JP4417819B2 - Information processing apparatus, responsibility determination method, responsibility determination program, and recording medium - Google Patents

Description

  The present invention relates to an information processing device, an obligation determination method, an obligation determination program, and a recording medium, and more particularly, to an information processing device, an obligation determination method, an obligation determination program, and a recording medium that determine whether a resource is permitted to operate based on a security policy.

In computer systems, access rights are generally defined for each resource in order to prevent unauthorized use of resources such as documents. Data in which such access rights are defined is generally called an ACL (Access Control List). The ACL is defined for each document, and the definition content indicates the presence or absence of various operation authorities for each user. On the other hand, the operation authority information that has been conventionally held for each system is changed to various security functions. A system configuration is adopted in which a common security rule can be applied to access control for resources in a plurality of systems by centrally managing a specific server (hereinafter referred to as “security server”) together with information. I'm starting. Here, information managed in the security server is generally called a security policy.

  In the security policy, resources such as documents that are subject to operations (viewing, printing, editing, deletion, etc.) are classified based on specific attributes of the resources, and the operation subject such as a user is specified by the specific attributes of the subject. In accordance with the combination of the resource classification and the subject classification, a rule (security rule) for determining whether or not to permit the operation is defined for each operation type. When the operation is permitted in the security rule, it is possible to define the responsibility to be executed together with the operation.

One of the typical responsibilities is logging. When logging is defined as the responsibility for an authorized operation, when the operation is completed successfully, information on when and who performed the operation on which resource is logged (access log) Must be recorded as Also, if an error occurs during execution of an allowed operation, a log (error log) corresponding to the type of operation and the degree of error that occurred is recorded regardless of whether or not logging is defined as a responsibility. It is also necessary to keep it.
JP 2002-56176 A JP 2003-150751 A

  However, as described above, security rules are defined for each combination of resource classification and subject classification. If the log contents to be output differ depending on the security rule, the responsibility definition is defined for each combination. Need to do. Accordingly, there is a problem that not only the maintenance work of the security policy becomes complicated, but also it is difficult to make a consistent definition as a whole security policy.

  The present invention has been made in view of the above points, and it is an object of the present invention to provide an information processing apparatus, an obligation determination method, an obligation determination program, and a recording medium that can easily define an obligation in a security policy. To do.

In order to solve the above-described problem, the present invention provides a subject classification information storage unit that stores a subject classification to which the subject belongs for each identifier of the subject of the operation, and a resource for each identifier of the resource to be operated. Depending on the combination of the resource classification information storage means storing the resource classification to which it belongs, the operation classification information storage means storing the operation classification to which the operation belongs for every possible operation on the resource, and the combination of the subject classification and the resource classification Policy storage means storing information indicating whether or not an operation is permitted for each operation classification, and information indicating the presence or absence of a duty required when the operation is performed, and an identification name and an operation target of an operation subject. In response to an operation request in which a resource identification name is designated, the subject classification to which the subject belongs is determined based on the subject identification name and the subject classification information storage unit, and before the resource belongs to The resource classification is determined based on the resource identification name and the resource classification information storage means, the operation classification to which the operation related to the operation request belongs is determined based on the operation classification information storage means, and the determined Operation permission / rejection determination means for determining permission / rejection of the operation according to the operation request and presence / absence of the responsibility based on the subject classification, the resource classification, and the operation classification and the policy storage means, and an operation according to the operation request. If it is determined that the responsibility is granted, the responsibility detailed information storage unit stores the content of the responsibility independently of the resource classification and the subject classification according to the operation classification. And responsibility content determination means for determining the content .

  In such an information processing apparatus, it is only necessary to define information on duties corresponding to the classification of operations. Therefore, it is not necessary to define information on duties for each rule relating to the above permission / rejection determination, and it is easy to define duties in the security policy. Can be done.

  In order to solve the above-described problems, the present invention provides a duty determination method in the information processing apparatus, a duty determination program for causing the information processing apparatus to execute the duty determination method, or a recording medium on which the duty determination program is recorded. It is good.

  According to the present invention, it is possible to provide an information processing apparatus, an obligation determination method, an obligation determination program, and a recording medium that can easily define an obligation in a security policy.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a diagram showing a configuration example of a document management system according to an embodiment of the present invention. As shown in FIG. 1, the document management system 1 according to the present embodiment includes a security management server 10, a document management server 20, an authentication server 30, a client device 40, a print server 51, a conversion server 52, a distribution server 53, and the like. It is configured by being connected through a network 60 (whether wired or wireless), such as the Internet or a LAN (Local Area Network).

  The security management server 10 is a computer for managing various types of security information (hereinafter referred to as “security information”) related to documents. Various servers (document management server 10, print server 51, conversion server 52, and distribution server 53) that handle documents in the document management system 1 are based on the security information managed by the security management server 10. The presence or absence of the operation authority for is judged.

  The document management server 20 is a computer on which a document management function and the like are implemented.

  The authentication server 30 is a computer on which an authentication module 31 for authenticating a user of the document management system 1 is installed. The authentication module 31 authenticates the user in response to the authentication request, and when the user is authenticated, authenticates an electronic certificate (hereinafter referred to as “ticket”) that proves that the user is authenticated. Issued to the requester.

  The print server 51, the conversion server 52, the distribution server 53, and the like are examples of various servers that handle documents managed by the document management server 20. The print server 51 is a computer having a function for causing a printer to print a document. The conversion server 52 is a computer having a function for converting a document into a predetermined data format. The distribution server 53 is a computer on which a function for distributing a document to a predetermined destination is installed.

  The client device 40 is a computer in which an application that uses the functions of the various servers described above is installed. However, the client device 40 is not necessarily a terminal used directly by the user. For example, the client device 40 may be a Web server, and in this case, an application installed in the client device 40 corresponds to a Web application.

  Each function in each of the above servers may be implemented as a Web service. In this case, communication between the client device 40 and each server is performed by SOAP (Simple Object Access Protocol).

  Next, details of the document management server 20 will be described. FIG. 2 is a diagram illustrating a hardware configuration example of the document management server according to the embodiment of the present invention. The document management server 20 shown in FIG. 2 includes a drive device 200, an auxiliary storage device 202, a memory device 203, an arithmetic processing device 204, and an interface device 205 that are connected to each other via a bus B. Is done.

  A program for realizing processing in the document management server 20 is provided by a recording medium 201 such as a CD-ROM. When the recording medium 201 on which the program is recorded is set in the drive device 200, the program is installed from the recording medium 201 to the auxiliary storage device 202 via the drive device 200.

  The auxiliary storage device 202 stores the installed program and stores necessary files and data. The memory device 203 reads the program from the auxiliary storage device 202 and stores it when there is an instruction to start the program. The arithmetic processing unit 204 executes functions related to the document management server 20 in accordance with a program stored in the memory device 203. The interface device 205 includes, for example, a modem, a router, etc., and is used to connect to the network 60 in FIG.

  Note that the security management server 10, authentication server 30, print server 51, conversion server 52, distribution server 53, and the like can also be realized by the hardware configuration shown in FIG.

  FIG. 3 is a diagram illustrating a functional configuration example of the document management server and the security management server in the embodiment of the present invention. In FIG. 3, the document management server 20 includes a document management module 21, a responsibility content determination module 22, and operation classification information 23.

  The document management module 21 is a module that provides various operation means (viewing, printing, deleting, changing attributes, etc.) for a managed document. The document management module 21 requests the security management module 11 of the security management server 10 for permission / prohibition regarding the operation of the document requested by the application 41, and executes the operation when permitted in the permission / rejection determination. However, as will be described later, in the security management server 10, there are various types of concepts according to a high abstraction level so that they can be shared by other servers (print server 51, conversion server 52, distribution server 53, etc.). Operations are classified. Therefore, when the document management module 21 requests the security management server 10 to determine whether or not to permit an operation, the document management module 21 determines a classification to which the operation belongs based on the operation classification information 23 and requests a permission determination for the classification.

  FIG. 4 is a diagram illustrating an example of operation classification information. As shown in FIG. 4, the operation classification information 23 classifies various operations in the document management module 21 into concepts with a higher abstraction level according to the characteristics of the operations. That is, the operation classification information 23 manages the association between various operations in the document management module 21 and the classification with a high level of abstraction. For example, it can be seen from FIG. 4 that document viewing and printing belong to information output, document deletion belongs to deletion, and document attribute change belongs to a change function. It can also be seen that the network setting change belongs to the management function and the change function. The operation classification information 23 is defined in advance by the system designer at the time of system design, for example.

  The responsibility content determination module 22 determines what type of log should be output when “log recording” is defined in the policy 113 described later as the responsibility corresponding to the operation requested by the application 41. It is a function to determine based on

  FIG. 5 is a diagram showing an example of detailed responsibility information. As shown in FIG. 5, the detailed responsibility information 114 is information that defines the type of log corresponding to the category for each category to which the operation belongs. That is, from FIG. 5, it is understood that when an operation related to the management function is executed and log recording is necessary, a normal access log should be output, and when an operation related to the change function or information output is executed. It can be seen that when log recording is necessary, it is necessary to output a normal access log and an error log related to unauthorized processing when an abnormality occurs. In addition, if it is necessary to record logs when performing operations related to deletion, it is necessary to output a detailed access log, and if an error occurs, a warning level error log and an error processing error log are output. I understand that there is. Here, the access log refers to a log indicating when and who performed which operation on which resource. Thus, in this embodiment, when the responsibility is log recording, what kind of log should be output depends on the classification to which the operation belongs, the classification of the subject of the operation described later, It is determined independent of the classification of the resource to be operated. In actual operation, it is often sufficient to determine according to the classification to which the operation belongs, and the structure of detailed responsibility information becomes complicated and management becomes complicated when the classification of the subject and the classification of resources are taken into consideration. . However, if necessary for operation, detailed responsibility information may be defined in consideration of the classification of the subject and the classification of resources.

  In the present embodiment, the detailed responsibility information 114 managed by the security management server 10 is downloaded to the document management server 20 and used.

  On the other hand, in FIG. 3, a security management module 11 is mounted on the security management server 10. The security management module 11 is a module in which various security information management functions are implemented. In the security management module 11, subject classification information 111, resource classification information 112, policy 113, responsibility detailed information 114, and the like are managed as security information.

  FIG. 6 is a diagram illustrating an example of subject classification information. As shown in FIG. 6, subject classification information 111 is information for classifying each user (subject) based on the department to which the user is related and the authority level of the user. Whether or not it is a person related to a department (department A, department B, department C) (hereinafter referred to as “user category”) and an authority level are defined. Here, the “participant in the department” corresponds to, for example, a person who belongs to the department or a person who participates in a project in the department. The authority level corresponds to a position in an organization such as a company. For example, in the subject classification information 111, it is defined that the user A is a person related to the department A and a regular employee, but is not a person related to the department B and the department C.

  FIG. 7 is a diagram illustrating an example of resource classification information. As shown in FIG. 7, the resource classification information 112 is information for classifying each document managed in the document management module 21 based on the document category, the confidential level, the management department, and the like. Document categories, confidentiality levels, management departments, etc. are defined. The document name is a name given to the document. The document category is a classification based on the content of the document, such as a design document, a technical document, a personnel document, a minutes, a specification, and a general document. The security level is the sensitivity of the document. The management department is the department name of the department that manages the document. For example, in the resource classification information 112, it is defined that the document 1 is a confidential minutes that are managed in the department A.

  8 and 9 are diagrams showing examples of policy definitions. In the policy 113 in FIG. 8 and the like, there are rules regarding whether or not to permit the operation for each operation classification according to the combination of the classification of the resource to be operated, the classification of the subject that operates the resource, and the classification of the resource. The XACML (eXtensible Access Control Markup Language) specification is defined as a reference. 8 and 9 show the definitions made in one file divided for convenience.

  The policy 113 in FIG. 8 and FIG. 9 is a PolicySet definition surrounded by a start tag ps1-1 (FIG. 8) and an end tag ps1-2 (FIG. 9) (hereinafter, the PolicySet definition is referred to as “PolicySet definition ps1”). .). The PolicySet definition can include the Target definition as a child element, and the PolicySet definition ps1 includes the Target definition t1.

  The Target definition is defined as a child element such as a PolicySet definition, a Policy definition described later, or a Rule definition, and specifies an application target of the definition by these parent elements to which the Target definition belongs. The Target definition includes, as child elements, a Subject definition for specifying a subject, a Resource definition for specifying a resource, an Action definition for specifying a classification of an operation, and the like. In the Target definition t1, the values of the Subject definition s1, the Resource definition r1, and the Action definition a1 are all “ANY”, so the PolicySet definition ps1 is a definition that applies to all subjects, resources, and operations. I understand.

  The PolicySet definition can also include one or more PolicySet definitions, Policy definitions, and the like as child elements. The PolicySet definition ps1 includes a start tag ps2-1 (FIG. 8) and an end tag ps2-2 (FIG. 9). 1 PolicySet definition (hereinafter referred to as “PolicySet definition ps2”). From the value of the Resource definition r2 in the Target definition t2 of the PolicySet definition ps2, it can be seen that the PolicySet definition ps2 is a definition for a document (resource) whose document category is “Minutes” and whose confidential level is “Confidential”. Note that the Target definition defined in the parent element is also valid for its child elements. Therefore, the policy 113 is applied to all resources in the PolicySet definition ps1, but has been narrowed down to a specific document in the PolicySet definition ps2.

  The PolicySet definition ps2 includes two PolicySet definitions: PolicySet definition ps3 (FIG. 8) and PolicySet definition ps4 (FIG. 9). The PolicySet definition ps3 is a definition for a user (subject) whose user category is “related party” and whose authority level is “regular employee” from the value of the Subject definition s3 in the Target definition t3. The PolicySet definition ps4 is a definition for a user (subject) whose user category is “related party” and whose authority level is “dispatch” from the value of the Subject definition s4 in the Target definition t4. The “related party” here means a related party for the document to be operated. That is, if the management department of the document to be operated is the same as the department to which the user who is the subject of the operation has a relationship, the user is assumed to be the “related party” of the document.

  PolicySet definition ps3 includes two Policy definitions, Policy definition p31 and Policy definition p32. The Policy definition is an element in which one security rule is defined. Each Policy definition includes a Rule definition, an Obligation definition and the like as child elements in addition to the Target definition.

  The Rule definition is an element in which a determination value (permitted or not permitted) is defined in the Effect attribute when the Policy definition is applied. The Obligation definition is an element in which the content of the responsibility that is obliged to be executed together with the target operation in the Policy definition is defined.

  It can be understood that the Policy definition p31 is a definition for the “information output” operation from the Action definition 31 in the Target definition 31. Further, it can be seen from the Rule definition r31 that the determination value is permission (Permit), and from the Obligation definition o31, “log recording” is the responsibility. In other words, the Policy definition p31 inherits the resource and subject limitation of the Target definition t2 in the PolicySet definition ps2 and the Target definition t3 in the PolicySet definition ps3, so that “the secret minutes are related to the minutes concerned”. The information output by a regular employee user is permitted. However, in this case, a log must be recorded. "

  Similarly, the policy definition p32 states that “the confidential minutes of a company are permitted to be deleted by a regular employee who is a person related to the minutes. However, in this case, a log must be recorded”. Is specified.

  Further, the policy definition p41 indicates that “information regarding confidential minutes is allowed to be output by a dispatching user who is a person concerned with the minutes. However, in that case, the log must be recorded”. Is specified. Furthermore, the policy definition p42 states that “the confidential minutes of the company are allowed to be deleted by the dispatching user who is the person concerned with the minutes. However, in that case, the log must be recorded”. Stipulate.

  It should be noted that in the policy 113, all responsibilities are defined as “log recording”, and the log type is not specified. As will be described later, since the type of log is determined based on the detailed responsibility information 114, it is not necessary to specify such details in the policy 113.

  Hereinafter, the processing procedure of the document management system 1 of FIG. 1 will be described. FIG. 10 is a sequence diagram for explaining processing of the document management system.

  In step S101, the responsibility content determination module 22 requests the security management module 11 to provide the detailed responsibility information 114, and downloads the detailed responsibility information 114 to the document management server 20 (S102). Note that this processing is executed in advance or periodically, for example, asynchronously with processing described later, such as when the document management server 20 is activated. However, the responsibility detailed information 114 may be received by the document management module 21 together with the determination result of the operation permission / rejection determination at a timing (S116) described later.

  Steps S103 to S111 are processes (session establishment, document search, etc.) that are prerequisites for operating the document managed by the document management server 10. That is, based on the user name and password input by the user, the application 41 requests the authentication module 31 to authenticate the user with the user name and password as arguments (S103). The authentication module 31 authenticates the user, and if the user is authenticated, generates a ticket that proves that fact (S104). In the ticket, for example, a ticket ID for identifying the ticket, a valid range indicating a service in which the ticket is valid, an expiration date for using the service by the ticket, a user ID, a code for tampering check, and the like are recorded. The ticket is encrypted so that only the authentication module 31 can refer to the ticket, and transmitted to the application 41 (S105).

  The application 41 transmits a session establishment request to the document management module 21 using the ticket as an argument (S106). The document management module 21 requests the authentication module 31 to verify the validity of the received ticket (S107). When a verification result indicating that the ticket is valid is returned (S108), the session ID is returned to the application 41. (S109). The document management module 21 stores the ticket in association with the session ID.

  After the session is established, when the user instructs to search for a document, the application 41 transmits a document search request to the document management module 21 with the session ID and search conditions as arguments (S110). The document management module 21 searches for a document based on the search condition, and transmits the search result to the application 41 (S111).

  At this point, the user is presented with a document list screen that includes a list of retrieved documents. Therefore, when the user selects an arbitrary document (the selected document is hereinafter referred to as “current document”) and instructs the execution of operations such as browsing, printing, deletion, or attribute change for the current document, the application 41 The document management module 21 is requested to execute the operation using the ticket, the document ID of the current document, and the operation ID for identifying the instructed operation as arguments (S112).

  Progressing to step S113 following step S112, the document management module 21 specifies the classification to which the designated operation belongs based on the operation classification information 23. For example, when browsing is instructed, the classification is specified as “information output” (see FIG. 4). The classification specified here is hereinafter referred to as “current operation classification”.

  Progressing to step S114 following step S113, the document management module 21 requests the security module 11 to determine whether or not to execute the current operation classification for the current document by the current user. Progressing to step S115 following step S114, the security management module determines the authority level of the current user based on the subject classification information 111, and determines the document category and confidential level of the current document based on the resource classification information 112. After determining whether or not the current user is a related person of the current document based on the subject classification information 111 and the resource classification information 112, the determination result is applied to the policy 113, and execution of the current operation classification is permitted. Whether or not, and the responsibilities and the like when permitted.

  For example, when the current user is “user A” and the current document is “document 1”, the authority level of the current user is “full-time employee”, and the document category and confidential level of the current document are “agenda”, respectively. "Record", "Confidential". Further, since the management department of document 1 is “department A” and user A is an affiliate of “department A”, the current user is an affiliate of the current document. Here, for example, when the current operation classification is “information output”, the policy definition p31 (FIG. 8) in the policy 113 is applied. Then, the execution of the operation classification is permitted, and it is determined that “log recording” is required as the responsibility.

  Proceeding to step S 116 following step S 115, the security management module 11 returns a determination result (operation permission / inhibition, responsibility, etc.) to the document management module 21. Progressing to step S117 following step S116, the document management module 21 executes an operation requested by the application 41, for example, a process for browsing the current document. Progressing to step S118 following step S117, when “log recording” is designated as the responsibility in the determination result returned from the security management module 11 in step S116, the document management module 21 identifies the current operation classification. Inquires about the type of log to be output to the responsibility content determination module 22 using the ID and the event ID as arguments. Here, the event ID is an ID for identifying an error or the like that occurs when the operation is executed.

  Proceeding to step S119 following step S118, the responsibility content determination module 22 determines the log type corresponding to the current operation classification based on the detailed responsibility information 114 (FIG. 4), and sends the determination result to the document management module 21. Output. For example, when an operation related to information output is executed, an error process related to unauthorized processing should be further output when a normal access log indicates that an error has occurred in the event ID It is determined as the log type.

  Proceeding to step S120 following step S119, the document management module 21 outputs a log according to the type determined by the responsibility content determination module 22, and information indicating the processing result, such as success or failure of the executed operation, to the application 41. A reply is made (S121), and the process is terminated.

  As described above, according to the document management system 1 according to the present embodiment, the type of log to be recorded is determined based on the detailed responsibility information 114. Therefore, the log type for each policy definition in the policy 113 is determined. There is no need to identify and define responsibilities. Therefore, if it is desired to change the log type according to the operation, it is only necessary to correct the portion corresponding to the operation in the detailed responsibility information 114, which can simplify the maintenance work of the policy 113 and there is no contradiction. Definition can be made easily.

  In the present embodiment, log recording has been described as a specific example of duties. However, the present invention is not limited to specific duties, and can be applied to various duties.

  The present invention is not limited to such specific embodiments, and various modifications and changes can be made within the scope of the gist of the present invention described in the claims.

It is a figure which shows the structural example of the document management system in embodiment of this invention. It is a figure which shows the hardware structural example of the document management server in embodiment of this invention. It is a figure which shows the function structural example of the document management server and security management server in embodiment of this invention. It is a figure which shows the example of operation classification information. It is a figure which shows the example of responsibility detailed information. It is a figure which shows the example of subject classification information. It is a figure which shows the example of resource classification information. It is a figure which shows the example of a policy definition. It is a figure which shows the example of a policy definition. It is a sequence diagram for demonstrating the process of a document management system.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Document management system 10 Security management server 11 Security management module 20 Document management server 21 Document management module 22 Responsibility determination module 23 Operation classification information 30 Authentication server 31 Authentication module 40 Client apparatus 41 Application 51 Print server 52 Conversion server 53 Distribution server 111 Subject classification information 112 Resource classification information 113 Policy 114 Responsibility detailed information 200 Drive device 201 Recording medium 202 Auxiliary storage device 203 Memory device 204 Arithmetic processing device 205 Interface device B Bus

Claims (7)

Subject classification information storage means for storing the subject classification to which the subject belongs for each identifier of the subject of operation;
Resource classification information storage means for storing a resource classification to which the resource belongs for each identification name of the resource to be operated;
Operation classification information storage means storing operation classification to which the operation belongs for each possible operation on the resource;
Policy storage means for storing information indicating whether or not an operation is permitted for each operation classification according to a combination of the subject classification and the resource classification, and information indicating whether or not there is a responsibility required in performing the operation,
In response to an operation request in which the identification name of the operation subject and the identification name of the resource to be operated are specified, the subject classification to which the subject belongs is determined based on the identification name of the subject and the subject classification information storage unit And determining the resource classification to which the resource belongs based on the identification name of the resource and the resource classification information storage means, and determining the operation classification to which the operation related to the operation request belongs based on the operation classification information storage means. An operation permission / rejection determination unit that determines whether to perform the operation according to the operation request and the presence / absence of the responsibility based on the determined subject classification, the resource classification, and the operation classification and the policy storage unit;
Responsibility detailed information storage for storing the content of the responsibility independent of the resource classification and the subject classification according to the operation classification when it is determined that the operation related to the operation request is permitted and the responsibility is present An information processing apparatus comprising responsibility content determination means for determining the content of the responsibility using means . The operation classification information processing apparatus according to claim 1, are classified by the concept is abstracted operable with respect to the resource. The responsibilities More information storage means, the information processing apparatus according to claim 1 or 2, wherein storing the type of the log to be recorded when performing the operation in association with the operation classification. The information processing apparatus according to claim 1, further comprising duty execution means for executing the duty determined by the duty content determination means. A responsibility determination method executed by a computer,
In response to the operation request in which the identification name of the subject of the operation and the identification name of the resource to be operated are specified, the subject classification to which the subject belongs is determined based on the identification name of the subject and the subject classification information storage unit, The resource classification to which the resource belongs is determined based on the identification name of the resource and the resource classification information storage means, and the operation classification to which the operation related to the operation request belongs is determined based on the operation classification information storage means. An operation permission / rejection determination procedure for determining permission / inhibition of operation and presence / absence of responsibility according to the operation request based on the subject classification, the resource classification, and the operation classification and policy storage unit;
Responsibility detailed information storage for storing the content of the responsibility independent of the resource classification and the subject classification according to the operation classification when it is determined that the operation related to the operation request is permitted and the responsibility is present A responsibility content determination procedure for determining the content of the responsibility using means,
The subject classification information storage means stores the subject classification to which the subject belongs for each identification name of the subject of operation,
The resource classification information storage means stores the resource classification to which the resource belongs for each identifier of the resource to be operated,
The operation classification information storage means stores the operation classification to which the operation belongs for every possible operation on the resource,
The policy storage means includes information indicating whether or not an operation is permitted for each operation classification according to a combination of the subject classification and the resource classification, and information indicating the presence or absence of the responsibility required when the operation is performed. Duty judgment method to remember . On the computer,
In response to the operation request in which the identification name of the subject of the operation and the identification name of the resource to be operated are specified, the subject classification to which the subject belongs is determined based on the identification name of the subject and the subject classification information storage unit, The resource classification to which the resource belongs is determined based on the identification name of the resource and the resource classification information storage means, and the operation classification to which the operation related to the operation request belongs is determined based on the operation classification information storage means. An operation permission / rejection determination procedure for determining permission / inhibition of operation and presence / absence of responsibility according to the operation request based on the subject classification, the resource classification, and the operation classification and policy storage unit;
Responsibility detailed information storage for storing the content of the responsibility independent of the resource classification and the subject classification according to the operation classification when it is determined that the operation related to the operation request is permitted and the responsibility is present A responsibility content determination procedure for determining the content of the responsibility using a means,
The subject classification information storage means stores the subject classification to which the subject belongs for each identification name of the subject of operation,
The resource classification information storage means stores the resource classification to which the resource belongs for each identifier of the resource to be operated,
The operation classification information storage means stores the operation classification to which the operation belongs for every possible operation on the resource,
The policy storage means includes information indicating whether or not an operation is permitted for each operation classification according to a combination of the subject classification and the resource classification, and information indicating the presence or absence of the responsibility required when the operation is performed. Responsibility judgment program to remember . A computer-readable recording medium on which the responsibility determining program according to claim 6 is recorded.

Images