JPH0314047A - Access control system - Google Patents

Abstract

PURPOSE:To improve the access processing efficiency by simultaneously performing retrieval of resources and check of the access right with respect to the access control for protection of resources like files of a computer. CONSTITUTION:Prescribed management information of resources allowing access of respective access mode are registered in resource management registers 2ai, 2bi, 2aj, and 2bj, which are provided for respective required classifications of access mode of access request sources 4i and 4j, with resource names. When an access request 5 is issued, an access processing part 3 retrieves one of resource management registers 2ai, 2bi, 2aj, and 2bj, which corresponds to the access mode designated by the request, by the designated resource name, and the request is executed in accordance with management information if the resource name is registered. Thus, it is discriminated whether the designated resource is registered or not by retrieval of resource management registers 2ai, 2bi, 2aj, and 2bj to check the access right, and the access processing efficiency is improved because the overhead of access control is eliminated.

Description

[Detailed Description of the Invention] [Summary] Regarding access control for resource protection of resources such as files in a computer, it is possible to search for resources and check the access authority to the resources at the same time. The purpose of this is an access control method that can improve access processing efficiency, and is controlled so that access can only be made to those resources that have a predetermined resource and are limited to the authority of the access requester, and only in a limited access manner. In the computer that performs the access, predetermined management information of the resource that is allowed to be accessed by the access mode is registered by resource name in a resource management list prepared for each required type of the access mode for each access request source, and When a request is issued, the resource management book corresponding to the access mode specified in the request is searched by the specified resource name, and if the resource name is registered, the resource management list corresponding to the access mode specified in the request is searched, and if the resource name is registered, the resource management list corresponding to the access mode specified in the request is searched, and if the resource name is registered, the resource management list corresponding to the access mode specified in the request is searched, and if the resource name is registered, Configure the request to run.

[Industrial application field]

The present invention relates to an access control method for protecting resources such as files in a computer.

[Prior art and problems to be solved by the invention] As is well known, access control is a method of controlling computer resources such as files in order to ensure their integrity. This process restricts access to resources.

For example, in the case of files, a file management book called a directory etc. is set up, files are registered by file name, the relationship between the file name and the entity is managed, and when an access request is made, the requested file is By searching a directory by name, you can obtain the administrative information necessary to access that file.

When access control is performed, a separate access control table is provided, and the access control table contains, for example, for each file, the identification name of the access requester to whom access is permitted, and the access mode for that requester, i.e., read-only. Do you forgive me?
It is possible to check the access authority of the request source by indicating restrictions such as whether both reading and writing are allowed.

Therefore, when an access request is made to a file, the directory is searched to obtain management information, and the access control table is referenced for access control to check whether the user has access authority or if there is access authority. In this case, it is determined whether the access mode of the request is within the limits, and access is executed only if the request satisfies the access control conditions.

For this reason, there is a problem in that the processing for access control becomes overhead added to normal access processing, reducing the processing capacity of the system.

An object of the present invention is to provide an access control method that can simultaneously search for a resource and check access authority for the resource, thereby increasing the processing efficiency of resource access.

[Means to solve the problem]

FIG. 1 is a block diagram showing the configuration of the present invention.

The figure shows the configuration of an access control method, which is used in a computer that has a predetermined resource l and controls access to only the resource limited to the authority of the access requester using the limited access mode. A resource management list 2ai, 2bt, 2aj, provided for each required type of access mode for each access request source 4i, 4j, etc.
2bj etc., predetermined management information of the resource that allows access in the access mode is registered by resource name, and when the access request 5 is issued, the access processing unit 3 registers the specified management information in the access mode specified in the request. Applicable resource management record 2ai
, 2bi, 2aj, 2bj, etc. using the specified resource name, and if the resource name is registered, the request is executed according to the management information.

[For production]

With this control method, the resource management book is searched and access authority is checked depending on whether the specified resource is registered or not, and if the specified resource is registered (i.e., accessible), at the same time, Since the management information obtained from the conventional directory can be obtained and the overhead of access control is eliminated, access processing efficiency can be improved.

〔Example〕

FIG. 2 is a diagram illustrating an example of a resource management list for controlling access to files. RIE 80) and
Resource management records 2a and 2b are provided for each of two types of access modes: read and write access (WRITE),
For example, if expressed in a tree structure, the request source identification name is the root, and the access modes are READ and Wl? There are fTE nodes, and under each one, branches based on the file names of accessible files are extended to reach the management information of the leaf nodes.

For example, if a request source using these resource management records 2a, 2b requests READ access to files rlJ, . It is possible to obtain management information IO such as location and execute access. On the other hand, if there is no technique for the corresponding file name in such a search, that is, if the file is not registered in the resource management list 2a, this indicates that READ access authority to that file has not been granted. , the access processing unit 3 replies to the request source that it refuses to execute the request.

FIG. 3 shows an example of the flow of the above-mentioned processing by the access processing unit 3. When an access request is received and processing is started, in processing step 20, resource management to be used is performed based on the request source identification name and the access mode of the request. Decide on the book.

In processing step 21, the resource management list is searched by the requested resource name, and if the requested resource is found, the process proceeds from processing step 22 to processing step 23, and access to the requested resource is executed based on the management information. do. If the resource is not registered in the resource management book, the process branches to step 24 and the request source is notified of access denial.

〔Effect of the invention〕

As is clear from the above description, according to the present invention, in access control for protection of resources such as computer files, resource searches and access authority checks are performed simultaneously to improve access processing efficiency. This has a significant industrial effect.

[Brief explanation of drawings]

FIG. 1 is a block diagram showing the configuration of the present invention, FIG. 2 is an explanatory diagram of the resource management list of the present invention, and FIG. 3 is a flowchart of the processing of the present invention. In the figure, ■ is a resource, 2a, 2b, 2ai, 2bi, 2aj, 2bj are resource management records, 3 is an access processing unit, 4i, 4j are access request sources, 5 is an access request, 10 is management information, FIG. Block diagram illustrating the configuration of the present invention; Figure 1; flowchart of processing of the present invention; Figure 3;

Claims (1)

[Scope of Claims] In a computer that has a predetermined resource (1) and controls access to the resource limited to the authority of an access requester only in a limited access manner, A resource management list (2ai,
, 2bi, 2aj, 2bj), register the predetermined management information of the resource that allows access for the access mode by resource name, and when an access request (5) is issued, the access specified in the request. The resource management book corresponding to the aspect (2ai~
) by the specified resource name, and if the resource name is registered, execute the request according to the management information (
3) An access control method characterized by being configured as follows.