Setting apparatus, setting method, program, and recording medium

A computer processor-based setting apparatus for setting any of authorization for and prohibition of access to data with a hierarchical structure, wherein

• a plurality of objects comprising the hierarchical structure constitute a tree structure, and a root node of the tree structure represents the object at a highest level in hierarchy, and a leaf node of the tree structure represent the object at a lowest level in hierarchy;
• the setting apparatus comprises:
• an abstract structure generation unit recorded on a computer-storage medium for bringing a plurality of objects whose relative position regarding the root node as a starting point is the same, and whose type is the same together, and for generating an abstract structure generated as one abstract object;
• an object selection unit recorded on a computer-storage medium for selecting at least one object from a plurality of objects constituting the hierarchical structure;
• a pattern selection unit recorded on a computer-storage medium for selecting at least one pattern from a plurality of patterns, each of which determines a relative position in the hierarchical structure to the object selected by the object selection unit, and including and selecting a sub-pattern not processed by the setting apparatus in the plurality of patterns;
• an access control policy setting unit recorded on a computer-storage medium for setting an access control condition, which are any of authorization for and prohibition of access to the object selected by the object selection unit, and each of objects at the relative position to the selected object, the relative position being determined by the pattern selected by the pattern selection unit;
• in the case where other access control condition has already been set for a setting target object for which an access control condition is to be set, the access control policy setting unit sets a combined condition obtained by combing the newly-set relevant access control condition and the already-set other access control condition;
• overwriting the access control condition for a descendant object with access control conditions of ancestor objects to combine conditions;
• in the case where other access control condition has been already set for the setting target object, the access control policy setting unit causes an administrator to select any one of a conjunction condition which satisfies both the newly-set relevant access control condition and the already-set other access control condition and a disjunction condition which satisfies any one of the relevant access control condition and the other access control condition, and sets the selected conjunction condition or disjunction condition as the combined condition;
• wherein the access control condition is a condition to be satisfied by a judgment target object located at a lower level in hierarchy than that of the object selected by the object selection unit, and
• in the case where other access control condition has already been set for the setting target object, the access control policy setting unit provides, as an option capable of being selected by the administrator, a condition obtained by adding to the conjunction condition that there is the same object on a route from the judgment target object as an origin to the object selected by the object selection unit in both the relevant access control condition and the other access control condition.