Patent ID: 7424475
Filing Date: 2008-09-09
Classification: H04L,Y10S

Abstract:
1. An access control system in which a plurality of storage devices for storing information resources and access controllers for controlling accesses to the information resources stored in the storage devices are connected with a network, each of the access controllers having an access control list on which access right to each information resource stored in the storage devices is recorded, and each of the access controllers having an access prohibition list on which user information of access prohibited users are recorded who are prohibited from accessing any information resource stored in the storage devices, each access controller comprising: an access restriction module configured to restrict access to each information resource stored in a storage device and listed on the access control list of the access controller that records access right to each information resource; an access interception module configured to intercept the access by reference to the access prohibition list of the access controller, which records user information of access prohibited users, prior to referencing the access control list by the access restriction module; a list update module configured to update the access prohibition list; an access control list update module configured to update the access control list according to the updated access prohibition list; and a distribution module; wherein the distribution module of at least one of the access controllers having received user information to be added to the access prohibition list thereof, and an access prohibition list updated accordingly, is configured to send out the user information added to the updated access prohibition or the entire updated access prohibition list to the other access controllers in response to the access prohibition list of the sending access controller being updated; wherein the list update module of each of the other access controllers is configured to receive the sent-out user information or updated access prohibition list, and to update the access prohibition list thereof to include the received user information or updated access prohibition list, wherein after the list update module of each of the other access controllers updates the access prohibition list thereof, the access control list update module thereof updates the access control list thereof according to the updated access prohibition list thereof, removing access rights from the access control list for any user corresponding to the user information in the updated access prohibition list; wherein after completing the updating of the access control list thereof, each of the other access controllers deletes the received user information from its updated access prohibition list or the entire updated prohibition list, and notifies the sending access controller of said completion; and wherein the list update module of the sending access controller deletes the user information on its access-prohibited list or the entire access prohibition list thereof at a predetermined timing after receiving the completion notifications from the other access controllers.