JP2004259102A - Access integrated control method, access integrated control device and network using integrated control system using same device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide technology for ensuring the security of network access by integrally controlling an application layer and a network layer. <P>SOLUTION: This access integrated control method has a step of interpreting the contents of utilization control to an application in an application utilization control device according to the user information and the application information received from the application utilization control device using a communicating means. The method has a step of interpreting the contents of network access control in the network access control device according to the access control information received from the network access control device using the communicating means. Further the method has a step of generating access control information for performing the network access control requested by the application utilization control device and transmitting the same to the network access control device using the communicating means to give an instruction for updating the access control information to the network access control device. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a network use integrated control system that controls the use of various application resources existing on a network and controls the use of network resources in accordance with the control. The present invention relates to a technology effective when applied to a network use integrated control system that integrally manages settings for use.
[0002]
[Prior art]
With the development of plug-and-play technology and middleware for network resource management, many resources, from various computing resources to information home appliances, are being connected to networks. In these environments, users can use those resources simply by connecting them to the network (for example, see Non-Patent Documents 1, 2, 3, and 4). A technique for managing and controlling a user's right to use a network, a right to use a resource, and the like using these techniques has also been established (for example, see Non-Patent Documents 6 and 7). Further, a system for controlling a usage right for using an application has been studied (for example, see Patent Document 1).
[0003]
Further, as a technique for temporarily using a network when an account is not held in the above-described network environment, there are an authentication VLAN (for example, see Non-Patent Document 5) and a guest account mechanism.
[0004]
As a technology for network security, a technology for securely communicating between resources on a certain network so as not to be seen by others, such as a VPN (Virtual Private Network) (for example, Non-Patent Documents 8, 9, 10). ), VLAN (Virtual Local Area Network) (for example, see Non-Patent Document 11), and SSL (Secure Socket Layer) (for example, see Non-Patent Document 12).
[0005]
[Patent Document 1]
JP 2000-305776 A
[Non-patent document 1]
"Universal Plug and Play Forum", Microsoft Corporation [online] [Search December 16, 2002] Internet <URL: http: // www. upnp. org / ＞
[Non-patent document 2]
"Jini.org", Sun Microsystems [online] [searched on December 16, 2002] Internet <URL: http: // www. jini. org / ＞
[Non-Patent Document 3]
“Home Audio Video Interoperability”, The HAVi Organization [online] [Searched on December 16, 2002] Internet <URL: http: // www. havi. org / ＞
[Non-patent document 4]
“MIT Project Oxygen”, MIT Laboratory for Computer Science. MIT Artificial Intelligence Laboratory [online] [Searched December 16, 2002] Internet <URL: http: // oxygen. lcs. mit. edu / ＞
[Non-Patent Document 5]
"What is an authentication VLAN?" NEC Corporation. [Online] [Searched on December 16, 2002] Internet <URL: http: // www. sw. nec. co. jp / middle / VLANaccess / summary. html>
[Non-Patent Document 6]
Eichi Niwano, 3 others, "MUSA: Model-based Ubiquitous Service Architecture", IEICE Technical Report Vol 101, 742, pp73-82, KBSE2001-74, 2000-3
[Non-Patent Document 7]
Masakazu Kobe and three others, "Study on management method of usage rights of computing resources", IEICE Technical Report, vol. 504, pp13-18, KBSE2002-23, Dec 2002
[Non-Patent Document 8]
"VPN Solutions", Allied Telesis K. et al. K. [Online] [Searched on December 16, 2002] Internet <URL: http: // www. allied-telesis. co. jp / sol / vpn / >>
[Non-Patent Document 9]
"Security related RFCs", Information Processing Promotion Agency Security Center [online] [Search on December 16, 2002] Internet <URL: http: // www. ipa. go. jp / security / rfc / RFC. html>
[Non-Patent Document 10]
"Layer 2 Tunneling Protocol", Cisco Systems K.K. K. [Online] [Searched on December 16, 2002] Internet <URL: http: // www. cisco. com / japanese / warp / public / 3 / jp / product / product / product / ios / prodlit / l2tunes. html>
[Non-Patent Document 11]
"Virtual LANs. IEEE 802.1Q" Institute of Electronic and Electronics Engineers. [Online] [Searched on December 16, 2002] Internet <URL: http: // www. iee802. org / 1 / pages / 802.1Q. html>
[Non-Patent Document 12]
"SSL (Secure Socket Layer) Encrypted Communication" VeriSign Japan K.K. K. [Online] [Searched on December 16, 2002] Internet <URL: http: // www. versign. co. jp / repository / faq / SSL / >>
[0006]
[Problems to be solved by the invention]
However, the conventional system described above has the following problems.
The first problem is that when controlling the user's use of the application, the application right is controlled at the application layer, and when controlling the access of the network, the access control is performed at the network layer. As described above, since each was independently controlled, even if the use of the application was disabled in the application layer, if the application could be used in the network layer, the network layer could be directly operated to operate the application. Is that it may be possible to launch
[0007]
The second problem is that, contrary to the first problem, even when the use is possible in the application layer, if the use is not possible in the network layer, the network access setting in the network layer must be changed. In this case, the application to be executed cannot be used, and the management load of the setting change is very large.
[0008]
An object of the present invention is to solve the above-mentioned problem, to implement access control to a network by updating access control information for network access according to usage right information held by an application usage control side, and to realize an application layer and a network. It is an object of the present invention to provide a technology capable of guaranteeing security of network access by unifying control of layers.
[0009]
[Means for Solving the Problems]
The present invention relates to an integrated access control apparatus for integrating and controlling a use right for an application belonging to an application layer and a network access right belonging to a network layer, wherein the use right for an application belonging to an application layer is controlled separately. The information of both network access rights belonging to the network layer is integrated to manage and control network access.
[0010]
In a network use integrated control system using an integrated access control device according to the present invention, a control device that conventionally controls application use in an application layer and performs access control in a network in a network layer, By converting the usage right information of the application managed in the application layer to the access control information in the network layer through the access integrated control device as the mediation device, and dynamically switching the network settings based on the control information, The main feature is to secure not only security in the application layer but also security in the network layer, and to perform unified control from the application layer to the network layer.
[0011]
An integrated network use control system according to the present invention includes an application use control device having a use right control function for controlling a right to use an application and a use right information storage function for storing use right information, and an access control function for performing network access control. A network access control device having an access control information storage function for storing access control information, an access integrated control device having an access interpretation mediation function for mediating between the application use control device and the network access control device, and an application use control device. Application and a network controlled by the network access control device.
[0012]
The processing in the integrated network use control system of the present invention uses the above-described functions.
(1) Application use control in the application use control device,
(2) Interpretation of application, user, and network states in the integrated access control device, and transmission of changes to the network access control device;
(3) Network access control in the network access control device
Is performed by a series of operations.
[0013]
First, in the use control of the application in the application use control device of (1), information on the application such as job title, organization, age, device, location, service type, and other attributes required for use is used by the use right information storage function. Then, the user information such as the address where the user is currently located is acquired and passed to the usage right control function.
[0014]
Next, in the usage right control function, the status of the user using the application, the user information and application information obtained by monitoring the status of the application used by the user, and the information obtained by the usage right information storage function are stored. Based on this, the application server determines whether the user can use the application by referring to a rule database for determining whether the application can be used. Then, it transmits information such as user information, application information, and a result of determining whether or not use is possible to the integrated access control device.
[0015]
In the process (2), the integrated access control device receives the information on the usage right transmitted from the application use control device, and interprets the received information by the application use control device interpretation means.
[0016]
Then, in order to execute the network access state requested by the application use control device, the access control information corresponding to the current network access control device is transmitted using the access interpretation mediation device and the network access control device interpretation device. It is generated based on the rules of the means itself and transmitted to the network access control device. This allows the network access control device to perform network access control based on the usage right controlled by the application use control device.
[0017]
Next, in the process of (3), the network access control device accesses the access control information transmitted from the integrated access control device to the access control function (for example, communication from a certain address to a certain address. The access control information is updated by acquiring information such as permitting or disallowing communication on a certain port) and storing the information by the access control information storage function. Thereby, the access control information transmitted from the integrated access control device can be reflected on the network access control device.
[0018]
After the access control information is updated, when a request for communication is made, the network access control device performs access control using the access control function. That is, the access control function requests the access control information management function for access control information for the communication (for example, control information by address, control information by port, control information by protocol, etc.), The storage function returns the access control information updated as described above. The access control function performs communication access control according to the response.
[0019]
As described above, according to the integrated network use control system of the present invention, management and control of network access are performed by integrating information of both the use right for the application belonging to the application layer and the network access right belonging to the network layer. Network access control is performed by updating access control information for network access according to the usage right information held by the application usage control side, and the network is controlled by unifying the application layer and network layer. It is possible to guarantee the security of access.
[0020]
BEST MODE FOR CARRYING OUT THE INVENTION
An integrated network use control system according to an embodiment for integrating and controlling a use right for an application belonging to an application layer and a network access right belonging to a network layer will be described below.
[0021]
The network use integrated control system according to the present embodiment is managed in the application layer with respect to a control device that has conventionally performed application use control in the application layer and network access control in the network layer. The use right information of the application in question is converted into access control information in the network layer through an intermediary device, and the network settings are dynamically switched based on the control information. The main feature is to ensure controllability from the application layer to the network layer.
[0022]
An integrated network use control system according to the present embodiment includes an application use control device having a use right control function for controlling a right to use an application and a use right information storage function for storing use right information necessary for the control, and a network access. A network access control device having an access control function for performing control and an access control information storage function for storing access control information necessary for the control, an access having an access interpretation mediation function for mediating between the application use control device and the network access control device It is composed of an application controlled by the integrated control device and the application use control device, and a network controlled by the network access control device.
[0023]
FIG. 1 is a diagram showing a configuration example of the integrated network use control system of the present embodiment. As shown in FIG. 1, the integrated network use control system 100 of the present embodiment includes an application use control device 101, a network access control device 102, and an integrated access control device 103.
[0024]
The application use control device 101 is a device that determines a use right for an application belonging to an application layer and controls use of the application by a user. The network access control device 102 is a device that determines a network access right belonging to a network layer and controls a user's access to a network.
[0025]
The access integrated control device 103 is a device that integrates a use right for an application belonging to an application layer and a network access right belonging to a network layer, and controls access to a network by an application used by a user.
[0026]
FIG. 1 shows an example of the configuration of a network-use integrated control system 100 according to the present embodiment (applications and networks are not shown).
FIG. 8 is a diagram illustrating a configuration example of each device of the present embodiment. As shown in FIG. 8, each device of the present embodiment includes various means corresponding to each function. Hereinafter, each device will be described in detail.
[0027]
FIG. 2 is a diagram illustrating a configuration example of the application use control device 101 of the present embodiment. As shown in FIG. 2, the application use control apparatus 101 according to the present embodiment includes a CPU 201, a memory 202, a magnetic disk device 203, an input device 204, an output device 205, a CD-ROM device 206, and a communication device 207. And
[0028]
The CPU 201 is a device that controls the operation of the entire application use control device 101. The memory 202 is a storage device that loads various processing programs and data for controlling the operation of the entire application use control device 101.
[0029]
The magnetic disk device 203 is a storage device for storing the various processing programs and data. The input device 204 is a device that performs various inputs for performing usage control on an application. The output device 205 is a device that performs various types of output associated with use control for applications.
[0030]
The CD-ROM device 206 is a device for reading the contents of a CD-ROM in which the various processing programs are recorded. The communication device 207 transmits and receives a request related to an application from a user when executing the usage right control function, and transmits and receives a request regarding application information and user information to and from another device. Communication means for transmitting / receiving user information such as a user name and a user attribute, or application information such as an application name and an application attribute to / from a component of the usage right control function.
[0031]
Further, the application use control device 101 includes a user state monitoring unit 211, an application state monitoring unit 212, an application use availability determination unit 213, a user information storage unit 214, and an application information storage unit 215.
[0032]
The user status monitoring unit 211 is a unit that monitors the status of the user making the application use request, such as the location of the user making the request. The application status monitoring unit 212 is a unit that monitors the status of the application used by the user, such as the operation status of the application and the location where the application is operating.
[0033]
The application availability judging means 213 is based on a plurality of pieces of information such as user and application names and attributes which can be obtained from the user information and application information obtained by the monitoring, and the user and application obtained from the user information storing means 214 and the application information storing means 215. This is a means for determining whether the user can use the application and using the communication device 207 to transmit the user information, the application information, and the use availability determination result to the integrated access control device 103.
[0034]
The user information storage unit 214 is a unit for storing information about the user such as a user name, a user ID, a user responsibility, and a place where the user is currently located. The application information storage unit 215 is a unit that stores information about the application such as an application name, a function provided by the application, a place where the application is currently operating, and a list of users who can use the application.
[0035]
A program for causing the application usage control device 101 to function as the user status monitoring unit 211, the application status monitoring unit 212, the application availability determination unit 213, the user information storage unit 214, and the application information storage unit 215 is recorded on a CD-ROM or the like. After being recorded on a medium and stored on a magnetic disk or the like, it is assumed to be loaded into a memory and executed. The recording medium for recording the program may be a recording medium other than the CD-ROM. Further, the program may be installed from the recording medium to the information processing apparatus and used, or the recording medium may be accessed through a network to use the program.
[0036]
The application use control device 101 in FIG. 2 is a device that mainly determines application availability in an application layer, and has a use right control function and a use right information storage function.
[0037]
As shown in FIG. 2, the use right control function of the application use control apparatus 101 is composed of a user state monitor 211, an application state monitor 212, and an application use availability determination unit 213. Further, the usage right information storage function is used by the application usage control device 101 to determine whether or not the application can be used or to monitor the user and the application, such as the attributes of users who can use the application and a list of users who can use the application. This is a function of storing information, and is composed of a user information storage unit 214 and an application information storage unit 215. Note that the transmission / reception processing in the above function is performed using the communication device 207.
[0038]
In FIG. 2, the application use control device 101 manages information of a plurality of applications at one place, but this information may be distributed for each application.
[0039]
FIG. 3 is a diagram illustrating a configuration example of the network access control device 102 of the present embodiment. As shown in FIG. 3, the network access control device 102 of the present embodiment includes a CPU 301, a memory 302, a magnetic disk device 303, an input device 304, an output device 305, a CD-ROM device 306, and a communication device 307. And
[0040]
The CPU 301 is a device that controls the operation of the entire network access control device 102. The memory 302 is a storage device that loads various processing programs and data for controlling the operation of the entire network access control device 102.
[0041]
The magnetic disk device 303 is a storage device that stores the various processing programs and data. The input device 304 is a device that performs various inputs for controlling access to the network. The output device 305 is a device that performs various types of output accompanying access control to the network.
[0042]
The CD-ROM device 306 is a device for reading the contents of a CD-ROM in which the various processing programs are recorded. The communication device 307 is a communication unit that transmits and receives information held in the network access information storage unit 313 to and from another device.
[0043]
Further, the network access control device 102 includes a network access availability determination unit 311, a network status monitoring unit 312, and a network access information storage unit 313.
[0044]
The network access permission / non-permission determining unit 311 refers to the access control information updated by the information received from the integrated access control device 103, and determines access to the network based on a plurality of conditions such as an address, a port, and a protocol permitted to access by communication. This is a means for determining whether or not it is possible.
[0045]
The network status monitoring unit 312 is a unit that monitors the status of communication in the network, such as which address is currently communicating from which address, and which port is currently communicating. The network access information storage means 313 includes access information such as which address can be accessed from which address, port access information such as which port is permitted to access, and communication using which protocol. This is means for storing access control information necessary for network access control, such as access information of a protocol such as a communication protocol, such as processing for transmitting access control information to the integrated access control device 103 using the communication device 307, Is a means for storing the access control information received from the integrated access control device 103 in the network access control device 102 and updating the access control information.
[0046]
A program for causing the network access control device 102 to function as the network access availability determination unit 311, the network state monitoring unit 312, and the network access information storage unit 313 is recorded on a recording medium such as a CD-ROM and stored on a magnetic disk or the like. Later, it is loaded into the memory and executed. The recording medium for recording the program may be a recording medium other than the CD-ROM. Further, the program may be installed from the recording medium to the information processing apparatus and used, or the recording medium may be accessed through a network to use the program.
[0047]
The network access control device 102 in FIG. 3 is a device that mainly performs access control of communication in a network layer, and has an access control function and an access control information storage function.
[0048]
As shown in FIG. 3, the access control function of the network access control device 102 includes a network access availability determination unit 311 for determining whether network access is possible and a network status monitoring unit 312 for monitoring the status of the network. The access control information storage function is a function for storing information necessary for controlling the access control function, and is configured by a network access information storage unit 313. Note that the transmission / reception processing in the above function is performed using the communication device 307.
[0049]
FIG. 4 is a diagram illustrating a configuration example of the integrated access control apparatus 103 according to the present embodiment. As shown in FIG. 4, the integrated access control device 103 of the present embodiment includes a CPU 401, a memory 402, a magnetic disk device 403, an input device 404, an output device 405, a CD-ROM device 406, and a communication device 407. And
[0050]
The CPU 401 is a device that controls the operation of the entire access integrated control device 103. The memory 402 is a storage device for loading various processing programs and data for controlling the operation of the entire access integrated control device 103.
[0051]
The magnetic disk device 403 is a storage device that stores the various processing programs and data. The input device 404 is a device that performs various inputs for performing access control that integrates the right to use the application and the right to access the network.
[0052]
The output device 405 is a device that performs various outputs according to the access control. The CD-ROM device 406 is a device for reading the contents of a CD-ROM in which the various processing programs are recorded. The communication device 407 is a communication unit that communicates with the application use control device 101 and the network access control device 102.
[0053]
Further, the access integrated control device 103 includes an application use control device interpretation unit 411, a network access control device interpretation unit 412, and an access interpretation mediation unit 413.
[0054]
The application use control device interpreting unit 411 is a unit that interprets the content of the use control for the application in the application use control device 101 based on the user information and the application information received from the application use control device 101 using the communication device 407. is there.
[0055]
The network access control device interpreting means 412 is a means for interpreting the contents of the network access control by the network access control device 102 based on the access control information received from the network access control device 102 using the communication device 407.
[0056]
The access interpretation mediation unit 413 generates access control information for performing network access control requested by the application use control device 101, based on the contents of use control and the contents of network access control for the interpreted application. , Transmitting the generated access control information to the network access control device 102 using the communication device 407.
[0057]
A program for causing the integrated access control device 103 to function as the application use control device interpretation means 411, the network access control device interpretation means 412, and the access interpretation mediation means 413 is recorded on a recording medium such as a CD-ROM and stored on a magnetic disk or the like. After that, it is loaded into the memory and executed. The recording medium for recording the program may be a recording medium other than the CD-ROM. Further, the program may be installed from the recording medium to the information processing apparatus and used, or the recording medium may be accessed through a network to use the program.
[0058]
The access integrated control device 103 shown in FIG. 4 is a device newly provided according to the present invention. The access integrated control device 103 mainly stores the access control information held by the network access control device 102 based on the usage right information of the application usage control device 101. Perform the update operation.
[0059]
The access integrated control device 103 has an access interpretation mediation function, and the access interpretation mediation function includes an application use control device interpretation device 411, a network access control device interpretation device 412, and an access interpretation mediation device 413. Note that the transmission / reception processing in the above function is performed using the communication device 407.
[0060]
The application use control device interpreting unit 411 uses the communication device 407 to send user information (for example, a user name, a user attribute, an address of an information processing device currently used by the user) and application information (for example, Application name, a service name provided by the application, an address of an information processing apparatus on which the application is operating, and the like). It interprets whether the request is made to the access integrated control device 103 in a proper state. It is assumed that this means holds a database such as an application usage information format for each application usage control device 101 for interpretation.
[0061]
The network access control device interpreting means 412 uses the communication device 407 to send network information (for example, communication address information, communication port information, communication protocol information, (Eg, address information that blocks communication), and interprets the state of the network based on the acquired network information. It is assumed that this means holds a database such as an access control information format for each network access control device 102 in order to perform the interpretation.
[0062]
The access interpretation mediation unit 413 is configured to determine what kind of change the network access control device based on the state of the application or user interpreted by the application use control device interpretation unit 411 and the state of the network interpreted by the network access control device interpretation unit 412. It is determined whether to make the change to the access control information storage function of the network access control apparatus 102. In this means, it is assumed that a rule for judging what kind of change is to be held (this rule is, for example, a specific address when a request from a specific user from a specific place is made. May be permitted. ").
[0063]
In this way, by interpreting the state of each of the application, the user, and the network, using the access interpretation mediation unit 413 to determine the content of the change in the access control information, and actually transmitting the information to the network access control apparatus 102, the network access control is performed. Dynamic access control in the device 102 becomes possible.
[0064]
The processing in the network use integrated control system 100 of the present embodiment uses the functions described above.
(1) Application use control in the application use control device 101
(2) Interpretation of application, user, and network states in the integrated access control device 103 and transmission of changes to the network access control device 102
(3) Network access control in the network access control device 102
Is performed by a series of operations. Hereinafter, a series of these operations will be described.
[0065]
(1) Application use control in the application use control device 101
FIG. 5 is a diagram illustrating an example of a control sequence of the application use control device 101 of the present embodiment. FIG. 5 illustrates an example of a sequence of application use control in the application use control device 101. It is assumed that the usage right information regarding the user application is stored in advance by the application information storage unit 215 of the usage right information storage function.
[0066]
In response to an information request from the usage right control function, the usage right information storage function uses the usage right information regarding the application (for example, the job title, organization, age, equipment, location, service type, and other attributes necessary for use). Is acquired from the application information storage unit 215, and user information (for example, the address where the user is currently located) is acquired from the user information storage unit 214 and returned to the usage right control function.
[0067]
Next, the use right / non-use judgment unit 213 of the use right control function is used to judge whether the user's application is usable. At this time, information of the user status monitoring means 211 (for example, from which address the user intends to use the application, which application is currently used, etc.), information of the application status monitoring means 212 (Eg, whether the application is currently operable, at which address the application is running, etc.), information obtained from the usage right information storage function (eg, what attributes the user needs to use the application, What is the function provided by the application?)
[0068]
With reference to these information and the rule database for application availability determination of the application availability determination unit 213, the availability determination for the user application is performed. Thereafter, information such as user information and application information is transmitted to the integrated access control device 103.
[0069]
(2) Interpretation of application, user, and network states in the integrated access control device 103 and transmission of changes to the network access control device 102
FIG. 7 is a diagram showing a control sequence of the integrated access control apparatus 103 of the present embodiment. FIG. 7 illustrates an example of a control sequence of the access integrated control device 103 that updates control information of the network access control device 102 based on control information of the application use control device 101 and maintains consistency of the control information between the two. ing.
[0070]
The application usage control device 101 uses the usage right control function to obtain information on the usage right (for example, the result of the application availability determination unit 213, the status information of the application monitored by the application status monitoring unit 212, and the user status monitoring unit 211 Status information of the user who is performing the communication) is transmitted to the access integrated control apparatus 103 using the communication apparatus 207.
[0071]
The access integrated control device 103 receives the information on the usage right transmitted from the application use control device 101 by the communication device 407, and interprets the received information by the application use control device interpretation means 411.
[0072]
Then, in order to execute the network access state requested by the application use control device 101, the access control mediation device 413 and the network access control device interpretation device 412 are used to change the access control information corresponding to the current network access control device 102. , Based on the rules of the access interpretation mediation means 413 itself.
[0073]
The access integrated control device 103 transmits the generated access control information to the network access control device 102 using the communication device 407. This allows the network access control device 102 to perform network access control based on the usage right information controlled by the application use control device 101.
[0074]
(3) Network access control in the network access control device 102
FIG. 6 is a diagram illustrating an example of a control sequence of the network access control apparatus 102 according to the present embodiment. FIG. 6 illustrates an example of a network access control sequence in the network access control apparatus 102.
[0075]
The network access control device 102 performs access control using an access control function. When there is a request for a certain communication, the access control function provides the access control information management function with access control information for the communication (eg, control information at an address, control information at a port, control information at a protocol, etc.). Request, and the access control information storage function replies to the access control information. The access control function performs communication access control according to this response. This basic operation is performed after the above (2) is performed in the same manner as before.
[0076]
The access control information transmitted to the access control function by the integrated access control device 103 of (2) (for example, communication from a certain address to a certain address is permitted, communication using a certain protocol is permitted, and communication using a certain port is And the communication device 307 obtains the information.
[0077]
The access control function transmits the acquired information to the access control information storage function using the network access permission / non-permission determining unit 311. The access control information storage function stores the transmitted information by the network access information storage unit 313 and updates the access control information. Thus, the access control information transmitted from the integrated access control device 103 can be reflected on the network access control device 102.
[0078]
Next, in the integrated network use control system 100 of the present embodiment, a description will be given of a processing procedure of each device when integrating and controlling the use right for the application belonging to the application layer and the network access right belonging to the network layer.
[0079]
FIG. 9 is a flowchart showing a processing procedure of the application use control device 101 of the present embodiment. In step 901, the application use control device 101 checks whether the communication device 207 has received an application use request from the information processing device used by the user. Proceed to step 902.
[0080]
In step 902, the user status monitoring means 211 reads the source address added to the header of the received application use request and obtains the network address assigned to the information processing device of the user making the request. Then, the obtained address is stored in the user information in the magnetic disk device 203 by the user information storage unit 214 as information indicating the current location of the user.
[0081]
In step 903, the application status monitoring unit 212 accesses the information processing apparatus on which the application is running in response to the received application usage request and confirms whether the application is running. Thereafter, the address of the accessed information processing apparatus is stored in the application information in the magnetic disk device 203 by the application information storage unit 215 as information indicating a location where the application is currently operating. It is assumed that which information processing apparatus each application runs on is determined in advance.
[0082]
In step 904, the application availability determination unit 213 accesses the magnetic disk device 203 through the user information storage unit 214 and, for the user who has made the application use request, information indicating the attribute of the user or information indicating the current location of the user For example, information about the user is read from the magnetic disk device 203.
[0083]
In step 905, the application use availability determination unit 213 accesses the magnetic disk device 203 through the application information storage unit 215, and determines, for the application for which the use request has been made according to the application use request, the user who is required to use the application. The application information indicating the usage conditions of the application such as the attribute and the location where the application is currently operating is read from the magnetic disk device 203.
[0084]
In step 906, the application use availability determination unit 213 compares the read user information with the application information, and checks whether information such as the attribute of the user satisfies the use condition of the application. The availability of the user is determined, and the determination result is stored in the memory 202.
[0085]
In step 907, the application availability determination unit 213 indicates the read user information including the information indicating the current location of the user, the application information including the information of the location where the application is currently operating, and the result of the determination. A request is transmitted to the integrated access control device 103 by the communication device 207 via the communication device 207, and the integrated access control device 103 is requested to execute access control to the network according to the result of the availability determination performed by the application use control device 101. I do.
[0086]
FIG. 10 is a flowchart illustrating a processing procedure of the integrated access control apparatus 103 according to the present embodiment. In step 1001, the access integrated control apparatus 103 requests the execution of access control in the network layer in accordance with the result of determination of use in the application layer as the execution request of the user information, the application information, and the application use held in the application use control apparatus 101. It is checked whether or not the result of the availability determination performed by the control device 101 has been received by the communication device 407. If the request has been received, the process proceeds to step 1002.
[0087]
In step 1002, the application use control device interpreting unit 411 refers to the application use information format indicating the format of the information used in the application use control device 101 for the received user information, application information, and the use availability determination result. It reads out and interprets the content of the usage control by the application usage control device 101 for the application.
[0088]
At this time, the user information and the application information received from the application use control device 101 are interpreted, and the address of the information processing device used by the user and the address of the information processing device on which the application is running are read out to the memory 402. Hold.
[0089]
For example, user information and application information received from the application use control device 101 include information such as “USER-running: 192.168.0.1” and “AP1 running on 192.168.0.2”. In this case, the information is interpreted and the IP (Internet Protocol) address “192.168.0.1” of the information processing apparatus used by the user and the IP address “192” of the information processing apparatus on which the application is running are used. .168.0.2 "and store it in the memory 402.
[0090]
In step 1003, the network access control device interpreting unit 412 requests the network access control device 102 to transmit access control information using the communication device 407.
[0091]
FIG. 11 is a flowchart illustrating a processing procedure of the access control information transmission / reception processing of the network access control apparatus 102 of the present embodiment. In step 1101, the network access control apparatus 102 checks whether a transmission request for access control information has been received from the integrated access control apparatus 103 via the communication apparatus 307. If the transmission request has been received, the network access control apparatus 102 determines in step 1102 Proceed to.
[0092]
In step 1102, the network access control device 102 uses the network access information storage unit 313 to access information such as which address can be accessed from which address, and which port can be accessed. Access control information required for network access control, such as access information and access information of a protocol such as which protocol is permitted, is read. In step 1103, the read access control information is read using the communication device 307. It is transmitted to the access integrated control device 103.
[0093]
In step 1003 of FIG. 10, the network access control device interpreting means 412 of the access integrated control device 103 receives the access control information transmitted from the network access control device 102, and formats the information used by the network access control device 102. The access control information is read out with reference to the access control information format indicating, and the contents of the network access control in the network access control device 102 are interpreted.
[0094]
At this time, it is determined in step 1002 whether communication from the user address stored in the memory 402 to the application address is permitted by the network access control device 102.
[0095]
For example, when the access control information received from the network access control apparatus 102 is “if (source: 192.168.0.1) then (Allow 192.168.0.4)”, the address “ After interpreting that only the communication from “192.168.0.1” to the address “192.168.0.4” is permitted, the IP address of the information processing apparatus used by the user stored in the memory 402 is stored. "192.168.0.1" and the IP address "192.168.0.2" of the information processing apparatus on which the application is operating, and the user's address "192.168.0.1" Communication to the address “192.168.0.2” is permitted by the network access control device 102. It determined as those that are not.
[0096]
In step 1004, the access interpretation mediation unit 413 compares the content of the usage control for the interpreted application with the content of the network access control, and contradicts between the content of the usage control for the application and the content of the network access control. It is determined whether or not there is a conflict.
[0097]
In other words, the result of the use determination by the application use control device 101 received in step 1001 permits the use of the application by the user, and the communication from the user's address to the application address is performed by the network access control device 102. Or the result of the availability determination in the application use control device 101 indicates that the user is not permitted to use the application, and communication from the user's address to the application address is performed by the network access control device. In any of the cases permitted in step 102, it is determined that the contradiction has occurred.
[0098]
In step 1006, the access interpretation mediation unit 413 generates access control information for permitting communication from the user's address to the application's address in accordance with the rule information held by the integrated access control device 103.
[0099]
That is, the application address is interpreted by the application use control unit interpreting unit 411, and the user address and the application address are extracted from the information held in the memory 402, and are extracted according to the format used by the network access control unit 102. Access control information in which those addresses are set is generated. For example, the user address “192.168.0.1” and the application address “192.168.0.2” are extracted, and “if (source: 192.168.0.1) then (Allow 192. 168.0.2) ”and the like.
[0100]
On the other hand, in step 1007, access control information for interrupting communication from the user address to the application address is generated. This is the control information that instructs the deletion of the access control information that permits the communication from the user's address to the application's address, but generates the access control information for interrupting the communication. Is also good.
[0101]
In step 1008, the access interpretation mediation unit 413 transmits the generated access control information to the network access control device 102 using the communication device 407, and instructs the network access control device 102 to update the access control information.
[0102]
In step 1104 of FIG. 11, the network access control apparatus 102 checks whether an update instruction for access control information has been received from the access integrated control apparatus 103 via the communication apparatus 307, and if the update instruction has been received, Goes to step 1105.
[0103]
In step 1105, the network access control device 102 stores the access control information received as the update instruction in the magnetic disk device 303 by the network access information storage unit 313, and updates the access control information. In step 1106, a response indicating that the update of the access control information has been completed is generated and transmitted to the integrated access control device 103 using the communication device 307.
[0104]
In step 1009 of FIG. 10, the access interpretation mediation unit 413 of the access integrated control apparatus 103 checks whether a response to the update instruction of the access control information has been received from the network access control apparatus 102, and when the response has been received. Go to step 1010.
[0105]
In step 1010, the access interpretation mediation unit 413 generates a response indicating that the network access control has been performed according to the result of the use determination by the application use control device 101, and transmits the response to the application use control device 101 by the communication device 407. I do.
[0106]
In step 908 of FIG. 9, the application use availability determination unit 213 of the application use control device 101 checks whether a response to the network access control request according to the use availability determination result has been received from the access integrated control device 103, and the response If it is received, the process proceeds to step 909.
[0107]
In step 909, the application availability determination unit 213 refers to the availability determination result stored in the memory 202 in step 906 to check whether the use of the user for the application is permitted. If yes, go to step 910; otherwise, go to step 911.
[0108]
In step 910, the application use availability determination unit 213 generates a response indicating that the use of the requested application is permitted, and transmits the response to the information processing apparatus on the user side that transmitted the use request. Then, a response indicating that the use of the requested application is not permitted is generated and transmitted to the information processing apparatus on the user side that has transmitted the use request.
[0109]
When the use of the application that has made the use request is permitted, the information processing device on the user side communicates with the information processing device on which the application is operating via the network access control device 102.
[0110]
FIG. 12 is a flowchart illustrating a processing procedure of an access control process in the network access control device 102 of the present embodiment. In step 1201, the network status monitoring unit 312 of the network access control device 102 monitors the network communication status and determines whether a communication request from the information processing device on the user side to the information processing device running the application is received. And if the communication request has been received, the process proceeds to step 1202.
[0111]
In step 1202, the network access availability determination unit 311 reads out the access control information updated by the information received from the integrated access control device 103 by the network access information storage unit 313.
[0112]
In step 1203, the address of the communication request received in step 1201 is compared with a plurality of conditions such as the address, port, protocol, and the like, which are permitted in the access by communication and indicated in the access control information read in step 1202. It is determined whether the information processing device on the user side can access the network. If it is determined that communication by the information processing device on the user side is permitted, the process proceeds to step 1204, and the communication is permitted. If it is determined that there is not, the process proceeds to step 1205.
[0113]
In step 1204, the network access availability determination means 311 sends the data received together with the communication request in step 1201 to the destination address indicated in the header, while in step 1205, the received data is Discard and cut off the communication.
[0114]
As described above, in the network use integrated control system 100 according to the present embodiment, the use right information including the user information and the application information of the application use control device 101 and the use availability determination result, and the network access control information of the network access control device Network access management and control are performed by integrating both pieces of access right information consisting of the following. Therefore, by updating the access control information for network access according to the usage right information held by the application usage control side, the network is updated. By controlling access to the application layer and integrally controlling the application layer and the network layer, it is possible to guarantee the security of network access.
[0115]
Next, a specific processing example in the integrated network use control system 100 of the present embodiment will be described. First, the prerequisites necessary for explaining this processing example are shown below (<> is a brief explanation of the conditions). Note that the AP within the following conditions is an abbreviation of an application.
It is assumed that the application use control device 101 has the following application information and user information in this processing example.
[0116]
■ Application use control device 101
-Information possessed by the usage right information storage function
-Application information storage means 215
"If (USER-Attr: President or Chief) then (use AP1, AP2)"
<If the user has the attribute of President or Chief, AP1 and AP2 can be used>
"If (USER-Attr: Staff) then (use AP3)"
<If the user has the stuff attribute, AP3 can be used>
"AP1 running on 192.168.0.2"
<AP1 is operating on address 192.168.0.2>
"AP2 running on 192.168.0.3"
"AP3 running on 192.168.0.4"
-User information storage means 214
"USER-NAME: USER-X"
"USER-ID: user00000000001"
"USER-Attr: Chief"
"USER-running: 192.168.0.1"
[0117]
As described above, in this processing example, the application information storage unit 215 of the application use control apparatus 101 stores “if (USER-Attr: President or Chief) then (use AP1, AP2)” as information indicating the use condition of the application. "If (USER-Attr: Staff) then (use AP3)" is stored, and these pieces of information can use AP1 and AP2 of the application when the user has the attribute of “President” or “Chief”. , And that the user can use the application AP3 when the user has the attribute of Staff.
[0118]
Also, “AP1 running on 192.168.0.2” or the like is stored as information indicating the location where the application is running, and this is the information processing device where the application AP1 has the address 192.168.0.2. It is operating on the above.
[0119]
Further, the user information storage unit 214 of the application use control apparatus 101 stores “USER-NAME: USER-X”, “USER-ID: user00000000001”, “USER-Attr: Chief”, and “USER-running: 192. 168.0.1 ", the user attribute of the user" USER-X "whose user ID is" user0000000001 "is" Chief ", and the address is" 192.168.0.1 ". "Is being accessed from the information processing apparatus.
It is assumed that the network access control device 102 has the following access control information and user information in this processing example.
[0120]
■ Network access control device 102
-Information possessed by the access control information storage function
-Network access information storage means 313
-"If (source: 192.168.0.1) then (Allow 192.168.0.4)"
<If the communication request source address is 192.168.0.1, communication to 192.168.0.4 is permitted>
[0121]
As described above, in this processing example, the network access information storage unit 313 of the network access control apparatus 102 stores “if (source: 192.168.0.1) then as access control information for controlling access to the network. (Allow 192.168.0.4), and the access control information indicates that when a communication request is made to the network access control apparatus 102, the communication request source address is “192.168. .0.1 "indicates that communication to the address" 192.168.0.4 "is permitted.
[0122]
Then, the access integrated control device 103 in this processing example performs the following information for interpreting the request from the application use control device 101 and the information for interpreting the state of the network access control by the network access control device 102. It is assumed that the information has information and rule information for changing access control information for the network.
[0123]
■ Integrated access control device 103
-Information possessed by the access interpretation mediation function
-Application use control device interpretation means 411
"USER-running = current user location"
"USER-Attr = user attribute"
"USER-ID = user ID"
"USER-NAME = user's name"
"Running on X = where the application is running"
"If if (X) then (Y) = X then Y is available"
-Network access control device interpreting means 412
"If (source X) then (Allow Y) = allow access to Y if request source is X"
-Access interpretation mediation means 413
"Rule 1. Extract [location where application is running] and [location of current user] from application information obtained from application usage control device"
“The location where the application is running” acquired by rule 2.1 is A, the location of the current user is B, and the network access control device [allows access to Y if the request source is X]. X = B and Y = A. "
[0124]
As described above, in this processing example, the application use control device interpretation means 411 of the access integrated control device 103 uses “USER-running = current user location” as format information for interpreting a request from the application use control device 101. "USER-Attr = user attribute", "USER-ID = user ID", "USER-NAME = user name", "running on X = where the application is running", "if (X ) Then (Y) = X, then Y can be used. "When the user information and the application information from the application use control device 101 are received,“ USER ”in the information is stored. -Running " In the same manner, the portion following “USER-Attr” is the attribute of the user, the portion following “USER-ID” is the user ID, and the portion following “USER-NAME”. Indicates that the part following "running on X" is to be interpreted as the address of the information processing apparatus on which the application is currently operating, and "if (X) then (Y)" is to be interpreted as the use condition of the application. .
[0125]
Further, the network access control device interpreting means 412 of the access integrated control device 103 uses “if (source X) then (Allow Y) = request source” as format information for interpreting the state of network access control by the network access control device 102. If access control information is received from the network access control apparatus 102, this information includes “if (source X) then (Allow Y)” when the access control information is received from the network access control apparatus 102. )) Is interpreted as if the control of permitting communication to the address Y is performed by the network access control device 102 if the request source address is X.
[0126]
Further, the access interpretation mediation unit 413 of the access integrated control apparatus 103 includes "rule 1." and "rule 2 .." as rule information for changing access control information for the network when permitting the user to use the application. The information is obtained by extracting the address of the information processing apparatus on which the application is running and the address of the information processing apparatus used by the user from the application information acquired from the application use control apparatus 101, This indicates that the access control information is created by setting the application address to the user address Y in X of the access control information “if (source X) then (Allow Y)” of the access control apparatus 102.
[0127]
Hereinafter, in the integrated network use control system 100 of the present embodiment, specific processing contents when the above-described processing (1) to (3) are performed under the preconditions will be described.
First, processing contents when (1) application use control by the application use control device 101 and (3) network access control by the network access control device 102 are performed under the preconditions will be described.
[0128]
(1) Example of application use control in application use control device 101
When a user having a user name of USER-X tries to use AP1, the application use control device 101 having the above-mentioned user information and use right information on the application transmits the application information in the application information storage means 215 in order to use AP1. Based on the information on the first line, it is determined that the attribute “USER-Attr” needs to be “President” or “Chief”. The use right control function compares the information (USER-Attr: Chief) in the user information storage means 214 under this condition. As a result, the application use control apparatus 101 has confirmed that USER-X has the user attribute of Chief, and permits USER-X to use AP1.
[0129]
Then, using the communication device 207, the access integrated control device 103 is used to determine whether or not the access is possible (in this example, it is possible) and the status of the application monitored by the application status monitoring unit 212 (AP1 is 192.168. 0.2) and the user status monitoring means 211 (in this example, USER-X is currently at 192.168.0.1).
[0130]
(3) Example of network access control in network access control device 102
When the USER-X attempts to communicate from the address 192.168.0.1 to the address 192.168.0.2, the network access control device 102 uses the network access information storage means in the access control information storage function. The information of 313 is confirmed.
The access control information storage function confirms that only 192.168.0.4 is permitted to communicate from the address 192.168.0.1. Thereby, the network access control device 102 cuts off the communication from the address 192.168.0.1.
[0131]
As described above, when the control of (1) and (3) is performed independently, and the use of AP1 is permitted in (1), the AP1 is operating in (3) 192.168. 0.2 is blocked by the network access control device 102, so that the use of the AP1 becomes impossible.
[0132]
Next, under the preconditions described above, after the use control of the application in the application use control device 101 in (1), the state interpretation of the application use control device 101 and the network access control device 102 in the access integrated control device 103 in (2) The processing content when changing the access control information will be described.
[0133]
(2) Example of interpretation of state of application use control apparatus 101 and network access control apparatus 102 and change of access control information in integrated access control apparatus 103
As described above, when the controls of (1) and (3) are performed independently of each other, even if the use of AP1 is permitted in (1), the AP1 operates in (3) 192.168. Since the network access control device 102 cuts off the communication for 0.2, it is impossible to use the AP1.
[0134]
Here, the integrated access control device 103 acquires the application information and the user information from the application use control device 101, and from there, [the location where the application is running] (192.168.0.2 in this example) and [ Current user location] (192.168.0.1 in this example).
[0135]
Based on the extracted address information, the integrated access control apparatus 103 stores “if (source: 192.168.0.1) then (Allow 192.168.0.2)” in the access control information storage function of the network access control apparatus 102. Is added. This allows USER-X to reach the address where AP1 is operating. Therefore, the USER-X can use the AP1 that could not be used when the controls (1) and (3) were operating independently.
[0136]
As described above, according to the integrated network use control system of the present embodiment, management and control of network access are performed by integrating information of both the use right for the application belonging to the application layer and the network access right belonging to the network layer. Therefore, the access control information for network access is updated according to the usage right information held by the application usage control side, thereby performing access control on the network, and integrally controlling the application layer and the network layer. It is possible to guarantee the security of network access.
[0137]
As described above, the invention made by the inventor has been specifically described based on the embodiment. However, the present invention is not limited to the embodiment, and can be variously modified without departing from the gist thereof. Of course.
[0138]
【The invention's effect】
As described above, the present invention has the following effects.
The first effect is that when the setting is inconsistent between the use right control function and the access control function in the application use control device and the network access control device, the inconsistency is resolved by performing the setting conversion using the integrated access control device. That is what you can do. This can eliminate the injustice of launching an application via the network layer, despite the fact that use in the application layer is prohibited, and if the use right is acquired in the application layer, the use in the network layer will be restricted. It becomes possible.
The second effect is that when the setting related to the application use is changed in the application use control device, the changed information is reflected on the network access control device through the integrated access control device, so that the usage right management and the access management are consistently performed. It can be implemented.
[Brief description of the drawings]
FIG. 1 is a diagram illustrating a configuration example of a network-based integrated control system according to an embodiment;
FIG. 2 is a diagram illustrating a configuration example of an application use control device 101 according to the present embodiment.
FIG. 3 is a diagram illustrating a configuration example of a network access control device 102 according to the present embodiment.
FIG. 4 is a diagram illustrating a configuration example of an integrated access control device 103 according to the present embodiment.
FIG. 5 is a diagram illustrating an example of a control sequence of the application use control apparatus 101 according to the embodiment.
FIG. 6 is a diagram illustrating an example of a control sequence of the network access control apparatus 102 according to the present embodiment.
FIG. 7 is a diagram showing a control sequence of the integrated access control apparatus 103 of the embodiment.
FIG. 8 is a diagram illustrating a configuration example of each device of the present embodiment.
FIG. 9 is a flowchart illustrating a processing procedure of the application use control device 101 according to the present embodiment.
FIG. 10 is a flowchart illustrating a processing procedure of the integrated access control apparatus 103 according to the present embodiment.
FIG. 11 is a flowchart illustrating a processing procedure of access control information transmission / reception processing of the network access control apparatus 102 according to the present embodiment.
FIG. 12 is a flowchart illustrating a processing procedure of an access control process in the network access control apparatus 102 according to the present embodiment.
[Explanation of symbols]
100: Network integrated control system, 101: Application use control device, 102: Network access control device, 103: Access integrated control device, 201: CPU, 202: Memory, 203: Magnetic disk device, 204: Input device, 205: Output device, 206: CD-ROM device, 207: Communication device, 211: User status monitoring unit, 212: Application status monitoring unit, 213: Application availability determination unit, 214: User information storage unit, 215: Application information storage unit Reference numerals 301, CPU, 302, memory, 303, magnetic disk device, 304, input device, 305, output device, 306, CD-ROM device, 307, communication device, 311, network access availability determination means, 312, network status monitor Means, 313: Network access information storage means, 401: CPU, 402: Memory, 403: Magnetic disk device, 404: Input device, 405: Output device, 406: CD-ROM device, 407: Communication device, 411: Application use Control device interpreting means, 412 ... Network access control device interpreting means, 413 ... Access interpretation mediating means.

Claims (12)

An access integrated control method for integrating and controlling a use right for an application belonging to an application layer and a network access right belonging to a network layer,
Interpreting, based on the user information and the application information received from the application use control device using the communication means, the content of the use control for the application in the application use control device;
Interpreting the contents of the network access control in the network access control device based on the access control information received from the network access control device using the communication means;
Based on the content of the usage control and the content of the network access control for the interpreted application, generate access control information for performing the network access control requested by the application usage control device, and perform network access using the communication unit. Transmitting to the control device and instructing the network access control device to update the access control information. An access integrated control method for integrating and controlling a use right for an application belonging to an application layer and a network access right belonging to a network layer,
Monitoring the status of the user using the application; monitoring the status of the application used by the user; and, based on the user information and the application information including the information acquired by the monitoring, the user corresponding to the application. Determining the availability of, transmitting the user information and application information from the application use control device to the access integrated control device using a communication means,
Based on the transmitted user information and application information, interpreting the contents of the use control for the application in the application use control device,
Transmitting access control information from the network access control device to the integrated access control device using communication means, and interpreting the contents of the network access control in the network access control device based on the transmitted access control information When,
Based on the content of the usage control for the interpreted application and the content of the network access control, generate access control information for performing the network access control requested by the application usage control device, and use the communication unit to perform network access. Transmitting the generated access control information to the control device and instructing the network access control device to update the access control information;
Storing the transmitted access control information and updating the access control information in the network access control device. When monitoring the status of a user who uses the application, the address assigned to the information processing device of the user is stored in the user information as information indicating the current location of the user, and is used by the user. When monitoring the status of an application, the address of the information processing device on which the application is operating is stored in the application information as information indicating a location where the application is currently operating. 2. The integrated access control method described in 2. When interpreting the content of the usage control for the application in the application usage control device, the address of the information processing device used by the user and the operation of the application are determined based on the user information and the application information received from the application usage control device. When reading the address of the information processing device, and interpreting the content of the network access control in the network access control device, communication from the read user address to the application address is performed by the network access control device. The access integrated control method according to any one of claims 1 to 3, wherein it is determined whether or not the access is permitted. When the content of the usage control for the interpreted application and the content of the network access control are inconsistent, the communication from the information processing device used by the user to the information processing device running the application is permitted or blocked. The access control method according to any one of claims 1 to 4, wherein access control information for performing the access control is generated and transmitted to a network access control device. An integrated access control device for integrating and controlling a use right for an application belonging to an application layer and a network access right belonging to a network layer,
Based on the user information and the application information received from the application use control device using the communication means, application use control device interpretation means for interpreting the contents of the use control for the application in the application use control device,
Network access control device interpreting means for interpreting the contents of network access control in the network access control device based on the access control information received from the network access control device using the communication means,
Based on the content of the usage control for the interpreted application and the content of the network access control, generate access control information for performing the network access control requested by the application usage control device, and use the communication unit to perform network access. An integrated access control device, comprising: an access interpretation mediation unit for transmitting to a control device. The application use control device interpreting means interprets information used by the user from user information and application information received from the application use control device when interpreting the contents of use control for an application in the application use control device. Reads the address of the processing device and the address of the information processing device on which the application is operating,
The network access control device interpretation means, when interpreting the contents of the network access control in the network access control device, communication from the user address read by the application use control device interpretation means to the application address. 7. The integrated access control device according to claim 6, wherein it is determined whether or not the access is permitted by the network access control device. The access interpretation mediation unit is configured to, when the content of the use control for the interpreted application and the content of the network access control contradict each other, change the information processing device used by the user to the information processing device on which the application is operating. 8. The integrated access control device according to claim 6, wherein access control information for permitting or blocking communication to the network is generated and transmitted to the network access control device. . An integrated network use control system for integrating and controlling a use right for an application belonging to an application layer and a network access right belonging to a network layer,
User status monitoring means for monitoring the status of the user using the application; application status monitoring means for monitoring the status of the application used by the user; and user information and application information including the information obtained by the monitoring. An application use control apparatus comprising: an application use control unit that determines whether the user can use the application for the application and transmits the user information and the application information to the integrated access control apparatus using a communication unit.
Application use control device interpreting means for interpreting the content of use control for an application in the application use control device based on user information and application information received from the application use control device using the communication means, and a network using the communication means Network access control device interpreting means for interpreting the contents of network access control in the network access control device based on the access control information received from the access control device, and contents of use control and network access control for the interpreted application Based on the above, access control information for performing network access control required by the application use control device is generated, and the generated access control information is transmitted to the network access control device using communication means. And access integrated control system and an access interpretation mediating means for transmitting Seth control information,
A network access control device including network access information storage means for storing the access control information received from the integrated access control device using the communication means and updating the access control information in the network access control device. Network use integrated control system. When monitoring the status of a user who uses the application, the user status monitoring means stores, in the user information, an address assigned to the information processing device of the user as information indicating a current location of the user. Things,
The application status monitoring means, when monitoring the status of an application used by a user, sets an address of an information processing apparatus on which the application is operating as application information as information indicating a location where the application is currently operating. 10. The integrated network use control system according to claim 9, wherein the system is stored in a network. The application use control device interpreting means interprets information used by the user from user information and application information received from the application use control device when interpreting the contents of use control for an application in the application use control device. Reads the address of the processing device and the address of the information processing device on which the application is operating,
The network access control device interpreting means, when interpreting the content of the network access control in the network access control device, communication from the user address read by the application use control device interpretation means to the application address. 11. The integrated network use control system according to claim 9, wherein it is determined whether or not the access is permitted by the network access control device. The access interpretation mediation unit is configured to, when the content of the use control for the interpreted application and the content of the network access control contradict each other, change the information processing device used by the user to the information processing device on which the application is operating. 12. Network use according to any one of claims 9 to 11, wherein access control information for permitting or blocking communication to the network is generated and transmitted to the network access control device. Integrated control system.

Images