Access control information generating system

An access control information generation method comprising:

• generating access control information representing permission for a user identified by user identification information stored in a storage device in association with role identification information included in policy information stored in the storage device to perform access of a type represented by action information included in the policy information, the storage device storing policy information in which role identification information for identifying a role assigned to a user, resource group identification information for identifying a resource group including at least one access target resource that is owned by an access target device and is a resource to be a target of access, and action information representing a type of access to the access target resource are associated with each other, and the storage device also storing user identification information for identifying a user and role identification information for identifying a role assigned to the user in association with each other;
• and transmitting the generated access control information to the access target device having the access target resource included in the resource group identified by the resource group identification information included in the policy information;
• receiving an access request including user identification information for identifying a user of a client device from the client device;
• acquiring address information representing an address for specifying a transmission source of the received access request in a communication network;
• and
• generating communication filter information representing permission for at least one of communication that the address represented by the acquired address information is a transmission source and communication that the address is a transmission destination, and transmitting the generated communication filter information to a communication filter device relaying communication between the client device and the access target device having an access target resource included in a resource group identified by resource group identification information included in policy information including role identification information stored in the storage device in association with the user identification information included in the received access request, among the policy information stored in the storage device.

An access control information generation device comprising:

• a policy information storing unit for storing policy information in which role identification information for identifying a role assigned to a user, resource group identification information for identifying a resource group including at least one access target resource that is owned by an access target device and is a resource to be a target of access, and action information representing a type of access to the access target resource are associated with each other;
• a user information receiving unit for receiving user identification information for identifying a user of a client device and address information representing an address for specifying the client device in a communication network;
• an access control information transmitting unit for generating access control information representing permission for a user identified by user identification information associated with the role identification information included in the stored policy information to perform access of the type represented by the action information included in the policy information, and transmitting the generated access control information to the access target device having the access target resource included in the resource group identified by the resource group identification information included in the policy information;
• and
• a communication filter information transmitting unit for generating communication filter information representing permission for at least one of communication that the address represented by the received address information is a transmission source and communication that the address is a transmission destination, and transmitting the generated communication filter information to a communication filter device relaying communication between the client device and the access target device having an access target resource included in a resource group identified by resource group identification information included in policy information including role identification information associated with the received user identification information, among the stored policy information.

An access control information generation method comprising:

• generating access control information representing permission for a user identified by user identification information associated with role identification information included in policy information stored in a storage device to perform access of a type represented by action information included in the policy information, the storage device storing policy information in which role identification information for identifying a role assigned to a user, resource group identification information for identifying a resource group including at least one access target resource that is owned by an access target device and is a resource to be a target of access, and action information representing a type of access to the access target resource are associated with each other;
• and transmitting the generated access control information to the access target device having the access target resource included in the resource group identified by the resource group identification information included in the policy information;
• receiving user identification information for identifying a user of a client device and address information representing an address for specifying the client device in a communication network;
• and
• generating communication filter information representing permission for at least one of communication that the address represented by the received address information is a transmission source and communication that the address is a transmission destination, and transmitting the generated communication filter information to a communication filter device relaying communication between the client device and the access target device having an access target resource included in a resource group identified by resource group identification information included in policy information including role identification information associated with the received user identification information, among the policy information stored in the storage device.

A non-transitory computer-readable recording medium storing a program comprising instructions for causing an information processing device to realize:

• an access control information transmitting unit for generating access control information representing permission for a user identified by user identification information associated with role identification information included in policy information stored in a storage device to perform access of a type represented by action information included in the policy information, the storage device storing policy information in which role identification information for identifying a role assigned to a user, resource group identification information for identifying a resource group including at least one access target resource that is owned by an access target device and is a resource to be a target of access, and action information representing a type of access to the access target resource are associated with each other;
• and transmitting the generated access control information to the access target device having the access target resource included in the resource group identified by the resource group identification information included in the policy information;
• a user information receiving unit for receiving user identification information for identifying a user of a client device and address information representing an address for specifying the client device in a communication network;
• and
• a communication filter information transmitting unit for generating communication filter information representing permission for at least one of communication that the address represented by the received address information is a transmission source and communication that the address is a transmission destination, and transmitting the generated communication filter information to a communication filter device relaying communication between the client device and the access target device having an access target resource included in a resource group identified by resource group identification information included in policy information including role identification information associated with the received user identification information, among the policy information stored in the storage device.