Access control decision system, access control enforcing system, and security policy

An access control enforcing method, comprising the steps of:

• storing a security policy that regulates an access permit to subject information, a requirement enforced when access is allowed, and supplement information indicating character information or image information used by an access request originator to perform the requirement when the requirement is enforced;
• acquiring a first attribute associated with a first identification information for identifying the access request originator who requests the access to the subject information, and a second attribute associated with a second identification information for identifying the subject information to be accessed, the second attribute corresponding to a category of the subject information;
• determining a requirement to execute an access indicated in access control information, when an access control is determined for the subject information based on access control information that indicates a control of the access to the subject information, the access control information determined based on information regulated in the security policy, and a combination of the first attribute associated with the first identification information and the second attribute associated with the second identification information;
• and
• sending a decision result information indicating the access control with respect to the subject information, to the access request originator which conducts an access decision request, the access request originator being required to perform the requirement including an image process using the supplemental information, based on the decision result information.

A non-transitory computer-readable storage medium including computer executable instructions, wherein the instructions, when executed by a computer, cause the computer to perform an access control enforcing method, the method comprising:

• storing a security policy that regulates an access permit to subject information, a requirement enforced when access is allowed, and supplement information indicating character information or image information used by an access request originator to perform the requirement when the requirement is enforced;
• acquiring a first attribute associated with a first identification information for identifying the access request originator who requests the access to the subject information, and a second attribute associated with a second identification information for identifying the subject information to be accessed, the second attribute corresponding to a category of the subject information;
• determining a requirement to execute an access indicated in access control information, when an access control is determined for the subject information based on access control information that indicates a control of the access to the subject information, the access control information determined based on information regulated in the security policy, and a combination of the first attribute associated with the first identification information and the second attribute associated with the second identification information;
• and
• sending a decision result information indicating the access control with respect to the subject information, to the access request originator which conducts an access decision request, the access request originator being required to perform the requirement including an image process using the supplemental information, based on the decision result information.