Access control system, access control method, and access control program

• US 20050262132A1
• Filed: 05/20/2005
• Published: 11/24/2005
• Est. Priority Date: 05/21/2004
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Morita, Yoichiro, Nakae, Masayuki
• Granted Patent: US 7,624,424 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A policy storage stores an access control policy as a set of setting information items to make resources (access destinations) shared by an adhoc group. When a part of the access control policy is edited, a policy analyzer updates a rule generated from the edited access control policy. At this time, the rule is updated with use of object knowledge having a data configuration capable of expressing a user as belonging to plural user groups. An access control list setting means updates a part of an access control list, based on the updated rule. Accordingly, an access control list can be generated with respect to a user group including a user who belongs to plural organizations, and the access control list can be updated efficiently.

Claims

1. An access control system comprising:

a knowledge database configured to store

(i) information indicative of a relationship between a group of users or devices that use at least a resource as an access destination, and user identification information or device identification information capable of identifying the user or device,

(ii) information indicative of a relationship between a position as an access source of access to the resource, and access source identification information capable of identifying the position, or

(iii) information indicative of a relationship between the resource and access destination identification information capable of identifying the resource; and

a policy engine configured to

(i) store an access control policy describing at least the group, position, and resource of the information stored in the knowledge database,

(ii) generate an access control list indicating accessibility/inaccessibility to an access destination from an access source by use of the access control policy and the information stored in the knowledge database, and

(iii) set the access control list in an existing access control device.

2. The access control system according to claim 1, wherein said policy engine includes

a policy analyzer configured to generate an intermediate language as a set of rules including no description depending on a specific access control device, by replacing at least the position and resource among contents written in the access control policy, with access source identification information and access destination identification information, respectively, by use of the information stored in the knowledge database.

3. The access control system according to claim 2, wherein said policy analyzer is configured to generate the rules constituting the intermediate language, based on an updated access control policy.

4. The access control system according to claim 1, wherein said knowledge database includes

a knowledge storage configured to store

(i) information indicative of a relationship between a group and user identification information or device identification information, as a directional graph having a path from one group to another group, user identification information, or device identification information,

(ii) information indicative of a relationship between a position and access source identification information, as a directional graph having a path from one position to another position or access source identification information, and

(iii) information indicative of a relationship between a resource and access destination identification information, as a directional graph having a path from one resource to another resource or access destination identification information.

5. The access control system according to claim 2, wherein

said knowledge database includes:

a knowledge storage configured to store

(i) information indicative of a relationship between a group and user identification information or device identification information, as a directional graph having a path from one group to another group, user identification information, or device identification information,

(ii) information indicative of a relationship between a position and access source identification information, as a directional graph having a path from one position to another position or access source identification information, and

(iii) information indicative of a relationship between a resource and access destination identification information, as a directional graph having a path from one resource to another resource or access destination identification information; and

update group notification means configured to notify the policy engine of information of a group, position, or resource concerning an updated part of the directional graph, when a directional graph stored in the knowledge storage is updated,

said policy engine includes policy specification means configured to specify an access control policy including the information of a group, position, or resource notified by the update group notification means; and

said policy analyzer is configured to generate a rule constituting an intermediate language, based on the access control policy specified by the policy specification means.

6. The access control system according to claim 5, further comprising

a presence manager configured to

(i) maintain information on a current position of each user, and

(ii) notify the knowledge database of movement information including at least user identification information on the user who has moved and current position identification information capable of identifying a movement destination thereof, when a current position has changed in accordance with a movement of a user, wherein

said knowledge storage is configured to store information indicative of a relationship between the user identification information of each user and the current position identification information of each user, as a directional graph having a path from the user identification information to the current position identification information,

said knowledge database includes user position information update means configured to update the directional graph, based on movement information notified by the presence manager,

said update group notification means is configured to notify the policy engine of user identification information concerning an updated part, when the directional graph is updated by the user position information update means,

said policy specification means is configured to specify an access control policy, based on user identification information notified by the update group notification means, and

said policy analyzer is configured to generate a rule constituting an intermediate language, based on the access control policy specified by the policy specification means.

7. The access control system according to claim 5, further comprising:

a presence manager is configured to

(i) maintain information of a current position of each user or each device, and

(ii) notify the knowledge database of movement information including at least user identification information on the user who has moved or device identification information on the device which has moved and current position identification information capable of identifying a movement destination thereof, when a current position has changed in accordance with a movement on a user or device; and

a knowledge analyzer is configured to

(i) determine information which should be transferred to the policy specification means, of the information stored in the knowledge database, and

(ii) transfer the information determined to the policy specification means from the knowledge database, wherein said policy specification means includes a policy

storage configured to store an access control policy in which a condition to make the access control policy itself effective is described, said access control policy describing, as a companion, a user or device overlapping or different from a user or device corresponding to a group,

said knowledge storage is configured to store information indicative of a relationship between user identification information on each user or device identification information on each user and current position identification information on each user or each device, as a directional graph having a path from the user identification information or device identification information to the current position identification information,

said knowledge database includes position information update means configured to update the directional graph, based on movement information notified by the presence manager,

said update group notification means is configured to notify the policy engine of user identification information or device identification information concerning an updated part, when the directional graph is updated by the position information update means,

said policy specification means is configured to

(i) output information on a group of users or devices and a companion, which is described in each access control policy, to the knowledge analyzer,

(ii) input thereby each user identification information or each device identification information corresponding to the group of users or devices and the companion from the knowledge analyzer,

(iii) specify an access control policy, based on the inputted user identification information or device identification information and based on the user identification information or device identification information notified by the update group notification means,

(iv) output each user identification information or each device identification information corresponding to a group and companion written in the specified access control policy to the knowledge analyzer,

(v) input thereby current position identification information on each user or each device corresponding to said each user identification information or each device identification information, from the knowledge analyzer, and

(vi) determine an access control policy which is made effective based on the inputted information and based on a condition described in the access control policy, and said policy analyzer is configured to generate a rule constituting an intermediate language, based on the access control policy specified by the policy specification means.

8. The access control system according to claim 5, further comprising

a system configuration manager configured to

(i) maintain information concerning operating states of plural access control devices connected to a policy engine, and

(ii) notify the knowledge database of configuration information including identification information on the access control device and information on the operating state thereof after having changed, when an operating state of an access control device has changed, wherein

said knowledge storage is configured to store information indicative of a relationship between identification information on each access control device and an operating state thereof, as a directional graph having a path from the identification information on each access control device to the operating state thereof,

said knowledge database includes operating state update means configured to update the directional graph, based on the configuration information notified by the system configuration manager,

said update group notification means is configured to notify identification information on an access control device concerning an updated part, when the directional graph is updated by the operation state update means, to the policy enfine,

said policy specification means is configured to specify an access control policy, based on the identification information on the access control device notified by the update group notification means, and

said policy analyzer is configured to generate a rule constituting an intermediate language, based on the access control policy specified by the policy specification means.

9. The access control system according to claim 4, wherein said knowledge database includes a knowledge manager configured to make said knowledge storage search for a directional graph from a group, a position or a resource, to extract a set of user identification information items or device identification information items, a set of access source identification information items, or a set of access destination identification items.

10. The access control system according to claim 4, wherein said knowledge database includes a directional graph editor configured to provide an user interface for editing a directional graph stored in the knowledge storage.

11. The access control system according to claim 10, wherein said directional graph editor is configured to provide a user interface including

a selection column to select another group to which a path extends from one group,

an input column to input a user identification information item or device identification information item to which a path extends from the one group, and

an instruction column to instruct a user identification information item or device identification information item to delete, among user identification information items or device identification information items to which paths extend from the one group.

12. The access control system according to claim 10, wherein said directional graph editor is configured to provide a user interface including

a selection column to select another position to which a path extends from one position,

an input column to input an access source identification information item to which a path extends from the one position, and

an instruction column to instruct an access source identification information item to delete, among access source identification information items which paths extend from the one group.

13. The access control system according to claim 10, wherein said directional graph editor is configured to provide a user interface including

a selection column to select another resource to which a path extends from one resource,

an input column to input an access destination identification information item to which a path extends from the one resource, and

an instruction column to instruct an access destination identification information item to delete, among access destination identification information items to which paths extend from the one group.

14. The access control system according to claim 1, wherein said policy engine includes:

a policy analyzer configured to generate an intermediate language as a set of rules including no description depending on a specific access control device, by replacing at least the position and resource among contents written in the access control policy, with access source identification information and access destination identification information, respectively, by use of the information stored in the knowledge database; and

access control list setting means configured to

(i) convert the generated intermediate language into an access control list corresponding to a type of a access control device as a setting target in which the access control list is to be set, and

(ii) set the access control list in the access control device.

15. The access control system according to claim 14, wherein

said policy analyzer is configured to generate a rule constituting an intermediate language, based on the updated access control policy, and gives the rule an ID of the access control policy as a generation source, and

said access control list setting means is configured to

(i) generate a line as a constitutional element of the access control list, based on the rule,

(ii) give the line as a generation source an ID given to the rule, and if a part of a rule is newly generated by the policy analyzer, and

(iii) update the line given the same ID as that given to the generated rule.

16. The access control system according to claim 1, wherein said policy engine includes a policy editor is configured to provide a user interface for editing at least a group, position, and resource of information included in an access control policy.

17. The access control system according to claim 16, wherein said policy editor is configured to

(i) display a list of groups, a list of positions, and a list of sources, and

(ii) provide a user interface to accept selection of a group, position, and resource from the lists, respectively.

18. The access control system according to claim 7, wherein said policy engine includes a policy editor configured to provide a user interface for editing at least a group, position, resource, and companion of information included in an access control policy.

19. The access control system according to claim 18, wherein said policy editor is configured to provide a user interface configured to

(i) display a list of groups of users or devices that use a resource, a list of positions, a list of resources, and a list of groups of companions, and

(ii) accept selection of a group of users or devices, a position, a resource, and a group of companions from the lists, respectively.

20. An access control system comprising:

a knowledge database configured to store information indicative of

(i) a relationship between a group of users or devices that use at least a resource as an access destination, and user identification information or device identification information capable of identifying the user or device,

(ii) a relationship between a position as an access source of access to the resource, and access source identification information capable of identifying the position,

(iii) a relationship between the resource and access destination identification information capable of identifying the resource, and

(iv) a relationship between user identification information on each user or device identification information on each device and current position identification information on each user or each device;

a policy engine configured to

(i) store an access control policy describing at least the group, position, and resource of the information stored in the knowledge database, and describing, as a companion, a user or device overlapping or different from a user or device corresponding to a group,

(ii) generate an access control list indicating accessibility/inaccessibility to an access destination from an access source by use of an effective access control policy and the information stored in the knowledge database, and

(iii) set the access control list in an existing access control device; and

a presence manager configured to

(i) maintain information on a current position of each user or each device, and

(ii) notify the knowledge database of movement information including at least user identification information on the user who has moved or device identification on the device which has moved and current position identification information capable of identifying a movement destination thereof, when a current position has changed in accordance with a movement of a user or a device, wherein

said knowledge database is further configured to

(v) update information indicative of a relationship between user identification information on each user or device identification information on each device and the current position identification information on each user or each device, based on the movement information notified by the presence manager, and

(vi) notify the policy engine of user identification information or device identification information concerning an updated part, and

said policy engine includes policy specification means configured to

(i) output information on a group of users or devices and a companion, which is described in each access control policy,

(ii) input thereby each user identification information or each device identification information corresponding to the group of users or devices and the companion,

(iii) specify an access control policy, based on the user identification information or device identification information and based on the user identification information or device identification information notified by the knowledge database,

(iv) output each user identification information or each device identification information corresponding to a group and companion written in the specified access control policy,

(v) input thereby current position identification information on each user or each device corresponding to said each user identification information or each device identification information, and

(vi) determine an access control policy which is made effective based on the inputted information and based on a condition described in the access control policy.

21. The access control system according to claim 20, wherein said policy engine includes a policy editor configured to provide a user interface for editing at least a group, position, resource, and companion of information included in an access control policy.

22. An access control method comprising:

a step in which a knowledge database stores information indicative of

(i) a relationship between a group of users or devices that use at least a resource as an access destination, and user identification information or device identification information capable of identifying the user or device,

(iii) a relationship between a position as an access source of access to the resource, and access source identification information capable of identifying the position, or

(iii) a relationship between the resource and access destination identification information capable of identifying the resource; and

a step in which a policy engine

(i) stores an access control policy describing at least the group, position, and resource of the information stored in the knowledge database,

(ii) generates an access control list indicating accessibility/inaccessibility to an access destination from an access source by use of the access control policy and the information stored in the knowledge database, and

(iii) sets the access control list in an existing access control device.

23. An access control method comprising:

a step in which a knowledge database stores information indicative of

(i) a relationship between a group of users or devices that use at least a resource as an access destination, and user identification information or device identification information capable of identifying the user or device,

(ii) a relationship between a position as an access source for accessing the resource, and access source identification information capable of identifying the position,

(iii) a relationship between the resource and access destination identification information capable of identifying the resource, and

(iv) a relationship between user identification information on each user or device identification information on each device and current position identification information on each user or each device;

a step in which a policy engine stores an access control policy describing at least the group, position, and resource of the information stored in the knowledge database, and describing, as a companion, a user or device overlapping or different from a user or device corresponding to a group;

a step in which a presence manager

(i) maintains information on a current position of each user or each device, and

(ii) when a current position has changed in accordance with a movement of a user or a device, notifies the knowledge database of movement information including at least user identification information on the user who has moved or device identification information on the device which has moved and current position identification information capable of identifying a movement destination thereof;

a step in which said knowledge database

(i) updates information indicative of a relationship between user identification information on each user or device identification information on each device and the current position identification information on each user or each device, based on the movement information notified by the presence manager, and

(ii) notifies the policy engine of user identification information or device identification information concerning an updated part;

a step in which said policy engine

(i) outputs information on a group of users or devices and a companion, which is described in each access control policy,

(ii) inputs thereby each user identification information or each device identification information corresponding to the group of users or devices and the companion,

(iii) specifies an access control policy, based on the inputted user identification information or device identification information and based on the user identification information or device identification information notified by the knowledge database,

(iv) outputs each user identification information or each device identification information corresponding to a group and companion written in the specified access control policy,

(v) inputs the current position identification information on each user or each device corresponding to said each user identification information or each device identification information, and

(vi) determines an access control policy which is made effective based on the inputted information and based on a condition described in the access control policy; and

a step in which said policy engine

(i) generates an access control list indicative of accessibility/inaccessibility from an access source to an access destination, by use of the access control policy determined as being effective and the information stored in the knowledge database, and

(ii) sets the access control list in an existing access control device.

24. An access control program for making a computer execute a processing,

said computer comprising a policy storage connected to a knowledge database which stores information indicative of:

a relationship between a group of users or devices that use at least a resource as an access destination, and user identification information or device identification information capable of identifying the user or device;

a relationship between a position as an access source of access to the resource, and access source identification information capable of identifying the position;

or

a relationship between the resource and access destination identification information capable of identifying the resource, and the policy storage storing an access control policy describing at least the group, position, and resource of the information stored in the knowledge database,

wherein said processing includes;

a step of generating an access control list indicating accessibility/inaccessibility to an access destination from an access source by use of the access control policy and the information stored in the knowledge database; and

a step of setting the access control list in an existing access control device.

25. An access control program for making a computer execute a processing,

said computer comprising a policy storage connected to a knowledge database which stores information indicative of:

a relationship between a group of users or devices that use at least a resource as an access destination, and user identification information or device identification information capable of identifying the user or device;

a relationship between a position as an access source for accessing the resource, and access source identification information capable of identifying the position;

a relationship between the resource and access destination identification information capable of identifying the resource;

or

a relationship between user identification information on each user or device identification information on each device and current position identification information on each user or each device, and

said policy storage storing an access control policy describing at least the group, position, and resource of the information stored in the knowledge database, and describing, as a companion, a user or device overlapping or different from a user or device corresponding to a group,

wherein said processing includes;

(i) an update information input step of inputting user identification information or device identification information concerning an update part in the information indicative of the relationship between user identification information on each user or device identification information on each device and current position identification information on each user or each device;

(ii) an identification information input step of outputting information on a group of users or devices and a companion, which is described in each access control policy, thereby to input each user identification information or each device identification information corresponding to the group of users or devices and the companion;

(iii) a specify step of specifying an access control policy, based on the user identification information or device identification information inputted in the identification information input step, and based on the user identification information or device identification information inputted by the update information input step;

(iv) a current position identification information input step of outputting each user identification information or each device identification information corresponding to a group and companion written in the specified access control policy, thereby to input current position identification information on each user or each device corresponding to said each user identification information or each device identification information;

(v) an effective policy determination step of determining an access control policy which is made effective based on the inputted information and based on a condition described in every access control policy;

(vi) a list generation step of generating an access control list indicative of accessibility/inaccessibility from an access source to an access destination, by use of the access control policy determined as being effective and the information stored in the knowledge database; and

(vii) a step of setting the access control list in an existing access control device.