Patent ID: 8621557

Claim:
An information processing system, comprising: a first information processing device configured to store a first object group; and a second information processing device configured to receive a manipulation request indicating a content of manipulation for a manipulation target object from a subject to operate said manipulation target object based on said manipulation request, wherein said second information processing device comprises: an access control policy storing section configured to access an access control policy that indicates a relationship between each second object included in a second object group and a control rule indicating permitted manipulation content for said each second object; and a data processing section configured to judge whether or not said manipulation request is feasible, wherein said first information processing device comprises: an additional control policy storing section configured to indicate a changed object group with respect to each of first objects included in said first object group, wherein said changed object group is a group of said second objects to which same control rule as said each first object is applied, and wherein said data processing section comprises: a changed object group determination section configured to refer to said additional access control policy storing section when said manipulation target object is included in said first object group, and obtain said changed object group corresponding to said manipulation target object; and an access control rejudging section configured to reference to said access control policy to judge whether or not said manipulation request is feasible for said each second object included in said changed object group and determine whether or not said manipulation request is feasible for said manipulation target object based on a judgment result, wherein said data processing device further comprises an access control section configured to refer to said access control policy to judge whether or not said manipulation target object is included in said second object group, and wherein said changed object group determination section obtains said changed object group when said manipulation target object is not included in said second object group.