JPH11238037A - Information access control method/information access controller and recording medium recording information access control program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To allow an information-using right information to a local user, which an operating system(OS) supplies, to use for multiple users (service users) includ ing the local user. SOLUTION: Matching information 120 defining the local user matching to the set of service users having the information-using right of an equal range against supplied information is prepared. A service program 110 receiving a request from the service user 100 makes the set of the service users match to the local user by the matching information 120. The access route identifier of a server program 130 that is operated under the right of the local user is returned to the service user 100. The service user 100 establishes an access route to the server program 130 by the route identifier and gives the request again as if the local user of the server program.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an information access control method and apparatus in a service for providing information stored in a computer to a large number of users (service users) other than local users, and an information access control program therefor. It relates to a recorded recording medium.

[0002]

2. Description of the Related Art Information stored in a computer is transferred to an operating system (O / O) for controlling the use of resources on the computer.
In an information service system that provides a large number of users (service users) other than the users (local users) directly managed by S), as a conventional information access control method, a method shown in FIG. 5 is used. is there. This is because the information use authority information 520 for the local users (A and B) independently of the information use authority information (omitted in FIG. 5) of the local user (C) provided by the operating system is independently provided. The computer 10 secures an information area 530 to which a specific local user C has a right to use on the computer 10, and operates under the authority of the local user C to eliminate access to the information area of other local users D and E. The server program 510 that keeps security
For example, a request (service user name, password, request information α, etc.) 500 of the service user A is received,
In some authentication services, the service user is authenticated, the user name of the service user A is determined, and information access control is realized by referring to unique information use authority information 520.

[0003] This method is called World-W on the Internet.
HTTP (Hyper-Text Tr known as ide-Web)
ansfer Protocol) service [for example, RFC-206
This is a method used in public use as 8].

[0004]

In the above prior art, the information use authority information for the service user is prepared independently of the information use authority information of the local user provided by the operating system. There is a problem that it must be managed twice. Moreover, the information use authority information for this service user is
It is necessary to prepare for each server program that operates with the authority of the specific local user that accepts it.

The present invention relates to an information service system for providing information stored in a computer to many users (service users) other than a local user. An object of the present invention is to realize information access control by using the information as information use authority information of a user.

[0006]

SUMMARY OF THE INVENTION The present invention relates to a correspondence between a set of service users having the same range of information use authority for information to be provided and a local user defined in advance corresponding to the set of service users. Prepare the information, obtain the local user name corresponding to the service user who made the request from the correspondence information, perform the authentication of the service user independently of the authentication of the operating system, and obtain the actual information access control. The local user name is referred to the information use authority information of the local user provided by the operating system.

[0007] This eliminates the necessity of managing the unique information use authority information for the service user. However, the association between the information to be provided and the set of service users who can use the information, that is, the association with the local user, can be arbitrarily established by the conventional method using a mechanism unique to the server program. In contrast, in the present invention,
Depending on the information usage authority information of the local user provided by the operating system, a desired association may not be implemented depending on the operating system used. However, in the majority of operating systems adopted as environments for executing services, it is possible to provide a plurality of local users with a right to use one piece of provided information or a set of provided information. Problem is extremely rare, and does not pose a problem in applying the present invention.

[0008]

FIG. 1 is a diagram showing the configuration and information flow of a first embodiment of the present invention. In the figure, 10
Is a computer that provides information provision services, and 100 is a service user (user terminal) that receives information provision. The computer 10 includes a server program 110 that operates in common for a large number of service users, a set of service users and local user correspondence information 120, a server program 130 that operates with the authority of a specific local user, and authentication of the server program 130. Password information 140 referred to by the service, an operating system (OS) 150 for controlling the use of resources on the computer 10, the OS 150
Information use authority information 160 of the local user provided by
And information 170 provided to the user. Correspondence information 120 includes a set 121 of service users having the same range of authority to use the information to be provided, a local user 122 corresponding to the set of service users, and
One set of access path identifiers 123 to the server program operating under the authority of the local user is provided, and there are as many such sets as the number of service user sets. here,
The local user 122 corresponding to the service user set 121 may be a virtual local user newly created to correspond to the service user set. OS
Information use authority information 1 of local user provided by 150
Reference numeral 60 is basically the same as the information use right information 520 if the service user in the information use right information 520 of FIG. 5 is replaced with a local user.

FIG. 2A shows a processing flowchart of the server program 110, and FIG. 2B shows a processing flowchart of the server program 130. Hereinafter, the operation of the embodiment of FIG. 1 will be described with reference to FIG.

When the server program 110 receives a request from the service user 100 (step 20)
1), referring to the correspondence information 120, the service user 10
The set of service users to which 0 belongs is determined (step 2).
02), the set of service users 100 (set A) is associated with the local user 7 (set local user A) from the correspondence information 120 (step 203), and the server program (130, A) (step 204), and the access path identifier A is returned to the service user 100 (step 205). In addition,
In step 202, if the set of service users to which the service user 100 belongs does not exist in the correspondence information 120, the server program 110
Request rejection is returned to 0 (step 20)
6).

The service user 100 newly uses the received access path identifier 12 to newly
Establish an access path to the server program 130 operating with the authority of and send a request. The request includes a service user name, a password, requested information (referred to as information α), and the like.

Upon receiving a request from the service user (step 211), the server program 130 operating under the authority of the local user A refers to the password information 140 based on the service user name and password to determine the authentication of the service user 100. Perform (step 212), and if authenticated, request the operating system (OS) 150 for permission to access the information α (step 213). Operating system 1
The server 50 refers to the information usage right information 160 to determine whether the local user A of the server program 130 has a right to use the information α. If so, the server grants access permission; Program 1
Return to 30. The server program 130 determines whether or not access from the operating system 150 is possible (step 214).
(Information α) is accessed (Step 215), and the service of providing the information α to the service user 100 is performed as if it were to the local user A (Step 2).
16). On the other hand, if the access denial is returned from the OS 150 or if the authentication is denied in step 212, the service user 100 is notified of the access denial (step 217).

FIG. 3 is a diagram showing the configuration and information flow of the second embodiment of the present invention. In this embodiment, the computer 10
Is a server program 310 that operates in common for a large number of service users, password information 320 referred to by the authentication service of the server program 310, correspondence information 330 between a set of service users and local users, actual access control of information. Access control program 3
40, an operating system (OS) 350, and information 370 provided to the user. Also in the present embodiment, although there is the information use authority information of the local user provided by the OS shown in FIG. 1, it is omitted in FIG. Correspondence information 3
Reference numeral 30 denotes a set of service users 331 having information usage authority information in the same range as the provided information, and a set of local users 332 corresponding to the set of service users. Only exists. In the present embodiment, like the correspondence information 120 in FIG.
The access path identifier 123 to the server program that operates with the authority of the local user is unnecessary.

FIG. 4A shows a processing flowchart of the server program 310, and FIG. 4B shows a processing flowchart of the access control program 340. Hereinafter, FIG.
The operation of the embodiment shown in FIG.

In this embodiment, the service user 100
From the beginning, the computer 10 sends a request containing the service user name, password, and requested information (information α).
Send to Upon receiving the request from the service user 100, the server program 310 (Step 40)
1), referring to the password information 320 using the service user name and password, and
(Step 402). When the authentication is obtained, the service user 10 is referred to by referring to the correspondence information 330.
A set of service users to which 0 belongs is determined (step 4).
03), the set of service users 100 (set A) and the local user (set local user A) are associated from the correspondence information 330 (step 404), the access control program 340 is started, and the user of the local user is started. The name A and the requested information α are passed, and an access request is made to the access control program 340 (step 40).
5). Thereafter, the server program 310 waits for an execution result from the access control program 340.

When the access control program 411 receives an access request for the local user name A and the information α from the server program 310 (step 411), the access control program 411 sends it to the operating system (OS) 350.
The use right information 361 of the information α in the information use right information (160 in FIG. 1) provided by the user 0 is obtained (step 412), and the local user A is referred to the use right information 361 to use the information α. It is determined whether or not the right exists (step 413).
Is accessed (step 414), and the information α is passed to the server program 310 (step 415). If the information α does not exist, an access rejection is notified to the server program 310 (step 416).

The server program 310 determines the execution result of the access control program 340 (step 40).
6) When the access is permitted and the information α is received from the access control program 340 (step 407), the information α is sent to the service user 100 (step 40).
8) On the other hand, if the access is not permitted, the service user 100 is notified of denial of access (step 409).

Although the two embodiments of the present invention have been described above, the processing flow shown in FIG. 2 and FIG.
It can be recorded on a recording medium such as a D-ROM in a computer-readable format and sold. And
By loading the information access control program recorded on this recording medium into a computer, the operations described in FIGS. 1 and 3 become possible.

[0019]

As described above, according to the present invention,
It is possible to easily use the information usage right information of the local user provided by the operating system as the information usage right information of the service user in a service system that provides information to a large number of users (service users) other than the local user. In addition, there is no need to duplicately manage the service user's information use authority information separately from the information use authority information provided by the operating system.

[Brief description of the drawings]

FIG. 1 is a diagram showing the configuration and information flow of a first embodiment of the present invention.

FIG. 2 is a processing flowchart of the embodiment of FIG. 1;

FIG. 3 is a diagram illustrating a configuration and a flow of information according to a second embodiment of the present invention.

FIG. 4 is a processing flowchart of the embodiment of FIG. 2;

FIG. 5 is a diagram illustrating a conventional information access control method.

[Explanation of symbols]

 Reference Signs List 10 computer 100 service user 110 server program 120 correspondence information 130 server program 140 password information 150 operating system 160 information use authority information 170 provided information

Claims (3)

[Claims] 1. A method in which information stored in a computer is transferred to a large number of users (hereinafter, referred to as “services”) other than users (hereinafter, referred to as “local users”) directly managed by an operating system that controls use of resources on the computer. In the information service system that provides the information to be provided, the correspondence between the set of service users who have the same scope of information use authority for the information to be provided and the local users defined corresponding to the set of service users The information is prepared, the local user name corresponding to the service user who made the request is obtained based on the corresponding information, and the information use authority information of the local user provided by the operating system is referred to based on the obtained local user name. Information access control method characterized by performing information access control to a user 2. The information stored in a computer is provided to a number of users (service users) other than users (local users) directly managed by an operating system that controls use of resources on the computer. Means for storing correspondence information between a set of service users having the same range of information use authority for provided information and local users defined in correspondence with the set of service users, Means for acquiring a local user name corresponding to the service user who made the request by the correspondence information, and for authenticating the service user independently of the authentication of the operating system; and a local area provided by the operating system based on the acquired local user name. Refer to the user's information use authority information and Means for controlling access of information to a user. 3. The information stored in a computer is provided to a large number of users (service users) other than users (local users) directly managed by an operating system that controls use of resources on the computer. A computer-readable recording medium on which an information access control program for a service to be provided is recorded, wherein, when requested by a service user, a set of service users having the same range of authority to use the information to be provided and the service A processing process of referring to correspondence information with a local user defined corresponding to a set of users and obtaining a local user name corresponding to the service user, and authenticating the service user independently of operating system authentication The operation is performed according to the processing process and the acquired local user name. A processing process for referring to information usage authority information of a local user provided by the operating system and controlling access to information of a service user.