JP3565481B2 - Computer directory access control system and method - Google Patents

Description

によって計算する。そして、アクセス制御プロセスが、この第２のディレクトリのセキュリティステータスとセキュリティ属性とを、従来技術と同様に論理計算することによって、第２のディレクトリにアクセスを許すか否かを決定する。
【００３０】
例えば、図２の例では、下位ファイル１３のセキュリティステータス１３Ｓは「１１０００００ １００００００」となっている。この下位ファイル１３にアクセスして図示のセキュリティステータス１３Ｓを成立させた者が、次に上位ファイル１１にアクセスしようとする時、継承制御プロセスは、その上位ファイル１１のセキュリティステータス１１Ｓを、

と計算する。つまり、下位ファイル１３のセキュリティステータス１１Ｓのうち上位ファイル１３へ継承されるビットは、下位ファイル１３の公開マスク１３ＲＭと上位ファイル１１の継承マスク１１ＩＭの双方で「１」が立っているビット、つまりキー種別「Ｎ１」のビットのみである。こうして、上位ファイル１１のセキュリティステータス１１Ｓは「００００００００ １０００００００」となる。図２の例では、上位ファイル１１のセキュリティ属性１１Ａでは、どのアクセス権レベルについても、キー種別「Ｎ１」のビットに「１」が立っていないので、上記した下位ファイル１３からの継承によっては、上位ファイル１１に関して何のアクセスも許可されないことになる。
【００３１】
一方、もし、下位ファイル１３の公開マスク１３ＲＭと上位ファイル１１の継承マスク１１ＩＭの双方において、「Ｐ２」のビットに「１」が設定されていれば、下位ファイル１３からの継承により上位ファイル１１のセキュリティステータス１１Ｓでは「Ｐ２」にビットに「１」が立って、上位ファイル１１のセキュリティ属性１１Ａの「追加」の値と一致することになるので、上位ファイル１１に関して「追加」のアクセスが許可されることになる。
【００３２】
以上のように、自ディレクトリの継承マスクによって、他ディレクトリから自ディレクトリへのセキュリティステータスの継承の度合いを制限することができる。また、自ディレクトリの公開マスクによって、自ディレクトリから他ディレクトリへのセキュリティステータスの継承の度合いを制限することができる。この２つのマスクの設定を巧みに組み合わせることで、異なるディレクトリ間でアクセスの融通性を生じさせることも、アクセスの独立性を確保することもできる。例えば、他のディレクトリからアクセスされる可能性を皆無にしたい場合、図２の下位ファイル１３のように、自ディレクトリの継承マスク１３ＩＭを全て「０」に設定しておけばよい。また、自ディレクトリから他ディレクトリへのアクセスの可能性を無くしたい場合は、図２の上位ファイル１１のように、自ディレクトリの公開マスク１１ＲＭを全て「０」に設定しておけばよい。
【００３３】
以上、本発明の一実施形態を説明したが、上記の実施形態はあくまで本発明の説明のための例示であり、本発明を当該実施形態にのみ限定する趣旨ではない。従って、本発明は、上記実施形態以外の様々な形態でも実施することができる。例えば、上記実施形態では１つのディレクトリに１つの継承マスクと１つの公開マスクを用意したが、他の実施形態として、１つのディレクトリに、上位ディレクトリとの間の継承に関する継承マスク及び公開マスクと、下位ディレクトリとの間の継承に関する別の継承マスク及び公開マスクとを用意する方法や、更に別の実施形態として、１つのディレクトリに、他のディレクトリの各階層別に独立した継承マスク及び公開マスクを用意する方法や、更にまた別の実施形態として、１つのディレクトリに、他のディレクトリの各種類別に（例えば、ファイルかフォルダか、特定アプリケーションの専用ファイルか共用ファイルか、どのようなアクセス権があるファイルかなどに応じて）独立した継承マスク及び公開マスクを用意する方法なども採用し得る。また、公開マスクを設けずに、継承マスクだけを設けた実施形態も考え得る。
【図面の簡単な説明】
【図１】従来のＩＣカードにおける階層ディレクトリのアクセス制御のための構成を示すブロック図。
【図２】本発明の一実施形態にかかるＩＣカードにおける階層ディレクトリのアクセス制御のための構成を示すブロック図。
【符号の説明】
１１ 上位のファイル（上位のディレクトリ）
１３ 下位のファイル（下位のディレクトリ）
１１Ａ、１３Ａ セキュリティ属性
１１Ｓ、１３Ｓ セキュリティステータス
１１ＩＭ、１３ＩＭ 継承マスク
１１ＲＭ、１３ＲＭ 公開マスク[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a technique for controlling access to an information storage location (directory) by a computer, and more particularly to an information access management technique suitable for managing a right to add or delete a directory in a multipurpose IC card. .
[0002]
[Prior art]
In a computer system, a number of logical storage locations (directories) such as files and folders are formed in a storage area, and storage information is organized, classified, and managed by the directories. Multiple directories can be organized in a hierarchical configuration. For example, as shown in FIG. 1, some files (or folders) 3 and 5 of the second hierarchy are put in a file (or folder) 1 of the first hierarchy, and a file 5 of the second hierarchy is For example, the file 7 of the third hierarchy is put therein.
[0003]
In the hierarchical directory structure, a shallow side of a directory of different layers is referred to as “upper” and a deeper side is referred to as “lower” in this specification. For example, in FIG. 1, file 1 is higher than files 3 and 5, and file 7 is lower than file 5. The top directory is called the "root directory". A path (a series of directories) from the root directory to the directory of interest is referred to as a “path” of the directory of interest. For example, in FIG. 1, the path of the file 7 is “file 1-file 5-file 7”.
[0004]
One type of computer system is an IC card, and a storage area in the IC card is also managed by a directory. An IC card that can be used only for a single use (for example, one type of service provided by one company) is known, while a plurality of uses (for example, many types of services provided by multiple companies) are known. There is also known a multipurpose IC card that can be used for a computer. In the multipurpose IC card, a separate directory is constructed for each purpose of use. For example, in FIG. 1, a file 3 is formed for use by the service of company A, and a file 5 is formed for use by the service of company B.
[0005]
In the multipurpose IC card, in principle, the service machine of Company A can access only the directory for the service of Company A, and the access of each company and each machine can not access the directory for the service of another company. Rights need to be controlled.
[0006]
As a conventional method of controlling the access right, as shown in FIG. 1, a unique security attribute 1A, 3A, 5A, 7A and a security status 1S, 3S, 5S, 7S are provided for each directory 1, 3, 5, 7. There is known a method of determining whether access is permitted or not based on a logical operation of a security attribute and a security status.
[0007]
That is, in the example of FIG. 1, the security attributes 1A, 3A, 5A, and 7A of the directories 1, 3, 5, and 7 include seven types of access party keys “P1” to “P7” and seven types of node keys “N1”. "-N7", it is specified whether or not each of the three access right levels is accessible. Here, the “access party key” is an access key entered by a person (for example, a service providing company) accessing the directory into the card, and the “node key” is used for the access. This is an access key that a machine (for example, each card reader / writer of a service provider) inputs to a card. The specific number of the key corresponding to each key type can be individually set for each of the directories 1, 3, 5, and 7.
[0008]
In the example shown in FIG. 1, the security attribute 5 </ b> A of the file 1 has, for example, an access right at the level “addition” (for example, a right to add or delete a new lower-level file immediately below the file 1). , The value “1” is set for the key type “P1”, and the value “0” is set for the other key types. This is because when the party issuing the access command with the file 1 as the current directory inputs the access party key corresponding to the key type “P1” in the file 1 and performs authentication, the “addition” for the file 1 is performed. Access is allowed. In the security attribute 7A of the file 7, for example, a value "1" is set to the key type "P2" and "N1" for the access right of the level "rewrite" (for example, the right to rewrite the file 7). , The value “0” is set for the other key types. This is because, using a machine having a node key corresponding to the key type “N1” in the file 7 and having an access party key corresponding to “P2”, a party who issues an access command in which the file 7 is a current directory is issued. If the authentication is performed by inputting the access party key of the key type “P2”, it means that the “rewrite” access of the file 7 is permitted.
[0009]
The security statuses 1S, 3S, 5S, and 7S of the directories 1, 3, 5, and 7 indicate that a key corresponding to the key type is obtained from the accessing party and the machine at the time of authentication at the time of starting access to the directory as the current directory. This indicates whether the input has been made. For example, in FIG. 1, in the security status 5S of the file 5, a value “1” is set for the key type “P1”, and a value “0” is set for the other key types. This means that only the access party key corresponding to the key type “P1” has been input.
[0010]
The control of the access right for each of the directories 1, 3, 5, and 7 is performed by a logical operation of the security attribute and the security status of each directory. There are many types of the logical operation, but as a simple example, a logical product of the security attribute and the security status is calculated, and if any bit in the logical product is “1” ( In short, access is permitted (if authentication is performed using a key corresponding to a key type in which "1" is set in the security attribute). For example, in the example of FIG. 1, when focusing on the file 5, the security status 5S has "1" in the bit of "P1" (that is, authentication is performed with the key of "P1"), and Since “1” is set in the bit of “P1” in the bit string related to “addition” of the attribute 1A, the access of “addition” is permitted. As described above, access control of each directory is performed based on the security attribute and the security status.
[0011]
Further, in the conventional access control, a security status established for an access with a certain directory as a current directory is inherited according to a certain rule by a security status of another access with another directory as a current directory. I have. The rule of inheritance is complicated, but as a simple example based on the inheritance rule, the security status of the current directory (file 5) established for the first access using a certain directory (for example, file 5) as the current directory is The security status of the higher-level directory (file 1) in the second access using the higher-level directory (eg, file 1) on the path of the current directory as the current directory is also inherited as it is. For example, the security status 5S “10000000000000” established for the file 5 in the first access is inherited as it is by the security status 1S of the file 1 in the second access, and the security status 1S of the file 1 also becomes “1000000000000”. .
[0012]
As described above, the reason why the security status of one directory is inherited by another directory is to provide flexibility of access between different directories from the viewpoint of the operation of the IC card service (that is, as necessary, It is necessary to simply use an access key for a certain directory to enable access to another directory).
[0013]
For example, in FIG. 1, the security status 5S of the file 5 is inherited by the security status 1S of the file 1, and “1” is set in the “P1” bit. Even if inheritance occurs in this manner, in the case of the example of FIG. 1, no access is permitted to the file 1 because “1” is not set in the “P1” bit in the security attribute 1A of the file 1. . However, if “1” is previously set in the “P1” bit of “addition” of the security attribute 1A of file 1, the “addition” access to file 1 is permitted by the above inheritance. Become. In this way, depending on how the security attributes of each directory are set, those who only know the key of the other directory may or may not reflect the inheritance of security status from other directories. You can control whether access is granted or denied.
[0014]
[Problems to be solved by the invention]
According to the above-mentioned prior art, as a side effect of inheriting the security status, maintaining independence of access between different directories (that is, for a person who only knows the key of a certain directory, The problem is that access to certain other directories that should not be accessed should never be allowed).
[0015]
For example, in FIG. 1, a person who has input a key of the key type “P1” for the file 5 and is permitted to “add” access to the file 5 is placed in a new directory immediately below the file 5, for example, a file 7. Is added, a key key of the key type “P2” is newly created for the file 7, and the key of the “P2” is input to access the file 7. Then, the result of inputting the key “P2” for the file 7 is inherited by the security status of the file 5 or the file 1 on the path of the file 7, and the security status of the file 5 or the file 1 is changed to the reference number 5S. As shown by '1S', “1” is also set in the bit of the key type “P2”. As a result, the “additional” access to the file 1 that should not be permitted is permitted, so that, for example, an access such as deletion to another file 3 immediately below the file 1 becomes possible.
[0016]
As described above, according to the related art, it is impossible to achieve both access flexibility and access independence between different directories.
[0017]
In a multipurpose IC card, there is a high possibility that a service to be used differs for each user. Therefore, as a method of creating a directory of each service in the IC card, a directory for the service is added by a service provider or the like every time the user starts using each service. A method would be adopted. However, if the independence between directories cannot be ensured, there is a possibility that a company that has newly added a directory can access a directory of another company.
[0018]
Therefore, an object of the present invention is to make it possible to achieve both flexibility and independence of access between directories in a hierarchical directory structure.
[0019]
[Means for Solving the Problems]
A directory access control system for a computer according to the present invention includes: a directory storage unit that stores a plurality of directories; a security status storage unit that stores a security status reflecting an authentication result for each of the plurality of directories; Security attribute storage means that stores whether or not access to the own directory is permitted if the contents are appropriate, and an inheritance mask that specifies conditions for inheriting the security status of another directory to the security status of the own directory. and inheritance mask storage means for storing, for each directory, published which defines the conditions under which to inherit the security status of the self-directory to the security status of other directory And a public mask storage means for storing the disk. When the security status of another directory is inherited by the security status of the directory of interest, the inheritance mask of the directory that matches the public mask of the other directory among the security statuses of the other directories. Only the items that meet the conditions specified in the above are inherited by the security status of the directory of interest . Then, when access to the focused directory is requested, access to the focused directory is permitted based on a result of a predetermined logical operation of the security attribute and the security status of the focused directory. Is determined.
[0020]
According to this system, the degree to which the security status of another directory is inherited by the security status of the directory of interest can be controlled by the conditions set in the inheritance mask and the public mask . For example, it is possible to set so as to inherit only the authentication result related to a specific key, or to set so as not to inherit anything. By the inheritance control by the inheritance mask and the public mask, the flexibility of access between directories can be generated, and the independence of access can be ensured.
[0022]
The present invention is suitable for controlling access to a directory in an IC card, but can be adopted in various types of computers other than the IC card.
[0023]
A computer program for implementing the present invention can be installed or loaded on a computer through various media such as a disk storage, a semiconductor memory, and a communication network.
[0024]
BEST MODE FOR CARRYING OUT THE INVENTION
FIG. 2 shows a configuration for controlling access to a hierarchical directory in an IC card according to an embodiment of the present invention.
[0025]
In the storage area of the computer, a large number of files (or folders) can be arranged in a hierarchical structure, but FIG. 2 shows only two files 11 and 13 having a higher-order and lower-order relationship in the hierarchical structure. . Therefore, another file (not shown) may exist further above the upper file 11 shown, and another file (not shown) other than the lower file 13 may exist immediately below the upper file 11. Further, another file (not shown) may exist below the lower file 13.
[0026]
Each of the files 11 and 13 in the card has security attributes 11A and 13A and security statuses 11S and 13S having the same meanings as those of the prior art, and further has inherit masks 11IM and 13IM and release (release). ) Masks 11RM and 13RM are further provided. These two types of masks are for controlling inheritance of security status between different directories. Here, the rules for determining which directory can inherit the security status from one directory may be the same as in the related art, or may be different, but in this embodiment, the lower-level file 13 The security status 13S of the lower file 13 established by the access to the current directory is inherited by the security status 11S of the upper file 11 in the access to the upper file 11 on the path of the lower file 13 as the current directory. And
[0027]
The inheritance masks 11IM and 13IM of the files 11 and 12 are masks applied to the security status of another file when the security status is inherited from another file to the own file. For example, in the example of FIG. 2, “1” is set only in the bit of the key type “N1” in the inheritance mask 11IM of the upper file 11, and all the bits of the other key types are “0”. This means that when the security status is inherited from another file (for example, the lower file 13) to the upper file 11, only the bits of the key type “N1” in the security status of the other file are inherited (that is, the other file's security status). If the bit of the status “N1” is “1”, the bit of the status “N1” of the own file also becomes “1”, and the bits of other key types are not inherited (that is, the status of the other file). Even if bits other than “N1” are “1”, that of the own file does not become “1”.
[0028]
The public masks 11RM and 13RM of the files 11 and 12 are masks applied to the security status of the own file when the security status is inherited from the own file 11 or 13 to another file. For example, in the example of FIG. 2, in the public mask 13RM of the lower file 13, "1" is set only in the bit of the key type "N1", and all the bits of the other key types are "0". This means that when inheriting the security status from the lower file 13 to another file (for example, the upper file 11), only the bits of the key type “N1” in the security status of the own file 13 are inherited (that is, If the “N1” bit of the status 13S of the file 13 is “1”, that of the other file also becomes “1”, and the bits of other key types are not inherited (that is, the status 13S of the own file 13). Even if bits other than “N1” are “1”, that of other files does not become “1”.
[0029]
Control of inheritance of security status and control of access to the directory are performed as follows. That is, when a person who has accessed the first directory subsequently accesses a second directory that inherits the security status of the first directory, the inheritance control process sets the security status of the second directory to:

Calculate by Then, the access control process determines whether to permit access to the second directory by logically calculating the security status and the security attribute of the second directory in the same manner as in the related art.
[0030]
For example, in the example of FIG. 2, the security status 13S of the lower-level file 13 is “1100000 100000”. When a person who accesses the lower-level file 13 and establishes the illustrated security status 13S attempts to access the upper-level file 11 next, the inheritance control process sets the security status 11S of the upper-level file 11 to

Is calculated. In other words, the bits of the security status 11S of the lower file 13 that are inherited by the upper file 13 are bits for which “1” is set in both the public mask 13RM of the lower file 13 and the inheritance mask 11IM of the upper file 11, that is, the key. Only bits of type “N1” are provided. Thus, the security status 11S of the upper file 11 becomes “00000000 10000000”. In the example of FIG. 2, in the security attribute 11A of the upper-level file 11, "1" is not set in the bit of the key type "N1" for any access right level, so depending on the inheritance from the lower-level file 13, No access is allowed for the upper file 11.
[0031]
On the other hand, if the “P2” bit is set to “1” in both the public mask 13 RM of the lower file 13 and the inheritance mask 11 IM of the upper file 11, the upper file 11 is inherited from the lower file 13. In the security status 11S, “1” is set in the bit of “P2”, which matches the value of the “addition” of the security attribute 11A of the upper file 11, so that the “add” access is permitted for the upper file 11. Will be.
[0032]
As described above, the degree of inheritance of the security status from another directory to the own directory can be restricted by the inheritance mask of the own directory. Further, the degree of inheritance of the security status from the own directory to another directory can be restricted by the public mask of the own directory. By skillfully combining the settings of the two masks, it is possible to provide access flexibility between different directories and to ensure access independence. For example, if there is no possibility of being accessed from another directory, all the inheritance masks 13IM of the own directory may be set to “0” as in the lower file 13 of FIG. In order to eliminate the possibility of access from the own directory to another directory, the public mask 11RM of the own directory may be set to “0” as in the upper file 11 in FIG.
[0033]
As mentioned above, although one embodiment of the present invention was described, the above-mentioned embodiment is only an illustration for explanation of the present invention, and does not purport to limit the present invention only to this embodiment. Therefore, the present invention can be implemented in various modes other than the above-described embodiment. For example, in the above embodiment, one directory has one inheritance mask and one public mask, but as another embodiment, one directory has an inheritance mask and a public mask related to inheritance with an upper directory, A method of preparing another inheritance mask and a public mask relating to inheritance with a lower directory, and as still another embodiment, preparing an independent inheritance mask and a public mask in one directory for each hierarchy of another directory And in yet another embodiment, one directory contains files for each type of directory (eg, files or folders, dedicated or shared files for a particular application, How to prepare independent inheritance masks and public masks It may also be employed. Further, an embodiment in which only a succession mask is provided without providing a public mask can be considered.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration for controlling access to a hierarchical directory in a conventional IC card.
FIG. 2 is an exemplary block diagram showing a configuration for controlling access to a hierarchical directory in the IC card according to the embodiment of the present invention;
[Explanation of symbols]
11 Top files (top directories)
13 Lower files (lower directories)
11A, 13A Security attributes 11S, 13S Security status 11IM, 13IM Inheritance mask 11RM, 13RM Public mask

Claims (3)

Directory storage means for storing a plurality of directories;
Security status storage means for storing a security status reflecting an authentication result for each of the plurality of directories;
Security attribute storage means for storing a security attribute defining what kind of content the security status is to permit access to the directory;
Inheritance mask storage means for storing an inheritance mask defining conditions for inheriting the security status of another directory to the security status of the own directory;
Public mask storage means for storing a public mask defining conditions for inheriting the security status of the own directory to the security status of another directory for each directory;
When allowing the security status of the directory of interest to inherit the security status of another directory, the security status of the other directory matches the public mask of the other directory and inherits the directory of interest. Only an item that meets the conditions defined in the mask, an inheritance control unit that inherits the security status of the directory of interest ,
When an access to the noted directory is requested, the access to the noted directory is permitted based on a result of a predetermined logical operation of the security attribute and the security status of the noted directory. A directory access control system for a computer, comprising: Directory storage means for storing a plurality of directories;
Security status storage means for storing a security status reflecting an authentication result for each of the plurality of directories;
Security attribute storage means for storing a security attribute defining what kind of content the security status is to permit access to the directory;
Inheritance mask storage means for storing an inheritance mask defining conditions for inheriting the security status of another directory to the security status of the own directory;
A computer system having public mask storage means for storing a public mask defining a condition for inheriting the security status of the own directory to the security status of another directory for each directory ,
When the security status of the directory of interest is inherited by the computer, the security status of the other directory is inherited from the security status of the other directory. Inheritance control step of causing only the items that meet the conditions defined in the inheritance mask to be inherited by the security status of the directory of interest ,
When the computer is requested to access the directory of interest, based on a result of a predetermined logical operation between the security attribute and the security status of the directory of interest, the computer accesses the directory of interest. A directory access control method for a computer, comprising: an access control step of determining whether to permit. Directory storage means for storing a plurality of directories;
Security status storage means for storing a security status reflecting an authentication result for each of the plurality of directories;
Security attribute storage means for storing a security attribute defining what kind of content the security status is to permit access to the directory;
Inheritance mask storage means for storing an inheritance mask defining conditions for inheriting the security status of another directory to the security status of the own directory;
For each directory in a computer system having a, a public mask storage means for storing a public mask that defines the conditions for inheriting own directory security status to another directory of security status,
When allowing the security status of the directory of interest to inherit the security status of another directory, the security status of the other directory matches the public mask of the other directory and inherits the directory of interest. An inheritance control step of causing only the items that match the conditions defined in the mask to be inherited by the security status of the directory of interest ,
When an access to the noted directory is requested, the access to the noted directory is permitted based on a result of a predetermined logical operation of the security attribute and the security status of the noted directory. A computer-readable recording medium carrying a program for causing a computer to execute a computer directory access control method having an access control step of determining whether the directory access control is performed.

Images