Policy setting control system, policy setting control method, and policy setting control program

Abstract

This invention is intended to reduce the labor of operational management required for data governance. A policy setting control system controls setting of a policy for controlling access to a resource. The policy setting control system includes a storage and a CPU. The storage stores a trigger correspondence table for managing the correspondence of policies for each trigger of the resource. When a change in the trigger is detected, the CPU, on the basis of the trigger correspondence table, extracts policies related to the trigger at which the change occurred as a related policy group, and extracts, as an update policy, a policy to be updated in accordance with a change of an attribute among the extracted related policy group.

Description

POLICY SETTING CONTROL SYSTEM, POLICY SETTING CONTROL METHOD, AND POLICY SETTING CONTROL PROGRAM

[0001] The present invention relates to a policy setting control system, a policy setting control method, and a policy setting control program.

[0002] In recent years, the increase in data governance-related labor costs (such as changes to access control) due to various lifecycle changes, such as organizational changes, increases in data including metadata, and changes in laws and regulations, has become a problem.

[0003] Patent Document 1 describes determining interference with existing controls based on priority information and related information (grouping) of access control.

[0004] Patent Document 2 describes that when consent input to provide a requested item is received, the item is set to be provided in a custom policy that takes precedence over a base policy.

[0005] JP 2015-064684 A JP 2016-162298 A

[0006] The data governor must monitor various changes related to data governance, such as organizational information, laws and regulations, and metadata, and when changes occur, must follow up and change and monitor access controls accordingly.

[0007] However, for example, when a column of sensitive data is added and the amount of data increases, if multiple types of policies are associated with the added sensitive data, it becomes unclear which access settings should be changed. In other words, when sensitive data associated with multiple types of policies is changed, the correspondence between the changes and the access settings is not self-evident unless consent is input by the user as in Patent Document 2, making it difficult to identify and monitor the scope of the change. Therefore, even when Patent Documents 1 and 2 are combined, it is not possible to extract and update access controls in an appropriate manner when various elements are changed.

[0008] Therefore, the present invention has been made in consideration of the above-mentioned problems, and an object of the present invention is to provide a technology that reduces the number of operational management steps in data governance.

[0009] In order to achieve the above object, the present invention provides a policy setting control system for controlling the setting of policies that control access to resources, the policy setting control system comprising a storage device and a processor, wherein the storage device stores a correspondence table that manages the correspondence between the policies for each attribute of the resource, and when the processor detects a change in the attribute, it extracts, based on the correspondence table, policies related to the attribute that has changed, as a group of related policies, and extracts, from the extracted group of related policies, a policy that is to be updated in accordance with the change in the attribute, as an updated policy.

[0010] According to the present invention, the number of operational management steps in data governance can be reduced.

[0011] 1 is a functional block diagram of a policy setting control system according to a first embodiment. FIG. 2 is a hardware configuration diagram of the policy setting control system according to the first embodiment. FIG. 3 is a diagram showing an editing screen for a trigger correspondence table according to the first embodiment. FIG. 4 is a flowchart showing policy setting control processing according to the first embodiment. FIG. 5 is a diagram for explaining the policy setting control processing according to the first embodiment. FIG. 6 is a diagram for explaining an extraction formula generation program according to the first embodiment. FIG. 7 is a flowchart showing policy setting control processing according to a second embodiment. FIG. 8 is a diagram for explaining the policy setting control processing according to the second embodiment. FIG. 9 is a diagram showing a policy setting screen according to the second embodiment.

[0012] The present invention will be described with reference to the accompanying drawings, but the present invention is not limited to the examples, but is defined by the claims.

[0013] FIG. 1 is a functional block diagram of a policy setting control system according to the first embodiment.

[0014] The policy setting control system 1 includes a policy setting control device 10 and a database system 20. The policy setting control device 10 and the database system 20 are connected to each other via a network N such as a wide area network (WAN) or a local area network (LAN). The policy setting control system 1 controls the setting of policies that control access to metadata, which is an example of a "resource" that manages data. The policy setting control system 1 includes at least one computer, as described below. The policy setting control system 1 may be configured by linking multiple computers. The computer may be a physical computer or a virtual computer.

[0015] The policy setting control device 10 includes a storage medium 16, a trigger management unit 13, a trigger correspondence table management unit 14, and a policy control unit 15. The storage medium 16 includes a governance policy storage unit 11 and a trigger correspondence table storage unit 12. The storage medium 16 non-temporarily stores computer programs or data. The storage medium 16 can store at least a portion of the computer programs and data stored in the memory or storage unit.

[0016] The governance policy storage unit 11 stores governance policies (higher-level policies) 54 (see FIG. 5 ), which will be described later. The trigger correspondence table storage unit 12 stores a trigger correspondence table 30 (see FIG. 3 , etc.), which is an example of a "correspondence table" (described later), that manages the correspondence between policies for each trigger, which is an example of an "attribute" of metadata.

[0017] The trigger management unit 13 manages metadata triggers. A trigger is a data change in the metadata to be detected. That is, the trigger management unit 13 detects a change in the metadata to be detected. The data change may include a change in an organization, a law, or metadata.

[0018] The trigger correspondence table management unit 14 manages the trigger correspondence table 30 (see FIG. 3 ). Specifically, when the trigger correspondence table management unit 13 detects a data change in the metadata, it extracts, based on the trigger correspondence table 30, policies related to the trigger at which the change occurred as a related policy group, and extracts, from the extracted related policy group, a policy to be updated in response to the change in trigger as an update policy.

[0019] The policy control unit 15 controls the governance policies stored in the governance policy storage unit 11 .

[0020] The database system 20 includes an access setting storage unit 21 , a database 22 , and a database management unit 23 .

[0021] The access setting storage unit 21 stores access settings 55 (see FIG. 5) as an example of a "lower-level policy" described later. The database 22 stores various data including metadata, and various programs including a policy setting control program and an extraction formula generation program 56 (see FIG. 6) described later.

[0022] The database management unit 23 manages the data and programs stored in the access setting storage unit 21 and the database 22 .

[0023] FIG. 2 is a hardware configuration diagram of the policy setting control system according to the first embodiment.

[0024] The policy setting control device 10 includes a storage 101 as an example of a "storage device," a CPU 102 as an example of a "processor," a main memory 103, a keyboard 104, a mouse 105, a display 106 as an example of a "display device," and a NIC 107. The storage 101, the CPU 102, the main memory 103, the keyboard 104, the mouse 105, the display 106, and the NIC 107 are connected to one another for communication via an internal bus B.

[0025] The storage 101 is, for example, a hard disk and / or a flash memory, and stores programs executed by the CPU 102 and data used by the CPU 102. In this embodiment, the storage 101 corresponds to the governance policy storage unit 11 and the trigger correspondence table storage unit 12.

[0026] The CPU 102 executes various processes in accordance with programs stored in the storage 101 and / or the main memory 103. In this embodiment, the trigger management unit 13, the trigger correspondence table management unit 14, and the policy control unit 15 are configured by the CPU 102 executing a policy setting control program stored in the main memory 103.

[0027] The main memory 103 is, for example, a RAM (Random Access Memory) and stores programs (for example, the policy setting control program and the extraction formula generation program 56) executed by the CPU 102 and necessary information. The main memory 103 stores related policy groups, update policies, and candidate policies.

[0028] The keyboard 104 and mouse 105 accept information input by the user. The display 106 displays and outputs a user interface (edit screen and setting screen) including various types of information.

[0029] The NIC 107 is an interface such as a wired LAN card or a wireless LAN card, and communicates with other devices (e.g., the database system 20) via the network N.

[0030] Similar to the policy setting control device 10 , the database system 20 includes a storage 201 , a CPU 202 , a main memory 203 , a keyboard 204 , a mouse 205 , a display 206 , and a NIC 207 .

[0031] FIG. 3 is a diagram showing an editing screen for the trigger correspondence table according to the first embodiment.

[0032] The display 106 displays an edit screen 31 on which the user edits the trigger correspondence table 30. The edit screen 31 displays the trigger correspondence table 30 and a register button 32.

[0033] The trigger correspondence table 30 stores entries including the correspondence of policies for each trigger. An entry in the trigger correspondence table 30 includes fields for trigger, policy correspondence, context correspondence, and type. The trigger corresponding to the entry is stored in the trigger field. The policy correspondence stores the correspondence between the trigger corresponding to the entry and the policy. The context correspondence stores the correspondence between the trigger corresponding to the entry and triggers of other metadata. The type stores the type of trigger corresponding to the entry (higher or lower relationship).

[0034] In the example of Fig. 3, the metadata #3 is triggered by the sensitivity included in the sensitive information, corresponds to the resource included in the governance policy, and corresponds to the metadata #4, and is a higher level. The metadata #4 is triggered by the DB (DATA BASE) included in the schema, corresponds to the resource included in the access setting, and corresponds to the metadata #3, and is a lower level.

[0035] The registration button 32 is pressed by the user when registering the edited contents of the event correspondence table 30 .

[0036] FIG. 4 is a flowchart showing the policy setting control process according to the first embodiment.

[0037] The trigger management unit 13 determines whether or not there is a change in the trigger in the trigger correspondence table 30 (S41). The trigger management unit 13 waits until the determination result in S41 becomes true (S41: YES).

[0038] Next, the trigger correspondence table management unit 14 determines whether the type of trigger that caused the change is a higher-level trigger (S42). If the determination result of S42 is false (S42: NO), the trigger correspondence table management unit 14 proceeds to S44. If the determination result of S42 is true (S42: YES), the trigger correspondence table management unit 14 refers to the context correspondence column of the trigger correspondence table 30 to identify a lower-level trigger relative to the trigger that caused the change (S43), and then proceeds to S44.

[0039] Next, the trigger correspondence table management unit 14 refers to the policy correspondence column of the identified lower trigger, and identifies the lower policy as a related policy group (S44).

[0040] Next, the trigger correspondence table management unit 14 executes the extraction formula generation program 56 to generate an extraction formula 57 (see Figure 6) described below that extracts an update policy based on any combination of the related policy group, and based on the generated extraction formula 57, extracts a policy from the related policy group that is to be updated in response to a change in the trigger as an update policy (S45).

[0041] Next, the trigger correspondence table management unit 14 corrects the identified violation of the update policy (S46). At this time, the user may correct the violation of the update policy by operating the edit screen 31.

[0042] FIG. 5 is a diagram for explaining the policy setting control process according to the first embodiment.

[0043] The metadata includes, as structure 1, a metadata.schema 51 and a metadata.sensitive information 52. The metadata includes, as structure 2, a metadata.URL 53 and a metadata.sensitive information 52.

[0044] The metadata schema 51 stores the correspondence between tables for each database DB as entries. The database stores the ID of the database corresponding to the entry. The table stores the ID of the table corresponding to the entry.

[0045] In the example of FIG. 5, database DB_A stores Table A1, and database DB_B stores Table B1.

[0046] The metadata sensitivity information 52 stores entries including the sensitivity of each data. The data stores a table in which data corresponding to the entry is stored. The sensitivity stores the sensitivity of the data corresponding to the entry.

[0047] In the example of FIG. 5, the data in Table A1 is sensitive data, and the data in Table B1 is non-sensitive data.

[0048] The metadata.URL 53 stores an entry including a table for each web URL. The URL stores the web URL (e.g., " / page1") corresponding to the entry. The table stores the ID of the table corresponding to the entry.

[0049] In the example of FIG. 5, the pages with URLs " / page1" and " / page2" are generated from Table A1 and Table B1.

[0050] The following describes a case where the sensitivity (trigger) of metadata sensitive information Table B1 is changed from non-sensitive to sensitive. Here, for example, governance policy (higher-level policy) 54 includes #2, where the subject is a data user, the resource is sensitive data, and the action is R (Read). Access setting (lower-level policy) 55 includes #3, where the subject is User02, the resource is DB_B, and the action is R (Read), and #4, where the subject is User02, the resource is DB_A, and the action is CRUD (Create / Read / Update / Delete).

[0051] When the trigger management unit 13 detects a change in the sensitivity (trigger) of Table B1 of metadata.sensitive information, the trigger correspondence table management unit 14 refers to the type column of the trigger correspondence table 30 and determines whether the type of metadata.sensitive information.sensitivity (trigger) in which the change occurred is a higher-level type. In the example of FIG. 5 , since the type of metadata.sensitive information.sensitivity (trigger) in which the change occurred is a higher-level type, the trigger correspondence table management unit 14 refers to the context correspondence column of the trigger correspondence table 30 and identifies that the lower-level trigger relative to the trigger in which the change occurred is #4.

[0052] Next, the trigger correspondence table management unit 14 refers to the policy correspondence column of the identified lower trigger (#4) and identifies the lower policy as a related policy group. In the example of Figure 5, the trigger correspondence table management unit 14 identifies the resource of the access setting 55 as a related policy group.

[0053] Next, the trigger correspondence table management unit 14 executes the extraction formula generation program 56 to generate an extraction formula 57 that extracts an update policy based on any combination of the related policies. The trigger correspondence table management unit 14 extracts, as update policies, policies from the related policies that are to be updated in response to a change in the trigger, based on the generated extraction formula 57. In the example of Figure 5, the trigger correspondence table management unit 14 executes the extraction formula generation program 56 to extract policies related to DB_B (including Table_B1) as update policies.

[0054] Next, the trigger correspondence table management unit 14 corrects the identified violation of the update policy (S46). In the example of Fig. 5, the trigger correspondence table management unit 14 corrects the action CRUD (Create / Read / Update / Delete) of DB_B to R (Read).

[0055] FIG. 6 is a diagram for explaining the extraction formula generation program according to the first embodiment.

[0056] The extraction expression generation program 56 may, for example, refer to the trigger correspondence table 30 and the metadata 51 to 53 and include the following steps 1 to 3. Step 1 is a step of extracting the table name (=access setting) to be extracted from the value (access setting.resource) corresponding to the lower-level policy in the policy correspondence column of the trigger correspondence table and setting it as the value of the FROM clause. Step 2 is a step of setting the value of the policy correspondence column of the lower-level policy on the left side of the WHERE clause. Step 3 is a step of setting the value (=DB_B) extracted based on the combination of the trigger at which the change occurred (metadata.sensitive information) and the value of the trigger column of the lower-level policy (=metadata.schema.DB) on the right side of the WHERE clause.

[0057] The extraction formula 57 generated by executing the extraction formula generation program 56 may include a SELECT statement and a WHERE conditional expression. The extraction formula 57 may include an expression that determines whether at least one of the resources, subjects, and actions match. This improves the accuracy of extraction of update policies by the extraction formula 57.

[0058] According to this configuration, the policy setting control system 1 controls the setting of policies that control access to resources. The policy setting control system 1 includes a storage 101 and a CPU 102. The storage 101 stores a trigger correspondence table 30 that manages the correspondence between policies for each resource trigger. When the CPU 102 detects a change in the trigger, it extracts, based on the trigger correspondence table 30, policies related to the trigger at which the change occurred, as a related policy group, and extracts, from the extracted related policy group, a policy to be updated in accordance with the change in attribute, as an updated policy.

[0059] This allows for the extraction of an update policy based on the correspondence between policies for each trigger, even when multiple triggers exist, thereby reducing the amount of operational management work required for data governance.

[0060] The CPU 102 generates an extraction formula 57 for extracting a candidate policy based on any combination of a plurality of related policies included in the related policy group, and extracts an updated policy based on the generated extraction formula 57. In this way, an updated policy can be extracted in accordance with the related policies.

[0061] The policy includes at least the resource to be accessed, the subject making the access, and the access action, and the extraction formula 57 includes an expression for determining whether at least one of the resource, subject, and action matches. This improves the accuracy of extracting the update policy using the extraction formula 57.

[0062] The device is provided with a display 106 that displays an edit screen 31 on which the user edits the trigger correspondence table 30. This allows the user to easily change the settings of the trigger correspondence table 30.

[0063] Change triggers include organizational, legal, or metadata changes, allowing for various data governance needs.

[0064] The second embodiment is an embodiment that includes a process for automatically generating a lower level policy. The following describes the second embodiment, focusing only on the differences from the first embodiment, with reference to the drawings.

[0065] FIG. 7 is a flowchart showing a policy setting control process according to the second embodiment.

[0066] After step S46, the policy control unit 15 executes an automatic generation process of a lower-level policy (S70). Specifically, the policy control unit 15 generates one or more lower-level policies as candidate policies based on a combination of subjects, resources, and actions as an example of one or more "related policies" included in the governance policy (higher-level policy) 54 as an example of a "related policy group" (S71). The policy control unit 15 calculates the difference between the generated candidate policy and a set of already defined lower-level policies (S72).

[0067] The policy control unit 15 determines whether the calculated difference is an empty set (S73). If the determination result of S73 is false (S73: YES), the policy control unit 15 ends the process. If the determination result of S73 is true (S73: NO), the trigger correspondence table management unit 14 presents the calculated difference to the user as a new lower-level policy (S74).

[0068] FIG. 8 is a diagram for explaining the policy setting control process according to the second embodiment.

[0069] 8, the policy control unit 15 generates lower-level policies as candidate policies 58 based on a combination of the subject (data user), resource (sensitive data), and action R (Read) of the governance policy (higher-level policy) 54. In this case, the subject of the lower-level policy 58 of #1 is User02, the resource is DB_B, and the action is R (Read). The subject of the lower-level policy 58 of #2 is User02, the resource is DB_C, and the action is R (Read).

[0070] Next, the policy control unit 15 calculates the difference between the generated lower policies 58 of #1 and #2 and the set of already defined access settings (lower policies) 55 of #3 and #4. At this time, the lower policy of #3 has a subject User02, a resource DB_A, and an operation R (Read), and the lower policy of #4 has a subject User02, a resource DB_B, and an operation CRUD (Create / Read / Update / Delete). That is, the policy control unit 15 calculates the lower policy with a subject User02, a resource DB_C, and an operation R (Read) as the difference 59.

[0071] Next, the policy control unit 15 determines whether the calculated difference 59 (a lower policy whose subject is User02, whose resource is DB_C, and whose action is R (Read)) is an empty set. If the determination result in S73 is false (S73: YES), the policy control unit 15 ends the processing. If the calculated difference 59 is an empty set, the trigger correspondence table management unit 14 presents the calculated difference 59 (a lower policy whose subject is User02, whose resource is DB_C, and whose action is R (Read)) to the user as a new lower policy.

[0072] FIG. 9 is a diagram showing a policy setting screen according to the second embodiment.

[0073] A setting screen 60 on which the user sets policy updates is displayed on the display 106. The setting screen 60 displays an active policy display field 61, a candidate policy display field 62, a pull-down button 63, and a register button 64.

[0074] The currently operating policy display field 61 displays the policy being used. The candidate policy display field 62 displays the candidate policies. The pull-down button 63 allows the user to select one of the candidate policies displayed in the candidate policy display field 62. The register button 64 is pressed by the user when registering the candidate policy selected by the pull-down button 63.

[0075] In the example of FIG. 9, the user determines whether to register candidate policy #2, which has a check mark next to "New," among the candidate policies displayed in the candidate policy display field 62, and presses the registration button 64 if he / she wishes to register it.

[0076] According to this configuration, the CPU 102 generates one or more lower-level policies as candidate policies 58 based on a combination of one or more subjects, resources, and actions included in the governance policy (higher-level policy) 54, calculates a difference 59 between the generated candidate policy 58 and a set of access settings (lower-level policies) 55, and generates the calculated difference 59 as a new policy. This makes it possible to easily generate new lower-level policies.

[0077] The present invention is not limited to the above-described embodiments, but includes various modifications. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

[0078] 1... Policy setting control system, 30... Trigger correspondence table, 31... Editing screen, 54... Governance policy, 55... Access setting, 57... Extraction formula, 101... Storage, 102... CPU, 106... Display

Claims

1. A policy setting control system for controlling the setting of policies that control access to resources, the policy setting control system comprising a storage device and a processor, the storage device storing a correspondence table that manages the correspondence of the policies for each attribute of the resource, and the processor, when it detects a change in the attribute, extracts policies related to the attribute that has changed as a group of related policies based on the correspondence table, and extracts a policy that is to be updated in response to the change in the attribute from the extracted group of related policies as an update policy.

2. The policy setting control system of claim 1, wherein the processor generates an extraction formula for extracting the update policy based on any combination of a plurality of related policies included in the related policy group, and extracts the update policy based on the generated extraction formula.

3. The policy setting control system of claim 1, wherein the processor generates one or more policies as candidate policies based on one or more related policies included in the related policy group, calculates a difference between the generated candidate policy and a set of lower-level policies among the related policies, and generates a new policy based on the calculated difference.

4. The policy setting control system of claim 2, wherein the policy includes at least the resource to be accessed, the subject making the access, and the action of the access, and the extraction formula includes an expression for determining a match between at least one of the resource, the subject, and the action.

5. The policy setting control system according to claim 1, further comprising a display device for displaying at least one of an editing screen on which a user edits the correspondence table and a setting screen on which the user sets policy updates.

6. The policy setting control system of claim 1, wherein the change includes an organization, a law, or a metadata change.

7. A policy setting control method using a policy setting control system that controls the setting of policies that control access to resources, wherein when the policy setting control system detects a change in an attribute of the resource, the policy setting control system extracts policies related to the attribute in which the change has occurred as a group of related policies based on a correspondence table that manages the correspondence of the policies for each attribute of the resource, generates an extraction formula for extracting a policy to be updated as an update policy based on any combination of a plurality of related policies included in the group of related policies, and extracts the update policy from the extracted group of related policies in accordance with the change in the attribute based on the generated extraction formula.

8. A policy setting control program to be executed by a computer that controls the setting of policies that control access to resources, the policy setting control program comprising: when the computer detects a change in an attribute of the resource, based on a correspondence table that manages the correspondence between the policies for each attribute of the resource, extracts policies related to the attribute in which the change has occurred as a group of related policies, based on any combination of a plurality of related policies included in the group of related policies, generates an extraction formula for extracting a policy to be updated as an update policy, and based on the generated extraction formula, extracts an update policy from the extracted group of related policies in accordance with the change in the attribute.

Images