Access management system and access management method

Abstract

To provide an access management system and an access management method with improved safety.SOLUTION: An access management system includes an isolated environment generated on a cloud and an authentication device that performs authentication based on accounts to determine whether or not access to the isolated environment is permitted. The accounts include a management-side account and a development-side account. The isolated environment is divided into a management-side account area that is accessed via a first network by a manager with the management-side account and has cloud components that are subjectively viewed and operated by the manager, and a development-side area that is accessed via a second network by a user with the development-side account and has cloud components that are subjectively viewed and operated by the user.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to an access management system and an access management method. [Background technology]

[0002] In recent years, cloud services have come into widespread use. In cloud services, the organization that manages the system that provides the cloud service is different from the organization that uses the system. This may require customization of the system, measures against information leakage, etc. For example, Patent Document 1 discloses a technique that provides access to a custom execution environment for the execution of custom executable instructions (e.g., custom code) in a cloud computer system. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Special Publication No. 2017-505483 Summary of the Invention [Problem to be solved by the invention]

[0004] Here, Patent Document 1 describes that the custom execution environment becomes an isolated environment that is secure in terms of security by adjusting access permissions, etc. However, the security of the custom execution environment depends on the security knowledge of the executor (e.g., the developer of the custom code, etc.). Therefore, there is a demand for a safer system environment that can take into account the developer's level of security knowledge, etc.

[0005] In view of the above circumstances, an object of the present disclosure is to provide an access management system and an access management method with improved security. [Means for solving the problem]

[0006] (1) An access management system according to an embodiment of the present disclosure includes: An isolated environment generated on the cloud; an authentication device that performs authentication based on an account and determines whether or not access to the isolated environment is permitted; The accounts include an administrative account and a developer account; The isolated environment is divided into a management side area having cloud components that are accessed via a first network by an administrator having the management side account and are actively viewed and operated by the administrator, and a development side area having cloud components that are accessed via a second network by a user having the development side account and are actively viewed and operated by the user. This configuration can improve safety.

[0007] (2) As an embodiment of the present disclosure, in (1), The isolated environment is configured on a project-by-project basis, The authentication device permits the authenticated user to access the developer area of ​​the isolated environment for a specific project. With this configuration, an isolated environment is created for each individual or group of users, rather than a comprehensive isolated environment for each organization, thereby making it possible to further improve security.

[0008] (3) As an embodiment of the present disclosure, in (1) or (2), the first network is the Internet, The developer area is configured as a first developer area, which is an environment in which the gateway to the Internet is closed, or a second developer area, which is an environment having a gateway to the Internet in which communication contents and connection destinations are restricted. This configuration allows the Internet connection to be managed according to the user's level of security knowledge, further enhancing safety.

[0009] (4) As an embodiment of the present disclosure, in (3), The cloud component in the management side domain includes a reverse proxy relay function, The reverse proxy relay function operated by the administrator limits connection destinations of the second development side domain. This configuration allows the administrator to appropriately manage Internet connections.

[0010] (5) As an embodiment of the present disclosure, in any one of (1) to (4), The cloud components in the management side domain are set so that they cannot be viewed or operated by the user. This configuration can prevent the management area from being mistakenly operated by the user.

[0011] (6) An access management method according to an embodiment of the present disclosure includes: An access management method executed in an access management system having an isolated environment generated on a cloud, comprising: performing authentication based on an account to determine whether or not access to the isolated environment is permitted; The accounts include an administrative account and a developer account; The isolated environment is divided into a management side area having cloud components that are accessed via a first network by an administrator having the management side account and are actively viewed and operated by the administrator, and a development side area having cloud components that are accessed via a second network by a user having the development side account and are actively viewed and operated by the user. This configuration can improve safety. Effect of the Invention

[0012] According to the present disclosure, it is possible to provide an access management system and an access management method with improved security. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a diagram illustrating a configuration example of an access management system according to an embodiment of the present disclosure. [Diagram 2] FIG. 2 is a diagram showing the division of operations on cloud components by accounts. [Diagram 3] FIG. 3 is a diagram illustrating a development and implementation flow for using an access management system according to one embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Hereinafter, an access management system according to an embodiment of the present disclosure will be described with reference to the drawings. FIG. 1 is a diagram showing a configuration example of the access management system. The access management system includes an isolated environment generated on a cloud and an authentication device. The isolated environment is a virtual environment constructed in a protected space, and is a so-called sandbox. In the isolated environment, for example, a tool such as a new application can be executed without affecting other users of cloud services. The authentication device is a device that performs authentication based on an account when an access request to the isolated environment is made from a terminal device via the Internet, and determines whether or not access to the isolated environment is permitted. The authentication device may be realized, for example, by one or more computers. The authentication device is capable of accessing a database that accumulates information on users who have accounts. In the database, for example, a user name, a project to be described later, and an account are accumulated in association with each other.

[0015] As shown in FIG. 1, the access management system according to the present embodiment uses a cloud service. The cloud service is used by multiple organizations, and in part of the cloud service, an isolated environment for a specific organization (sandbox for a specific organization) may be constructed. In the present embodiment, the organization is described as a company, but is not limited to this. The cloud service provides cloud components, which are a group of resources available on the cloud. The group of resources may include, for example, tools, data, algorithms, and UI (User Interface) used in the tools, and may include service functions. One example of the service function is a reverse proxy relay function. Here, a mechanism for connecting an entrance from one development side area (details of the development side area will be described later) to another development side area while setting restrictions, implemented by a proxy server or a firewall, is called a "reverse proxy." The cloud components may be used by users, or customized to suit the use of a specific organization.

[0016] Conventionally, when an isolated environment is generated and used on a cloud, a comprehensive isolated environment (sandbox for a specific organization in FIG. 1) is generated for each organization, and users belonging to the organization often use one isolated environment according to their respective access rights. Therefore, when a user with little knowledge about security uses an isolated environment for each organization, there is a risk that information may be leaked due to a vulnerability, or a tool executed in the isolated environment may malfunction or go out of control, adversely affecting other users. In the access management system according to the present embodiment, the security can be improved by taking into account the user's level of knowledge about security, etc., by using the configuration described later. In the following description, the user is assumed to be a developer who develops cloud components. The developer may have a lot of knowledge about security, or may not. The administrator is an individual who manages the access management system and has sufficient knowledge about security.

[0017] As shown in FIG. 1, in the access management system according to this embodiment, the isolation environment is configured on a project basis (see project Pa, project Pb, and project Pc in FIG. 1). A project is a unit indicating a group within an organization, and may correspond to, for example, a product development or an organization to which a user belongs. Furthermore, the authentication device permits an authenticated user to access the isolation environment of a specific project. Security can be improved by constructing isolation environments on a project basis (in other words, individual or group basis of users) that are independent of each other, rather than a comprehensive isolation environment on an organizational basis.

[0018] Here, the accounts include a management account and a developer account. The administrator has a management account. The authentication device determines that the person requesting access is the administrator based on the management account. Furthermore, the user (a developer in this embodiment) has a developer account. The authentication device determines that the person requesting access is a developer based on the developer account. Furthermore, the authentication device identifies each developer based on user information in the database, authenticates whether or not they can access, and determines which projects a developer authenticated as having access can access.

[0019] The isolated environment is divided into an administration side area and a development side area. As shown in FIG. 1, each of the isolated environments for each project has an administration side area and a development side area. The administration side area has cloud components that are accessed by an administrator via a first network and are viewed and operated by the administrator. The development side area is accessed by a user (developer) having a development side account via a second network and is viewed and operated by the user. Here, the first network is the Internet. The second network is a line other than the Internet, for example, a VPN (Virtual Private Network). A developer authenticated by an authentication device develops customization of cloud components in a limited environment within the development side area of ​​the isolated environment of a specific project. Therefore, even if the above-mentioned leakage, malfunction, or runaway occurs, it does not affect users of other projects, and safety in development can be improved.

[0020] Here, the development side area may be configured as a first development side area, which is an environment in which the entrance and exit to the Internet is closed, or a second development side area, which is an environment in which the entrance and exit to the Internet is restricted in terms of communication content and connection destination. For example, for a developer with little knowledge about security, an isolated environment may be set as one project that other developers do not access, and the development side area of ​​the isolated environment may be the first development side area (an environment without Internet connection). By having a developer with little knowledge about security use the first development side area, it is possible to prevent accidents such as leakage, malfunction, or runaway. In addition, for a developer with a lot of knowledge about security, an isolated environment may be set as one project, and the development side area of ​​the isolated environment may be the second development side area. A developer with a lot of knowledge about security can freely verify the operation of a tool under development in an environment where Internet connection is partially possible. By selecting the first development side area or the second development side area for each project according to the developer's level of knowledge about security and managing the Internet connection, it is possible to further improve safety.

[0021] In addition, restrictions on the Internet connection destination in the second development side area may be set by an administrator. For example, the source of access to the entrance from the Internet of the second development side area may be restricted by a relay function of a reverse proxy with authentication. Specifically, a cloud component in the management side area may include a reverse proxy relay function, and the connection destination of the second development side area may be restricted by the reverse proxy relay function operated by the administrator. In addition, the communication content and the access destination of the exit to the Internet of the second development side area may also be restricted by, for example, a firewall function. The Internet connection of the development side area may be appropriately managed by an administrator using a cloud component in the management side area.

[0022] Referring again to FIG. 1, for example, the development side areas of projects Pa to Pc are independent from each other and cannot be accessed by each other. In the example of FIG. 1, the development side area of ​​project Pc is an environment in which the entrance and exit to the Internet is blocked (i.e., the first development side area). In addition, each developer uses the cloud service using terminal devices Da to Dd in an internal network (e.g., an intranet), for example. In the example of FIG. 1, when a developer associated with project Pa requests access from terminal device Da, the authentication device authenticates based on the account and allows the developer to access the development side area of ​​project Pa. In addition, when a developer associated with project Pc requests access from terminal device Db, the authentication device authenticates based on the account and allows the developer to access the development side area of ​​project Pc, which is an environment in which the entrance and exit to the Internet is blocked. In addition, when a developer not associated with any project requests access from terminal device Dc, the authentication device denies the access. Here, the operation of cloud components that can be set or instructed to execute processing based on an authentication function separately provided in the cloud is not included in the scope of processing by the authentication device (see terminal device Dd in FIG. 1).

[0023] FIG. 2 shows the classification of operations on cloud components by account. The administrator is the one who views and operates the first network and the reverse proxy relay function in the management side area. The administrator is also able to access the second network and data in the development side area, but is not basically involved. The authenticated developer is the one who views and operates the data in the development side area. In other words, since the development side area is configured as an isolated environment with safety in mind as described above, the developer can freely modify data and UI, execute algorithms, etc. in the accessible development side area. However, the developer is able to view the second network, but cannot perform operations such as modification. The first network and the cloud components (the reverse proxy relay function in the example of FIG. 2) of the management side area are set so that they cannot be viewed or operated by the developer. Therefore, it is possible to prevent the management side area from being operated by the developer by mistake.

[0024] Moreover, an access management method may be executed in the access management system according to the present embodiment. The access management method includes a process in which an authentication device performs authentication based on an account and determines whether or not access to the isolated environment is permitted. The method of determination based on the account is as described above.

[0025] The access management system according to the present embodiment is used, for example, in the development of new or customized cloud components by a developer. In the following description, it is assumed that the developed cloud components are new tools.

[0026] FIG. 3 is a diagram illustrating a flow of development and implementation of a new tool using the access management system according to the present embodiment. After a new tool is planned (step S1), the requirements and specifications of the new tool are defined (step S2). Before being implemented in a cloud environment, the prototype of the new tool is tested in an isolated environment (sandbox environment) generated as a project as described above (step S3). The sandbox environment is a closed environment or an environment with an entrance to the Internet with limited communication content and connection destination, so that the test can be safely performed without worrying about runaway. If review is required as a result of the test (Yes in step S4), the specification is revised by returning to step S2. The processes of steps S2 to S4 are repeated as necessary. If review is no longer required (No in step S4), the new tool is implemented in a cloud environment (step S5). By performing operation verification of the prototype of the new tool in a sandbox environment, the timing of the verification work can be accelerated compared to the conventional method in which verification is performed only after sufficient security measures are implemented, and the overall development period can be shortened.

[0027] As described above, the access management system and the access management method according to the present embodiment can enhance security by the above configuration. In particular, an isolated environment can be configured on a project-by-project basis, and projects can be divided according to the developer's level of security knowledge, thereby preventing accidents such as leaks, malfunctions, or runaways due to a low level of knowledge.

[0028] Although the embodiments of the present disclosure have been described based on the drawings and examples, it should be noted that those skilled in the art can easily make various modifications or corrections based on the present disclosure. Therefore, it should be noted that these modifications or corrections are included in the scope of the present disclosure. For example, the functions included in each component or each step can be rearranged so as not to be logically inconsistent, and multiple components or steps can be combined into one or divided. The embodiments of the present disclosure can also be realized as a program executed by a processor included in the device and a storage medium on which the program is recorded. It should be understood that these are also included in the scope of the present disclosure.

[0029] For example, the access management system may further include a management device that manages the isolated environments. The management device may be realized by the same computer as the authentication device or a different computer. The management device may use a cloud service tool to generate an isolated environment for each project on the cloud and delete unnecessary isolated environments (projects). For example, when the management device generates an isolated environment to be used by a developer with little knowledge about security, the management device may delete the isolated environment after a period of time (e.g., six months) when the developer's knowledge is assumed to have improved. At this time, the authority of the developer may be changed so that the developer can access the isolated environment of a project used by a developer with a lot of knowledge about security. The management device may reflect the creation and deletion of projects and new associations between users and projects in the database. Contribution to the Sustainable Development Goals (SDGs) led by the United Nations

[0030] The SDGs have been proposed to realize a sustainable society. One embodiment of the present disclosure is considered to be a technology that can contribute to "No. 9 Build infrastructure for industry and technological innovation."

Claims

1. An isolated environment generated on the cloud; an authentication device that performs authentication based on an account and determines whether or not access to the isolated environment is permitted; The accounts include an administrative account and a developer account; An access management system in which the isolated environment is divided into a management side area having cloud components that are accessed via a first network by an administrator having the management side account and are actively viewed and operated by the administrator, and a development side area having cloud components that are accessed via a second network by a user having the development side account and are actively viewed and operated by the user.

2. The isolated environment is configured on a project-by-project basis, The access management system according to claim 1 , wherein the authentication device permits the authenticated user to access the developer area of ​​the isolated environment for a specific project.

3. the first network is the Internet, The access management system of claim 1 or 2, wherein the development side area is configured as a first development side area which is an environment in which an entrance / exit to the Internet is blocked, or a second development side area which is an environment having an entrance / exit to the Internet with restricted communication content and connection destinations.

4. The cloud component in the management side domain includes a reverse proxy relay function, The access management system according to claim 3 , wherein a connection destination of the second development side domain is restricted by the reverse proxy relay function operated by the administrator.

5. The access management system according to claim 1 , wherein the cloud components in the management side domain are set so as not to be viewable or operable by the user.

6. An access management method executed in an access management system having an isolated environment generated on a cloud, comprising: performing authentication based on an account to determine whether or not access to the isolated environment is permitted; The accounts include an administrative account and a developer account; An access management method in which the isolated environment is divided into a management side area having cloud components that are accessed via a first network by an administrator having the management side account and are actively viewed and operated by the administrator, and a development side area having cloud components that are accessed via a second network by a user having the development side account and are actively viewed and operated by the user.

Images