JP4738183B2 - Access control apparatus, access control method and program - Google Patents

Description

  The present invention relates to an access control technique when a user terminal used by a user accesses a resource such as a server, for example.

Conventionally, when accessing a company from a remote location, information for identifying a user is used as a means for authenticating the user. The information for identifying the user is, for example, a user ID / password, a certificate written in the IC card, a fingerprint, or the like.
As shown in the “personal authentication system” disclosed in Japanese Patent Application Laid-Open No. 2002-64861, the location of the user is used for authentication, or “Control Method and Information of Information Network System” disclosed in Japanese Patent Application Laid-Open No. 2004-46666. As shown in “Network system and mobile communication terminal”, there is also a technique used for access control.
Further, as a technique for performing communication between a terminal used by a user in a remote place and a server in the office, as shown in “Data communication system and data communication method” disclosed in Japanese Patent No. 3608905, a client application There is a technology that can recover even if the line is disconnected by using group identification information for identifying communication between the server application and the server application.
JP 2002-64861 A JP 2004-46666 A Japanese Patent No. 3608905

  In a conventional user authentication method, if there is a high possibility that identification information (IC card, password, fingerprint, etc.) is physically stolen, unauthorized access will be prevented if the system can be accessed with only one user's identification information. There was a problem of increasing the possibility of forgiveness.

  The main object of the present invention is to solve such a problem. For example, even when access control that requires simultaneous login of a plurality of persons is performed, things necessary for authentication are stolen. The main purpose is to ensure security.

An access control apparatus according to the present invention
An access control device that accepts login from a user terminal used by a user and determines whether the user terminal is permitted to access a resource requested to be accessed,
An access control table management unit that manages an access control table indicating a plurality of user groups each composed of two or more users and access permission resources to which each user group is permitted to access;
A communication management table management unit for managing a communication management table indicating a logged-in user terminal and a user using the user terminal;
A receiving unit that receives an access request for a specific resource from any user terminal;
Whether the access permission resource of the user group of the request source user who is the request source of the access request matches the specific resource requested by the access request using the access control table and the communication management table And an access permission / rejection determination unit for determining permission / refusal for the access request by determining a login status from another user belonging to the user group of the requesting user.

  According to the present invention, since the access status is determined by determining the login status of other users, even if an object necessary for user authentication is taken out illegally, other legitimate users are logged in. Otherwise, an access request from a person who attempts unauthorized access is not accepted, and the security strength can be improved.

Embodiment 1 FIG.
FIG. 1 is a diagram illustrating a configuration example of a system according to the present embodiment.

In FIG. 1, a PC (Personal Computer) terminal 100 is a terminal used by a user at a remote place. In FIG. 1, the PC terminal 100a is used by a user A (hereinafter also referred to as userA), and Client-a is installed as a client application. The PC terminal 100b is used by a user B (hereinafter also referred to as userB), and Client-b is installed as a client application. The PC terminal 100 is an example of a user terminal.
An IC card reader 110 or a fingerprint authentication device 120 is connected to the PC terminal 100 to perform user authentication. When performing user authentication with a user ID and password, such a device may not be provided. Also, other authentication means / authentication apparatus may be used.

The server 200 holds various business applications and is accessed from the PC terminal 100 via the gateway machine 300. The business application accessed from the server 200 itself or the PC terminal is an example of a resource.
In FIG. 1, a server a 200 a and a server b 200 b are connected to the gateway machine 300.

  Communication from the PC terminal 100 to the server 200 side may be used in an environment where line disconnection is likely to occur, such as a mobile phone. Therefore, even if a line disconnection occurs between the terminal and the gateway machine 300, for example, by connecting the client application and the server application by the method shown in “Client / Server System” disclosed in Japanese Patent Laid-Open No. 2000-101640. The application may not be affected. When connecting to the server 200 from the PC terminal 100, the user logs in to the gateway machine 300 once and connects to the target server through the gateway machine 300. The login to the gateway machine 300 uses normal user identification information (user name / password, fingerprint, certificate stored in an IC card, etc.).

The gateway machine 300 receives a login request from the PC terminal 100, and further, when there is an access request for any server 200 (resource) or any business application (resource) from the logged-in PC terminal 100, Judgment of permission / inhibition for access request
The gateway machine 300 is an example of an access control device.
As shown in FIG. 1, the gateway machine 300 includes a reception unit 301, a user authentication unit 302, an application access control unit 303, a transmission unit 304, an organization-specific information management unit 305, a communication management table management unit 306, and an access control table management unit. 307.

In gateway machine 300, receiving section 301 receives data from PC terminal 100 such as a login request and an access request, data from server 200 to the PC terminal, and the like.
The user authentication unit 302 authenticates a user who uses the PC terminal 100 when there is a login request from the PC terminal 100. Note that when only the authentication by the IC card reader 110 and the fingerprint authentication device 120 is performed and the user ID / password authentication is not performed, the user authentication unit 302 may be omitted.

When there is an access request for any resource from the logged-in PC terminal 100, the application access control unit 303 determines whether to permit access to the requested resource. The application access control unit 303 performs access control using a communication management table and an access control table described later. The application access control unit 303 is an example of an access permission / rejection determination unit.
The transmission unit 304 transmits data from the PC terminal 100 permitted to access to the server 200, and transmits data from the server 200 to the PC terminal 100.
The organization-specific information management unit 305 manages organization information to which a user who uses the PC terminal 100 belongs.
The communication management table management unit 306 manages the communication management table. The communication management table is a table indicating the logged-in PC terminal 100 and the user who uses the PC terminal 100. The communication management table management unit 306 manages a communication management table as shown in FIG. The communication management table has user information in addition to information on the PC terminal (client) connected to the gateway machine 300.
The access control table management unit 307 manages the access control table. The access control table is a table showing a plurality of user groups each composed of two or more users and resources (access permission resources) to which access is permitted for each user group. The access control table management unit 307 manages an access control table as shown in FIG. 3, for example. The access control table has a condition (permission type) as to what kind of user connection is required for permission, and resource information (connection permission server) that can be accessed when the necessary users are available. In addition, when the information regarding access control is related to the organization information to which the user belongs, it may be managed using the LDAP (Lightweight Directory Access Protocol).

  The communication management table management unit 306 and the access control table management unit 307 are realized by, for example, a magnetic disk device or a semiconductor memory, and the communication management table and the access control table are stored in the magnetic disk device or the semiconductor memory.

Here, an outline of an access control operation by the application access control unit 303 will be described.
In the access control table of FIG. 3, the users belonging to the group of group ID: 1 are userA and userB, and all the affiliated users userA and userB are connected (logged in) as shown in the “permission type” column. In this case, access to server-a becomes possible. When both user A and user B are connected to the gateway machine 300 using the PC terminal 100, as shown in FIG. 2, user A and user B are described in the communication management table, and the groups to which user A and user B belong Group ID: 1 is described in each “Group ID” column. When there is an access request for server-a from userA or userB, group ID: 1 is described in userA or userB in the communication management table, and the server to which the group with group ID: 1 can be connected in the access control table is server. Since -a, user A or user B can connect to server-a. Whether to allow connection to the resource can be determined not only when all users belonging to the group are connected as in this example, but also when more than a certain number of users in the group are connected.
In FIG. 2 and FIG. 3, the access permission resource to which access is permitted is a connection permission server and a server unit, but may be a business application unit.

FIG. 10 is a diagram illustrating a hardware configuration example of the gateway machine 300 according to the first embodiment.
In FIG. 10, the gateway machine 300 includes a CPU (Central Processing Unit) 137 that executes a program. The CPU 137 is connected via a bus 138 to a ROM (Read Only Memory) 139, a RAM (Random Access Memory) 140, a communication board 144, a CRT (Cathode Ray Tube) display device 141, a K / B 142, a mouse 143, and an FDD (FlexibleDrivableD). 145, a magnetic disk device 146, a compact disk device (CDD) 186, a printer device 187, and a scanner device 188.

The RAM is an example of a volatile memory. ROM, FDD, CDD, magnetic disk device, and optical disk device are examples of nonvolatile memory.
The communication board 144 may be connected to a FAX machine, telephone, LAN, or the like.
Further, as shown in FIG. 1, the communication board 144 is connected to the PC terminal 100 and the server 200 through a predetermined communication line, and constitutes a part of the reception unit 301 and the transmission unit 304 shown in FIG.

  The magnetic disk device 146 stores an operating system (OS) 147, a window system 148, a program group 149, and a file group 150. The program group is executed by the CPU 137, the OS 147, and the window system 148.

  The program group 149 stores a program for executing a function described as “unit” in the present embodiment and the following description of the embodiment. The program is read and executed by the CPU.

  The file group 150 includes, for example, a communication management table and an access control table. In addition, in the present embodiment and the description of the embodiment described below, what is described as “determination result of”, “calculation result of”, and “processing result of” is stored as “to file”. ing.

  In addition, an arrow portion of the flowchart described in the description of the embodiment described below mainly indicates input / output of data, and for the input / output of the data, data includes a magnetic disk device, an FD (Flexible Disk), an optical disk, It is recorded on other recording media such as CD (compact disc), MD (mini disc), DVD (Digital Versatile Disk). Alternatively, it is transmitted through a signal line or other transmission medium.

  In addition, what is described as “˜unit” in the description of the embodiment described below may be realized by firmware stored in the ROM 139. Alternatively, it may be implemented by software alone, hardware alone, a combination of software and hardware, or a combination of firmware.

  In addition, programs for carrying out the embodiments described below also include other magnetic disk devices, FD (Flexible Disk), optical disc, CD (compact disc), MD (mini disc), DVD (Digital Versatile Disc), and the like. You may memorize | store using the recording device by a recording medium.

Next, an operation example of the gateway machine 300 according to the present embodiment will be described with reference to the flowcharts of FIGS. 4 and 5.
FIG. 4 shows an operation when the user logs in to the gateway machine 300 using the PC terminal 100, and FIG. 5 shows an operation when the user requests the gateway machine 300 to access a specific resource.

First, the operation at the time of login will be described with reference to FIG.
First, the reception unit 301 of the gateway machine 300 receives a login request from the PC terminal 100 (S401), and if necessary, the user authentication unit 302 performs user authentication of the user of the PC terminal 100 (S402). The authentication information sent to the gateway machine 300 at the time of user authentication is stored in the user information column of the communication management table. Note that this processing may be omitted when only the authentication by the IC card reader 110 and the fingerprint authentication device 120 is performed and the user ID / password authentication is not performed.
If the user authentication is not successful (No in S403), error information is transmitted from the transmission unit 304 to the PC terminal 100. If authenticated (Yes in S403), the application access control unit 303 communicates with the access control table management unit 307, and refers to the access control table to extract a record corresponding to the user of the PC terminal 100 (S404). .
For example, when the login request is transmitted from the PC terminal 100a of the user A, records including the user A of the access control table (a record of group ID: 1 and a record of group ID: 3) are extracted.
Next, the application access control unit 303 communicates with the communication management table management unit 306, refers to the communication management table, analyzes the login status of other users, and determines whether other necessary users are logged in. (S405). For example, the group with the group ID: 1 needs to be logged in by all users, and determines whether the user B who is another user is logged in using the PC terminal 100b. Similarly, the log-in status of other users is also determined for the group with group ID: 3.
If the necessary user is not logged in (No in S406), the group ID: 0 is written in the group ID column of the communication management table (S408).
On the other hand, when a necessary user is logged in (Yes in S406), the group ID is written in the communication management table (S407). For example, as shown in FIG. 3, when group ID: 1 is composed of userA and userB, if userA and userB are connected, 1 is written in the group ID column of the communication management table. The session ID is added to a communication message between the terminal and the gateway machine 300 as in the “client / server system” disclosed in Japanese Patent Laid-Open No. 2000-101640. At this time, if the group ID of another user belonging to the same user group is 0, the group ID is written in the communication management table for the other user. For example, when the group ID: 1 is composed of userA and userB, when userB first transmits a login request alone, since userA is not logged in at that time, the group ID: 0 is written, but when user A transmits a login request thereafter, both user A and user B are logged in, so group ID: 1 is also set for the record of user B in the communication management table.

Next, the operation when there is an access request for a specific resource from the PC terminal 100 will be described with reference to FIG.
First, the receiving unit 301 of the gateway machine 300 receives an access request from the PC terminal 100 (S501) (receiving step).
Next, the application access control unit 303 communicates with the communication management table management unit 306, refers to the communication management table based on the session ID in the access request, and the value written in the group ID column of the corresponding record (Group ID) is read (S502) (access permission determination step).
If the value of the read group ID is 0 (Yes in S503), no other necessary users are logged in, so access to the requested resource is prohibited (S507) (access permission / denial) (Decision step), the access request is not sent to the server 200.
On the other hand, if the group ID is not 0 (No in S503), it means that other necessary users are logged in, so the application access control unit 303 communicates with the access control table management unit 307, and the group ID number From the access control table, it is determined whether or not the requested resource that the PC terminal 100 tried to access matches the access permission resource described in the “connection permission server” column of the access control table (S504). (Access permission judgment step).
If the requested resource matches the access permission resource (Yes in S505), access to the requested resource is permitted and the access request from the PC terminal 100 is passed to the target server 200 (S506) ( Access permission judgment step). Also, when data is sent from the server 200 on the same communication path, the data is transferred to the PC terminal 100 side.
On the other hand, if the requested resource does not match the access-permitted resource (No in S505), access to the requested resource is prohibited (S507) (access permission determination step), and the access request is sent to the server 200. I can't.

  As described above, communication between the terminal and the server is possible only when a plurality of users matching the user IDs belonging to the access control table are connected, and the items required for authentication (IC card, password, finger, client PC) ) Is taken out and even if it tries to gain unauthorized access, it cannot access resources that require simultaneous login by two people.

  4 and 5, it is assumed that an access request is transmitted from the PC terminal 100 after the PC terminal 100 is logged in. However, the login request and the access request are simultaneously transmitted from the PC terminal 100. You may make it do. In this case, after the processing in FIG. 4, the processing after S502 in FIG. 5 may be performed continuously.

  As described above, the gateway machine 300 according to the present embodiment has a communication management table and an access control table, manages users connected to the gateway machine 300 using the communication management table, and is described in the access control table. When a combination of users is connected, the user is permitted to connect to the server.

  As described above, according to the present embodiment, in addition to authentication using an IC card, a password, biometric information, and the like, the gateway machine 300 uses the communication management table and the access control table to other users belonging to the user group. In order to determine whether or not to permit access to the access request by determining the login status, the conditions for permitting access are weighted. In addition, even if an item required for authentication is taken out illegally, the access request of a person who attempts unauthorized access is not allowed unless another legitimate user is logged in. it can. In addition, the security strength can be improved with existing hardware resources without adding hardware such as a new authentication device.

Embodiment 2. FIG.
In the present embodiment, in addition to the access control shown in the first embodiment, access control is performed by checking whether the two users who log in are in the same area (the same room, building, area, etc.).

  The overall system configuration example and the internal configuration example of the gateway machine 300 are the same as those in FIG.

An operation example of the gateway machine 300 according to the present embodiment will be described with reference to FIG.
In order to acquire the position where the PC terminal 100 exists, the position information (GPS (Global Positioning System) position information, telephone number acquired from the modem, cell phone area information, network IP address, etc.) is received on the PC terminal 100 side. get.
The acquired position information is transmitted to the gateway machine 300 together with the login request. As described in the first embodiment, the gateway machine 300 receives a login request (S401), authenticates a user (S402, S403), acquires an access control table record (S404), and determines whether another user is logged in or not. (S404, S405) are performed. Since these are the same as the operations shown in FIG. 4, a detailed description thereof will be omitted.
Next, the position of the PC terminal 100 is determined based on the position information of the PC terminal 100 transmitted together with the login request (S801).
Next, it is determined whether or not the position of the PC terminal 100 that has transmitted the login request matches the position condition (S802). In the communication management table of the present embodiment, the position information sent from the PC terminal 100 is written as shown in FIG. In this example, the names of places such as a control room and a work room are used, but any other format (coordinates, address, IP address, etc.) may be used as long as the location information is sent from the terminal. On the other hand, in the access control table of the present embodiment, as shown in FIG. 7, conditions are set so that access to the connection permission server is permitted when the position information also matches in the “permission type” column. ing. The combination of position verification includes being in the same area, not being in the same area, and being in each designated area. For example, when working with a set of two people, it can be set to allow access to the server only when one person is in the control room and the other person is in the work room.
As described above, the position of the PC terminal 100 used by another user belonging to the same user group is acquired from the communication management table, and the position of the PC terminal 100 of the user who transmitted the login request is indicated in the access control table. It is determined whether or not the current position condition is met.
As a result, if the position condition is met, the corresponding group ID and the position information of the PC terminal 100 that has transmitted the login request are written into the communication management table (S803).
On the other hand, if No in S406 and S802, the group ID: 0 and the location information of the PC terminal 100 that has transmitted the login request are written in the communication management table (S804).
The operation when an access request is transmitted is the same as that shown in FIG.

Further, unlike the above description, it is possible to determine whether or not the position condition is met when receiving the access request without performing the determination of whether or not the position condition is met when receiving the login request (S802). Good.
In this case, the determination of S801 and S802 in FIG. 8 is omitted, while the position of each user belonging to the same user group described in the communication management table (FIG. 6) between S503 and S504 in FIG. The determination in S801 and S802 may be performed by comparing the information and the position condition described in the “permission type” of the access management table (FIG. 7).

  As described above, the gateway machine 300 according to the present embodiment manages the location information of the user connected to the gateway machine 300 using the communication management table, and the user combination / location described in the access control table. It has the feature of allowing a user to connect to the server.

  As described above, even if an unauthorized user tries to access from another place while a regular user is accessing, if the user's position is different from the permitted position set in the access control table, two-person simultaneous login is performed. Necessary resources cannot be accessed and security can be ensured. In addition, the security strength can be improved with existing hardware resources without adding hardware such as a new authentication device.

Embodiment 3 FIG.
In the present embodiment, in addition to the access control of the second embodiment, the identification information when the user connects to the server is divided and shared by a plurality of users.
For example, the client certificate necessary for accessing the server is divided in half and each has a certificate (partial authentication information) divided by two users. At the same time, the two users log in to the gateway machine 300 and PC A half certificate is sent from the terminal 100 to the gateway machine 300, the gateway machine 300 restores the original certificate, and the gateway machine 300 connects to the target server using the certificate. The PC terminal 100 connects to the target server via the gateway machine 300. On the other hand, when the original certificate cannot be restored from the certificate divided by the gateway machine 300, the gateway machine 300 is denied access to the server 200.

  As described above, the gateway machine 300 according to the present embodiment divides authentication information necessary for connection to the server, and all authentication information is obtained after authentication using the communication management table and the access control table in the gateway machine 300. It is characterized by sending the restored authentication information to the server so that it can be authenticated by the server. That is, the gateway machine 300 according to the present embodiment is divided from the divided authentication information (partial authentication information) from the user who made the login request and the other users belonging to the user group of the user who made the login request. Based on whether or not the original authentication information can be restored from the authentication information (partial authentication information), whether to permit or reject the access request is determined.

  As described above, according to the present embodiment, by dividing a certificate, unauthorized access cannot be made unless a certain number or more of the divided certificates are stolen. Therefore, it is safer than using a certificate that is not divided against theft of the certificate.

Embodiment 4 FIG.
In the second embodiment, the position is acquired using the position acquisition means connected to or built in the PC terminal 100 in order to acquire the position where the user is. However, in this embodiment, the entrance / exit management device As described above, position acquisition means that is not directly connected to the PC terminal 100 is used.
FIG. 9 is a diagram showing a system configuration example of the present embodiment.
In FIG. 9, in the entrance / exit management system 500, only a person who has been authenticated by a fingerprint collation device or a non-contact IC card reader installed at the entrance of the room can enter the room. The entrance / exit management controller (entrance / exit management device) 600 is connected to a fingerprint collation device and a non-contact IC card reader, and the entrance / exit of the ID and time of the person who entered / exited by the entrance / exit management controller 600 is shown. Collect log information.
The gateway machine 300 is connected to the entry / exit management controller 600 and acquires entry / exit log information from the entry / exit management controller 600. The entry / exit log information includes position information indicating the position of the user.
When the user transmits a login request from the PC terminal 100 to the gateway machine 300, the position where the user currently exists is obtained using the entry / exit log information and described in the communication management table. Other operations are the same as those in the second embodiment.

  Thus, gateway machine 300 according to the present embodiment is connected to entry / exit management controller 600, acquires entry / exit log information from entry / exit management controller 600, and communicates using the acquired entry / exit log information. The management table manages the user location information.

  As described above, in addition to the effects of the second embodiment, by acquiring the entry / exit log from the entry / exit management system, it is possible to use when a plurality of users log in simultaneously using the location information of the user who uses the PC terminal. Such access control can be performed.

The figure which shows the structural example of the whole system containing the gateway machine which concerns on Embodiment 1-3. FIG. 3 is a diagram showing an example of a communication management table according to the first embodiment. FIG. 4 is a diagram showing an example of an access control table according to the first embodiment. FIG. 4 is a flowchart showing an operation example of the gateway machine according to the first embodiment. FIG. 4 is a flowchart showing an operation example of the gateway machine according to the first embodiment. FIG. 10 is a diagram illustrating an example of a communication management table according to the second embodiment. FIG. 10 is a diagram illustrating an example of an access control table according to the second embodiment. FIG. 9 is a flowchart showing an operation example of the gateway machine according to the second embodiment. The figure which shows the structural example of the whole system containing the gateway machine which concerns on Embodiment 4. FIG. The figure which shows the hardware structural example of the gateway machine which concerns on Embodiment 1-4.

Explanation of symbols

  100 PC terminal, 110 IC card reader, 120 fingerprint authentication device, 200 server, 201 business application, 202 business application, 203 business application, 300 gateway machine, 301 reception unit, 302 user authentication unit, 303 application access control unit, 304 transmission Section, 305 organization-specific information management section, 306 communication management table management section, 307 access control table management section, 400 modem.

Claims (9)

An access control device that accepts login from a user terminal used by a user and determines whether the user terminal is permitted to access a resource requested to be accessed,
An access control table management unit that manages an access control table indicating a plurality of user groups each composed of two or more users and access permission resources to which each user group is permitted to access;
A communication management table management unit for managing a communication management table indicating a logged-in user terminal and a user using the user terminal;
A receiving unit that receives an access request for a specific resource from any user terminal;
Whether the access permission resource of the user group of the request source user who is the request source of the access request matches the specific resource requested by the access request using the access control table and the communication management table And determining login status from other users belonging to the user group of the request source user, and when there is login from at least some other users belonging to the user group of the request source user, An access control apparatus comprising: an access permission / rejection determination unit that permits access to the specific resource in response to the access request . The access permission determination unit
The access according to claim 1, wherein access to the specific resource is permitted in response to the access request when there is a login from all other users belonging to the user group of the requesting user. Control device. The communication management table management unit
Managing a communication management table indicating the logged-in user terminal and the position of the user using the user terminal;
The access permission determination unit
The access control apparatus according to claim 1, wherein permission / refusal for the access request is determined based on a position of the request source user and a position of another user belonging to the user group of the request source user. The access control table management unit
For each user group, manage an access control table that shows the conditions related to the location of users belonging to each user group,
The access permission determination unit
The location of the request source user indicated in the communication management table management unit and the location of other users belonging to the user group of the request source user match the conditions regarding the location of the user indicated in the access control table. The access control apparatus according to claim 3 , wherein access to the specific resource is permitted in response to the access request. The receiver is
From the user terminal of the user who requests login, together with the login request, position information indicating the position of the user terminal as the user position is received,
The communication management table management unit
The access control apparatus according to claim 3 , wherein position information from the user terminal received by the receiving unit is registered in the communication management table. The receiver is
Receive partial authentication information divided from specific authentication information along with the login request from the user terminal of the user requesting login,
The access permission determination unit
Specific authentication information can be restored from partial authentication information received at the time of a login request from the requesting user and partial authentication information received at the time of a login request from another user belonging to the user group of the requesting user. The access control apparatus according to claim 1, wherein whether or not the access request is permitted is determined based on whether or not the access request is received. The access control device
It is connected to an entry / exit management device that manages user entry / exit,
The receiver is
From the entrance / exit management device, receiving location information indicating the location of each user,
The communication management table management unit
The access control apparatus according to claim 3 , wherein the position information from the entry / exit management apparatus received by the reception unit is registered in the communication management table. An access control method for accepting login from a user terminal used by a user and determining whether the user terminal is permitted to access a resource requested to be accessed,
A receiving step of receiving an access request for a specific resource from any user terminal;
A plurality of user groups each composed of two or more users, an access control table indicating access permission resources permitted to access each user group, a logged-in user terminal, and the user terminal are used Whether or not the access permission resource of the user group of the requesting user who is the request source of the access request matches the specific resource requested in the access request using a communication management table indicating the user And determining login status from other users belonging to the user group of the requesting user, and if there is login from at least some other users belonging to the user group of the requesting user, the access access allowed to allow access of the to a given resource for the request Access control method characterized by having a judgment step. A program that accepts a login from a user terminal used by a user and causes a computer to execute permission / inhibition of access of the user terminal to a resource requested to be accessed,
A reception process for receiving an access request for a specific resource from any user terminal;
A plurality of user groups each composed of two or more users, an access control table indicating access permission resources permitted to access each user group, a logged-in user terminal, and the user terminal are used Whether or not the access permission resource of the user group of the requesting user who is the request source of the access request matches the specific resource requested in the access request using a communication management table indicating the user And determining login status from other users belonging to the user group of the requesting user, and if there is login from at least some other users belonging to the user group of the requesting user, the access access allowed to allow access of the to a given resource for the request A program characterized by executing the determination process on the computer.

Images