Access control system and access control method

1. An access control system which controls user access to a resource, comprising:

at least one processor; and

at least one storage device which stores information defining conditions under which each user is allowed to perform resource access,

wherein the at least one processor acquires a first access request indicating an operation for a first resource in a target system by a first user,

determines based on the information whether or not the first access request is permitted,

acquires a result of an additional permission/disapproval determination of the first access request in response to the disapproval determination of the first access request, and

grants execution authority of the first access request by the first user according to the result of the additional permission/disapproval determination indicating permission.

2. The access control system according to claim 1 , wherein the at least one processor presents to an administrator a request for the additional permission/disapproval determination of the first access request in response to the disapproval determination of the first access request, and

receives the result of the additional permission/disapproval determination from the administrator.

3. The access control system according to claim 2 , wherein the at least one processor presents the administrator with information on at least one of a state of the target system and a state of the first user, together with the request for the additional permission/disapproval determination.

4. The access control system according to claim 2 ,

wherein the at least one storage device stores auxiliary information,

wherein the auxiliary information includes: at least one information of a state of the target system and a state of one or more users including the first user; and information of a criterion for the additional permission/disapproval determination, and

wherein at least one processor presents the administrator with at least one information which meets the criterion for the additional permission/disapproval determination.

5. The access control system according to claim 1 ,

wherein the at least one storage device stores auxiliary information,

wherein the auxiliary information includes: at least one information of a state of the target system and a state of one or more users including the first user; and information of a criterion for the additional permission/disapproval determination, and

wherein the at least one processor executes the additional permission/disapproval determination of the first access request, based on the auxiliary information.

6. The access control system according to claim 2 ,

wherein the at least one storage device stores resource access management information which defines one or more resource access groups, and

wherein the at least one processor acquires information on incidental resource access included in the same resource access group as the first access request from the resource access management information,

presents the information on the incidental resource access to the administrator, and

acquires a determination result of permission/disapproval of the incidental resource access from the administrator.

7. The access control system according to claim 4 ,

wherein the at least one storage device stores resource access management information which defines one or more resource access groups, and

wherein the at least one processor acquires information on incidental resource access included in the same resource access group as the first access request from the resource access management information, and

executes the permission/disapproval determination of the incidental resource access, based on the auxiliary information.

8. An access control method which controls user access to a resource, comprising the steps of:

causing a system to acquire a first access request indicating an operation for a first resource in a target system by a first user,

causing the system to determine whether or not the first access request is permitted on the basis of information defining conditions under which each user is allowed to perform resource access,

causing the system to acquire a result of an additional permission/disapproval determination of the first access request in response to the disapproval determination of the first access request, and

causing the system to grant execution authority of the first access request by the first user according to the result of the additional permission/disapproval determination indicating permission.

9. The access control method according to claim 8 ,

wherein the system presents to the administrator a request for the additional permission/disapproval determination of the first access request in response to the disapproval determination of the first access request, and

wherein the system receives the result of the additional permission/disapproval determination from the administrator.

10. The access control method according to claim 9 ,

wherein the system presents information on at least one of a state of the target system and a state of the first user to the administrator together with the request for the additional permission/disapproval determination.

11. The access control method according to claim 9 ,

wherein the system refers to the auxiliary information, and the auxiliary information includes: information on at least one of the state of the target system and the state of one or more users including the first user; and information on the criterion for the additional permission/disapproval determination, and

wherein the system presents to the administrator the at least one information which satisfies the criterion for the additional permission/disapproval determination.

12. The access control method according to claim 8 ,

wherein the system refers to auxiliary information, and the auxiliary information includes: information on at least one of the state of the target system and the state of one or more users including the first user; and information on the criterion for the additional permission/disapproval determination, and

wherein the system executes an additional permission/disapproval determination of the first access request, based on the auxiliary information.

13. The access control method according to claim 9 ,

wherein the system acquires information on incidental resource access included in the same resource access group as the first access request from the resource access management information which defines one or more resource access groups,

wherein the system presents information on the incidental resource access to the administrator, and

wherein the system acquires the determination result of permission/disapproval of the incidental resource access from the administrator.

14. The access control method according to claim 11 ,

wherein the system acquires information on incidental resource access included in the same resource access group as the first access request from the resource access management information which defines one or more resource access groups, and

wherein the system executes the permission/disapproval determination of the incidental resource access based on the auxiliary information.