JP7452366B2 - Access control device, access control method and access control program - Google Patents

Description

The present invention relates to access control technology.

A so-called SSO (Single Sign-On), which is a function that authorizes access to multiple services with a single user authentication, is known. For example, in SSO, control of access to services, access level, etc. is achieved using user attribute information obtained from an LDAP server that provides a directory service compatible with LDAP (Lightweight Directory Access Protocol) or the like.

In the above directory service, directory information may be updated frequently as a user's job title changes. In order to perform access control reflecting such updates, the directory service is accessed every time a user accesses the service.

Japanese Patent Application Publication No. 2005-62556 Japanese Patent Application Publication No. 8-287095 JP2003-281021A

However, in the above LDAP server, the directory service is accessed every time a user accesses, so the load on the LDAP server increases.

Note that the above problem occurs not only when attribute information is provided by a directory service such as an LDAP server, but also occurs in all services that provide user attribute information.

In one aspect, the present invention aims to provide an access control device, an access control method, and an access control program that can reduce the load on a server that provides user attribute information.

In one proposal, the access control device includes an acquisition unit that acquires attribute information of users belonging to a group whose access frequency exceeds a threshold value from a server that stores attribute information groups of a plurality of users at a predetermined period; If an access to the service is received from a user terminal of a first user belonging to a group whose value exceeds the threshold, access control is performed based on the attribute information of the first user among the attribute information acquired by the acquisition unit. If an access to the service is received from a user terminal of a second user belonging to a group whose access frequency does not exceed the threshold, access control is performed based on attribute information of the second user stored in the server. and an access control unit that executes.

The load on the server that provides user attribute information can be reduced.

FIG. 1 is a diagram showing an example of a system configuration according to a first embodiment. FIG. 2 is a diagram showing an example of a directory information tree. FIG. 3 is a diagram illustrating an example of the functional configuration of the server device according to the first embodiment. FIG. 4 is a diagram showing an example of transition of acquisition source information. FIG. 5 is a diagram illustrating an example of operation during periodic acquisition. FIG. 6 is a diagram illustrating an example of operation during periodic acquisition. FIG. 7 is a diagram showing an example of operation during access control. FIG. 8 is a diagram showing an example of operation during access control. FIG. 9 is a sequence diagram showing the procedure of periodic acquisition processing according to the first embodiment. FIG. 10 is a flowchart showing the procedure of periodic acquisition processing according to the first embodiment. FIG. 11 is a sequence diagram showing the procedure of access control processing according to the first embodiment. FIG. 12 is a flowchart showing the procedure of access control processing according to the first embodiment. FIG. 13 is a diagram showing an example of the hardware configuration of a computer.

DESCRIPTION OF THE PREFERRED EMBODIMENTS An access control device, an access control method, and an access control program according to the present application will be described below with reference to the accompanying drawings. Note that this example does not limit the disclosed technology. Each of the embodiments can be combined as appropriate within a range that does not conflict with the processing contents.

[System configuration]
FIG. 1 is a diagram showing an example of a system configuration according to a first embodiment. Although FIG. 1 shows a corporate information system 1 that introduces a single sign-on service as an example of an information system to which the access control function according to the present embodiment is applied, any information system may be used. Furthermore, although FIG. 1 shows an example in which the access control function according to the present embodiment is provided by an agent-based single sign-on service, it may be provided by other methods such as a reverse proxy method.

As shown in FIG. 1, the corporate information system 1 may include server devices 10-1 to 10-N, user terminals 20A to 20M, an administrator terminal 30, and an LDAP server 40. Hereinafter, when there is no need to distinguish between the server devices 10-1 to 10-N, it will be referred to as "server device 10", and when there is no need to distinguish between the user terminals 20A to 20M, it will be referred to as "user terminal 20". It may be written as

The server device 10, user terminal 20, administrator terminal 30, and LDAP server 40 are communicably connected via the network NW. For example, the network NW may be any type of communication network, such as the Internet, a LAN (Local Area Network), or a VPN (Virtual Private Network), regardless of whether it is wired or wireless.

The server device 10 is an example of a computer that provides arbitrary services, for example, web services such as business services. Examples of such a server device 10 include a web server, an application server, a database server, and the like.

As shown in FIG. 1, the server devices 10-1 to 10-N may include service execution units 13-1 to 13-N and authorization proxy execution units 15-1 to 15-N. The service execution units 13-1 to 13-N execute processes corresponding to Web services. The authorization proxy execution units 15-1 to 15-N authorize user access to the Web service, so-called access control, in accordance with the authorization policy set by the authorization controller 50. Hereinafter, when there is no need to distinguish between the service execution units 13-1 to 13-N, it will be referred to as "service execution unit 13", and there is no need to distinguish between the authorization proxy execution units 15-1 to 15-N. In this case, it may be written as "authorization proxy execution unit 15".

As an example, FIG. 1 shows an example in which one Web service is provided for one server device 10, but the present invention is not limited to the illustrated example. For example, from the aspect of realizing parallelization and redundancy of Web services, the server device 10 has multiple servers that execute processes corresponding to multiple Web services of the same type or different types on a host such as a VM (Virtual Machine) or a container. You can also run processes. In this case, the server device 10 may include a plurality of service execution units 13 and a plurality of authorization proxy execution units 15 arranged as agents corresponding to each of the plurality of service execution units 13.

The user terminal 20 is a terminal device used by an end user of the corporate information system 1. For example, the user terminal 20 has an environment in which the web service provided by the server device 10 can be used, for example, an environment in which a browser, which is an example of a web client, can operate. Hereinafter, access performed from the user terminal 20 to resources existing on the network NW may be referred to as "user access."

The administrator terminal 30 is a terminal device used by an administrator of the corporate information system 1 corresponding to an example of a user of the single sign-on service. The "administrator" here may include all administrators of the corporate information system 1, such as a system administrator, a security administrator, an operator of the server device 10, and the like of the corporate information system 1.

The LDAP server 40 corresponds to an example of a computer that provides a directory service compatible with LDAP. For example, the above directory service uses a directory information base that stores a directory information tree in which a collection of entries related to objects such as people and organizations is expressed in a tree structure.

FIG. 2 is a diagram showing an example of a directory information tree. As shown in FIG. 2, objects in the directory information tree include attributes and attribute values. For example, editing such as registration, update, or deletion of objects in the directory information tree can be accepted from the administrator terminal 30 according to the end user's job title information. Here, "dc" shown in FIG. 2 refers to a domain name, "ou" refers to an organization, and "cn" refers to an individual. In the example of the directory information tree shown in FIG. 2, the computer can recognize that the company FJ includes four organizations: sales, development, general affairs, and accounting. Of these, the computer can recognize that sales includes two organizations, 1g and 2g, as well as an individual named X. Furthermore, the computer can recognize that the sales organization 1g includes three individuals, A, B, and C. Furthermore, the computer can recognize that development includes two organizations, 1g and 2g, and that 1g includes two individuals, D and E. Furthermore, the computer can recognize that the general affairs section includes two organizations, 1g and 2g, and that the accounting section includes two organizations, 1g and 2g, and that there is an individual named Y.

As described above, although FIG. 1 illustrates an on-premise environment in which the server device 10 and the LDAP server 40 are installed within the corporate information system 1, the present invention is not limited to this. For example, some or all of the functions of the server device 10 and the LDAP server 40 may be provided as cloud services in a cloud environment.

Further, through the authorization controller 50 shown in FIG. 1, the authorization proxy control function is provided as a cloud service. As one aspect, the authorization controller 50 provides the administrator terminal 30 with a user interface such as a GUI (Graphical User Interface) or a CLI (Command Line Interface) that accepts end user access authority settings. For example, an end user is assigned a role that represents the end user's job or role within an organization. Access privileges such as permission to access resources such as services and data and access levels are assigned to each role. Authorization policy information in which these roles and access privileges are associated is distributed to the authorization proxy execution unit 15. As another aspect, the authorization controller 50 can also collect access logs for resources from the authorization proxy execution unit 15 of each server device 10.

Although FIG. 1 shows an example in which the authorization controller 50 controls the authorization proxy execution units 15-1 to 15-N, the present invention is not limited to the illustrated example. For example, one or a predetermined number of authorization proxy execution units 15 among the authorization proxy execution units 15-1 to 15-N may have a control function for other authorization proxy execution units 15. In this case, the authorization controller 50 may not necessarily be included.

[Configuration of server device 10]
Next, the functional configuration of the server device 10 according to this embodiment will be explained. FIG. 3 is a block diagram showing an example of the functional configuration of the server device 10 according to the first embodiment. FIG. 3 schematically shows blocks corresponding to functions that the server device 10 has. As shown in FIG. 3, the server device 10 includes an authentication section 11, a service execution section 13, and an authorization proxy execution section 15. It should be noted that the server device 10 may include, in addition to the functional units shown in FIG. 3, various functional units included in known computers, such as functions corresponding to input/output interfaces, communication interfaces, and the like.

Functional units such as the authentication unit 11, the service execution unit 13, and the authorization proxy execution unit 15 are virtually realized by a hardware processor such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit). For example, the processor reads various programs from a storage (not shown), such as an HDD (Hard Disk Drive), an optical disk, or an SSD (Solid State Drive). Such programs may include, in addition to the OS (Operating System), a web application that implements a web service, an access control program that implements the above-mentioned access control function, and the like.

For example, by executing the above Web application, the processor deploys processes corresponding to the authentication unit 11 and the service execution unit 13 on a memory such as a RAM (Random Access Memory). In this way, as a result of executing the above-mentioned Web application, the above-mentioned service execution unit 33 is virtually realized as a process. In addition, the processor deploys a process corresponding to the authorization proxy execution unit 15 on a memory such as a RAM by executing the above-mentioned access control program. In this way, as a result of executing the above access control program, the authorization proxy execution unit 15 is virtually realized as a process. Note that although a CPU or an MPU is illustrated here as an example of a processor, the above-mentioned functional unit may be realized by any processor, regardless of whether it is a general-purpose type or a specialized type. In addition, the above-mentioned functional unit or part of the functional unit may be realized by hard-wired logic such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

The authentication unit 11 is a processing unit that performs user authentication. As one embodiment, when the authentication unit 11 receives a sign-in request from the user terminal 20, it transmits the authentication request including the user ID and password received from the user terminal 20 to an SSO server (not shown). In response to this authentication request, the SSO server performs user authentication using the account on LDAP. As a result, when authentication is successful, an authentication token, such as an LDAP user name, is issued.

The service execution unit 13 is a processing unit that executes processing corresponding to a web service. In one embodiment, when the service execution unit 13 receives a user access, for example, an HTTP (HyperText Transfer Protocol) request, from the user terminal 20 via the authorization proxy execution unit 15, the service execution unit 13 executes the process requested by the HTTP request. Thereafter, the service execution unit 13 transmits the HTTP response to the user terminal 20 via the authorization proxy execution unit 15.

The authorization proxy execution unit 15 is an authorization proxy, that is, a processing unit that executes the above access control program. As shown in FIG. 3, the authorization proxy execution unit 15 includes a calculation unit 15A, a generation unit 15B, an acquisition unit 15C, a reception unit 15D, and an access control unit 15E.

The calculation unit 15A is a processing unit that calculates the access frequency. As one embodiment, the calculation unit 15A can start processing when periodic acquisition of attribute information of an organizational unit is performed. That is, in this embodiment, in order to reduce the load on the LDAP server 40, acquisition of attribute information of end users belonging to organizations whose access frequency is equal to or higher than a threshold value is suppressed from being obtained from the LDAP server 40 every time a user accesses the organization. be done. Instead, in this embodiment, attribute information of end users belonging to organizations whose access frequency exceeds a threshold value is acquired from the LDAP server 40 at a predetermined period, for example, once every few hours. At the timing when such periodic acquisition is executed, the calculation unit 15A calculates the access frequency and threshold Th of each organization corresponding to the division range in which the directory information tree is divided, for example, the entry located directly under the root entry. Calculate.

As one aspect, the calculation unit 15A calculates the access frequency of the organization by referring to the access log 14A. The access log 14A is a log of access to each service by the service execution units 13-1 to 13-N. For example, the access log 14A is generated when accesses to the services of the service execution units 13-1 to 13-N are collected from the authorization proxy execution units 15-1 to 15-N to the authorization controller 50. As an example, in the example shown in FIG. 2, the directory information tree is divided into four organizations: sales, development, general affairs, and accounting located directly under the root entry. In this case, the calculation unit 15A aggregates the number of accesses from each of the four organizations, sales, development, general affairs, and accounting, and calculates the number of accesses per unit time, for example, from one day to one month. is calculated as the access frequency. At this time, in order to emphasize the most recent access situation, the period for aggregating the number of accesses may be narrowed down to accesses within a predetermined period from the time when the access frequency is calculated, or the time when the access frequency is calculated. It is also possible to give a larger weight as the value approaches . Note that here, an example is given in which the access frequency is calculated at the time of regular acquisition, but the access frequency is calculated by totaling the number of accesses each time an access is detected by the authorization proxy execution units 15-1 to 15-N. You can also do that.

As another aspect, the calculation unit 15A calculates a threshold Th to be compared with the access frequency. As just an example, the calculation unit 15A calculates that the total data size when acquiring attribute information individually for all accesses per unit time is equivalent to the data size when acquiring attribute information of all users in the organization at once through periodic acquisition. The value is calculated as the threshold Th. Such a threshold Th can be dynamically calculated using the following equation, for example.

Threshold Th = (Saved internal data size x Access count unit time ÷ Periodic acquisition interval from LDAP) ÷ (Saved internal data size ÷ Number of people belonging to the organization)
= Access count unit time x Number of members of the organization ÷ Periodic acquisition interval from LDAP

The generation unit 15B is a processing unit that generates acquisition source information 14B in which the acquisition source of attribute information of users belonging to the organization is set for each organization corresponding to the division range of the directory information tree. Hereinafter, the acquisition source of user attribute information may be abbreviated as "user attribute acquisition source." In one embodiment, the generation unit 15B determines, for each organization corresponding to an entry located immediately below the root entry of the directory information tree, whether the access frequency of the organization exceeds the threshold Th. At this time, the generation unit 15B sets the user attribute acquisition source of the organization whose access frequency exceeds the threshold Th to "proxy", and sets the user attribute acquisition source of the organization whose access frequency is less than or equal to the threshold Th to "LDAP". Set. In this way, acquisition source information 14B is generated for each organization, in which the user attribute acquisition source of the organization is set.

FIG. 4 is a diagram showing an example of transition of the acquisition source information 14B. FIG. 4 shows acquisition source information 14B0 to 14B3 for the first time T0, the second time T1, the third time T2, and the fourth time T3. As shown in FIG. 4, at the first time point T0, there is no actually measured value of access frequency. Therefore, since the initial value of the access frequency of all organizations is set to "high" exceeding the threshold Th, the user attribute acquisition source of all organizations is set to "proxy". Subsequently, at the second time point T1, the access frequency of three of the four organizations, sales, general affairs, and accounting, exceeds the threshold Th _sales , threshold Th _{general affairs} , and threshold Th _accounting , while the access frequency of development exceeds the threshold Th. Below _development . In this case, the user attribute acquisition source for development is changed from "proxy" to "LDAP". Thereafter, at the third time point T2, the access frequency for accounting decreases and becomes equal to or less than the threshold _value Th for accounting. Along with this, the user attribute acquisition destination for accounting is changed from "proxy" to "LDAP". Subsequently, at the fourth time point T3, the access frequency for accounting increases and exceeds the threshold Th _accounting . Along with this, the user attribute acquisition source for accounting is changed from "LDAP" to "proxy". In this way, the organization's user attribute acquisition source can be dynamically changed in accordance with changes in access frequency.

The acquisition unit 15C is a processing unit that performs regular acquisition to acquire attribute information of an organizational unit from the LDAP server 40 at a predetermined period. In one embodiment, when a certain period has passed since the previous periodic acquisition was performed, the acquisition unit 15C determines the user attribute acquisition source of the organization for each organization corresponding to the division range of the directory information tree. Reference is made from 14B. Then, the acquisition unit 15C acquires from the LDAP server 40 attribute information of users belonging to each organization whose user attribute acquisition destination is "proxy".

5 and 6 are diagrams illustrating an example of operation during periodic acquisition. FIG. 5 shows an example in which periodic acquisition is performed with reference to the acquisition source information 14B0 shown in FIG. 4, while FIG. 6 shows an example in which periodic acquisition is performed with reference to the acquisition source information 14B1 shown in FIG. An example is shown below.

As shown in FIG. 5, the calculation unit 15A calculates the access frequency and threshold Th for each of the four organizations, sales, development, general affairs, and routes, corresponding to the division range of the directory information tree (step S11). Next, the generation unit 15B generates acquisition source information 14B0 in which the user attribute acquisition source of the organization is associated with each organization depending on whether the access frequency calculated in step S11 exceeds the threshold Th ( Step S12). Subsequently, the acquisition unit 15C refers to the user attribute acquisition destination set in the acquisition destination information 14B0 (step S13). Here, in the acquisition source information 14B0 shown in FIG. 5, "proxy" is set as the user attribute acquisition source for all organizations such as sales, development, general affairs, and accounting. Therefore, the acquisition unit 15C requests the LDAP server 40 for all the entries below ou directly under the root entry (step S14). As a result, attribute information of users of all organizations is acquired from the directory information base, ie, DIB (Directory Information Base) 41A (step S15). Thereafter, the acquisition unit 15C stores the attribute information of users of all organizations acquired in step S15 in a storage area that can be referenced by the authorization proxy execution unit 15 (step S16). Hereinafter, the storage area that can be referenced by the authorization proxy execution unit 15 may be abbreviated as "authorization proxy storage area." Through this series of periodic acquisitions, attribute information 14C0 is obtained.

Further, as shown in FIG. 6, the calculation unit 15A calculates the access frequency and threshold Th for each of the four organizations, sales, development, general affairs, and routes corresponding to the division range of the directory information tree (step S21). Next, the generation unit 15B generates acquisition source information 14B1 in which the user attribute acquisition source of the organization is associated with each organization depending on whether the access frequency calculated in step S21 exceeds the threshold Th ( Step S22). Subsequently, the acquisition unit 15C refers to the user attribute acquisition destination set in the acquisition destination information 14B1 (step S23). Here, according to the acquisition source information 14B1 shown in FIG. 6, "proxy" is set as the user attribute acquisition source for sales, general affairs, and accounting, while "LDAP" is set as the user attribute acquisition source for development. ing. In this case, the acquisition unit 15C requests the LDAP server 40 for the entries below "ou=eigyou", the entries below "ou=soumu", and the entries below "ou=keiri" (step S24). As a result, attribute information of sales, general affairs, and accounting users is acquired from the DIB 41A (step S25). After that, the acquisition unit 15C stores the attribute information of the sales, general affairs, and accounting users acquired in step S25 in a storage area that can be referenced by the authorization proxy execution unit 15 (step S26). The attribute information 14C1 is obtained through a series of these periodic acquisitions.

Returning to the explanation of FIG. 3, the reception unit 15D is a processing unit that accepts user access from the user terminal 20. In one embodiment, the receiving unit 15D receives an HTTP request message from the user terminal 20. At this time, the receiving unit 15D extracts an authentication token, such as an LDAP user name, added to the header of the HTTP request message.

The access control unit 15E is a processing unit that controls user access. In one embodiment, the access control unit 15E acquires the attribute information of the user corresponding to the LDAP user name from among the attribute information of all users stored in the authorization proxy storage area. Next, the access control unit 15E selects a user attribute acquisition source corresponding to the organization to which the user belongs, which is identified from the user attribute information acquired from the authorization proxy storage area, among the user attribute acquisition sources included in the acquisition source information 14B. See. At this time, if the user attribute acquisition source is "LDAP", the access control unit 15E acquires user attribute information corresponding to the LDAP user name from the LDAP server 40. Then, the access control unit 15E determines whether or not access is possible and the access level based on the access authority associated with the role of the user attribute information acquired from the LDAP server 40 among the access authority included in the authorization policy information 14D. Control. On the other hand, when the user attribute acquisition source is "proxy", the access control unit 15E determines which of the access rights included in the authorization policy information 14D is associated with the role of the user attribute information acquired from the authorization proxy storage area. Control access permissions and access levels based on access privileges.

7 and 8 are diagrams illustrating an example of operation during access control. 7 shows an example in which access control is performed with reference to the acquisition source information 14B0 shown in FIG. 4, while FIG. 8 shows an example in which access control is performed with reference to the acquisition source information 14B1 shown in FIG. An example is shown below. Furthermore, FIG. 7 shows an example in which a user access is accepted from the user terminal 20A used by A, who belongs to the sales department 1g in the directory information tree shown in FIG. On the other hand, FIG. 8 shows an example in which a user access is accepted from a user terminal 20E used by E, who belongs to development group 1g in the directory information tree shown in FIG.

As shown in FIG. 7, the receiving unit 15D receives a user access from the user terminal 20A (step S31). Then, the receiving unit 15D extracts the LDAP user name "A" given to the header of the HTTP request message received in step S31 (step S32). Then, the access control unit 15E selects the LDAP identification name "cn=A, ou=1g, ou=eigyo," which corresponds to the LDAP user name "A" among the attribute information 14C0 of all users stored in the authorized proxy storage area. dc=FJ, dc=com” (step S33). Next, the access control unit 15E selects a user who corresponds to the organization "sales" of the user identified from the LDAP identification name acquired from the authorized proxy storage area in step S33 among the user attribute acquisition sources of the acquisition source information 14B0. The attribute acquisition destination "proxy" is referred to (step S34). Thereafter, the access control unit 15E determines whether or not access is possible and the access level based on the access authority associated with the role of the LDAP identification name acquired from the authorization proxy storage area in step S33 among the access authority included in the authorization policy information 14D0. (step S35 and step S36).

Further, as shown in FIG. 8, the reception unit 15D receives user access from the user terminal 20E (step S41). Then, the receiving unit 15D extracts the LDAP user name "E" given to the header of the HTTP request message received in step S41 (step S42). Then, the access control unit 15E selects the LDAP identification name "cn=E, ou=1g, ou=kaihatsu," corresponding to the LDAP user name "E" from among the attribute information 14C1 of all users stored in the authorized proxy storage area. dc=FJ, dc=com” (step S43). Next, the access control unit 15E selects a user who corresponds to the organization "development" of the user identified from the LDAP identification name acquired from the authorized proxy storage area in step S43 among the user attribute acquisition sources of the acquisition source information 14B1. The attribute acquisition destination "LDAP" is referred to (step S44). Thereafter, the access control unit 15E obtains the LDAP identification name "cn=E, ou=1g, ou=kaihatsu, dc=FJ, dc=com" corresponding to the LDAP user name "E" from the LDAP server 40 ( Step S45). Then, the access control unit 15E overwrites and updates the LDAP identification name of the LDAP user name "E" acquired in step S45 in the attribute information 14C1 (step S46). Then, the access control unit 15E determines whether or not access is possible based on the access authority associated with the role of the LDAP identification name acquired from the LDAP server 40 in step S45 among the access authority included in the authorization policy information 14D0. The level is controlled (step S47 and step S48).

[Processing flow]
Next, the flow of processing of the server device 10 according to this embodiment will be explained. FIG. 9 is a sequence diagram showing the procedure of periodic acquisition processing according to the first embodiment. As shown in FIG. 9, an interrupt is generated by a timer set with a regular acquisition cycle (step S100). Then, the acquisition unit 15C acquires the data acquisition range (step S110).

Subsequently, the acquisition unit 15C transmits a data acquisition request to the LDAP server 40 based on the data acquisition range acquired in step S110 (step S120). In response, the LDAP server 40 transmits attribute information corresponding to the data acquisition range for which the data acquisition request was made in step S120 to the authorization proxy execution unit 15. After that, the acquisition unit 15C stores the attribute information received in step S130 in the authorization proxy storage area (step S130).

FIG. 10 shows the details of the logic of the processing of the authorization proxy execution unit 15 from step S110 to step S130 shown in FIG. 9. FIG. 10 is a flowchart showing the procedure of periodic acquisition processing according to the first embodiment.

As shown in FIG. 10, the calculation unit 15A calculates the access frequency and threshold Th for each organization corresponding to the division range into which the directory information tree is divided, for example, an entry located directly below the root entry (step S301 and step S302).

Next, the generation unit 15B generates acquisition source information 14B in which the user attribute acquisition destination "proxy" or "LDAP" is set for each organization depending on whether the access frequency of the organization exceeds the threshold Th ( Step S303). The acquisition unit 15C then selects one of the organizations included in the acquisition destination information 14B generated in step S303 (step S304).

At this time, if the user attribute acquisition destination corresponding to the organization selected in step S304 is "proxy" (step S305 Yes), the acquisition unit 15C acquires the user attribute information corresponding to the organization selected in step S304 using LDAP. It is acquired from the server 40 (step S306). The acquisition unit 15C then stores the attribute information acquired in step S306 in the authorization proxy storage area (step S307).

On the other hand, if the user attribute acquisition source corresponding to the organization selected in step S304 is "LDAP" (No in step S305), the process skips steps S306 and S307 and moves to the process in step S308.

Then, the acquisition unit 15C repeats the processes from step S304 to step S307 until all the organizations included in the acquisition source information 14B are selected (No in step S308). After that, if all the organizations included in the acquisition source information 14B are selected (step S308 Yes), the process ends.

FIG. 11 is a sequence diagram showing the procedure of access control processing according to the first embodiment. As shown in FIG. 11, upon receiving a message from the user terminal 20 (step S410), the access control unit 15E refers to the attribute information from the stored data of the authorization proxy (step S420). Subsequently, the access control unit 15E identifies the acquisition source of the attribute information (step S430).

At this time, if the attribute information acquisition destination is "LDAP", an attribute information acquisition request (user name) is sent to the LDAP server 40 (step S440). In response, the LDAP server 40 transmits attribute information corresponding to the user name for which the attribute information acquisition request was made in step S440 to the authorization proxy execution unit 15. On the other hand, if the attribute information acquisition source is "proxy", the process of step S440 is skipped.

Thereafter, the access control unit 15E uses the attribute information acquired in step S420 or step S440 to determine whether access from the user terminal 20 is possible (step S450). At this time, if it is determined that access is possible, the access control unit 15E transfers the message received from the user terminal 20 in step S410 to the service execution unit 13 (step S460).

FIG. 12 shows the details of the logic of the processing of the authorization proxy execution unit 15 from step S410 to step S460 shown in FIG. 11. FIG. 12 is a flowchart showing the procedure of access control processing according to the first embodiment.

As shown in FIG. 12, when a user access from the user terminal 20 is accepted by the reception unit 15D (step S501), the access control unit 15E selects the LDAP information from among all user attribute information stored in the authorization proxy storage area. Attribute information of the user corresponding to the user name is acquired (step S502). Furthermore, the access control unit 15E notifies the authorization controller 50 of the history regarding the user access in step S501 and requests the authorization controller 50 to update the access log (step S503).

Furthermore, the access control unit 15E selects a user attribute acquisition source corresponding to the organization to which the user belongs, which is identified from the user attribute information acquired from the authorization proxy storage area, among the user attribute acquisition sources included in the acquisition source information 14B. Reference is made (step S504).

At this time, if the user attribute acquisition source is "LDAP" (step S505 Yes), the access control unit 15E acquires the user attribute information corresponding to the LDAP user name from the LDAP server 40 (step S506).

Then, the access control unit 15E determines whether or not access is possible based on the access authority associated with the role of the user attribute information acquired from the LDAP server 40 in step S506 among the access authority included in the authorization policy information 14D. Determination is made (step S507 and step S508).

On the other hand, when the user attribute acquisition source is "proxy" (step S505 No), the access control unit 15E stores the user attribute information acquired from the authorization proxy storage area in step S502 among the access authority included in the authorization policy information 14D. Access permission is determined based on the access authority associated with the role (step S507 and step S508).

Thereafter, the access control unit 15E controls the user access received from the user terminal 20 in step S501 based on the access determination result in step S508 (step S509), and ends the process.

[One aspect of the effect]
As described above, the authorization proxy execution unit 15 according to this embodiment sets the reference destination of attribute information used for access control to LDAP or pre-cache depending on whether the user belongs to an organization whose access frequency exceeds a threshold value. Switch between the two. For example, when accepting access from a user in an organization whose access frequency exceeds a threshold, pre-cached attribute information is used for access control, while when accepting access from a user in an organization whose access frequency is below the threshold, LDAP attribute information is used for access control. is used for access control. Therefore, according to the authorization proxy execution unit 15 according to this embodiment, it is possible to reduce the load on the LDAP server.

Now, the embodiments related to the disclosed apparatus have been described so far, but the present invention may be implemented in various different forms in addition to the embodiments described above. Therefore, other embodiments included in the present invention will be described below.

[Distribution and integration]
Further, each component of each illustrated device does not necessarily have to be physically configured as illustrated. In other words, the specific form of distributing and integrating each device is not limited to what is shown in the diagram, and all or part of the devices can be functionally or physically distributed or integrated in arbitrary units depending on various loads and usage conditions. Can be integrated and configured. For example, some of the functional units included in the authorization proxy execution unit 15 may be connected as external devices to the server device 10 via a network. Furthermore, the functions of the authorization proxy execution unit 15 may be realized by having different devices each having a part of the functional units included in the authorization proxy execution unit 15 and being connected to a network and working together. good.

[Access control program]
Moreover, the various processes described in the above embodiments can be realized by executing a program prepared in advance on a computer such as a personal computer or a workstation. Therefore, an example of a computer that executes an access control program having the same functions as those in the first and second embodiments will be described below with reference to FIG. 13.

FIG. 13 is a diagram showing an example of the hardware configuration of a computer. As shown in FIG. 13, the computer 100 includes an operation section 110a, a speaker 110b, a camera 110c, a display 120, and a communication section 130. Furthermore, this computer 100 has a CPU 150, a ROM 160, an HDD 170, and a RAM 180. Each of these units 110 to 180 is connected via a bus 140.

As shown in FIG. 13, the HDD 170 stores an access control program 170a that performs the same function as the authorization proxy execution unit 15 shown in the first embodiment. This access control program 170a may be integrated or separated similarly to each component of the authorization proxy execution unit 15 shown in FIG. That is, the HDD 170 does not necessarily need to store all the data shown in the first embodiment, and it is sufficient that the data used for processing is stored in the HDD 170.

Under such an environment, the CPU 150 reads the access control program 170a from the HDD 170 and expands it to the RAM 180. As a result, the access control program 170a functions as an access control process 180a, as shown in FIG. The access control process 180a expands various data read from the HDD 170 into an area allocated to the access control process 180a among the storage areas of the RAM 180, and executes various processes using the expanded various data. For example, examples of the processing executed by the access control process 180a include the processing shown in FIGS. 9 to 12. Note that the CPU 150 does not necessarily need to operate all of the processing units shown in the first embodiment, as long as the processing unit corresponding to the process to be executed is virtually realized.

Note that the access control program 170a described above does not necessarily have to be stored in the HDD 170 or ROM 160 from the beginning. For example, the access control program 170a is stored in a "portable physical medium" such as a flexible disk, so-called FD, CD-ROM, DVD disk, magneto-optical disk, or IC card, which is inserted into the computer 100. Then, the computer 100 may acquire the access control program 170a from these portable physical media and execute it. Alternatively, the access control program 170a may be stored in another computer or server device connected to the computer 100 via a public line, the Internet, LAN, WAN, etc., and the computer 100 may acquire the access control program 170a from these. It may also be executed by

Regarding the embodiments including the above examples, the following additional notes are further disclosed.

(Additional Note 1) An acquisition unit that acquires attribute information of users belonging to a group whose access frequency exceeds a threshold value from a server that stores attribute information groups of a plurality of users at a predetermined period;
When access to the service is received from a user terminal of a first user belonging to a group whose access frequency exceeds the threshold, access is performed based on the attribute information of the first user among the attribute information acquired by the acquisition unit. When the control is executed and an access to the service is accepted from a user terminal of a second user belonging to a group whose access frequency does not exceed the threshold, based on the attribute information of the second user stored in the server. An access control device comprising: an access control section that executes access control using the following methods.

(Supplementary note 2) The access control device according to supplementary note 1, wherein the server is an LDAP server that provides a directory service compatible with LDAP.

(Supplementary note 3) The access control device according to supplementary note 2, wherein the group is an organization corresponding to an entry located directly below a root entry of a directory information tree stored in the LDAP server.

(Supplementary note 4) The access control device according to supplementary note 1, further comprising a calculation unit that calculates a threshold value to be compared with the access frequency when the predetermined period has elapsed.

(Additional note 5) The calculation unit calculates that the total data size when acquiring attribute information from the server at the access frequency is equal to the data size when attribute information of all users in the group is acquired by the acquisition unit at once. The access control device according to appendix 4, characterized in that the access control device calculates a threshold value that becomes .

(Additional Note 6) Attribute information of users belonging to a group whose access frequency exceeds a threshold is acquired at a predetermined period from a server that stores attribute information groups of multiple users,
When an access to the service is received from a user terminal of a first user belonging to a group whose access frequency exceeds the threshold, based on the attribute information of the first user among the attribute information acquired in the acquisition process. When access control is executed and an access to the service is accepted from a user terminal of a second user belonging to a group whose access frequency does not exceed the threshold, the attribute information of the second user stored in the server is perform access control based on
An access control method characterized in that processing is executed by a computer.

(Additional Note 7) The access control method according to Additional Note 6, wherein the server is an LDAP server that provides a directory service compatible with LDAP.

(Additional Note 8) The access control method according to Additional Note 7, wherein the group is an organization corresponding to an entry located directly below a root entry of a directory information tree stored in the LDAP server.

(Supplementary note 9) The access control method according to supplementary note 6, wherein the computer further executes a process of calculating a threshold value to be compared with the access frequency when the predetermined period has elapsed.

(Additional note 10) The calculation process is performed such that the total data size when attribute information is acquired from the server at the access frequency is the data size when attribute information of all users in the group is acquired by the acquisition unit at once. The access control method according to appendix 9, characterized in that an equal threshold value is calculated.

(Additional Note 11) Attribute information of users belonging to a group whose access frequency exceeds a threshold is acquired at a predetermined period from a server that stores attribute information groups of a plurality of users,
When an access to the service is received from a user terminal of a first user belonging to a group whose access frequency exceeds the threshold, based on the attribute information of the first user among the attribute information acquired in the acquisition process. When access control is executed and an access to the service is accepted from a user terminal of a second user belonging to a group whose access frequency does not exceed the threshold, the attribute information of the second user stored in the server is perform access control based on
An access control program that causes a computer to execute processing.

(Supplementary note 12) The access control program according to supplementary note 11, wherein the server is an LDAP server that provides a directory service compatible with LDAP.

(Supplementary note 13) The access control program according to supplementary note 12, wherein the group is an organization corresponding to an entry located immediately below a root entry of a directory information tree stored in the LDAP server.

(Supplementary note 14) The access control program according to supplementary note 11, further causing the computer to execute a process of calculating a threshold value to be compared with the access frequency when the predetermined period has elapsed.

(Additional Note 15) The calculation process is performed such that the total data size when attribute information is acquired from the server at the access frequency is the data size when attribute information of all users in the group is acquired by the acquisition unit at once. The access control program according to appendix 14, characterized in that the access control program calculates the threshold values that are equivalent.

1 Corporate information system 10 Server device 11 Authentication unit 13 Service execution unit 15 Authorization proxy execution unit 15A Calculation unit 15B Generation unit 15C Acquisition unit 15D Reception unit 15E Access control unit 20 User terminal 30 Administrator terminal 40 LDAP server 50 Authorization controller

Claims (7)

an acquisition unit that acquires attribute information of users belonging to a group whose access frequency exceeds a threshold value at a predetermined period from a server that stores attribute information groups of a plurality of users;
When access to the service is received from a user terminal of a first user belonging to a group whose access frequency exceeds the threshold, access is performed based on the attribute information of the first user among the attribute information acquired by the acquisition unit. When the control is executed and an access to the service is accepted from a user terminal of a second user belonging to a group whose access frequency does not exceed the threshold, based on the attribute information of the second user stored in the server. An access control device comprising: an access control section that executes access control using the following methods. The access control device according to claim 1, wherein the server is an LDAP server that provides a directory service compatible with LDAP. 3. The access control device according to claim 2, wherein the group is an organization corresponding to an entry located directly below a root entry of a directory information tree stored in the LDAP server. 3. The access control device according to claim 1, further comprising a calculation unit that calculates a threshold value to be compared with the access frequency when the predetermined period has elapsed. The calculation unit determines a threshold value at which the total data size when attribute information is acquired from the server at the access frequency is equal to the data size when attribute information of all users in the group is acquired by the acquisition unit at once. The access control device according to claim 4, characterized in that the access control device calculates. Attribute information of users belonging to a group whose access frequency exceeds a threshold is acquired at a predetermined period from a server that stores attribute information groups of multiple users,
When an access to the service is received from a user terminal of a first user belonging to a group whose access frequency exceeds the threshold, based on the attribute information of the first user among the attribute information acquired in the acquisition process. When access control is executed and an access to the service is accepted from a user terminal of a second user belonging to a group whose access frequency does not exceed the threshold, the attribute information of the second user stored in the server is perform access control based on
An access control method characterized in that processing is executed by a computer. Attribute information of users belonging to a group whose access frequency exceeds a threshold is acquired at a predetermined period from a server that stores attribute information groups of multiple users,
When an access to the service is received from a user terminal of a first user belonging to a group whose access frequency exceeds the threshold, based on the attribute information of the first user among the attribute information acquired in the acquisition process. When access control is executed and an access to the service is accepted from a user terminal of a second user belonging to a group whose access frequency does not exceed the threshold, the attribute information of the second user stored in the server is perform access control based on
An access control program that causes a computer to execute processing.

Images