JP2017162481A - Terminal, access control method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform access restriction with predetermined granularity without modifying a permission mechanism itself in a certain open platform.SOLUTION: An application processes data communication with an application server, and executes a unique processing operation of the application. The application detects user access to a resource. When detecting the user access to the resource, the application refers to an access policy of a user. Then, on the basis of the referred user access policy, determination processing is performed as to whether to permit the user to access the resource, as interrupt processing.SELECTED DRAWING: Figure 3

Description

  The present invention relates to a terminal, an access restriction method, and a program for restricting an application installed in a terminal from accessing a resource of a terminal user.

  In an open platform for a portable terminal represented by android (registered trademark) OS, a mechanism called permission is used to prevent access to inappropriate resources. On these platforms, when installing an application, a list of resources that need to be accessed is presented to the user, and the application cannot be installed unless the user approves it. For this reason, a technique has been proposed in which a source file is repackaged, a monitoring function is added to an interface for a resource for which access is permitted, and permission is requested from the user for each access (see, for example, Non-Patent Document 1).

Rubin Xu, Hassen Saidi, and Ross Anderson, “Aurasium: Practical Policy for Android Applications”, USENIX Security'12.

  However, since the permission is determined in advance by the platform provider, it cannot cope with a case where the granularity is inappropriate. For example, it may not be possible to restrict an application that has permitted Internet access to allow access to a legitimate site that is supposed to be accessed, but not to allow access to an unexpected illegal site. Further, the technique described in Non-Patent Document 1 has a problem that convenience is reduced by asking the user for permission for each access.

  Therefore, the present invention has been made in view of the above-described problems, and a terminal and an access restriction method capable of performing access restriction with a desired granularity without modifying the permission mechanism itself in an open platform. And to provide a program.

  The present invention proposes the following matters in order to solve the above problems. In addition, in order to make an understanding easy, although the code | symbol corresponding to embodiment of this invention is attached | subjected and demonstrated, it is not limited to this.

  (1) The present invention is a terminal provided with an application (for example, equivalent to the application 210 in FIGS. 1 and 2) that restricts access at a desired granularity, and the application is connected to an application server. Processing means for processing data communication (for example, equivalent to the processing unit 211 in FIGS. 1 and 2) and execution means for executing unique processing operations of the application (for example, equivalent to the execution unit 212 in FIGS. 1 and 2) ), An access detection unit (for example, equivalent to the access detection unit 214 in FIGS. 1 and 2) for detecting that the application has attempted to access the user resource, and the access detection unit to the user resource. Whether to allow access to user resources by referring to the user's access policy An access restriction means (for example, equivalent to the access restriction unit 213 in FIGS. 1 and 2) that performs the determination process as an interrupt process, and an access policy storage unit (for example, FIG. 1, FIG. 1) that stores the access policy of the user. 4 and an access policy storage unit 220 in FIG. 4 and a resource storage unit (for example, corresponding to the resource storage unit 230 in FIGS. 1 and 4) for storing the user's resources. Has proposed.

  According to this invention, the processing means of the application processes data communication with the application server. The execution means executes a unique processing operation of the application. The access detection means detects that the application tried to access the user's resource. When the access detection means detects access to the user's resource, the access restriction means refers to the user's access policy and determines whether to permit access to the user's resource as an interrupt process. . Therefore, it is possible to perform access restriction with a desired granularity without modifying the permission mechanism itself in a certain open platform.

  (2) The present invention includes a storage device (for example, equivalent to the access policy server 300 and the resource server 400 in FIG. 2) for storing the user resource and access policy for the terminal of (1). A terminal with features is proposed.

  According to the present invention, a storage device for storing user resources and access policies is provided outside. This makes it possible to use resources and access policies of users outside the terminal.

  (3) The present invention includes an application and access restriction means (for example, equivalent to the access restriction unit 251 in FIGS. 7 and 8) for restricting access to the application, and the access restriction means has an application with a desired granularity. And a processing means (for example, corresponding to the processing unit 211 in FIG. 7 and FIG. 8) for processing data communication with the application server, and a unique application of the application. Execution means (e.g., corresponding to the execution unit 212 in FIGS. 7 and 8) for executing processing operations, and when the access restriction means tries to access the user's resources, Refer to the access policy to determine whether to allow access to the user's resources. It has proposed a terminal, wherein the door.

  According to this invention, the processing means of the application processes data communication with the application server. The execution means executes a unique processing operation of the application. When the application tries to access the user's resource, the access restriction means refers to the user's access policy and determines whether to permit access to the user's resource. Therefore, it is possible to perform access restriction with a desired granularity without modifying the permission mechanism itself in a certain open platform.

  (4) The present invention provides an application that restricts access by itself (for example, equivalent to the application 210 in FIGS. 1 and 2), an access policy storage unit that stores a user access policy, and a resource that stores the user resource. And a storage unit, and an access restriction method in a terminal that restricts access at a desired granularity, wherein the application processes data communication with an application server (for example, step of FIG. 3). S110), a second step in which the application executes a unique processing operation of the application (for example, equivalent to step S120 in FIG. 3), and a first step in which the application detects access to a user resource. 3 step (for example, in step S130 of FIG. And a fourth step (for example, corresponding to step S140 in FIG. 3) of referring to the access policy of the user when the application detects access to the resource of the user, and the application And a fifth step (for example, corresponding to step S150 in FIG. 3) of performing, as an interrupt process, a process for determining whether to permit access to the user's resource based on the user's access policy. Proposed access restriction method.

  According to the present invention, the application processes data communication with the application server, and executes an original processing operation of the application. The application detects access to the user's resource, and refers to the user's access policy when detecting access to the user's resource. Then, based on the access policy of the referred user, a process for determining whether to permit access to the user's resource is performed as an interrupt process. Therefore, it is possible to perform access restriction with a desired granularity without modifying the permission mechanism itself in a certain open platform.

  (5) The present invention includes an application that limits access by itself, an access policy storage unit that stores a user's access policy, and a resource storage unit that stores the user's resources, and performs access limitation at a desired granularity. A program for causing a computer to execute an access restriction method in a terminal, wherein the application processes data communication with an application server (for example, corresponding to step S110 in FIG. 3); A second step (for example, corresponding to step S120 in FIG. 3) in which the application performs a unique processing operation of the application, and a third step (for example, in which the application detects access to a user resource) Equivalent to step S130 in FIG. 3), When the application detects access to the resource of the user, a fourth step of referring to the user's access policy (for example, corresponding to step S140 in FIG. 3) and the access of the user referred to by the application A program for causing a computer to execute a fifth step (e.g., corresponding to step S150 in FIG. 3) of performing, as an interrupt process, a process for determining whether to permit access to a user resource based on a policy. is suggesting.

  According to the present invention, the application processes data communication with the application server, and executes an original processing operation of the application. The application detects access to the user's resource, and refers to the user's access policy when detecting access to the user's resource. Then, based on the access policy of the referred user, a process for determining whether to permit access to the user's resource is performed as an interrupt process. Therefore, it is possible to perform access restriction with a desired granularity without modifying the permission mechanism itself in a certain open platform.

  According to the present invention, there is an effect that it is possible to perform access restriction with a desired granularity without modifying the permission mechanism itself in a certain open platform.

It is a figure which shows the structure of the terminal which concerns on the 1st Embodiment of this invention. It is a figure which shows the structure of the terminal which concerns on the modification of the 1st Embodiment of this invention. It is a figure which shows the process of the terminal which concerns on the 1st Embodiment of this invention. It is a figure which shows the structure of the terminal which concerns on the 2nd Embodiment of this invention. It is a figure which shows the structure of the terminal which concerns on the modification of the 2nd Embodiment of this invention. It is a figure which shows the process of the terminal which concerns on the 2nd Embodiment of this invention. It is a figure which shows the structure of the terminal which concerns on the 3rd Embodiment of this invention. It is a figure which shows the structure of the terminal which concerns on the modification of the 3rd Embodiment of this invention. It is a figure which shows the process of the terminal which concerns on the 3rd Embodiment of this invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
Note that the constituent elements in the present embodiment can be appropriately replaced with existing constituent elements and the like, and various variations including combinations with other existing constituent elements are possible. Therefore, the description of the present embodiment does not limit the contents of the invention described in the claims.

<First Embodiment>
A first embodiment of the present invention will be described with reference to FIGS.

  The terminal of the present invention can install an application according to a certain platform. At this time, the permission is set at a granularity determined by the platform provider. The set permission restricts the application from accessing the application user's resources.

  In addition, the installed application may need to submit the acquired application user resource to the application server in order to provide services to the user. Thus, when an application user's resource is required, when installing an application in an application utilization terminal, it is necessary to obtain an agreement of an application user explicitly. Hereinafter, an embodiment for executing the above processing will be described.

<Terminal configuration>
As illustrated in FIG. 1, the terminal 200 according to the present embodiment includes an application 210 that restricts its own access, an access policy storage unit 220 that stores user access policies, and a resource storage unit 230 that stores user resources. It consists of and. An application server 100 is provided outside. The access policy storage unit 220 and the resource storage unit 230 may be provided outside the terminal as the access policy server 300 and the resource server 400, as shown in FIG. As described above, if a storage device for storing user resources and access policies is provided outside, it is possible to use resources and access policies of users outside the terminal. In addition, the terminal according to the present embodiment is a terminal capable of setting a policy only with a predetermined granularity on the platform when an application is installed.

  Here, the access policy is set independently of the permission setting determined by the platform provider by the provider providing the application restriction unit described later, and the access policy is realized as some conditional expression. Specifically, an execution permission or an execution denial is assigned to a combination of a function to be executed, a resource to be accessed, an application provider, an access use, and the like.

  Further, the application 210 includes a processing unit 211, an execution unit 212, an access restriction unit 213, and an access detection unit 214.

  The processing unit 211 processes data communication with the application server. The execution unit 212 executes a unique processing operation of the application.

  The access detection unit detects that the application tried to access the user's resource. When the access restriction unit 213 detects an access to the user's resource, the access restriction unit 213 refers to the user's access policy and performs a determination process as to whether or not to permit the access to the user's resource as an interrupt process. The access restriction unit 213 restricts access to the resource of the application user according to the access policy setting independent of the permission setting determined by the platform provider.

<Terminal processing>
Processing of the terminal according to the present embodiment will be described using FIG.

  The application processes data communication with the application server (step 110), and executes an original processing operation of the application (step S120).

  Next, the application detects access to the user's resource (step S130), and when the application detects access to the user's resource, the user's access policy is referred to (step S140).

  Then, based on the access policy of the referred user, a process for determining whether to permit access to the user's resource is performed as an interrupt process (step S150). In addition, as a method of interruption, a function for obtaining the resource of the application user is replaced with a function forcing access to the application restriction unit 213 in advance, and a third party or the like indicates that all functions have been replaced. You may make it implement | achieve by checking. In addition, as a specific operation, for example, when a function to be executed by an application is defined as being permitted by the access policy, the function is executed as it is and is defined as being rejected. In that case, an error message may be returned to stop the operation.

  As described above, according to the present embodiment, by implementing an application that restricts access to a terminal on a terminal, access restriction with a desired granularity is performed without modifying the permission mechanism itself in a certain open platform. be able to.

<Second Embodiment>
A second embodiment of the present invention will be described with reference to FIGS. In addition, about the component which attaches | subjects the same code | symbol as 1st Embodiment, since it has the same function, the detailed description is abbreviate | omitted.

<Terminal configuration>
As illustrated in FIG. 4, the terminal 200 according to the present embodiment includes an application 240, an access policy storage unit 220 that stores user access policies, a resource storage unit 230 that stores user resources, and an access restriction unit 251. And an access restriction application 250 for restricting the access of the application having. The access policy storage unit 220 and the resource storage unit 230 may be provided outside the terminal as the access policy server 300 and the resource server 400 as shown in FIG. As described above, if a storage device for storing user resources and access policies is provided outside, it is possible to use resources and access policies of users outside the terminal.

  Here, the access policy is set independently of the permission setting determined by the platform provider by the provider providing the application restriction unit described later, and the access policy is realized as some conditional expression. Specifically, an execution permission or an execution denial is assigned to a combination of a function to be executed, a resource to be accessed, an application provider, an access use, and the like.

  When the application tries to access the user resource, the access restriction unit 251 refers to the user access policy and determines whether to permit access to the user resource.

  Note that the application user needs to confirm that the application does not request permission other than access to the application restriction unit 251 when installing the application.

  Further, the application restriction unit 251 is granted all permissions required by the application group to be restricted. When the application executes a procedure for acquiring the resource of the application user, an acquisition request is submitted to the application restriction unit 251. Then, the application restriction unit 251 first refers to the access policy of the application user set in advance, and then, if the application acquisition request is defined to be executable by the access policy, the application restriction The unit 251 acquires the application user resource and provides it to the application. On the other hand, if it is defined that the requested execution is rejected, an error message is returned and the operation is stopped.

<Terminal processing>
Processing of the terminal according to the present embodiment will be described using FIG.

  First, the access restriction application 250 detects access to the user's resource by the application (step S210), and refers to the user's access policy when detecting access to the user's resource by the application (step S220). Then, based on the access policy of the referred user, it is determined whether or not access to the user resource is permitted (step S230).

  As a specific operation, for example, when an application acquisition request is defined as an execution permission by an access policy, the application restriction unit 251 acquires the application user resource and provides it to the application. . On the other hand, if it is defined that the requested execution is rejected, an error message may be returned to stop the operation.

  As described above, according to the present embodiment, when an application tries to access a user resource, the user access policy is referred to and whether or not access to the user resource is permitted is determined. By installing the access restriction application in the terminal, it is possible to restrict access with a desired granularity without modifying the permission mechanism itself in an open platform.

<Third Embodiment>
A third embodiment of the present invention will be described with reference to FIGS. In addition, about the component which attaches | subjects the same code | symbol as 1st Embodiment and 2nd Embodiment, since it has the same function, the detailed description is abbreviate | omitted. In the present embodiment, all of the components are configured by hardware.

<Terminal configuration>
As illustrated in FIG. 7, the terminal 200 according to the present embodiment stores an application 260 including a processing unit 211 and an execution unit 212, an access policy storage unit 220 that stores a user access policy, and a user resource. Resource storage section 230 and access restriction section 251. An application server 100 is provided outside. The access policy storage unit 220 and the resource storage unit 230 may be provided outside the terminal as the access policy server 300 and the resource server 400, as shown in FIG. As described above, if a storage device for storing user resources and access policies is provided outside, it is possible to use resources and access policies of users outside the terminal.

  Here, the access policy is set independently of the permission setting determined by the platform provider by the provider providing the application restriction unit described later, and the access policy is realized as some conditional expression. Specifically, an execution permission or an execution denial is assigned to a combination of a function to be executed, a resource to be accessed, an application provider, an access use, and the like.

  When the application tries to access the user's resource, the access restriction unit 251 refers to the user's access policy and determines whether to permit access to the user's resource.

  Note that the application user needs to confirm that the application does not request permission other than access to the application restriction unit 251 when installing the application.

  Further, the application restriction unit 251 is granted all permissions required by the application group to be restricted. When the application executes a procedure for acquiring the resource of the application user, an acquisition request is submitted to the application restriction unit 251. Then, the application restriction unit 251 first refers to the access policy of the application user set in advance, and then, if the application acquisition request is defined to be executable by the access policy, the application restriction The unit 251 acquires the application user resource and provides it to the application. On the other hand, if it is defined that the requested execution is rejected, an error message is returned and the operation is stopped.

<Terminal processing>
The processing of the terminal according to the present embodiment will be described using FIG.

  First, the application processes data communication with the application server (step S310), and executes an original processing operation of the application (step S320).

  Next, the access restriction unit 251 detects access to the user's resource by the application (step S330), and refers to the user's access policy when detecting access to the user's resource by the application (step S340). Then, based on the access policy of the referred user, it is determined whether or not access to the user resource is permitted (step S350).

  As a specific operation, for example, when an application acquisition request is defined to be permitted by the access policy, the access restriction unit 251 acquires the application user resource and provides it to the application. . On the other hand, if it is defined that the requested execution is rejected, an error message may be returned to stop the operation.

  As described above, according to this embodiment, by implementing the access restriction unit 251 as hardware, it is possible to restrict access with a desired granularity without modifying the permission mechanism itself in a certain open platform. Can do.

  The terminal of the present invention can be realized by recording the processing of the terminal on a recording medium readable by the computer system, causing the terminal to read and execute the program recorded on the recording medium. The computer system here includes an OS and hardware such as peripheral devices.

  Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW (World Wide Web) system is used. The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.

  The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, what is called a difference file (difference program) may be sufficient.

  The embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the embodiments, and includes designs and the like that do not depart from the gist of the present invention.

100; Application server 200; Terminal 210; Application 211; Processing unit 212; Execution unit 213; Access restriction unit 214; Access detection unit 220; Access policy storage unit 230; Resource storage unit 240; Application 250; Access restriction application 251; Restriction unit 260; application 300; access policy server 400; resource server

Claims (5)

A terminal with an application that restricts access at a desired granularity,
The application
Processing means for processing data communication with the application server;
Execution means for executing a unique processing operation of the application;
Access detection means for detecting that the application tried to access the user's resource;
An access restriction unit that, when the access detection unit detects access to the user's resource, refers to the user's access policy and performs a determination process as to whether or not to permit access to the user's resource as an interrupt process; ,
With
An access policy storage unit for storing the access policy of the user;
A resource storage unit for storing the resource of the user;
A terminal comprising:   The terminal according to claim 1, further comprising a storage device for storing the user resource and access policy. An application and access restriction means for restricting access of the application, wherein the access restriction means is a terminal for restricting access to the application at a desired granularity;
The application
Processing means for processing data communication with the application server;
Execution means for executing a unique processing operation of the application;
With
The terminal, wherein when the application tries to access a user resource, the access restriction unit refers to a user access policy and determines whether to permit access to the user resource. Access in a terminal that includes an application that restricts access by itself, an access policy storage unit that stores a user's access policy, and a resource storage unit that stores the resource of the user, and in which the application restricts access at a desired granularity Restriction method,
A first step in which the application processes data communication with an application server;
A second step in which the application performs a unique processing operation of the application;
A third step in which the application detects access to a user's resources;
A fourth step of referring to a user's access policy when the application detects access to the user's resource;
A fifth step in which the application performs, as an interrupt process, a process for determining whether to permit access to a user's resource based on the referred user's access policy;
An access restriction method comprising: An access restriction method in a terminal for restricting access at a desired granularity, comprising: an application that restricts access by itself; an access policy storage unit that stores user access policies; and a resource storage unit that stores user resources. A program for executing
A first step in which the application processes data communication with an application server;
A second step in which the application performs a unique processing operation of the application;
A third step in which the application detects access to a user's resources;
A fourth step of referring to a user's access policy when the application detects access to the user's resource;
A fifth step in which the application performs, as an interrupt process, a process for determining whether to permit access to a user's resource based on the referred user's access policy;
A program that causes a computer to execute.

Images