Network system and method for changing access rights associated with account IDs of an account name

In an account association table the account IDs and account names of accounts created at nodes are associated and recorded. In response to an access control list change request including the account name of an account the access control entry of which is to be changed and the contents of the change, an access control list change unit retrieves an account ID recorded while being associated with the account name from the account association table and changes, in accordance with the contents of the change, an access control entry in which the retrieved account ID is recorded among account control entries in an access control list to be changed.

This application is a National Stage Entry of PCT/JP2014/000142 filed on Jan. 15, 2014, which claims priority from Japanese Patent Application 2013-016834 filed on Jan. 31, 2013, the contents of all of which are incorporated herein by reference, in their entirety.

TECHNICAL FIELD

The present invention relates to a network system such as a work group in which nodes individually manage user accounts, a node of the network system, an access control list change method for the network system, and a program.

BACKGROUND ART

Network systems are mainly categorized into those including domain controllers and those not including any domain controller. Large network systems including a large number of nodes generally include multiple domains, and each of the domains includes a domain controller that collectively manages user accounts. Including domain controllers enables efficient and secure management and operation of a large network system.

In contrast to the above, small network systems such as a work group including a small number of nodes do not generally include any domain controller, and individual nodes manage user accounts. In other words, in a network system (also referred to as an individual-management network system) that does not include any domain controller, each user needs to create his/her own account at each node that the user desires to access (see PTL 1, for example).

More specifically, in a network system not including any domain controller, each user needs to input an account creation request including an account name and a password to each node that the user desires to access and needs to store account information including the account name, an account ID, and the password in each node in advance. The above-mentioned account name is, for example, a character string to be used by a person for identifying the account. The above-mentioned account ID is an identifier to be used by the node for uniquely identifying the account and is generated by the node itself. The account ID is also referred to as a security identifier (SID). Even when account creation requests including the same account name and password are input to multiple respective nodes, the account IDs generated at the respective nodes are not necessarily the same since the nodes individually generate the account IDs. The account information registered as described above is used for authentication. When receiving an authentication request including an account name and a password from a node used by a user, a node compares registered account information and the information received from a terminal unit and permits access to the node itself when the matching is successful.

In order to increase the security, some network systems perform access control using an access control list (ACL) on an object such as a file or a folder (see PTL 2, for example). An access control list of a certain object includes access control entries (ACEs) in each of which the account ID and the access right of an account having permission to access the object are recorded. When an account having a certain account ID (e.g., IDX) issues a request to access the object and the access control list of the object does not include any access control entry including the account ID “IDX”, the access is denied. When the access control list includes such an access request entry, a determination is further made about whether to permit access, on the basis of the access right recorded in association with the account ID “IDX” and the contents of the access request.

CITATION LIST

Patent Literature

[PTL 2] Japanese Translation of PCT International Application Publication No. 2011-526387

SUMMARY OF INVENTION

Technical Problem

As described above, in an individual-management network system, which does not include any domain controller, the nodes individually generate account IDs for identifying an account. In access control using an access control list, the account of an access request source is identified on the basis of the account ID. In consideration of these, an individual-management network system that performs access control using an access control list has a problem that, to change the access control list of an object accessible from multiple nodes with the same account name, complex change operation is required. This problem is described below by using the network system inFIG. 16as an example.

The network system inFIG. 16includes multiple nodes N1to N3and a shared storage ST shared by the nodes N1and N2.

The shared storage ST stores a file F accessible from the node N1and the node N2by a user U of the node N3by using the account name “XYZ”. The file F includes an access control list ACL and a file main body FH. The access control list ACL includes an access control entry ACE1, in which the account ID “IDN1” generated by the node N1itself at the time of creating an account of the account name “XYZ” at the node N1and the access right “ALL” are recorded, and an access control entry ACE2, in which the account ID “IDN2” generated by the node N2itself at the time of creating an account of the same account name “XYZ” at the node N2and the access right “ALL” are recorded.

An account information storage unit SA of the node N1stores account information generated upon receipt of an account creation request including the account name “XYZ” and the password “P” from the node N3. This account information includes the account name “XYZ” and the password “P”, which are included in the account creation request, and the account ID “IDN1”, which is generated by the node N1itself.

An account information storage unit SB of the node N2stores account information generated upon receipt of an account creation request including the account name “XYZ” and the password “P” from the node N3. This account information includes the account name “XYZ” and the password “P”, which are included in the account creation request, and the account ID “IDN2”, which is generated by the node N2itself.

To access the file F from the node N1by using the account name “XYZ”, the user U of the node N3transmits an access request including, for example, the account name “XYZ” and access contents, from the node N3to the node N1. In response to the access request, the node N1retrieves the account ID “IDN1” recorded in association with the account name “XYZ” from the account information storage unit SA. The reason of retrieving the account ID “IDN1” here is because accounts (users) accessible to an object (the file F in this case) are managed using account IDs in the access control list ACL.

After the retrieval, the node N1checks whether an access control entry in which the account ID “IDN1” is recorded is included in the access control list ACL of the file F. In this example, since the access control entry ACE1, in which the account ID “IDN1” is recorded, is included, the node N1determines whether or not to permit the access to the file F, on the basis of the access right recorded in the access control entry ACE1and the access contents in the access request. In this example, since the access right recorded in the access control entry ACE1is “ALL”, the node N1permits the user U to access the file F.

To access the file F from the node N2by using the account name “XYZ”, the user of the node N3transmits an access request including, for example, the account name “XYZ” and access contents, from the node N3to the node N2. Upon receipt of the request, the node N2carries out the same process as that carried out by the node N1, and the access to the file F is permitted.

Next, operation to be performed in order to change the access control list ACL of the file F is described. First, the user U of the node N3transmits an access control list change request from the node N3to the node N1, the access control list change request including identification information on the object (the file F in this example) the access control list of which is to be changed, the account name (e.g., “XYZ”) of the account for which the access control list is to be changed, and change contents (e.g., change the access right to “WRITE”). In response to the request, the node N1retrieves the account ID “IDN1”, which is recorded in association with the account name “XYZ”, from the account information storage unit SA. Thereafter, the node N1changes the access right in the access control entry ACE1, in which the retrieved account ID “IDN1” is recorded, from “ALL” to “WRITE”. In this state, the access rights are different between when the user U accesses the file F from the node N1by using the account name “XYZ” and when the user U accesses the file F from the node N2by using the same account name “XYZ”.

To address this situation, the user U transmits an access control list change request that has the same contents as those of the above-described access control list change request, to the node N2. In response to the request, the same process as that described above is carried out in the node N2, and the access right in the access control entry ACE2is changed from “ALL” to “WRITE”. As described above, the access control list change request needs to be transmitted to both the node N1and the node N2in order that the access right would be the same in the case of access from the node N1and in the case of access from the node N2. This requires complex operation for changing the access control list. In the case inFIG. 16, the network system includes two nodes, i.e., the nodes N1and N2, that are accessible to the file F by using the same account name “XYZ”, and hence the number of times the access control list change request is transmitted is two. However, when N nodes are included as those accessible to the file F by using the same account name “XYZ”, the access control list change request needs to be transmitted N times.

In view of the above, the present invention aims to provide a network system that solves the problem of requiring complex change operation to change an access control list of an object accessible from multiple nodes by using the same account name, in the case where the network system does not include any domain controller.

Solution to Problem

A network system according to an exemplary aspect of the invention includes: a first node; a second node; and an access control list of each object shared by the first node and the second node, the access control list including an access control entry in which an account ID and an access right of an account permitted to access the object are recorded, wherein the first node comprises an account association table in which an account name and an account ID of an account created at the node itself are recorded in association with each other and in which an account name and an account ID of an account created at the second node are recorded in association with each other and an access control list change unit that, in response to an access control list change request including identification information on an object an access control list of which is to be changed, an account name of an account for which an access control entry is to be changed, and change contents, retrieves an account ID recorded in association with the account name in the access control list change request, from the account association table and changes, in accordance with the change contents, an access control entry in which the retrieved account ID is recorded and that is included in the access control list of the object indicated by the identification information.

A node according to an exemplary aspect of the invention includes: an account association table in which an account name and an account ID of an account created at the node itself are recorded in association with each other and an account name and an account ID of an account created in a different node are recorded in association with each other; and an access control list change unit that, in response to an access control list change request including identification information on an object an access control list of which is to be changed among objects shared by the node itself and the different node, an account name of an account for which an access control entry is to be changed, and change contents, retrieves an account ID recorded in association with the account name in the access control list change request, from the account association table and changes, in accordance with the change contents, an access control entry in which the retrieved account ID and an access right are recorded and that is included in the access control list of the object indicated by the identification information.

An access control list change method according to an exemplary aspect of the invention is a method for a network system including a first node, a second node, and an access control list of each object shared by the first node and the second node, the access control list including an access control entry in which an account ID and an access right of an account permitted to access the object are recorded, the access control list change method includes: in response to an access control list change request including identification information on an object an access control list of which is to be changed, an account name of an account for which an access control entry is to be changed, and change contents, the first node retrieving an account ID recorded in association with the account name in the access control list change request, from an account association table in which an account name and an account ID of an account created at the node itself are recorded in association with each other and in which an account name and an account ID of an account created at the second node are recorded in association with each other, and changing, in accordance with the change contents, an access control entry in which the retrieved account ID is recorded and that is included in the access control list of the object indicated by the identification information.

A program according to an exemplary aspect of the invention is a program causing a computer including an account association table in which an account name and an account ID of an account created in the computer itself are recorded in association with each other and an account name and an account ID of an account created in a different computer are recorded in association with each other, to function as an access control list change unit that, in response to an access control list change request including identification information on an object an access control list of which is to be changed among objects shared by the computer itself and the different computer, an account name of an account for which an access control entry is to be changed, and change contents, retrieves an account ID recorded in association with the account name in the access control list change request, from the account association table and changes, in accordance with the change contents, an access control entry in which the retrieved account ID and an access right are recorded and that is included in the access control list of the object indicated by the identification information.

Advantageous Effects of Invention

According to the present invention, it is possible to obtain the effect of facilitating change operation even in the case of changing an access control list of an object accessible from multiple nodes by using the same account name, in a network system where nodes individually manage accounts.

DESCRIPTION OF EMBODIMENTS

First Exemplary Embodiment

Referring toFIG. 1, a network system according to a first exemplary embodiment of the present invention includes nodes1and2, which function as file servers, a shared storage3, which is accessible from the nodes1and2, and nodes4and5, which function as clients. The nodes1,2,4, and5are connected to each other via a network NW. In this exemplary embodiment, for enhancing availability, the nodes4and5, which function as clients, access files any of31-1to31-N in the shared storage3from the node1when the node1is operating normally and access any of the files31-1to31-N from the node2when the node1is facing failure.

As illustrated inFIG. 2, the file31-i(1≤i≤N) in the shared storage3includes a file metadata311, an access control list312, and a file main body313. The file metadata311includes, for example, file creation time and date, the account name of a file creator, and a file name.

The nodes1and2, which functions as file servers, include transmission/reception units11,12, control units12,22, storages13,23, input units14,24such as a keyboard, and display units15,25such as an LCD, respectively.

The storages13,23of the nodes1,2include account information storage units131,231and account association table storage units132,232, respectively.

The account information storage unit131of the node1stores account information including the account name, the account ID, and the password of each account created at the node1itself. The account information storage unit231of the node2stores account information including the account name, the account ID, and the password of each account created at the node2itself.FIGS. 3A and 3Bare tables illustrating respective examples of the contents of the account information storage units131and231.

The account association table storage unit132of the node1stores an account association table in which the account name and the account ID of each account created at the node1itself are recorded in association with each other and the account name and the account ID of each account created at the different node2are recorded in association with each other. The account association table storage unit232of the node2stores an account association table in which the account name and the account ID of each account created at the node2itself are recorded in association with each other and the account name and the account ID of each account created by the different node1are recorded in association with each other.FIGS. 4A and 4Bare tables illustrating respective examples of the contents of the account association table storage units132and232.

Each of the transmission/reception units11and21of the respective nodes1and2has the function of transmitting and receiving data via the network NW.

The control unit12of the node1includes an account management unit121, an account association table management unit122, an authentication unit123, and a file system124, and the control unit22of the node2includes an account management unit221, an account association table management unit222, an authentication unit223, and a file system224.

The account management unit121of the node1has the function of, in response to an account creation request that is transmitted by the node4or the node5functioning as a client and that includes the account name and the password of an account to be created, generating an account ID that uniquely identifies the account at the node1itself, and the function of storing, in the account information storage unit131, account information including the generated account ID, and the account name and the password in the account creation request. In addition to these, the account management unit121has the function of passing an account association table registration request including the generated account ID and the account name in the account creation request, to the account association table management unit122of the node1itself, and the function of transmitting the account association table registration request to the different node2. When the account does not need to be protected with a password, no password needs to be included in the account creation request. Upon receipt of an account creation request not including any password, the account management unit121generates an account ID that uniquely identifies the account, and stores, in the account information storage unit131, account information including the account ID and the account name in the account creation request.

The account management unit221of the node2has the function of, in response to an account creation request that is transmitted by the node4or the node5functioning as a client and that includes the account name and the password of an account to be created, generating an account ID that uniquely identifies the account at the node2itself, and the function of storing, in the account information storage unit231, account information including the generated account ID, and the account name and the password in the account creation request. In addition to these, the account management unit221has the function of passing an account association table registration request including the generated account ID and the account name in the account creation request, to the account association table management unit222of the node2itself, and the function of transmitting the account association table registration request to the different node1.

The account association table management unit122of the node1has the function of storing, in association with each other, the account name and the account ID included in the account association table registration request received from the account management unit121of the node1itself, in the account association table storage unit132, and the function of storing, in association with each other, the account name and the account ID included in the account association table registration request received from the different node2, in the account association table storage unit132.

Correspondingly, the account association table management unit222of the node2has the function of storing, in association with each other, the account name and the account ID included in the account association table registration request received from the account management unit221of the node2itself, in the account association table storage unit232, and the function of storing, in association with each other, the account name and the account ID included in the account association table registration request received from the different node1, in the account association table storage unit232.

The authentication unit123of the node1has the function of, upon receipt of an authentication request including an account name and a password from the node4or the node5functioning as a client, comparing the account name and the password with the account information stored in the account information storage unit131of the node1itself and permitting the use of the file system124when the matching is successful. The authentication unit223of the node2has the function of, upon receipt of an authentication request including an account name and a password from the node4or the node5functioning as a client, comparing the account name and the password with the account information stored in the account information storage unit231of the node2itself and permitting the use of the file system224when the matching is successful.

The file system124of the node1includes an access control unit125and a file registration unit127, and the access control unit125includes an access control list change unit (ACL change unit)126. The file system224of the node2includes an access control unit225and a file registration unit227, and the access control unit225includes an access control list change unit (ACL change unit)226.

The access control unit125of the node1has the following functions (1) to (4).

(1) The function of, upon receipt of a file access request from the node4or the node5functioning as a client, determining whether or not to permit the file access, by referring to the access control list of the access target file. The detailed description of the function is as follows.

File access requests in this exemplary embodiment are categorized into those requesting only a file main body as an access target, those requesting only an access control list as an access target, and those requesting both a file main body and an access control list as access targets. As illustrated inFIG. 5A, a file access request that requests only a file main body as an access target includes a file name51of an access target file, an account name52of the account to be used for accessing the file having the file name51, and access contents53(such as WRITE or READ) for the file main body. As illustrated inFIG. 5B, a file access request that requests only an access control list as an access target includes the file name51of an access target file (file name of the file the access control list of which is to be changed)51, the account name52of the account to be used for accessing the file having the file name51, an account name54of the account for which each corresponding access control entry is to be changed, and change contents55for the access control list. The change contents55for the access control list include addition or deletion of an access control entry as well as change of the access right. As illustrated inFIG. 5C, a file access request requesting both a file main body and an access control list as access targets includes the file name51of an access target file, the account name52of the account to be used for accessing the file having the file name51, the access contents53for the file main body, the account name54of the account for which each corresponding access control entry is to be changed, and the change contents55for the access control list.

In the case where a received file access request is that illustrated inFIG. 5(A), in which only a file main body is requested as an access target, the access control unit125first retrieves the account ID recorded in association with the account name52from the account information storage unit131, checks whether or not the retrieved account ID is included in the access control list of the file indicated by the file name51, and denies the access when the account ID is not included in the access control list. When the account ID is included in the access control list, the access control unit125further determines whether or not to permit the access, on the basis of the access right recorded in association with the retrieved account ID, and the access contents53.

In the case where the file access request is that illustrated inFIG. 5B, in which only an access control list is requested as an access target, the access control unit125carries out the same process as that described above except for the part carried out when the retrieved account ID is included in the access control list of the access target file. When the retrieved account ID is included in the access control list, the access control unit125determines whether or not to permit the access, on the basis of the access right recorded in association with the account ID, and the change contents55.

In the case where the file access request is that illustrated inFIG. 5C, in which both a file main body and an access control list are requested as access targets, the access control unit125carries out the same process as that described above except for the part carried out when the retrieved account ID is included in the access control list of the access target file. When the retrieved account ID is included in the access control list, the access control unit125determines whether or not to permit the access, on the basis of the access right recorded in association with the account ID, the access contents53, and the change contents55. Specifically, the access control unit125permits the access when both the process indicated by the access contents53and the process indicated by the change contents55can be performed with the recorded access right, and denies the access otherwise. The details of the function (1) are as described above.

(2) The function of, when a file access request is that illustrated inFIG. 5A, in which only a file main body is requested as an access target, carrying out a process based on the access contents53on the file main body of the file having the file name51, and returning the process result to the request source.

(3) The function of, when a file access request is that illustrated inFIG. 5B, in which only an access control list is requested as an access target, instructing the access control list change unit (ACL change unit)126to execute a process of changing the access control list, and the function of returning the process result to the request source. The access control list change unit126has the function of retrieving all the account IDs recorded in association with the account name54from the account association table stored in the account association table storage unit132, and the function of changing the access control entry in which each retrieved account ID is recorded among the access control entries included in the access control list of the file indicated by the file name51, in accordance with the change contents55. When the change contents55indicate addition of an access control entry, an access control entry in which the account ID and a corresponding access right are recorded is created for each retrieved account ID in the access control list. The access right is included in the change contents55.

(4) The function of, when a file access request is that illustrated inFIG. 5C, in which both a file main body and an access control list are requested as access targets, carrying out the above processes (2) and (3) and returning the process results to the request source.

The functions of the access control unit125are described above. The access control unit225of the node2has the same functions as those of the access control unit125.

The file registration unit127of the node1has the function of, upon receipt of a file registration request from the node4or the node5functioning as a client, extracting the account name of the file creator from the file metadata311(seeFIG. 2) of the registration target file, the function of retrieving all the account IDs recorded in association with the extracted account name, from the account association table stored in the account association table storage unit132, and the function of creating, for each retrieved account ID, an access control entry in which the account ID and the preset access right (e.g., ALL) of the file creator are recorded, in the access control list312. The file registration unit227of the node2has the same functions as those of the file registration unit127.

The node1can be implemented by a computer. In the case of implementing the node1by a computer, an example of the configuration is as follows: prepare a disk, a semiconductor memory, or any other recording medium in which a program for causing the computer to function as the account management unit121, the account association table management unit122, the authentication unit123, and the file system124is recorded; and cause the computer to read the program. The computer can implement, in the computer itself, the account management unit121, the account association table management unit122, the authentication unit123, and the file system124by controlling the operation of itself in accordance with the read program. Similarly, the node2can be implemented by a computer as in the case of the node1.

Referring toFIG. 6, the node4, which functions as a client, includes a transmission/reception unit41, a control unit42, an input unit43such as a keyboard, and a display unit44such as an LCD. The transmission/reception unit41has the function of transmitting and receiving data via the network NW.

The control unit42includes an account creation request unit421, an authentication request unit422, a file registration request unit423, and a file access unit424.

The account creation request unit421has the function of creating an account creation request including an account name and a password, in accordance with an instruction by a user U4, and transmitting the account creation request to the node specified by the user U4.

The authentication request unit422has the function of transmitting an authentication request including an account name and a password, to the node1in accordance with an instruction by the user U4. When the node1is facing failure, the authentication request unit422transmits the authentication request to the node2.

The file registration request unit423has the function of transmitting a file registration request including a registration target file, to the node1in accordance with the instruction by the user U4. When the node1is facing failure, the file registration request unit423transmits the file registration request to the node2.

The file access unit424has the function of transmitting the file access request illustrated inFIG. 5A, 5B, or5C, to the node1in accordance with an instruction by the user U4. When the node1is facing failure, the file access unit424transmits the file access request to the node2. A determination method employed to determine whether or not the node1is facing failure may be one determining that the node1is facing failure when a request to the node1is denied a certain number of times in succession, or one determining that the node1is facing failure when a signal indicating normal operation is not received from the node1, for example.

The node5has the same configuration as that of the node4. The node4can be implemented by a computer. In the case of implementing the node4by a computer, an example of the configuration is as follows: prepare a disk, a semiconductor memory, or any other recording medium in which a program for causing the computer to function as the account creation request unit421, the authentication request unit422, the file registration unit423, and the file access unit424is recorded; and cause the computer to read the program. The computer can implement, in the computer itself, the account creation request unit421, the authentication request unit422, the file registration unit423, and the file access unit424by controlling the operation of itself in accordance with the read program.

Next, operation in this exemplary embodiment is described in detail.

First, description is given of operation in the case where the user U4of the node4creates an account with the account name “A” in each of the nodes1and2.

The user U4inputs an account creation instruction including the account name “A”, the password “PA”, and the destination “node1”, from the input unit43of the node4. In response to the input, the account creation request unit421transmits an account creation request including the account name “A” and the password “PA”, to the node1(Step S701inFIG. 7).

Upon receipt of the account creation request, the account management unit121of the node1generates the account ID “IDA1” for uniquely identifying the account at the node1itself (Step S702inFIG. 7and Step S81inFIG. 8). Then, the account management unit121generates account information including the generated account ID “IDA1” as well as the account name “A” and the password “PA” in the account creation request, and stores the account information in the account information storage unit131(Step S703inFIG. 7and Steps S82and S83inFIG. 8).

In addition to the above, the account management unit121passes an account association table registration request including the account name “A” and the account ID “IDA1” to the account association table management unit122(Step S84inFIG. 8). In response to the request, the account association table management unit122stores the account name “A” and the account ID “IDA1” in association with each other in the account association table storage unit132(Step S704inFIG. 7).

After the above, the account management unit121transmits the account association table registration request including the account name “A” and the account ID “IDA1” to the node2(Step S705inFIG. 7and Step S85inFIG. 8). Upon receipt of the account association table registration request from the node1, the account association table management unit222of the node2stores the account name “A” and the account ID “IDA1” in association with each other in the account association table storage unit232(Step S706inFIG. 7).

In order to create an account with the account name “A” also in the node2, the user U4of the node4inputs an account creation instruction including the account name “A”, the password “PA”, and the destination “node2” from the input unit43. In response to the input, the account creation request unit421transmits an account creation request including the account name “A” and the password “PA”, to the node2(Step S707inFIG. 7).

Upon receipt of the account creation request, the account management unit221of the node2generates the account ID “IDA2” for uniquely identifying the account at the node2itself (Step S708inFIG. 7and Step S81inFIG. 8). Then, the account management unit221generates account information including the generated account ID “IDA2” as well as the account name “A” and the password “PA” in the account creation request, and stores the account information in the account information storage unit231(Step S709inFIG. 7and Steps S82and S83inFIG. 8). Thereafter, the account management unit221passes an account association table registration request including the account name “A” and the account ID “IDA2” to the account association table management unit222(Step S84inFIG. 8). In response to the request, the account association table management unit222stores the account name “A” and the account ID “IDA2” in association with each other in the account association table storage unit232(Step S710inFIG. 7).

After the above, the account management unit221transmits the account association table registration request including the account name “A” and the account ID “IDA2” to the node1(Step S711inFIG. 7and Step S85inFIG. 8). Upon receipt of the account association table registration request from the node2, the account association table management unit122of the node1stores the account name “A” and the account ID “IDA2” in association with each other in the account association table storage unit132(Step S712inFIG. 7).

In the case where a user U5of the node5creates an account with the account name “B” in each of the nodes1and2, the same process as that described above is carried out. Through these processes, the contents of the account information storage units131and231correspond to those illustrated inFIGS. 3A and 3Band the contents of the account association table storage units132and232correspond to those illustrated inFIGS. 4A and 4B.

Next, description is given of operation in the case where the user U4of the node4registers a file in the shared storage3by using the account created in the node1with the account name “A”.

The user U4inputs the account name “A” and the password “PA” to the authentication request unit422from the input unit43of the node4. In response to the input, the authentication request unit422transmits an authentication request to the node1.

The authentication unit123of the node1compares the account name “A” and the password “PA” in the authentication request received from the node4, with the account information stored in the account information storage unit131(Step S91inFIG. 9). When the matching is successful (Yes in Step S92), the authentication unit123permits the node4to use the file system124(Step S93); when the matching fails (No in Step S92), the authentication unit123denies the use (Step S94).

When the use of the file system124is permitted, the user U4of the node4inputs a file registration instruction including, for example, the file name of a registration target file using the input unit43. In response to the input, the file registration request unit423transmits a file registration request including the registration target file to the node1.

Upon receipt of the file registration request from the node4, the file registration unit127of the node1first stores the registration target file in the shared storage3(Step S101inFIG. 10). Then, the file registration unit127extracts the account name of the file creator from the file metadata of the file and retrieves all the account IDs recorded in association with the extracted account name, from the account association table storage unit132(Steps S102and S103). For example, assume that the account name of the file creator is “A” and the contents of the account association table storage unit132are those illustrated inFIG. 4A. In this case, the account IDs “IDA1” and “IDA2” are retrieved. Thereafter, the file registration unit127generates, for each retrieved account ID, an access control entry including the account ID and the preset access right (e.g., ALL) of the file creator, and stores the generated account control entry in the access control list (Step S104). Through the above process, an access control list as that presented inFIG. 11, for example, is created.

Next, description is given of operation in the case where the user U4of the node4accesses a file in the shared storage3by using the account created in the node1with the account name “A”.

First, the user U4transmits an authentication request to the node1via the authentication request unit422of the node4. When the authentication unit123of the node1permits the use of the file system124, the file access unit424creates the file access request illustrated inFIG. 5A, 5B, or5C in accordance with an instruction input from the input unit43by the user U4and transmits the file access request to the node1.

Upon receipt of the file access request, the access control unit125of the node1determines whether or not to permit the file access, by referring to the access control list of the file indicated by the file name51in the file access request (Step S1201inFIG. 12).

When determining not to permit the access (No in Step S1202), the access control unit125notifies the node4, which is the request source, of having no access right (Step S1211) and thereafter terminates the process. In contrast, when determining to permit the access (Yes in Step S1202), the access control unit125further determines whether or not the file access request includes change of the access control list (Step S1203). This determination is made on the basis of whether or not the “account name54of the account for which each corresponding access control entry is to be changed” and the “change contents55for the access control list” are included in the file access request.

When determining that change of the access control list is included (Yes in Step S1203), the access control unit125instructs the access control list change unit126to execute an access control list change process (Step S1204).

In response to the instruction, the access control list change unit126retrieves account IDs recorded in association with the account name54of the account for which each corresponding access control entry is to be changed, from the account association table storage unit132(Step S131inFIG. 13), and changes the access control entry in which any of the retrieved account IDs is recorded, in accordance with the change contents55(Step S132). Thereafter, the access control list change unit126returns the process result to the access control unit125(Step S133).

Here, assume, for example, that the contents of the account association table storage unit131are those illustrated inFIG. 4Aand the change target access control list is that illustrated inFIG. 11. In addition to these, assume, for example, that the account name54of the account for which each corresponding file access control entry is to be changed in the file access request is “B” and the change contents55for the access control list indicate “add an access control entry having READ as the access right”. In this case, the access control list change unit126carries out the following process. In Step S131, the access control list change unit126retrieves the account IDs “IDB1” and “IDB2” recorded in association with the account name “B”, from the account association table storage unit132. In Step S132, an access control entry having the account ID “IDB1” and the access right “READ” and an access control entry having the account ID “IDB2” and the access right “READ” are added to the access control list. As a result of this, the contents of the access control list are changed to those illustrated inFIG. 14A.

Assume, for example, that the contents of the account association table storage unit131are those illustrated inFIG. 4Aand the change target access control list is that illustrated inFIG. 14A. In addition to these, assume, for example, that the account name54of the account for which each corresponding file access control entry is to be changed in the file access request is “B” and the change contents55for the access control list indicate “change the access right to WRITE”. In this case, the access control list change unit126carries out the following process. In Step S131, the access control list change unit126retrieves the account IDs “IDB1” and “IDB2” recorded in association with the account name “B”, from the account association table storage unit132. In Step S132, the access right in each access control entry including any of the account IDs “IDB1” and “IDB2” is changed to “WRITE”. As a result of this, the contents of the access control list are changed to those illustrated inFIG. 14B.

Assume, for example, that the contents of the account association table storage unit132are those illustrated inFIG. 4Aand the change target access control list is that illustrated inFIG. 14B. In addition to these, assume, for example, that the account name54of the account for which each corresponding access control entry is to be changed in the file access request is “B” and the change contents for the access control list indicate “delete an access control entry”. In this case, the access control list change unit126carries out the following process. In Step S131, the access control list change unit126retrieves the account IDs “IDB1” and “IDB2” recorded in association with the account name “B”, from the account association table storage unit132. In Step S132, each access control entry having any of the account IDs “IDB1” and “IDB2” is deleted from the access control list. As a result of this, the contents of the access control list are changed to those illustrated inFIG. 14C.

When the process result returned from the access control list change unit126indicates failure (Step S1205), the access control unit125returns a response indicating process failure, to the node4, which is the request source, (Step S1210) and thereafter terminates the process.

In contrast, when the process result returned from the access control list change unit126indicates success (Yes in Step S1205), the access control unit125determines whether or not the file access request received from the node4includes a process for the file main body (Step S1206). This determination is made on the basis of whether or not the file access request includes the “access contents53for the file main body”.

When the file access request does not include the “access contents53for the file main body” (No in Step S1206), the access control unit125returns a response indicating process success, to the node4, which is the request source, (Step S1209) and thereafter terminates the process. When the file access request includes the “access contents53for the file main body” (Yes in Step S1206), the access control unit125carries out the process based on the “access contents53for the file main body” in the file access request (Step S1207). Note that the process in Step S1207is carried out even when the determination result in Step S1203is No.

When the process is successful (Yes in Step S1208), the access control unit125returns a response indicating process success, to the node4, which is the request source, (Step S1209) and thereafter terminates the process. In contrast, when the process fails (No in Step S1208), the access control unit125returns a response indicating process failure, to the node4, which is the request source, (Step S1210) and thereafter terminates the process.

When receiving a response indicating process failure, the node4transmits the file access request to the node1again. When receiving a response indicating process failure a certain number of times in succession, the node4determines that the node1is facing failure, and carries out, for the node2, the same process as that carried out for the node1. This can increase the availability of file servers.

In the above-described exemplary embodiment, a file is used as the object for which access control is performed using an access control list. However, the object is not limited to this and may be a different object such as a folder. Moreover, in the above-described exemplary embodiment, the number of nodes functioning as file servers is two. However, the number of nodes may be three or more.

Effects of First Exemplary Embodiment

According to this exemplary embodiment, the following effect can be obtained: change operation can be facilitated even when an access control list of a file (object) accessible from multiple nodes by using the same account name is to be changed in a network system in which nodes individually manage accounts.

The reason is as follows. Upon input of a file access request including the account name of the account for which each corresponding access control entry is to be changed and change contents, the account IDs recorded in association with the account name are retrieved from the account association table storage unit, and each access control entry in which any of the retrieved account IDs is recorded among the account control entries in the change target access control list is changed in accordance with the change contents.

According to this exemplary embodiment, the effect of being able to easily create an account association table can be obtained.

The reason is as follows. Upon input of an account creation request including the account name of an account to be created, the first node generates an account ID that uniquely identifies the account to be created at the node itself, and stores, in association with each other, the generated account ID and the account name in the account creation request, in the account association table storage unit in the node itself. Upon receipt of an account association table registration request from the second node, the first node stores, in association with each other, the account ID and the account name included in the request, in the account association table storage unit in the node itself. Upon input of an account creation request including the account name of an account to be created, the second node generates an account ID that uniquely identifies the account to be created at the node itself, and transmits an account association table registration request including the account ID and the account name in the account creation request, to the node1.

In addition to the above, according to this exemplary embodiment, the effect of providing a network system with enhanced availability can be obtained.

The reason is that the third node functioning as a client transmits a file access request to the first node when the first node is operating normally, and transmits a file access request to the second node when the first node is facing failure.

According to this exemplary embodiment, the effect of being able to automatically create an access control list of a file accessed from multiple nodes, at the time of creating the file can be obtained.

The reason is as follows. Upon receipt of a file registration request, the account IDs recorded in association with the account name of the file creator are retrieved from the account association table storage unit, and each access control entry in which any of retrieved account IDs and the preset access right are recorded in association with each other is created in the access control list of the registration target file.

Second Exemplary Embodiment

Next, a network system according to a second exemplary embodiment of the present invention is described.

Referring toFIG. 15, a network system according to this exemplary embodiment includes a first node100, a second node200, and access control lists301-1to301-N. The access control lists301-1to301-N are access control lists of respective objects300-1to300-N shared by the first node100and the second node200, and each include access control entries in each of which the account ID and the access right of an account permitted to access the object is recorded.

The first node100includes an account association table101and an account control list change unit102.

In the account association table101, the account name and the account ID of each account created at the node100itself are recorded in association with each other, and the account name and the account ID of each account created at the second node200are recorded in association with each other.

In response to an access control list change request including identification information on an object the access control list of which is to be changed, the account name of the account for which each corresponding access control entry is to be changed, and change contents, the access control list change unit102retrieves the account IDs recorded in association with the account name in the access control list change request, from the account association table101. Thereafter, the access control list change unit102changes each access control entry in which any of the retrieved account IDs is recorded and that is included in the access control list of the object indicated by the identification information, in accordance with the change contents.

Effects of Second Exemplary Embodiment

According to this exemplary embodiment, the following effect can be obtained: change operation can be facilitated even when an access control list of an object accessible from multiple nodes by using the same account name is to be changed in a network system in which nodes individually manage accounts.

The reason is as follows. Upon input of an access control list change request including the account name of the account for which each corresponding access control entry is to be changed and change contents, the account IDs recorded in association with the account name are retrieved from the account association table, and each access control entry in which any of the retrieved account IDs is recorded among the account control entries in the change target access control list is changed in accordance with the change contents.

The program described in the above exemplary embodiments and the like may be stored in a storage or recorded in a computer-readable recording medium. For example, the recording medium may be a portable medium such as a flexible disk, an optical disk, a magneto-optical disk, or a semiconductor memory.

The invention of the present application is described above by referring to the above-given exemplary embodiments. However, the invention of the present application is not limited to the above-described exemplary embodiments. Various changes that can be understood by those skilled in the art within the scope of the invention of the present application may be made to the configuration and details of the invention of the present application.

Note that the present invention is intended to benefit from the priority claim based on Japanese Patent Application No. 2013-016834 filed on Jan. 31, 2013 in Japan, the entire contents of which patent application are incorporated herein.

REFERENCE SIGNS LIST