JPS62163156A - Control system for access of data set - Google Patents

Abstract

PURPOSE:To facilitate easy access control to a data setting in an information processing system by performing a prescribed calculation based on a user discriminated name and a charging number to obtain a check key when a job is started and deciding the access right to the data setting group by said check key. CONSTITUTION:When the job start processing sets in, a check key is obtained through the prescribed calculation based on the user discriminated name and the charging number of an input job control sentence. The corresponding item is read out of an access control table by means of the check key. Each item on the access control table shows the access right to be given to each data set group against each check key. Each data et name and its access mode designated by the input job control sentence are collated with the access control table read out to check whether the access right is satisfied or not for the data set group shown by a part of the data set name. In case the requested access is not permitted by the access right, the job start processing is discontinued in the same way as a case where the designating error of the job control sentence is detected.

Description

[Detailed Description of the Invention] [Summary] Data set access control method. At the start of a job, a test key is determined by a predetermined calculation from the user's user identification name and billing number, and the test key determines access rights to the data set group. The data set group to which the data set specified in the job belongs is determined from a part of the data set name, and whether or not access to the data set 1- is allowed is identified.

With this method, access control of data sets by business etc. can be easily realized, and the overhead required for the control is small.

[Industrial application field]

The present invention relates to an access control method for data sets in an information processing system.

As is well known in the information processing system, data is stored on magnetic disks. Data sets, which are collections of data, are stored and stored in a device, etc., in units of so-called data sets, and in data processing, a user specifies a required data set name and uses it.

It is well known that in systems where such datasets are used by a large number of users, the datasets that can be used by users are regulated using an appropriate access control sieve in order to preserve the data. It is as it is.

[Prior art and problems to be solved by the invention] FIG. 3 is a block diagram showing an example of the configuration of an information processing system.

The management progera J executed by the processing device 1 processes so-called job data consisting of information specifying a job input by the user from the input device 2 such as a display terminal or a card reader, and performs job opening processing. I do.

As is well known, the job deck includes, for example, a user identification name, the name of one or more programs to be executed, and the name of each progera J, created as a job control statement in a predetermined format according to the specifications of the so-called job control language. Contains information such as the dataset name used in execution and necessary data.

The management program of the processing bag 91 opens a specified job in the system by creating a necessary control table etc. based on such information, and controls the progera 1 specified for the job to the specified job. Execute sequentially in order.

In controlling the execution start of each program specified by the user, the management program sets the specified data set name in each predetermined data set control table so that those data sets can be used during the execution of the program. do.

As is well known, in each program, when execution progresses to a stage where a certain data set is required, in order to make the data set accessible, the management program is required to control the data set. Specify a table and request so-called open processing for the required data set.

Here, the management program allows the requesting program to access the specified data set stored in the storage device 3, which is a magnetic disk storage device, magnetic tape storage device, etc., in a specified manner such as reading/writing. Set up a logical path if possible.

In this way, the processing of each program is executed, and the output generated by executing the job is output to the output device 4 such as a line printer.

In a system that controls access to datasets in order to preserve data, the user's access rights to a specified dataset are determined based on the user identification name, for example, and the access rights are determined based on the user's identification name. A management table is established for each set,
In the open process described above, access rights are determined using the management table.

Access control is performed by specifying access rights such as "read/write,""readonly," and "access prohibited," and completing or aborting the open process in accordance with the instructions.

According to such an access control method, it is necessary to set access rights for each necessary data set, making management complicated. The load is high and the control overhead is large (easily caused).

Furthermore, since access control is performed during the oven, even if access is prohibited, there are problems such as useless processing being executed until that stage is reached.

[Failure to solve the problem]

FIG. 1 is a flowchart of the process of the present invention.

The figure shows the flow of job opening processing, in which 10 is a processing step for calculating an inspection key, 11.12 is a processing step for identifying access rights for a dataset group using an access control table,
13 is a processing step when access is prohibited, 14 is a processing step when access is allowed, and step 7.

[For production]

When the job opening process is started, in process step 10, a check key is obtained by a predetermined calculation from the user identification name and billing number of the input job control statement.

In processing step 11, the corresponding type is read from the access control table using the inspection key. Each entry in the access control table indicates the access right granted to each data set group for each verification key.

In processing step 12, each data set name and its access mode specified in the manual job control statement are checked against the access control table read out in niI, and the access of the data set group indicated by a part of the data set name is determined. Satisfy or identify rights.

As a result, if the requested access is not permitted due to the access rights, the job opening process is canceled in step 13 by the same process as when it is detected that there is an error in the job control statement. .

If access is permitted, the process proceeds to step 14, where job opening processing similar to the conventional job opening process is executed.

With the above control method, access control for data sets used in a job is performed at the time of job opening, eliminating unnecessary job openings, and access control is performed all at once, so that the old data set iY i+'- Since the information is managed, the overhead for control, etc. can be reduced.

〔Example〕

FIG. 2 is a diagram illustrating an example of the structure of an access control table.

In the access control table 20, each row contains each check key value (for example, O
Each term 21 corresponds to each data set group (groups 1 to 9).
ρ).

Each column indicates the access rights that should be granted to the user who has the corresponding inspection key for the corresponding dataset group.
In the figure, rWJ indicates "read/write allowed," rRJ indicates "read only," and rNJ indicates "access prohibited."

Here, each data set group is configured by classifying data nodes by business, taking into consideration the need for access from the user's business, for example, and The dataset name shall be assigned so that indicates the dataset group.

When the processing device 1 receives a job deck and starts job opening processing as in the past, in processing step 10 shown in FIG. Find the inspection key using di calculation.

Enter the user identification name here, for example r Z Z 9910)
Assuming that the format consists of two alphabento characters and two numeric characters, the billing number is determined, for example, by the following 81 calculation, and is known to the user along with the user identification name.

That is, find each numerical value G1, G2 without indicating the alphabetical order of each alpha head character of the usage-1f identification name, and each numerical value G3, G4 without indicating the alphabetical order, and calculate the numerical value of the billing number by A=G.
+C++GzCz+G3G34G4C4+ K Cs.

However, K in ``2'' is the numerical value of the inspection key to be given to the user. Further, C,, CZ, C3, C4, and C3 are integer constants appropriately determined by the system, for example, C1=7,
Cz=31, C3=99991, Ct=9973.
By setting Cs・997, 1 can be calculated using the above formula.
Obtain a 6-digit billing number 0i1-ti.

The values of the integer constants C0 to C5 are such that duplication of billing numbers is unlikely to occur;
Needless to say, it is desirable to select a billing number that is difficult for the user to calculate.

From the above, in processing step IO, the inspection key can be obtained from the user identification name and the billing number by back-calculating the above equation.

In processing step 11, for example, the information is stored in the storage device 3,
The entry corresponding to the inspection key is read from the access control table shown in FIG.

In processing step 12, each data set name specified in the manual job control statement and its access by Mr. B are checked against the corresponding column of the access control table read above, and the data set name indicated by a part of the data set name is checked. Identifies whether the node group's access rights are satisfied.

As a result, if the requested access is not permitted due to the access rights, in processing step 13, an error message is output, for example, by the same process as when a specification error is generally detected in a job control statement. Then, job opening processing is performed on January 1st.

If access is permitted, the process proceeds to step 14, where the job opening process PII is executed as in the conventional method, and then job execution is started.

〔Effect of the invention〕

As is clear from the explanation below, according to the present invention, the management of access control, which is essential for data processing in an information processing system, is facilitated, and the overhead of access control remains small, so that the system There is a significant industrial effect of improving processing efficiency.

[Brief explanation of drawings]

FIG. 1 is a flowchart of the processing of the present invention, FIG. 2 is an explanatory diagram of an access control table, and FIG. 3 is a block diagram of an example of the configuration of an information processing system. In the figure, I is a processing device, 2 is an input device, 3 is a storage device,
4 is an output device, 10 to I4 are processing steps,
20 is an access control table. FIG. 1 is an explanatory diagram of the access control table. FIG. 2 is a block diagram of an example configuration of an information processing system.

Claims (3)

[Claims] (1) In an information processing system that has multiple data set groups formed by classifying data sets, in the opening process of a job that accesses the data set, the correspondence between inspection keys and access rights is determined for each data set group. An access control table (20) is provided, and an inspection key (10) is calculated by a predetermined calculation from the user identification name and billing number assigned to the user of the job, and the data specified by the user. A data set access control method, characterized in that access to the data set is controlled by access rights obtained from the access control table according to the data set group to which the set belongs (11, 12, 13). (2) The data set access control method according to claim 1, wherein the data set group to which the data set belongs is identified by a part of the data set name of the data set. (3) The data set access control method according to claim 1 or 2, wherein the predetermined calculation is as follows. The numerical value determined from each character of the n-character user identification name is G_1
, G_2,...G_n, and the numbers represented by the billing number and inspection key are A and K, respectively, K=(A-(G_1C_1+G_2C_2+...+
G_nC_n))/C_n_+_1. However, C_
1, C_2, . . . C_n, C_n_+_1 are predetermined integer constants.