Access control apparatus, control method, and non-transitory computer readable medium
An access control apparatus ( 2000 ) acquires a request ( 20 ) for access to data stored in a first storage apparatus 30 . The access control apparatus ( 2000 ) acquires privilege information ( 70 ) from a blockchain storage ( 40 ). The privilege information ( 70 ) represents access privilege pertaining to access to the first storage apparatus ( 30 ). The access control apparatus ( 2000 ) determines whether requested access is within a range of the access privilege of a target entity ( 10 ) being a subject of the request ( 20 ), by using the privilege information ( 70 ) of the target entity ( 10 ). When it is determined that the access is within the range of the access privilege of the target entity ( 10 ), the access control apparatus ( 2000 ) executes the access.
1. An access control apparatus, comprising:
at least one memory storing instructions; and
at least one processor configured to execute the instructions to perform operations comprising:
acquiring a request from a first user for access to data of a second user stored in a data storage area of a first storage apparatus allocated for the second user, the request including first authentication information used for authentication of the second user;
acquiring privilege information from a second storage apparatus, the privilege information representing access privilege of the first user with respect to the data stored in the data storage area allocated for the second user;
determining whether the access is within a range of the access privilege of the first user, by using the privilege information of the first user;
executing the access to read second authentication information of the second user stored in the data storage area allocated for the second user, based on the access being determined to be within the range;
performing authentication of the second user by comparing the first authentication information with the second authentication information;
acquiring results of procedures after the authentication based on the authentication being successful; and
storing, in the data storage area allocated for the second user, the results of procedures in association with identification information of the first user, wherein
the second storage apparatus is a blockchain storage.
2. The access control apparatus according to claim 1 , wherein
the first authentication information and the second authentication information comprise biometric information.
3. The access control apparatus according to claim 1 , wherein
the operations further comprise outputting a notification representing a result of the authentication, and
the notification does not include the first authentication information.
4. A control method to be executed by a computer, comprising:
acquiring a request from a first user for access to data of a second user stored in a data storage area of a first storage apparatus allocated for the second user, the request including first authentication information used for authentication of the second user;
acquiring privilege information from a second storage apparatus, the privilege information representing access privilege of the first user with respect to the data stored in the data storage area allocated for the second user;
determining whether the access is within a range of the access privilege of the first user, by using the privilege information of the first user;
executing the access to read second authentication information of the second user stored in the data storage area allocated for the second user, based on the access being determined to be within the range;
performing authentication of the second user by comparing the first authentication information with the second authentication information;
acquiring results of procedures after the authentication based on the authentication being successful; and
storing, in the data storage area allocated for the second user, the results of procedures in association with identification information of the first user, wherein
the second storage apparatus is a blockchain storage.
5. The control method according to claim 4 , wherein
the first authentication information and the second authentication information comprise biometric information.
6. The control method according to claim 4 , further comprising,
outputting a notification representing a result of the authentication, wherein
the notification does not include authentication information acquired from the first storage apparatus.
7. A non-transitory computer readable medium storing a program causing a computer to execute operations, comprising:
acquiring a request from a first user for access to data of a second user stored in a data storage area of a first storage apparatus allocated for the second user, the request including first authentication information used for authentication of the second user;
acquiring, privilege information from a second storage apparatus, the privilege information representing access privilege of the first user with respect to the data stored in the data storage area allocated for the second user;
determining whether the access is within a range of the access privilege of the first user, by using the privilege information of the first user;
executing the access to read second authentication information of the second user stored in the data storage area allocated for the second user, based on the access being determined to be within the range;
performing authentication of the second user by comparing the first authentication information with the second authentication information;
acquiring results of procedures after the authentication based on the authentication being successful; and
storing, in the data storage area allocated for the second user, the results of procedures in association with identification information of the first user, wherein
the second storage apparatus is a blockchain storage.