# US 2013/0160076 A1 · Access authority generation device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0160076 A1 - Document ID: US20130160076A1 - Status: Published application - Kind: A1 - Application number: 13/819,060 - Filed: 2011-06-10 - Published: 2013-06-20 - Earliest claimed: 2010-09-22 - Assignees: NEC Corporation - Inventors: Yoichiro Morita - Web page: https://patentgrep.com/patent/US20130160076A1 ## CPC - G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - G06F 21/604: {Tools and structures for managing or administering access control systems} - H04L 63/105: {Multiple levels of security} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F 2221/2145: Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A precedence constraint solving means generates a set of authorities without a precedence constraint into a temporary storing means from a set of authorities having a precedence constraint extracted for a role. At this moment, the precedence constraint solving means derives an authority in accordance with an order satisfying the precedence constraint from the set of authorities having the precedence constraint and, when an object of the derived authority includes an object of an authority having the same action already generated in the temporary storing means and permission/denial identifiers of both the authorities are different from each other, divides the derived authority into a plurality of authorities having objects of the same granularity as that of the included object, and stores only an authority having a different object from the included object into the temporary storing means. ## Claims ### Claim at position 1 -9. (canceled) ### Claim 10 An access authority generation device, comprising: a memory having: a policy storing region for storing a set of authorities having a precedence constraint, in association with a role, wherein a combination of an object, an action and a permission/denial identifier representing whether to permit or deny the action on the object is defined as an authority; a subject assignment storing region for storing information about a relation between a role and a subject belonging to the role; an object hierarchy storing region for storing information about an inclusion relation between objects; and a temporary storing region; and a processor connected to the memory, wherein the processor is programmed to: extract a set of authorities having a precedence constraint from the policy storing region, as a process target set, in association with a role; when generating a set of authorities without a precedence constraint into the temporary storing region from the process target set extracted for a role, in association with the role: firstly derive an authority in accordance with an order satisfying the precedence constraint from the process target set associated with the role, and determine the derived authority, as a process target authority; next, in a case that an object of the process target authority includes an object of an authority having a same action that has already been generated in the temporary storing region and permission/denial identifiers of both the authorities are different from each other, divide the process target authority into a plurality of authorities having objects of same granularity as that of the included object; and next store an authority having a different object from the included object among the plurality of authorities obtained by the division, into the temporary storing region; and generate a set of access authorities associated with the subject from the set of authorities without the precedence constraint generated for the role and the information about the relation between the role and the subject, wherein a combination of a subject, an object, an action and a permission/denial identifier representing whether to permit or deny the subject the action on the object is defined as an access authority. ### Claim 11 (depends on 10) The access authority generation device according to claim 10, wherein: the memory further has a role hierarchy storing region for storing information about an inheritance relation between roles; and the processor is programmed to, in the extraction of the process target set, extract and couple the set of authorities having the precedence constraint stored in the policy storing region in association with the role and a set of authorities having a precedence constraint stored in the policy storing region in association with an inheritance source role of the role represented by the inheritance relation between the roles, thereby generating a process target set that is a set of authorities having a precedence constraint. ### Claim 12 (depends on 10) The access authority generation device according to claim 10, wherein the processor is programmed to, in the generation of the set of authorities without the precedence constraint into the temporary storing region, discard the process target authority having an object included in an object of an authority having a same action stored in the temporary storing region. ### Claim 13 (depends on 10) The access authority generation device according to claim 10, wherein: the memory further has an action hierarchy storing region for storing information about a relation between the object and an action; and the processor is programmed to, in the generation of the set of authorities without the precedence constraint into the temporary storing region, in a case that an action of the process target authority is not associated with granularity of the object of the process target authority, divide the process target authority into a plurality of process target authorities having objects of smaller granularity associated with the action and then process. ### Claim 14 (depends on 10) The access authority generation device according to claim 10, wherein the processor is programmed to, in the generation of the set of authorities without the precedence constraint into the temporary storing region, in a case that the object of the process target authority includes the object of the authority having the same action stored in the temporary storing region and the permission/denial identifiers of both the authorities are identical to each other, store the process target authority into the temporary storing region and delete the authority having the same action and the same permission/denial identifier stored in the temporary storing region. ### Claim 15 (depends on 10) The access authority generation device according to claim 10, wherein the processor is programmed to, in the generation of the set of access authorities associated with the subject, integrate a plurality of access authorities having same subjects, objects and permission/denial identifiers and having different actions, into one access authority. ### Claim 16 (depends on 10) The access authority generation device according to claim 10, wherein the processor is programmed to further execute access control based on the generated access authority. ### Claim 17 An access authority generation method executed by an access authority generation device having: a memory having: a policy storing region for storing a set of authorities having a precedence constraint, in association with a role, wherein a combination of an object, an action and a permission/denial identifier representing whether to permit or deny the action on the object is defined as an authority; a subject assignment storing region for storing information about a relation between a role and a subject belonging to the role; an object hierarchy storing region for storing information about an inclusion relation between objects; and a temporary storing region; and a processor connected to the memory, the access authority generation method, comprising: extracting a set of authorities having a precedence constraint from the policy storing region, as a process target set, in association with a role, by the processor; when generating a set of authorities without a precedence constraint into the temporary storing region from the process target set extracted for a role, in association with the role: firstly deriving an authority in accordance with an order satisfying the precedence constraint from the process target set associated with the role, and determining the derived authority, as a process target authority; next, in a case that an object of the process target authority includes an object of an authority having a same action that has already been generated in the temporary storing region and permission/denial identifiers of both the authorities are different from each other, dividing the process target authority into a plurality of authorities having objects of same granularity as that of the included object; and next storing an authority having a different object from the included object among the plurality of authorities obtained by the division, into the temporary storing region, by the processor; and generating a set of access authorities associated with the subject from the set of authorities without the precedence constraint generated for the role and the information about the relation between the role and the subject, wherein a combination of a subject, an object, an action and a permission/denial identifier representing whether to permit or deny the subject the action on the object is defined as an access authority, by the processor. ### Claim 18 (depends on 17) The access authority generation method according to claim 17, wherein the memory further has a role hierarchy storing region for storing information about an inheritance relation between roles, the access authority generation method comprising: in the extraction of the process target set, extracting and coupling the set of authorities having the precedence constraint stored in the policy storing region in association with the role and a set of authorities having a precedence constraint stored in the policy storing region in association with an inheritance source role of the role represented by the inheritance relation between the roles, thereby generating a process target set that is a set of authorities having a precedence constraint, by the processor. ### Claim 19 (depends on 17) The access authority generation method according to claim 17, comprising: in the generation of the set of authorities without the precedence constraint into the temporary storing region, discarding the process target authority having an object included in an object of an authority having a same action stored in the temporary storing region, by the processor. ### Claim 20 (depends on 17) The access authority generation method according to claim 17, wherein the memory further has an action hierarchy storing region for storing information about a relation between the object and an action, the access authority generation method comprising: in the generation of the set of authorities without the precedence constraint into the temporary storing region, in a case that an action of the process target authority is not associated with granularity of the object of the process target authority, dividing the process target authority into a plurality of process target authorities having objects of smaller granularity associated with the action and then processing, by the processor. ### Claim 21 (depends on 17) The access authority generation method according to claim 17, comprising: in the generation of the set of authorities without the precedence constraint into the temporary storing region, in a case that the object of the process target authority includes the object of the authority having the same action stored in the temporary storing region and the permission/denial identifiers of both the authorities are identical to each other, storing the process target authority into the temporary storing region and deleting the authority having the same action and the same permission/denial identifier stored in the temporary storing region, by the processor. ### Claim 22 (depends on 17) The access authority generation method according to claim 17, comprising: in the generation of the set of access authorities associated with the subject, integrating a plurality of access authorities having same subjects, objects and permission/denial identifiers and having different actions, into one access authority, by the processor. ### Claim 23 (depends on 17) The access authority generation method according to claim 17, further comprising executing access control based on the generated access authority by the processor. ### Claim 24 A non-transitory computer readable medium storing a program for causing a computer having: a policy storing unit for storing a set of authorities having a precedence constraint, in association with a role, wherein a combination of an object, an action and a permission/denial identifier representing whether to permit or deny the action on the object is defined as an authority; a subject assignment storing unit for storing information about a relation between a role and a subject belonging to the role; an object hierarchy storing unit for storing information about an inclusion relation between objects; and a temporary storing unit, to function as: a process target set extracting unit for extracting a set of authorities having a precedence constraint from the policy storing unit, as a process target set, in association with a role; a precedence constraint solving unit for generating a set of authorities without a precedence constraint into the temporary storing unit from the process target set extracted for a role, in association with the role, the precedence constraint solving unit being configured to: derive an authority in accordance with an order satisfying the precedence constraint from the process target set associated with the role, and determine the derived authority, as a process target authority; in a case that an object of the process target authority includes an object of an authority having a same action that has already been generated in the temporary storing unit and permission/denial identifiers of both the authorities are different from each other, divide the process target authority into a plurality of authorities having objects of same granularity as that of the included object; and store an authority having a different object from the included object among the plurality of authorities obtained by the division, into the temporary storing unit; and an access authority generating unit for generating a set of access authorities associated with the subject from the set of authorities without the precedence constraint generated for the role and the information about the relation between the role and the subject, wherein a combination of a subject, an object, an action and a permission/denial identifier representing whether to permit or deny the subject the action on the object is defined as an access authority.