Authorization server device, authorization system, authorization method, and authorization program

Abstract

This authorization server device (100) performs dynamic authorization on an authorization target that is a user who performs an access. An authorization logic reception unit (110) receives an input of authorization logic data (31) including an access type indicating the type of access, an access unit indicating a unit on which authorization is performed on the basis of the access type, and an evaluation attribute that is an attribute to be evaluated in the access unit. An evaluation rule reception unit (120) receives an input of evaluation rule data (32) including a state of the evaluation attribute and an evaluation rule indicating an authorization condition in the state of the evaluation attribute. A generation unit (130) generates an authorization rule for performing the dynamic authorization on the basis of the authorization logic data (31) and the evaluation rule data (32).

Description

Authorization server device, authorization system, authorization method, and authorization program

[0001] The present disclosure relates to an authorization server device, an authorization system, an authorization method, and an authorization program.

[0002] Trade secrets stored on-premise or in-house clouds are accessed from various environments, such as inside or outside the company, day or night, and domestically or overseas. Therefore, there is a demand for technology that can perform authorization and authentication in response to user access requests to these trade secrets, thereby reducing the risk of information leakage.

[0003] Patent Literature 1 discloses a method for managing authorization rules in an ontology format for dynamic authorization adopted in zero trust security. In the method of Patent Literature 1, a tree is created as an ontology for each attribute used in evaluating authorization decisions. Then, in the method of Patent Literature 1, the tree is referenced according to attribute information presented by the user to be authorized, and authorization is determined.

[0004] International Publication No. 2022 / 149226

[0005] In the technology of Patent Document 1, the same evaluation conditions may appear in nodes on the ontology. Also, multiple ontologies may be created with the same upper-middle-lower structure, such as department-section-project or district-building-room. As such, an increase in attribute information handled in authorization processing poses a problem in that the structure of the ontology, which is the authorization rule, becomes redundant.

[0006] The present disclosure aims to improve the readability and maintainability of authorization rules by generating authorization rules using information that abstracts authorization logic and evaluation conditions.

[0007] The authorization server device according to the present disclosure includes: an authorization logic receiving unit that receives an input of authorization logic data including an access type indicating a type of access to an authorization target of dynamic authorization, an access unit indicating a unit for performing authorization in the access type, and an evaluation attribute which is an attribute to be evaluated in the access unit; an evaluation rule receiving unit that receives an input of evaluation rule data including a state of the evaluation attribute and an evaluation rule indicating an authorization condition in the state of the evaluation attribute; and a generation unit that generates an authorization rule for performing the dynamic authorization based on the authorization logic data and the evaluation rule data.

[0008] The authorization server device according to the present disclosure generates authorization rules based on authorization logic data and evaluation rule data. The authorization logic data is information that abstracts authorization logic, including an access type, an access unit, and an evaluation attribute. The evaluation rule data is information on evaluation conditions for each state of the evaluation attribute, including the state of the evaluation attribute and the evaluation rule. Therefore, according to the authorization server device according to the present disclosure, authorization rules are generated using information that abstracts the authorization logic and the evaluation conditions, thereby improving the readability and maintainability of the authorization rules.

[0009] FIG. 1 is a diagram showing a configuration example of an authorization server device according to the first embodiment. FIG. 2 is a flow diagram showing ontology generation processing in the authorization server device according to the first embodiment. FIG. 3 is a diagram showing a configuration example of an authorization rule ontology which is an example of an authorization rule according to the first embodiment. FIG. 4 is a diagram showing a configuration example of an authorization logic ontology included in the authorization rule ontology according to the first embodiment. FIG. 5 is a diagram showing a configuration example of an evaluation rule ontology included in the authorization rule ontology according to the first embodiment. FIG. 6 is a flow diagram showing access permission determination processing in the authorization server device according to the first embodiment. FIG. 7 is a diagram showing a configuration example of an authorization server device according to a modified example of the first embodiment. FIG. 8 is a diagram showing a configuration example of an authorization server device according to the second embodiment. FIG. 9 is a diagram showing a configuration example of an authorization logic ontology according to the second embodiment. FIG. 10 is a flow diagram showing processing for generating an authorization logic ontology according to the second embodiment.

[0010] The present embodiment will be described below with reference to the drawings. In each drawing, identical or corresponding parts are designated by the same reference numerals. In the description of the embodiment, the description of identical or corresponding parts will be omitted or simplified as appropriate. Arrows in the drawings mainly indicate the flow of data or the flow of processing. Furthermore, the sized relationships between components in the following drawings may differ from the actual relationships. Furthermore, in the description of the embodiment, directions or positions such as up, down, left, right, front, rear, front, and back may be indicated. These notations are provided for the convenience of explanation and do not limit the placement, direction, or orientation of devices, instruments, or parts.

[0011] Embodiment 1. ***Configuration*** FIG. 1 is a diagram illustrating an example of the configuration of an authorization server device 100 according to this embodiment. The authorization server device 100 generates an authorization rule ontology 61 as an authorization rule 60. The authorization server device 100 also receives an access request 51 for a resource on a file server 200 from a user who is an authorization target 20, and determines whether or not to grant access. The file server 200 is a location where the resources of the authorization target 20 are stored. In FIG. 1, a "document to be accessed" is illustrated as an example of a resource. The file server 200 refers to an on-premises server physically installed within an organization or a server on the cloud. Although not illustrated, an authentication server that authenticates a user accessing the file server 200 may be provided separately from the authorization server device 100. In this case, the authentication result may be included in the access request and used as a condition for the authorization server device 100 to grant or deny access to the resource.

[0012] The authorization server device 100 is a computer. The authorization server device 100 includes a processor 910, as well as other hardware such as a memory 921, an auxiliary storage device 922, an input interface 930, an output interface 940, and a communication device 950. The processor 910 is connected to the other hardware via signal lines and controls the other hardware.

[0013] The authorization server device 100 includes, as functional elements, an authorization logic receiving unit 110, an evaluation rule receiving unit, a generation unit 130, an access request receiving unit 140, an access permission determining unit 150, and a storage unit 160. The storage unit 160 stores an authorization rule ontology 61. The authorization rule ontology 61 is an example of an authorization rule 60 for dynamic authorization of a user who is an authorization target 20.

[0014] The functions of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150 are realized by software. The storage unit 160 is provided in the memory 921. The storage unit 160 may be provided in the auxiliary storage device 922, or may be provided separately in the memory 921 and the auxiliary storage device 922.

[0015] The processor 910 is a device that executes an authorization program. The authorization program is a program that realizes the functions of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150. The processor 910 is an IC that performs arithmetic processing. Specific examples of the processor 910 are a CPU, a DSP, and a GPU. IC is an abbreviation for Integrated Circuit. CPU is an abbreviation for Central Processing Unit. DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.

[0016] The memory 921 is a storage device that temporarily stores data. Specific examples of the memory 921 are SRAM and DRAM. SRAM is an abbreviation for Static Random Access Memory. DRAM is an abbreviation for Dynamic Random Access Memory. The auxiliary storage device 922 is a storage device that saves data. A specific example of the auxiliary storage device 922 is an HDD. The auxiliary storage device 922 may also be a portable storage medium such as an SD (registered trademark) memory card, CF, NAND flash, flexible disk, optical disk, compact disk, Blu-ray (registered trademark) disk, or DVD. Note that HDD is an abbreviation for Hard Disk Drive. SD (registered trademark) is an abbreviation for Secure Digital. CF is an abbreviation for CompactFlash (registered trademark). DVD is an abbreviation for Digital Versatile Disk.

[0017] The input interface 930 is a port connected to an input device such as a mouse, keyboard, or touch panel. Specifically, the input interface 930 is a USB terminal. The input interface 930 may also be a port connected to a LAN. USB is an abbreviation for Universal Serial Bus. LAN is an abbreviation for Local Area Network. Although one input interface 930 is shown in FIG. 1 , multiple input interfaces 930 may be present.

[0018] The output interface 940 is a port to which a cable of an output device such as a display is connected. Specifically, the output interface 940 is a USB terminal or an HDMI (registered trademark) terminal. Specifically, the display is an LCD. The output interface 940 is also called a display interface. HDMI (registered trademark) is an abbreviation for High Definition Multimedia Interface. LCD is an abbreviation for Liquid Crystal Display. Although one output interface 940 is shown in FIG. 1 , multiple output interfaces 940 may be present.

[0019] The communication device 950 has a receiver and a transmitter. The communication device 950 is connected to a communication network such as a LAN, the Internet, a telephone line, or Wi-Fi (registered trademark). Specifically, the communication device 950 is a communication chip or NIC. NIC is an abbreviation for Network Interface Card.

[0020] The authorization program is executed in the authorization server device 100. The authorization program is loaded into the processor 910 and executed by the processor 910. The memory 921 stores not only the authorization program but also an OS. OS is an abbreviation for Operating System. The processor 910 executes the authorization program while executing the OS. The authorization program and the OS may be stored in an auxiliary storage device 922. The authorization program and the OS stored in the auxiliary storage device 922 are loaded into the memory 921 and executed by the processor 910. Note that part or all of the authorization program may be incorporated into the OS.

[0021] The authorization server device 100 may include multiple processors that replace the processor 910. These multiple processors share the execution of the authorization program. Each processor is a device that executes the authorization program, just like the processor 910.

[0022] Data, information, signal values ​​and variable values ​​used, processed or output by the authorized program are stored in memory 921, auxiliary storage device 922, or registers or cache memory within processor 910.

[0023] The "part" of each of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150 may be interpreted as a "circuit," a "step," a "procedure," a "process," or a "circuitry." The authorization program causes a computer to execute an authorization logic receiving process, an evaluation rule receiving process, a generation process, an access request receiving process, and an access permission determining process. The "processes" of the authorization logic receiving process, the evaluation rule receiving process, the generation process, the access request receiving process, and the access permission determining process may be interpreted as a "program," a "program product," a "computer-readable storage medium storing a program," or a "computer-readable recording medium recording a program." The authorization method is a method performed by the authorization server device 100, which is a computer, executing an authorization program. The authorization program may be provided by being stored in a computer-readable recording medium. The authorization program may be provided as a program product.

[0024] ***Explanation of Operation*** Next, the operation of the authorization server device 100 according to this embodiment will be described. The operation procedure of the authorization server device 100 corresponds to an authorization method. Furthermore, the program that realizes the authorization process, which is the operation procedure of the authorization server device 100, corresponds to an authorization program.

[0025] The authorization process of the authorization server device 100 according to this embodiment includes an ontology generation process and an access permission determination process. The ontology generation process is a process for generating an authorization rule ontology 61, which is an example of an authorization rule 60. The access permission determination process is a process for receiving an access request 51 from a user and determining whether or not to permit access.

[0026] Fig. 2 is a flow diagram showing ontology generation processing in the authorization server device 100 according to this embodiment. Fig. 3 is a diagram showing a configuration example of an authorization rule ontology 61 which is an example of an authorization rule 60 according to this embodiment. Fig. 4 is a diagram showing a configuration example of an authorization logic ontology 611 included in the authorization rule ontology 61 according to this embodiment. Fig. 5 is a diagram showing a configuration example of an evaluation rule ontology 612 included in the authorization rule ontology 61 according to this embodiment.

[0027] 2, either step S101 of the authorization logic reception processing or step S102 of the evaluation rule reception processing may be processed first. Step S101 may be the evaluation rule reception processing, and step S102 may be the authorization logic reception processing. Alternatively, step S101 of the authorization logic reception processing and step S102 of the evaluation rule reception processing may be processed in parallel.

[0028] <Authorization Logic Receiving Process: Step S101> The authorization logic receiving unit 110 receives input of authorization logic data 31 including an access type, an access unit indicating the unit of authorization for the access type, and an evaluation attribute which is an attribute to be evaluated for each access unit. The access type is information indicating the authorization target of dynamic authorization, i.e., the type of access made by the user. Specifically, it is as follows:

[0029] The authorization logic data 31 is information that abstracts authorization logic including an access type 41, an access unit 42, and an evaluation attribute 43. The authorization logic data 31 is information that is input to an authorization logic ontology 611, which will be described later. The authorization logic data 31 is input by a system administrator. The system administrator is the person who manages authorization to the file server. On the other hand, it can be assumed that the system administrator has minimal security literacy.

[0030] For example, a system administrator considers what type of access unit 42 is desired for authorization and inputs authorization logic data 31. The system administrator need only consider which attributes to evaluate depending on the expected access target and scope of the user, who is the authorization target 20. Specifically, the system administrator inputs the access type 41, such as a service or a file, and the access unit 42, such as details thereof, by describing them in a tree structure or graph structure as authorization logic data 31. The system administrator then associates an evaluation attribute 43 with the access unit 42. If evaluation rule data 32 has already been entered at this time, the system administrator may select information to associate with the access unit 42 from the evaluation attribute status 44 or evaluation rule 45 included in the evaluation rule data 32.

[0031] As shown in Fig. 3, the authorization rule ontology 61 is composed of an authorization logic ontology 611 and an evaluation rule ontology 612. Fig. 4 shows an example of the detailed configuration of the authorization logic ontology 611. Fig. 5 shows an example of the detailed configuration of the evaluation rule ontology 612.

[0032] The access type 41 is an access target that is expected by the user. In the example of FIG. 4, service access and file access are set as the access type 41. The access unit 42 is a unit for which authorization is desired for each access type 41, i.e., a scope. In the example of FIG. 4, the access unit 42 is set to be "external SaaS session unit," "confidential file unit," "confidential directory unit," or "confidential file unit." The access unit 42, i.e., the scope, is expressed by, for example, a URL. When the access type 41 and the access unit 42 are identified, a node in the ontology is identified.

[0033] The evaluation attribute 43 is information indicating what attribute is evaluated in the access unit 42. In the example of Fig. 3, in the case of the access type "service access" and the access unit "external SaaS session unit," "location, time, connection method" are set as the evaluation attribute 43. Note that a more specific input interface will be described later.

[0034] <Evaluation Rule Receiving Process: Step S102> The evaluation rule receiving unit 120 receives input of evaluation rule data 32 including the evaluation attribute state 44 and the evaluation rule 45 indicating the approval conditions for the evaluation attribute state. Specifically, this is as follows.

[0035] The evaluation rule data 32 is information that is input to an evaluation rule ontology 612, which will be described later. Input of the evaluation rule data 32 requires specialized knowledge and is therefore assumed to be performed by a security expert.

[0036] An ontology such as the authorization logic ontology 611 or the evaluation rule ontology 612 can be expressed using, for example, RDF or JSON. For RDF, description languages ​​such as XML, Turtle, or N3 are used. For JSON, description languages ​​such as JSON-LD are used. When giving meaning to an ontology, as in this embodiment, it is efficient to use OWL. It is assumed that an OWL auxiliary tool will be used for the input interface. RDF is an abbreviation for Resource Description Framework. XML is an abbreviation for Extensible Markup Language. JSON is an abbreviation for JavaScript Object Notation. OWL is an abbreviation for Web Ontology Language.

[0037] 5, attribute information corresponding to the evaluation attribute 43 is set as the evaluation attribute state 44. Furthermore, a rule indicating the approval condition for the evaluation attribute state 44 is set as the evaluation rule 45.

[0038] <Generation Process: Step S103> The generation unit 130 generates authorization rules 60 for performing dynamic authorization based on the authorization logic data 31 and the evaluation rule data 32. In this embodiment, the generation unit 130 generates an authorization rule ontology 61 in an ontology format as the authorization rules 60.

[0039] The generation unit 130 generates an authorization logic ontology 611 by converting the access type 41, access unit 42, and evaluation attribute 43 included in the authorization logic data 31 into an ontology format. The generation unit 130 also generates an evaluation rule ontology 612 by converting the evaluation attribute state 44 and evaluation rule 45 included in the evaluation rule data 32 into an ontology format. That is, the generation unit 130 generates an authorization rule ontology 61 consisting of the authorization logic ontology 611 and the evaluation rule ontology 612 as an authorization rule 60.

[0040] The generation unit 130 generates a logic layer 661 in which the access type 41, the access unit 42, and the evaluation attribute 43 are converted into an ontology format as an authorization logic ontology 611. The generation unit 130 also generates an evaluation rule ontology 612 consisting of a pre-evaluation layer 671 in which the state 44 of the evaluation attribute is converted into an ontology format, and a rule evaluation layer 672 in which the evaluation rule 45 is converted into an ontology format.

[0041] As mentioned above, an ontology can be expressed using, for example, RDF or JSON. For RDF, description languages ​​such as XML, Turtle, or N3 are used. For JSON, description languages ​​such as JSON-LD are used. When giving meaning to an ontology, as in this embodiment, it is efficient to use OWL. Such ontology description languages ​​provide a format that allows the ontology to be uniquely interpreted.

[0042] The authorization rule ontology 61 generated by the generation unit 130 will be further described with reference to Figs. 3 to 5. In the authorization server device 100 according to this embodiment, the authorization rules 60 for determining whether or not to perform dynamic authorization are managed by dividing them into separate ontologies for authorization logic and evaluation rules. The authorization logic ontology 611 defines the type of evaluation flow to be performed depending on the type of access. The evaluation rule ontology 612 defines the components to be used in the evaluation flow. The pre-evaluation layer 671 represents the "state" of the authorization target. The rule evaluation layer 672 represents the "conditions" of the evaluation.

[0043] Specifically, the authorization rules 60 are organized into the so-called 5W1H format of What, Who, Where, When, Why, and How. The What element is expressed in the logic layer 661 of the authorization logic ontology 611. The Who, Where, When, and Why elements are expressed in the pre-evaluation layer 671 of the evaluation rule ontology 612. The How element is expressed in the rule evaluation layer 672 of the evaluation rule ontology 612. Furthermore, the evaluation rule ontology 612 is divided into the pre-evaluation layer 671 that represents the "state" of the user and the rule evaluation layer 672 that represents the "conditions" (evaluation rules) for authorizing the user. As described above, the authorization rule ontology 61 identifies the 5W1H, so-called What, Who, Where, When, Why, and How, from the user's access request. Finally, the structure is such that the evaluation rules written in the rule evaluation layer 672 can be specified.

[0044] <Ontology Storage Process: Step S104> The generating unit 130 stores the authorization rule ontology 61 generated in step S103 in the storage unit 160.

[0045] 6 is a flow diagram showing the access permission determination process in the authorization server device 100 according to this embodiment. The access permission determination process is a process for receiving an access request 51 from a user and determining whether or not to permit access.

[0046] <Access Request Reception Process: Step S201> The access request reception unit 140 receives an access request 51 from a user. The access request 51 includes information that the user presents to the authorization server device 100 in order to access a resource in the file server 200. Specifically, the access request 51 includes the resource to be accessed, the scope, and attribute information. The resource to be accessed may be a service, as well as various types of data such as a file. The resource to be accessed corresponds to the access type 41. Hereinafter, the resource to be accessed may also be referred to as the access type. The scope is information such as session-based, file-based, directory-based, or service-based. The scope corresponds to the access unit 42. A node in the authorization logic ontology 611 is identified by the resource to be accessed and the scope. Hereinafter, the scope may also be referred to as the access unit.

[0047] The attribute information is information such as person / place / time / connection method / reason that is included in the user or context. The attribute information identifies a node in the evaluation rule ontology 612. The attribute information corresponds to the evaluation attribute 43.

[0048] <Access permission determination process: step S202> The access permission determination unit 150 analyzes the access request 51, and refers to the authorization logic ontology 611 and the evaluation rule ontology 612 stored in the storage unit 160 to identify the evaluation rules of the rule evaluation layer 672 and determine whether to permit authorization.

[0049] Specifically, the access permission determination unit 150 selects an evaluation attribute 43 using the access type and access unit included in the access request 51 and the authorization logic ontology 611. The selected evaluation attribute 43 is set as a selected evaluation attribute 431. The selected evaluation attribute 431 is the evaluation attribute 43 corresponding to the access type and access unit included in the access request 51. The access permission determination unit 150 then determines whether to grant or deny the access request 51 using the selected evaluation attribute 431, user attribute information included in the access request 51, and the evaluation rule ontology 612. More specifically, the access permission determination unit 150 uses the selected evaluation attribute 431 and the pre-evaluation layer 671 to select an ontology from the evaluation rule ontology 612 that corresponds to the selected evaluation attribute 431. The access permission determination unit 150 then determines whether to grant or deny the access request 51 using the rule evaluation layer 672 in the selected ontology and user attribute information included in the access request 51.

[0050] Specific examples of the access permission determination procedure are described below using the examples of FIGS. 3 to 5 . (1) The access permission determination unit 150 refers to the authorization logic ontology 611 using the access type and access unit included in the access request 51 and selects the root node of the pre-evaluation layer 671 as the selected evaluation attribute 431. In the example of FIG. 4 , for example, the evaluation attributes "person" and "location" are selected from the access type "service access" and the access unit "intranet service unit." (2) From the root node of the pre-evaluation layer 671 selected as the selected evaluation attribute 431, the access permission determination unit 150 selects a node of the rule evaluation layer 672 from the attribute information included in the access request 51 and determines an evaluation rule. At this time, if a unit such as "person," "location," or "time" is specified in the pre-evaluation layer 671, the condition of the rule evaluation layer 672 linked to the node below is processed as an AND condition. Furthermore, when an AND / OR condition is directly specified in units such as "affiliation," "job title," and "access source" in the pre-evaluation layer 671, the conditions in the rule evaluation layer 672 are processed as the specified AND / OR condition. In the example of Figure 5, when "location" is selected as the selected evaluation attribute 431, an evaluation rule in the rule evaluation layer 672 linked to "location" is identified. (3) The access permission determination unit 150 evaluates the attribute information included in the access request 51 using the identified evaluation rule in the rule evaluation layer 672, and determines whether to authorize the access request 51.

[0051] If it is determined that the access request 51 is denied (NO in step S203), the process proceeds to step S204, in which the access permission determining unit 150 notifies the user that the access request 51 has been denied.

[0052] If it is determined that the access request 51 is permitted (YES in step S203), the process proceeds to step S205. In step S205, the access permission determination unit 150 issues an access token 52 including the permitted access target (corresponding to the access type) and scope (corresponding to the access unit), and transmits the access token 52 to the user. The access token 52 may include the contents of the access request 51. The format of the access token 52 may be arbitrary.

[0053] When the user receives the access token 52, the user can present the access token 52 to the file server 200 to access the resource.

[0054] ***Other Configurations*** <Variation 1> In this embodiment, the authorization server device 100 has been described as having an ontology generation function that generates an authorization rule ontology and an access permission determination function that determines whether to authorize an access request. As Variation 1, the first authorization server device may have only the ontology generation function. Then, a second authorization server device that is a computer separate from the authorization server device may be prepared, and the second authorization server device may have the access permission determination function. In other words, the authorization server device 100 may be an authorization system including a first authorization server device and a second authorization server device.

[0055] In this case, the user transmits an access request to the second authorization server device. The second authorization server device acquires the authorization rule ontology from the first authorization server device. The second authorization server device determines whether to grant the access request using the authorization rule ontology acquired from the first authorization server device. The access permission determination process by the second authorization server device is the same as that described in the first embodiment.

[0056] <Modification 2> In this embodiment, the functions of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150 are realized by software. As a modification, the functions of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150 may be realized by hardware. Specifically, the authorization server device 100 includes an electronic circuit 909 instead of the processor 910.

[0057] 7 is a diagram showing a configuration example of the authorization server device 100 according to a modified example of this embodiment. The electronic circuit 909 is a dedicated electronic circuit that realizes the functions of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150. Specifically, the electronic circuit 909 is a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an ASIC, or an FPGA. GA is an abbreviation for Gate Array. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array.

[0058] The functions of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150 may be realized by a single electronic circuit, or may be distributed across multiple electronic circuits.

[0059] As another modification, some of the functions of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150 may be realized by electronic circuits, and the remaining functions may be realized by software. Also, some or all of the functions of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150 may be realized by firmware.

[0060] Each of the processor and the electronic circuit is also called a processing circuitry. That is, the functions of the authorization logic receiving unit 110, the evaluation rule receiving unit 120, the generation unit 130, the access request receiving unit 140, and the access permission determining unit 150 are realized by the processing circuitry.

[0061] ***Explanation of Effects of the Present Embodiment*** As described above, the authorization server device 100 according to the present embodiment can define a basic ontology that abstracts evaluation conditions as an authorization logic ontology. This has the effect of making it easier for a system administrator to input authorization logic. Furthermore, the authorization server device 100 according to the present embodiment separately generates a basic ontology that abstracts evaluation conditions and an evaluation rule ontology that expresses evaluation conditions in ontology format. This makes it possible to prevent the appearance of identical nodes in a graph structure.

[0062] As described above, the authorization server device 100 according to the present embodiment can improve the readability and maintainability of the ontology that expresses the authorization rules. Furthermore, the authorization server device 100 according to the present embodiment eliminates the description of duplicated evaluation rules, and can reduce the number of nodes in the ontology. Furthermore, the authorization server device 100 according to the present embodiment separates the ontology into authorization logic and evaluation rules, which has the effect of making it easier to create combinations of evaluation rules according to purposes.

[0063] In a method for determining the access range based on attributes presented by a user, the authorization request becomes larger as the number of attributes to be handled increases. On the other hand, the authorization server device 100 according to this embodiment has the advantage that it can determine the attributes to be presented from the authorization logic according to the purpose, and the attributes to be included in the authorization request become clear. Therefore, since the attributes to be presented by the user are easy to understand, there is no need to present unnecessary information, which is also effective from the viewpoint of personal information.

[0064] Embodiment 2 In this embodiment, differences from and additions to embodiment 1 will be mainly described. In this embodiment, components having the same functions as those in embodiment 1 will be assigned the same reference numerals, and descriptions thereof will be omitted.

[0065] In this embodiment, a mode will be described in which a system administrator can select a preset when inputting authorization logic data using the authorization logic receiving unit 110. In this embodiment, an ontology that defines a preset of the pre-evaluation layer for each authorization logic is prepared as the template layer 662.

[0066] ***Description of Configuration*** Fig. 8 is a diagram showing a configuration example of the authorization server device 100 according to this embodiment. In this embodiment, in addition to the components described in embodiment 1, a template receiving unit 170 is provided. The other configuration is the same as in embodiment 1.

[0067] 9 is a diagram showing an example of the configuration of an authorization logic ontology 611 according to this embodiment. In this embodiment, the authorization logic ontology 611 has a logic layer 661 and a template layer 662. The logic layer 661 is a layer in which the access type 41, the access unit 42, and the access criteria 46 indicating the access level criteria 33 are converted into an ontology format. The template layer 662 is a layer in which the access criteria 46 and the evaluation attributes 43 corresponding to the access criteria 46 are converted into an ontology format.

[0068] ***Explanation of Operation*** First, of the ontology generation processing, a description will be given of the processing for generating the authorization logic ontology 611. The processing for generating the evaluation rule ontology 612 is the same as in the first embodiment.

[0069] 10 is a flow diagram showing the process of generating the authorization logic ontology 611 according to this embodiment. In step S301, the template receiving unit 170 receives input of information including access criteria 46 indicating the criteria for the access level. The system administrator inputs information indicating the criteria for the access level for the organization, such as a protection level or a risk value. In step S302, the authorization logic receiving unit 110 receives input of the authorization logic data 31 including the access type 41, the access unit 42, and the evaluation attribute 43.

[0070] In step S303, the generation unit 130 generates an authorization logic ontology 611 having a logic layer 661 and a template layer 662. The logic layer 661 is a layer obtained by converting the access type 41, the access unit 42, and the access criteria 46 indicating the criteria for the access level into an ontology format. The template layer 662 is a layer obtained by converting the access criteria 46 and the evaluation attributes 43 corresponding to the access criteria 46 into an ontology format.

[0071] The authorization logic ontology 611 according to this embodiment will be further described with reference to Fig. 9. Access criteria 46 are set at the end nodes in the logic layer 661. As shown in Fig. 9, access criteria 46 such as "level 1 protection" and "risk value 6 or more" are set at the end nodes in the logic layer 661. In this way, in the logic layer 661, the access type 41 and access unit 42 are expressed in the same way as in the first embodiment, and nodes of the access criteria 46 in the template layer 662 are set for the parts linked to the evaluation rule ontology 612.

[0072] An evaluation attribute 43 linked to the pre-evaluation layer 671 of the evaluation rule ontology 612 is set at the end node in the template layer 662. If the evaluation rule ontology 612 has already been generated, the generation unit 130 may select the evaluation attribute 43 linked to the pre-evaluation layer 671 from the evaluation rule ontology 612. In the "by level" ontology of the template layer 662 of FIG. 9 , evaluation attributes 43 such as "person," "place," and "time" are set at the end node. Alternatively, as shown in the "risk value" ontology of the template layer 662 of FIG. 9 , an access criterion 46 such as "level 1 protection" or "level 2 protection" may be set at the end node. Then, as represented by the dotted line in FIG. 9 , a graph structure may be adopted in which the end node of the "risk value" ontology is linked to the "risk value" ontology.

[0073] The process of generating the evaluation rule ontology 612 is the same as in embodiment 1. The generating unit 130 stores the authorization rule ontology 61, which is made up of the authorization logic ontology 611 and the evaluation rule ontology 612, in the storage unit 160, as in embodiment 1.

[0074] The accessibility determination process according to this embodiment is the same as that according to the first embodiment, except that the template layer 662 is used. The accessibility determination unit 150 according to this embodiment uses the access request 51 and the logic layer 661 to select from the logic layer 661 the access criteria 46 that correspond to the access type and access unit included in the access request 51. Then, the accessibility determination unit 150 uses the selected access criteria 46 and the template layer 662 to select the evaluation attribute 43 that corresponds to the selected access criteria 46 as the selected evaluation attribute 431. The subsequent processing is the same as that described in the first embodiment.

[0075] ***Description of Effects of the Present Embodiment*** As described above, the authorization server device according to the present embodiment includes a template receiving unit that separately receives input of access criteria as repeatedly used data. The generation unit then generates an authorization logic ontology having a logic layer and a template layer from the input data received by the template receiving unit and the authorization logic receiving unit. In this way, an ontology that defines presets of the pre-evaluation layer for each authorization logic is prepared as the template layer. This allows the system administrator to select a preset when entering authorization logic using the authorization logic receiving unit. Therefore, the authorization server device according to the present embodiment makes it easier for the system administrator to select an authorization flow.

[0076] In the above first and second embodiments, each unit of the authorization server device has been described as an independent functional block. However, the configuration of the authorization server device does not have to be the same as that of the above-described embodiments. The functional blocks of the authorization server device may have any configuration as long as they can realize the functions described in the above-described embodiments. Furthermore, the authorization server device may not be a single device, but may be a system composed of multiple devices. Furthermore, multiple parts of the first and second embodiments may be combined and implemented. Alternatively, only one part of these embodiments may be implemented. In addition, these embodiments may be combined in any way, either as a whole or in part. That is, in the first and second embodiments, the respective embodiments may be freely combined, or any component of each embodiment may be modified, or any component of each embodiment may be omitted.

[0077] The above-described embodiments are essentially preferred examples and are not intended to limit the scope of the present disclosure, the scope of application of the present disclosure, or the scope of use of the present disclosure. The above-described embodiments can be modified in various ways as needed. For example, the procedures described using flow charts or sequence diagrams may be modified as appropriate.

[0078] 20 Authorization target, 31 Authorization logic data, 32 Evaluation rule data, 33 Access level criteria, 41 Access type, 42 Access unit, 43 Evaluation attribute, 431 Selected evaluation attribute, 44 Evaluation attribute state, 45 Evaluation rule, 46 Access criteria, 51 Access request, 52 Access token, 60 Authorization rule, 61 Authorization rule ontology, 611 Authorization logic ontology, 661 Logic layer, 662 Template layer, 612 Evaluation rule ontology, 671 Pre-evaluation layer, 672 Rule evaluation layer, 100 Authorization server device, 110 Authorization logic reception unit, 120 Evaluation rule reception unit, 130 Generation unit, 140 Access request reception unit, 150 Access permission determination unit, 160 Storage unit, 170 Template reception unit, 200 File server, 909 Electronic circuit, 910 Processor, 921 Memory, 922 Auxiliary storage device, 930 Input interface, 940 output interface, 950 communication device.

Claims

1. An authorization server device comprising: an authorization logic receiving unit that receives input of authorization logic data including an access type indicating a type of access to an authorization target of dynamic authorization, an access unit indicating a unit for performing authorization for the access type, and an evaluation attribute that is an attribute to be evaluated for the access unit; an evaluation rule receiving unit that receives input of evaluation rule data including a state of the evaluation attribute and an evaluation rule indicating an authorization condition for the state of the evaluation attribute; and a generation unit that generates an authorization rule for performing the dynamic authorization based on the authorization logic data and the evaluation rule data.

2. The authorization server device of claim 1, wherein the generation unit generates the authorization rule comprising an authorization logic ontology obtained by converting the access type, the access unit, and the evaluation attribute included in the authorization logic data into an ontology format, and an evaluation rule ontology obtained by converting the state of the evaluation attribute and the evaluation rule included in the evaluation rule data into an ontology format.

3. The authorization server device described in claim 2, wherein the generation unit generates the evaluation rule ontology consisting of a pre-evaluation layer in which the state of the evaluation attribute is converted into an ontology format, and a rule evaluation layer in which the evaluation rule is converted into an ontology format.

4. The authorization server device according to claim 3, further comprising an access permission determination unit that acquires an access request from a user, selects evaluation attributes corresponding to the access type and access unit included in the access request as selected evaluation attributes using the access type and access unit included in the access request and the authorization logic ontology, and determines whether to grant or deny the access request using the selected evaluation attributes, the user's attribute information included in the access request, and the evaluation rule ontology.

5. The authorization server device described in claim 4, wherein the access permission determination unit uses the selected evaluation attribute and the pre-evaluation layer to select an ontology from the evaluation rule ontology that corresponds to the selected evaluation attribute, and determines whether to grant or deny the access request using the rule evaluation layer in the selected ontology and the user's attribute information.

6. The authorization server device according to claim 4 or 5, further comprising: a template receiving unit that receives input of information including access criteria that indicate standards for access levels; and the generation unit that generates the authorization logic ontology comprising: a logic layer in which the access type, the access unit, and the access criteria are converted into an ontology format; and a template layer in which the access criteria and the evaluation attributes corresponding to the access criteria are converted into an ontology format.

7. The authorization server device of claim 6, wherein the access permission determination unit uses the access type and access unit included in the access request and the logic layer to select access criteria corresponding to the access type and access unit included in the access request, and uses the selected access criteria and the template layer to select the selected evaluation attribute corresponding to the selected access criteria.

8. An authorization server device comprising: an access permission determination unit that determines whether to grant or deny an access request obtained from a user, using an authorization logic ontology obtained by converting into an ontology format an access type indicating a type of access to an authorization target of dynamic authorization, an access unit indicating a unit for performing authorization for the access type, and an evaluation attribute which is an attribute to be evaluated for the access unit; and an evaluation rule ontology obtained by converting into an ontology format the state of the evaluation attribute and an evaluation rule indicating an authorization condition for the state of the evaluation attribute.

9. The authorization server device according to claim 8, wherein the evaluation rule ontology comprises a pre-evaluation layer in which the state of the evaluation attribute is converted into an ontology format, and a rule evaluation layer in which the evaluation rule is converted into an ontology format.

10. The authorization server device described in claim 9, wherein the access permission determination unit uses the access type and access unit included in the access request and the authorization logic ontology to select an evaluation attribute corresponding to the access type and access unit included in the access request as a selected evaluation attribute, and determines whether to grant or deny the access request using the selected evaluation attribute, the user attribute information included in the access request, and the evaluation rule ontology.

11. The authorization server device described in claim 10, wherein the access permission determination unit uses the selected evaluation attribute and the pre-evaluation layer to select an ontology from the evaluation rule ontology that corresponds to the selected evaluation attribute, and determines whether to grant or deny the access request using the rule evaluation layer in the selected ontology and the user's attribute information.

12. An authorization system comprising: an authorization logic receiving unit that receives input of authorization logic data including an access type indicating a type of access to an authorization target of dynamic authorization, an access unit indicating a unit for performing authorization for the access type, and an evaluation attribute that is an attribute to be evaluated for the access unit; an evaluation rule receiving unit that receives input of evaluation rule data including a state of the evaluation attribute and an evaluation rule indicating an authorization condition for the state of the evaluation attribute; a generation unit that generates an authorization rule for performing the dynamic authorization based on the authorization logic data and the evaluation rule data; and an access permission determination unit that acquires an access request from a user and determines whether to grant or deny the access request using the authorization rule.

13. An authorization method in which a computer receives input of authorization logic data including an access type indicating a type of access to an authorization target of dynamic authorization, an access unit indicating a unit for performing authorization for the access type, and an evaluation attribute which is an attribute to be evaluated for the access unit; the computer receives input of evaluation rule data including a state of the evaluation attribute and an evaluation rule indicating an authorization condition for the state of the evaluation attribute; and the computer generates an authorization rule for performing the dynamic authorization based on the authorization logic data and the evaluation rule data.

14. An authorization method in which a computer determines whether to grant an access request obtained from a user by using: an authorization logic ontology obtained by converting, into an ontology format, an access type indicating the type of access to an authorization target of dynamic authorization, an access unit indicating the unit of authorization for the access type, and an evaluation attribute which is an attribute to be evaluated for the access unit; and an evaluation rule ontology obtained by converting, into an ontology format, the state of the evaluation attribute and an evaluation rule indicating the authorization condition for the state of the evaluation attribute.

15. An authorization program that causes a computer to execute the following steps: an authorization logic reception process that receives input of authorization logic data including an access type indicating a type of access to an authorization target of dynamic authorization, an access unit indicating a unit for performing authorization for the access type, and an evaluation attribute which is an attribute to be evaluated for the access unit; an evaluation rule reception process that receives input of evaluation rule data including a state of the evaluation attribute and an evaluation rule indicating an authorization condition for the state of the evaluation attribute; and a generation process that generates an authorization rule for performing the dynamic authorization based on the authorization logic data and the evaluation rule data.

16. An authorization program that causes a computer to execute access permission determination processing to determine whether to grant or deny an access request obtained from a user, using an authorization logic ontology obtained by converting into an ontology format an access type indicating the type of access to an authorization target of dynamic authorization, an access unit indicating the unit of authorization for the access type, and an evaluation attribute which is an attribute to be evaluated for the access unit, and an evaluation rule ontology obtained by converting into an ontology format the state of the evaluation attribute and an evaluation rule indicating the authorization condition for the state of the evaluation attribute.

Images