Patent ID: 8813250
Filing Date: 2014-08-19
Classification: G06F,H04L

Abstract:
1. A non-transitory computer readable medium storing an access control program, the access control program comprising instructions which when executed by a computer, causes the computer to perform operations, comprising: a step of storing a subject assignment, an authority permission assignment, and a role hierarchy together or separately in one or more storage devices, the subject assignment associating one or more roles and a subject to which the one or more roles are assigned, the authority permission assignment associating a role, an authority permission, and a grant/denial which indicates whether a subject assigned the role is granted or denied the authority permission, the role hierarchy indicating an inheritance relation between roles; a step of determining whether or not one subject is assigned a plurality of roles in the subject assignment and, when it is determined that one subject is assigned a plurality of roles, obtaining the plurality of roles, R1, R2 . . . Rm, where m is a natural number equal to or larger than 2; a first authority permission grant/denial deriving step of deriving, by inheritance, authority permission grants/denials associated with each of the plurality of roles R1, R2 . . . Rm, based on the role hierarchy and the authority permission assignment; a step of storing, among the authority permission grants/denials derived by inheritance, authority permissions A1, A2 . . . An, where n is a natural number, which are each derived from two or more different roles out of the plurality of roles R1, R2 . . . Rm and which are each granted to one of the plurality of roles R1, R2 . . . Rm but denied to another of the plurality of roles R1, R2 . . . Rm, in one of the one or more storage devices as authority permissions that are conflicting among a combination of the plurality of roles R1, R2 . . . Rm; a step of receiving via an input device grants/denials of the authority permissions A1, A2 . . . An for the one subject assigned the combination of the plurality of roles R1, R2 . . . Rm; a step of storing, based on the received grants/denials, grants/denials of the authority permissions A1, A2 . . . An with respect to the combination of the plurality of roles R1, R2 . . . Rm in one of the one or more storage devices as an exceptional authority permission assignment for an exceptional role, which is a virtual role constituted of the combination of the plurality of roles R1, R2 . . . Rm; and a second authority permission grant/denial deriving step of deriving, by inheritance, authority permission grants/denials associated with each of the plurality of roles R1, R2 . . . Rm of the exceptional role, based on the role hierarchy, the authority permission assignment, and the exceptional authority permission assignment wherein the second authority permission grant/denial deriving step comprises the steps of: wherein, when deriving, by inheritance, authority permission grants/denials of the subject assigned the exceptional role, the exceptional role is treated as a multiple-inheritance source role which has the plurality of roles R1, R2 . . . Rm as inheritance sources.