Technique for controlling access to data

Access control with easy change/extension is implemented. Access to data is controlled by a first storage unit that stores a plurality of attribute values respectively selected from a plurality of integers which are relatively prime and identifying a plurality of attributes of users, in association with respective users a second storage unit that stores a product of at least two attribute values which are common to users belonging to a set of users, in association with respective data to be accessed, to show the set of users which are targets of controlling access to the data. A plurality of attribute values corresponding to a user who requests access are read from the first storage unit, and a product of at least two of the plurality of read attribute values is calculated. The user is accepted as a target of controlling access to the data, on condition that the calculated product of attribute values matches a product of attribute values stored in the second storage unit in association with the data to be accessed.

FIELD OF THE INVENTION

The present invention relates to a technique for controlling access to data and screen. More particularly, the present invention relates to a technique for determining whether access to data is granted or denied, based on attributes of a user.

BACKGROUND OF THE INVENTION

In recent years, a large number of pages with a hierarchical structure have been created using World Wide Web technology such as hyperlinks, and such pages have been widely used not only on the Internet but also on intranets. A large website with a large number of pages is built assuming that the website is accessed by multiple users having a variety of attributes. For example, there is a case in which, for appropriate information management within a company, browsable pages are restricted by department, position, job title, or the like. Also, there is a case in which when a database is updated by an operation performed on a page, a determination as to whether to allow for the update may be made according also to attributes of a user.

Examples of techniques for access control can be found, for example, in Japanese Unexamined Patent Publication (Kokai) No. 2005-92891 and Japanese Unexamined Patent Publication (Kokai) No. 2006-48220.

Conventionally, such access control is reflected in the design of software for access control and implemented by the software being operated on a web server or the like. For example, design specifications that “if the attribute of a user is a specific attribute, then the user is allowed to refer to a given page” are implemented by a database in which an attribute is stored for each user, a database in which an attribute of a user to whom access is granted is stored for each page, and a program that determines, based on the attribute stored in the databases, whether to grant or deny access. Thus, to change access control or add an attribute or page, there is a need to change the databases or program.

For example, when a database is in a table format including a plurality of rows provided for each page and a plurality of columns provided for each attribute, a new column needs to be added to the table, in order to add an attribute. A process of adding a column to the table takes a very long time, depending on the type of database or the data size. In order to eliminate the need to change access control, it may be considered to enable setting of sufficient types of attributes in advance; however, it is almost impossible to fully predict future modifications and prepare in advance for attributes.

SUMMARY OF THE INVENTION

The present invention provides a system, method, and program product for determining whether access to data is granted or denied, based on attributes of a user.

According to a first aspect of the present invention, there is provided a system for controlling access to data, comprising: a first storage unit for storing a plurality of attribute values respectively selected from a plurality of integers which are relatively prime and identifying a plurality of attributes of users, in association with respective users; a second storage unit for storing a product of at least two attribute values which are common to users belonging to a set of users, in order to show, in association with respective data to be accessed, the set of users as targets of access control to the data; a calculation unit for reading out, from the first storage unit, a plurality of attribute values corresponding to a user who requests access, and calculating a product of at least two of the plurality of read attribute values; and a control unit for performing a process for accepting the user as a target of controlling access to the data, on condition that the calculated product of attribute values matches a product of attribute values stored in the second storage unit in association with the data to be accessed. In addition, there are provided a program product for allowing an information processing apparatus to function as the system and a method for controlling access using the system.

It is to be understood that the aforementioned summary of the invention does not list all necessary features of the present invention and thus any sub-combination of groups of these features can also fall within the invention.

DETAILED DESCRIPTION OF THE INVENTION

Although the present invention will be described below through an embodiment of the present invention, the following embodiment is not intended to limit the inventions as set forth in the appended claims and all combinations of features described in the embodiment are not always necessary to the solving means of the present invention.

FIG. 1shows the overall configuration of an information system10according to an embodiment of the present invention. The information system10includes a web server20, a DB server25, and a database28. When the web server20communicates with an external terminal apparatus15and receives a request from a user to display a web page, the web server20creates a requested web page and transmits, as a response, the web page to the terminal apparatus15. In the process of creating a web page to be displayed, access to the database28may be required. In such a case, the web server20instructs the DB server25to read out necessary data from the database28or to update data contained in the database28.

For such World Wide Web technology, standardization of the technology is advanced and a website including a plurality of web pages can be created at low cost and with high quality and thus the World Wide Web technology is widely spread. Hence, it is often the case that a system such as the information system10is simultaneously and parallelly accessed by a large number of users on a company intranet, for example. The information system10according to the present embodiment supports such an application and is intended to facilitate, when access to a web page is restricted on a per-user basis, the extension/change of access restriction which is once set.

FIG. 2shows a functional configuration of the web server20. The web server20has a first storage unit200, a second storage unit210, a calculation unit220, and a control unit230. The first storage unit200stores a plurality of attribute values which identify a plurality of attributes of users in association with respective users. The attribute values are selected in advance from a plurality of integers which are relatively prime and assigned. For example, the attribute values may be selected from a combination of only prime numbers, such as 2, 3, 5, and 7, or may be selected from a combination of not only prime numbers but also integers which are relatively prime, such as 13, 15, 17, 32, and 77.

The second storage unit210is provided to show, in association with respective data to be accessed, a set of users as targets of access control to the data, and stores a product of at least two attribute values which are common to users belonging to the set of users. The data refers, for example, to a web page or a data entry in the database28to be updated according to an input to the web page. As an example, for a given web page, when, if a user has an attribute value of a certain attribute of 11 and an attribute value of another attribute of 13, and access to the web page is granted to that user regardless of other attributes, the second storage unit210stores 143 (=11×13) in association with the web page.

The calculation unit220receives identification information of a user (called a user ID) who requests access such that the user ID is included in a web page display request, for example. The calculation unit220then reads out, from the first storage unit200, a plurality of attribute values corresponding to the user ID and calculates a product of at least two of the plurality of read attribute values. As an example, when 11, 13, and 17 are read out, a product of at least two of them, e.g., 143 (=11×13), is calculated. The calculation unit220calculates, for each combination of attribute values which includes at least two of the plurality of read attribute values, a product of attribute values belonging to each combination of attribute values. In the example where 11, 13, and 17 are read out, in addition to 143, 221 (=13×17), 187 (=11×17), and 2431 (=11×13×17) are calculated. The product calculation process may be efficiently performed using a cache, as will be described later.

The control unit230receives identification information (called a page ID) that identifies data to be accessed such that the page ID is included in a web page display request, for example. The control unit230then reads out, from the second storage unit210, a product of attribute values in association with the page ID. The control unit230then compares the product of attribute values calculated by the calculation unit220with the read product of attribute values. When there are a plurality of calculated products of attribute values, the control unit230compares each of the calculated products of attribute values with the read product of attribute values. When a plurality of products of attribute values are stored in associated with one same web page, the control unit230compares each of the calculated products of attribute values with each of the read products of attribute values.

On condition that there is a match, the control unit230performs a process for accepting the user as a target of access control to the data. The phrase “there is a match” refers to that any of the calculated products of attribute values matches any of the read products of attribute values. The process for accepting the user as a target of access control to the data refers, for example, to a process of granting, if it is predetermined that access is granted only when there is a matched product of attribute values, access to the data by the user. In contrast, if it is predetermined that access is denied only when there is a matched product of attribute values, the control unit230denies access to the data by the user on condition that there is a matched product.

FIG. 3shows an exemplary data structure of the first storage unit200. The first storage unit200stores a plurality of attribute values which identify a plurality of attributes of a user, such that the attribute values are associated with each user. The attribute values are illustrated in an attribute field in the drawing. Furthermore, the first storage unit200calculates and stores in advance a product of at least two of a plurality of attribute values corresponding to a user, in association with respective users. The products of attribute values are illustrated in a cache field in the drawing. Note, however, that values in cache C are not products of attribute values but attribute values themselves. As such, the first storage unit200may further store a frequently used attribute values themselves in the cache field.

As described above, a plurality of attribute values are selected in advance from a combination of integers which are relatively prime and then assigned. In the example ofFIG. 3, the attribute of a department of a user is either distribution department or sales department. To the attribute values of this attribute are assigned a prime number 103 indicating the distribution department and a prime number 101 indicating the sales department. Similarly, for the attribute of a job title of a user, a prime number 3 indicating manager and a prime number 2 indicating assistant manager are assigned to the attribute values. In this example, a prime number 3 is also assigned to an attribute value indicating director. As such, an attribute value may not be one that can fully identify an attribute and may be one that collectively identifies a plurality of pieces of attribute information which are actually different from each other, depending on the circumstances of access control.

Thereafter, similarly, for the attribute of a work location of a user, a prime number 11 indicating eastern Japan and a prime number 13 indicating western Japan are selected as attribute values, and for the attribute of a group to which a user belongs, a prime number 67 indicating group B and a prime number 61 indicating group A are selected as attribute values.

As an example of a cache, the first storage unit200calculates and stores in advance in a cache A field a product of an attribute value of a department and an attribute value of a job title. For example, for user 1, the first storage unit200stores 309 which is the product of a prime number 103 indicating the distribution department and a prime number 3 indicating manager. In addition, the first storage unit200calculates and stores in advance in a cache B field a product of an attribute value of a department and an attribute value of a work location.

FIG. 4Ashows an exemplary screen configuration of a web page which is the target of access control. When a given item is selected on a menu page which is an initial screen, a screen1-1is displayed. Note that the screen1-1and subsequent screens1-2and1-3can be referred to only by users whose serviced department attributes are the distribution department. Therefore, the web server20denies access from any other user. For the screen1-1, reference by all users of the distribution department is allowed. On the other hand, for the screen1-2to be displayed in response to an operation performed on the screen1-1, users who are in the distribution department and in eastern Japan are allowed for read-only reference, and users in the distribution department and in western Japan are allowed not only for read reference but also for an update. As such, access control may involve not only the grant/denial of access but also control of the type of access to be granted. For the screen1-3to be displayed in response to an operation performed on the screen1-2, reference is allowed only by users who are in the distribution department and in western Japan and thus access by users in eastern Japan is denied.

When another item is selected on the menu page, a screen2-1is displayed. Note that the screen2-1and a subsequent screen2-2can be referred to only by users whose job titles are either director or manager. Furthermore, for the screen2-1, an update by directors or managers in group A is allowed, and directors or managers in group B are allowed only for read reference. For the screen2-2to be displayed in response to an operation performed on the screen2-1, reference by the directors or managers in the group A is allowed, and access by users in any other group, regardless of whether the users are directors or managers, is not allowed.

FIG. 4Bshows an exemplary data structure of the second storage unit210.FIG. 4Bis associated with the screen configuration shown inFIG. 4A. The second storage unit210is provided to show, in association with respective data (e.g., page) to be accessed, a set of users as targets of access control to the data, and stores a product of at least two attribute values which are common to users belonging to the set of users. The second storage unit210further stores type information indicating whether read-only reference to data is allowed or even an update to the data is allowed, in association with respective data to be accessed.

As an example, the second storage unit210stores, for a page 1-2, 1133 which is the product of an attribute value 103 indicating the distribution department which is a serviced department and an attribute value 11 indicating eastern Japan which is a work location. In addition, the second storage unit210stores, for this page, “reference” which is an access type for read-only. By referring to this entry, the control unit230can allow a set of users in the distribution department and in eastern Japan to refer to the page 1-2.

Specifically, the calculation unit220reads out 103, 3, 11, and 67 as a plurality of attribute values of a given user (user 1). The calculation unit220then calculates, for each combination including at least two of the attribute values, a product of attribute values belonging to each combination. For example, the products are 309 (=103×3), 33 (=3×11), 1133 (=11×103), and the like. Since any of the calculated products matches the product 1133 associated with the page 1-2, the control unit230performs access control according to type information associated with the user. Specifically, since the type information associated with the matched product of attribute values indicates allowance for reference to data, the control unit230allows for read reference to the data.

As another example, the second storage unit210stores, for a page 2-1, 183 which is the product of an attribute value 3 indicating a job title of a serviced department and an attribute value 61 indicating the group A which is a serviced group. In addition, the second storage unit210stores, for this page, “update” which is an access type. By referring to this entry, the control unit230can allow a set of users who are directors or managers and in the group A to update the page 2-1.

Specifically, the calculation unit220reads out 103, 3, 13, and 61 as a plurality of attribute values of a given user (user 3). The calculation unit220then calculates, for each combination including at least two of the attribute values, a product of attribute values belonging to each combination. For example, the products are 309 (=103×3), 39 (=3×13), 183 (=3×61), and the like. Since any of the calculated products matches the product 183 associated with the page 2-1, the control unit230performs access control according to type information associated with the user. Specifically, since the type information associated with the matched product of attribute values indicates allowance for an update to data, the control unit230allows for an update to the data. Note that when there is no matched product of attribute values the control unit230denies access to the data.

Note that the second storage unit210stores, for the page 1-1, not only the product of attribute values but also an attribute value itself. This indicates that if a user has that attribute value, the user is allowed for access regardless of other attributes. Specifically, the control unit230compares not only products of attribute values read out from the first storage unit200but also an attribute value itself with an entry of a product of attribute values in the second storage unit210and if there is a match, then a user is the target of access control. As such, by allowing not only products of attribute values but also an attribute value itself to be set, flexible specification of a set of users is enabled.

As described above, according to the information system10described with reference toFIGS. 1 to 4, by storing a product of prime number values for each web page, a set of users which are targets of access control can be managed. This makes the number of data entries in a column direction (i.e., the number of columns) in the second storage unit210smaller, and thus, the required capacity of the second storage unit210can be reduced. Furthermore, even when a new attribute is added or when a user who is the target of access control is added, there is no need to add a new column to the second storage unit210. Therefore, even when a database technique in which addition of a column is difficult is adopted, the change/extension of access control is facilitated.

FIG. 5shows a flowchart of a process of setting attributes for allowing the information system10to perform access control. A user such as an engineer or system administrator assigns, as a plurality of attribute values, attribute values selected from a plurality of integers which are relatively prime, e.g., prime numbers (S500). For an attribute value, a value is assigned which is different not only from other attribute values of an attribute to which the attribute value belongs but also from attribute values of other attributes. The user then stores the plurality of attribute values in the first storage unit200using the assigned attribute values such that the plurality of attribute values are associated with each user (S510). Then, in order to show a set of users which are targets of access control to a web page, the user calculates, for each web page, a product of attribute values which are common to users of the set and then stores the calculated products in the second storage unit210(S520).

FIG. 6is a flowchart of a process of controlling access to a page by the information system10. The information system10performs the following process in response to, for example, a request for screen transition from a web page being displayed on the screen of the terminal apparatus15to a next web page. The calculation unit220obtains a user ID of a user who requests access from, for example, an HTTP access request message in which a URL and the like of the next web page are specified (S600). The calculation unit220then reads out, from the cache field of the first storage unit200, products of attribute values corresponding to the user ID (S605). Then, the control unit230searches the second storage unit210and determines whether any of the read products of attribute values matches a product of attribute values which is associated with a page to be accessed in the second storage unit210(S610). The page to be accessed namely refers to the next web page specified by a URL or the like.

On condition that a matched product of attribute values is searched (YES at S620), the control unit230considers the user as a target of access control to the web page (S630). For example, the control unit230grants access by the user. As a result of the granting of access, the control unit230transmits information on the next web page to the terminal apparatus15and displays the next web page on the screen of the terminal apparatus15. On the other hand, on condition that a matched product of attribute values is not searched (NO at S620), the calculation unit220determines whether there is a product of attribute values which is associated with the user and which is not yet read out from the cache field (S640). If there is a product of attribute values which is not yet read out (YES at S640), then the web server20returns to S605and continues the process.

If there is no product of attribute values which is not yet read out (NO at S640), then the calculation unit220reads out, from the attribute field of the first storage unit200, a plurality of attribute values corresponding to the user ID and calculates, for each combination including at least two of the plurality of read attribute values, a product of attribute values belonging to each combination (S650). For efficiency of the process, the calculation unit220may calculate a product of a given combination of attribute values by calculating a product of a product of attribute values read out from the cache field and another read attribute value.

The control unit230then searches the second storage unit210and reads out, from the second storage unit210, a product of attribute values which are associated with a page ID and then compares the products of attribute values calculated by the calculation unit220with the read product of attribute values (S660). On condition that a matched product of attribute values is searched (YES at S670), the control unit230performs a process with the user being the target of access control to the web page (S630). On the other hand, on condition that a matched product of attribute values is not searched (NO at S670), the control unit230does not perform a process for accepting the user as a target of access control to the web page (S680). For example, the control unit230denies access to the web page by the user. As a result of the denial of access, the control unit230may notify the terminal apparatus15of the denial of access and display on the screen of the terminal apparatus15a screen showing such a fact.

FIG. 7shows the overall configuration of a web server20according to a variant of the present embodiment. The variant shows an example of a combination of a database in which a condition for controlling access to data is stored for respective data to be accessed, with a database which is shown inFIG. 4Band which implements control by products of prime number values. The variant is intended to facilitate management by a user or to increase compatibility with existing techniques, by managing a universal condition where change/extension is rare and a fluid condition where there is possible change/extension, such that the conditions are distinguished from each other.

The web server20further includes, in addition to the components of the web server20shown inFIG. 20, a third storage unit240. A specific example of the third storage unit240is shown inFIG. 8.

FIG. 8shows an exemplary data structure of the third storage unit240in the variant of the present embodiment. The third storage unit240stores an attribute condition that a user should satisfy to grant access, in association with respective data to which access is to be granted. For example, the third storage unit240has a page ID field, a condition field, and a type information field. As an example, the third storage unit240stores, for a page 1-1, information indicating whether the attribute of a job title is an executive or whether the attribute of a serviced department is system department, as a condition for allowing for read-only reference to the page and an update to a database related to the page.

In the variant, the control unit230performs access control based further on such information stored in the third storage unit240. Specifically, first, the control unit230reads out, from the first storage unit200, attribute values corresponding to a user who requests access and reads out, from the third storage unit240, a condition corresponding to the user who requests access. The control unit230then determines whether the read attribute values satisfy the read condition. This condition determination is implemented by a comparison of attribute values by a conditional branch instruction. If the condition is satisfied, then the control unit230performs a process for accepting the user as a target of access control. In the example ofFIG. 8, both read reference and an update are allowed.

On the other hand, on condition that the read attribute values do not satisfy the read condition, the control unit230performs the above-described process using products of attribute values. Specifically, the control unit230determines whether products of attribute values calculated by the calculation unit220match a product of attribute values stored in the second storage unit210.

As described above, according to the variant, access control based on a condition can be combined with access control by products of attribute values. By this, a condition that is universal and difficult to change and a condition that possibly changes are managed so as to be distinguished from each other and the change/extension of the condition that possibly changes is facilitated.

FIG. 9shows an exemplary hardware configuration of an information processing apparatus500which functions as the web server20according to the present embodiment or the variant of the present embodiment. The information processing apparatus500includes a CPU peripheral section having a CPU1000, a RAM1020, and a graphics controller1075which are interconnected to one another by a host controller1082; an input/output section having a communication interface1030, a hard disk drive1040, and a CD-ROM drive1060which are connected to the host controller1082by an input/output controller1084; and a legacy input/output section having a ROM1010, a flexible disk drive1050, and an input/output chip1070which are connected to the input/output controller1084.

The host controller1082connects the RAM1020to the CPU1000and the graphics controller1075which access the RAM1020at high transfer rate. The CPU1000operates based on programs stored in the ROM1010and the RAM1020and performs control of each section. The graphics controller1075obtains image data to be generated, by the CPU1000or the like, on a frame buffer provided in the RAM1020and displays the image data on a display device1080. Instead of this, the graphics controller1075may include therein a frame buffer that stores image data to be generated by the CPU1000or the like.

The input/output controller1084connects the host controller1082to the communication interface1030, the hard disk drive1040, and the CD-ROM drive1060which are relatively high-speed input/output devices. The communication interface1030communicates with an external apparatus via a network. The hard disk drive1040stores programs and data to be used by the information processing apparatus500. For example, the above-described first storage unit200, second storage unit210, and third storage unit240are implemented by storage devices such as the hard disk drive1040, for example. The CD-ROM drive1060reads a program or data from a CD-ROM1095and provides the read program or data to the RAM1020or the hard disk drive1040.

To the input/output controller1084are connected the ROM1010and relatively low-speed input/output devices such as the flexible disk drive1050and the input/output chip1070. The ROM1010stores a boot program which is executed by the CPU1000upon startup of the information processing apparatus500, a program that depends on the hardware of the information processing apparatus500, and the like. The flexible disk drive1050reads a program or data from a flexible disk1090and provides the read program or data to the RAM1020or the hard disk drive1040via the input/output chip1070. The input/output chip1070connects the flexible disk1090or various input/output devices via a parallel port, a serial port, a keyboard port, or a mouse port, for example.

A program to be provided to the information processing apparatus500is stored in a recording medium, such as the flexible disk1090, the CD-ROM1095, or an IC card, and then provided by a user. The program is read out from the recording medium via the input/output chip1070and/or the input/output controller1084and then installed on and executed by the information processing apparatus500. Operations to be performed by the program prompting the information processing apparatus500or the like are the same as those of the web server20described inFIGS. 1 to 8and thus description thereof will be omitted.

Programs described above may be stored in an external storage medium. For the storage medium, in addition to the flexible disk1090and the CD-ROM1095, optical recording media such as DVDs and PDs, magneto-optical recording media such as MDs, tape media, semiconductor memories such as IC cards, and the like can be used. It is also possible that a storage device, such as a hard disk or RAM, provided in a server system connected to a private communication network or the Internet is used as a recoding medium and a program is provided to the information processing apparatus500via the network.

The present invention has been described using an embodiment thereof; however, the technical scope of the present invention is not limited to the scope described in the aforementioned embodiment. It is obvious to those skilled in the art that various kinds of changes or modifications can be added to the aforementioned embodiment. It is obvious from the recitation of the appended claims that embodiments to which such changes or modifications are added are also included in the technical scope of the present invention.