Information processing apparatus, information processing method, and computer program

1. An information processing apparatus, comprising:

processing circuitry configured to:

detect an access request for target data;

determine necessity of checking information indicating whether access to the target data is permitted, based on position information on the target data, and on a data range to be checked,

wherein if the position information is included in the data range to be checked, the processing circuitry is configured to determine to perform the check.

2. The information processing apparatus according to claim 1 ,

wherein the processing circuitry is configured to detect activation of a first environment, and acquire information indicating a data range referable from the first environment, and

wherein the data range to be checked is a first data range referable from the first environment.

3. The information processing apparatus according to claim 2 ,

wherein the first environment is activated by a first process,

the access request for the target data is generated by a second process, and

if the second process has a descendant relationship with the first process, the processing circuitry is configured to determine to perform the check.

4. The information processing apparatus according to claim 1 ,

wherein the data range to be checked is a second data range referable from a third process relating to a security function.

5. The information processing apparatus according to claim 4 ,

wherein the access request for the target data is generated by a second process, and

if the second process has a descendant relationship with the third process, the processing circuitry is configured to determine to perform the check.

6. The information processing apparatus according to claim 4 ,

wherein the access request for the target data is generated by a second process, and

if the third process is in an environment identical to that of the second process, the processing circuitry is configured to determine to perform the check.

7. The information processing apparatus according to claim 4 ,

wherein the processing circuitry is configured to detect activation of a first environment, and acquire information on a first data range referable from the first environment,

wherein the first environment is activated by a first process, and

the processing circuitry is configured to convert the position information on the target data into a format referable from the third process, based on the information indicating the first data range, if the third process has a descendant relationship with the first process.

8. The information processing apparatus according to claim 7 ,

wherein the check is a process of determining whether the converted position information on the target data has a match in a list that includes position information on the data permitted or denied to be accessed.

9. The information processing apparatus according to claim 7 ,

wherein the position information on the target data is represented by a first path in a hierarchical structure,

the second data range is represented by a second path in the hierarchical structure, and

the processing circuitry is configured to convert the position information on the target data by removing, from the first path, a path part continuously matching between the first path and the second path from a top layer.

10. The information processing apparatus according to claim 2 ,

wherein the access request for the target data is generated by a second process,

the processing circuitry is configured to detect activation of a process in an environment, and generate process-related data that associates the detected process with a fourth process that is a process having activated the environment,

the information processing apparatus comprises a first storage configured to store environment data which associates the fourth process with a data range referable from the environment activated by the fourth process, and

the processing circuitry is configured to identify the fourth process associated with the second process in the process-related data, and adopt, as the first data range, the data range corresponding to the fourth process in the environment data.

11. The information processing apparatus according to claim 2 ,

wherein the access request for the target data is generated by a second process, and

the processing circuitry is configured to:

detect activation of a process in an environment, and generate process-related data that associates the detected process with a data range referable from the environment; and

adopt, as the first data range, a data range associated with the second process in the process-related data.

12. The information processing apparatus according to claim 2 ,

wherein the processing circuitry is configured to detect activation of the first environment in a second environment and acquires information of the first data range, and the information of the first data range indicates the first data range from a viewpoint of the second environment, and

acquire data range information that indicates the first data range, from a viewpoint of a system provided with the second environment, based on the information of the first data range, and information of a third data range referable from the second environment.

13. The information processing apparatus according to claim 2 , further comprising

a second storage configured to store information of the first data range; and

wherein the processing circuitry is configured to examine whether all of a first process having activated the first environment and processes having a descendant relationship with the first process are ended, and remove the information of the first data range from the storage if all of the first process and the processes having a descendant relationship with the first process are ended.

14. The information processing apparatus according to claim 1 , further comprising

a checker circuit configured to perform the check, when the processing circuitry determines to perform the check.

15. The information processing apparatus according to claim 14 ,

wherein the checker circuit is configured to determine whether first information associated with the target data is included in a list of information associated with the data permitted or denied to be accessed.

16. An information processing method performed in a computer, comprising:

detecting, by the computer, an access request for target data, from a process executed on an operation system by a Central Processing Unit (CPU); and

determining, by the computer, necessity of checking information indicating whether access to the target data is permitted, based on position information on the target data, and on a data range to be checked, when the access request is detected,

wherein if the position information is included in the data range to be checked, the processing circuitry is configured to determine to perform the check.

17. A non-transitory computer readable medium having a computer program stored therein which causes a computer to perform processes when executed by the computer, the processes, comprising:

detecting an access request for target data from a process executed on an operating system by a Central Processing Unit (CPU); and

determining necessity of checking information indicating whether access to the target data is permitted, based on position information on the target data, and on a data range to be checked, when the access request is detected,

wherein if the position information is included in the data range to be checked, the processing circuitry is configured to determine to perform the check.