JP4628073B2 - Access control apparatus and access control method - Google Patents

Description

  The present invention relates to an access control apparatus and an access control method.

  In general, in order for a process running on a computer to access computer resources such as input data and files from the keyboard, it is necessary to issue a request called a system call to the kernel program and access it through the kernel. . As a result, only processes that have access authority to the resource can access the resource.

  On the other hand, each process running on a computer has a low-reliability process originally introduced by a computer user from a high-reliability process originally provided by a computer provided by a reliable vendor. . In a process with low reliability, the process itself may be malicious or vulnerable, and if these processes are allowed access to resources on the computer, information is sent to the outside. There is a risk that the file will be leaked or the files on the computer will be tampered with.

  Furthermore, resources that need to be accessed for processes running on a computer are determined according to their roles. For example, in the case of a Web server process, it is only necessary to be able to input a file necessary for responding to an HTTP request (for example, under the Web server root directory) or output to a log file.

  In order to avoid the dangers mentioned above, it is necessary to be able to control access to each resource on the computer of each process according to the role and authority of each process.

  As one of the techniques for realizing the above, there is a technique called forced access control that performs fine-grained access control by using an access control rule in which access authority to each resource of each process is set finely. For example, in SELinux, a level of access right called a domain is set for each process, and a level called a type is set for each resource on a computer (see, for example, Non-Patent Document 1). After that, it is possible to set an access control rule that describes an access right for each type of each domain, and the kernel can control access to each resource of each process by this access control rule. For example, in the example of the Web server, as shown in FIG. 12, a domain “httpd_t” is set in the Web server process, and the directory “/ var / www / html /” where the Web page file is stored is set. By setting the type “httpd_sys_content_t” and setting the access control rule that <process belonging to the httpd_t domain can only read directories belonging to the httpd_sys_content_t type>, it is possible to give only the minimum authority to the Web server process. It is.

  As an example of applying mandatory access control technology such as SELinux, for example, in the example shown in FIG. 13, process A can read resource A and resource B, and process B can read only resource B. It is.

  Here, consider the case where process A outputs to process B after process A reads resource A. In this case, the process B can read the resource A that should not have the authority to read.

  In order to avoid such a situation using forced access control technology such as that implemented in SELiunux, <all processes authorized to read resource A are prohibited from inter-process communication with process B>. There should be control rules.

  In this case, even if the resource read by process A is B, process A cannot output it to process B.

  In this situation, flexible access control is achieved compared to SELinux's mandatory access control technology, which changes the access authority of process A when resource A is read and prohibits interprocess communication with process B. A technique that enables this is also disclosed (for example, see Patent Document 1). In this case, process A can communicate with process B until resource A is read, but after resource A is read, communication with process B is impossible and resource B cannot be output to process B. Can not.

  In the two documents mentioned above, both perform access control for each resource of each process. However, when access rights between processes are different, communication between resources B that should actually be permitted in the case shown in FIG. 13 must be prohibited, and the operation of each process is more than necessary. It will be restricted.

  For example, there are many applications such as JAVA (registered trademark) applet that process A acquires and executes an untrusted code (process B in the above example) from the Internet. In this case, when process A executes process B, information is generally exchanged using a system call such as a pipe. However, unreliable process B is generally not allowed access to specific resources of the terminal. In this case, for example, process A holds the password entered by the user with a program such as a browser. In the case where the process A is executed, the process A cannot exchange any information when the process B is executed, and the operation of each process is extremely limited. However, on the other hand, allowing free exchange of information between process A and process B has a high risk of information leakage if process B is malicious.

  Access control that impairs process flexibility as described above can be inconvenient for both user and program vendors, or security can be relaxed by loosening access control rules to avoid such problems. The above vulnerability occurs.

For such a problem, a solution using a technique called information flow analysis can be considered (for example, see Non-Patent Document 2). In the information flow analysis technology, the flow of information input to the process is tracked and controlled by static analysis of the original program source or dynamic analysis during process execution. Specifically, for information input to the process, the propagation of information between variables referred to by the process is analyzed.
Security Enhanced Linux (SE Linux) http: // www. nsa. gov / selinux / JP-A-8-87440 Stephen Tse and Steve Zdancewic. “Run-time principals in information-flow type systems”. In proceedings of IEEE Symposium on Security and Privacy, pages 179-193, 2004.

  However, in order to solve the problems mentioned above, it is only necessary to monitor the input of resources to the process and the output of resources from the process, and monitor variables referenced by the process, such as information flow analysis technology. This is a factor that degrades the performance of the process.

  In view of the above problems, an object of the present invention is to provide an access control apparatus and an access control method that reduce overhead and perform flexible access control.

  In order to achieve the above object, a feature of the present invention is an access control device that inputs input data to an input variable referred to by a process and outputs output data stored in an output variable derived from the input variable according to process execution. (A) a first access control rule deriving unit for deriving a first access control rule corresponding to the input data, and (b) a derivation rule representing the correspondence between the input variable and the output variable, An input data specifying unit for specifying input data as a derivation source; and (c) a second access control rule corresponding to the output data in accordance with the first access control rule corresponding to the input data specified by the input data specifying unit. A second access control rule deriving unit for deriving data, and (d) an access control unit for controlling output processing of output data according to the second access control rule. And summarized in that a that the access control device.

  According to the access control device according to the first feature, overhead can be reduced and flexible access control can be performed.

  In the access control device according to the first feature, when the input source of the input data is a resource on the computer, the first access control rule deriving unit derives the first access control rule corresponding to the resource. May be. According to this access control device, output processing according to resources can be performed.

  In the access control device according to the first feature, the first access control rule and the second access control rule may determine whether or not to permit a system call generated during output processing. According to this access control device, the process that issued the system call can check whether or not it has the authority to input the specified resource, and can read the resource only when it has the authority.

  In the access control device according to the first feature, when the input destination of input data is a variable referred to by the program that generated the process, the input data specifying unit may specify the variable. According to this access control device, output processing can be controlled according to the first access control rule corresponding to the variable.

  Further, in the access control device according to the first feature, when the output data is derived from a plurality of input data, the second access control rule derivation unit, according to the first access control rule corresponding to the plurality of input data, A second access control rule corresponding to the output data may be derived. According to this access control apparatus, it is possible to derive a second access control rule that takes all input data into consideration.

  Further, in the access control device according to the first feature, when the output process is data transmission in inter-process communication, the second access control rule derivation unit includes the first access control rule corresponding to the destination process. Accordingly, a second access control rule corresponding to the output data may be derived. According to this access control apparatus, output control according to the process of the transmission destination can be performed.

  In the access control device according to the first feature, the derivation rule may be generated by statically analyzing the program source of the program that generated the process. According to this access control device, it is possible to appropriately specify the input variable from which the output variable is derived by referring to the generated derivation rule.

  In the access control device according to the first feature, when the input data to the process is output data from another process, the first access control rule deriving unit corresponds to the output data of the other process. A first access control rule corresponding to the input data may be derived according to the second access control rule. According to this access control apparatus, flexible output control according to each process can be performed.

  In the access control device according to the first feature, when the output destination of the output data is a resource on the computer, the access control unit performs the resource access control rule according to the second access control rule corresponding to the output data. May be updated. According to this access control apparatus, the access control rule can be updated as appropriate according to the output process.

  A second feature of the present invention is an access control method in which input data is input to an input variable referred to by a process, and output data stored in an output variable derived from the input variable is output in accordance with process execution. ) A step of deriving a first access control rule corresponding to the input data; and (b) a step of specifying the input data from which the output data is derived based on a derivation rule representing the correspondence between the input variable and the output variable. (C) deriving a second access control rule corresponding to the output data according to the first access control rule corresponding to the identified input data; and (d) outputting according to the second access control rule. And an access control method including a step of controlling data output processing.

  According to the access control method according to the second feature, overhead can be reduced and flexible access control can be performed.

  According to the present invention, it is possible to provide an access control apparatus and an access control method that reduce overhead and perform flexible access control.

  Next, embodiments of the present invention will be described with reference to the drawings. In the following description of the drawings, the same or similar parts are denoted by the same or similar reference numerals. However, it should be noted that the drawings are schematic.

<First Embodiment>
(Access control device)
As shown in FIG. 1, the access control apparatus 100 according to the first embodiment includes a first access control rule deriving unit 110, an input data specifying unit 120, a second access control rule deriving unit 130, and an access control unit. 140.

  In the first embodiment, an access control rule for controlling access to each resource on the computer of each process operating on the computer is the same as the existing mandatory access control technology realized in SELinux, for example. Assume that it is determined in advance.

  In the first and second embodiments, FIG. 2 shows the flow from the input of data to the output of the process. As shown in FIG. 2, input data 310 input to an input variable 410 referred to by a process from resources on a computer such as a file or a keyboard by input processing is derived to an output variable 420 according to process execution. The output data 320 stored in the output variable 420 is output.

  Specifically, as shown in FIG. 3, the access control rule defined for each resource is read into memory (input processing) or transmitted to another process / computer (output processing) for each resource of the process. ) Is a rule for controlling input / output processing. For example, the process 1 is prohibited from inputting data from a keyboard. In FIG. 3, a unique identifier is assigned to each access control rule for the following explanation. Since the access control apparatus 100 monitors and controls the data input / output processing by the process, for example, it can be considered to be incorporated as a kernel function for managing the input / output processing of the process.

  The first access control rule deriving unit 110 of the access control apparatus 100 derives a first access control rule 210 corresponding to the input data 310 input to the process storage area.

  The input data specifying unit 120 specifies the input data 310 that is the derivation source of the output data 320 based on the derivation rule 220 that indicates the correspondence between the given input variable 410 and the output variable 420.

  The second access control rule deriving unit 130 derives the second access control rule 230 corresponding to the output data 320 according to the first access control rule corresponding to the input data 310 specified by the input data specifying unit 120. .

  The access control unit 140 controls the output process of the output data 320 according to the second access control rule 230.

  The operation of each unit described above will be described in detail in the access control method.

  The access control device 100 according to the first embodiment includes a processing control device (CPU), and includes the first access control rule deriving unit 110, the input data specifying unit 120, and the second access control rule described above. The deriving unit 130, the access control unit 140, and the like can be built in the CPU as modules. These modules can be realized by executing a dedicated program for using a predetermined program language in a general-purpose computer such as a personal computer.

  Although not shown, the access control device 100 executes a program for causing the CPU to execute a first access control rule derivation process, an input data identification process, a second access control rule derivation process, an access control process, and the like. You may provide the program holding | maintenance part which accumulate | stores. The program holding unit is a recording medium such as a RAM, a ROM, a hard disk, a flexible disk, a compact disk, an IC chip, and a cassette tape. According to such a recording medium, it is possible to easily store, transport, and sell programs.

  Although not shown, the access control apparatus 100 may include a data holding unit that holds the input source access control rule 200, the first access control rule 210, the derivation rule 220, and the second access control rule 230. Good. The data holding unit may be an internal storage device such as a RAM or an external storage device such as a hard disk.

(Access control method)
Next, an access control method performed by the access control apparatus 100 will be described with reference to FIG. 5, assuming that an access control rule as shown in FIG.

  First, in step S <b> 101, the first access control rule deriving unit 110 acquires an input source access control rule 200 assigned in advance to the input source of the input data 310 input to the process. Here, the input source refers to, for example, a resource on a computer, specifically data stored on the computer or data input from a keyboard by a user of the computer. When these are entered into a process, the process always issues a read system call to read the resource into the process's memory space. For example, when reading a file on a computer, the following system call is issued.

read (“file descriptor”, input variable, input size)
The file descriptor of the first argument uniquely represents a file on the computer. This system call requests the kernel to read from the file specified by the file descriptor by the data length specified by the input size and assign it to the input variable 410.

  When the kernel receives a system call, it checks whether the process that issued the system call has the authority to input the specified resource according to the access control rules given in advance. Allow system calls.

  When the system call as described above is issued and the input data 310 is input to the process, in step S102, the first access control rule deriving unit 110 corresponds the input source access control rule 200 to the input variable 410. The first access control rule 210 is assumed. In order to uniquely associate with the input destination of the input data 310, for example, as shown in FIG. 4, the input variable 410 and the first access control rule 210 are associated and recorded.

  Next, in step S104, the second access control rule deriving unit 130 derives a second access control rule 230 corresponding to the output data 320 when data is output from the process. Whenever a process outputs data from memory space, it must issue a write system call.

write (“file descriptor”, output variable, output size)
The file descriptor represents an output destination. For example, when a file descriptor indicates a file on a computer, when indicating a display, it may indicate another process inside or outside the computer. This system call requests the kernel to read only the data length specified by the output size from the output variable 420 and output it to the output destination specified by the file descriptor.

  When the system call as described above is issued and the output data 320 is output from the process, the second access control rule deriving unit 130 derives the second access control rule 230 for controlling the output process. . Specifically, the following procedure is followed.

(1) Deriving all input variables 410 from which the output variable 420 in which the output data 320 is stored is derived (2) Obtaining the first access control rule 210 corresponding to each of the input variables 410 (3) ) The second access control rule 230 corresponding to the output variable 420 is derived from all the first access control rules 210. Among the above three procedures, the procedure (1) is mentioned in Non-Patent Document 2 above. Although a method using such an information flow analysis technique is also conceivable, it leads to performance degradation. Accordingly, it is assumed that a derivation rule 220 representing the correspondence between the given input variable 410 and the output variable 420 is input, and this is used in step S103. A method for deriving the derivation rule 220 will be described in detail in the second embodiment. Here, it is assumed that all the input variables 410 from which the output variable 420 is derived can be specified. For example, if the output data is derived from X1 and X2 among the input variables shown in FIG. 4, Policy2 and Policy3 are obtained by procedure (2), and the second access control is obtained by procedure (3). Rule 230 is derived. In this case, the second access control rule 230 combines Policy2 and Policy3 and becomes the following rule.

-Process 1 and process 2 prohibit file output-Processes 1 and 2, including all processes, except kernel, prohibit output outside computer Next, in step S105, the access control unit 140 The output processing of the output data 320 is controlled in accordance with the access control rule 230. In the example shown above, if the main subject of output processing is process 1, output is permitted if the output destination is a different process, but if the output destination is outside the computer or a file, output is permitted. Ban.

(Action and effect)
According to the access control apparatus and the access control method according to the first embodiment, an access control rule is given to data input to the process, and when the data is output from the process, the access control rule of the data is obeyed. Output processing can be controlled. Therefore, for example, in the example of FIG. 13, flexible access control is possible in which process A is not permitted when outputting resource A to process B, but is permitted when outputting resource B. In addition, by monitoring only the input / output of resources, it is possible to reduce the overhead generated in the information flow analysis technique.

  If the input source of the input data 310 is a computer resource, the first access control rule deriving unit 110 can derive the first access control rule 210 corresponding to the resource. For this reason, the output process according to a resource can be performed.

  In addition, the first access control rule 210 and the second access control rule 230 can determine whether or not to permit a system call generated during the output process. For this reason, the process that issued the system call checks whether or not it has the authority to input the specified resource, and can read the resource only when it has the authority.

  Further, when the input destination of the input data 310 is a variable referred to by the program that generated the process, the input data specifying unit 120 can specify the variable. Therefore, the output process can be controlled according to the first access control rule 210 corresponding to the variable.

  When the output data 320 is derived from a plurality of input data 310, the second access control rule deriving unit 130 corresponds to the output data 320 according to the first access control rule 210 corresponding to the plurality of input data 310. A second access control rule 230 can be derived. Therefore, it is possible to derive the second access control rule 230 in consideration of all input data 310.

  When the output process is data transmission in inter-process communication, the second access control rule deriving unit 130 corresponds to the output data 320 according to the first access control rule 210 corresponding to the destination process. Two access control rules 230 can be derived. For this reason, output control according to the process of the transmission destination can be performed.

<Second Embodiment>
(Access control device and access control method)
In the second embodiment, a method in which the input data specifying unit 120 specifies the input variable 410 that derives data to the output variable 420 will be described. Here, the derivation specifically indicates that the output data 320 stored in the output variable 420 is generated from the input data 310 stored in the derivation source input variable 410. For example, in the program as shown in FIG. 6, the data stored in the variable is generated from the data stored in the variable a and the variable b.

  The input data specifying unit 120 specifies the input variable 410 by using the derivation rule 220 generated in advance. The derivation rule 220 is expressed as shown in FIG. 7, for example, which input variable 410 the output variable 420 is derived from. In this example, the output variable Y1 is derived from the input variables X1 and X2.

  The derivation rule 220 can be generated, for example, by statically analyzing the program source of the execution program that generated the process. Specifically, the following procedure is followed.

  (1) The input variable 410 and the output variable 420 are specified.

  (A) The input variable 410 and the output variable 420 are variables that are arguments for a system call as described in the first embodiment or a high-level function for calling the system call specified in the program language. Therefore, it can be specified by analyzing the program source.

  (A) For example, the read system call shown in the first embodiment, the fgets () function that is a high-level function thereof, or the like is used for file input.

  (2) The derived rule 220 is generated by statically analyzing the program source using the specified input variable 410 and output variable 420.

  (A) In the operation in which derivation occurs as shown in FIG. 6, when the input side of the operation is the input variable 410, the variable on the output side of the operation is derived from the input variable 410.

  (A) If an operation is performed in which a variable derived from the input variable 410 is input, the output of the operation is also derived from the input variable 410.

  (C) In the above repetition, when the variable further derived from the input variable 410 or the variable derived from the input variable 410 is the output variable 420, the input variable 410 is derived as the derivation source input variable of the output variable 420. To record.

  (D) The above process is repeated for all input variables 410.

  The input data specifying unit 120 refers to the derivation rule 220 obtained as described above, so that when a system call related to output processing occurs, the input source of the output variable 420 in which the output data 320 is stored is input. The variable 410 is specified.

(Action and effect)
According to the access control apparatus and the access control method according to the second embodiment, the derivation rule 220 is generated by statically analyzing the program source of the program that generated the process.

  By referring to the derivation rule 220 generated in this way, the input variable 410 from which the output variable 420 is derived can be appropriately specified.

<Third Embodiment>
(Access control device and access control method)
In the third embodiment, a case will be described in which the output destination by the output process is a different process in the first embodiment. In the third embodiment, it is assumed that output processing is permitted by the access control unit 140 and output of the output data 320 to the process has occurred.

  FIG. 8 shows the flow of input / output processing according to the third embodiment. In FIG. 8, the output data 321 stored in the output variable 421 referred to by the input source process 510 is input to the input variable 412 referred to by the output destination process 520.

  When viewed from the output destination process 520, the input source access control rule 200 is the second access control rule 231 corresponding to the output variable of the input source process 510. The first access control rule derivation unit 110 of the output destination process 520 derives the first access control rule 212 corresponding to the input variable 412 by referring to the system call issued by the output destination process 520. Specifically, the output variable 421 of the input source process 510 is specified by referring to the file descriptor of the read system call, and the second access control rule 231 corresponding to the output variable 421 is set as the input source access control rule 200. The first access control rule 212 corresponding to the input variable 412 is acquired.

(Action and effect)
According to the access control device and the access control method according to the third embodiment, when the input data to the process is the output data 321 from the other process, the first access control rule deriving unit 110 In accordance with the second access control rule 231 corresponding to the output data 321, the first access control rule 212 corresponding to the input data can be derived. For this reason, flexible output control according to each process can be performed.

<Fourth embodiment>
(Access control device and access control method)
In the fourth embodiment, a case will be described in which the output destination by the output process is a file in the first embodiment. In the fourth embodiment, it is assumed that output processing is permitted by the access control unit 140 and output of the output data 320 to a file has occurred.

  FIG. 9 shows the flow of input / output processing according to the fourth embodiment. In FIG. 9, the first access control rule 211 corresponding to the input variable 411 that stores the data input from the file 610 and the first access control corresponding to the input variable 412 that stores the data input from the file 620. There is a rule 212, and a second access control rule 230 corresponding to the output variable 420 is derived from the first access control rule 211 and the first access control rule 212. The output data 320 is output to the file 610 according to the second access control rule 230.

  Assume that the input source access control rule 201 and the input source access control rule 202 as shown in FIG. 10 have been defined for the file 610 and the file 620 in advance. What corresponds to Policy 610 is the input source access control rule 201, and what corresponds to Policy 620 is the input source access control rule 202.

  As described in the first embodiment, the second access control rule deriving unit includes the first access control rule 210 corresponding to the input variable 411 and the second access control rule 212 corresponding to the input variable 412. The second access control rule 230 corresponding to the output variable 420 is derived as follows.

-Process 1 and process 2 are prohibited from outputting to the display.-All processes including processes 1 and 2 except the kernel are prohibited from outputting to the process. In the second access control rule 230, file output is prohibited. Therefore, the access control unit 140 permits the output data 320 to be output to the file 610. At this time, the access control unit 140 refers to the second access control rule 230 and inherits it to the input source access control rule 201 of the file 610. Thereby, the input source access control rule 201 after the output processing is as shown in FIG.

(Action and effect)
According to the access control device and the access control method according to the fourth embodiment, when the output destination of the output data 320 is a computer resource (for example, the file 610), the access control unit 140 corresponds to the output data 320. In accordance with the second access control rule 230, the access control rule of the resource (for example, the file 610) can be updated as shown in FIG. Therefore, the access control rules can be updated as appropriate according to the output process.

<Other embodiments>
Although the present invention has been described according to the above-described embodiments, it should not be understood that the descriptions and drawings constituting a part of this disclosure limit the present invention. From this disclosure, various alternative embodiments, examples, and operational techniques will be apparent to those skilled in the art.

  For example, in the access control apparatus 100 according to the first embodiment, the first access control rule deriving unit 110, the input data specifying unit 120, the second access control rule deriving unit 130, the access control unit 140, and the like are used as modules. Although it has been described that the configuration may be built in one CPU, they may be divided into two or more CPUs. In this case, it is assumed that the devices are connected by a bus or the like so that data can be exchanged between the CPUs.

  As described above, the present invention naturally includes various embodiments not described herein. Therefore, the technical scope of the present invention is defined only by the invention specifying matters according to the scope of claims reasonable from the above description.

1 is a configuration block diagram of an access control apparatus according to a first embodiment. FIG. It is a figure for demonstrating the input-output process which concerns on 1st Embodiment. It is an example of the access control rule provided to the resource which concerns on 1st Embodiment. 4 is an example of a correspondence table between input variables and first access control rules according to the first embodiment. It is a flowchart which shows the access control method which concerns on 1st Embodiment. It is a figure for demonstrating the derivation which concerns on 2nd Embodiment. It is an example of the derivation rule which concerns on 2nd Embodiment. It is a figure for demonstrating the input / output process which concerns on 3rd Embodiment. It is a figure for demonstrating the input-output process which concerns on 4th Embodiment. It is an example of the access control rule before the update which concerns on 4th Embodiment. It is an example of the access control rule after the update which concerns on 4th Embodiment. It is a figure for demonstrating mandatory access control in SELinux. It is a figure for demonstrating the output of the resource input into the process.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 ... Access control apparatus 110 ... Access control rule derivation part 120 ... Input data specific | specification part 130 ... Access control rule derivation part 140 ... Access control part 200, 201, 202 ... Input source access control rule 210, 211, 212 ... 1st Access control rule 220: Derivation rule 230, 231 ... Second access control rule 310 ... Input data 320, 321 ... Output data 410, 411, 412 ... Input variable 420, 421 ... Output variable 510 ... Input source process 520 ... Output destination Process 610, 620 ... file

Claims (10)

An access control device that inputs input data to an input variable referred to by a process and outputs output data stored in an output variable derived from the input variable according to process execution,
A first access control rule derivation unit for deriving a first access control rule corresponding to the input data;
Based on a derivation rule that represents the correspondence between the input variable and the output variable, an input data specifying unit that specifies the input data from which the output data is derived,
A second access control rule deriving unit for deriving a second access control rule corresponding to the output data according to the first access control rule corresponding to the input data identified by the input data identifying unit;
An access control unit that controls output processing of the output data according to the second access control rule ,
The first access control rule derivation unit derives an input source access control rule when a system call is issued and input data is input to a process as the first access control rule corresponding to an input variable,
The second access control rule derivation unit includes:
Derive all the input variables that are the source of the output variable that stores the output data,
Obtaining a first access control rule corresponding to the derived input variable;
A second access control rule corresponding to an output variable is derived from all the first access control rules . When the input source of the input data is a computer resource,
The access control apparatus according to claim 1, wherein the first access control rule deriving unit derives a first access control rule corresponding to the resource.   3. The access control according to claim 1, wherein the first access control rule and the second access control rule determine whether or not to permit a system call generated during the output process. 4. apparatus. When the input destination of the input data is a variable referenced by the program that generated the process,
The access control apparatus according to claim 1, wherein the input data specifying unit specifies the variable. When the output data is derived from a plurality of input data,
The second access control rule deriving unit derives a second access control rule corresponding to the output data according to a first access control rule corresponding to the plurality of input data. The access control apparatus of any one of -4. When the output processing is data transmission in inter-process communication,
The second access control rule deriving unit derives a second access control rule corresponding to the output data according to a first access control rule corresponding to a destination process. 6. The access control device according to any one of 5 above.   The access control apparatus according to claim 1, wherein the derivation rule is generated by statically analyzing a program source of a program that generated a process. If the input data to the process is output data from another process,
The first access control rule deriving unit derives a first access control rule corresponding to the input data according to a second access control rule corresponding to output data of the other process. Item 6. The access control device according to any one of Items 1 to 5 . If the output destination of the output data is a computer resource,
The access control apparatus according to claim 1, wherein the access control unit updates the access control rule of the resource according to a second access control rule corresponding to the output data. . An access control method in an access control device for inputting input data to an input variable referred to by a process and outputting output data stored in an output variable derived from the input variable according to process execution,
The access control device deriving a first access control rule corresponding to the input data;
The access control device identifying the input data from which the output data is derived based on a derivation rule representing a correspondence between the input variable and the output variable;
The access control device deriving a second access control rule corresponding to the output data according to a first access control rule corresponding to the identified input data;
The access control device in accordance with said second access control rule, see containing and controlling the output process of the output data,
In the step of deriving the first access control rule, an input source access control rule when a system call is issued and input data is input to the process is derived as the first access control rule corresponding to the input variable. And
In the step of deriving the second access control rule,
Derive all the input variables that are the source of the output variable that stores the output data,
Obtaining a first access control rule corresponding to the derived input variable;
A second access control rule corresponding to an output variable is derived from all the first access control rules .

Images