JP2007114816A - Automatic screen access controller, control method therefor and control program therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an automatic screen access controller, method and program, capable of facilitating access control in screen units. <P>SOLUTION: A computer system 1 is connected with: an authentication device 2 performing authentication processing of a user; a display means 3 displaying a screen accessible by the user; an input means 7 designating the user; and a screen access right database 4 storing access control information. The computer system 1 has an access right control means 5 performing the access control of a screen on the basis of the screen access right DB 4 and authenticator information of the user from the authentication device 2. The access right control means 5 has: an authenticator information acquisition processing part 51 acquiring the authenticator information; an access right information acquisition processing part 52 acquiring information about an access right on the basis of the authenticator information; an access right decision processing part 53 deciding the access right of the screen from the information about the access right and the authenticator information; a screen management processing part 54 managing an availability state of the screen; and an access log storage processing part 55 storing history log information. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a screen automatic access control apparatus that controls a screen access right of a user's computer system, a control method thereof, and a control program thereof.

  Normally, in a computer system, access control is performed by defining the correspondence of resources that can be accessed to users / groups / applications that have been authenticated in advance in ACL (Access Control List) and controlling access authority. The technique of performing is generally used.

  For example, in the user authentication system proposed in Patent Document 1, when a user uses a plurality of applications, the user ID (Identification) and password are used for authentication, and the effort for updating the authentication information is reduced. It is also to eliminate. In this system, both personnel information and authority information set for each application are used, and it is possible to control access to a plurality of applications and data in units of users by logging in only once. .

JP 2005-107984 A

  However, when performing access control for each user on a screen unique to an application as in Patent Document 1, it is necessary to incorporate a function for performing screen access control based on access control information in the application. Further, in order to improve the security by adding such a screen access control function to an existing application, it is necessary to change the existing application.

  An object of the present invention is to provide a screen automatic access control device, a control method thereof, and a control program thereof that can easily perform access control in units of screens without implementing an access control function as a partial function of an application. .

  In the screen automatic access control device of the present invention, an authentication device that performs user authentication processing on a computer system, a display unit that displays a user-accessible screen, an input unit that specifies a user, A screen access right database (hereinafter abbreviated as DB) in which access control information is stored is provided. In order to perform access control of the user's screen, the computer system has access right control means, and by this access right control means, user authenticator information from the authentication device and the screen access right database. Based on the above, screen access control is implemented.

  If the automatic screen access control device is configured as in the present invention, it is easy to control access rights in units of screens using user authentication information by the authentication device and access control information in the screen access right database without complication. It can be carried out. Moreover, even if the existing application does not have a function of performing screen access control based on user authentication, access control can be performed without changing the existing application, and security can be improved. .

  Also, according to the log information visualization method and visualization program of the present invention, it is possible to easily perform access right control of a screen of a computer system.

  The screen automatic access control device of the present invention includes an authentication device that performs user authentication processing, a display unit that displays a user-accessible screen, an input unit that specifies a user, and an access to a computer system. And a screen access right database in which control information is stored. The computer system performs screen access control based on user authenticator information from the authentication device and the screen access right database. Access right control means is provided.

  An automatic screen access control apparatus according to an embodiment of the present invention is shown in FIG. The screen automatic access control device records in the computer system 1 the authentication device 2 that performs user authentication processing, the display means 3 that displays the screen status that can be accessed and used, and the screen access right for each user. The stored screen access right DB 4 is connected to each other and can be used.

  As the authentication device 2, an authentication unit for biometrics authentication such as vein authentication or fingerprint authentication, or a device that uniquely identifies and authenticates a user of the computer system 1 by a user ID and password input verification or the like can be used.

  The screen access right DB 4 is configured as a local DB of the computer system 1 and used, or the screen access right DB 4 is centrally managed by using a server, and corresponds to user authentication information according to a request from the computer system 1. Screen access right information is managed by a return method.

  For example, the administrator of the computer system 1 assigns a screen access right to be subject to access control to any application screen 1 to screen 5 in advance for each of the users A and B registered in the authentication device 2 as shown in FIG. Whether or not it can be used is set and registered in the screen access right DB 4. The screen access right DB 4 is normally used externally or as a storage means in the computer system 1, but when centrally managing the server configuration, the server system administrator performs the same setting registration operation as described above. .

  For registration in the screen access right DB 4, for example, a screen ID is associated with each user by an interface function such as a normally used screen access right registration tool. Access permission or prohibition is set for the associated screen and registered in the screen access right DB 4.

The screen access right DB 4 is provided with a mechanism that can not be tampered with normally used encryption or the like, and the screen access right registration tool is operable only when authenticated as an administrator of the computer system 1. It can also be used as a configuration for improving security.
The computer system 1 includes an access right control means 5 for performing access control and an access log DB 6 for recording and accumulating operation history information. The access right control means 5 allows the user from the authentication device 2 to Screen access control is performed based on the certifier information and the screen access right DB 4.

  The access right control means 5 of the computer system 1 is accessed from the authenticator information acquisition processing unit 51 for acquiring the authenticator information of the user from the authentication device 2 and the screen access right DB 4 based on the authenticator information. An access right information acquisition processing unit 52 that performs a right information acquisition process, and an access right determination processing unit 53 that performs a screen access right determination process from the acquired authenticator information and access right information. .

  In addition, the computer system 1 is provided with a screen management processing unit 54 for managing the availability of the screen of the display means 3 based on the determination of the access right in the access right determination processing unit 53, and the screen An access log accumulation processing unit 55 that records and accumulates history such as registration operations in the access right DB 4 as log information is also provided. Furthermore, the authenticator change processing unit 56 can be provided as needed for the case where the authentication user continues to use it on behalf of another person while the computer system 1 is activated.

  The access control processing of the automatic access control means 5 is performed according to a processing procedure as shown in FIG. When the user starts up the computer system 1 and is authenticated by the authentication device 2, the certifier information acquisition process of the certifier is executed (step S11), and the screen access right is based on the acquired certifier information. The screen access right information is acquired from the DB 4 (step S12).

Next, the application screen enters an active detection standby state until the screen becomes active by an operation of the application (step S13). When the active state of the application screen is detected, the authenticator refers to the screen access right DB 4 to display the screen. The access right determination processing unit 53 checks whether or not there is an access right to the access (step S14), and performs an access right determination process (step S15).
In the above determination process (step S15), if the access right is Yes, it can be used as it is, and if the access right is not allowed, the screen management processing unit 54 works to use the active screen. Then, the operation processing for making the state inaccessible is terminated (step S16).

  If it is determined in the access right determination process (step S15) that there is an access right, for example, for user A, permission settings for application screens 1 to 5 are previously stored in the screen access right DB 4 as shown in FIG. When registered, when the application screen is operated after the user A is authenticated, the application screen 1 to the screen 5 are all operable as shown in FIG. 3A.

For user B, if the permission settings for application screen 2 to screen 4 are registered in advance in screen access right DB 4 as shown in FIG. 2, application screen operation after user B is authenticated In some cases, as shown in FIG. 3 (b), only the screen 4 to the screen 4 can be operated. The screen that can be operated can be browsed and operated as it is.
If there is no change of the certifier and the user continues to use No as it is, the screen is re-executed from the active detection standby state (step S13). If the current certifier stops using and terminates the operation and the computer system 1 in the activated state is used by another person using the certifier change process (step S17), the certifier information is used. Is re-executed from the acquisition process (step S11), and the screen access right is controlled.

  The processing procedure of the automatic screen access control means 5 described with reference to the above-described flowchart is to implement the automatic screen access control easily by creating and using this entire processing procedure as a collective automatic screen access control program. be able to.

  The certifier information and the operation information of the screen to be operated are recorded and accumulated in the access log DB 6 together with the certifier information as the operation history by the operation of the access log accumulation processing unit 5E. Accumulate information on whether or not the operation was performed.

It is a block diagram which shows the screen automatic access control apparatus which is one Example of this invention. It is a figure which shows the example of the screen access right database in the screen automatic access control apparatus of this invention. It is a display screen example of the screen access right in the screen automatic access control apparatus of this invention. It is a flowchart which shows the procedure of the screen automatic access control in this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Computer system, 2 ... Authentication apparatus, 3 ... Display means, 4 ... Screen access right database, 5 ... Automatic access right control means, 5A ... Authentication person information acquisition process part, 6 ... Access log database, 5B ... Access right information Acquisition processing unit, 5C ... access right determination processing unit, 5D ... screen management processing unit, 5E ... access log accumulation processing unit.

Claims (5)

An authentication device that performs user authentication processing in a computer system, a display unit that displays a user-accessible screen, an input unit that specifies a user, and a screen access right database that stores access control information The computer system has access right control means for performing screen access control based on user authenticator information from the authentication device and the screen access right database,
A screen automatic access control device characterized by being configured as described above. 2. The access right control unit according to claim 1, wherein the access right control means includes an authenticator information acquisition processing unit for acquiring user authenticator information from the authentication device, and access right information from the screen access right DB 4 based on the authenticator information. An access right information acquisition processing unit for performing the acquisition processing;
An access right determination processing unit that performs a screen access right determination process from the acquired authenticator information and access right information; and a screen management processing unit that manages whether the screen of the display unit 3 is usable. A screen automatic access control device characterized by comprising.   3. The automatic screen according to claim 1, wherein the access right control means comprises a access log storage processing unit for recording and storing operation history information of an access screen together with certifier information in an access log database. Access control device.   Authenticator information of the certifier authenticated by the authentication device is acquired, screen access right information is acquired from the screen access right DB 4 based on the acquired certifier information, and the application screen active in the screen display means is activated. When the status is detected, the screen access right database is referenced to determine whether the certifier has access rights to the screen, and the access right judgment process is performed. If there is access right in the judgment process, the screen can be used. A screen automatic access control method characterized in that if the user does not have an access right, the screen is used and processing that cannot be referred to is performed. Procedure for acquiring certifier information of the certifier authenticated by the authentication device, a procedure for acquiring the screen access right information from the screen access right DB 4 based on the acquired certifier information, and an application in the screen display means When an active state of a screen is detected, a procedure for performing access right determination processing by referring to the screen access right database to determine whether the certifier has access right to the screen, and when there is access right in the determination processing Is a screen automatic access control program that performs processing for making a screen usable, and executes the processing procedure in a state in which the screen cannot be used and referred to when there is no access right.

Images