Authorization server device, authorization system, authorization method, and authorization program

Abstract

The authorization server device (100) performs dynamic authorization of an authorization target, which is a user making an access. The authorization logic receiving unit (110) receives input of authorization logic data (31) including an access type indicating the type of access, an access unit indicating the unit of authorization for the access type, and an evaluation attribute which is an attribute to be evaluated for each access unit. The evaluation rule receiving unit (120) receives input of evaluation rule data (32) including the state of the evaluation attribute and an evaluation rule indicating the authorization condition for the state of the evaluation attribute. The generation unit (130) generates an authorization rule for performing dynamic authorization based on the authorization logic data (31) and the evaluation rule data (32).

Description

[Technical Field]

[0001] The present disclosure relates to an authorization server device, an authorization system, an authorization method, and an authorization program. [Background technology]

[0002] Trade secrets stored on-premise or in-house clouds are accessed from various environments, such as inside or outside the company, day or night, and domestically or overseas. Therefore, there is a demand for technology that can perform authorization and authentication in response to user access requests to these trade secrets, thereby reducing the risk of information leakage.

[0003] Patent Document 1 discloses a method for managing authorization rules in an ontology format for dynamic authorization adopted in zero trust security. In the method of Patent Document 1, a tree is created for each attribute used in evaluating authorization decisions as an ontology. The method of Patent Document 1 then refers to the tree according to the attribute information presented by the user to be authorized, and determines whether to grant authorization. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] International Publication No. 2022 / 149226 Summary of the Invention [Problem to be solved by the invention]

[0005] In the technology of Patent Document 1, the same evaluation conditions may appear in nodes on the ontology. Also, multiple ontologies may be created with the same upper-middle-lower structure, such as department-section-project or district-building-room. As such, when the amount of attribute information handled in the authorization process increases, there is a problem that the structure of the ontology, which is the authorization rule, becomes redundant.

[0006] The present disclosure aims to improve the readability and maintainability of authorization rules by generating authorization rules using information that abstracts authorization logic and evaluation conditions. [Means for solving the problem]

[0007] An authorization server device according to the present disclosure includes: an authorization logic receiving unit that receives an input of authorization logic data including an access type indicating a type of access to an authorization target of dynamic authorization, an access unit indicating a unit for performing authorization in the access type, and an evaluation attribute that is an attribute to be evaluated in the access unit; an evaluation rule receiving unit that receives input of evaluation rule data including the state of the evaluation attribute and an evaluation rule that indicates an authorization condition for the state of the evaluation attribute; The system further comprises a generating unit that generates an authorization rule for performing the dynamic authorization based on the authorization logic data and the evaluation rule data. [Effects of the Invention]

[0008] The authorization server device according to the present disclosure generates authorization rules based on authorization logic data and evaluation rule data. The authorization logic data is information that abstracts authorization logic, including an access type, an access unit, and an evaluation attribute. The evaluation rule data is information on evaluation conditions for each state of the evaluation attribute, including the state of the evaluation attribute and the evaluation rule. Therefore, according to the authorization server device according to the present disclosure, authorization rules are generated using information that abstracts the authorization logic and the evaluation conditions, thereby improving the readability and maintainability of the authorization rules. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 2 is a diagram showing a configuration example of an authorization server device according to the first embodiment. [Figure 2] FIG. 4 is a flowchart showing an ontology generation process in the authorization server device according to the first embodiment. [Figure 3]FIG. 2 is a diagram showing an example of the configuration of an authorization rule ontology, which is an example of an authorization rule according to the first embodiment. [Figure 4] FIG. 2 is a diagram showing an example of the configuration of an authorization logic ontology included in an authorization rule ontology according to the first embodiment. [Figure 5] FIG. 2 is a diagram showing an example of the configuration of an evaluation rule ontology included in an authorization rule ontology according to the first embodiment. [Figure 6] 4 is a flowchart showing an access permission determination process in the authorization server device according to the first embodiment. [Figure 7] FIG. 10 is a diagram showing a configuration example of an authorization server device according to a modification of the first embodiment. [Figure 8] FIG. 10 is a diagram showing a configuration example of an authorization server device according to a second embodiment. [Figure 9] FIG. 10 is a diagram showing an example of the configuration of an authorization logic ontology according to the second embodiment. [Figure 10] FIG. 10 is a flowchart showing a process for generating an authorization logic ontology according to the second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] The present embodiment will be described below with reference to the drawings. In each drawing, identical or corresponding parts are designated by the same reference numerals. In the description of the embodiment, the description of identical or corresponding parts will be omitted or simplified as appropriate. Arrows in the drawings mainly indicate the flow of data or the flow of processing. Furthermore, the sized relationships between components in the following drawings may differ from the actual relationships. Furthermore, in the description of the embodiment, directions or positions such as up, down, left, right, front, rear, front, and back may be indicated. These notations are provided for the convenience of explanation and do not limit the placement, direction, or orientation of devices, instruments, or parts.

[0011] Embodiment 1 ***Configuration Description*** FIG. 1 is a diagram illustrating an example of the configuration of an authorization server device 100 according to this embodiment. The authorization server device 100 generates an authorization rule ontology 61 as the authorization rule 60. The authorization server device 100 also receives an access request 51 to a resource of the file server 200 from a user who is an authorization target 20, and determines whether or not to permit the access. The file server 200 is where the resources of the authorization target 20 are stored. In FIG. 1, an example of a resource is a "document to be accessed." The file server 200 can be an on-premise server physically installed within an organization, or a server on the cloud. Although not shown, an authentication server that authenticates a user accessing the file server 200 may be provided separately from the authorization server device 100. In this case, the authentication result may be included in the access request and used as a condition for the authorization server device 100 to grant or deny access to the resource.

[0012] The authorization server device 100 is a computer. The authorization server device 100 includes a processor 910, as well as other hardware such as a memory 921, an auxiliary storage device 922, an input interface 930, an output interface 940, and a communication device 950. The processor 910 is connected to the other hardware via signal lines and controls the other hardware.

[0013] The authorization server device 100 includes, as functional elements, an authorization logic receiving unit 110, an evaluation rule receiving unit, a generation unit 130, an access request receiving unit 140, an access permission determination unit 150, and a storage unit 160. The storage unit 160 stores an authorization rule ontology 61. The authorization rule ontology 61 is an example of an authorization rule 60 for dynamic authorization of a user who is an authorization target 20.

[0014] The functions of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150 are realized by software. The storage unit 160 is provided in the memory 921. The storage unit 160 may be provided in the auxiliary storage device 922, or may be provided separately in the memory 921 and the auxiliary storage device 922.

[0015] The processor 910 is a device that executes an authorization program. The authorization program is a program that realizes the functions of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150. The processor 910 is an IC that performs arithmetic processing. Specific examples of the processor 910 are a CPU, a DSP, and a GPU. IC is an abbreviation for Integrated Circuit. CPU is an abbreviation for Central Processing Unit. DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.

[0016] The memory 921 is a storage device that temporarily stores data. Specific examples of the memory 921 are SRAM and DRAM. SRAM is an abbreviation for Static Random Access Memory. DRAM is an abbreviation for Dynamic Random Access Memory. The auxiliary storage device 922 is a storage device that stores data. A specific example of the auxiliary storage device 922 is a HDD. The auxiliary storage device 922 may also be a portable storage medium such as an SD (registered trademark) memory card, CF, NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. Note that HDD is an abbreviation for Hard Disk Drive. SD (registered trademark) is an abbreviation for Secure Digital. CF is an abbreviation for CompactFlash (registered trademark). DVD is an abbreviation for Digital Versatile Disk.

[0017] The input interface 930 is a port connected to an input device such as a mouse, keyboard, or touch panel. Specifically, the input interface 930 is a USB terminal. The input interface 930 may also be a port connected to a LAN. USB is an abbreviation for Universal Serial Bus. LAN is an abbreviation for Local Area Network. Although one input interface 930 is shown in FIG. 1, multiple input interfaces 930 may also be present.

[0018] The output interface 940 is a port to which a cable of an output device such as a display is connected. Specifically, the output interface 940 is a USB terminal or an HDMI (registered trademark) terminal. Specifically, the display is an LCD. The output interface 940 is also called a display interface. HDMI (registered trademark) is an abbreviation for High Definition Multimedia Interface. LCD is an abbreviation for Liquid Crystal Display. Although one output interface 940 is shown in FIG. 1, multiple output interfaces 940 may be present.

[0019] The communication device 950 has a receiver and a transmitter. The communication device 950 is connected to a communication network such as a LAN, the Internet, a telephone line, or Wi-Fi (registered trademark). Specifically, the communication device 950 is a communication chip or NIC. NIC is an abbreviation for Network Interface Card.

[0020] The authorization program is executed in the authorization server device 100. The authorization program is loaded into the processor 910 and executed by the processor 910. In addition to the authorization program, the memory 921 also stores an OS. OS is an abbreviation for Operating System. The processor 910 executes the authorization program while running the OS. The authorization program and the OS may be stored in an auxiliary storage device 922. The authorization program and the OS stored in the auxiliary storage device 922 are loaded into the memory 921 and executed by the processor 910. Note that part or all of the authorization program may be incorporated into the OS.

[0021] The authorization server device 100 may include multiple processors that replace the processor 910. These multiple processors share the execution of the authorization program. Each processor is a device that executes the authorization program, just like the processor 910.

[0022] Data, information, signal values ​​and variable values ​​used, processed or output by the authorized program are stored in memory 921, secondary storage device 922, or registers or cache memory within processor 910.

[0023] The "part" of each of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determination unit 150 may be interpreted as a "circuit," a "step," a "procedure," a "process," or a "circuitry." The authorization program causes a computer to execute an authorization logic reception process, an evaluation rule reception process, a generation process, an access request reception process, and an access permission determination process. The "processing" of the authorization logic reception process, the evaluation rule reception process, the generation process, the access request reception process, and the access permission determination process may be interpreted as a "program," a "program product," a "computer-readable storage medium storing a program," or a "computer-readable recording medium recording a program." The authorization method is a method performed by the authorization server device 100, which is a computer, executing the authorization program. The authorization program may be provided in a form stored in a computer-readable recording medium, or may be provided as a program product.

[0024] ***Explanation of Operation*** Next, an operation of the authorization server device 100 according to this embodiment will be described. The operation procedure of the authorization server device 100 corresponds to an authorization method. Furthermore, a program that realizes the authorization process, which is the operation procedure of the authorization server device 100, corresponds to an authorization program.

[0025] The authorization process of the authorization server device 100 according to this embodiment includes an ontology generation process and an access permission determination process. The ontology generation process is a process for generating an authorization rule ontology 61, which is an example of an authorization rule 60. The access permission determination process is a process for receiving an access request 51 from a user and determining whether or not to permit access.

[0026] FIG. 2 is a flow diagram showing the ontology generation process in the authorization server device 100 according to this embodiment. FIG. 3 is a diagram showing an example of the configuration of an authorization rule ontology 61, which is an example of the authorization rule 60 according to this embodiment. FIG. 4 is a diagram showing an example of the configuration of the authorization logic ontology 611 included in the authorization rule ontology 61 according to this embodiment. FIG. 5 is a diagram showing an example of the configuration of the evaluation rule ontology 612 included in the authorization rule ontology 61 according to this embodiment.

[0027] 2, either step S101 of the authorization logic reception processing or step S102 of the evaluation rule reception processing may be processed first. Step S101 may be the evaluation rule reception processing, and step S102 may be the authorization logic reception processing. Alternatively, step S101 of the authorization logic reception processing and step S102 of the evaluation rule reception processing may be processed in parallel.

[0028] <Authorization logic reception process: Step S101> The authorization logic receiving unit 110 receives input of authorization logic data 31 including an access type, an access unit indicating a unit for performing authorization for the access type, and an evaluation attribute which is an attribute to be evaluated for the access unit. The access type is information indicating the authorization target of dynamic authorization, i.e., the type of access performed by the user. Specifically, it is as follows:

[0029] The authorization logic data 31 is information that abstracts authorization logic and includes an access type 41, an access unit 42, and an evaluation attribute 43. The authorization logic data 31 is information that serves as input to an authorization logic ontology 611, which will be described later. The authorization logic data 31 is entered by a system administrator who manages authorization to the file server. On the other hand, it can be assumed that the system administrator has minimal security literacy.

[0030] For example, a system administrator considers what kind of access unit 42 is desired for authorization and inputs authorization logic data 31. The system administrator only needs to consider which attributes to evaluate depending on the expected access target and scope of the user who is the authorization target 20. Specifically, the system administrator inputs the access type 41, such as a service or a file, and the access unit 42, such as the details thereof, by describing them in a tree structure or a graph structure as the authorization logic data 31. Then, the system administrator associates an evaluation attribute 43 with the access unit 42. If the evaluation rule data 32 has already been entered at this time, the information to be associated with the access unit 42 may be selected from the evaluation attribute status 44 or evaluation rule 45 included in the evaluation rule data 32.

[0031] As shown in FIG. 3, the authorization rule ontology 61 is composed of an authorization logic ontology 611 and an evaluation rule ontology 612 . FIG. 4 shows a detailed configuration example of the authorization logic ontology 611. FIG. 5 also shows an example of the detailed configuration of the evaluation rule ontology 612.

[0032] The access type 41 is an access target that is expected by the user. In the example of Fig. 4, the access type 41 is set to service access and file access. The access unit 42 is the unit, or scope, of authorization desired for each access type 41. In the example of FIG. 4, the access unit 42 is set to be "external SaaS session unit," "confidential file unit," "confidential directory unit," or "confidential file unit." The access unit 42, or scope, is expressed by, for example, a URL. Once the access type 41 and access unit 42 are identified, a node in the ontology is identified.

[0033] The evaluation attribute 43 is information indicating what attribute is evaluated in the access unit 42. In the example of Fig. 3, in the case of the access type "service access" and the access unit "external SaaS session unit", "location, time, connection method" are set as the evaluation attribute 43. A more specific input interface will be described later.

[0034] <Evaluation Rule Reception Process: Step S102> The evaluation rule receiving unit 120 receives input of evaluation rule data 32 including the state 44 of the evaluation attribute and the evaluation rule 45 indicating the conditions for approval in the state of the evaluation attribute. Specifically, it is as follows:

[0035] The evaluation rule data 32 is information that is input to the evaluation rule ontology 612, which will be described later. Input of the evaluation rule data 32 requires specialized knowledge and is therefore expected to be performed by a security expert.

[0036] An ontology such as the authorization logic ontology 611 or the evaluation rule ontology 612 can be expressed using, for example, RDF or JSON. For RDF, description languages ​​such as XML, Turtle, or N3 are used. For JSON, description languages ​​such as JSON-LD are used. When giving meaning to an ontology, as in this embodiment, it is efficient to use OWL. It is assumed that an OWL auxiliary tool will be used for the input interface. RDF is an abbreviation for Resource Description Framework. XML is an abbreviation for Extensible Markup Language. JSON is an abbreviation for JavaScript (registered trademark) Object Notation. OWL is an abbreviation for Web Ontology Language.

[0037] 5, attribute information corresponding to the evaluation attribute 43 is set as the evaluation attribute state 44. Also, as the evaluation rule 45, a rule indicating the authorization condition for the evaluation attribute state 44 is set.

[0038] <Generation process: Step S103> The generation unit 130 generates authorization rules 60 for performing dynamic authorization based on the authorization logic data 31 and the evaluation rule data 32. In this embodiment, the generation unit 130 generates an authorization rule ontology 61 in an ontology format as the authorization rules 60.

[0039] The generation unit 130 generates an authorization logic ontology 611 by converting the access type 41, access unit 42, and evaluation attribute 43 included in the authorization logic data 31 into an ontology format. The generation unit 130 also generates an evaluation rule ontology 612 by converting the state 44 of the evaluation attribute and the evaluation rule 45 included in the evaluation rule data 32 into an ontology format. That is, the generation unit 130 generates an authorization rule ontology 61 consisting of the authorization logic ontology 611 and the evaluation rule ontology 612 as an authorization rule 60.

[0040] The generating unit 130 generates a logic layer 661 as an authorization logic ontology 611 by converting the access type 41, the access unit 42, and the evaluation attribute 43 into an ontology format. The generator 130 also generates an evaluation rule ontology 612 consisting of a pre-evaluation layer 671 in which the states 44 of the evaluation attributes are converted into an ontology format, and a rule evaluation layer 672 in which the evaluation rules 45 are converted into an ontology format.

[0041] As mentioned above, ontologies can be expressed using, for example, RDF or JSON. For RDF, description languages ​​such as XML, Turtle, or N3 are used. For JSON, description languages ​​such as JSON-LD are used. When giving meaning to an ontology, as in this embodiment, it is efficient to use OWL. Such ontology description languages ​​provide a format that allows the ontology to be uniquely interpreted.

[0042] The authorization rule ontology 61 generated by the generating unit 130 will be further described with reference to FIGS. In the authorization server device 100 according to this embodiment, the authorization rules 60 for determining whether or not dynamic authorization is permitted are managed by dividing the authorization logic and the evaluation rules into separate ontologies. The authorization logic ontology 611 defines what evaluation flow should be performed depending on the type of access. The evaluation rule ontology 612 defines the components used in the evaluation flow. The pre-evaluation layer 671 represents the "state" of the authorization target. The rule evaluation layer 672 represents the "conditions" of the evaluation.

[0043] Specifically, the authorization rules 60 are organized in the form of What, Who, Where, When, Why, and How, the so-called 5W1H. The "What" element is expressed in the logic layer 661 of the authorization logic ontology 611. The "Who, Where, When, and Why" elements are expressed in the pre-evaluation layer 671 of the evaluation rule ontology 612. The "How" element is expressed in the rule evaluation layer 672 of the evaluation rule ontology 612. Furthermore, the evaluation rule ontology 612 is divided into the pre-evaluation layer 671, which represents the "state" of the user, and the rule evaluation layer 672, which represents the "conditions" (evaluation rules) for authorizing the user. As described above, the authorization rule ontology 61 identifies the 5W1H (What, Who, Where, When, Why, and How) from a user's access request. Finally, the structure is such that the evaluation rules described in the rule evaluation layer 672 can be identified.

[0044] <Ontology storage process: Step S104> The generating unit 130 stores the authorization rule ontology 61 generated in step S103 in the storage unit 160.

[0045] FIG. 6 is a flowchart showing the access permission determination process in the authorization server device 100 according to this embodiment. The access permission determination process is a process of receiving an access request 51 from a user and determining whether or not access is permitted.

[0046] <Access request reception process: Step S201> The access request receiving unit 140 receives an access request 51 from a user. The access request 51 includes information that the user presents to the authorization server device 100 in order to access a resource in the file server 200. Specifically, the access request 51 includes the resource to be accessed, the scope, and attribute information. The resource to be accessed may be a service as well as various types of data such as a file. The resource to be accessed corresponds to the access type 41. Hereinafter, the resource to be accessed may also be referred to as the access type. The scope is information such as a session unit, a file unit, a directory unit, or a service unit. The scope corresponds to the access unit 42. A node in the authorization logic ontology 611 is identified by the resource to be accessed and the scope. Hereinafter, the scope may also be referred to as an access unit.

[0047] The attribute information is information such as person / place / time / connection method / reason that is included in the user or context. The attribute information identifies a node in the evaluation rule ontology 612. The attribute information corresponds to the evaluation attribute 43.

[0048] <Accessibility Determination Process: Step S202> The access permission determination unit 150 analyzes the access request 51, and refers to the authorization logic ontology 611 and the evaluation rule ontology 612 stored in the storage unit 160 to identify the evaluation rules in the rule evaluation layer 672 and determine whether to permit or deny the access.

[0049] Specifically, the access permission determination unit 150 selects an evaluation attribute 43 using the access type and access unit included in the access request 51 and the authorization logic ontology 611. The selected evaluation attribute 43 is set as a selected evaluation attribute 431. The selected evaluation attribute 431 is an evaluation attribute 43 corresponding to the access type and access unit included in the access request 51. Then, the access permission determination unit 150 determines whether to grant or deny the access request 51 using the selected evaluation attribute 431, the user attribute information included in the access request 51, and the evaluation rule ontology 612. More specifically, the accessibility determination unit 150 uses the selected evaluation attribute 431 and the pre-evaluation layer 671 to select an ontology corresponding to the selected evaluation attribute 431 from the evaluation rule ontology 612. Then, the accessibility determination unit 150 uses the rule evaluation layer 672 in the selected ontology and the user attribute information included in the access request 51 to determine whether the access request 51 is acceptable.

[0050] A specific example of the access permission determination procedure will be described below using the examples of FIGS. (1) The access permission determining unit 150 refers to the authorization logic ontology 611 using the access type and access unit included in the access request 51 and selects the root node of the pre-evaluation layer 671 as the selected evaluation attribute 431 . In the example of FIG. 4, for example, the evaluation attributes "person" and "place" are selected from the access type "service access" and the access unit "intranet service unit." (2) The accessibility determination unit 150 selects a node in the rule evaluation layer 672 from the attribute information included in the access request 51, starting from the root node of the pre-evaluation layer 671 selected as the selected evaluation attribute 431, and determines the evaluation rule. At this time, if a unit such as "person," "place," or "time" is specified in the pre-evaluation layer 671, the conditions in the rule evaluation layer 672 linked to the node below are processed as AND conditions. Also, if an AND / OR condition is directly specified in units such as "affiliation," "job title," or "access source" in the pre-evaluation layer 671, the conditions in the rule evaluation layer 672 are processed as the specified AND / OR conditions. In the example of FIG. 5, when "location" is selected as the selected evaluation attribute 431, the evaluation rules in the rule evaluation layer 672 linked to "location" are identified. (3) The access permission determination unit 150 evaluates the attribute information included in the access request 51 using the evaluation rules of the identified rule evaluation layer 672, and determines whether or not to permit the access request 51.

[0051] If it is determined that the access request 51 is denied (NO in step S203), the process proceeds to step S204. In step S204, the access permission determination unit 150 notifies the user that the access request 51 has been denied.

[0052] If it is determined that the access request 51 is permitted (YES in step S203), the process proceeds to step S205. In step S205, the access permission determination unit 150 issues an access token 52 including the permitted access target (corresponding to the access type) and scope (corresponding to the access unit), and transmits it to the user. The access token 52 may include the contents of the access request 51. The format of the access token 52 may be arbitrary.

[0053] When the user receives the access token 52, the user can present the access token 52 to the file server 200 to access the resource.

[0054] ***Other Configurations*** <Variation 1> In the present embodiment, the authorization server device 100 has been described as having an ontology generation function for generating an authorization rule ontology and an access permission determination function for determining whether or not to authorize an access request. As a first modification, the first authorization server device may have only an ontology generation function. Then, a second authorization server device, which is a computer separate from the authorization server device, may be prepared, and the second authorization server device may have an access permission determination function. In other words, the authorization server device 100 may be an authorization system including a first authorization server device and a second authorization server device.

[0055] In this case, the user transmits an access request to the second authorization server device. The second authorization server device acquires the authorization rule ontology from the first authorization server device. The second authorization server device determines whether to grant the access request using the authorization rule ontology acquired from the first authorization server device. The access permission determination process by the second authorization server device is the same as that described in the first embodiment.

[0056] <Variation 2> In this embodiment, the functions of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150 are realized by software. As a variation, the functions of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150 may be realized by hardware. Specifically, the authorization server device 100 includes an electronic circuit 909 instead of a processor 910 .

[0057] FIG. 7 is a diagram illustrating a configuration example of the authorization server device 100 according to a modification of the present embodiment. The electronic circuit 909 is a dedicated electronic circuit that realizes the functions of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150. Specifically, the electronic circuit 909 is a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an ASIC, or an FPGA. GA is an abbreviation for Gate Array. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array.

[0058] The functions of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150 may be realized by a single electronic circuit, or may be distributed across multiple electronic circuits.

[0059] As another variation, some of the functions of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150 may be realized by electronic circuits, and the remaining functions may be realized by software. Also, some or all of the functions of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150 may be realized by firmware.

[0060] Each of the processor and the electronic circuit is also called a processing circuitry. That is, the functions of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150 are realized by the processing circuitry.

[0061] ***Explanation of the effect of this embodiment*** As described above, the authorization server device 100 according to the present embodiment can define a basic ontology that abstracts evaluation conditions as an authorization logic ontology, which has the effect of making it easier for a system administrator to input authorization logic. Furthermore, the authorization server device 100 according to the present embodiment generates a basic ontology that abstracts evaluation conditions and an evaluation rule ontology that expresses evaluation conditions in an ontology format separately, thereby preventing the appearance of the same node in a graph structure.

[0062] In this way, the authorization server device 100 according to the present embodiment can improve the readability and maintainability of the ontology that expresses the authorization rule. Furthermore, in the authorization server device 100 according to the present embodiment, duplicated evaluation rules are not described, and the number of nodes in the ontology can be reduced. Furthermore, in the authorization server device 100 according to the present embodiment, since the ontologies are divided into authorization logic and evaluation rules, it is possible to easily create a combination of evaluation rules according to the purpose.

[0063] In a method for determining the access range from attributes presented by a user, the authorization request becomes larger as the number of attributes to be handled increases. On the other hand, the authorization server device 100 according to this embodiment has the advantage that it can determine the attributes to be presented from the authorization logic according to the purpose, and the attributes to be included in the authorization request become clear. Therefore, since the attributes to be presented by the user are easy to understand, there is no need to present unnecessary information, which is also effective from the viewpoint of personal information.

[0064] Embodiment 2 In this embodiment, differences from and additions to the first embodiment will be mainly described. In this embodiment, components having the same functions as those in the first embodiment are given the same reference numerals, and the description thereof will be omitted.

[0065] In this embodiment, a mode will be described in which a system administrator can select a preset when inputting authorization logic data using the authorization logic receiving unit 110. In this embodiment, an ontology that defines a preset of the pre-evaluation layer for each authorization logic is prepared as the template layer 662.

[0066] ***Configuration Description*** FIG. 8 is a diagram illustrating an example of the configuration of the authorization server device 100 according to this embodiment. In this embodiment, in addition to the components described in the first embodiment, a template receiving unit 170 is provided. The other configurations are the same as those in the first embodiment.

[0067] FIG. 9 is a diagram showing an example of the configuration of the authorization logic ontology 611 according to this embodiment. In this embodiment, the authorization logic ontology 611 has a logic layer 661 and a template layer 662 . The logic layer 661 is a layer in which the access type 41, the access unit 42, and the access criteria 46 indicating the access level criteria 33 are converted into an ontology format. The template layer 662 is a layer in which the access criteria 46 and the evaluation attributes 43 corresponding to the access criteria 46 are converted into an ontology format.

[0068] ***Explanation of Operation*** First, a description will be given of the ontology generation process for generating the authorization logic ontology 611. The process for generating the evaluation rule ontology 612 is the same as that in the first embodiment.

[0069] FIG. 10 is a flow diagram showing the process of generating the authorization logic ontology 611 according to this embodiment. In step S301, the template receiving unit 170 receives input of information including the access criteria 46 indicating the criteria for the access level. The system administrator inputs information indicating the criteria for the access level for the organization, such as a protection level or a risk value. In step S302, the authorization logic receiving unit 110 receives an input of the authorization logic data 31 including the access type 41, the access unit 42, and the evaluation attribute 43.

[0070] In step S303, the generator 130 generates the authorization logic ontology 611 having a logic layer 661 and a template layer 662. The logic layer 661 is a layer in which the access type 41, the access unit 42, and the access criteria 46 indicating the criteria for the access level are converted into an ontology format. The template layer 662 is a layer in which the access criteria 46 and the evaluation attributes 43 corresponding to the access criteria 46 are converted into an ontology format.

[0071] The authorization logic ontology 611 according to this embodiment will be further described with reference to FIG. Access criteria 46 are set for the terminal nodes in the logic layer 661. As shown in Fig. 9, access criteria 46 such as "Level 1 protection" and "Risk value 6 or more" are set for the terminal nodes in the logic layer 661. In this way, in the logic layer 661, the access types 41 and access units 42 are expressed in the same way as in the first embodiment, and nodes of the access criteria 46 in the template layer 662 are set for the parts linked to the evaluation rule ontology 612.

[0072] An evaluation attribute 43 linked to the pre-evaluation layer 671 of the evaluation rule ontology 612 is set in the terminal node in the template layer 662. If the evaluation rule ontology 612 has already been generated, the generation unit 130 may select the evaluation attribute 43 linked to the pre-evaluation layer 671 from the evaluation rule ontology 612. In the "by level" ontology of the template layer 662 in Fig. 9, evaluation attributes 43 such as "person," "place," and "time" are set in the terminal node. Alternatively, as shown in the "risk value" ontology in the template layer 662 in Fig. 9, access criteria 46 such as "level 1 protection" or "level 2 protection" may be set at the terminal node. Then, as shown by the dotted line in Fig. 9, a graph structure may be adopted in which the terminal node of the "risk value" ontology is linked to the "risk value" ontology.

[0073] The process of generating the evaluation rule ontology 612 is the same as in the first embodiment. The generation unit 130 stores the authorization rule ontology 61, which is made up of the authorization logic ontology 611 and the evaluation rule ontology 612, in the storage unit 160, as in the first embodiment.

[0074] The accessibility determination process according to this embodiment is the same as that of the first embodiment except that the template layer 662 is used. The accessibility determination unit 150 according to this embodiment uses the access request 51 and the logic layer 661 to select from the logic layer 661 an access criterion 46 that corresponds to the access type and access unit included in the access request 51. Then, using the selected access criterion 46 and the template layer 662, the accessibility determination unit 150 selects, as the selected evaluation attribute 431, an evaluation attribute 43 that corresponds to the selected access criterion 46. The subsequent processing is the same as that described in the first embodiment.

[0075] ***Explanation of the effect of this embodiment*** As described above, the authorization server device according to this embodiment includes a template receiving unit that separately receives input of access criteria as data to be used repeatedly. The generation unit generates an authorization logic ontology having a logic layer and a template layer from the input data received by the template receiving unit and the authorization logic receiving unit. In this way, an ontology that defines presets for the pre-evaluation layer for each authorization logic is prepared as the template layer. This allows the system administrator to select a preset when entering authorization logic using the authorization logic receiving unit. Therefore, the authorization server device according to this embodiment makes it easier for the system administrator to select an authorization flow.

[0076] In the above first and second embodiments, each unit of the authorization server device has been described as an independent functional block. However, the configuration of the authorization server device does not have to be the same as that of the above-mentioned embodiments. The functional blocks of the authorization server device may have any configuration as long as they can realize the functions described in the above-mentioned embodiments. Furthermore, the authorization server device may not be a single device, but may be a system composed of multiple devices. Furthermore, it is possible to combine multiple parts of the first and second embodiments. Alternatively, it is possible to implement only one part of these embodiments. In addition, it is possible to implement any combination of these embodiments, either as a whole or in part. That is, in the first and second embodiments, the respective embodiments can be freely combined, or any of the components in the respective embodiments can be modified, or any of the components in the respective embodiments can be omitted.

[0077] The above-described embodiments are essentially preferred examples and are not intended to limit the scope of the present disclosure, the scope of application of the present disclosure, or the scope of use of the present disclosure. The above-described embodiments can be modified in various ways as needed. For example, the procedures described using flow charts or sequence diagrams may be modified as appropriate. [Explanation of symbols]

[0078] 20 authorization target, 31 authorization logic data, 32 evaluation rule data, 33 access level criteria, 41 access type, 42 access unit, 43 evaluation attribute, 431 selected evaluation attribute, 44 evaluation attribute state, 45 evaluation rule, 46 access criteria, 51 access request, 52 access token, 60 authorization rule, 61 authorization rule ontology, 611 authorization logic ontology, 661 logic layer, 662 template layer, 612 evaluation rule ontology, 671 pre-evaluation layer, 672 rule evaluation layer, 100 authorization server device, 110 authorization logic reception unit, 120 evaluation rule reception unit, 130 generation unit, 140 access request reception unit, 150 access permission determination unit, 160 storage unit, 170 template reception unit, 200 file server, 909 electronic circuit, 910 processor, 921 memory, 922 auxiliary storage device, 930 Input interface, 940 output interface, 950 communication device.

Claims

1. an authorization logic receiving unit that receives an input of authorization logic data including an access type indicating a type of access to an authorization target of dynamic authorization, an access unit indicating a unit for performing authorization in the access type, and an evaluation attribute that is an attribute to be evaluated in the access unit; an evaluation rule receiving unit that receives input of evaluation rule data including the state of the evaluation attribute and an evaluation rule that indicates an authorization condition for the state of the evaluation attribute; a generation unit that generates authorization rules for performing the dynamic authorization, the authorization rules including an authorization logic ontology obtained by converting the access type, the access unit, and the evaluation attribute included in the authorization logic data into an ontology format, and an evaluation rule ontology obtained by converting the state of the evaluation attribute and the evaluation rule included in the evaluation rule data into an ontology format; Equipped with The generation unit An authorization server device that generates the evaluation rule ontology, which includes a pre-evaluation layer that converts the states of the evaluation attributes into an ontology format, and a rule evaluation layer that converts the evaluation rules into an ontology format.

2. The authorization server device 2. The authorization server device according to claim 1, further comprising: an access permission determination unit that obtains an access request from a user, selects evaluation attributes corresponding to the access type and access unit included in the access request as selected evaluation attributes using an access type and access unit included in the access request and the authorization logic ontology, and determines whether to grant or deny the access request using the selected evaluation attributes, attribute information of the user included in the access request, and the evaluation rule ontology.

3. The accessibility determination unit 3. The authorization server device according to claim 2, wherein an ontology corresponding to the selected evaluation attribute is selected from the evaluation rule ontology using the selected evaluation attribute and the pre-evaluation layer, and the access request is permitted or not using the rule evaluation layer in the selected ontology and attribute information of the user.

4. The authorization server device a template receiving unit that receives input of information including access criteria that indicate criteria for an access level; The generation unit 4. The authorization server device according to claim 2, wherein the authorization logic ontology is generated by converting the access type, the access unit, and the access criteria into an ontology format, and a template layer into an ontology format, the template layer being a template of the access criteria and the evaluation attributes corresponding to the access criteria.

5. The accessibility determination unit The authorization server device of claim 4, wherein the access criteria corresponding to the access type and access unit included in the access request are selected using the access type and access unit included in the access request and the logic layer, and the selected access criteria and the template layer are used to select the selected evaluation attribute corresponding to the selected access criteria.

6. an authorization logic ontology obtained by converting, into an ontology format, an access type indicating a type of access to an authorization target of dynamic authorization, an access unit indicating a unit for performing authorization in the access type, and an evaluation attribute which is an attribute to be evaluated in the access unit; an evaluation rule ontology obtained by converting the state of the evaluation attribute and the evaluation rule indicating the authorization condition in the state of the evaluation attribute into an ontology format; and an access permission determination unit that determines whether or not an access request acquired from a user is permitted using the The evaluation rule ontology An authorization server device including a pre-evaluation layer that converts the state of the evaluation attribute into an ontology format, and a rule evaluation layer that converts the evaluation rules into an ontology format.

7. The accessibility determination unit 7. The authorization server device according to claim 6, wherein the authorization server device selects, as a selected evaluation attribute, an evaluation attribute corresponding to the access type and access unit included in the access request, using the access type and access unit included in the access request and the authorization logic ontology, and determines whether to grant the access request, using the selected evaluation attribute, the attribute information of the user included in the access request, and the evaluation rule ontology.

8. The accessibility determination unit The authorization server device according to claim 7, wherein an ontology corresponding to the selected evaluation attribute is selected from the evaluation rule ontology using the selected evaluation attribute and the pre-evaluation layer, and the rule evaluation layer in the selected ontology and attribute information of the user are used to determine whether the access request is acceptable.

9. an authorization logic receiving unit that receives an input of authorization logic data including an access type indicating a type of access to an authorization target of dynamic authorization, an access unit indicating a unit for performing authorization in the access type, and an evaluation attribute that is an attribute to be evaluated in the access unit; an evaluation rule receiving unit that receives input of evaluation rule data including the state of the evaluation attribute and an evaluation rule that indicates an authorization condition for the state of the evaluation attribute; a generation unit that generates authorization rules for performing the dynamic authorization, the authorization rules including an authorization logic ontology obtained by converting the access type, the access unit, and the evaluation attribute included in the authorization logic data into an ontology format, and an evaluation rule ontology obtained by converting the state of the evaluation attribute and the evaluation rule included in the evaluation rule data into an ontology format; an access permission determination unit that receives an access request from a user and determines whether or not to grant the access request using the authorization rule; Equipped with The generation unit An authorization system for generating the evaluation rule ontology, comprising a pre-evaluation layer that converts the states of the evaluation attributes into an ontology format, and a rule evaluation layer that converts the evaluation rules into an ontology format.

10. a computer receives an input of authorization logic data including an access type indicating a type of access to an authorization target of dynamic authorization, an access unit indicating a unit for performing authorization in the access type, and an evaluation attribute which is an attribute to be evaluated in the access unit; The computer receives input of evaluation rule data including a state of the evaluation attribute and an evaluation rule indicating an authorization condition for the state of the evaluation attribute; a computer generates an authorization rule for performing the dynamic authorization, the authorization rule including an authorization logic ontology obtained by converting the access type, the access unit, and the evaluation attribute included in the authorization logic data into an ontology format, and an evaluation rule ontology obtained by converting the state of the evaluation attribute and the evaluation rule included in the evaluation rule data into an ontology format; An authorization method in which a computer generates the evaluation rule ontology, which comprises a pre-evaluation layer in which the states of the evaluation attributes are converted into an ontology format, and a rule evaluation layer in which the evaluation rules are converted into an ontology format.

11. The computer an authorization logic ontology obtained by converting, into an ontology format, an access type indicating a type of access to an authorization target of dynamic authorization, an access unit indicating a unit for performing authorization in the access type, and an evaluation attribute which is an attribute to be evaluated in the access unit; an evaluation rule ontology obtained by converting the state of the evaluation attribute and the evaluation rule indicating the authorization condition in the state of the evaluation attribute into an ontology format; and An authorization method for determining whether or not to grant an access request obtained from a user, using The authorization method, wherein the evaluation rule ontology comprises a pre-evaluation layer in which the state of the evaluation attribute is converted into an ontology format, and a rule evaluation layer in which the evaluation rule is converted into an ontology format.

12. an authorization logic receiving process that receives an input of authorization logic data including an access type indicating a type of access to an authorization target of dynamic authorization, an access unit indicating a unit for performing authorization in the access type, and an evaluation attribute that is an attribute to be evaluated in the access unit; an evaluation rule receiving process for receiving input of evaluation rule data including the state of the evaluation attribute and an evaluation rule indicating an authorization condition for the state of the evaluation attribute; a generation process for generating authorization rules for performing the dynamic authorization, the authorization rules being made up of an authorization logic ontology obtained by converting the access type, the access unit, and the evaluation attribute included in the authorization logic data into an ontology format, and an evaluation rule ontology obtained by converting the state of the evaluation attribute and the evaluation rule included in the evaluation rule data into an ontology format; An authorization program for causing a computer to execute The generation process includes: an authorization program for generating the evaluation rule ontology, the authorization program comprising a pre-evaluation layer that converts the states of the evaluation attributes into an ontology format, and a rule evaluation layer that converts the evaluation rules into an ontology format;

13. an authorization logic ontology obtained by converting, into an ontology format, an access type indicating a type of access to an authorization target of dynamic authorization, an access unit indicating a unit for performing authorization in the access type, and an evaluation attribute which is an attribute to be evaluated in the access unit; an evaluation rule ontology obtained by converting the state of the evaluation attribute and the evaluation rule indicating the authorization condition in the state of the evaluation attribute into an ontology format; and an authorization program that causes a computer to execute an access permission determination process that determines whether an access request acquired from a user is permitted using the The evaluation rule ontology is an authorization program consisting of a pre-evaluation layer that converts the state of the evaluation attribute into an ontology format, and a rule evaluation layer that converts the evaluation rules into an ontology format.

Images