# US 12,001,692 B2 · Access control system and access control method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,001,692 B2 - Document ID: US12001692B2 - Status: Granted - Kind: B2 - Application number: 17/945,766 - Filed: 2022-09-15 - Published: 2023-08-17 - Granted: 2024-06-04 - Earliest claimed: 2022-02-15 - Assignees: Hitachi, Ltd. - Applicants: Hitachi, Ltd. - Inventors: Toshiyuki Aritsuka; Takahiro Yamamoto; Tatsuya Hirai; Hideo Saito - Web page: https://patentgrep.com/patent/US12001692B2 ## CPC - G06F 3/0622: {in relation to access} - G06F 3/0637: {Permissions} - G06F 3/0655: {Vertical data movement, i.e. input-output transfer; data movement between one or more hosts and one or more storage devices} - G06F 3/0671: {In-line storage system} - G06F 3/0673: {Single storage device} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An access control system stores information defining conditions under which each user is allowed to perform resource access. The access control system acquires a first access request indicating an operation for a first resource in a target system by a first user, determines based on the information whether or not the first access request is permitted, acquires a result of an additional permission/disapproval determination of the first access request in response to the disapproval determination of the first access request, and grants execution authority of the first access request by the first user according to the result of the additional permission/disapproval determination indicating permission. ## Claims ### Claim 1 An access control system which controls user access to a resource, comprising: at least one processor; and at least one storage device which stores information defining conditions under which each user is allowed to perform resource access, wherein the at least one processor acquires a first access request indicating an operation for a first resource in a target system by a first user, determines based on the information whether or not the first access request is permitted, acquires a result of an additional permission/disapproval determination of the first access request in response to the disapproval determination of the first access request, and grants execution authority of the first access request by the first user according to the result of the additional permission/disapproval determination indicating permission. ### Claim 2 (depends on 1) The access control system according to claim 1, wherein the at least one processor presents to an administrator a request for the additional permission/disapproval determination of the first access request in response to the disapproval determination of the first access request, and receives the result of the additional permission/disapproval determination from the administrator. ### Claim 3 (depends on 2) The access control system according to claim 2, wherein the at least one processor presents the administrator with information on at least one of a state of the target system and a state of the first user, together with the request for the additional permission/disapproval determination. ### Claim 4 (depends on 2) The access control system according to claim 2, wherein the at least one storage device stores auxiliary information, wherein the auxiliary information includes: at least one information of a state of the target system and a state of one or more users including the first user; and information of a criterion for the additional permission/disapproval determination, and wherein at least one processor presents the administrator with at least one information which meets the criterion for the additional permission/disapproval determination. ### Claim 5 (depends on 1) The access control system according to claim 1, wherein the at least one storage device stores auxiliary information, wherein the auxiliary information includes: at least one information of a state of the target system and a state of one or more users including the first user; and information of a criterion for the additional permission/disapproval determination, and wherein the at least one processor executes the additional permission/disapproval determination of the first access request, based on the auxiliary information. ### Claim 6 (depends on 2) The access control system according to claim 2, wherein the at least one storage device stores resource access management information which defines one or more resource access groups, and wherein the at least one processor acquires information on incidental resource access included in the same resource access group as the first access request from the resource access management information, presents the information on the incidental resource access to the administrator, and acquires a determination result of permission/disapproval of the incidental resource access from the administrator. ### Claim 7 (depends on 4) The access control system according to claim 4, wherein the at least one storage device stores resource access management information which defines one or more resource access groups, and wherein the at least one processor acquires information on incidental resource access included in the same resource access group as the first access request from the resource access management information, and executes the permission/disapproval determination of the incidental resource access, based on the auxiliary information. ### Claim 8 An access control method which controls user access to a resource, comprising the steps of: causing a system to acquire a first access request indicating an operation for a first resource in a target system by a first user, causing the system to determine whether or not the first access request is permitted on the basis of information defining conditions under which each user is allowed to perform resource access, causing the system to acquire a result of an additional permission/disapproval determination of the first access request in response to the disapproval determination of the first access request, and causing the system to grant execution authority of the first access request by the first user according to the result of the additional permission/disapproval determination indicating permission. ### Claim 9 (depends on 8) The access control method according to claim 8, wherein the system presents to the administrator a request for the additional permission/disapproval determination of the first access request in response to the disapproval determination of the first access request, and wherein the system receives the result of the additional permission/disapproval determination from the administrator. ### Claim 10 (depends on 9) The access control method according to claim 9, wherein the system presents information on at least one of a state of the target system and a state of the first user to the administrator together with the request for the additional permission/disapproval determination. ### Claim 11 (depends on 9) The access control method according to claim 9, wherein the system refers to the auxiliary information, and the auxiliary information includes: information on at least one of the state of the target system and the state of one or more users including the first user; and information on the criterion for the additional permission/disapproval determination, and wherein the system presents to the administrator the at least one information which satisfies the criterion for the additional permission/disapproval determination. ### Claim 12 (depends on 8) The access control method according to claim 8, wherein the system refers to auxiliary information, and the auxiliary information includes: information on at least one of the state of the target system and the state of one or more users including the first user; and information on the criterion for the additional permission/disapproval determination, and wherein the system executes an additional permission/disapproval determination of the first access request, based on the auxiliary information. ### Claim 13 (depends on 9) The access control method according to claim 9, wherein the system acquires information on incidental resource access included in the same resource access group as the first access request from the resource access management information which defines one or more resource access groups, wherein the system presents information on the incidental resource access to the administrator, and wherein the system acquires the determination result of permission/disapproval of the incidental resource access from the administrator. ### Claim 14 (depends on 11) The access control method according to claim 11, wherein the system acquires information on incidental resource access included in the same resource access group as the first access request from the resource access management information which defines one or more resource access groups, and wherein the system executes the permission/disapproval determination of the incidental resource access based on the auxiliary information.