JP6960874B2 - Management device, specific program, specific method, management system - Google Patents

Description

The present invention relates to a management device, a specific program, a specific method, and a management system that control access to resources on a network.

Conventionally, a device for identifying the affiliation of a user who has requested access to a resource on a network has been known. Patent Document 1 describes a technique for identifying the affiliation of a user who has requested access based on the organization information stored in advance.

Japanese Unexamined Patent Publication No. 2011-0765669

Generally, the device that manages the resource for which the access authority is set stores the organizational information corresponding to the organizational structure of the company and the authority information for each organization associated with the organizational information. In this case, in a technology such as Patent Document 1, it is necessary to create organizational information corresponding to the organizational structure of a company for each object to which access authority is granted, and the larger the organizational structure, the more the organization. The burden of managing information was heavy.

Therefore, the present invention has been made in view of these points, and an object of the present invention is to provide a management device, a specific program, a specific method, and a management system capable of reducing the burden of managing organizational information.

The management device according to the first aspect of the present invention provides an electronic certificate including a group affiliation certificate certifying the affiliation relationship between a plurality of groups and a user affiliation certificate certifying the affiliation relationship between the groups and users. It has an acquisition unit to be acquired and a specific unit that specifies the hierarchical structure of the group to which the user belongs based on the digital certificate.

The specific unit may specify the hierarchical structure of the group to which the user belongs, provided that the digital certificate is digitally signed.
The specific unit may specify the hierarchical structure of the group to which the user belongs, provided that the signature source of the electronic signature is the administrator who manages the group indicated by the digital certificate.

The management device is provided on the condition that the storage unit that stores the resources used by the user and the group to which the user belongs includes the group to which access to the resource is permitted. It may further have a determination unit that permits access to the resource.

The determination unit may permit access on condition that the group to which the user belongs is within a predetermined hierarchy from the group to which access to the resource is permitted.
The specific unit may specify the hierarchical structure of the group to which the user belongs, provided that the digital certificate is not included in the revocation information indicating that the digital certificate is not valid. good.

The terminal according to the second aspect of the present invention generates an electronic certificate including a group affiliation certificate certifying the affiliation relationship between a plurality of groups and a user affiliation certificate certifying the affiliation relationship between the groups and users. It has a certificate generation unit to be used, and a certificate granting unit to give the digital certificate to the user.

The certificate granting unit may grant the user an electronically signed digital certificate.
The digital certificate includes an administrator certificate certifying the administrator of the group, and the certificate generator corresponds to the group affiliation certificate corresponding to the administrator certificate and the administrator certificate. An electronic certificate including the user affiliation certificate may be generated.

The specific program according to the third aspect of the present invention is an electronic computer including a group affiliation certificate certifying the affiliation relationship between a plurality of groups and a user affiliation certificate certifying the affiliation relationship between the groups and users. It functions as an acquisition unit for acquiring a certificate and a specific unit for specifying the hierarchical structure of the group to which the user belongs based on the electronic certificate.

The specific method according to the fourth aspect of the present invention includes a group affiliation certificate that certifies the affiliation relationship between a plurality of groups and a user affiliation certificate that certifies the affiliation relationship between the group and the user, which is executed by a computer. It has a step of acquiring an electronic certificate including the above, and a step of specifying a hierarchical structure of the group to which the user belongs based on the electronic certificate.

The granting program according to the fifth aspect of the present invention is an electronic computer including a group affiliation certificate certifying the affiliation relationship between a plurality of groups and a user affiliation certificate certifying the affiliation relationship between the groups and users. It functions as a certificate generation unit that generates a certificate and a certificate granting unit that grants the digital certificate to a user.

The granting method according to the sixth aspect of the present invention includes a group affiliation certificate that certifies the affiliation relationship between a plurality of groups and a user affiliation certificate that certifies the affiliation relationship between the groups and users, which is executed by a computer. It has a step of generating a including electronic certificate and a step of granting the electronic certificate to a user.

The management system according to the seventh aspect of the present invention manages the granting terminal used by the grantor who grants the digital certificate, the granting terminal used by the grantee who is granted the digital certificate, and resources. A management system having a management device, wherein the granting terminal is a group affiliation certificate certifying the affiliation relationship between a plurality of groups and a user affiliation certificate certifying the affiliation relationship between the group and the grantee. The management device has a certificate generation unit that generates an electronic certificate including a document and a certificate granting unit that grants the digital certificate to the grant terminal, and the management device is said to be from the grant terminal. An acquisition unit that acquires a group affiliation certificate and an electronic certificate including the user affiliation certificate, and a specific unit that specifies the hierarchical structure of the group to which the grantee belongs based on the electronic certificate. Have.

According to the present invention, it is possible to reduce the burden of managing organizational information.

It is a figure for demonstrating the outline of a management system. It is a figure which shows the structure of the grant terminal, the grant terminal, and the management device. It is a figure which schematically represented the affiliation relationship of the grant terminal and the grant terminal, and the access authority set to the resource. It is a figure which represented an example of the process flow of issuing an electronic certificate schematically. It is a figure which represented the contents of the electronic certificate schematically. It is a figure which represented an example of the process flow of issuing an electronic certificate schematically. It is a figure which represented the contents of the electronic certificate schematically. It is a figure which represented an example of the process flow of issuing an electronic certificate schematically. It is a figure which represented an example of the flow which controls access to a resource typically. It is a flowchart which shows the flow of the process of issuing a digital certificate in a management system. It is a sequence diagram which shows the flow of the process which controls access in a management system. It is a figure which represented typically the screen which issues a digital certificate.

[Overview of management system S]
FIG. 1 is a diagram for explaining an outline of the management system S. The management system S is a system that controls access from users to resources on the network based on an electronic certificate that certifies the affiliation relationship between a plurality of groups and users. A group is, for example, an organization in a company (headquarters, department, section, group, etc.), an organization in a project team (project, subproject, etc.). The group may be, for example, a family or a school.

The management system S includes a granting terminal 1, a granting terminal 2, and a management device 3. The granting terminal 1 is a terminal used by a grantor who grants an electronic certificate, for example, a computer. The grantor is, for example, the head of the organization belonging to the organization. The grantee terminal 2 is a terminal used by the grantee who is given the digital certificate, and is, for example, a computer. The grantee is, for example, an employee belonging to the organization. The grantor can also be the grantee by granting the digital certificate to himself / herself. The management device 3 is a device that manages resources, for example, a server. Resources are, for example, user-created files (documents, images, etc.), folders, and the like.

In FIG. 1, the subproject Y belongs to the project X, and the grant terminal 1 used by the grantor (for example, the manager of the project X) belongs to the project X and the grantee (for example, the leader of the subproject Y). The description will be made on the premise that the granted terminal 2 used by the project belongs to the subproject Y and the project X has a management device 3 (for example, a server for sharing documents). In this case, the management device 3 is set with an access authority for permitting access to the project X.

First, the grantor issues a digital certificate to the grantee. Specifically, the granting terminal 1 first generates an electronic certificate to be granted to the grantee ((1) in FIG. 1). The digital certificate in this case includes at least a group affiliation certificate certifying that subproject Y belongs to project X and a user affiliation certificate certifying that the grantee belongs to subproject Y. Includes a type of digital certificate. Then, the granting terminal 1 grants the digital certificate to the grantee by transmitting the generated digital certificate to the grantee terminal 2 ((2) in FIG. 1).

Subsequently, the grantee who has been granted the digital certificate accesses the management device 3 and performs an operation such as viewing a document. In this case, first, the granting terminal 2 requests access to the documents managed by the management device 3 ((3) in FIG. 1). At this time, the granting terminal 2 requests access to the management device 3 and transmits the digital certificate granted by the granting terminal 1.

When the management device 3 acquires the digital certificate transmitted from the grantee terminal 2, the management device 3 identifies the hierarchical structure of the subproject Y to which the grantee belongs based on the acquired digital certificate ((4) in FIG. 1). )). In the "hierarchical structure of subproject Y", subproject Y is located in the lower hierarchy among a plurality of groups existing between the highest hierarchy and the lowest hierarchy existing in the organization to which the subproject Y belongs. Shows the hierarchical relationship between multiple groups. For example, when there are a plurality of subprojects belonging to project X, which is a group of the highest hierarchy, "project X-subproject Y" is "hierarchical structure of subproject Y".

Whether the management device 3 permits access to the granted terminal 2 based on the hierarchical structure of the subproject Y specified in (4) of FIG. 1 and the access authority set in the management device 3. Judge whether or not. In this case, since the management device 3 includes the project X indicated by the access authority in the hierarchical structure of the specified subproject Y, the management device 3 permits access to the document ((5) in FIG. 1).

After that, the grantee uses the grant terminal 2 to browse the documents managed by the management device 3. In this way, in the management system S, access is performed based on an electronic certificate given by one user to another user to prove the affiliation relationship between a plurality of groups and users without managing the entire structure of the organization. Control. As a result, the management system S can reduce the burden of managing the organization information.
Hereinafter, the configurations of the granting terminal 1, the granting terminal 2, and the management device 3 will be described.

[Configuration of Granted Terminal 1, Granted Terminal 2, and Management Device 3]
FIG. 2 is a diagram showing the configurations of the grant terminal 1, the grant terminal 2, and the management device 3. The granting terminal 1 has a communication unit 11, a storage unit 12, and a control unit 13.
The communication unit 11 is an interface for connecting to a network, and is configured to include, for example, a LAN controller.

The storage unit 12 is a storage medium such as a ROM (Read Only Memory), a RAM (Random Access Memory), and a hard disk. The storage unit 12 stores a program executed by the control unit 13.
The control unit 13 is, for example, a CPU (Central Processing Unit). The control unit 13 functions as a key generation unit 131, a certificate generation unit 132, a signature unit 133, and a certificate granting unit 134 by executing the program stored in the storage unit 12.

The granted terminal 2 has a communication unit 21, a storage unit 22, and a control unit 23.
The communication unit 21 is an interface for connecting to a network, and is configured to include, for example, a LAN controller.

The storage unit 22 is a storage medium such as a ROM, RAM, and a hard disk. The storage unit 22 stores a program executed by the control unit 23.
The control unit 13 is, for example, a CPU. The control unit 23 functions as the certificate management unit 231 and the encryption unit 232 by executing the program stored in the storage unit 22.

The management device 3 has a communication unit 31, a storage unit 32, and a control unit 33.
The communication unit 31 is an interface for connecting to a network, and is configured to include, for example, a LAN controller.

The storage unit 32 is a storage medium such as a ROM, RAM, and a hard disk. The storage unit 32 stores a program executed by the control unit 33. In addition, the storage unit 32 stores resources used by the user.
The control unit 33 is, for example, a CPU. The control unit 33 functions as an acquisition unit 331, a specific unit 332, and a determination unit 333 by executing the program stored in the storage unit 32.
Hereinafter, the processes executed by the control units of the granting terminal 1, the granting terminal 2, and the management device 3 will be described.

[Process for issuing digital certificate (1)]
FIG. 3 is a diagram schematically showing the affiliation relationship between the grant terminal 1 and the grant terminal 2 and the access authority set for the resource. As shown in FIG. 3, when company A is the first layer, the B headquarters belongs to company A as the second layer, which is the layer directly below company A. In addition, as the third layer, which is the layer directly below the B headquarters, the C department belongs to the B headquarters. In addition, Group D belongs to Department C as the fourth layer, which is the level directly below Department C.

Resources R1, R2, R3, and R4 are stored in the management device 3. The access authority of resource R1 is set to allow access to company A, the access authority of resource R2 is set to allow access to headquarters B, and the access authority of resource R3 is set to allow access. The C part is set to allow access, and the access authority of the resource R4 is set to allow access to the D group. The terminal used by the reader F is the granted terminal 2f when the digital certificate is given by the granting terminal 1e used by the manager E, and the granting terminal 1f when the digital certificate is given to the 2g used by the member G. It becomes. Hereinafter, FIGS. 4, 6, 8 and 9 will be described based on the affiliation relationship and access authority shown in FIG.

FIG. 4 is a diagram schematically showing an example of the flow of processing for issuing a digital certificate. FIG. 4 shows a flow in which the granting terminal 1e used by the manager E grants the digital certificate to the granting terminal 2f used by the reader F. Leader F belongs to the D group, and is given an electronic certificate so as to belong to the C department in order to manage the D group.

First, the granting terminal 1e generates a key to be used for the digital certificate. Specifically, the key generation unit 131 of the granting terminal 1e generates a private key and a public key used for the digital certificate. The private key is a key that is not disclosed to the outside, and the public key is a key that is disclosed to the outside. The key generated by the key generation unit 131 includes key identification information for identifying the key.

In the example shown in FIG. 4, the key generation unit 131 generates a private key and a public key for the manager E as the key for the manager E ((1) in FIG. 4). Further, the key generation unit 131 generates a private key and a public key for the C unit as the key for the C unit ((2) in FIG. 4). Further, the key generation unit 131 generates a private key and a public key for the reader F as the key for the reader F ((3) in FIG. 4). The given terminal 2f used by the reader F may generate the key for the reader F. In this case, the key generation unit 131 of the granting terminal 1e acquires the public key for the reader F among the reader F keys generated by the granting terminal 2f.

The key generation unit 131 transmits the generated public key for the manager E, the public key for the C unit, and the public key for the reader F to the management device 3 ((4) in FIG. 4). The key generation unit 131 may transmit each public key related to the digital certificate to the management device 3 when the digital certificate is given to the grantee.

Subsequently, the granting terminal 1e generates an electronic certificate. Specifically, the certificate generation unit 132 of the granting terminal 1e is an electronic device including a group affiliation certificate certifying the affiliation relationship between a plurality of groups and a user affiliation certificate certifying the affiliation relationship between the groups and users. Generate a certificate. More specifically, the certificate generation unit 132 is an electronic certificate including a group affiliation certificate corresponding to an administrator certificate certifying the administrator of the group and a user affiliation certificate corresponding to the administrator certificate. Generate a book.

In the example shown in FIG. 4, the certificate generation unit 132 first generates a user affiliation certificate certifying that the leader F belongs to the C unit ((5) in FIG. 4), and the generated user affiliation certificate. As an administrator certificate corresponding to the above, an administrator certificate indicating that the administrator of the C department is the manager E is generated ((6) in FIG. 4). The administrator certificate may be generated in advance.

FIG. 5 is a diagram schematically showing the contents of the digital certificate. FIG. 5A shows the contents of the user affiliation certificate, and FIG. 5B shows the contents of the administrator certificate. The user affiliation certificate shown in FIG. 5A includes a "classification" item indicating the classification of the digital certificate, a "subordinate" item indicating the group to which the digital certificate belongs, and a "dependent" item indicating the user to which the digital certificate belongs. Is included. The "classification" item shown in FIG. 5A indicates that the digital certificate is a user affiliation certificate. In the example shown in FIG. 4, the "subordinate" item of the user affiliation certificate shown in FIG. 5A shows the key identification information of the public key for the C part, and the "dependent" item is the leader F. The key identification information of the public key for is shown.

The administrator certificate shown in FIG. 5B includes a "classification" item, an "administrator" item indicating an administrator, and a "group" item indicating a group to which the administrator belongs. The "Category" item shown in FIG. 5B indicates that the digital certificate is an administrator certificate. In the example shown in FIG. 4, the "administrator" item of the administrator certificate shown in FIG. 5 (b) shows the key identification information of the public key for the manager E, and the "group" item shows the C part. The key identification information of the public key for is shown.

Here, the user affiliation certificate corresponding to the administrator certificate is, for example, the key identification information shown in the "subordinate" item included in the user affiliation certificate and the "group" item included in the administrator certificate. It is a relationship that matches the key identification information shown in. The certificate generation unit 132 may explicitly associate the administrator certificate with the user affiliation certificate by including the certificate identification information that identifies the administrator certificate.

Returning to FIG. 4, the signature unit 133 of the granting terminal 1e digitally signs the generated user affiliation certificate using the private key for the manager E, and the generated administrator certificate is subjected to a digital signature. Digitally sign using the private key for part C. The digital signature of the user affiliation certificate includes the key identification information of the public key for the manager E, and the digital signature of the administrator certificate includes the key identification information of the public key for the C department.

Subsequently, the certificate generation unit 132 has two group affiliation certificates certifying that the B headquarters belongs to the A company and the C department belongs to the B headquarters, and each of the two group affiliation certificates. The corresponding two administrator certificates are obtained from the storage unit 12 of the granting terminal 1e ((7) in FIG. 4). In this way, the certificate generation unit 132 generates an electronic certificate including a user affiliation certificate, a group affiliation certificate, and an administrator certificate corresponding to each certificate.

Then, the certificate granting unit 134 of the granting terminal 1e transfers the digitally signed digital certificate and the reader F key (public key and private key for the reader F) to the granting terminal 2f via the communication unit 11. ((8) in FIG. 4). The certificate management unit 231 of the grant terminal 2f acquires the digital certificate and the reader F key transmitted from the grant terminal 1e and stores them in the storage unit 22 of the grant terminal 2f. In this way, the certificate granting unit 134 grants the digital certificate to the reader F.

[Process for issuing digital certificate (2)]
6 and 8 are diagrams schematically showing an example of the flow of processing for issuing a digital certificate. 6 and 8 show a flow in which the terminal used by the reader F grants the digital certificate to the granted terminal 2g used by the member G. The terminal used by the reader F functions as the granting terminal 1f in order to grant the digital certificate to the member G.

First, the key generation unit 131 of the granting terminal 1f generates a private key and a public key used for the digital certificate. In the example shown in FIG. 6, the key generation unit 131 generates a private key and a public key for the D group as the D group key ((1) in FIG. 6). The key generation unit 131 transmits the generated public key for the D group to the management device 3 via the communication unit 11 ((2) in FIG. 6).

Further, the key generation unit 131 transmits the generated public key for the D group to the granting terminal 1e used by the manager E via the communication unit 11 ((3) in FIG. 6). The key generation unit 131 is based on, for example, an administrator certificate certifying that the administrator of the C unit is the manager E, which corresponds to a user affiliation certificate certifying that the leader F belongs to the C unit. The generated D group key is transmitted to the granting terminal 1e.

Subsequently, the granting terminal 1e used by the manager E generates an electronic certificate to be granted to the reader F. Specifically, the certificate generation unit 132 of the granting terminal 1e generates an electronic certificate including an administrator certificate acquired from the storage unit 12 and a group affiliation certificate corresponding to the administrator certificate. In the example shown in FIG. 6, the certificate generation unit 132 generates a group affiliation certificate certifying that the D group belongs to the C unit ((4) in FIG. 6).

FIG. 7 is a diagram schematically showing the contents of the digital certificate. FIG. 7A shows the contents of the group affiliation certificate, and FIG. 7B shows the contents of the administrator certificate. The group affiliation certificate shown in FIG. 7A includes a "classification" item, a "subordinate" item, and a "subordinate" item indicating the group to which the group belongs. The "classification" item shown in FIG. 7A indicates that the digital certificate is a group affiliation certificate. The "subordinate" item of the group affiliation certificate shown in FIG. 7A shows the key identification information of the public key for the C part, and the "dependent" item shows the key identification of the public key for the D group. Information is shown.

Here, the group affiliation certificate corresponding to the administrator certificate is, for example, the key identification information shown in the "subordinate" item included in the group affiliation certificate and the "group" item included in the administrator certificate. It is a relationship that matches the key identification information shown in. The "group" of the administrator certificate shown in FIG. 7 (b) includes the key identification shown in the "subordinate" item of the group affiliation certificate shown in FIG. 7 (a) corresponding to the administrator certificate. The key identification information of the public key for part C, which matches the information, is shown. The certificate generation unit 132 may explicitly associate the administrator certificate with the group affiliation certificate by including the certificate identification information that identifies the administrator certificate.

Returning to FIG. 6, the signature unit 133 of the granting terminal 1e digitally signs the generated group affiliation certificate using the private key for the director E. The electronic signature includes the key identification information of the public key for the manager E. The certificate granting unit 134 of the granting terminal 1e transmits the generated digital certificate to the granting terminal 2f ((5) in FIG. 6). Specifically, the certificate granting unit 134 grants an electronic certificate including the generated group affiliation certificate and the administrator certificate corresponding to the group affiliation certificate obtained from the storage unit 12. Send to terminal 2f. The certificate management unit 231 of the grant terminal 2f used by the reader F acquires the digital certificate transmitted from the grant terminal 1e and stores it in the storage unit 22.

Subsequently, the key generation unit 131 of the granting terminal 1f used by the leader F generates a private key and a public key for the member G as the key for the member G to be given to the member G ((6) in FIG. 8). The given terminal 2g used by the member G may generate the key for the member G. The key generation unit 131 of the granting terminal 1f transmits the generated public key for the member G to the management device 3 via the communication unit 11 ((7) in FIG. 8).

Subsequently, the certificate generation unit 132 of the granting terminal 1f generates a group affiliation certificate, a user affiliation certificate, and an administrator certificate as electronic certificates to be given to the member G. As an example shown in FIG. 8, the certificate generation unit 132 first generates a user affiliation certificate certifying that the member G belongs to the D group ((8) in FIG. 8), and the generated user affiliation certificate. As an administrator certificate corresponding to the above, an administrator certificate certifying that the administrator of the D group is the leader F is generated ((9) in FIG. 8).

In this case, the "subordinate" item of the user affiliation certificate shows the key identification information of the public key for the D group, and the "subordinate" item shows the key identification information of the public key for the member G. ing. Further, the "administrator" item of the administrator certificate shows the key identification information of the public key for the leader F, and the "group" item shows the key identification information of the public key for the D group. There is. The signature unit 133 of the granting terminal 1f digitally signs the generated user affiliation certificate using the private key for the reader F, and digitally signs the administrator certificate using the private key for the D group. .. The digital signature of the user affiliation certificate includes the key identification information of the public key for the reader F, and the electronic signature of the administrator certificate includes the key identification information of the public key for the D group.

Subsequently, the certificate generation unit 132 of the granting terminal 1f is a group of three certifying that the B headquarters belongs to the A company, the C department belongs to the B headquarters, and the D group belongs to the C department. The affiliation certificate and the three administrator certificates corresponding to each of the three group affiliation certificates are acquired from the storage unit 12 of the granting terminal 1f ((10) in FIG. 8). In this way, the certificate generation unit 132 generates a user affiliation certificate, a group affiliation certificate, and an electronic certificate including an administrator certificate corresponding to each certificate.

Then, the certificate granting unit 134 of the granting terminal 1f transmits the generated digital certificate to the granting terminal 2g via the communication unit 11. Specifically, the certificate granting unit 134 transfers the digitally signed digital certificate and the member G key (public key and private key for member G) to the granted terminal 2g via the communication unit 11. It is transmitted ((11) in FIG. 8). The certificate management unit 231 of the grant terminal 2g acquires the digital certificate and the member G key transmitted from the grant terminal 1f and stores them in the storage unit 22 of the grant terminal 2g. In this way, the certificate granting unit 134 of the granting terminal 1f grants the digital certificate to the member G.

[Process to control access]
FIG. 9 is a diagram schematically showing an example of a flow for controlling access to a resource. FIG. 9 shows a flow in which the management device 3 controls access to the resource R3 (the resource to which the access authority is given to the C unit) from the granted terminal 2g used by the member G. The management device 3 in this case is not limited to the resource R3, and may be any of the resources R1, R2, and R4.

First, the granted terminal 2g requests access to the resource R3 stored in the management device 3 ((1) in FIG. 9). Specifically, the granted terminal 2g is an electronic certificate including a user affiliation certificate, a group affiliation certificate, and an administrator certificate corresponding to each certificate acquired by the certificate management unit 231 from the storage unit 22. Is transmitted, and the management device 3 is requested to access the resource R3.

In the example shown in FIG. 9, the user affiliation certificate shows the affiliation relationship between the members G and D groups, and the group affiliation certificate shows the affiliation relationship between company A and B headquarters, B headquarters and C. The affiliation relationship between departments and the affiliation relationship between departments C and D are shown respectively.

The acquisition unit 331 of the management device 3 is an electronic certificate including a group affiliation certificate, a user affiliation certificate, and an administrator certificate transmitted together with an access request from the granted terminal 2g via the communication unit 31. ((2) in FIG. 9). Subsequently, the identification unit 332 of the management device 3 specifies the hierarchical structure of the group to which the user belongs based on the digital certificate acquired by the acquisition unit 331 ((3) in FIG. 9). Specifically, the identification unit 332 specifies the hierarchical structure of the group to which the user belongs, provided that the digital certificate is digitally signed. More specifically, the specific unit specifies the hierarchical structure of the group to which the user belongs, provided that the signature source of the electronic signature is the administrator who manages the group indicated by the digital certificate.

In the example shown in FIG. 9, the specific unit 332 refers to the key identification information of the public key for the reader F indicated by the electronic signature of the user affiliation certificate and the D group indicated by the administrator certificate corresponding to the user affiliation certificate. The hierarchical structure of the D group to which the member G belongs is specified on condition that the key identification information of the public key for the leader F who is the administrator matches. The "hierarchical structure of the D group" in this case indicates that the D group belongs to the C department, which is one of the lower hierarchy groups of the B headquarters, which is one of the groups belonging to the A company. Specify the hierarchical structure of Group D as "Company A-Headquarters B-Department C-Group D". By doing so, the specific unit 332 can prevent the resource from being accessed based on the falsified digital certificate.

By the way, in a company, the organizational structure may change due to organizational changes, or the organization to which the user belongs may change due to personnel changes. Therefore, the specific unit 332 may specify the hierarchical structure of the group to which the user belongs, provided that the digital certificate is not included in the revocation information indicating that the digital certificate is an invalid digital certificate. The specific unit 332 inquires, for example, whether the user affiliation certificate or the group affiliation certificate is valid to the revocation information management server (not shown) that manages the revoked digital certificate, and the inquired electronic certificate is received. The hierarchical structure of the group to which the user belongs may be specified on condition that the notification that the user is not included in the revocation information is received. Further, the specific unit 332 may, for example, acquire revocation information from the revocation information management server and determine whether or not the acquired revocation information includes a user affiliation certificate or the like. By doing so, the specific unit 332 can prevent a situation in which the specific unit 332 specifies the hierarchical structure of the group to which the user belongs based on an invalid digital certificate.

Subsequently, the determination unit 333 of the management device 3 accesses the resource R3 on the condition that the hierarchical structure of the group to which the user specified by the specific unit 332 belongs is related to the group to which the access to the resource is permitted. Allow. Specifically, the determination unit 333 permits access to the resource R3 on the condition that the hierarchical structure of the group to which the user belongs includes the group to which the access to the resource is permitted.

In the example shown in FIG. 9, the determination unit 333 first determines whether or not the granted terminal 2g that has requested access has authority ((4) in FIG. 9). In this case, the determination unit 333 is granted because the specific information that identifies that the member G belongs to the D group and the D group belongs to the C unit includes the C unit that is permitted to access the resource R3. It is determined that the terminal 2g has authority. When the determination unit 333 determines that the granted terminal 2g has authority, it generates a confirmation character string and transmits the generated confirmation character string to the granted terminal 2g, so that the terminal requesting access is electronic. Request proof that it is the granted terminal 2g used by the member G indicated by the certificate ((5) in FIG. 9). The confirmation character string is a randomly generated character string.

The encryption unit 232 of the granted terminal 2g encrypts the confirmation character string transmitted from the management device 3 by using the private key for the member G stored in the storage unit 22 ((6) in FIG. 9). )). Specifically, the encryption unit 232 calculates a hash value of the confirmation character string transmitted from the management device 3 by using a hash function, and stores the private key for the member G stored in the storage unit 22. Use to encrypt the calculated hash value. The encryption unit 232 transmits the encrypted confirmation character string to the management device 3 via the communication unit 21 to prove that it is the granted terminal 2g used by the member G indicated by the digital certificate. ((7) in FIG. 9).

The determination unit 333 of the management device 3 confirms the encrypted confirmation character string transmitted from the granted terminal 2g ((8) in FIG. 9). Specifically, the determination unit 333 first uses the public key for member G stored in the storage unit 32 and indicated by the user affiliation certificate included in the electronic certificate to encrypt the confirmation character. The column is decoded, and the decoded confirmation character string is compared with the confirmation character string transmitted to the granted terminal 2g. More specifically, does the determination unit 333 match the hash value, which is the decrypted confirmation character string, with the hash value calculated by using the hash function for the confirmation character string transmitted to the granted terminal 2g? Judge whether or not.

Then, when the determination unit 333 determines that the decoded confirmation character string and the confirmation character string transmitted to the grant terminal 2g match, the resource R3 requests access to the grant terminal 2g. Allow access ((9) in FIG. 9). In this way, the management device 3 controls access to the resource. The management device 3 also controls access to the resources R1 and R2 that are permitted to be accessed by the upper organization of the C unit by performing the above-mentioned processing.

By the way, a user belonging to a group in a higher hierarchy having a group in a lower hierarchy may not want the resources R1 and R2 stored in the management device 3 to be seen by a user belonging to the group in the lower hierarchy. be. Therefore, the determination unit 333 of the management device 3 may permit access on condition that the group to which the user belongs is within a predetermined hierarchy from the group to which access to the resource is permitted. Specifically, the determination unit 333 is subject to the condition that the number of group affiliation certificates certifying the affiliation relationship from the group to which access to the resource is permitted to the group to which the user belongs is within a predetermined threshold value. Access may be granted.

For example, the user who stores the resource R2 that is permitted to access the resource R2 shown in FIG. 3 in the management device 3 is set to be within one layer from the B headquarters that is permitted to access the resource R2, and is the manager. It is assumed that the terminal used by E requests access to the resource R2 as the granted terminal 2e. In this case, the determination unit 333 has the number of group affiliation certificates certifying the affiliation relationship from the B headquarters to which the manager E belongs to the C division to which the access to the resource is permitted, and the C division belongs to the B headquarters. Since it is one of the group affiliation certificates that certifies, access to the resource R2 is permitted assuming that the conditions within the set one layer are satisfied.

On the other hand, for example, the user who stores the resource R2 that is permitted to access the resource R2 shown in FIG. 3 in the management device 3 is set to be within one layer from the B headquarters that is permitted to access the resource R2. It is assumed that the granted terminal 2g used by the member G requests access to the resource R2. In this case, the number of group affiliation certificates certifying the affiliation relationship from the B headquarters to which access to the resource is permitted to the D group to which the member G belongs is the group affiliation certifying that the C department belongs to the B headquarters. There are two types: a certificate and a group affiliation certificate that certifies that Group D belongs to Department C. Therefore, the determination unit 333 does not allow access from the granted terminal 2g, assuming that the condition within the set one layer is not satisfied. By doing so, the determination unit 333 can set the detailed access authority as if the access authority was set based on the organizational information corresponding to the organizational structure of the company.

[Processing of management system S (1)]
The processing flow in the management system S will be described. FIG. 10 is a flowchart showing a flow of processing for issuing a digital certificate in the management system S. In this flowchart, the flow of the process in which the leader F (granter) shown in FIG. 8 grants the digital certificate to the member G (grantee) is shown. In the granting terminal 1 used by the grantor, one or more group affiliation certificates and one or more administrator certificates corresponding to each of the one or more group affiliation certificates are stored in the storage unit 12. Further, in the grant terminal 1, the generated leader F key (granter key) and D group key (subordinate group key) are stored in the storage unit 12. This flowchart will be described on the premise of the state of the granting terminal 1 as described above.

FIG. 12 is a diagram schematically showing a screen for issuing a digital certificate. The screen f1 shown in FIG. 12 is a screen for issuing the digital certificate displayed on the display of the granting terminal 1f. On the screen f1 shown in FIG. 12, a grantee selection item f11 for selecting the grantee to whom the digital certificate is granted, and a group selection item f12 for selecting the group to which the grantee to whom the digital certificate belongs belong. Is displayed.

For example, on the screen f1, the leader F selects "member G" from the grantee selection item f11, selects "company A-B headquarters-C department-D group" from the group selection item f12, and sets the setting button. Perform the operation of pressing. By performing such a simple operation, the grantor grants the digital certificate to the grantee selected in the grantee selection item f11. When the grantor presses the setting button on the screen f1 shown in FIG. 12, the processing of the flowchart shown in FIG. 11 is started.

First, the key generation unit 131 generates a grantee key (member G key) including a private key and a public key as a key used for the digital certificate (S10). The key generation unit 131 transmits the generated public key for the grantee to the management device 3 via the communication unit 11 (S20).

Subsequently, the certificate generation unit 132 generates an administrator certificate (S30). Specifically, the certificate generation unit 132 shows the key identification information of the public key for the grantor in the "administrator" item, and shows the key identification information of the public key for the subordinate group in the "group" item. Generate a person certificate. The signature unit 133 executes a digital signature on the generated administrator certificate by using the private key for the subordinate group (S40). The digital signature of the administrator certificate contains the key identification information of the public key for the subordinate group.

Subsequently, the certificate generation unit 132 generates a user affiliation certificate (S50). Specifically, the certificate generation unit 132 shows the key identification information of the public key for the dependent group in the "subordinate" item, and shows the key identification information of the public key for the grantee in the "subordinate" item. Generate user affiliation certificate. The signature unit 133 executes a digital signature on the generated user affiliation certificate by using the private key for the grantor (S60). The digital signature of the user affiliation certificate includes the key identification information of the public key for the grantor.

Subsequently, the certificate generation unit 132 acquires one or more group affiliation certificates and one or more administrator certificates corresponding to each of the one or more group affiliation certificates from the storage unit 12 (S70). .. In this way, the certificate generation unit 132 generates a user affiliation certificate, a group affiliation certificate, and an electronic certificate including an administrator certificate corresponding to each certificate. Then, the certificate granting unit 134 transmits the electronically signed digital certificate and the grantee key (public key and private key for the grantee) to the grantee terminal 2 via the communication unit 11. (S80).

[Processing of management system S (2)]
FIG. 11 is a sequence diagram showing a flow of processing for controlling access in the management system S. First, when the granted terminal 2 accesses the resource managed by the management device 3, the certificate management unit 231 of the granted terminal 2 has a user affiliation certificate and a group affiliation certificate stored in the storage unit 22. , And obtain an electronic certificate including the administrator certificate corresponding to each certificate (S110). The grant terminal 2 transmits the digital certificate acquired by the certificate management unit 231 and requests access to the resource managed by the management device 3.

The acquisition unit 331 of the management device 3 acquires an electronic certificate including a group affiliation certificate, a user affiliation certificate, and an administrator certificate transmitted together with an access request from the granted terminal 2g. The specific unit 332 specifies the hierarchical structure of the group to which the user belongs based on the digital certificate including the plurality of group affiliation certificates and one user affiliation certificate acquired by the acquisition unit 331 (S120). ..

Subsequently, the determination unit 333 determines whether or not the group to which the user belongs has authority. Specifically, the determination unit 333 determines whether or not the hierarchical structure of the group to which the user belongs includes a group to which access to the resource is permitted. When the determination unit 333 determines that the hierarchical structure of the group to which the user belongs does not include the group for which access to the resource is permitted (NO in S130), the determination unit 333 performs processing without permitting access to the resource. finish. On the other hand, when the determination unit 333 determines that the hierarchical structure of the group to which the user belongs includes a group to which access to the resource is permitted (YES in S130), the determination unit 333 generates a confirmation character string (when it is determined to be YES in S130). S140), transmission to the grant terminal 2.

When the encryption unit 232 of the grant terminal 2 acquires the confirmation character string transmitted from the management device 3, it encrypts the acquired confirmation character string using the private key for the grantee (S150). .. The encryption unit 232 transmits the encrypted confirmation character string to the management device 3.

The determination unit 333 of the management device 3 decrypts the encrypted confirmation character string transmitted from the grantee terminal 2 using the public key for the grantee (S160). The determination unit 333 determines whether or not the decoded confirmation character string and the confirmation character string transmitted to the granted terminal 2 match. When the determination unit 333 determines that the decrypted confirmation character string and the confirmation character string transmitted to the granted terminal 2 do not match (NO in S170), the determination unit 333 performs processing without permitting access to the resource. finish. On the other hand, when the determination unit 333 determines that the decrypted confirmation character string and the confirmation character string transmitted to the granted terminal 2 match (YES in S170), the determination unit 333 permits access to the resource. As a result, the granted terminal 2 can access the resource.

[Effects in this embodiment]
As described above, in the management system S according to the present embodiment, the granting terminal 1 grants the granting terminal 2 an electronic certificate certifying the affiliation relationship between a plurality of groups and users. Then, the management device 3 specifies the hierarchical structure of the group to which the user belongs based on the digital certificate in response to the access request from the granted terminal 2, and the access is permitted to the hierarchical structure of the specified group. Allow access to resources, provided that the population is included. By doing so, the management system S accesses the resource based on the affiliation relationship proved by the electronic certificate without the management device 3 memorizing the affiliation relationship between the plurality of groups and users in advance. Can be controlled. As a result, the manager who manages the management device 3 can reduce the burden of managing the organization information.

Although the present invention has been described above using the embodiments, the technical scope of the present invention is not limited to the scope described in the above embodiments, and various modifications and changes can be made within the scope of the gist thereof. be. For example, the specific embodiment of the distribution / integration of the device is not limited to the above embodiment, and all or a part thereof may be functionally or physically distributed / integrated in any unit. Can be done. Also included in the embodiments of the present invention are new embodiments resulting from any combination of the plurality of embodiments. The effect of the new embodiment produced by the combination has the effect of the original embodiment together.

In the above-described embodiment, an organization in a company is illustrated as a group, but the present invention can be applied to other groups whose affiliation can be defined. For example, if you want to allow the server owned by a family to access the students of the school that the children of the family attend, the family is defined as the upper group and the school is defined as the lower group. Similar to the above embodiment, by giving the electronic certificate to the terminal of the school student, the terminal of the school student can be allowed to access the server owned by the family.

1 Grant terminal 11 Communication unit 12 Storage unit 13 Control unit 131 Key generation unit 132 Certificate generation unit 133 Signature unit 134 Certificate granting unit 2 Granted terminal 21 Communication unit 22 Storage unit 23 Control unit 231 Certificate management unit 232 Encryption Unit 3 Management device 31 Communication unit 32 Storage unit 33 Control unit 331 Acquisition unit 332 Specific unit 333 Judgment unit

Claims (9)

An acquisition unit that acquires an electronic certificate including a group affiliation certificate that certifies the affiliation relationship between a plurality of groups and a user affiliation certificate that certifies the affiliation relationship between the groups and users.
Based on the digital certificate, a specific unit that specifies the hierarchical structure of the group to which the user belongs, and
A determination unit that permits access to the resource, provided that the group to which the user belongs is within a predetermined hierarchy from the group that is permitted to access the resource used by the user.
Management device with. The specific unit specifies the hierarchical structure of the group to which the user belongs, provided that the digital certificate is digitally signed.
The management device according to claim 1. The specific unit specifies the hierarchical structure of the group to which the user belongs, provided that the signature source of the electronic signature is the administrator who manages the group indicated by the digital certificate.
The management device according to claim 2. The specific unit identifies the hierarchical structure of the group to which the user belongs, provided that the digital certificate is not included in the revocation information indicating that the digital certificate is not valid.
The management device according to any one of claims 1 to 3. Computer,
Acquisition unit that acquires an electronic certificate including a group affiliation certificate that certifies the affiliation relationship between a plurality of groups and a user affiliation certificate that certifies the affiliation relationship between the group and the user .
Based on the digital certificate, a specific unit that specifies the hierarchical structure of the group to which the user belongs, and
A determination unit that permits access to the resource, provided that the group to which the user belongs is within a predetermined hierarchy from the group to which access to the resource used by the user is permitted.
A specific program to function as. Computer runs,
A step of acquiring an electronic certificate including a group affiliation certificate certifying the affiliation relationship between a plurality of groups and a user affiliation certificate certifying the affiliation relationship between the group and the user.
A step of identifying the hierarchical structure of the group to which the user belongs based on the digital certificate, and
A step of permitting access to the resource, provided that the group to which the user belongs is within a predetermined hierarchy from the group to which access to the resource used by the user is permitted.
Specific method with. A management system having a granting terminal used by a grantor who grants a digital certificate, a granting terminal used by a grantor who is granted a digital certificate, and a management device for managing resources.
The granting terminal is
A certificate generator that generates an electronic certificate including a group affiliation certificate that certifies the affiliation relationship between a plurality of groups and a user affiliation certificate that certifies the affiliation relationship between the group and the grantee.
A certificate granting unit that grants the digital certificate to the granted terminal, and
Have,
The management device is
An acquisition unit that acquires an electronic certificate including the group affiliation certificate and the user affiliation certificate from the granted terminal.
Based on the digital certificate, a specific unit that specifies the hierarchical structure of the group to which the grantee belongs, and
A determination unit that permits access to the resource, provided that the group to which the grantee belongs is within a predetermined hierarchy from the group that is permitted to access the resource used by the grantee.
Has a management system. The certificate provider provides the said electronic certificate with an electronic signature to the grantee,
The management system according to claim 7. The digital certificate includes an administrator certificate certifying the administrator of the group.
The certificate generation unit generates an electronic certificate including the group affiliation certificate corresponding to the administrator certificate and the user affiliation certificate corresponding to the administrator certificate.
The management system according to claim 7 or 8.

Images