Patent ID: 6754691
Filing Date: 2004-06-22
Classification: H04L

Abstract:
An access control apparatus having an agent environment for executing one or more agents each having method executing means and for managing execution of said agent(s), wherein(a) said agent environment comprises: (a1) agent generating means for generating said agent; (a2) agent management means for uniquely distinguishing and managing said agent from another agent in said agent environment as from generation until end of execution of said agent; (a3) execution method management means for checking as to whether or not the method executed by said agent is in need of access control; (a4) agent environment information management means for storing managing position information of said agent environment, a starter of said agent environment and a producer of an execution program of said agent environment, as agent environment information, upon startup of said agent environment, and for collating the agent environment information with a security policy proper to said agent environment to check into authorization of executing method of an agent operating on said agent environment; (a5) agent information management means for storing and managing the information on a starter of said agent and a producer of said agent as agent information upon generation of said agent, and for collating said agent information with the security policy proper to said agent environment to check into the authorization of said executing method of said agent; (b) wherein first method transmission means and first method reception means are provided in the access control apparatus; (c) wherein the apparatus is configured such that: (c1) when a first agent present in the first one of said plural agent environments makes a method execution request to a second agent having a method to be disclosed to another agent, (c2) said first agent information management means of the first agent environment discriminates the agent information on the first agent environment and collates the discriminated information with the security policy of said first agent environment to check into a transmission authorization of said method for said first agent and, (c4) when said first agent has an authorization to transmit said method, the first method transmission means transmits, along with the execution request of said method, the first agent information and an updated thread visit history information on an executed thread of said method of said first agent added with the agent environment information of said first agent by a first thread visit history management means of the first agent environment, (c5) said first method reception means receiving a reply to said method execution request; (d) wherein said second agent environment where said second agent is present comprises: (d1) second reception means for receiving said method execution request transmitted from said first method transmission means, said first agent information and said thread visit history information; (d2) second agent information management means for reading said first agent information and collating the read information with the security policy of said second agent environment to check into the execution authorization of said method; (d3) second thread visit history management means for reading and discriminating the updated thread visit history information and collating the read information with the security policy of said second agent environment to check into the execution authorization of said method; and (d4) second method transmission means for returning a result of execution of said method to said first agent environment.