JP4251633B2 - Determination device, program, recording medium, and determination method - Google Patents

Description

  The present invention relates to a determination device, a program, a recording medium, and a determination method. In particular, the present invention relates to a determination apparatus, a program, a recording medium, and a determination method for determining consistency of settings for permitting or prohibiting access to a plurality of objects constituting a hierarchical structure.

  In recent years, documents written in a structured language such as XML (Extensible Markup Language) have been widely used. An XML document can describe both a plurality of objects and a parent-child relationship between the objects. For this reason, it is widely used in databases that want to manage data hierarchically. Furthermore, in recent years, a technique for setting permission or prohibition of access to a plurality of objects included in an XML document has been used. According to this technique, permission or prohibition of access can be set not only in document units but also in object units.

  Conventionally, in many database systems, Xpath is used as a method for expressing an object having a parent-child relationship in XML or the like. Xpath can appropriately represent an object that satisfies a predetermined condition or a set of predetermined objects. For this reason, research on Xpath has been widely performed. For example, a method for efficiently searching an object specified by Xpath from the entire XML document has been proposed (see Non-Patent Documents 1 and 2). .

Non-Patent Document 3 will be described later.
F. Neven and T Schwentick.XPath containment in the presence of disjunction, DTDs, and variable, In ICDT, 2003. G. Mikalu and D. Suciu, Containment and equivalence for an XPath fragment, In PODS, JEHopcroft and JDUllman, Introduction to Automata Theory, Languages, and Computation, Addison-Wesley, 1979

  As described above, access permission or prohibition can be set for each object constituting the XML document. However, there are various inconveniences when only access to a child object is permitted although access to the parent object is prohibited. For example, when such an XML document is accessed, only child objects can be read, but in the read XML document, the parent-child relationship is not properly described and an incomplete XML document is generated. For this reason, such an XML document cannot be handled by a conventional program module that receives the XML document, for example, an API such as DOM or SAX that analyzes the hierarchical structure of the XML document.

  Therefore, an object of the present invention is to provide a determination device, a program, a recording medium, and a determination method that can solve the above-described problems. This object is achieved by a combination of features described in the independent claims. The dependent claims define further advantageous specific examples of the present invention.

In order to solve the above-described problem, in the first aspect of the present invention, there is provided a determination device for determining consistency of settings for permitting or prohibiting access to a plurality of objects having a parent-child relationship with each other, A rule acquisition unit that acquires a plurality of access control rules that permit or prohibit access to any of the objects, and each of the plurality of access control rules is an ancestor of an object that is permitted to access by the access control rules. A rule determination unit that determines whether or not an integrity condition that is a condition that access to an object is permitted by any one of the plurality of access control rules; and any of the access control rules satisfies the consistency condition A notification unit for notifying an instruction to change the plurality of access control rules when there is not And a determination program using the determination apparatus. The determination apparatus includes: a program that causes a computer to function as the determination apparatus; a recording medium that stores the program;
The above summary of the invention does not enumerate all the necessary features of the present invention, and sub-combinations of these feature groups can also be the invention.

  According to the present invention, it is possible to determine the consistency of data constituting a hierarchical structure.

  Hereinafter, the present invention will be described through embodiments of the invention. However, the following embodiments do not limit the invention according to the scope of claims, and all combinations of features described in the embodiments are included. It is not necessarily essential for the solution of the invention.

  FIG. 1 shows a block diagram of the determination apparatus 10. An object of the determination apparatus 10 is to determine the consistency of settings for permitting or prohibiting access to a plurality of objects having a parent-child relationship with each other in hierarchical data such as an XML document. The determination apparatus 10 includes a rule expansion unit 100, a rule acquisition unit 110, a rule determination unit 120, and a notification unit 130.

  The rule expansion unit 100 acquires an access control policy 20 in which permission or prohibition of access to hierarchical data is set. Then, the rule expansion unit 100 expands the acquired access control policy 20 into a plurality of access control rules each permitting or prohibiting access to any of the plurality of objects. The plurality of expanded access control rules are, for example, access control rules 30-1 to 30-N.

  The rule acquisition unit 110 acquires the access control rules 30-1 to 30 -N and sends them to the rule determination unit 120. The rule determination unit 120 determines whether each of the access control rules 30-1 to 30 -N satisfies the consistency condition, and sends the determination result to the notification unit 130. The consistency condition satisfied by a certain access control rule is, for example, that access to each ancestor of an object permitted to be accessed by the access control rule is permitted by any of the access control rules 30-1 to 30-N. It is a condition.

  In addition, when each access control rule permits access to a set of a plurality of objects, the rule determination unit 120 applies to any ancestor object of any object included in the set of objects permitted to access. If access is not permitted by any access control rule, it may be determined that the consistency condition is not satisfied.

  When any access control rule does not satisfy the consistency condition, the notification unit 130 notifies the user, for example, an editor of the access control rule, of an instruction to change the access control rules 30-1 to 30-N. For example, the notification unit 130 may notify an instruction to delete an access control rule that does not satisfy the consistency condition. As a result, the user can appropriately grasp that the access control policy needs to be changed, and can use it to correct the access control policy. Further, the notification unit 130 may delete the access control policy to be deleted without receiving confirmation input from the user based on the user setting. In this case, the determination apparatus 10 can automatically correct the access control policy.

  FIG. 2 shows an example of the access control policy 20. The access control policy 20 includes a plurality of access control rules. The access control rule is an access requester ID that is identification information for identifying an access requester that permits access, an object ID that is identification information of an object that is permitted to be accessed by the access requester, and permits access to the object. Or control information indicating prohibition.

  The plurality of objects may have a tree-structure parent-child relationship, and the object ID of the object may be path information that is a path from the root object of the tree structure to the object. As an example, the access control rule on the first line in the figure indicates that the access requester whose identification information is the operator is allowed to read the object specified by / org which is the path information. This path information may be expressed by, for example, Xpath or DTD (Document Type Description), may be expressed by a tree language such as a tree automaton or modal logic, or a character string such as a regular expression or a character string automaton. It may be expressed by language.

  In addition, the access control rule may further include a condition to be satisfied by the passing object in the path information. For example, the access control rule on the second line in this figure indicates that access to an object specified by / org / dept / emp that is path information is permitted. Furthermore, this access control rule includes a condition that the id which is the attribute of the object specified by / org / dept is “S77”. In other words, according to this access control rule, reading is permitted for the object emp that arrives via the object dept whose attribute value named id is “S77”. In the following description, an expression specifying this condition, for example, [@ id = 'S77'] is called a predicate expression.

  Further, the control information (+ r) indicates permission to read the specified object. On the other hand, the control information (+ R) indicates that reading of the designated object and its descendant object is permitted. That is, the access control rule on the third line in the figure indicates that reading is permitted for all descendant objects of the object name specified by / org / dept / emp / name. In the following description, it is assumed that reading of an object that is not permitted to be read by any access control rule is prohibited.

  In this embodiment, permission or prohibition of access to a plurality of objects in the XML document is handled, but the plurality of objects according to the present invention is not limited to this example. For example, the object may be a file or a folder (directory) in the file system, or data managed in various databases.

  FIG. 3 shows an example of the access control rules 30-1 to 30-N. The rule expansion unit 100 expands the acquired access control policy 20 into access control rules 30-1 to 30-N. For example, the rule expansion unit 100 expands the access control rule specified by the control information (+ R) in the access control policy 20 into the access control rules 30-4 to 7 using the control information (+ r). That is, (Operator, / org / dept / emp / name, + R), which is the access control rule before deployment, is (Operator, / org / dept / emp / name, + r) and (Operator, / org / dept / emp / name // *, + r), (Operator, / org / dept / emp / name // @ *, + r) and (Operator, / org / dept / emp / name // text ( ), + r).

  Here, / org / dept / emp / name // * indicates all descendant objects of the name object that sequentially go from the root object through the objects org, dept, and emp. In addition, / org / dept / emp / name // @ * indicates all attribute objects that are descendants of the name object that sequentially go from the root object through the objects org, dept, and emp. In addition, / org / dept / emp / name // text () indicates all text objects that are descendants of the name object from the root object through the objects org, dept, and emp sequentially. In this way, the access control rule may permit access to not only a single object but also an object set including at least one object.

  Here, since access to / org / dept / emp that is an ancestor of the object name that is permitted to be accessed by the access control rule 30-7 is not permitted, the access control rule 30-7 sets the consistency condition. Do not meet. Therefore, the notification unit 130 notifies the user of an instruction to change the access control rules 30-1 to 30-N.

  FIG. 4 shows an example of the rule change instruction 40. The notification unit 130 notifies the user of an instruction to change the access control rules 30-1 to 30-N when any of the access control rules does not satisfy the consistency condition. For example, the notification unit 130 notifies the user of either an access restriction instruction for deleting any access control rule or an access mitigation instruction for adding a new access control rule.

  (A) shows an example of an access relaxation instruction. The notification unit 130 notifies, as the access relaxation instruction, an instruction to add a new access control rule that allows access to each object that is an ancestor of an object that is permitted to be accessed by an access control rule that does not satisfy the consistency condition. .

  For example, in the access control rules 30-1 to 30-N, reading from the object emp and the object dept that are ancestors of the object name is not permitted. Therefore, the notification unit 130 notifies an instruction to add an access control rule that permits reading for these objects emp and dept.

  (B) shows an example of an access restriction instruction. In the access control rules 30-1 to 30-N, access to the object emp that is the parent of the object name may not be permitted. For example, the access control rule 30-4 permits reading of the object name that passes through the objects org, dept, and emp regardless of the attribute of the object dept. On the other hand, the access control rule 30-3 permits only reading with respect to the object emp that starts from the root object and passes through the object dept having the attribute id S77. That is, the object emp which is a child of the object dept whose attribute id is not S77 is not permitted to be read even though it is the parent of the object name.

  In such a case, the notification unit 130 may notify an access restriction instruction to delete the access control rules 30-4 to 7, but the access control rules 30-4 to 7 are not displayed as shown in FIG. You may notify that the object set which permits access is changed. That is, the notification unit 130 may notify an instruction to add a condition passing through the object dept having the attribute id S77 to the access control rules 30-4 to 7-7.

  As described above, as shown in the figure, when the access control rule does not satisfy the consistency condition, the notification unit 130 is an access relaxation instruction for adding a new access control rule, or an access for changing or deleting an access control rule. Notify users of restriction instructions. As a result, the user can appropriately grasp that the access control policy needs to be changed, and can use it to correct the access control policy.

  Further, in this case, the notification unit 130 may select and notify the access mitigation instruction or the access restriction instruction based on the access requester permitted to access according to the access control rule. For example, in the case of this figure, the operator who is the access requester (Operator) has access authority below a predetermined standard, so the notification unit 130 may select and notify the access restriction instruction. Thus, the determination apparatus 10 can notify an appropriate instruction according to the access requester.

  FIG. 5 shows an operation flow of processing in which the determination apparatus 10 determines the access control policy 20. The rule expansion unit 100 expands the acquired access control policy 20 into a plurality of access control rules each permitting or prohibiting access to any of the plurality of objects (S500). Furthermore, the rule expansion unit 100 may convert an access control policy described in DTD (Document Type Description) or the like into an access control rule described in Xpath.

  The rule acquisition unit 110 acquires the access control rules 30-1 to 30-N from the rule expansion unit 100 (S510). Then, the rule determination unit 120 determines whether each of the access control rules 30-1 to 30-N satisfies the consistency condition (S520). For example, the rule determination unit 120 determines whether an access to an ancestor object of an object permitted to be accessed by each of the access control rules 30-1 to 30-N depends on any of the access control rules 30-1 to 30-N as the consistency condition. Judgment is made on the conditions for permission. Thereby, the notification unit 130 can determine whether or not the read XML document is fragmented.

This process will be described using an example in which the path information of the access control rule is Xpath.
First, the rule determination unit 120 obtains all prefixes of path information of each access control rule. For example, the rule determination unit 120 obtains / org, / org / dept, and / org / dept / emp as prefixes of / org / dept / emp / name. Next, the rule determination unit 120 determines whether these prefixes are included in the path information in any other access control rule. For example, the prefix / org is included in the path information of the access control rule 30-1 (for example, in this case, completely matches). On the other hand, the prefix / org / dept is not included in the path information in any access control rule. The rule determination unit 120 determines that the consistency condition is not satisfied when any prefix is not included in the path information in any access control rule.

  As described above, in order to determine whether or not the consistency condition is satisfied, inclusion determination for determining whether a certain Xpath expression is included in another Xpath expression is necessary. For example, the rule determining unit 120 determines that the Xpath expression / a is included in the Xpath expression / a. Further, it is determined that the Xpath expression / a is included in the Xpath expression / *. Further, it is determined that the Xpath expression / a / b // * is included in the Xpath expression / a // *. Further, it is determined that the Xpath expression / ns0: a is included in the Xpath expression / ns0: *. Further, it is determined that the Xpath expression / a [@ id = 0] is included in the Xpath expression / a. Further, it is determined that the Xpath expression / a [@ id = 0 or @ id = 1] is included in both the Xpath expression / a [@ id = 0] and the Xpath expression a [@ id = 1]. Since the specific process of inclusion determination is exemplified in Non-Patent Documents 1 to 3, the description in this embodiment is omitted.

  Subsequently, a modification of the process for determining the consistency condition will be described. First, the rule determination unit 120 generates an automaton indicating a set of objects permitted to be accessed by the access control rule based on each access control rule that permits access. Next, the rule determination unit 120 generates an automaton indicating a set of objects whose access is prohibited by the access control rule based on each access control rule that prohibits access. Then, the rule determination unit 120 performs the following processing according to the access control rule or the standard defined in the XML document or the like.

(Modification 1) A case where an access control rule for prohibiting access and an access control rule for permitting access are mixed.
The rule determination unit 120 generates a difference automaton obtained by subtracting the sum of the automatons of each access control rule that prohibits access from the sum of automatons of each access control rule that permits access. When schema information is specified in the XML document, the rule determination unit 120 further generates an automaton based on the schema information, and generates an automaton that indicates a common part between the generated automaton and the difference automaton. May be.

  Then, the rule determining unit 120 determines the consistency condition by determining whether or not all the prefixes of the generated automaton are included in the automaton itself. Since the calculation of the automaton common part, the calculation of the automaton prefix, and the determination of the inclusiveness of the automaton are exemplified in Non-Patent Document 1, the description in this embodiment is omitted.

(Modification 2) A case where it is not permitted to set a plurality of access control rules contradicting the same object according to a standard in a data structure such as an XML document.
The rule determination unit 120 generates an automaton that is a common part between the sum of automatons of each access control rule that permits access and the sum of automatons of each access control rule that prohibits access. When schema information is specified in the XML document, the rule determination unit 120 further generates an automaton based on the schema information, and generates an automaton indicating a common part between the generated automaton and the automaton of the common part. May be.

  Then, the rule determining unit 120 determines that the consistency condition is satisfied if the generated automaton is an empty set. As described above, the rule determining unit 120 matches the condition that access to each object that the access control rules 30-1 to 30-N permit access is not prohibited by any other access control rule. You may judge further as conditions.

(Modification 3) When it is not permitted to set neither permitted nor prohibited for an object according to a standard in a data structure such as an XML document.
The rule determination unit 120 generates an automaton included in either the sum of the automaton of each access control rule that permits access or the sum of the automaton of each access control rule that prohibits access. When schema information is specified in the XML document, the rule determination unit 120 further generates an automaton based on the schema information.

  Then, the rule determination unit 120 determines that the consistency condition is satisfied if the automaton generated based on the schema information is included in the automaton generated based on the access control rule. As described above, the rule determination unit 120 may determine a condition that access to all objects is permitted or prohibited by any of a plurality of access control rules.

  Subsequently, when it is determined that the consistency condition is satisfied (S530: YES), the determination apparatus 10 ends the process. At this time, the fact that the consistency condition is satisfied may be output and displayed. On the other hand, when the consistency condition is not satisfied (S530: NO), the notification unit 130 determines whether the access requester satisfies a predetermined condition (S540). For example, the notification unit 130 determines whether or not a predetermined access authority corresponding to the access requester is higher than a predetermined standard. When the access requester satisfies a predetermined condition (S540: YES), the notification unit 130 notifies the user of an access relaxation instruction (S550).

  On the other hand, when the access requester does not satisfy the predetermined condition (S540: NO), the notification unit 130 notifies the user of an access relaxation instruction (S560). An access relaxation instruction refers to, for example, an access control rule that does not satisfy a consistency condition, and a set of objects that the access control rule permits access to. This is an instruction to change to a set of objects for which access is permitted. Specifically, the notification unit 130 generates an access control instruction by the following process.

  First, for the path information of the access control rule that does not satisfy the consistency condition, the notification unit 130 detects all other access control rules that set permission or prohibition of access to any object indicated by the path information. In the following description, such an access control rule is called a similar access control rule. In addition, a plurality of pieces of path information having a common object to be specified are referred to as mutually similar path information.

  The notification unit 130 calculates a union of objects that are permitted to be accessed according to each detected access control rule. Next, the notification unit 130 calculates a product set of an object set that is permitted to be accessed by the access control rule that does not satisfy the consistency condition and a union of the calculated objects. Then, the notification unit 130 generates, as an access restriction instruction, an instruction to change the set of objects that the access control rule that does not satisfy the consistency condition permits access to the calculated intersection set.

  In this case, preferably, when the consistency condition of another access control rule is determined based on the access control rule to be changed, the rule determining unit 120 matches the consistency condition of the access control rule. Is determined again based on the changed access control rule. Thereby, all access control rules to be added to satisfy the consistency condition can be detected more accurately.

  Subsequently, the notification unit 130 obtains all prefixes in the path information of the access control rule that does not satisfy the consistency condition. And the notification part 130 performs the following processes about each path information which shows each prefix. First, the notification unit 130 detects all access control rules having path information similar to the path information. Next, the notification unit 130 calculates a union of objects that are permitted to be accessed according to each detected access control rule.

  Subsequently, the notification unit 130 calculates a product set of the object set indicated by the prefix and the union of the calculated objects. Then, the notification unit 130 generates, as an access restriction instruction, an instruction to add a new access control rule that permits access to the calculated product set. When an access control rule to be added is already set, it is desirable to exclude the access control rule from the access control rule to be added.

  For example, since the access control rule “(Operator, / org / dept / emp / name, + r)” shown in FIG. 3 does not satisfy the consistency condition, the notifying unit 130 determines that / org / dept / emp / name Find the prefixes / org, / org / dept, and / org / dept / emp. Here, / org is already set as an access control rule, so there is no problem. Next, the notification unit 130 detects (Operator, / org / dept [@ id = 'S77'] / emp, + r) as an access control rule similar to / org / dept / emp / name. Similarly, (Operator, / org / dept [@ id = 'S77'], + r) is detected as an access control rule similar to / org / dept.

  Then, / org / dept [@ id = 'S77'] / emp / name is calculated as a product set of the obtained / org / dept / emp / name and path information of a similar access control rule. As a result, the calculated product set is not included in the access control rules 30-1 to 30-N that have already been set, so the notification unit 130 notifies the access control rule as an access control rule to be changed.

Meanwhile, the notification unit 130 is a prefix / org, / org / dept, and / org / dept / emp will be processed as follows. First, since / org is already set as an access control rule, there is no problem. Next, the notification unit 130 detects (Operator, / org / dept [@ id = 'S77'] / emp, + r) as an access control rule similar to / org / dept / emp. Similarly, (Operator, / org / dept [@ id = 'S77'], + r) is detected as an access control rule similar to / org / dept.

  Then, / org / dept [@ id = 'S77'] / emp and / org / dept [@ id = 'S77'] are set as a product set of the obtained prefix and the path information of the detected access control rule. calculate. As a result, since the calculated product set is the same as the access control rule 30-2 and the access control rule 30-3 that have already been set, the notification unit 130 excludes the access control rule from the access control rule to be added. To do.

  As described above, according to this embodiment, the determination apparatus 10 can determine the consistency of the access control policy for an XML document in which access permission or prohibition is set using path information expressed by Xpath or the like. Then, when the consistency is not satisfied, the determination apparatus 10 can notify the user of an access control rule to be added or an access control rule to be deleted / changed to satisfy the consistency. Thereby, an administrator of the XML document can easily find and correct an error in the set access control rule.

  Note that the processing from S540 to S560 by the notification unit 130 is an example. Instead, the notification unit 130 may notify the user by generating both an access relaxation instruction and an access restriction instruction and displaying them on the screen. In this case, the notification unit 130 may cause the user to select whether to change the access control policy according to the access relaxation instruction or the access restriction instruction, and may change the access control policy based on the selected instruction. Thereby, the user can change the access control policy after comparing and examining the access relaxation instruction and the access restriction instruction.

  FIG. 6 shows an example of a hardware configuration of a computer that functions as the determination apparatus 10. The determination device 10 includes a CPU peripheral unit having a CPU 600, a RAM 620, a graphic controller 675, and a display device 680 that are connected to each other by a host controller 682, a communication interface 630 that is connected to the host controller 682 by an input / output controller 684, and a hard disk An input / output unit having a drive 640 and a CD-ROM drive 660, and a legacy input / output unit having a ROM 610, a flexible disk drive 650, and an input / output chip 670 connected to the input / output controller 684 are provided.

  The host controller 682 connects the RAM 620 to the CPU 600 and the graphic controller 675 that access the RAM 620 at a high transfer rate. The CPU 600 operates based on programs stored in the ROM 610 and the RAM 620 and controls each unit. The graphic controller 675 acquires image data generated by the CPU 600 or the like on a frame buffer provided in the RAM 620 and displays it on the display device 680. Instead of this, the graphic controller 675 may include a frame buffer for storing image data generated by the CPU 600 or the like.

  The input / output controller 684 connects the host controller 682 to the communication interface 630, the hard disk drive 640, and the CD-ROM drive 660 which are relatively high-speed input / output devices. The communication interface 630 communicates with an external device via a network. The hard disk drive 640 stores programs and data used by the determination apparatus 10. The CD-ROM drive 660 reads a program or data from the CD-ROM 695 and provides it to the input / output chip 670 via the RAM 620.

  The input / output controller 684 is connected to the ROM 610 and relatively low-speed input / output devices such as the flexible disk drive 650 and the input / output chip 670. The ROM 610 stores a boot program executed by the CPU 600 when the determination apparatus 10 is started up, a program depending on the hardware of the determination apparatus 10, and the like. The flexible disk drive 650 reads a program or data from the flexible disk 690 and provides it to the input / output chip 670 via the RAM 620. The input / output chip 670 connects various input / output devices via a flexible disk 690 and, for example, a parallel port, a serial port, a keyboard port, a mouse port, and the like.

  The program provided to the determination apparatus 10 is stored in a recording medium such as the flexible disk 690, the CD-ROM 695, or an IC card and provided by the user. The program is read from the recording medium via the input / output chip 670 and / or the input / output controller 684, installed in the determination apparatus 10, and executed.

  The program that is installed and executed in the determination apparatus 10 includes a rule expansion module, a rule acquisition module, a rule determination module, and a notification module. The operation that each module causes the determination device 10 to perform is the same as the operation of the corresponding member in the determination device 10 described with reference to FIGS.

  The program shown above may be stored in an external storage medium. As the storage medium, in addition to the flexible disk 690 and the CD-ROM 695, an optical recording medium such as a DVD or PD, a magneto-optical recording medium such as an MD, a tape medium, a semiconductor memory such as an IC card, or the like can be used. Further, a storage device such as a hard disk or a RAM provided in a server system connected to a dedicated communication network or the Internet may be used as a recording medium, and the program may be provided to the determination device 10 via the network.

  As mentioned above, although this invention was demonstrated using embodiment, the technical scope of this invention is not limited to the range as described in the said embodiment. It will be apparent to those skilled in the art that various modifications or improvements can be added to the above-described embodiment. It is apparent from the scope of the claims that the embodiments added with such changes or improvements can be included in the technical scope of the present invention.

  According to the embodiment described above, the determination device, program, recording medium, and determination method shown in the following items are realized.

(Item 1) A determination device for determining consistency of settings for permitting or prohibiting access to a plurality of objects having a parent-child relationship, each of which allows or prohibits access to any of the plurality of objects A rule acquisition unit that acquires an access control rule, and each of the plurality of access control rules has an access to each object that is an ancestor of an object permitted to be accessed by the access control rule, depending on any of the plurality of access control rules A rule determination unit that determines whether or not a consistency condition that is a permitted condition is satisfied, and when any of the access control rules does not satisfy the consistency condition, the plurality of access control rules are changed And a notification unit that notifies the instruction.
(Item 2) The notification unit, when any access control rule does not satisfy the consistency condition, an access restriction instruction that instructs to delete the access control rule, or the access control rule accesses The determination apparatus according to item 1, wherein an access mitigation instruction that is an instruction to add a new access control rule for permitting access to each object that is an ancestor of the permitted object is notified.

(Item 3) The rule acquisition unit acquires, as the access control rule, a set of identification information that identifies an access requester that permits access and identification information of an object that permits access by the access requester. When any access control rule does not satisfy the consistency condition, the notification unit selects the access mitigation instruction or the access restriction instruction based on an access requester permitted to access by the access control rule. The determination device according to item 2, which is notified.
(Item 4) Each of the plurality of access control rules permits access to an object set including at least one object, and the rule determination unit is configured to select any object included in the object set for each access control rule. If access to any of the ancestor objects is not permitted by any of the plurality of access control rules, it is determined that the access control rule does not satisfy the consistency condition, and the notification unit When an access control rule does not satisfy the consistency condition, an object that allows access by the access control rule and any other access control rule in common for an object set that the access control rule permits access Instructions to change to a set of The determination device according to item 2, which is notified as a process restriction instruction.

(Item 5) The plurality of objects have a tree-structure parent-child relationship, and the rule acquisition unit changes, as the access control rule, an object to which access is permitted from the tree-structure root object to the object. Item 1 for acquiring path information designated by a route to reach, wherein the rule determination unit determines whether the access control rule satisfies the consistency condition based on path information in each of the plurality of access control rules The determination apparatus described.
(Item 6) The rule determining unit indicates that, as the consistency condition, access to each object that each of the plurality of access control rules permits access is not prohibited by any other access control rule. The determination device according to item 1, further determining a condition.
(Item 7) The rule determination unit further determines, as the consistency condition, a condition that access to each of all the plurality of objects is permitted or prohibited by any of the plurality of access control rules. The determination apparatus according to Item 1.

(Item 8) A determination device for determining consistency of settings for permitting or prohibiting access to a plurality of objects having a parent-child relationship with each other, each of which allows or prohibits access to any of the plurality of objects Consistency that is a condition that a rule acquisition unit that acquires an access control rule and access to each object that each of the plurality of access control rules permits access are not prohibited by any other access control rule A rule determination unit that determines whether or not a condition is satisfied, and a notification unit that notifies an instruction to change the plurality of access control rules when any of the access control rules does not satisfy the consistency condition Judgment device.
(Item 9) A determination device that determines consistency of settings for permitting or prohibiting access to a plurality of objects having a parent-child relationship, each of which allows or prohibits access to any of the plurality of objects Whether a rule acquisition unit that acquires an access control rule and a consistency condition that is a condition that access to each of all the plurality of objects is permitted or prohibited by any of the plurality of access control rules A determination apparatus comprising: a rule determination unit that determines whether or not; and a notification unit that notifies an instruction to change the plurality of access control rules when any of the access control rules does not satisfy the consistency condition.
(Item 10) A program that causes a computer to function as a determination device that determines the consistency of settings for permitting or prohibiting access to a plurality of objects that have a parent-child relationship with each other. A rule acquisition unit that acquires a plurality of access control rules that permit or prohibit access to any of the plurality of objects, and each of the plurality of access control rules is an ancestor of an object that is permitted to access by the access control rules. A rule determination unit that determines whether or not an integrity condition that is a condition that access to each object is permitted by any of the plurality of access control rules; and any access control rule satisfies the consistency condition If not, the plurality of access control routes A program that functions as a notification unit that notifies an instruction to change a message.
(Item 11) A recording medium on which the program according to Item 10 is recorded.

(Item 12) A determination method for determining consistency of settings for permitting or prohibiting access to a plurality of objects having a parent-child relationship, each of which allows or prohibits access to any of the plurality of objects A rule acquisition step of acquiring an access control rule, and each of the plurality of access control rules is determined by any of the plurality of access control rules that access to each ancestor object of the object permitted to be accessed by the access control rule A rule determination stage for determining whether or not a consistency condition, which is a permitted condition, is satisfied, and when any of the access control rules does not satisfy the consistency condition, the plurality of access control rules are changed And a notification step of notifying the instruction.

FIG. 1 shows a block diagram of the determination apparatus 10. FIG. 2 shows an example of the access control policy 20. FIG. 3 shows an example of the access control rules 30-1 to 30-N. FIG. 4 shows an example of the rule change instruction 40. FIG. 5 shows an operation flow of processing in which the determination apparatus 10 determines the access control policy 20. FIG. 6 shows an example of a hardware configuration of a computer that functions as the determination apparatus 10.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Determination apparatus 20 Access control policy 30 Access control rule 40 Rule change instruction 100 Rule expansion | deployment part 110 Rule acquisition part 120 Rule judgment part 130 Notification part

Claims (13)

A determination apparatus for determining consistency of settings for permitting or prohibiting access to a plurality of objects having a parent-child relationship with each other,
A rule acquisition unit for acquiring a plurality of access control rules each permitting or prohibiting access to any of the plurality of objects;
The difference automaton obtained by subtracting the sum of the automaton indicating the object set prohibited by the access control rule prohibiting access from the sum of the automaton indicating the object set permitted by the access control rule permitting access A rule determination unit that determines consistency conditions by determining whether all the prefixes of the generated difference automaton are included in the difference automaton itself, and
When any of the access control rules does not satisfy the consistency condition, all other objects that set permission or prohibition of access to any object indicated by the path information of the access control rule that does not satisfy the consistency condition An object set for which access is permitted by an access control rule that does not satisfy the consistency condition while calculating a union of objects permitted to be accessed by all the detected access control rules after detecting an access control rule And an instruction to change a set of objects that are allowed to access according to an access control rule that does not satisfy the consistency condition to an object set that is the product set. And a notifying unit that generates an access restriction instruction . A determination apparatus for determining consistency of settings for permitting or prohibiting access to a plurality of objects having a parent-child relationship with each other,
A rule acquisition unit that acquires a plurality of access control rules each permitting or prohibiting access to any of the plurality of objects;
The difference automaton obtained by subtracting the sum of the automaton indicating the object set prohibited by the access control rule prohibiting access from the sum of the automaton indicating the object set permitted by the access control rule permitting access Whether or not all the automaton prefixes indicating the common part between the automaton generated based on the schema information specified in the XML document and the automaton of the difference are included in the automaton of the difference itself. A rule determining unit that determines the consistency condition by determining
When any of the access control rules does not satisfy the consistency condition, all other objects that set permission or prohibition of access to any object indicated by the path information of the access control rule that does not satisfy the consistency condition An object set for which access is permitted by an access control rule that does not satisfy the consistency condition while calculating a union of objects permitted to be accessed by all the detected access control rules after detecting an access control rule And an instruction to change a set of objects that are allowed to access according to an access control rule that does not satisfy the consistency condition to an object set that is the product set. And a notifying unit that generates an access restriction instruction . The notification unit generates an instruction to add a new access control rule permitting access to the calculated intersection set as an access restriction instruction, and when the new access control rule is already set Excludes the new access control rule from the access control rule to be added
The determination apparatus according to claim 1 or 2. The plurality of objects have a tree-parent relationship.
The rule acquisition unit acquires, as the access control rule, path information that specifies an object to which access is permitted by a route from the root object of the tree structure to the object,
The rule judgment unit determining device according to claim 1 or claim 2 the access control rules to determine whether the integrity condition is satisfied based on the path information in each of said plurality of access control rules. The rule determination unit further determines, as the consistency condition, a condition that access to each object permitted to be accessed by each of the plurality of access control rules is not prohibited by any other access control rule. The determination apparatus according to claim 1 or 2 . 2. The rule determination unit further determines, as the consistency condition, a condition that access to each of all the plurality of objects is permitted or prohibited by any of the plurality of access control rules. Or the determination apparatus of Claim 2 . A determination apparatus for determining consistency of settings for permitting or prohibiting access to a plurality of objects having a parent-child relationship with each other,
A rule acquisition unit for acquiring a plurality of access control rules each permitting or prohibiting access to any of the plurality of objects;
The automaton of the common part of the sum of automaton indicating the object set permitted to be accessed by the access control rule permitting access and the sum of automaton indicating the object set not permitted to access by the access control rule prohibiting access A rule determination unit that determines that the consistency condition is satisfied if the automaton of the common part is an empty set ;
When any of the access control rules does not satisfy the consistency condition, all other objects that set permission or prohibition of access to any object indicated by the path information of the access control rule that does not satisfy the consistency condition An object set for which access is permitted by an access control rule that does not satisfy the consistency condition while calculating a union of objects permitted to be accessed by all the detected access control rules after detecting an access control rule And an instruction to change a set of objects that are allowed to access according to an access control rule that does not satisfy the consistency condition to an object set that is the product set. And a notifying unit that generates an access restriction instruction . A determination apparatus for determining consistency of settings for permitting or prohibiting access to a plurality of objects having a parent-child relationship with each other,
A rule acquisition unit for acquiring a plurality of access control rules each permitting or prohibiting access to any of the plurality of objects;
Included in either the sum of automaton indicating the object set permitted to access by the access control rule permitting access or the sum of automaton indicating the object set prohibited to access by the access control rule prohibiting access A rule determination unit that determines consistency conditions by determining whether or not all objects are included in an automaton that indicates a set of objects to be
When any of the access control rules does not satisfy the consistency condition, all other objects that set permission or prohibition of access to any object indicated by the path information of the access control rule that does not satisfy the consistency condition An object set for which access is permitted by an access control rule that does not satisfy the consistency condition while calculating a union of objects permitted to be accessed by all the detected access control rules after detecting an access control rule And an instruction to change a set of objects that are allowed to access according to an access control rule that does not satisfy the consistency condition to an object set that is the product set. And a notifying unit that generates an access restriction instruction . A program that causes a computer to function as a determination device that determines consistency of settings for permitting or prohibiting access to a plurality of objects having a parent-child relationship with each other,
The program causes the computer to
A rule acquisition unit that acquires a plurality of access control rules each permitting or prohibiting access to any of the plurality of objects;
The difference automaton obtained by subtracting the sum of the automaton indicating the object set prohibited by the access control rule prohibiting access from the sum of the automaton indicating the object set permitted by the access control rule permitting access A rule determination unit that determines consistency conditions by determining whether all the prefixes of the generated difference automaton are included in the difference automaton itself, and
When any of the access control rules does not satisfy the consistency condition, all other objects that set permission or prohibition of access to any object indicated by the path information of the access control rule that does not satisfy the consistency condition An object set for which access is permitted by an access control rule that does not satisfy the consistency condition while calculating a union of objects permitted to be accessed by all the detected access control rules after detecting an access control rule And an instruction to change a set of objects that are allowed to access according to an access control rule that does not satisfy the consistency condition to an object set that is the product set. programming to function as a notification unit that generates an access restriction instruction Beam. The notification unit generates an instruction to add a new access control rule permitting access to the calculated intersection set as an access restriction instruction, and when the new access control rule is already set Excludes the new access control rule from the access control rule to be added
  The program according to claim 9.   The recording medium which recorded the program of Claim 9 or Claim 10. A determination method for determining consistency of settings for permitting or prohibiting access to a plurality of objects having a parent-child relationship with each other using a determination device including a rule acquisition unit, a rule determination unit, and a notification unit ,
A rule acquisition step of acquiring a plurality of access control rules each permitting or prohibiting access to any of the plurality of objects by the rule acquisition unit;
The sum of automaton indicating the object set prohibited by the access control rule prohibiting access from the sum of the automaton indicating the object set permitted by the access control rule permitting access by the rule determining unit. Determining a consistency condition by determining whether all the prefixes of the generated difference automaton are included in the difference automaton itself;
When any of the access control rules does not satisfy the consistency condition, the notification unit sets permission or prohibition of access to any object indicated by the path information of the access control rule that does not satisfy the consistency condition. After detecting all other access control rules, the union of objects permitted to be accessed by all the detected access control rules is calculated, and the access is controlled by an access control rule that does not satisfy the consistency condition. A product set of the permitted object set and the calculated union of the objects is calculated, and a set of objects permitted to be accessed according to an access control rule that does not satisfy the consistency condition is defined as an object set to be the product set. Bei and generating an instruction to change the access restriction instruction That determination method. The notification unit generates an instruction to add a new access control rule permitting access to the calculated intersection set as an access restriction instruction, and when the new access control rule is already set Comprises the step of excluding the new access control rule from the access control rule to be added
The determination method according to claim 12.

Images