US 8,621,557 B2Granted

Information processing system judging whether manipulation is possible or not based on access control policy and method of operation thereof

AssigneeNEC Corporation

InventorAtsushi Honda

Life of this patent

Estimating the term…

Loading patent…

Abstract

An information processing system includes a first information processing device and a second information processing device. The first information processing device stores a first object group and an additional access control policies. The second information processing device stores access control policies applied to each of second objects. The additional access control policies indicate a changed object group for the each first object. The changed object group is a group of second objects whose access control policy is same as that of the first object. When the second information device obtains an operation request for the first object, the second information device accesses the additional access control policy and determines the changed object group. The second information system judges whether or not the operation request is feasible for the changed object group based on the access control policy, and determines whether or not the target first object is processed.

Claims21

Dependent claims

An information processing system, comprising:

a first information processing device configured to store a first object group;
and
a second information processing device configured to receive a manipulation request indicating a content of manipulation for a manipulation target object from a subject to operate said manipulation target object based on said manipulation request,
wherein said second information processing device comprises:
an access control policy storing section configured to access an access control policy that indicates a relationship between each second object included in a second object group and a control rule indicating permitted manipulation content for said each second object;
and
a data processing section configured to judge whether or not said manipulation request is feasible,
wherein said first information processing device comprises:
an additional control policy storing section configured to indicate a changed object group with respect to each of first objects included in said first object group, wherein said changed object group is a group of said second objects to which same control rule as said each first object is applied, and
wherein said data processing section comprises:
a changed object group determination section configured to refer to said additional access control policy storing section when said manipulation target object is included in said first object group, and obtain said changed object group corresponding to said manipulation target object;
and
an access control rejudging section configured to reference to said access control policy to judge whether or not said manipulation request is feasible for said each second object included in said changed object group and determine whether or not said manipulation request is feasible for said manipulation target object based on a judgment result,
wherein said data processing device further comprises an access control section configured to refer to said access control policy to judge whether or not said manipulation target object is included in said second object group, and
wherein said changed object group determination section obtains said changed object group when said manipulation target object is not included in said second object group.

12 more elements

A data saving device comprising a first information device used in an information processing device wherein said information processing device comprises:

the first information processing device configured to store a first object group;
and
a second information processing device configured to receive a manipulation request indicating a content of manipulation for a manipulation target object from a subject to operate said manipulation target object based on said manipulation request,
wherein said second information processing device comprises:
an access control policy storing section configured to store an access control policy that indicates a relationship between each second object included in a second object group and a control rule indicating permitted manipulation content for said each second object;
and
a data processing section configured to judge whether or not said manipulation request is feasible,
wherein said first information processing device comprises:
an additional control policy storing section configured to indicate a changed object group with respect to each of first objects included in said first object group, wherein said changed object group is a group of said second objects to which same control rule as said each first object is applied, and
wherein said data processing section comprises:
a changed object group determination section configured to refer to said additional access control policy storing section when said manipulation target object is included in said first object group, and obtain said changed object group corresponding to said manipulation target object;
and
an access control rejudging section configured to reference to said access control policy to judge whether or not said manipulation request is feasible for said each second object included in said changed object group and determine whether or not said manipulation request is feasible for said manipulation target object based on a judgment result,
wherein said data processing device further comprises an access control section configured to refer to said access control policy to judge whether or not said manipulation target object is included in said second object group, and
wherein said changed object group determination section obtains said changed object group when said manipulation target object is not included in said second object group.

12 more elements

A data using device comprising a second information device used in an information processing device wherein said information processing device comprises:

a first information processing device configured to store a first object group;
and
the second information processing device configured to receive a manipulation request indicating a content of manipulation for a manipulation target object from a subject to operate said manipulation target object based on said manipulation request,
wherein said second information processing device comprises:
an access control policy storing section configured to store an access control policy that indicates a relationship between each second object included in a second object group and a control rule indicating permitted manipulation content for said each second object;
and
a data processing section configured to judge whether or not said manipulation request is feasible,
wherein said first information processing device comprises:
an additional control policy storing section configured to indicate a changed object group with respect to each of first objects included in said first object group, wherein said changed object group is a group of said second objects to which same control rule as said each first object is applied, and
wherein said data processing section comprises:
a changed object group determination section configured to refer to said additional access control policy storing section when said manipulation target object is included in said first object group, and obtain said changed object group corresponding to said manipulation target object;
and
an access control rejudging section configured to reference to said access control policy to judge whether or not said manipulation request is feasible for said each second object included in said changed object group and determine whether or not said manipulation request is feasible for said manipulation target object based on a judgment result,
wherein said data processing device further comprises an access control section configured to refer to said access control policy to judge whether or not said manipulation target object is included in said second object group, and
wherein said changed object group determination section obtains said changed object group when said manipulation target object is not included in said second object group.

12 more elements

A method for operating an information processing system having a first information processing device configured to store a first object group, and a second information processing device configured to obtain manipulation request indicating a manipulation target object and a manipulation content to operate said manipulation target object based on said manipulation request, said method comprising:

preliminary storing an access control policy indicating a relationship between an each of second objects included in second object group and a control rule indicating permitted manipulations for said each second object, in said second information processing device;
preliminary storing an additional access control policy indicating a changed object group with respect to each of first objects included in said first object group in said first information processing device, wherein said changed object group is a group of second objects to which same control rule as said each first object is applied;
and
judging whether or not said manipulation request is feasible,
wherein said judging whether or not said manipulation request is feasible comprises:
obtaining said manipulation request by said second information processing device;
referring to said additional access control policy and obtaining said changed object group corresponding to said manipulation target object by said second information processing device, when said manipulation request is included in said first object group;
and
referring to said access control policy to judge whether or not manipulation content of said manipulation request is feasible for said changed object group by said second information processing device, and judging whether or not said manipulation request is feasible for said manipulation target object, based on a judgment result,
wherein said judging whether or not said manipulation request is feasible, further comprises referring to said access control policy to judge whether or not said manipulation target object is included in said second object group, and
wherein said obtaining said changed object group comprises obtaining said changed object group when said manipulation target object is not included in said second object group.

8 more elements

A non-transitory computer readable recording medium in which a computer-executable program code is stored to attain a method for operating an information processing system having a first information processing device configured to store a first object group, and a second information processing device configured to obtain manipulation request indicating a manipulation target object and a manipulation content to operate said manipulation target object based on said manipulation request,

wherein said method comprises:
preliminary storing an access control policy indicating a relationship between an each of second objects included in second object group and a control rule indicating permitted manipulations for said each second object, in said second information processing device;
preliminary storing an additional access control policy indicating a changed object group with respect to each of first objects included in said first object group in said first information processing device, wherein said changed object group is a group of second objects to which same control rule as said each first object is applied;
and
judging whether or not said manipulation request is feasible,
wherein said judging whether or not said manipulation request is feasible comprises:
obtaining said manipulation request by said second information processing device;
referring to said additional access control policy and obtaining said changed object group corresponding to said manipulation target object by said second information processing device, when said manipulation request is included in said first object group;
and
referring to said access control policy to judge whether or not manipulation content of said manipulation request is feasible for said changed object group by said second information processing device, and judging whether or not said manipulation request is feasible for said manipulation target object, based on a judgment result,
wherein said judging whether or not said manipulation request is feasible, further comprises referring to said access control policy to judge whether or not said manipulation target object is included in said second object group, and
wherein said obtaining said changed object group comprises obtaining said changed object group when said manipulation target object is not included in said second object group.

9 more elements

Dependencies are inferred from the claim text.