizing the range of damage that occurs when the trust relationship between the processing unit 121 and the control unit 111 is violated by a third party.

(Embodiment of the Second Invention) FIG. 5 is a block diagram showing an embodiment of the second invention. This embodiment includes the following six means as shown in FIG.

1. First computer 1 holding computer resources
Control means 21 which is executed on computer 1 and controls computer resources
1 2. 2. processing means 221 which is executed on the second computer 12 and uses computer resources; The first computer and the second computer are contacted and receive data including the sender's identifier and the receiver's identifier from the sender, and are protected from infringement by a third party other than the sender and the recipient. Communication means 23 for transferring data to the recipient 4. 4. Communication means 25 for communicating between processing means 221 and communication means 23 5. Communication means 26 for communicating between processing means 221 and communication means 23 The communication means 27 for communicating between the control means 211 and the communication means 23 The communication means 25 and 26 are, as shown in FIG.
It is constituted by means.

(1) Receiving means 251 for receiving data including the identifiers of the sender, receiver, and computer resources from the processing means 221 (2) Identifying the sender and receiver included in the data received by the receiving means 251 Storage means 25 for taking out and storing
2 (3) Storage means 253 for storing the identifier of one means defined as the destination to which the data transmitted to the communication means 25 or 26 is transferred (4) Data is received from the reception means 251 and included in the data The conversion means 254 converts the computer resource identifier into an internal identifier indicating the same computer resource as the computer resource identifier inside the means defined in the storage means 253, and replaces it. (5) The conversion of the computer resource in the communication means 25 or 26 One character string used when converting the identifier into an identifier of a computer resource in the means defined in the storage means 253 is stored, and the storage means 255 is passed to the conversion means 254. (6) Data is received from the conversion means 254. Replace the sender's identifier in the data with the contact's identifier,
Conversion means 256 for replacing the receiver identifier contained in the data with the identifier of the means stored in storage means 253 (7) Transmission means 257 (8) which receives data from conversion means 256 and transmits the data to communication means 23 ) After transmitting the data by the transmitting means 257, the receiving means 258 waits for a reply from the communicating means 23 and receives the reply data. (9) The data is received from the receiving means 258, and the identifier of the sender included in the data is stored in the storing means 252. Conversion means 259 for replacing the stored sender identifier with the receiver identifier contained in the data with the sender identifier stored in the storage means 252, respectively. (10) Connected to the conversion means 259, Transmitting means 2510 for receiving the data from the means 259 and transferring it to the processing means indicated by the identifier of the sender contained in the data Fault means 27 is constituted by the following ten unit as shown in FIG.

(1) Sender, receiver,
Receiving means 2 for receiving data including a computer resource identifier
71 (2) Storage means 27 for extracting and storing identifiers of a sender and a receiver included in data received by receiving means 271
2 (3) Storage means 273 for storing an identifier of one control means defined as a destination to which the data transmitted to the communication means 27 is transferred. (4) Means for permitting data transfer through the reception means 271. , Communication means 25 and 26,
Storage means 2 for storing information for identifying an identifier of a computer resource which the means may specify, that is, a character string stored in storage means 255 inside communication means 25 and 26
74 (5) Judgment unit 2 that receives data from reception unit 271 and determines the sender and computer resource identifiers contained in the data based on the information stored in storage unit 274
75 (6) Receive the data from the determination means 275, replace the identifier of the sender included in the data with the identifier of the communication means 27, and store the identifier of the receiver included in the data in the storage means 273
Conversion means 27 for replacing with the identifier of the control means stored in
6 (7) The control unit 2 receives the data from the conversion unit 276 and points the data to the identifier of the receiver included in the data.
(8) After transmitting the data by the transmitting unit 277, wait for a response from the control unit 211 and receive the response data 278 (9) Receive the data from the receiving unit 278 and include it in the data Conversion means 279 (10) which replaces the sender's identifier with the receiver's identifier stored in storage means 272 and the receiver's identifier included in the data with the sender's identifier stored in storage means 272, respectively. ) Transmission means 2710 which receives data from conversion means 279 and transfers it to communication means 23 Next, the operation of the communication means 25 and 26 of this embodiment will be described.

Processing request for access to computer resources
21 arrives at the receiving means 251. It is necessary that identifiers of a sender, a receiver, and a computer resource are included in a prescribed location inside the arrived data (hereinafter abbreviated as data).
Here, the identifier of the sender is the identifier of the processing unit that transmitted the data, and the identifier of the recipient is the identifier of the communication unit. The receiving unit 251 takes a copy of the identifiers of the sender and the recipient from the data and stores it in the storage unit 252. And
The data is passed to conversion means 254.

The conversion means 254 extracts the identifier of the computer resource contained in the data. In this embodiment, the identifier of the computer resource is in the form of a character string, and the identifier of the computer resource in the communication unit and the identifier of the computer resource in the unit defined in the storage unit 253 are stored in the storage unit 2.
It is converted by adding the character string defined in 55 to its head. Then, the identifier portion of the computer resource in the data is rewritten with the identifier inside the obtained means. Then, the data is passed to the conversion means 256.

The conversion means 256 rewrites the identifier of the sender in the data with the identifier of the communication means, and further converts the identifier of the receiver in the data into the storage 25
3 is rewritten with the identifier stored in 3. In this case, the identifier of the communication unit 27 is stored in the storage unit 253. Then, the data is passed to the transmitting means 257.

Transmission means 257 transmits data to communication means 23
To execute data transmission. After transfer, receiving means 2
Start 58.

The receiving unit 258 waits for a reply from the transfer destination previously transferred by the transmitting unit 257 via the communication unit 23, and passes the received data to the converting unit 259.

The conversion means 259 rewrites the locations of the sender and receiver identifiers contained in the data with the receiver and sender identifiers stored in the storage means 252, respectively. Then, the rewritten data is transmitted to the transmitting means 2510. Transmission means 2510 passes the data to processing means identified by the sender's identifier in the data.

Next, the operation of the communication means 27 of this embodiment will be described.

The request for access to the computer resources is transmitted by the communication means 2
3 arrives at the receiving means 271. It is necessary that identifiers of a sender, a receiver, and a computer resource are included in a prescribed location inside the arrived data (hereinafter abbreviated as data). Here, the identifier of the sender is the identifier of the communication means 25 or 26 that transmitted the data, and the identifier of the receiver is the identifier of the communication means 27. The receiving means 271 takes a copy of the sender and receiver identifiers from the data and stores it in the storage means 272. Then, the data is passed to the determination means 275.

The determination means 275 extracts the sender and computer resource identifiers contained in the data. Storage means 27
4 is searched to find a pair in which the sender's identifier matches the identifier of the means in the table, and find the other string in the pair. It is determined whether or not the character string matches the head of the identifier of the computer resource included in the data. If the character string does not match, the transmitting unit 2710 is called as an illegal request and the sender of the data is notified to that effect. If they match, the process proceeds to the conversion unit 276.

The conversion means 276 rewrites the identifier of the sender in the data with the identifier of the communication means 27,
Further, the part of the identifier of the receiver in the data is rewritten with the identifier stored in the storage means 273. Then, the data is passed to the transmitting means 277.

Transmission means 277 transfers the data to the means indicated by the sender's identifier contained in the data. After the transfer, the receiving means 278 is activated.

The receiving unit 278 waits for the arrival of the communication from the transfer destination previously transferred by the transmitting unit 277, that is, the control unit 211, and passes the received data to the converting unit 279.

The conversion means 279 rewrites the locations of the sender and receiver identifiers contained in the data with the receiver and sender identifiers stored in the storage means 272, respectively. Then, the rewritten data is passed to the transmitting means 2710. Transmission means 2710 simply passes this on to communication means 23.

The processing of the conversion means 254 for converting the identifier of the computer resource will be described with reference to FIG.

First, a computer resource identifier is extracted from the data (step S11). The identifier is a string string
g11 (for example, “file1”). Next, the identifier stored in the storage unit 255 is extracted (step S12). The storage unit 255 stores a character string string12 (eg, “/ fol”) as an identifier.
der / "). In this embodiment,
The identifier of the computer resource inside the control means is stored in the storage means 255.
Is added to the beginning of the identifier extracted from the data, that is, string12 +
string11 (according to the above example, "/ folde
r / file1 ") (step S13). Finally, the obtained identifier string12 +
The location where the string 11 is located in the data is rewritten by the string 11 (step S14).

The processing of the determination means 275 for determining the identifier of the sender and the identifier of the computer resource will be described with reference to FIG.

First, the sender identifier a and the computer resource identifier string13 are extracted from the data (step S11). Next, one pair of the identifier and the character string of the unit stored in the storage unit 274 is extracted (step S1).
2). If there is no pair to be taken out, this data is determined to be invalid, and the process proceeds to step S15 (step S1).
3). The identifier a of the sender extracted from the data is compared with the identifier b of this pair of means.
Proceed to step 12 (step S14). If they match, the character string string stored as a pair with the identifier b
14 is taken out (step S16). Next, the character string string1 of the identifier of the computer resource extracted from the data
3 is compared with the character string string14 (step S17). If they do not match, this data is determined to be invalid and the process proceeds to step S15. If it is determined that the data is invalid, return data for notifying the sender of this is created, and the transmission unit 2710 is called to transmit the return data (step S15). If the data is valid, for example, string13 is "/ fo
string14 is “/ fo” in “lder / file1”
lder ", the process proceeds to the conversion unit 276.

As described in the above embodiment, the two communication means 25 and 26 share the computer resources controlled by the control means 211 which communicates with the communication means 23 via the communication means 27, and perform processing. It has a role to supply to the means 221. The effect of this embodiment will be described with reference to FIG. A set indicated by X in the figure is a set of identifiers of computer resources controlled by the control unit 211. This control means
Communication means 25 and 26 are connected, and the communication means 25 is X
And the communication means 26 is in charge of B which is a subset of X. It is assumed that two pairs of trust relationships have been established between the communication means 25 and 26 using the communication means 23 with the communication means 27 in order to use the computer resources of the control means 211. At this time, if the third party infringes on this and succeeds in becoming the communication means 25 in the trust relationship between the communication means 25 and the communication means 27, the communication resource 25 Set A can be infringed by a third party. However,
If the trust relationship between the communication means 26 and the communication means 27 has not been violated, the computer resources of the subset B will not be violated by a third party at this point.

When the present invention is not used, the trust relationship between the processing means 221 and the control means 211 is directly targeted by a third party. Once this trust relationship is violated, all of the computer resources of the set X can be violated by a third party at once. As described above, according to the second aspect of the present invention, the range of damage that occurs when the trust relationship between the processing unit 221 and the control unit 211 is violated by a third party can be reduced.

(Embodiment of the Third Invention) FIG. 11 is a block diagram showing an embodiment of the third invention. This embodiment includes the following five means as shown in FIG.

1. First computer 3 holding computer resources
1. first control means 311 which is executed on the first computer and controls computer resources; 2. Second control means 312 which is executed on the first computer 31 having computer resources and controls computer resources. Processing means 321 which is executed on the second computer 32 and uses computer resources; A communication between the first computer and the second computer, receiving data including the identifier of the sender and the identifier of the receiver from the sender, and protected from infringement from a third party other than the sender and the receiver. 4. Communication means 33 for transferring data to recipients Communication means 34 for communicating between control means 311 and 312 and communication means 33 Communication means 34 is composed of the following nine means as shown in FIG.

(1) The sender, receiver,
Receiving means 3 for receiving data including the identifier of the computer resource
41 (2) Storage means 34 for extracting and storing identifiers of the sender and receiver included in the data received by receiving means 341
2 (3) Receiving the data from the receiving unit 341, based on the identifier of the computer resource included in the data, finds a control unit that controls the computer resource specified by the identifier,
The identifier of the computer resource inside the control means is obtained, the identifier of the receiver inside the data is rewritten with the obtained identifier of the control means, and the identifier of the computer resource inside the data is obtained as the identifier inside the obtained control means. Conversion means 34 for rewriting
3 (4) The following information: (a) One identifier of the control means connected to the communication means 34 (b) When converting the computer resource identifier in the control means into the computer resource identifier in the communication means 34 Are stored as many as the number of control means connected to the communication means 34.
A conversion unit 345 connected to the conversion unit 343, receives data from the conversion unit 343, and replaces the identifier of the sender included in the data with the identifier of the communication unit 345 (6) conversion Transmitting means 346 for receiving the data from the means 345 and transmitting the data to the control means indicated by the identifier of the receiver (7) after transmitting the data by the transmitting means 346, sending a reply from the control means indicated by the identifier of the receiver in the data Receiving means 347 for waiting and receiving reply data (8) Conversion means 348 for receiving data from receiving means 347 and replacing the identifiers of the sender and receiver contained in the data with the two identifiers stored in storage means 342 (9) Transmission means 349 for receiving data from the conversion means 348 and transferring it to the communication means 33. It will be described.

The access request to the computer resource issued by the processing means 321 is transmitted via the communication means 33 to the receiving means 341.
To arrive. It is necessary that identifiers of a sender, a receiver, and a computer resource are included in a prescribed location inside the arrived data (hereinafter abbreviated as data). Here, the identifier of the sender is the identifier of the unit that has requested the communication unit 33 to transmit data, and the identifier of the receiver is the identifier of the unit to which the communication unit 33 sends data. The receiving unit 341 takes a copy of the identifiers of the sender and the recipient from the data and stores it in the storage unit 342. Then, the data is passed to the conversion means 343.

The conversion unit 343 uses the table of the storage unit 344 to identify the identifier of the control unit that controls the computer resource indicated by the identifier of the computer resource included in the data, and the identifier of the computer resource in the control unit. Get. And
The receiver identifier portion in the data is rewritten with the obtained identifier of the control means, and the computer resource identifier portion in the data is rewritten with the obtained identifier inside the control means. Then, the data is passed to the conversion means 345.

The conversion means 345 rewrites the identifier of the sender in the data with the identifier of the communication means 34. Then, the data is passed to the transmitting means 346.

The transmitting means 346 transfers the data to the means indicated by the sender's identifier contained in the data. After the transfer, the receiving means 347 is activated.

The receiving means 347 waits for the arrival of the communication from the transfer destination previously transferred by the transmitting means 346, and passes the received data to the converting means 348.

The conversion means 348 rewrites the location of the sender and receiver identifiers contained in the data with the sender and receiver identifiers stored in the storage means 342. Then, the rewritten data is transmitted to the transmitting means 349. The transmission means 349 simply passes this to the communication means 33.

The processing of the conversion means 343 for converting the identifier of the computer resource will be described with reference to FIG.

First, the identifier of the computer resource is extracted from the data (step S11). The identifier is a string string
It is assumed that it is represented by g21. Next, one of the pair of the identifier and the character string of the control means stored in the storage means 344 is extracted (step S12). It is determined whether all pairs in the storage unit 344 have been extracted (step S).
13) If all the checks have been completed, it is determined that the designated computer resource does not exist, and the fact is transmitted to the processing means via the transmitting means 349 (step S14).

The character string extracted in step S12 is represented by st
Let it be ring22. The character string string21 and the character string string22 are compared, and it is determined whether or not the head of the character string string21 matches the character string string22 (step S15). If they match, the process returns to step S16. If they do not match, the process returns to step S12. The next pair stored in the storage unit 344 is extracted, and the same determination is repeated.

The part that matches the character string string 22 is deleted from the beginning of the character string string 21 (step S16). Delete the completed string
ng23. For example, string21 is "/ ro
ot / test / src ”, and string22
Is "/ root", string23
Is calculated as "/ test / src". Then stri
ng23 is written in the location of the computer resource identifier in the data as the computer resource identifier in the control means (step S17).

Next, the storage means 3 is paired with a character string string 22 that matches the head of the character string string 21.
The identifier of the control means stored in 44 is written in the location of the recipient in the data (step S18).

As described in the above embodiment, the communication means 34 is connected to the two control means 311, 31 connected thereto.
2 has a role of intensively supplying the computer resources controlled by the communication means from one location to the communication means. FIG. 14 shows the effect of this embodiment.
This will be described with reference to FIG. A set indicated by X in the figure is a set of identifiers of computer resources controlled by the control unit 311, and a set indicated by Y is a set of identifiers of computer resources controlled by the control unit 312. The communication means 34 connected to the two control means is in charge of the union A. In this case, the processing unit 321 may establish one trust relationship between the communication unit 34 and the processing unit 321 by using the communication unit 33 to use the computer resources of the control units 311 and 312. If the present invention is not used, the processing unit 321 must establish and maintain two trust relationships between the control unit 311 and the processing unit 321 and a trust relationship between the control unit 312 and the processing unit 321. Thus, the third invention is
This has the effect of reducing the amount of processing for creating a trust relationship that must be established in order to use computer resources.

(Embodiment of the Fourth Invention) FIG. 15 is a block diagram showing an embodiment of the fourth invention. This embodiment includes the following five means as shown in FIG.

1. First computer 4 holding computer resources
Control means 41 which is executed on the server 1 and controls computer resources
1 2. 2. first processing means 421 which is executed on the second computer 42 and uses computer resources; 3. second processing means 422 which is executed on the second computer 42 and uses computer resources; The first computer and the second computer are contacted and receive data including the sender's identifier and the receiver's identifier from the sender, and are protected from infringement by a third party other than the sender and the recipient. 4. Communication means 43 for transferring data to the recipient Communication means 45 for communicating between processing means 421 and 422 and communication means 43 The communication means 45 is composed of the following eight means as shown in FIG.

(1) Receiving means 451 for receiving data including the identifiers of the sender, receiver, and computer resource from the processing means 421 or 422. (2) Sender and receiver information included in the data received by the receiving means 451. Storage means 45 for extracting and storing identifiers
2 (3) The storage means 45 in which the communication means 45 stores the identifier of the means defined as the party to which the access request is transferred.
3 (4) Receive the data from the receiving unit 451, and replace the identifier of the sender included in the data with the identifier of the communication unit 45, and replace the identifier of the recipient included in the data with the identifier stored in the storage unit 453, respectively. Conversion means 454 (5) Transmission means 455 for receiving data from the conversion means 454 and transmitting the data to the communication means 43 (6) After transmitting the data by the transmission means 455, waits for a reply from the communication means 43, and transmits the reply data. Receiving receiving unit 456 (7) Receiving the data from the receiving unit 456, the identifier of the sender included in the data is stored in the identifier of the receiver stored in the storing unit 452, and the identifier of the receiver included in the data is stored in the storing unit 452. And (8) the converting means 457 receives the identifier of the sender stored in the The chromatography data, transmission means for transferring to the processing means the sender identifiers in the data points 4
58 Next, the operation of the embodiment of the fourth invention will be described.

The access request to the computer resource issued by the processing means 421 or 422 reaches the receiving means 451. It is necessary that identifiers of a sender, a receiver, and a computer resource are included in a prescribed location inside the arrived data (hereinafter abbreviated as data). In this case, the identifier of the sender is the identifier of the processing means 421 or 422, and the identifier of the recipient is the identifier of the communication means 45. The receiving unit 451 takes a copy of the identifiers of the sender and the recipient from the data and stores it in the storage unit 452. Then, the data is converted by the conversion means 4
It is passed to 54.

The conversion means 454 rewrites the identifier of the sender in the data with the identifier of the communication means 45,
The identifier of the receiver in the data is rewritten with the identifier of the unit stored in the storage unit 453. Then, the data is passed to the transmitting means 455.

Transmission means 455 transmits data to communication means 43
And request to send. After the transfer, the receiving unit 456 is activated.

The receiving means 456 waits for the arrival of the communication from the transfer destination previously transferred by the transmitting means 455, and passes the received data to the converting means 457.

The conversion means 457 rewrites the location of the sender and receiver identifiers contained in the data with the sender and receiver identifiers stored in the storage means 452. Then, the rewritten data is transmitted to the transmitting means 458. The transmitting means 458 passes this to the processing means identified by the identifier of the recipient included in the data.

As described in the above embodiment, the communication means 45 is connected to the two processing means 421 and 42 connected thereto.
2 has a role to be treated as one processing unit from the viewpoint of the control unit 411. When n processing units transmit an access request to one control unit, n trust relationships must be established and maintained unless the present invention is used, but if the present invention is used, one trust relationship is established. Can be reduced. If this one trust relationship is breached by a third party, the situation is similar to that of a third party being able to impersonate any of the n processing means. Then it becomes weak. However, the security is not completely lost as in the conventional case, but can be adjusted to 1 / n. As described above, the fourth invention has an effect of reducing the amount of processing for creating a trust relationship that must be established in order to use computer resources.

[0080]

As described above, according to the present invention, there is an effect that the range of damage that occurs when the trust relationship between the processing means and the control means is violated by a third party is reduced.

Further, according to the present invention, there is an effect of reducing the amount of processing for creating a trust relationship that must be established in order to use computer resources.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of a first embodiment of the present invention.

FIG. 2 is a diagram showing a configuration of communication means 14, 16 included in the configuration of FIG.

FIG. 3 is a flowchart showing an operation of a conversion unit 144 included in the communication unit of FIG.

FIG. 4 is a diagram for explaining an effect of the embodiment in FIG. 1;

FIG. 5 is a diagram showing a configuration of an embodiment of the second invention.

6 is a diagram showing a configuration of communication means 25 and 26 included in the configuration of FIG.

FIG. 7 is a diagram showing a configuration of a communication unit 27 included in the configuration of FIG. 5;

FIG. 8 is a flowchart showing the operation of the conversion means 254 included in the configuration of FIG.

FIG. 9 is a flowchart showing an operation of a conversion unit 275 included in the configuration of FIG. 7;

FIG. 10 is a diagram for explaining an effect of the embodiment in FIG. 5;

FIG. 11 is a diagram showing a configuration of an example of the third invention.

FIG. 12 is a diagram illustrating a configuration of a communication unit included in the configuration of FIG. 11;

FIG. 13 shows conversion means 343 included in the communication means of FIG.
3 is a flowchart showing the operation of the first embodiment.

FIG. 14 is a diagram illustrating the effect of the third invention.

FIG. 15 is a diagram showing a configuration of an example of the fourth invention.

FIG. 16 is a diagram showing a configuration of a communication unit 45 included in the configuration of FIG.

And FIG. 17 is a diagram illustrating a configuration example of a communication unit according to the related art.

[Explanation of symbols]

 11, 21, 31, 41 First computer 12, 22, 32, 42 Second computer 13, 23, 33, 43 Communication means 14, 15, 25, 26, 27, 34, 35 Communication means 111, 211, 311, 312, 411 Control means 121, 221, 321, 421, 422 Processing means

Claims (4)

(57) [Claims] A control means for controlling computer resources executed on a first computer having computer resources; a processing means for executing computer resources executed on a second computer; And a communication connected to the second computer and transmitting data including identifiers of the sender, the receiver, and the computer resources in a state protected from infringement from a third party other than the sender and the receiver of the requested communication. And a plurality of communication means for connecting the communication means with the control means for computer resources, wherein the communication means controls the computer by the control means from a set of computer resource identifiers defined by the communication means. A mapping means for mapping a set of resource identifiers to a subset, and an access request to a computer resource required by the processing means via the communication means for an element of the computer resource set defined by the communication means. Transfer means for retrieving an identifier of a computer resource in the control means using the mapping means, re-transmitting an access request to the control means by replacing the identifier with the determined identifier. Computer resource control method. 2. A control means which is executed on a first computer having computer resources and controls computer resources, one processing means which is executed on a second computer and uses computer resources, and And communication means connected to the second computer for transmitting data including the sender, receiver, and computer resource identifiers in a state protected from infringement from a third party other than the sender and receiver of the requested communication. A first communication means between the control means and the communication means, and a plurality of second communication means between the processing means and the communication means, the second communication means, The first communication means defines the mapping means from the set of computer resource identifiers defined by the second communication means to a subset of the set of computer resource identifiers controlled by the control means, and the processing means. For elements of a set of computer resources At the time of a request for access to a required computer resource, an identifier of the computer resource in the control means is obtained by using the mapping means, the identifier is replaced with the obtained identifier, and the access request is retransmitted to the control means. Means, the first communication means, holding a correspondence relationship between a means capable of transmitting an access request and a subset of the computer resources of the control means that permits access to the means, A checking means for detecting whether an access request arriving at the first communication means is permitted; and a checking means for requesting a computer resource required for an element of a set of computer resources defined by the control means via the communication means. At the time of the access request, the validity of the access request is checked by the detecting means. If the access request is valid, the access request is resent to the control means. And a transfer means for rejecting the scan request, the computer resource control method, characterized in that. 3. A plurality of control means for computer resources executed on a first computer having computer resources, a processing means executed on a second computer for utilizing computer resources, and Communication means connected to the second computer for transmitting data including the sender, receiver, and computer resource identifiers in a state protected from infringement by a third party other than the sender and receiver of the requested communication; One communication means between the control means of the computer resources and the communication means, further comprising: the communication means, based on a set of identifiers of the computer resources defined by the communication means, the plurality of control means Mapping means for mapping a set of identifiers of computer resources to be controlled, selecting means for controlling means for controlling elements of computer resources after mapping, and computer resources defined by the communication means from the processing means via the communication means. At the time of a request for access to computer resources required for the combined element, control means for controlling the computer resources using the mapping means and the selection means, an identifier of the computer resources in the control means is obtained, and designation of the identifier is requested. And a transfer unit for retransmitting the access request to the obtained control unit by replacing the identifier with the obtained identifier. 4. A control means which is executed on a first computer having computer resources and controls computer resources, a plurality of processing means which is executed on a second computer and uses computer resources, And communication means connected to the second computer for transmitting data including the sender, receiver, and computer resource identifiers in a state protected from infringement from a third party other than the sender and receiver of the requested communication. And one communication means between the processing means and the communication means, wherein the communication means receives an access request transmitted from any one of the processing means, and Transfer means for changing to a request issued by the communication means, retransmitting the request to the control means using the communication means, and further retransmitting a result returned from the control means to the processing means which has requested access. To the computer resource control method, characterized in that.