Patent ID: 8613042

Claim:
An access control list conversion system comprising: hardware, including a processor; a reading unit implemented at least by the hardware and configured to be supplied with an access control list including at least one access control rule and to read the access control rule described in the access control list, the access control rule being a set of an access target resource to be accessed, an accessing actor user who accesses the access target resource, and an access right, the access right defining whether to permit or prohibit the access of the accessing actor user to the access target resource; a first rule judgment unit implemented at least by the hardware and configured to judge whether the read access control rule is a permission rule or a prohibition rule, the permission rule permitting the access of the accessing actor user to the access target resource, the prohibition rule prohibiting the access of the accessing actor user to the access target resource; a storage unit implemented at least by the hardware and configured to store the access control rule which is judged to be the permission rule by the first rule judgment unit; a second rule judgment unit implemented at least by the hardware and configured to judge whether the accessing actor user of the access control rule which is judged to be the prohibition rule is the same as the accessing actor user of the access control rule stored in the storage unit and whether the access target resource of the access control rule which is judged to be the prohibition rule includes the access target resource of the access control rule stored in the storage unit; a database implemented at least by the hardware and configured to store resource information in which all of the latest information of the access target resource is systematically recorded from a superordinate concept to a subordinate concept; and a resource expansion unit implemented at least by the hardware and configured to remove, with reference to the resource information, the access target resource described in the access control rule which is stored in the storage unit from the access target resource of the access control rule which is judged to be the prohibition rule, in the case where the second rule judgment unit judges that the accessing actor user of the access control rule which is judged to be the prohibition rule is the same as the accessing actor user of the access control rule stored in the storage unit and that the access target resource of the access control rule which is judged to be the prohibition rule includes the access target resource of the access control rule stored in the storage unit.