Patent ID: 8595256

Claim:
An access list conversion device that is connected to a resource database in which the state of a resource as an access target is recorded and updates an access control rule using an access control list, which is a collection of rules used to control access to the resource, the device comprising: a temporary storage hardware-implemented unit that stores in advance a “permission rule” providing that an actor, which is a target of the access control, can access the resource and a “prohibition rule” providing that the actor cannot access the resource; an already-existing rule judgment hardware-implemented unit that reads out a rule from the access control list accepted and judges whether the readout rule is contained in the permission and prohibition rules stored in advance in the temporary storage hardware-implemented unit; a first rule judgment hardware-implemented unit that records the readout rule in the temporary storage hardware-implemented unit when a judgment result shows that the readout rule is not contained and when the readout rule is a permission rule; a second rule judgment hardware-implemented unit that makes, when a judgment result shows that the readout rule is not contained and when the readout rule is a prohibition rule, a determination as to whether the prohibition rule conflicts with the permission rule stored in the temporary storage hardware-implemented unit, and stores, when the prohibition rule does not conflict, the prohibition rule in the temporary storage hardware-implemented unit; and a resource expansion hardware-implemented unit that converts, when the result of judgment by the second rule judgment hardware-implemented unit shows that the prohibition rule conflicts, the prohibition rule to a prohibition rule by removing access target resources written in the permission rule from access target resources written in the prohibition rule on the basis of resource information of the resource database and stores the prohibition rule in the temporary storage hardware-implemented unit.