SYSTEM OF CONTROLLING ACCESS OF USER TO RESOURCE AND METHOD THEREOF
A system that controls access to a resource by a user stores policy information for determining a condition with respect to an operation of the resource. The system acquires a first access request that shows a predetermined operation to a first resource by the user from a user terminal. The system acquires user state information that shows a current state of the user from the user terminal. The system determines a condition in case of access by the user based on the user state information. The system determines whether to authorize the first access request based on the policy information and the condition in case of access.
1 . A system that controls access to a resource by a user, the system comprising:
one or more processors; and
one or more storage devices that store policy information for determining a condition with respect to an operation of the resource,
wherein the one or more processors
acquire a first access request that shows a predetermined operation to a first resource by the user from a user terminal,
acquire user state information that shows a current state of the user from the user terminal,
determine a condition in case of access by the user based on the user state information, and
determine whether to authorize the first access request based on the policy information and the condition in case of the access.
2 . The system according to claim 1 ,
wherein the user state information shows at least one of a posture and a dynamic of the user.
3 . The system according to claim 1 ,
wherein the one or more processors
acquire information of the user from the user terminal, and
determine the condition in case of access by the user based on the user state information and information of the user terminal.
4 . The system according to claim 1 ,
wherein the one or more processors
acquire information of a network to which the user terminal is connected, and
determine the condition in case of access by the user based on the user state information and information of the network.
5 . The system according to claim 1 ,
wherein the first access request further includes a designated parameter of the predetermined operation, and
the policy information shows a parameter that can designate the predetermined operation of the first resource.
6 . The system according to claim 1 ,
wherein a condition to the first access request shown by the policy information includes a role of the user, and
the one or more processors determine a role of the user based on information of the user acquired from the user terminal in an authentication process of the user.
7 . The system according to claim 1 ,
wherein the one or more processors
execute user authentication of the user before determining whether to authorize the first access request, and
determine whether to authorize the access request from the user after the first access request without the user authentication of the user.
8 . The system according to claim 1 ,
wherein the resource is a data storage area of a storage system.
9 . The system according to claim 1 ,
wherein the user terminal generates the user state information based on data measured by a sensor.
10 . A method of controlling access to a resource by a user by a system, the method comprising:
storing policy information for determining a condition with respect to an operation of the resource by the system;
acquiring a first access request that shows a predetermined operation to a first resource by the user from a user terminal by the system;
acquiring user state information that shows a current state of the user from the user terminal by the system;
determining a condition in case of access by the user based on the user state information by the system; and
determining whether to authorize the first access request based on the policy information and the condition in case of the access by the system.