Technique for controlling access to data

A method for controlling access using a system for controlling access to data, the system including

• a first storage unit for storing a plurality of attribute values respectively selected from a plurality of integers which are relatively prime, each attribute value identifying one of a plurality of attributes of a user, the attributes describing a common property of the user in association with respective users;
• and
• a second storage unit for associating data to be accessed with products of at least two of the plurality of attribute values, which are common to users belonging to a set of users, each product of the products indicating a combination of attributes required for the set of users as targets of access control to the data, the method comprising:
• reading out a plurality of attribute values corresponding to a user who requests access from the first storage unit, and calculating a product of at least two of the plurality of read attribute values by an information processing apparatus;
• and
• performing a process for accepting the user as a target of controlling access to the data by the information processing apparatus, on condition that the calculated product of attribute values matches a product of attribute values stored in the second storage unit in association with the data to be accessed.

A program product stored on a computer readable storage medium for causing an information processing apparatus to function as a system for controlling access to data, the program product causing the information processing apparatus to function as:

• a first storage unit for storing a plurality of attribute values respectively selected from a plurality of integers which are relatively prime, each attribute value identifying one of a plurality of attributes of a user, the attributes describing a common property of the user in association with respective users;
• a second storage unit for associating data to be accessed with products of at least two of the plurality of attribute values, which are common to users belonging to a set of users, each product of the products indicating a combination of attributes required for the set of users as targets of access control to the data;
• a calculation unit for reading out, from the first storage unit, a plurality of attribute values corresponding to a user who requests access, and calculating a product of at least two of the plurality of read attribute values;
• and
• a control unit for performing a process for accepting the user as a target of controlling access to the data, on condition that the calculated product of attribute values matches a product of attribute values stored in the second storage unit in association with the data to be accessed.