Authorization device, authorization method, and authorization program

Abstract

This authorization device 1 comprises: a management unit 12 that manages resource provider information in which identification information about a resource and identification information about a resource provider are associated with each other; and an authorization unit 11 that receives an access request for accessing a desired resource, uses the resource provider information to identify a resource provider corresponding to the desired resource, and uses an authorization policy of the resource provider to determine authorization of the access request.

Description

Authorization Device, Authorization Method, and Authorization Program

[0001] The present disclosure relates to an authorization device, an authorization method, and an authorization program.

[0002] In a data circulation infrastructure, in order to maintain data governance, authorization technology for controlling access requests from users is important.

[0003] For example, role-based access control (RBAC) that performs access control based on the roles of users and the like, and attribute-based access control (ABAC) that performs access control based on the attributes of users and the like are known.

[0004] When highly flexible authorization control is required, the latter ABAC is used (see Non-Patent Document 1).

[0005] Vincent C. Hu, et al., "Guide to Attribute Based Access Control (ABAC) Definition and Considerations", U.S. Department of Commerce, National Institute of Standards and Technology Special Publication 800-162, January 2014

[0006] However, in ABAC, since it is necessary to define an authorization policy considering various attributes, the design and management of the authorization policy become complicated. Especially in a large-scale system, it is difficult to maintain the consistency of the authorization policy.

[0007] In addition, the introduction of ABAC requires the collection of detailed attribute information and the creation of an authorization policy, so a lot of time and labor are required for the initial setting.

[0008] In addition, since ABAC performs attribute evaluation and authorization policy application in real time, it affects the performance of the system. When there are many authorization policies, a delay occurs in authorization.

[0009] This disclosure is made in view of the circumstances described above, and the purpose of this disclosure is to provide a technology that can improve the authorized technology.

[0010] An authorization device in one aspect of the present disclosure includes a management unit that manages resource provider information, which associates resource identification information with resource provider identification information, and an authorization unit that receives an access request for accessing a desired resource, identifies a resource provider corresponding to the desired resource using the resource provider information, and determines whether to authorize the access request using the resource provider's authorization policy.

[0011] An authorization method in one aspect of the present disclosure is an authorization method performed by an authorization device, which manages resource provider information that associates resource identification information with resource provider identification information, receives an access request for accessing a desired resource, identifies a resource provider corresponding to the desired resource using the resource provider information, and determines whether to authorize the access request using the resource provider's authorization policy.

[0012] An authorization program in one aspect of the present disclosure causes a computer to perform the following processes: managing resource provider information, which associates resource identification information with resource provider identification information; receiving an access request to access a desired resource; identifying a resource provider corresponding to the desired resource using the resource provider information; and determining whether to authorize the access request using the resource provider's authorization policy.

[0013] According to this disclosure, we can provide technology that can improve authorization technology.

[0014] Figure 1 shows an example of the system configuration according to this embodiment. Figure 2 shows an example of resource provider information according to this embodiment. Figure 3 shows an example of an authorization policy according to this embodiment. Figure 4 shows an example of authorization processing according to this embodiment. Figure 5 shows an example of the system configuration according to Embodiment 1. Figure 6 shows an example of an authorization policy according to Embodiment 1. Figure 7 shows an example of resource provider information according to Embodiment 1. Figure 8 shows an example of authorization processing according to Embodiment 1. Figure 9 shows an example of the system configuration according to Embodiment 2. Figure 10 shows an example of authorization processing according to Embodiment 2. Figure 11 shows a management image of a conventional authorization policy. Figure 12 shows a management image of the authorization policy of this embodiment. Figure 13 shows an example of the hardware configuration of the authorization device.

[0015] Embodiments of this disclosure will be described below with reference to the drawings. In the drawings, the same parts are denoted by the same reference numerals and their descriptions are omitted.

[0016] [Summary of this disclosure] The aforementioned issues are feared to become even more serious in authorization controls between multiple organizations or companies, such as in data distribution infrastructure.

[0017] Therefore, this disclosure will disclose authorization methods and authorization policy management methods centered on resource providers such as organizations and companies in data distribution within and between organizations, and within and between companies.

[0018] This simplifies the management of authorization policies and enables faster authorization decisions.

[0019] From now on, we will use companies as examples of resource providers.

[0020] [System Configuration] Figure 1 shows an example of the system configuration according to this embodiment.

[0021] The system comprises an authorization device 1 and management devices 2 for each company.

[0022] The authorization device 1 is a device that authorizes and controls access requests from user terminals 100 to resources within a company. The authorization device 1 comprises an authorization unit 11 and a management unit 12.

[0023] The authorization unit 11 receives an access request from the user terminal 100 to access a desired resource, identifies the company corresponding to the desired resource using the resource provider information of the management unit 12, obtains the authorization policy of the identified company from the company's management device 2, makes an authorization decision on the access request using the obtained authorization policy, and controls the access request based on the result of the authorization decision.

[0024] The management unit 12 has a function to manage resource provider information, which associates resource names with the names of the companies that provide the resources. An example of resource provider information is shown in Figure 2.

[0025] Management device 2 is a corporate management device and has the function of managing corporate authorization policies and corporate resources. For example, management device 2 for corporate A manages corporate A's authorization policies and corporate A's resources A and B. Corporate A's authorization policy is illustrated in Figure 3. It is set to allow only "read" access to resources A and B.

[0026] [System Operation] Figure 4 shows an example of the authorization process according to this embodiment.

[0027] The user terminal 100 sends an access request to the authorization device 1 to access resource A (step S101).

[0028] Next, the authorization device 1 receives an access request from the user terminal 100 and uses the resource provider information stored in the management unit 12 to identify company A corresponding to resource A (step S102).

[0029] Next, the authorization device 1 obtains the authorization policy of the identified company A from the management device 2 of company A (step S103), and uses the obtained authorization policy of company A to determine whether to authorize the access request (step S104).

[0030] Finally, the authorization device 1 controls access requests to resource A based on the result of the authorization determination (step S105). In the case of the authorization policy of company A shown in Figure 3, permission is only granted when "reading" the resources of "company A".

[0031] [Example 1] This example describes a case where resources are stored in object storage. In object storage, authorization control can be performed using either an ABAC or RBAC model based on users, groups, and roles.

[0032] Figure 5 shows an example of the system configuration according to Example 1.

[0033] The management device 2 within the company is placed inside the authorization device 1 to form the authorization policy DB 2'. The authorization unit 11 of the authorization device 1 uses the authorization policy DB 2' within the authorization device 1 to determine whether to authorize access requests, and based on the result of the authorization determination, it directly accesses the company's object storage. The authorization policy DB 2' stores the authorization policies set by companies A and B, as illustrated in Figure 6.

[0034] The management unit 12 of the authorization device 1 is defined as the metadata DB 12'. The metadata DB 12' stores resource provider information, which associates object names with the company names of the companies that provide the resources, as illustrated in Figure 7.

[0035] Figure 8 shows an example of the approval process according to Example 1.

[0036] The user terminal 100 sends an access request to the authorization device 1 to access object A (step S201).

[0037] Next, the authorization device 1 receives an access request from the user terminal 100 and identifies company A corresponding to object A using the resource provider information stored in the metadata DB 12' (step S202).

[0038] Next, the authorization device 1 retrieves the authorization policy of the identified company A from the authorization policy DB 2' (step S203), and uses the retrieved authorization policy of company A to determine whether to authorize the access request (step S204).

[0039] Finally, the authorization device 1 controls access requests to object A based on the result of the authorization determination (step S205). In the case of the authorization policy of company A shown in Figure 6(a), permission is only granted when "reading" an object of "company B".

[0040] [Example 2] The case of configuring with physically separated companies or systems will be described.

[0041] FIG. 9 is a diagram showing a configuration example of the system according to Example 2.

[0042] Each company manages its own authorization policy within its own system and includes an authorization determination device 2'' equipped with an authorization determination function (PDP; Policy Decision Point).

[0043] The authorization determination device 2'' corresponds to the management device 2 shown in FIG. 1. However, while the management device 2 simply manages (stores) the authorization policy, the authorization determination device 2'' executes an authorization determination process using the authorization policy.

[0044] FIG. 10 is a diagram showing an example of the authorization process according to Example 2.

[0045] The user terminal 100 transmits an access request for accessing object A to the authorization device 1 (step S301).

[0046] Next, the authorization device 1 receives the access request from the user terminal 100 and identifies company A corresponding to object A using the resource provider information (see FIG. 7) stored in the metadata DB12' (step S302).

[0047] Next, the authorization device 1 transmits an authorization determination request for determining the authorization of the access request to the authorization determination device 2'' of the identified company A (step S303).

[0048] Next, the authorization determination device 2'' of company A determines the authorization of the access request using the authorization policy of company A (see FIG. 6(a)) (step S304) and returns the determined result to the authorization device 1 (step S305).

[0049] Finally, the authorization device 1 controls the access request for object A based on the determined result (step S306).

[0050] [Effect] Figure 11 shows a diagram illustrating the management of traditional authorization policies. In ABAC, authorization policies are defined by combining user attributes, resource attributes, actions, and environment attributes, and access is granted or denied based on the values ​​of these attributes.

[0051] On the other hand, in this embodiment, as illustrated in Figure 12, the authorized resources are managed in association with the resource providers, and furthermore, the authorization policy is also managed, thus providing a technology that can improve authorization technology. Specifically, the following effects can be obtained.

[0052] (1) It is possible to simplify the management of authorization policies.

[0053] In the ABAC authorization model, a complex registration (initial setup) of authorization policies was required before users could configure authorization policies.

[0054] On the other hand, in this embodiment, operation is possible with only the following two simple policies as initial policy settings.

[0055] In the authorization unit 11 of the authorization device 1, resource providers only need to allow CRUD (Create, Read, Update, Delete) operations on their own authorization policies. For example, as an initial setting, a simple rule is sufficient: company A can only CRUD operations on company A's authorization policies.

[0056] The authorization policy of management device 2 only needs to be valid for resources of a specific company. For example, the authorization policy for company A only needs to be a simple rule that is valid for resources within the scope of company A.

[0057] (2) Operational errors can be prevented.

[0058] In data distribution platforms involving multiple organizations and companies, the accidental leakage of data to other companies is an extremely sensitive issue. Existing authorization models require operational measures and restrictions to prevent operational errors, making management difficult.

[0059] On the other hand, in this embodiment, each company has its own independent authorization rules and authorized resources, so by registering only the simple operational rules described in (1), it is possible to prevent the setting of incorrect authorization rules for other companies' resources and prevent serious operational errors.

[0060] (3) It enables faster evaluation of authorization policies.

[0061] Evaluating authorization policies requires evaluating all policies registered in many systems.

[0062] On the other hand, in this embodiment, authorized resources are divided by resource provider, and the authorization policy is also divided accordingly by resource provider, thus limiting the scope of authorization policies to be evaluated. This enables faster authorization policy evaluation.

[0063] [Other] This disclosure is not limited to the embodiments described above. This disclosure can be modified in numerous ways within the scope of the gist of this disclosure.

[0064] The authorization device 1 of this embodiment described above can be realized using a general-purpose computer system, for example, as shown in Figure 13, which includes a CPU 901, a memory 902, a storage 903, a communication device 904, an input device 905, and an output device 906. The memory 902 and the storage 903 are storage devices. In this computer system, each function of the authorization device 1 is realized when the CPU 901 executes a predetermined program loaded onto the memory 902.

[0065] The authorization device 1 may be implemented on a single computer. The authorization device 1 may be implemented on multiple computers. The authorization device 1 may be a virtual machine implemented on a computer.

[0066] The program for authorization device 1 can be stored on a computer-readable recording medium such as an HDD, SSD, USB memory, CD, or DVD (Digital Versatile Disc). A computer-readable recording medium is, for example, a non-transitory recording medium. The program for authorization device 1 can also be distributed via a communication network.

[0067] 1 Authorization device 11 Authorization unit 12 Management unit 12' Metadata DB 2 Management device 2' Authorization policy DB 2'' Authorization determination device 100 User terminal 901 CPU 902 Memory 903 Storage 904 Communication device 905 Input device 906 Output device

Claims

1. An authorization device comprising: a management unit that manages resource provider information, which associates resource identification information with resource provider identification information; and an authorization unit that receives an access request to access a desired resource, identifies the resource provider corresponding to the desired resource using the resource provider information, and determines whether to authorize the access request using the authorization policy of the resource provider.

2. The authorization device according to claim 1, further comprising a management unit for managing authorization policies of resource providers, wherein the authorization unit determines whether to authorize the access request using the authorization policy.

3. The authorization device according to claim 1, wherein the authorization unit transmits an authorization determination request for authorization determination to the resource provider's authorization determination device, instead of determining whether to authorize the access request.

4. The authorization device according to claim 1, wherein the resource is stored in object storage.

5. The authorization device according to claim 1, wherein the resources and the authorization policy are managed for each resource provider.

6. An authorization method performed by an authorization device, comprising: managing resource provider information that associates resource identification information with resource provider identification information; receiving an access request for accessing a desired resource; identifying a resource provider corresponding to the desired resource using the resource provider information; and determining whether to authorize the access request using the resource provider's authorization policy.

7. An authorization program that causes a computer to perform the following: a process for managing resource provider information, which associates resource identification information with resource provider identification information; a process for receiving access requests to access desired resources, identifying the resource provider corresponding to the desired resource using the resource provider information, and determining whether to authorize the access request using the resource provider's authorization policy.

Images