Patent ID: 8011006

Claim:
An access controller for controlling access to control target resources by a program, comprising: a function access detection unit implemented by a computer processor which detects loading of a control target function from the program and generates identification information necessary when a kernel specifies a system call for function load notification issued from the detected control target function; a function access control unit which obtains a function name of the control target function and information regarding a loading origin process of the control target function to determine permission of loading of the control target function based on function permission access control rules indicating whether a function is a control target function permitted to be loaded or not, the function permission access control rules including a conditional permission rule for permitting function loading under a condition of specific processing; an addition processing unit which executes predefined processing indicated by the conditional permission rule when loading of the control target function is permitted by the conditional permission rule; and a resource access control unit which obtains a system call to the control target resources from the program and determines permission of access of the system call based on the identification information and resource access control rules constituted of information of the control target resources, information of the program of an access request origin, the identification information, and a group of permitted operations, wherein the function access detection unit generates the identification information when the loading of the control target function is permitted by the function access control unit, the function access detection unit detects loading of the control target function based on receiving the system call for function load notification, the system call for function load notification including an address offset and a size of execution code of the control target function, and the function access detection unit generates the identification information by calculating a stored address range of execution code of the control target function based on the address offset and the size of the execution code.