System, server, and program for access right management

• US 8,296,821 B2
• Filed: 02/08/2008
• Issued: 10/23/2012
• Est. Priority Date: 03/09/2007
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Nakae, Masayuki
• Primary Examiner(s): Dada, Beemnet
• Assistant Examiner(s): MORAN, RANDAL D
• Application Number:
  US12/068,673
• Publication Number:
  US 20080222694A1
• Time in Patent Office: 1,719 Days
• Field of Search: 726/1, 726/26, 726/27
• US Class Current: 726/1
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Each domain is provided with an access right management device which creates a resource-sharing policy and performs processing for resource-sharing policy negotiation between a plurality of domain administrators. An access right management device that has created a resource-sharing policy identifies, for each policy unit included in the resource-sharing policy, an access right management device that is a negotiating partner to negotiate with about the policy unit in question. The access right management device generates negotiation information including an identification name of the identified negotiating-partner access right management device and the policy unit in question and sends the negotiation information to the negotiating-partner access right management device. Only when all policy units are agreed on by respective identified negotiating-partner access right management devices, the resource-sharing policy is set on shared resources.

Claims

1. A system comprising an access right management device, which is provided in each domain, for creating a resource-sharing policy for sharing computer equipment resources, and performing resource-sharing policy negotiation between a plurality of domain administrators, wherein

the access right management device comprises a computer and performs:

for each policy unit to be negotiated of the resource-sharing policy, separately identifying an access right management device which is a negotiating partner about each policy unit to be negotiated;

generating negotiation information including an identification name of the identified access right management device and the policy unit to be negotiated; and

transmitting the negotiation information to the identified access right management device, wherein each policy unit comprises an access subject, an access object, and an access action; and

setting the resource-sharing policy on shared resource when having received an instruction to agree on every policy unit from the identified access right management device to which the negotiation information was sent,

wherein, when a first domain administrator has agreed on a policy unit with a second domain administrator, the first domain administrator affixes its own digital signature to the policy unit,

wherein the instruction to agree on the policy unit is verified by digital signatures of both the first domain administrator and the second domain administrator affixed to the policy unit.

2. The system according to claim 1, wherein the access right management device comprises:

a policy editing section for creating and editing the resource-sharing policy;

a group management section for storing domain information including identification names of users, domain administrators and the access right management device involved in resource sharing and relations with domains;

a shared resource management section for storing an identification name of shared resource and the domain which are associated with each other;

a negotiation information generation section for extracting from the resource-sharing policy the policy unit to be negotiated with the domain which is a negotiating partner and generating the negotiation information by referring to the group management section and the shared resource management section;

a policy negotiating section for performing negotiation to obtain an agreement with the identified access right management device on the policy unit of the resource-sharing policy and, when having agreed on the policy unit with the negotiating partner, affixing a digital signature of the domain administrator to the policy unit; and

a policy enforcement section for setting only an agreed resource-sharing policy on shared resource when digital signatures of both the domain administrators negotiated are affixed to the policy unit to determine that the policy unit has been agreed on.

3. The system according to claim 2, wherein when the policy editing section creates a new resource-sharing policy or alters a resource-sharing policy, the negotiation information generation section divides the resource-sharing policy into policy units and, for each policy unit, inquires of the group management section which domain the identification name of a user belongs to, or inquires of the shared resource management section which domain the identification name of a shared resource belongs to, thereby identifying a negotiating partner about the policy unit, and generates negotiation information including a list of identification names of involved access right management devices and at least one policy unit to be negotiated.

4. The system according to claim 2, wherein the policy negotiation section sends the negotiation information generated by the negotiation information generation section to the access right management device included in the negotiation information and when an instruction to agree on the policy unit included in the negotiation information is obtained from the access right management device to which the negotiation information has been sent, a digital signature of a domain administrator of that access right management device is affixed to the policy unit.

5. The system according to claim 4, wherein the policy negotiation section checks for presence of a digital signature and, when determining that the policy unit has been agreed on, updates the resource-sharing policy in question with the agreed policy unit.

6. The system according to claim 1, wherein the shared resource is a virtual shared resource, wherein the system further comprises a virtual resource generation section of a computer for generating the virtual shared resource and registering information of generated virtual shared resource in the access right management device.

8. The system according to claim 1, further comprising a conflict verification section of a computer for detecting a conflict between the resource-sharing policy and a predetermined restrictive condition.

7. A system comprising:

an access right management server provided in each domain, which, for each policy unit to be negotiated of a generated resource-sharing policy for sharing computer equipment resources, separately identifies a negotiating partner about the policy unit;

generates negotiation information including an identification name of the identified negotiating partner and the policy unit to be negotiated; and

transmits the negotiation information to the identified negotiating partner; and

when having received an instruction to agree on every policy unit from the identified negotiating partner to which the negotiation information was sent, sets the resource-sharing policy on shared resource, wherein each policy unit comprises an access subject, an access object, and an access; and

a client terminal which connects to the access right management server to allow a domain administrator to instruct editing, negotiation and forcedly setting of the resource-sharing policy,

wherein, when the access right management server has agreed on a policy unit with the identified negotiating partner, the access right management server affixes its own digital signature to the policy unit,

wherein the instruction to agree on the policy unit is verified by digital signatures of both the access right management server and the identified negotiating partner affixed to the policy unit.

9. The system according to claim 7, further comprising a conflict verification section for detecting a conflict between the resource-sharing policy and a predetermined restrictive condition.

10. A server, which is provided in each domain, for creating a resource-sharing policy for sharing computer equipment resources, and performing resource-sharing policy negotiation between a plurality of domain administrators, wherein the server performs:

for each policy unit to be negotiated of the resource-sharing policy, separately identifying a server which is a negotiating partner about each policy unit to be negotiated;

generating negotiation information including an identification name of the identified server and the policy unit to be negotiated; and

transmitting the negotiation information to the identified server, wherein each policy unit comprises an access subject, an access object, and an access action; and

setting the resource-sharing policy on shared resource when having received an instruction to agree on every policy unit from the identified server to which the negotiation information was sent,

wherein, when the server has agreed on a policy unit with the identified server, the server affixes its own digital signature to the policy unit,

wherein the instruction to agree on the policy unit is verified by digital signatures of both the server and the identified server affixed to the policy unit.

11. The server according to claim 10, comprising:

a policy editing section for creating and editing the resource-sharing policy;

a group management section for storing domain information including identification names of users, domain administrators and the server involved in resource sharing and relations with domains;

a shared resource management section for storing an identification name of shared resource and the domain which are associated with each other;

a negotiation information generation section for extracting from the resource-sharing policy the policy unit to be negotiated with the domain which is a negotiating partner and generating the negotiation information by referring to the group management section and the shared resource management section;

a policy negotiating section for performing negotiation to obtain an agreement with the identified server on the policy unit of the resource-sharing policy and, when having agreed on the policy unit with the identified server, affixing a digital signature of the server to the policy unit; and

a policy enforcement section for setting only an agreed resource-sharing policy on shared resource when digital signatures of both the server and the identified server negotiated are affixed to the policy unit to determine that the policy unit has been agreed on.

12. The server according to claim 11, wherein when the policy editing section creates a new resource-sharing policy or alters a resource-sharing policy, the negotiation information generation section divides the resource-sharing policy into policy units and, for each policy unit, inquires of the group management section which domain the identification name of a user belongs to, or inquires of the shared resource management section which domain the identification name of a shared resource belongs to, thereby identifying a negotiating partner about the policy unit, and generates negotiation information including a list of identification names of involved servers and at least one policy unit to be negotiated.

13. The server according to claim 11, wherein the policy negotiation section sends the negotiation information generated by the negotiation information generation section to the server included in the negotiation information and when an instruction to agree on the policy unit included in the negotiation information is obtained from the server to which the negotiation information has been sent, a digital signature of a domain administrator of that server is affixed to the policy unit.

14. The server according to claim 13, wherein the policy negotiation section checks for presence of a digital signature and, when determining that the policy unit has been agreed on, updates the resource-sharing policy in question with the agreed policy unit.

15. The server according to claim 10, wherein the shared resource is a virtual shared resource, wherein the system further comprises a virtual resource generation section for generating the virtual shared resource and registering information of generated virtual shared resource in the server.

16. A non-transitory computer-readable medium storing an access right management program which runs on an access right management server provided in each domain, for creating a resource-sharing policy for sharing computer equipment resources, and performing resource-sharing policy negotiation between a plurality of domain administrators, wherein the program instructs the access right management server to perform:

a function of, for each policy unit to be negotiate d of the resource-sharing policy, separately identifying an access right management server which is a negotiating partner about each policy unit to be negotiated;

generating negotiation information including an identification name of the identified access right management server and the policy unit to be negotiated; and

transmitting the negotiation information to the identified access right management server, wherein each policy unit comprises an access subject, an access object, and an access action; and

a function of setting the resource-sharing policy on shared resource when having received an instruction to agree on every policy unit from the identified access right management server to which the negotiation information was sent, wherein, when the access right management server has agreed on a policy unit with the identified access right management, the access right management server affixes its own digital signature to the policy unit, wherein the instruction to agree on the policy unit is verified by digital signatures of both the access right management server and the identified access right management server affixed to the policy unit.

17. The non-transitory computer-readable medium according to claim 16, wherein the program instructs the access right management server to perform:

a policy editing function of creating and editing the resource-sharing policy;

a group management function of storing domain information including identification names of users, domain administrators and the server involved in resource sharing and relations with domains;

a shared resource management function of storing an identification name of shared resource and the domain which are associated with each other;

a negotiation information generation function of extracting from the resource-sharing policy the policy unit to be negotiated with the domain which is a negotiating partner and generating the negotiation information by referring to the group management function and the shared resource management function;

a policy negotiating function of performing negotiation to obtain an agreement with the identified access right management server on the policy unit of the resource-sharing policy and, when having agreed on the policy unit with the identified access right management server, affixing a digital signature of the server to the policy unit; and

a policy enforcement function of setting only an agreed resource-sharing policy on shared resource when digital signatures of both the access right management server and the identified access right management server negotiated are affixed to the policy unit to determine that the policy unit has been agreed on.

18. The non-transitory computer-readable medium according to claim 16, wherein when the policy editing function creates a new resource-sharing policy or alters a resource-sharing policy, the negotiation information generation function divides the resource sharing policy into policy units and, for each policy unit, inquires of the group management function which domain the identification name of a user belongs to, or inquires of the shared resource management function which domain the identification name of a shared resource belongs to, thereby identifying a negotiating partner about the policy unit, and generates negotiation information including a list of identification names of involved access right management servers and at least one policy unit to be negotiated.

19. The non-transitory computer-readable medium according to claim 18, wherein the policy negotiation function sends the negotiation information generated by the negotiation information generation function to the access right management server included in the negotiation information and when an instruction to agree on the policy unit included in the negotiation information is obtained from the access right management server to which the negotiation information has been sent, a digital signature of a domain administrator of that access right management server is affixed to the policy unit.

20. The non-transitory computer-readable medium according to claim 19, wherein the policy negotiation function checks for presence of a digital signature and, when determining that the policy unit has been agreed on, updates the resource-sharing policy in question with the agreed policy unit.

21. The non-transitory computer-readable medium according to claim 16, wherein the shared resource is a virtual shared resource, wherein the program further comprises a virtual resource generation function of generating the virtual shared resource and registering information of generated virtual shared resource in the access right management server.

22. A method for creating a resource-sharing policy for sharing computer equipment resources, and performing resource-sharing policy negotiation between a plurality of domain administrators in an access right management server provided in each domain, comprising:

for each policy unit to be negotiated of the resource-sharing policy, separately identifying an access right management server which is a negotiating partner about each policy unit to be negotiated;

generating negotiation information including an identification name of the identified access right management server and the policy unit to be negotiated; and

transmitting the negotiation information to the identified access right management server, wherein each policy unit comprises an access subject, an access object, and an access action; and

setting the resource-sharing policy on shared resource when having received an instruction to agree on every policy unit from the identified access right management server to which the negotiation information was sent,

wherein, when the access right management server has agreed on a policy unit with the identified access right management server, the access right management server affixes its own digital signature to the policy unit,

wherein the instruction to agree on the policy unit is verified by digital signatures of both the access right management server and the identified access right management server affixed to the policy unit.

23. The method according to claim 22, comprising:

creating and editing the resource-sharing policy;

storing domain information including identification names of users, domain administrators and the server involved in resource sharing and relations with domains;

storing an identification name of shared resource and the domain which are associated with each other;

extracting from the resource-sharing policy the policy unit to be negotiated with the domain which is a negotiating partner and generating the negotiation information by referring to the domain information, the identification name of the shared resource and the domain;

performing negotiation to obtain an agreement with the identified access right management server on the policy unit of the resource-sharing policy and, when having agreed on the policy unit with the identified access right management server, affixing a digital signature of the server to the policy unit; and

setting only an agreed resource-sharing policy on shared resource when digital signatures of both the access right management serve and the identified access right management server negotiated are affixed to the policy unit to determine that the policy unit has been agreed on.

24. The method according to claim 22, wherein when creating a new resource-sharing policy or altering a resource-sharing policy,

dividing the resource-sharing policy into policy units and, for each policy unit,

inquiring about which domain the identification name of a user belongs to, or inquiring about which domain the identification name of a shared resource belongs to, thereby identifying a negotiating partner about the policy unit, and

generating negotiation information including a list of identification names of involved access right management servers and at least one policy unit to be negotiated.

25. The method according to claim 22, wherein the shared resource is a virtual shared resource, wherein the method further comprises generating the virtual shared resource and registering information of generated virtual shared resource in the access right management server.