Access authority generation device

An access authority generation device, comprising:

• a memory having:
• a policy storing region for storing a set of authorities having a precedence constraint, in association with a role, wherein a combination of an object, an action and a permission/denial identifier representing whether to permit or deny the action on the object is defined as an authority;
• a subject assignment storing region for storing information about a relation between a role and a subject belonging to the role;
• an object hierarchy storing region for storing information about an inclusion relation between objects;
• and a temporary storing region;
• and
• a processor connected to the memory,
• wherein the processor is programmed to:
• extract a set of authorities having a precedence constraint from the policy storing region, as a process target set, in association with a role;
• when generating a set of authorities without a precedence constraint into the temporary storing region from the process target set extracted for a role, in association with the role:
• firstly derive an authority in accordance with an order satisfying the precedence constraint from the process target set associated with the role, and determine the derived authority, as a process target authority;
• next, in a case that an object of the process target authority includes an object of an authority having a same action that has already been generated in the temporary storing region and permission/denial identifiers of both the authorities are different from each other, divide the process target authority into a plurality of authorities having objects of same granularity as that of the included object;
• and next store an authority having a different object from the included object among the plurality of authorities obtained by the division, into the temporary storing region;
• and
• generate a set of access authorities associated with the subject from the set of authorities without the precedence constraint generated for the role and the information about the relation between the role and the subject, wherein a combination of a subject, an object, an action and a permission/denial identifier representing whether to permit or deny the subject the action on the object is defined as an access authority.

An access authority generation method executed by an access authority generation device having:

• a memory having:
• a policy storing region for storing a set of authorities having a precedence constraint, in association with a role, wherein a combination of an object, an action and a permission/denial identifier representing whether to permit or deny the action on the object is defined as an authority;
• a subject assignment storing region for storing information about a relation between a role and a subject belonging to the role;
• an object hierarchy storing region for storing information about an inclusion relation between objects;
• and a temporary storing region;
• and
• a processor connected to the memory,
• the access authority generation method, comprising:
• extracting a set of authorities having a precedence constraint from the policy storing region, as a process target set, in association with a role, by the processor;
• when generating a set of authorities without a precedence constraint into the temporary storing region from the process target set extracted for a role, in association with the role:
• firstly deriving an authority in accordance with an order satisfying the precedence constraint from the process target set associated with the role, and determining the derived authority, as a process target authority;
• next, in a case that an object of the process target authority includes an object of an authority having a same action that has already been generated in the temporary storing region and permission/denial identifiers of both the authorities are different from each other, dividing the process target authority into a plurality of authorities having objects of same granularity as that of the included object;
• and next storing an authority having a different object from the included object among the plurality of authorities obtained by the division, into the temporary storing region, by the processor;
• and
• generating a set of access authorities associated with the subject from the set of authorities without the precedence constraint generated for the role and the information about the relation between the role and the subject, wherein a combination of a subject, an object, an action and a permission/denial identifier representing whether to permit or deny the subject the action on the object is defined as an access authority, by the processor.

A non-transitory computer readable medium storing a program for causing a computer having:

• a policy storing unit for storing a set of authorities having a precedence constraint, in association with a role, wherein a combination of an object, an action and a permission/denial identifier representing whether to permit or deny the action on the object is defined as an authority;
• a subject assignment storing unit for storing information about a relation between a role and a subject belonging to the role;
• an object hierarchy storing unit for storing information about an inclusion relation between objects;
• and a temporary storing unit, to function as:
• a process target set extracting unit for extracting a set of authorities having a precedence constraint from the policy storing unit, as a process target set, in association with a role;
• a precedence constraint solving unit for generating a set of authorities without a precedence constraint into the temporary storing unit from the process target set extracted for a role, in association with the role, the precedence constraint solving unit being configured to:
• derive an authority in accordance with an order satisfying the precedence constraint from the process target set associated with the role, and determine the derived authority, as a process target authority;
• in a case that an object of the process target authority includes an object of an authority having a same action that has already been generated in the temporary storing unit and permission/denial identifiers of both the authorities are different from each other, divide the process target authority into a plurality of authorities having objects of same granularity as that of the included object;
• and
• store an authority having a different object from the included object among the plurality of authorities obtained by the division, into the temporary storing unit;
• and
• an access authority generating unit for generating a set of access authorities associated with the subject from the set of authorities without the precedence constraint generated for the role and the information about the relation between the role and the subject, wherein a combination of a subject, an object, an action and a permission/denial identifier representing whether to permit or deny the subject the action on the object is defined as an access authority.