Access control policy compliance check process

An information processing device comprising:

• an integrated circuit;
• an access right management information obtaining unit to obtain access right management information from an access right management information storing unit for storing the access right management information that collectively or partially restricts an access to an arbitrary resource;
• a violation detecting unit to obtain a policy from a policy storing unit for storing the policy set for the resource or the access to the resource, to check whether the access right management information complies with the policy, and to detect access right management information that does not comply with the policy as a violation;
• a policy compliance level calculating unit to calculate a risk score for evaluating a degree of risk of the violations detected by the violation detection unit, the violations are detected when user information included in the access right management information corresponds to any of an unused user account, an account of an unidentifiable user, and an account that is to be deleted but remains, when a role assignment included in the access right management information corresponds to any of an unused role assignment, and a role assignment violating a rule that prohibits a role assignment, when a permission assignment included in the access right management information corresponds to any of an unused permission assignment, and a permission assignment violating a rule that prohibits a permission assignment, when a role included in the access right management information corresponds to any of an unused role, a role violating a rule that prohibits a role-to-user assignment, and a role violating a rule that prohibits a permission-to-role assignment, and when any one of a role assignment violating a rule that prohibits a role-to-user assignment, permission violating a rule that prohibits a permission-to-role assignment, and permission violating a rule that prohibits a permission-to-user assignment exists, and to calculate a compliance level which represents a degree in which the policy was complied with from the calculated risk score by calculating the sum of the degree of risk of the violations;
• and
• a result outputting unit to output a result of calculating the compliance level calculated by the policy compliance level calculating unit.