JP4379040B2 - Distributed cooperative information use control method and system - Google Patents

Description

  The present invention relates to a distributed cooperative information use control method and system, and more particularly, to a resource provider apparatus that has resources on a network and allows resource operations according to conditions, and resource operation requesters that request resource operations. In a system consisting of devices, an operation provider performs a necessary operation such as a resource operation request, and then makes a use permission determination, and makes a predetermined resource operation request including a requested resource operation according to the result. The present invention relates to a distributed cooperative information usage control method and system.

  FIG. 13 is a diagram for explaining the operation of the conventional information use control system. As preconditions for the following processing, it is assumed that there are a plurality of operation side devices that allow resource operations on the network according to conditions, and there are requester side devices that request resource operations.

  First, an operation request is issued from the requester side device to the operation side device (step 11). Prior to this processing, the resource operation requester is identified using authentication or the like, and the identification information (user ID or the like) is attached, the user's attribute or information indicating how to use the information. It is also possible to attach it.

The operating side apparatus evaluates the request based on the policy (step 12). Here, a policy is a usage control rule set for a resource (single / plural), and an operation target (direct URL designation / condition designation), operation content, and the rule are applied. It consists of the applicable conditions. Parameters set as application conditions include information about users, information about operation details, information about target resources, etc.
-As user information, user authentication status, user personal information (groups, etc.);
-As information about the operation content, usage purpose, usage restrictions (private use, no redistribution, etc.);
-As information about the target resource, meta information about the resource (including operation history such as the number of operations);
Etc.

  Next, the operation side device performs an operation based on the evaluation in step 12 (step 13), and transmits a response based on the policy evaluation result and the resource operation result to the requester side device (step 14).

  Next, the resource operation based on the policy in step 13 will be described.

  FIG. 14 is a flowchart of a determination process based on a conventional policy.

If the determination result in step 12 is “non-permitted” or “determination not possible” (step 131, Yes), the operating device creates a response to the requester device (step 132). On the other hand, when the determination result is “permitted” (No in step 131), the requested resource operation is performed (step 133). When the mandatory operation is described in the policy (step 134, Yes), the mandatory operation is performed (step 135), and a response to the request source is created (step 136) (for example, Non-Patent Document 1). reference).
XACML (http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=xacml)

  However, in the above-described conventional method, it is complicated to explicitly provide all information related to the operation requester and the operation request at the time of the operation request, and there is a high possibility of leakage.

  Further, as a condition for permitting the resource operation, another resource operation other than acquisition cannot be assumed.

  Furthermore, there is a problem that the mandatory operation can be performed only by the server which is the operation side device.

  The present invention has been made in view of the above points. The requester side requests the requester side device or a third party to acquire resources necessary for policy evaluation and other operations from the requester side. A distributed cooperative information usage control method capable of avoiding the inability to determine true / false of application conditions due to lack of information or premised resource operations, without being much conscious of information and resource operations necessary for policy evaluation in the device, and The purpose is to provide a system.

  A further object of the present invention is to provide a distributed cooperative information usage control method and system capable of performing a mandatory operation on a server other than the server serving as the operation side device.

  FIG. 1 is a diagram for explaining the principle of the present invention.

The present invention (claim 1), between a plurality of apparatus on a network, and against the resource to define a plurality of parties including providers, to protect the intent of each resource owner, application conditions and their In a distributed cooperative information usage control method for hierarchically determining policies consisting of specific actions based on authenticity and performing resource operations,
A resource operation request is transmitted from a device on the resource operation requester side (hereinafter referred to as “requester side device”) to a device that operates the resource (hereinafter referred to as “operation side device”) (step 1).
In the operation side device,
Obtain a resource operation request (step 2),
Applicable conditions set for one or a plurality of resources stored in the storage means, specific operations when the applicable conditions are “true” (required requested resource operation, requested Either the requested resource operation is rejected, one or more resource operations are requested from the operating device, the requester device, or another device, or the permission request for the requested resource operation is not determined. Or a plurality of policies) set by a resource provider that is a usage control rule including a specific action when the application condition is “false” and a specific action when the application condition is finally “undecidable” Based on the above, it is determined whether the application condition included in the policy at the time of receiving the resource operation request is true or false (step 3),
If the application condition included in the policy is "undecidable", in order to use the policy prescribed by the parties that are different from the resource provider, it is necessary to obtain the variables and environment values necessary for the judgment and each device Request one or more determination resource operations, represented by the acquisition of authentication results, from the device having the determination resource, and again determine the application conditions included in the policy based on the operation results. However, if it is still “determinable”, the specific action when the application condition included in the policy is finally “determinable” is performed by any means, and the operation result or notification is transmitted to the requester device. (Steps 4 and 5),
If the application condition included in the policy is “true”, the specific operation when the application condition is “true” is performed by any means, and the operation result or notification is transmitted to the requester side device (step 4). , 5),
If the application condition included in the policy is “false”, the specific operation when the application condition is “false” is performed by any means, and the operation result or notification is transmitted to the requester side device (step 4). , 5).

Further, the present invention (Claim 2) provides a resource operation request,
The requester side apparatus attaches resources and other information on the own apparatus in advance, and these are also used when the operating side apparatus determines the authenticity of the application condition included in the policy.

Further, according to the present invention (Claim 3), although the true / false determination result of the policy application condition is “undecidable”, it is possible to avoid being undecidable by performing some resource operation. If possible, request such request resource operation from the requester side device,
Upon receiving such a request, the requester side apparatus performs from the policy search for the determination resource in the own apparatus to the execution of the specific operation based on the true / false of the application condition, and returns a response to the operation side apparatus.

Further, the present invention (Claim 4) stores the authentication result of the requester side device as a resource in the storage means,
When judging the authenticity of the application conditions included in the policy,
The authentication result of the requester side device stored in the storage means is also used.

Further, according to the present invention (Claim 5) , the resource operation result history resulting from the resource operation request of the requester side device is stored in the storage means,
When judging the authenticity of the application conditions included in the policy,
The resource operation result history resulting from the resource operation request of the requester side device stored in the storage means is also used.

Further, according to the present invention (Claim 6) , in the determination of whether the application condition included in the policy is true or false ,
In the course of policy evaluation, required for the determination, as represented by the authentication result acquisition of and the apparatus of the values of variables and the environment, if found existence of one or more of determining resource operations, each time Request resource operation for judgment .

  FIG. 2 is a principle configuration diagram of the present invention.

The present invention (claim 7), between a plurality of apparatus on a network, and against the resource to define a plurality of parties including providers, to protect the intent of each resource owner, application conditions and their A distributed cooperative information usage control system for hierarchically determining policies consisting of specific actions based on authenticity and performing resource operations,
A resource operation requester side device (hereinafter referred to as a requester side device) 100B having resource operation request means for transmitting a resource operation request to a device that operates the resource (hereinafter referred to as an operation side device);
Application condition set for one or more resources, specific operation when the application condition is “true” (permit the requested resource operation, reject the requested resource operation, operation One or a plurality of resource operations are requested from the side device, the requester side device, or another device, or the permission result of the requested resource operation cannot be determined (or a plurality thereof), the application condition A policy accumulating unit 170 for accumulating a policy set by a resource provider, which is a usage control rule including a specific action when the value is “false” and a specific action when the application condition is finally “undecidable”; ,
A policy evaluation unit 130 that determines whether the application condition included in the policy of the policy storage unit 170 at the time of receiving the resource operation request is true or false with respect to the acquired resource operation request;
In the policy evaluation means 130, if the application condition included in the policy is “undecidable”, in order to use a policy prescribed mainly by a party different from the resource provider, variables and environment necessary for the determination are used. Requests one or more determination resource operations, represented by acquisition of values and authentication results of each device, from the device having the determination resource, and is included in the policy based on the operation result If the application condition is determined again, and if it is still “determination impossible”, the specific action when the application condition included in the policy is finally “determination impossible” is performed by any means, and the requester side device is operated. Send results or notifications,
If the application condition included in the policy is “true”, the policy evaluation unit 130 performs a specific operation when the application condition is “true”, and sends an operation result or notification to the requester side device.
If the application condition included in the policy is “false” in the policy evaluation unit 130, a specific operation when the application condition is “false” is performed by any means, and an operation result or notification is sent to the requester side device. Resource operation request accepting means 120 for transmitting
An operation side device 100A having resource operation means 140 that performs resource operation in response to a resource request in accordance with an instruction from the resource operation request reception means 230.

Further, according to the present invention (Claim 8), in the resource operation request unit 110 ,
The requester side device includes means for attaching resources and other information on the own device in advance,
In the policy evaluation means 130,
Operating side device comprises a means for utilizing also those in determining the authenticity of Applicable conditions in the policy.

Further, according to the present invention (Claim 9), in the operation side device, the true / false judgment result of the policy application condition is “undecidable”, but it cannot be determined by performing some resource operation. If there is a possibility that it can be avoided, it includes means for requesting such a determination resource operation to the requester side device 100B,
Upon receiving such a request, the requester side device 100B performs from the policy search for the determination resource in the own device to the execution of the specific operation based on the true / false of the application condition, and returns a response to the operation side device 100A. comprising means for.

Further, the present invention (claim 10) is the operation side device 100A ,
Having authentication result storage means for storing the authentication result of the requester side device as a resource ;
In the policy evaluation means 130,
When judging the authenticity of the application conditions included in the policy,
Means for utilizing the authentication result of the requester side device stored in the authentication result storage means;

Further, the present invention (claim 11) is the operation side device 100A ,
A resource operation result history storage means for storing a resource operation result history resulting from the resource operation request of the requester side device;
In the policy evaluation means 130,
When judging the authenticity of the application conditions included in the policy,
Means for utilizing also the resource operation result history resulting from the resource operation request of the requester side device stored in the resource operation result storage means.

Further, the present invention (Claim 12), in the resource operation request accepting means 120,
In the true / false judgment of the application conditions included in the policy in the policy evaluation means 130, before it is judged as “undecidable” once, in the process of policy evaluation , acquisition of variables and environment values necessary for the judgment typified by obtaining the authentication result of the device, one or, if there a plurality of determination resource operations turned out, each time including means for requesting the determination resource operation.

  According to the present invention, since information necessary for policy evaluation can be acquired interactively, it is possible to avoid the policy evaluation inability due to lack of information without much awareness of the resource operation requester side. Moreover, resources can be obtained from a third party, and the degree of freedom is increased.

  Furthermore, in addition to the conventional resource acquisition, other resource operations such as execution can be requested as means for avoiding the above evaluation failure, and the degree of freedom is further increased.

  Also, one or a plurality of resource operations on the own device, the requester side device, and other devices according to the true / false judgment result (true / false / finally undecidable) of the application condition for the convenience of the provider The degree of freedom increases. This includes conventional mandatory operations. On the other hand, since the policy evaluation is performed for the resource operation request, it is possible to prevent the operation without permission and to keep the intention of each resource owner.

  Furthermore, since a mandatory operation can be performed by a server other than the server serving as the operation side device, the degree of freedom increases, and the intention of each resource owner is protected by performing policy evaluation at that time.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  First, terms used in the following description will be described.

Resource: refers to electronic data (image data / text data / video data / audio data / program, etc.) and devices that can be handled on a computer, and usage is controlled by policies;
-Resource operation: In the narrow sense, it refers to the operation of resources such as acquisition, and in the broad sense, includes authentication;
-Remote resources: resources managed by other servers;
-Local resources: Resources managed by the local server;
Policy: Usage control rules set for resources (single / multiple);
-Policy evaluation: To make a permission decision for resource operation. If the specific operation based on the true / false of the application condition includes “permits the requested resource operation”, the evaluation result is “permitted”, and the specific operation includes “reject the requested resource operation”. In this case, the evaluation result is “non-permitted”, and the evaluation result is “undecidable” if the specific operation includes “unauthorized result of requested resource operation cannot be determined”. The specific operation does not specify the evaluation result when none of the above three are included or when a plurality of operations are included.

  FIG. 3 shows an apparatus configuration according to an embodiment of the present invention.

  The requester side device and the operation side device are assumed to have the same configuration.

  The apparatus 100A shown in the figure includes a resource operation request unit 110, a resource operation request reception unit 120, a policy evaluation unit 130, a resource operation unit 140, a resource storage unit 150, a storage unit 160, and a policy storage unit 170.

  The resource operation request unit 110 has a function of transmitting a resource operation request to the operation side device and a function of acquiring a response from the operation side device. In the resource operation request, information for identifying a resource operation requester (user ID, public key certificate, etc. obtained by prior authentication) to be used at the time of policy evaluation, resource operation unit 140 of the requester side device May be attached with the result of the resource operation performed (such as the resource acquisition result).

  The resource operation request receiving unit 120 receives a resource operation request, requests a policy evaluation from the policy evaluation unit 130, receives the result, performs the resource operation (request) shown below, and transmits a response to the requester side device. It has a function.

  The resource operation (request) is a local resource operation requested by the operation requester or one or a plurality of resource operations passed from the policy evaluation unit 130, and the permitted former is the resource operation unit 140. The latter requests the operation and receives the result, and the latter requests the resource operation via the resource operation requesting unit 110 and receives the result.

  The policy storage unit 170 stores a policy including the following elements.

a. Applicable condition;
The following are described as parameters.

・ Information about the operation target;
・ Information on the operation requester;
-Information about operation contents-Contents of some resources;
An authentication result and resource operation result history stored in the storage unit 116;
-Objective information such as resources and environment (resource creation time, current time, etc.);
・ Others b. Specific actions based on judgment of applicable conditions;
b1. Specific action when the application condition is “true”;
b2. Specific action when the application condition is “false”;
b3. A specific action when the application condition is finally "undecidable";
The specific operation consists of one or more of the following.

-License the requested resource operation;
Reject the requested resource operation;
・ Determine permission result of requested resource operation;
Any local resource manipulation;
Any remote resource operation;
The policy evaluation unit 130 applies information based on the information obtained from the resource operation request accepting unit 120, information obtained from the policy storage unit 170, and objective information such as the storage unit 160, resources, and the environment as necessary. Performs true / false judgment of the condition and returns a specific action according to the judgment result.

  In addition, the policy evaluation unit 130 requests local resource operation or remote resource operation via the resource operation request unit 110 as needed, receives the result, and then applies the judgment material. Whether the condition is true or false can be determined. When the contents of some resource are adopted as the parameters of the application condition, if the resource is not acquired, the authenticity of the application condition is determined after acquisition.

  The resource operation unit 140 operates the resource storage unit 150 in response to a request from the operation request reception unit 120, and returns the result (including any acquired one). The resource operation includes program execution.

  The resource accumulation unit 150 accumulates resources operated by the resource operation unit 140.

  The storage unit 160 has a function of storing authentication results and resource operation result histories that can be used for policy evaluation. It is also conceivable to store objective information such as resources and environment in the storage unit.

  The outline of the operation will be described below.

  FIG. 4 is a flowchart (part 1) illustrating an example of an operation between the resource operation requester and the resource provider according to the embodiment of the present invention.

  A resource operation request is transmitted from the requester side device to the operation side device (step 10). The operating side device receives the resource operation request in the resource operation request receiving unit 120 (step 11), and the policy evaluation unit 130 searches the policy storage unit 170 for a policy corresponding to the resource operation request (step 12). Then, the policy evaluation unit 130 determines whether the application condition is true or false (step 13). In that case, the information attached by the requester side apparatus, the authentication result / resource operation result history stored in the storage unit 160, and objective information such as the resource and environment may be used as the judgment material.

  If the true / false of the application condition is not “determinable” (step 14, NO), a specific operation based on the true / false of the application condition (in this case, “true” or “false”) is executed (step 21). ). The execution of the specific operation based on the true / false of the application condition will be described later with reference to FIG. Thereafter, the resource operation request accepting unit 120 responds with a resource operation result or the like (step 22), and the requester side device accepts it (step 26), and ends the process.

  If the true or false of the application condition is “determination not possible” (step 14, YES) and the determination result cannot be avoided by performing some resource operation (step 15, NO), the application condition is final Specific operation is executed (step 21), the resource operation request accepting unit 120 responds with a resource operation result or the like (step 22), and the requester side device accepts it (step 21). 26) The process is terminated.

  If the true / false of the application condition is “determination not possible” (step 14, YES) and there is a possibility that the determination result can be avoided by performing some resource operation (step 15, YES), the resource An operation request is issued to the requester side device via the resource operation request unit 110 (step 16).

  In this example, the resource operation request for the requester side device is taken up as an operation for determining the authenticity of the application condition. However, there are other variations such as operation requests for the own device and other devices.

  In addition, as the timing of performing an operation that may avoid the inability to determine the true / false of the application condition, as in this example, the true / false of the application condition is determined only by the information at that time point. In addition to the case where the policy evaluation unit 130 requests one operation necessary for the policy evaluation after it is determined that there is, after the resource operation request reception unit 120 receives that “determination is impossible”, the same operation is requested. When requesting an operation as soon as a necessary operation is found during policy evaluation, list all the operations that may avoid undecidable during the same policy evaluation, and then request the operation one by one Various variations are possible, such as when performing.

  The requester side device accepts the resource operation request (step 17), and, like the operation side device, performs from the policy search to the execution of the specific operation based on the true / false of the application condition (step 18). A response is returned (step 19).

  The operation side device receives a response in the resource operation request unit 110 (step 20), determines again the authenticity of the application condition based on the operation result (step 13), and repeats the subsequent processing.

  Next, execution of a specific operation according to the policy evaluation result will be described.

  FIG. 5 is a flowchart of an example of execution of a specific operation based on true / false of application conditions according to an embodiment of the present invention.

  The resource operation request receiving unit 120 executes the following steps for one operation described in the specific operation, and repeats the following steps for the operation as long as there are other operations described (step 36, YES). . If there is no other operation described (step 36, NO), the process is terminated.

  If the operation is “permit the requested resource operation” (step 30, YES), the requested operation is executed (step 31) and the process proceeds to step 36.

  If the operation is not “permit the requested resource operation” (step 30, NO) but “reject the requested resource operation” (step 32, YES), the process proceeds to step 36.

  The operation is neither “permits the requested resource operation” (step 30, NO) nor “rejects the requested resource operation” (step 32, NO). If “cannot be determined” (step 33, YES), the process proceeds to step 36.

  The operation is neither “permit the requested resource operation” (step 30, NO), but “reject the requested resource operation” (step 32, NO). If it is not “cannot be determined” (step 33, NO), an operation request for the operation described via the resource operation request unit 110 is issued (step 34), and a response is received via the resource operation request unit 110 (step 35). ), Go to step 36.

  Although it is not limited to a specific operation, it is possible to speed up the policy evaluation result by caching the same operation on its own device in a short period of time and not performing re-evaluation. Care should be taken as policy evaluation results may change.

  FIG. 6 is a flowchart (part 2) illustrating an example of an operation between the resource operation requester and the resource provider according to the embodiment of the present invention.

  A resource operation request is transmitted from the requester side device to the operation side device (step 40). The operating side device accepts the resource operation request at the resource operation request accepting unit 120 (step 41), and the policy evaluation unit 130 searches the policy storage unit 170 for a policy corresponding to the resource operation request (step 42). The policy evaluation unit 130 evaluates the policy (step 43).

  The policy evaluation unit 130 returns the specific operation based on the true / false of the application condition to the resource operation request receiving unit 120, and the resource operation request receiving unit 120 executes the specific operation (step 44). Thereafter, the resource operation request receiving unit 120 responds with a resource operation result or the like (step 45), and the requester side apparatus receives it (step 46).

  In the requester side device, if the permission result of the requested resource operation is other than “undecidable” (step 47, NO), the process is terminated. If the permission result of the requested resource operation is “undecidable” (step 47, YES), an operation request that may be able to reverse the permission result is issued to the own device via the resource operation request unit 110 ( Step 48). In this example, an operation is requested to the own device, but a variation in which an operation is requested to another device such as an operation side device is also conceivable. The “operation that may be able to reverse the permission result” is specified by providing information from the operation side device.

  The resource operation request accepting unit 120 accepts an operation request from its own device (step 49), and performs a process from policy search to execution of a specific operation based on the true / false of the application condition, similarly to the operation side device (step 50). The response is returned to the own device (step 51). Subsequently, the resource operation request unit 110 receives the response (step 52), and the resource operation request unit 110 issues the resource operation request to the operation side device again with the operation result attached (step 53).

  The operating side apparatus accepts the request again (step 41), and repeats the processing from step 42 to step 45. However, it should be noted that, since new information is attached by the requester side device when re-requesting the resource operation, the permission result of the requested resource operation can be other than “undecidable”.

  When the re-request is repeated a plurality of times, the attachment information may be sent by the requester side device every time all the operation results up to that point, or the operation side device stores the previous attachment information in the storage unit, It is also conceivable to use them for policy evaluation.

  Embodiments of the present invention will be described below with reference to the drawings.

  In the following embodiments, both the requester side device and the operation side device have the same configuration and will be described using the numbers shown in FIG.

[First embodiment]
FIG. 7 is a sequence chart of resource operation in the first exemplary embodiment of the present invention.

  The resource operation requesting unit 120 of the resource operation requester (employee A device: hereinafter referred to as the requester side device) operates the resource “employee list” as a resource operation to the resource provider (hereinafter referred to as company server). "Reference" is requested (step 101).

  The resource operation request reception unit 120 of the company server receives a request from the requester side device, and the policy evaluation unit 130 has a policy for a policy that “if the requester is an employee of the Company, the employee list is allowed to be referred to”. Evaluation is performed (step 102), and the resource operation request receiving unit 120 does not know the resource of the requester “company belonging to employee A” via the resource operation requesting unit 110. An operation “reference” of the resource “company belonging to employee A” is requested to the requester side device via the operation request unit 110 (step 103).

  In the requester side device, the resource operation request accepting unit 120 accepts a “reference” request, and the policy evaluation unit 130 determines a policy for a policy that “any requester is allowed to refer to the company belonging to the employee A”. The resource operation unit 140 executes the operation (step 105) because the evaluation is performed (step 104) and the license is granted, and the resource operation request receiving unit 120 sends the result “permitted” to the company server via the resource operation request unit 110. The content “company with company server” of the resource “company belonging to employee A” is returned (step 106).

  In response to an instruction from the resource operation request accepting unit 120, the company server performs the policy evaluation again in the policy evaluating unit 130 (step 107). Since the permission is granted, the resource operation unit 140 executes the operation and accepts the resource operation request. The unit 120 returns the resource “employee list” referred to as the result “permission” to the requester side device (step 108).

[Second Embodiment]
FIG. 8 is a sequence chart of resource operation in the second embodiment of the present invention.

  The resource operation requesting unit 110 of the resource operation requester (customer A device: hereinafter referred to as requester side device) sends the resource “customer A public key certificate” to the resource provider (hereinafter referred to as bank server). At the same time, an operation “inquiry” for the resource “deposit balance of customer A” is requested (step 201).

  When the bank operation server accepts the request for “inquiry” at the resource operation request accepting unit 120, the policy evaluation unit 130 recognizes that “if the requester's public key certificate is that of the customer A in the CA server, Policy evaluation is performed for the policy “acknowledge customer A's deposit balance” (step 202), and the resource operation requesting unit 110 sends the resource “customer A's principal” to the authentication CA server, which is a third party. Since the "guarantee guarantee" is unknown, the resource "customer A public key certificate" and the "bank server public key certificate" are attached, and the operation "acquisition" of the resource "customer A identity guarantee" is requested. (Step 203).

  When the CA server receives the “acquisition” request at the resource operation request receiving unit 120, the policy evaluation unit 130 determines that the given public key certificate is “if the requester's public key certificate belongs to the correct bank server. The policy is evaluated for the policy of confirming the identity of the resource and returning it as the acquisition result of the dynamic resource “guarantee of ** identity” (step 204). Then, the operation is executed (step 205), and the resource operation request accepting unit 120 returns the content “resource guarantee of customer A” acquired as a result “permission” to the bank server (step 206).

  The bank server performs the policy evaluation again in the policy evaluation unit 130 according to the instruction of the resource request receiving unit 120 (step 207), and since it is permitted, the resource operation unit 140 executes the operation (step 208), and the resource The operation request receiving unit 120 returns the result “permission” and the inquiry result of the resource “deposit balance of customer A” to the requester side device (step 209).

[Third embodiment]
FIG. 9 is a sequence chart of resource operation in the third exemplary embodiment of the present invention.

  The resource operation request unit 110 of the resource requester (member A device: hereinafter referred to as the requester side device) sends the resource “January 1, 2004” to the resource provider (hereinafter referred to as the schedule management server). The operation “schedule” is requested to “move to the schedule on January 2, 2004” (step 301).

  In response to an instruction from the resource operation request accepting unit 120, the schedule management server causes the policy evaluation unit 130 to “allow anyone to move a certain schedule to a certain schedule, but actually move the schedule after moving the schedule. The policy operation is performed on the policy of “deleting” (step 302). Since the license is granted, the resource operation request receiving unit 120 obtains the following as a proxy operation (step 303).

・ Operation of resource “scheduled January 1, 2004” “replication to January 2, 2004”
-Operation "Delete" of resource "Scheduled for January 1, 2004"
The policy evaluation unit 130 of the schedule management server performs policy evaluation on the proxy operations for the policies “anyone can copy from the schedule to the schedule” and “anyone can delete the schedule” (steps). 304) Since the permission has been granted, the resource operation unit 140 executes each operation (step 305).

  The resource operation request accepting unit 120 of the schedule management server returns the result “permission” to the requester side device (step 306).

[Fourth embodiment]
FIG. 10 is a sequence chart of resource operation in the fourth exemplary embodiment of the present invention.

  The resource operation requesting unit 110 of the resource operation requester (photographer A's device: hereinafter referred to as requester side device) operates the resource “crane photo” on the resource provider (hereinafter referred to as photobook server). "Registration" is requested (step 401).

  In response to an instruction from the resource operation request receiving unit 120, the photo book server causes the policy evaluation unit 130 to respond to the policy that “anyone can register resources, but allow the log output program to write operation logs at the time of registration”. Then, the policy evaluation is performed (step 402), and the license is granted. Therefore, the resource operation request receiving unit 120 obtains the following as the specific operation.

-Resource operation as requested-Resource "log output program" operation "Operation log export"
The resource operation unit 140 of the photo book server executes the operation “registration” for the requested resource “photo of crane” (step 403).

  The policy evaluation unit 130 of the photo book server performs policy evaluation on the policy that “everyone is allowed to write the operation log to the log output program” (step 404). The unit 140 executes the operation “write operation log” of the “log output program” which is a mandatory operation (step 405).

  The resource operation request accepting unit 120 of the photo book server returns the result “permission” to the requester side device (step 406).

[Fifth embodiment]
FIG. 11 is a sequence chart of resource operation in the fifth exemplary embodiment of the present invention.

  The resource operation requesting unit 110 of the resource operation requester “bidder A” (hereinafter referred to as “requester side device”) sends a “payment limit” (content is 500 yen) to the resource provider (hereinafter referred to as “auction server”). ) Is attached and an operation “successful bid” for the resource “product A” is requested (step 501).

The auction server, in response to an instruction from the resource operation request accepting unit 120, causes the policy evaluation unit 130 to set “the successful bid amount of the product A is equal to or higher than the highest bid amount at that time (1,000 yen at this time). Policy evaluation is performed for the dynamic policy of “returning the image that was returned” (step 502), and the permission is not granted (step 503). Therefore, the resource operation request receiving unit 120 performs the following as a specific operation: obtain.
・ Operation "Reference" of the resource "Disappointing image"
The auction server performs policy evaluation on the policy that “anyone can see the image that was disappointing” in the policy evaluation unit 130 (step 504). The operation “reference” of “unfortunate image” which is a specific operation at the time of permission is executed (step 505), and the resource “ "Sorry image" is returned (step 506).

[Sixth embodiment]
FIG. 12 is a sequence chart of resource operation in the sixth exemplary embodiment of the present invention.

  The resource operation requesting unit 110 of the resource requester “reporter A” (hereinafter referred to as “requester side device”) sends the operation “registration” of the resource “article α” to the resource provider (hereinafter referred to as company main server). Request (step 601).

In response to an instruction from the resource operation request accepting unit 120, the main server of the company uses the policy evaluation unit 130 to evaluate the policy for a policy that “anyone can register the resource, but register it with the backup server at the time of registration”. (Step 602), and permission is granted (step 603), the resource operation request accepting unit 120 obtains the following as the specific operation.
-Resource operations as required;
・ Similar resource operations for company backup servers;
The resource operation unit 140 of the company main server executes the operation “registration” of the requested resource “article α” (step 604).

  The resource operation request unit 110 of the main server of the company that became the resource requester attaches the resource “certificate of the main server at the head office” to the backup server of the company that is the resource provider, and operates the resource “article α”. “Registration” is requested (step 605).

  The backup server of the company has a policy of “permits registration of resources if the requester attaches the correct main server certificate of the headquarters” in the policy evaluation unit 130 according to an instruction from the resource operation request reception unit 120. On the other hand, policy evaluation is performed (step 606), and the license is granted (step 607). Therefore, the operation is performed in the resource operation unit 140, and the result “permission” is returned from the resource operation request reception unit 120 to the main server of the company. Then, the result “permission” is returned from the resource operation request receiving unit 120 of the company main server to the requester side device (step 609).

  In the present invention, the operation of each of the requester side device and the operation side device is constructed as a program, installed in a computer of these devices, executed by a control means such as a CPU, or distributed via a network. You may make it make it.

  Further, the constructed program is stored in a hard disk device connected to a computer such as each of the requester side devices or the operation side device, or a portable storage medium such as a flexible disk or a CD-ROM, and the present invention. It is also possible to install and execute on these devices when implementing the above.

  The present invention is not limited to the above-described embodiments and examples, and various modifications and applications are possible within the scope of the claims.

  The present invention relates to various types of business (general enterprise-employee, bank-customer, member-schedule manager, bidder-auction organizer, etc.) among resource requesters among resource-distributed devices and resource providers. It is applicable to. It can be used not only by these industries but also among individuals.

It is a figure for demonstrating the principle of this invention. It is a principle block diagram of this invention. 1 is a system configuration diagram according to an embodiment of the present invention. It is a flowchart (the 1) which shows an example of the operation | movement between the resource operation requester and resource provider in one embodiment of this invention. It is a flowchart which shows an example of execution of specific operation | movement based on the truth of the application conditions in one embodiment of this invention. It is a flowchart (the 2) which shows an example of the operation | movement between the resource operation requester and resource provider in one embodiment of this invention. It is a sequence chart of the resource operation in 1st Example of this invention. It is a sequence chart of resource operation in the 2nd example of the present invention. It is a sequence chart of resource operation in the 3rd example of the present invention. It is a sequence chart of resource operation in the 4th example of the present invention. It is a sequence chart of resource operation in the 5th example of the present invention. It is a sequence chart of resource operation in the 6th example of the present invention. It is a figure for demonstrating operation | movement of the conventional information utilization control system. It is a flowchart of the judgment process based on the conventional policy.

Explanation of symbols

100 Apparatus 100A Operation side apparatus, apparatus A
100B Requester side device, device B (or terminal)
110 Operation request unit, resource operation request unit 120 Resource operation request reception unit, resource operation request reception unit 130 Policy evaluation unit, policy evaluation unit 140 Resource operation unit, resource operation unit 150 Resource storage unit 160 Storage unit 170 Policy storage unit, policy Accumulator

Claims (12)

Between a plurality of apparatus on a network, and against the resource to define a plurality of parties including providers, to protect the intent of each resource owner, comprising a specific operation based application condition and its authenticity In the distributed cooperative information usage control method for hierarchically determining policies and performing resource operations,
A resource operation request is transmitted from a device on the resource operation requester side (hereinafter referred to as the requester side device) to a device that operates the resource (hereinafter referred to as the operation side device).
In the operation side device,
Obtaining the resource operation request;
Applicable conditions set for one or a plurality of resources stored in the storage means, specific operations when the applicable conditions are “true” (required requested resource operation, requested Rejecting the requested resource operation, requesting one or a plurality of resource operations to the operating side device or the requesting side device or another device, disabling a request for permission for the requested resource operation, One or more), set by a resource provider that is a usage control rule that includes a specific action when the application condition is “false” and a specific action when the application condition is finally “undecidable” On the basis of the determined policy, the authenticity of the application condition included in the policy at the time of receiving the resource operation request is determined,
If the application condition included in the policy is “undecidable”, in order to use a policy defined mainly by a party different from the resource provider, it is necessary to acquire variables and environment values necessary for the determination and Requests one or more determination resource operations represented by acquisition of device authentication results from the device having the determination resources, and re-applies the application conditions included in the policy based on the operation results. If it is determined and still “determination impossible”, the specific operation when the application condition included in the policy is finally “determination impossible” is performed by any means, and the operation result or notification is sent to the requester device. Send
If the application condition included in the policy is “true”, a specific operation when the application condition is “true” is performed by any means, and an operation result or notification is transmitted to the requester side device.
If the application condition included in the policy is “false”, a specific operation when the application condition is “false” is performed by any means, and an operation result or a notification is transmitted to the requester side device. A distributed cooperative information usage control method characterized by In the resource operation request,
The requester-side device attaches resources and other information on the device in advance, and the operation-side device also uses them when determining whether the application condition included in the policy is true or false. Distributed cooperative information usage control method. Although the true / false judgment result of the policy application condition was “undecidable”, if there is a possibility that it can be avoided by performing some resource operation, such a decision Request resource operation from the requester side device;
Upon receiving such a request, the requester side device performs a process from policy search for the determination resource in the own device to execution of a specific operation based on the true / false of the application condition, and returns a response to the operation side device < The distributed cooperative information usage control method according to claim 1 or 2. The authentication result of the requester side device is stored in the storage means as a resource,
When determining the authenticity of the application condition included in the policy,
The distributed cooperative information usage control method according to any one of claims 1 to 3, wherein an authentication result of the requester side device stored in the storage unit is also used. A resource operation result history resulting from a resource operation request of the requester side device is stored in a storage means,
When determining the authenticity of the application condition included in the policy,
5. The distributed cooperative information usage control method according to claim 1, wherein a resource operation result history resulting from a resource operation request of the requester side device stored in the storage unit is also used. In the determination of whether the application condition included in the policy is true or false,
In the course of policy evaluation, if the existence of one or more resource operations for determination, such as the acquisition of variables and environment values required for the determination, and the acquisition of authentication results for each device, is determined, it is determined each time. 6. The distributed cooperative information control method according to any one of claims 1 to 5, wherein a resource operation is requested. Between a plurality of apparatus on a network, and against the resource to define a plurality of parties including providers, to protect the intent of each resource owner, comprising a specific operation based application condition and its authenticity A distributed cooperative information usage control system for hierarchically judging policies and performing resource operations,
A resource operation requester side device (hereinafter referred to as a requester side device) having resource operation request means for transmitting a resource operation request to a resource operation device (hereinafter referred to as an operation side device);
An application condition set for one or a plurality of resources, a specific operation when the application condition is “true” (permit the requested resource operation, reject the requested resource operation, One or more of requesting one or a plurality of resource operations to the operation side device or the requester side device or another device, or disabling the permission result of the requested resource operation) Policy accumulation means for accumulating a policy set by a resource provider, which is a usage control rule including a specific action when the application condition is “false” and a final action when the application condition is finally “undecidable” When,
Policy evaluation means for judging the authenticity of an application condition included in the policy of the policy storage means at the time of receiving the resource operation request for the acquired resource operation request;
In the policy evaluation means, if the application condition included in the policy is “determination impossible”, a variable or environment necessary for the determination is mainly used in order to use a policy defined by a party different from the resource provider. Requesting one or more determination resource operations represented by the acquisition of the value of the device and the authentication result of each device to the device having the determination resource, and based on the operation result, If the application condition included in the policy is determined to be “undecidable”, the specific operation when the application condition included in the policy is finally “determination impossible” is performed by any means, and the requester side Send operation results or notifications to the device,
In the policy evaluation means, if the application condition included in the policy is “true”, a specific operation is performed when the application condition is “true”, and an operation result or notification is transmitted to the requester side device. And
In the policy evaluation means, if the application condition included in the policy is “false”, a specific operation when the application condition is “false” is performed by an arbitrary means, and an operation result or A resource operation request accepting means for sending a notification;
A distributed cooperative information usage control system comprising: an operation side device having resource operation means for performing a resource operation in response to a resource request according to an instruction from the resource operation request reception means. The resource operation request means includes
The requester side device includes means for attaching in advance resources and other information on the own device,
The policy evaluation means includes:
The distributed cooperative information usage control system according to claim 7, further comprising means for using the operating device when determining whether the application condition included in the policy is true or false. In the operation side device, the true / false judgment result of the policy application condition was “undecidable”, but if there is a possibility that it is possible to avoid being undecidable by performing some resource operation, Means for requesting such a request resource operation to the requester side device,
The requester-side apparatus that has received such a request performs a process from a policy search for the determination resource in the own apparatus to execution of a specific operation based on the true / false of the application condition, and returns a response to the operation-side apparatus The distributed cooperative information usage control system according to claim 7 or 8, comprising: The operation side device is:
Authentication result storage means for storing the authentication result of the requester side device as a resource;
The policy evaluation means includes:
When determining the authenticity of the application condition included in the policy,
The distributed cooperative information usage control system according to any one of claims 7 to 9, further comprising means for using an authentication result of the requester side device stored in the authentication result storage means. The operation side device is:
A resource operation result history storage means for storing a resource operation result history resulting from a resource operation request of the requester side device;
The policy evaluation means includes:
When determining the authenticity of the application condition included in the policy,
The use of distributed cooperative information according to any one of claims 7 to 10, further comprising means for using a resource operation result history resulting from a resource operation request of the requester side device stored in the resource operation result storage means. Control system. The resource operation request receiving means is
In the policy evaluation means, in the true / false determination of the application conditions included in the policy, before it is determined that the determination is impossible, in the process of policy evaluation, the variables and environment values necessary for the determination are acquired. Or a means for requesting the determination resource operation each time when the existence of one or a plurality of determination resource operations represented by acquisition of the authentication result of each device is found. The distributed cooperative information usage control system according to any one of the preceding claims.

Images