JPH09293052A - Method and system for authorization management between plural networks - Google Patents

Abstract

PROBLEM TO BE SOLVED: To easily unify managed authority even when authorization management is performed by different organization structures in networks. SOLUTION: The relation of permission to access a resource in one network from organization data in another network is generated by an authorization correspondence relation editing means 31 and held in an authorization correspondence relation maintaining means 32. Here, if a user in a network 1 makes a request to access a resource in a network 2, an authorization corresponding relation retrieving means 33 retrieves whether or not the user as the access request source or the group that the user belongs to corresponds to organization data in the network 2 at a request from an authorization management service part 21 and rejects the access when not; when the user or group corresponds to the data, an authorization management service part 21 judges whether or not the organization data has the right to access the target resource in the network 2.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a right management method and system on a network system, and more particularly to a right management method and system over a plurality of networks.

[0002]

2. Description of the Related Art Conventionally, in this kind of authority management method or system, in order to make the access right to the resource on the computer network system correspond to the organizational structure of the real world, it is described in, for example, Japanese Patent Application Laid-Open No. 4-302344. As described above, there is proposed a method for enabling the authority management preferable for the real world organization operation by making the organization data indicating the access right to the information include the authority of the organization data lower than the organization data. There is.

[0003]

However, in the conventional method as described above, when operating in an organizational structure having different management authority on a plurality of networks, it is possible to operate on the plurality of networks. Users / groups with administrative privileges on one network typically do not have access to the resource on another different network because they are not associated with each other, or They are in different situations with different access rights.

Therefore, the present invention has been made in view of the above-mentioned circumstances, and the management authority can be easily integrated even when the authority management is performed under different organizational structures on different networks. It is an object of the present invention to provide a method and system for managing authority between multiple networks.

[0005]

In order to achieve the above-mentioned object, according to the present invention, the access from the user / group on the other network to the resource on the own network is handled by the management authority of the user / group on the own network. An authority management method between a plurality of networks is provided, which is characterized by performing the management.

Further, the present invention is directed to management authority of users / groups on other networks and users / groups on their own network.
Authority correspondence relationship editing means for creating a correspondence relationship with group management authority, authority correspondence relationship maintaining means for holding the correspondence relationship created by the authority correspondence relationship editing means, and authority correspondence relationship maintaining means Authority between a plurality of networks, which includes access authority search means for finding out the access right of the user / group on the own network corresponding to the access from the user / group on the other network based on the corresponding relationship. Provide a management system.

[0007]

Next, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram showing the configuration of an embodiment of the present invention. Referring to FIG. 1, in the best mode for carrying out the present invention, a network 1 and a network 2 which are physically or logically different networks, and an authority management integrated service unit for integrally managing these networks. 3 and. In the following description, the case where the management authority of the two networks 1 and 2 is made to correspond is taken as an example, but the present invention is not limited to this and is similarly applied to the case of making the management authority of three or more networks correspond. can do.

The authority management service unit 11 and the authority management service unit 21 edit / store / maintain the management authority corresponding to the organizational structures on the network 1 and the network 2, respectively, and access to resources on the own network. Manage rights. As the management method, the method described in the above-mentioned JP-A-4-302344 can be used.

The authority management integration service unit 3 includes an authority correspondence relation editing means 31, an authority correspondence relation maintaining means 32, and an authority correspondence relation searching means 33.

The authority correspondence editing means 31 manages predetermined organization data maintained by the authority management service unit 11 of the network 1 and manages predetermined organization data maintained by the authority management service unit 21 of the network 2. It is a means for creating a correspondence between the authority and the corresponding relation that already exists.

The authority correspondence relation maintaining means 32 is means for holding the correspondence relation created or updated by the authority correspondence relation editing means 31.

When a user / group on a different network accesses a resource on a certain network, the authority correspondence search unit 33 responds to an inquiry from the authority management service unit on the network where the resource exists. Is a means for determining whether or not there is a management authority corresponding to the management authority on the original network, and that the target resource can be accessed by the management authority, and returns the result.

Next, the operation of the embodiment of the present invention will be described.

Referring to FIG. 1, for example, the network 1
The administrator can create a relationship of access permission from the organization data existing in another network for the organization data stored in the authority management service unit 11 by the authority correspondence relationship editing means 31, and the created access The permission relationship is held by the authority correspondence relationship maintaining unit 32. Similarly, the administrator of the network 2 can create an access permission relationship from the organization data existing in another network with respect to the organization data stored in the authority management service unit 21 by the authority correspondence editing unit 31. The created access permission relationship is held by the authority correspondence relationship maintaining unit 32.

When an access request is made from a user on the network 1 to a resource on the network 2, the authority management service unit 21 determines that the user who requested the access or the group to which the user belongs is
The authority-correspondence relationship search means 33 searches the relationship held by the authority-correspondence relationship maintaining means 32 to determine whether or not it corresponds to the organization data on the network 2. If the corresponding organization data does not exist, access is denied. . On the other hand, when the corresponding organization data exists, the authority management service unit 21 further determines whether or not the organization data has the access right to the resource of the access request destination on the network 2 and, as a result, return it.

[0017]

EXAMPLES Examples of the present invention will now be described with reference to the drawings in order to describe the above-described embodiments of the present invention more specifically.

FIG. 2 is a diagram for explaining one embodiment of the present invention. As shown in FIG. 2, on the network 1 and the network 2, organizational data having a hierarchical structure formed by the lower management authority being included in the higher management authority is held. On the network 1, the groups 13 and 14 belong to the group 12, and the users 15 and 16 belong to the groups 13 and 14, respectively. Further, on the network 2, the user 23 and the user 24 belong to the group 22.

Here, the administrator on the network 2 uses the authority correspondence relation editing means 31 of the authority management integrated service section 3 to determine "group 22" as the correspondence relation between the group 22 on the network 2 and the organization data on the network 1. "Permits access from the group 13 on the network 1", and the authority correspondence relationship maintaining means 32 is created.
Therefore, it is assumed that this created relationship is held.

In such a situation, the network 1
When the above user 15 makes an access request to a resource on the network 2 to which the group 22 has an access right, in response to the request from the authority management service unit 21, the authority management integrated service unit 3 handles the authority. The relationship search means 33 searches whether any of the user 15, the group 13 to which the user 15 belongs, and the upper group 12 of the group 13 corresponds to the organizational data on the network 2. In this embodiment, as a result of such a search, “group 22 is group 1 on network 1
The access request from the user 15 is finally granted because the relationship "permit access from 3" is found, and the group 22 has the access right to the resource of the access request destination.

On the other hand, the user 1 on the network 1
If a similar access request is issued from 6, the authority correspondence search means 33 cannot find out the management authority corresponding to the organization data on the network 2, so the access request from the user 16 is rejected.

[0022]

As described above, according to the present invention,
Even when authority management is performed on different networks under different organizational structures, it is possible to easily integrate the management authority on multiple networks.

[Brief description of drawings]

FIG. 1 is a block diagram showing a configuration of an embodiment of the present invention.

FIG. 2 is a diagram for explaining an embodiment of the present invention.

[Explanation of symbols]

 1, 2 network 11, 21 authority management service section 12, 13, 14, 22 group 15, 16, 23, 24 user 3 authority management integration service section 31 authority correspondence relationship editing means 32 authority correspondence relationship maintenance means 33 authority correspondence relationship search means

Claims (5)

[Claims] 1. An authority management method between a plurality of networks, wherein access from a user / group on another network to a resource on the own network is managed in association with management authority of a user / group on the own network. . 2. A correspondence relationship between a user / group management authority on another network and a user / group management authority on the own network is created, and a resource on the own network is accessed from a user / group on another network. A permission management method between a plurality of networks, characterized in that the permission or denial is judged based on the correspondence relationship. 3. A plurality of users according to claim 1, wherein the users / groups of the own network or the other network are configured in a hierarchical structure in which lower management authority is included in higher management authority. Permission management method between networks. 4. An authority correspondence editing means for creating a correspondence between a management authority of a user / group on another network and a management authority of a user / group on the own network, and the authority correspondence editing means. Authority correspondence maintaining means for holding correspondence, and access of user / group on own network corresponding to access from user / group on other network based on correspondence held by the authority correspondence maintaining means An authority management system between a plurality of networks characterized by including authority correspondence search means for finding a right. 5. The plurality of networks according to claim 4, wherein the users / groups of the own network or the other network are configured in a hierarchical structure in which lower management authority is included in higher management authority. Authority management system.