JP2020057429A - Access management method, access management device, and computer program - Google Patents

Abstract

To reduce security risk of an information processing apparatus.SOLUTION: An access management device 16 stores a work condition for a work object device 14 including a log-in ID applied by a user, the work condition being approved by an administrator according to application from the user, in a first storage region. When the access management device 16 receives a log-in request for designating the work object device 14 at a log-in destination, the log-in request satisfying the work condition previously stored in the first storage region, the access management device logs in the work object device 14 using the log-in ID and password which are used for logging in the work object device 14 previously stored in a second storage region, the log-in ID and the password corresponding to the work condition that the log-in request satisfies.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a data processing technique, and more particularly, to a technique for managing user access to an information processing device.

  With the development of network technology, access to computer systems via a network has been widely performed. Password authentication is widely used as an authentication means when a user logs in to a computer system. As measures to enhance the security of password authentication, passwords are forcibly changed after a certain period of time, or login is rejected after a predetermined number of consecutive failed password entries. ing.

  The present applicant proposes a technique in Patent Document 1 below that easily detects unauthorized access without reducing the usability of an authorized user.

JP 2006-004333 A

  In conventional password authentication, it is necessary to disclose to a user the password of an information processing device (hereinafter, also referred to as a “work target device”) with which the user is to perform work. Therefore, a security risk may occur in the work target device. For example, there is a possibility that the password of the work target device is leaked from an authorized user to a malicious third party.

  The present invention has been made in view of such problems, and a main object thereof is to provide a technique for reducing a security risk of an information processing device.

  In order to solve the above-described problem, an access management method according to an aspect of the present invention provides an access management method, wherein an access management device is a login ID for logging in to a work target device, and includes a work target including a login ID applied by a user. Storing, in a first storage area, work conditions permitted by an administrator based on a user's application based on work conditions for the device, and a user requesting a login request including information specifying a work target device to be logged in; And a login request receiving step for receiving a login request that satisfies a work condition pre-stored in the first storage area, and logs in to a work target device of a login destination pre-stored in the second storage area. Login ID and password for the user, and correspond to the login ID specified in the work condition that satisfies the login request. By logging into the work target device login destination using the login ID and password to perform the log step of enabling the work of the user for work device of the login destination, the.

  Another embodiment of the present invention relates to an access management device. This device includes an account holding unit that associates and holds a login ID and a password for logging in to the work target device with respect to a work target device to which the user is to perform work, and a login ID for logging in to the work target device. A condition holding unit that holds a work condition for a work target device that includes a login ID applied by a user and includes a work condition permitted by an administrator based on a user's application; A login request reception unit that receives a login request including information specifying the device from the user, and a login ID that is stored in the account storage unit when a login request that satisfies the work condition stored in the condition storage unit is received. A password that corresponds to the login ID specified in the work conditions that the login request has satisfied By logging into the work target device login destination using the login ID and password, and a login processing unit that allows the user's work for work device of the login destination.

  It is to be noted that any combination of the above-described components and any conversion of the expression of the present invention between a system, a program, a recording medium storing the program, and the like are also effective as embodiments of the present invention.

  According to the present invention, security risks of the information processing device can be reduced.

FIG. 1 is a diagram illustrating a configuration of an information processing system according to an embodiment. FIG. 2 is a block diagram illustrating a functional configuration of the access management device of FIG. 1. 5 is a flowchart illustrating an operation of the access management device. 5 is a flowchart illustrating an operation of the access management device.

  FIG. 1 illustrates a configuration of an information processing system according to an embodiment. The information processing system 100 is a system in a certain company, and includes an operator terminal 10, an administrator terminal 12, work target devices 14a, 14b, and 14c collectively referred to as a work target device 14, and an access target device 14c. The management device 16 is included.

  The operator terminal 10 is a PC that is operated by an operator or a developer of the information processing system 100 that should perform work on the work target device 14 (hereinafter, unified by the operator). The administrator PC 12 is a PC operated by an administrator of the information processing system 100.

  The work target device 14 is a server that is a target of work by an operator of the information processing system 100 (for example, updating a file or adjusting various setting values). For example, it may be a web server, application server, database server, or the like. Further, the software configuration of the work target device 14 is not limited, and may be different between the work target devices 14a to 14c. For example, the OS of the work target device 14a may be UNIX (registered trademark), the OS of the work target device 14b may be Linux (registered trademark), and the OS of the work target device 14c may be Windows (registered trademark). The communication protocol for notifying the command from the operator PC 10 to the work target device 14 is not limited, and may be Telnet, SSH, FTP, RDP, or the like.

  The access management device 16 collectively receives an operator's login request for a plurality of work target devices 14 (the work target devices 14a to 14c in FIG. 1) regardless of the type of the work target device 14, and It is determined whether or not the login has been approved by the administrator. If approved, the access management device 16 logs in to the work target device 14 on behalf of the operator, and relays the command transmitted from the operator PC 10 to the work target device 14. That is, the access management device 16 enables the operator to work on the work target device 14 while increasing the security strength of the work target device 14 by mediating access from the operator PC 10 to the work target device 14.

  FIG. 2 is a block diagram showing a functional configuration of the access management device 16 of FIG. The access management device 16 includes an internal account storage unit 20, an external account storage unit 22, an account update unit 24, a work condition storage unit 26, an application information reception unit 28, an application information notification unit 30, and an approval information reception unit. It includes a unit 32, a connection request receiving unit 34, an authentication processing unit 36, a login request receiving unit 38, a determining unit 40, a login processing unit 42, a command receiving unit 44, and a command transfer unit 46.

  Each block shown in the block diagram in this specification can be realized by hardware, such as a device such as a CPU of a computer, or a mechanical device, and can be realized by software by a computer program or the like. The functional blocks realized by their cooperation are drawn. Therefore, it is understood by those skilled in the art that these functional blocks can be realized in various forms by a combination of hardware and software. For example, each functional block in FIG. 2 may be stored in a recording medium as an access management program and installed in the storage of the access management device 16. Then, when the access management program is activated, the program corresponding to each functional block may be read out to the main memory and executed by the CPU.

  The internal account holding unit 20 defines a predetermined operator ID and password as an account (hereinafter, also referred to as an “internal account”) for permitting the operator to connect to the access management device 16 from the operator PC 10. Are stored in association with each other.

  The external account holding unit 22 serves as an account for permitting connection to the work target device 14 (hereinafter, also referred to as “external account”). And a password). For example, external accounts defined in each of the work target devices 14a to 14c are collectively held. The external account holding unit 22 also holds an account of a privileged user of the work target device 14 as an external account, and holds, for example, a root password and an Administrator password.

  When the login account is changed in the work target device 14, the account update unit 24 detects the fact and stores the changed account in the external account holding unit 22. For example, the work target device 14 periodically changes the login account in the device itself, notifies the access management device 16 of information indicating the changed account, and the work target device 14 in the work target device 14 based on the notification. Account changes may be detected. As a modification, the account updating unit 24 may periodically access the work target device 14 to change the login account, and store the changed account in the external account holding unit 22.

  The work condition holding unit 26 is a storage area for holding a condition for permitting an operator to log in to the work target device 14 (hereinafter, also referred to as “work condition”). The work conditions for each of the devices 14c are collectively held. The work conditions in the present embodiment include the ID of the operator, the work start date and time and the work end date and time for the work target device 14, the host name of the work target device 14, the communication protocol to be used, and the login to the work target device 14. A login ID (for example, root) is included.

  The application information receiving unit 28 receives information (hereinafter, also referred to as “application information”) for applying to the administrator to log in to the work target device 14 from the operator PC 10. This application information includes the same contents as the work conditions described above. That is, it includes the ID of the operator, the work start date and time and the work end date and time, the host name of the work target device 14, the communication protocol to be used, and the login ID used to log in to the work target device 14.

  The application information notification unit 30 transmits the application information received from the operator PC 10 to the administrator PC 12, and allows the administrator to decide whether to approve or reject the application content of the operator. The approval information receiving unit 32 receives, from the administrator PC 12, information indicating whether or not the administrator has approved the application content. When the administrator approves the application content, the approval information receiving unit 32 stores the application content of the operator in the work condition holding unit 26 as a work condition.

  The connection request receiving unit 34 receives a connection request to the access management device 16 from the operator PC 10. In this connection request, an operator account (that is, an internal account) defined in the access management device 16 is specified. The communication protocol between the operator PC 10 and the access management device 16 may be appropriately selected by the operator, and may be, for example, Telnet, SSH, FTP, RDP, or the like.

  The authentication processing unit authenticates the operator. Specifically, it is determined whether or not the operator's account specified in the connection request matches the operator's account held in the internal account holding unit 20. If they match, the connection request receiving unit 34 is notified that the authentication of the operator has succeeded. If the authentication of the operator is successful, the connection request receiving unit 34 establishes a communication session with the operator PC 10 and notifies the operator PC 10 of the successful authentication. When notified of the success of the authentication, the operator PC 10 displays on the display a screen for designating the work target device 14 to be logged in (in other words, the work target device 14 on which the operator performs the work). As a modified example, when the authentication of the operator is successful, the connection request receiving unit 34 may transmit the data of the login destination designation screen to the operator PC 10 and display the data on the operator PC 10.

  The log-in request receiving unit 38 requests information from the operator PC 10 to log in to the specific work target device 14 via the communication session between the operator PC 10 and the access management device 16 established by the connection request receiving unit 34 ( Hereinafter, this is also referred to as a “login request”.) This login request includes information indicating a work target device 14 (hereinafter, also referred to as a “designated device”) as a login destination designated by the operator on the login destination designation screen displayed on the operator PC 10. On the other hand, the account (eg, password) of the designated device is not included in the login request.

  The determination unit 40 determines whether the login request satisfies the work condition stored in the work condition holding unit 26. Specifically, the ID of the operator who is the sender of the login request matches the ID of the operator in the work condition, and the date and time of reception of the login request is in the range from the work start time to the work end date and time in the work condition. If the specified device in the login request matches the connection destination device of the work condition, it is determined that the login request satisfies the work condition.

  When it is determined that the login request satisfies the work condition, the login processing unit 42 uses the designated device account held in the external account holding unit 22 even if the account of the designated device is not included in the login request. Login to the designated device and establish a communication session between the access management device 16 and the designated device. Specifically, an account (a login ID and a password, for example, a root and a root password, which are a login ID and a password, for example, a root and a root) that is a predetermined account in the designated device and is specified in the work condition is transmitted from the external account holding unit 22 get. Then, by using the communication protocol specified by the work condition, a login request specifying the account acquired from the external account holding unit 22 is transmitted to the specified device.

  The command receiving unit 44 receives a command for the designated device from the operator PC 10 via the communication session between the operator PC 10 and the access management device 16 established by the connection request receiving unit 34. The command transfer unit 46 transfers the command received by the command receiving unit 44 to the designated device via the communication session between the access management device 16 and the designated device established by the login processing unit 42.

The operation of the above configuration will be described below.
FIG. 3 is a flowchart showing the operation of the access management device 16. When the application information receiving unit 28 receives the application information transmitted from the operator PC 10 (Y in S10), the application information notification unit 30 transmits the application information to the administrator PC 12 (S12). Upon receiving information from the administrator PC 12 that the application content has been approved (Y in S14), the approval information receiving unit 32 stores the application content in the work condition holding unit 26 as work conditions (S16). If the information that the application content has been approved is not received (N of S14), S16 is skipped. If the application information from the operator PC 10 is not received (N of S10), S12 to S16 are skipped. When detecting that the account has been changed in the work target device 14 (Y in S18), the account update unit 24 acquires the changed account from the work target device 14 and stores it in the external account holding unit 22 (S20). . If an account change in the work target device 14 has not been detected (N in S18), S20 is skipped.

  FIG. 4 is also a flowchart showing the operation of the access management device 16. This figure shows a continuation of the operation in FIG. When the connection request transmitted from the operator PC 10 is received by the connection request receiving unit 34 (Y in S30), the authentication processing unit 36 authenticates the operator based on the connection request. When the authentication of the operator is successful (Y in S32), the connection request receiving unit 34 notifies the operator PC 10 of the fact and displays a login destination designation screen on the operator PC 10 (S34). If the authentication of the operator has failed (N in S32), S34 is skipped, and if no connection request is received from the operator PC 10 (N in S30), S32 and S34 are skipped.

  When the login request reception unit 38 receives the login request transmitted from the operator PC 10 (Y in S36), the determination unit 40 determines whether the login request satisfies the work condition. When the login request satisfies the work condition (Y in S38), the login processing unit 42 acquires an account of the designated device in the login request from the external account holding unit 22 (S40), and logs in to the designated device using the account. (S42).

  The command receiving unit 44 waits until a command is received from the operator PC 10 (N in S44). When the command receiving unit 44 receives the command transmitted from the operator PC 10 (Y in S44), the command transfer unit 46 transmits the command to the work target device 14 (S46). If the command received from the operator PC 10 is an end command (for example, an “exit” command) (Y in S48), the command accepting unit 44 disconnects the communication session with the operator PC 10 and ends the flow of FIG. If the command received from the operator PC 10 is not the end command (N in S48), the process returns to the command waiting state in S44. If the login request does not satisfy the work condition (N in S38), or if the login request is not accepted (N in S36), the subsequent processing is skipped and the flow of this diagram ends.

  According to the information processing system 100 of the present embodiment, the access management device 16 logs in to the work target device 14 on behalf of the operator or the developer. Therefore, the account (especially a password) of the work target device 14 can be kept secret from the operator or the developer, and the security risk of the work target device 14 can be reduced. For example, it is possible to prevent an account from being leaked from an operator or a developer to a malicious third party, and prevent an operator or a developer from accessing the work target device 14 beyond the range approved by the administrator. . According to the information processing system 100, it is possible not only to detect later whether an unauthorized access has been made based on the access log of the work target device 14, but also to prevent the occurrence of an unauthorized access in the first place.

  The login account for the work target device 14 is periodically changed and stored in the external account holding unit 22 of the access management device 16. Thereby, the security risk of the work target device 14 can be further reduced. In addition, the effect of the change of the login account on the work target device 14 is absorbed by the access management device 16 and the operator and the developer are not affected by the change, so that the convenience for the operator and the developer can be improved.

  In addition, since the access management device 16 controls access to the work target device 14 collectively, the work target device 14 does not need to determine individual accounts for a plurality of operators and developers in advance. Also, there is no need to set various access rights for these individual accounts. Therefore, the security risk of the work target device 14 can be reduced without changing the work target device 14.

  The present invention has been described based on the embodiments. This embodiment is an exemplification, and it is understood by those skilled in the art that various modifications can be made to the combination of each component and each processing process, and that such modifications are also within the scope of the present invention. is there. Hereinafter, modified examples will be described.

  A first modification will be described. Although not mentioned in the above embodiment, the command receiving unit 44 monitors whether or not the current date and time has passed the work end date and time defined in the work condition. The communication session with the access management device 16 may be disconnected. Similarly, the command transfer unit 46 monitors whether or not the current date and time has passed the work end date and time of the work condition, and disconnects the communication session between the access management device 16 and the work target device 14 when the current date and time have passed. You may. According to this aspect, after the end time of the work is over, the command from the operator is not transferred to the work target device 14, so that the work by the operator can be permitted within a range approved by the administrator. .

  As another modified example, the command receiving unit 44 may maintain a communication session between the operator PC 10 and the access management device 16 even when the current date and time exceeds the work end date and time of the work condition. Similarly, the command transfer unit 46 may maintain the communication session between the access management device 16 and the work target device 14 even when the current date and time passes the work end date and time of the work condition. Furthermore, the operator may be able to select whether to disconnect or maintain the communication session when the current date and time exceeds the work end date and time of the work condition, and the result of the selection by the operator may be the application information (ie, the work information). Condition). In this case, the command receiving unit 44 and the command transfer unit 46 may determine whether to disconnect or maintain the communication session when the current date and time exceed the work end date and time of the work condition according to the work condition. .

  A second modification will be described. The access management device 16 may further include a log holding unit, a log output unit, and a log search unit. The log holding unit associates the internal account of the operator, the host name of the work target device 14 at the login destination, the login account (external account) to the work target device 14, the command issued to the work target device 14, and the command issue date and time. Keep logs. The log output unit displays the internal account of the operator, the host name of the work target device 14 to be logged in, and the login account to the work target device 14 when the login to the work target device 14 is performed in response to the login request. And keep it as When the command receiving unit 44 receives a command from the operator PC 10, the command, the login information, and the current date and time (that is, the command issue date and time) are stored in the log holding unit in association with each other.

  The log search unit receives a search request in which a search keyword is specified from the administrator PC 12. Then, the log stored in the log holding unit is searched based on the search keyword, and the information of the log hit in the search is transmitted to the administrator PC 12. According to the second modification, since the access management device 16 collectively manages the access logs over the plurality of work target devices 14, the administrator easily obtains the access logs over the plurality of work target devices 14. be able to. For example, by making a search request to the access management device 16 using the ID of a specific operator (a specific internal account) as a search keyword, the specific operator can perform a plurality of tasks without inquiring each work target device 14. The history of accesses to the target device 14 can be efficiently acquired.

  A third modification will be described. The access management device 16 may further include a prohibited command holding unit and a command determination unit. The prohibited command holding unit holds information indicating a predetermined prohibited command as a command to be prohibited from being issued to the work target device 14. The prohibition command may include, for example, a command for changing a user's password (such as a passwd command) or a command for switching a user's account (such as a su command). The command determination unit determines whether the command received from the operator PC 10 matches the prohibited command stored in the prohibited command storage unit. If they do not match, the command determination unit passes the command received from the operator PC 10 to the command transfer unit 46. If they match, the command determination unit suppresses passing the command received from the operator PC 10 to the command transfer unit 46 and discards the command. In this case, the command determination unit may notify the operator PC 10 that the transfer to the work target device 14 has been refused because the command is a prohibited command.

  In the second and third modified examples, a case where encrypted communication is performed between the operator PC 10 and the access management device 16 and between the access management device 16 and the work target device 14 (for example, when the communication is SSH communication). I will add. In this case, the access management device 16 once decrypts the encrypted command received from the operator PC 10, encrypts the decrypted plaintext command again, and sends the encrypted plaintext command to the work target device 14. Therefore, the log output unit of the second modification stores a log indicating a plaintext command in the log holding unit, and the command determination unit of the third modification compares the plaintext command with the prohibited command. As described above, while maintaining the security strength by the encrypted communication on the communication path, the storage of the command and the comparison with the prohibition command can be realized using the plain text command.

  A fourth modification will be described. In the above embodiment, the access management device 16 includes the external account holding unit 22 and the account updating unit 24. As a modified example, an information processing device (herein also referred to as “account management device”) different from the access management device 16 includes an external account holding unit 22 and an account updating unit 24 in place of the access management device 16, and further includes An external account providing unit may be provided. In this case, the login processing unit 42 of the access management device 16 transmits to the account management device a password request specifying the host name of the work target device 14 at the login destination and the login ID of the work target device 14 used for login. . The external account providing unit of the account management device provides the access management device 16 with a password associated with the login ID specified in the password request.

  Any combination of the above-described embodiments and modifications is also useful as an embodiment of the present invention. A new embodiment that is generated by the combination has the effects of the combined embodiment and the modified example.

  It should be understood by those skilled in the art that the functions to be fulfilled by the components described in the claims are realized by each component shown in the embodiment and the modification or a combination thereof.

  Reference Signs List 10 operator PC, 12 administrator PC, 14, 16 access management device, 20 internal account holding unit, 22 external account holding unit, 24 account updating unit, 26 work condition holding unit, 34 connection request receiving unit, 36 authentication processing unit , 38 a login request receiving unit, 40 determining unit, 42 login processing unit, 44 command receiving unit, 46 command transfer unit, 100 information processing system.

Claims (3)

The access control device
By comparing the user's account specified in the connection request to the device transmitted from the user's terminal with the first account previously stored in the first storage area and allowing the user to connect to the device. Authenticating the user,
From the terminal of the user who has been successfully authenticated in the authenticating step, a login request receiving step of receiving a login request including information specifying a work target device on which the user should perform work,
When the login request is received, by logging in to the work target device using a second account for logging in to the work target device stored in advance in a second storage area, A login step that allows the user to work,
Run
The second storage area is a storage area provided in an account management device different from the access management device and the work target device,
The access management device periodically accesses the account management device and periodically changes a password of a second account for logging in to the work target device stored in the second storage area of the account management device. An access management method, further comprising the step of: An access management device capable of communicating with an account management device including a second account holding unit that holds an account for logging in to the work target device predetermined for a work target device on which a user should perform work,
A first account holding unit that holds a first account that is an account that allows a user to connect to the apparatus;
An authentication unit that authenticates the user by checking the first account against the account of the user specified in the connection request to the device transmitted from the user terminal;
From a terminal of a user who has been successfully authenticated by the authentication unit, a login request receiving unit that receives a login request including information specifying the work target device,
When the login request is accepted, a user's work on the work target device is performed by logging in to the work target device using the second account held in the second account holding unit of the account management device. A login processing unit that enables
An account updating unit for periodically accessing the account management device and periodically changing a password of a second account for logging in to the work target device held in the second account holding unit of the account management device; When,
An access management device, comprising: For access control devices,
By comparing the user's account specified in the connection request to the device transmitted from the user's terminal with the first account previously stored in the first storage area and allowing the user to connect to the device. , The ability to authenticate the user,
From the terminal of the user who has been successfully authenticated by the authenticating function, a function of receiving a login request including information specifying a work target device on which the user should perform work,
When the login request is received, by logging in to the work target device using a second account for logging in to the work target device stored in advance in a second storage area, Functions that enable users to work,
To realize
The second storage area is a storage area provided in an account management device different from the access management device and the work target device,
Periodically access the access management device to the account management device, and periodically enter a password of a second account for logging in to the work target device stored in the second storage area of the account management device. A computer program for further realizing the function of changing to.

Images