Authorization apparatus, data server and communication system

A data server comprising:

• a memory configured to store a plurality of data records, each of the plurality of data records including data in association with resource identification information of the data;
• and
• a processor circuit coupled to the memory, the processor being configured to perform processing, the processing including:
• receiving a first request from a terminal, the first request including user identification information and extraction condition information, the user identification including an identifier of a user of the terminal, the extraction condition information including an extraction condition that is a condition to be used for extracting, from among the plurality of data records, a data record to be obtained by the terminal;
• in response to the receiving of the first request, transmitting a signal including the user identification information and the extraction condition information to an authorization apparatus, the transmitting of the signal causing the authorization apparatus to store request information including the user identification information and the extraction condition information, thereby a memory of the authentication apparatus stores, for each data record of the plurality of data records stored in the data server, attribute information and to store the request information, the attribute information for the each data record including resource identification information and a plurality of pieces of information indicating a plurality of attributes of the each data record, the plurality of attributes including an owner identification information and one or more attributes of an owner of the each data record, the owner identification information including an identifier of the owner of the each data record, the owner of the each data record being a person different from the user of the terminal;
• receiving a second request from the terminal, the second request including an access token that has been generated by the authorization apparatus;
• in response to the receiving of the second request, transmitting a verification request including the access token to the authorization apparatus, the transmitting of the verification request causing the authorization apparatus to perform
• obtaining, from the memory, the request information corresponding to the access token included in the verification request,
• obtaining, from the obtained request information, the extraction condition information that corresponds to the access token,
• extracting, from among a plurality of pieces of attribute information stored for the plurality of data records, one or more pieces of resource identification information, the extracting of the one or more pieces of resource identification information including comparing, for each data record of the plurality of data records, the one or more attributes of the owner of the each data record and the extraction condition included in the obtained extraction condition information, extracting the one or more pieces of attribute information each of which includes the one or more attributes that satisfy the extraction condition included in the obtained extraction condition information, and obtaining, from each of the extracted one or more pieces of attribute information, the resource identification information, and
• transmitting a response to the data server, the response including a list of the extracted one or more pieces of resource identification information, each of the one or more pieces of resource identification information indicating to the data server from among the plurality of data records a data record to be allowed to be provided to the terminal;
• and
• transmitting, in response to receiving the response from the authentication apparatus, data associated with the one or more pieces of resource identification information included in the list to the terminal.

A communication system comprising:

• a data server configured to store a plurality of data records, each of the plurality of data records including data in association with resource identification information of the data;
• a terminal configured to request to the data server;
• and
• an authorization apparatus of controlling whether to authorize an access to the data server from the terminal, the authorization apparatus including:
• a memory configured to store, for each data record of a plurality of data records stored in the data server, attribute information and to store request information, the attribute information for the each data record including the resource identification information and a plurality of pieces of information indicating a plurality of attributes of the each data record, the plurality of attributes including an owner identification information and one or more attributes of an owner of the each data record, the owner identification information including an identifier of the owner of the each data record, the request information including a user identification information and an extraction condition information, the user identification including an identifier of a user of the terminal, the extraction condition information including an extraction condition that is a condition to be used for extracting, from among the plurality of data records, the data record to be obtained by the terminal, the owner of the each data record being a person different from the user of the terminal;
• and
• a processor circuit coupled to the memory, the processor circuit being configured to perform processing, the processing including:
• receiving a first request from the terminal, the first request including the user identification information;
• in response to the receiving of the first request,
• generating, for the terminal to be authorized to access the data server, an access token, to store the generated access token in association with the extraction condition information by adding the generated access token to the request information that includes the user identification included in the first request, and
• transmitting a first response to the terminal, the first response including the generated access token;
• receiving, from the data server, a second request including a target access token associated with an access request from the terminal to the data server;
• and
• in response to the receiving of the second request,
• obtaining, from the memory, the request information that includes the generated access token matching the target access token included in the second request,
• obtaining, from the obtained request information, the extraction condition information that corresponds to the access token that matches the target access token,
• extracting, from among a plurality of pieces of attribute information stored for the plurality of data records, one or more pieces of resource identification information, the extracting of the one or more pieces of resource identification information including comparing, for each data record of the plurality of data records, the one or more attributes of the owner of the each data record and the extraction condition included in the obtained extraction condition information, extracting the one or more pieces of attribute information each of which includes the one or more attributes that satisfy the extraction condition included in the obtained extraction condition information, and obtaining, from each of the extracted one or more pieces of attribute information, the resource identification information, and
• transmitting a second response to the data server, the second response including a list of the extracted one or more pieces of resource identification information, each of the one or more pieces of resource identification information indicating to the data server from among the plurality of data records a data record to be allowed to be provided to the terminal.