Access control system and access control method

Patent metadata

Field	Value
Publication number	US-2018225465-A1
Application number	US-201615505949-A
Country	US
Kind code	A1
Filing date	Jan 6, 2016
Priority date	Mar 25, 2015
Publication date	Aug 9, 2018
Grant date	—

Abstract

To provide a system for simplifying setting of access control for a file system and a firewall, it is provided an access control system, which is formed by a computer including a processor configured to execute a process, and a memory configured to store a program for executing the process, the access control system comprising: a launcher, which is a process configured to activate the process; an ACL file in which specifics for controlling an I/O request issued by the process are defined; a process search module configured to trace a parent of the process to determine whether or not the process is an activated process that has originated from the launcher; and an access control module configured to control an I/O request issued by the activated process that has originated from the launcher in accordance with the specifics defined in the ACL file.

First claim

What is claimed is:

1 . An access control system, which is formed by a computer including a processor configured to execute a process, and a memory configured to store a program for executing the process, the access control system comprising:
a launcher, which is a process configured to activate the process; an ACL file in which specifics for controlling an I/O request issued by the process are defined; a process search module configured to trace a parent of the process to determine whether or not the process is an activated process that has originated from the launcher; and an access control module configured to control an I/O request issued by the activated process that has originated from the launcher in accordance with the specifics defined in the ACL file.

2 . The access control system according to claim 1 , wherein the process search module is configured to:
acquire identification information on the process that has issued the I/O request; determine that the process that has issued the I/O request is an activated process that has originated from the launcher in a case where identification information on a process that has activated the process is the same as identification information on the launcher; and trace a parent process of the process to further determine whether identification information on the parent process is the same as the identification information on the launcher in a case where the identification information on the process that has activated the process is different from the identification information on the launcher.

3 . The access control system according to claim 1 , wherein the access control module is configured to:
determine a type of the I/O request; determine specifics for controlling I/O depending on an access destination of the I/O request by referring to the ACL file in a case where the I/O request is a file I/O request; and determine specifics for controlling I/O depending on a communication source of the I/O request and a communication destination of the I/O request by referring to the ACL file in a case where the I/O request is a network I/O request.

4 . An access control method, which is executed by a computer including a processor configured to execute a process, and a memory configured to store a program for executing the process,
the computer including: a launcher, which is a process configured to activate the process with the processor; a process search module configured to trace a parent of the process with the processor; and an access control module configured to control an I/O request with the processor, the computer being configured to store an ACL file in which specifics for controlling the I/O request are defined, the access control method comprising steps of: tracing, by the process search module, a parent of the process to determine whether the process is an activated process that has originated from the launcher; and controlling, by the access control module, an I/O request issued by the activated process that has originated from the launcher in accordance with the specifics defined in the ACL file.

5 . The access control method according to claim 4 , further comprising steps of:
acquiring, by the process search module, identification information on the process that has issued the I/O request; determining, by the process search module, that the process that has issued the I/O request is an activated process that has originated from the launcher in a case where identification information on a process that has activated the process is the same as identification information on the launcher; and tracing, by the process search module, a parent process of the process that has issued the I/O request to further determine whether identification information on the parent process is the same as the identification information on the launcher in a case where the identification information on the process that has activated the process is different from the identification information on the launcher.

6 . The access control method according to claim 4 , further comprising:
determining, by the access control module, a type of the I/O request; determining, by the access control module, specifics for controlling I/O depending on an access destination of the I/O request by referring to the ACL file in a case where the I/O request is a file I/O request; and determining, by the access control module, specifics for controlling I/O depending on a communication source of the I/O request and a communication destination of the I/O request by referring to the ACL file in a case where the I/O request is a network I/O request.

Assignees

• Hitachi Solutions Ltd

Inventors

• Kiyokawa Yuuichi
• Inoue Kouji
• Nakayama Ryuuji
• Ota Hiroyuki

Classifications

• H04L63/101

  Access control lists [ACL] · CPC title

• G06F21/62 Primary

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title

• G06F11/3485

  for I/O devices · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title