Client apparatus, server apparatus and authority control method

A server apparatus for providing data or a function to a client apparatus, comprising:

• an abnormality information reception unit configured to receive abnormality information from the client apparatus, the abnormality information including an abnormal state detected in the client apparatus and a location where the abnormal state occurs;
• an abnormality information interpretation unit configured to determine a risk of the abnormal state in accordance with a first table associating abnormal states, locations where the abnormal states occur and risks;
• a policy management unit configured to determine a permitted operation in accordance with a second table associating risks, server resources and permitted operations;
• an authority setting unit configured to set an authority of the client apparatus according to the permitted operations determined by the policy management unit;
• and
• an authority control unit configured to control the authority of the client apparatus according to the set authority.

An authority control method for controlling an authority of a client apparatus in a system including the client apparatus and a server apparatus for providing data or a function to the client apparatus, comprising:

• monitoring target software;
• creating abnormality information from an abnormal state or unauthorized state of the target software, which is detected by the step of monitoring target software, the abnormality information including an abnormal state;
• issuing the abnormality information to the server apparatus that is being accessed by the client apparatus;
• determining, in the server apparatus, a risk of the abnormal state in accordance with a first table associating abnormal states, locations where the abnormal states occur and risks;
• determine, in the server apparatus, a permitted operation in accordance with a second table associating risks, server resources and permitted operations;
• setting, in the server apparatus, an authority of the client apparatus according to the determined permitted operations;
• and
• controlling the access of the client apparatus according to the authority set.