JP5503500B2 - Access right management device, access right management system, access right management method, and access right management program - Google Patents

Description

  The present invention relates to a technology such as an access right management device for accessing equipment installed in a building, office, factory, etc. while maintaining security.

  Conventionally, management of equipment has been performed within a local network. Even when managing via the Internet, dedicated servers and networks of specific customers have been used, and dedicated systems have been constructed. In recent years, SaaS / cloud services have emerged in which one system is used by many customers.

As a method for managing equipment via the Internet, there is a BACnet / WS standard, and a method for accessing equipment using a tree structure is defined. Further, in order to access the facility equipment safely, it is necessary that an access right is added to the facility equipment and only the right holder can access it.
As a method of adding access rights to individual elements (equipment, files, etc.), with respect to file access rights management, a method of centrally managing access rights for each folder and assigning them to each file is known. (For example, refer to Patent Document 1).

JP 2008-305221 A

  However, as mentioned above, when trying to manage access rights by creating a list of users who can use each equipment, file, and folder, there is a huge number of equipment in one system. Since the devices to be accessed differ depending on the user and the service used by the user, setting the access right by creating a list of users who can use it for each equipment device becomes complicated, There is a problem that the load on the equipment and the amount of network communication increase.

  Accordingly, the present invention has been made in view of the above problems, and an access right management device, an access right management system, an access right management method, and an access right management program that realize the granting of an access right that reduces the load on the system. It is an issue to provide.

In order to solve the above problems, an access right management apparatus according to the present invention is an access right management apparatus that manages an access right that is a right to access a facility device when a user uses a service, and identifies the user. For each set of a user ID to be performed and a service ID for specifying the service, the access authority information associated with the accessible equipment and the input from a client device that exchanges information with the user Based on the user ID and the service ID, the access authority information is used to obtain an accessible equipment list (accessible equipment information) that is a list of the equipment that the user can access in the service. , For the control equipment that controls the equipment, the accessible equipment list (A Requesting control of the equipment present in processes available equipment information), to the client device, an access control unit for displaying the control result of the equipment acquired from the control apparatus, the equipment and the equipment A storage unit storing facility device state history information that associates the state of the device with a history of the state, and the facility device is accessed via a network, or the state of the facility device is recorded A node that is information indicating whether to access the equipment status history information, and a storage unit that stores node type information that associates the equipment with the access control unit. For each piece of equipment that exists in the available equipment information, the node type information is used to acquire the node type and select a location to access. Characterized in that it comprises a Seth controller.
Alternatively, the access right management apparatus according to the present invention is an access right management apparatus that manages an access right that is a right to access a facility device when a user uses a service, and the user ID that identifies the user and the service For each set of service IDs that identify the device, the information is acquired from the storage unit storing the access authority information that associates the accessible equipment and the input from the client device that exchanges information with the user. Based on the user ID and the service ID, the access authority information is used to obtain accessible equipment information that is information on the equipment that the user can access in the service, and the equipment is controlled. Requesting the control equipment to control the equipment existing in the accessible equipment information. An access control unit that displays a control result of the facility device acquired from the control device to a client device, and a tree that indicates a management state in the service configuration of the facility device in order to indicate a route to the facility device There is a first path based on a structure and a second path based on a tree structure indicating a management state of the system configuration of the equipment, and the first path and the second path are classified for each equipment. A storage unit that stores associated route correspondence information, and the access control unit indicates the facility device to the client device using the first route, and On the other hand, the equipment is indicated by replacing the first route with the second route based on the route correspondence information.

  According to the present invention, it is possible to realize an access right that reduces the load on the system.

It is a figure which shows the structure of the access right management apparatus and access right management system which concern on 1st Embodiment of this invention. It is a figure which shows the structure of the memory | storage part of the access right management apparatus of this invention. It is a figure which shows an example of the user authentication information table in the access right management apparatus of this invention. It is a figure which shows an example of the service information table in the access right management apparatus of this invention. It is a figure which shows an example of the service permission table (use authority information) in the access right management apparatus of this invention. It is a figure which shows an example of the node permission table (access authority information) in the access right management apparatus of this invention. It is a figure which shows an example of the node matching table (path | route correspondence information) in the access right management apparatus of this invention. It is a figure which shows an example of the device node information table (node classification information) in the access right management apparatus of this invention. It is a figure which shows an example of the device node state history table (facility apparatus state history information) in the access right management apparatus of this invention. It is a figure which shows an example of the tree structure which shows the management state on the system configuration of equipment. It is a figure which shows an example of the tree structure which shows the management state on the service structure of an installation apparatus. It is a flowchart which shows the operation | movement of the login process of the access right management apparatus of this invention. It is a flowchart which shows the operation | movement of the service access process of the access right management apparatus of this invention. It is a flowchart which shows the operation | movement of the data acquisition process of the access right management apparatus of this invention. It is a flowchart which shows the operation | movement of the data registration process of the access right management apparatus of this invention. It is a figure which shows the structure of the access right management apparatus and access right management system which concern on 2nd Embodiment of this invention.

<First Embodiment>
Hereinafter, a first embodiment of the present invention will be described with reference to FIGS.
[Configuration of Access Rights Management System 100]
As shown in FIG. 1, an access right management system 100 includes a server device (access right management device) 1, a client device 2, a gateway (GW) device 3, a global network 4, a local network 5, and a control device. 31-33 and equipment 41-47 are provided. Hereinafter, an example in which the present invention is applied to an office in a building will be described.
The access right management system 100 is a system for a user to access equipment when using a service. Here, the service refers to entrance / exit management such as door locking, energy management such as air conditioner control, and other equipment management.

  The server device (access right management device) 1 provides a service in response to a request from the client device 2. The server device (access right management device) 1 is connected to the global network 4 and controls the facility devices 41 to 47 via the gateway (GW) device 3 and the control device 33. Here, “control” refers to obtaining state data of the equipment, changing data stored in the equipment, or issuing an operation instruction to the equipment. The internal configuration of the server device (access right management device) 1 will be described later.

The client device 2 receives service from the server device (access right management device) 1. The client device 2 is connected to the global network 4 and receives input from a user or displays data for providing a service from the server device (access right management device) 1. The client device 2 has a GUI (Graphical User Interface) such as a general-purpose browser.
The gateway (GW) device 3 is a communication device that controls the facility devices 41 to 46 via the control devices 31 and 32 in response to a request from the server device (access right management device) 1. A gateway (GW) device 3 is connected to the global network 4 and the local network 5.

The global network 4 is a public network such as the Internet, and connects the server device (access right management device) 1, client device 2, gateway (GW) device 3, and control device 33 to each other.
The local network 5 is a network such as a LAN (Local Area Network) wired in a building or the like, and connects the gateway (GW) device 3 and the control devices 31 and 32 to each other.

The control device 31 is connected to the local network 5 and controls the facility devices 41 to 44. The control device 31 notifies the gateway (GW) device 3 of the state change of the facility devices 41 to 44. Alternatively, in response to a request from the gateway (GW) device 3 such as an operation instruction to the equipment devices 41 to 44 or acquisition of state data, the control device 31 sends an operation instruction or state data to the equipment devices 41 to 44. Acquire.
Similarly, the control device 32 controls the equipment devices 45 and 46.
The control device 33 is connected to the global network 4 and controls the equipment device 47. Unlike the control devices 31 and 32, the control device 33 is a request for operation instructions and status data acquisition from the server device (access right management device) 1, not the gateway (GW) device 3, to the facility device 47. In response to this, an operation instruction to the equipment device 47, acquisition of state data, and the like are performed.

  The facility equipments 41 to 47 include so-called devices and the like in addition to general equipment equipment such as buildings, offices, and factories, and mean objects in the program. For example, the equipment devices 41 to 47 are an electric lock, a card reader, a packaged air conditioner, a camera, and a calculation formula in a program. As described above, the facility devices 41 to 47 are connected to the control devices 31 to 33 according to their standards according to their types. The standard is, for example, DI / DO, RS-485, RS-232C, HTTP, or the like.

Next, the server device (access right management device) 1 will be described.
[Configuration of Server Device (Access Right Management Device) 1]
The server device (access right management device) 1 includes an access control unit 10 that performs data processing, and a storage unit 14 that stores a table for data processing.
The access control unit 10 includes a service access control unit 11, a data access control unit 12, and a device access control unit 13.

The service access control unit 11 receives a service use request from the client device 2 and, according to the combination of the user who is the user of the service and the service to be used, a list of equipment devices that can be used by the user from the storage unit 14 (described later). To obtain an accessible equipment list (accessible equipment information). Here, the accessible equipment list (accessible equipment information) means that when the user uses the service, the status data of the equipment is acquired, the data stored in the equipment is changed, or This is a list of equipment that can issue operation instructions to the equipment.
Further, the service access control unit 11 acquires the control results of the equipment devices 41 to 47 from the data access control unit 12 to be described later, and edits the acquired control results to construct screen data. The screen data is, for example, in HTML (Hyper Text Markup Language) format. This screen data is transmitted to the client device 2 and displayed. Here, the control result refers to an acquisition result of state data of the equipment devices 41 to 47, a change result of data stored in the equipment devices 41 to 47, or an operation instruction result of the equipment devices 41 to 47.
The service access control unit 11 also performs user login processing.

The data access control unit 12 receives a control request for equipment according to the accessible equipment list (accessible equipment information) from the service access control unit 11, and receives the request from the device access control unit 13 or the storage unit 14 described later. The control result of equipment is acquired. This control result is transmitted to the service access control unit 11.
The device access control unit 13 establishes a communication path via the global network 4 in response to a control request for the equipment according to the accessible equipment list (accessible equipment information) from the data access control unit 12 It is. Here, for establishing the communication path, mutual authentication using SSL (Secure Socket Layer) is performed to establish a secure communication path.
The device access control unit 13 acquires a control result of the facility device from the gateway (GW) device 3 or the control device 33. This control result is returned to the data access control unit 12.

The storage unit 14 includes service management data 15 that provides data related to user authentication and service use, device management data 16 that provides data related to device access, and device status that provides data related to device status and history. Data 17. In the present embodiment, the storage unit 14 is a database.
As shown in FIG. 2, the service management data 15 includes a user authentication information table 201, a service information table 301, a service permission table (use authority information) 401, a node permission table (access authority information) 501, and node correspondences. An attachment table (route correspondence information) 601 and a service node tree 1001.

The device management data 16 includes a device node information table (node type information) 701 and a device node tree 901.
The device state data 17 includes a device node state history table (facility equipment state history information) 801.

Next, an example of the various tables described above and a tree structure will be described with reference to FIGS.
As shown in FIG. 3, the user authentication information table 201 is a table for managing users and their authentication information. This user authentication information table 201 includes a user ID 210 and user authentication information 220.
The user ID 210 is an ID for uniquely identifying the user, and is information presented by the user when the user uses the service. The user authentication information 220 is data necessary for the identity verification of the user presenting the user ID 210, and a password hash value and biometric authentication information are recorded.

As shown in FIG. 4, the service information table 301 is a table for managing services and information necessary for providing the services. The service information table 301 includes a service ID 310 and service information 320.
The service ID 310 is an ID for uniquely identifying a service used from a number of services. The service information 320 is information necessary for providing the service specified by the service ID 310, and in this embodiment, the service URL (Uniform Resource Locator) is recorded.

The service permission table (use authority information) 401 is a table for managing the use authority of a service in accordance with a user / service pair, as shown in FIG. The service permission table (use authority information) 401 includes a user ID 410, a service ID 420, and a service permission (access right type) 430.
The user ID 410 is the same as the user ID 210 recorded in the user authentication information table 201. The service ID 420 is the same as the service ID 310 recorded in the service information table 301. The service permission (access right type) 430 is information for determining whether or not the user indicated by the user ID can use the service indicated by the service ID.

The service permission (access right type) 430 is, for example, “read”, “write”, or “read, write”. “Read” is an authority to view information on the equipment using the service indicated by the service ID, “write” is an authority to give an operation instruction to the equipment using the service indicated by the service ID, and “read, write "Indicates the authority to browse the information on the equipment and to perform an operation instruction using the service indicated by the service ID.
For example, “read” can be used to know what state the air conditioner is currently in. “Write” can turn on the air conditioner. In “write”, the calculation formula and parameters for processing the status data of the equipment device can be changed on the server device (access right management device) 1. Further, in “write”, the operation parameters of the equipment devices 41 to 47 can be changed such that, for example, an alarm is sounded when the door is open for 10 seconds on the equipment devices 41 to 47.

As shown in FIG. 6, the node permission table (access authority information) 501 is a table that manages the access authority of the equipment according to the combination of the user and the service. The node permission table (access authority information) 501 includes a user ID 510, a service ID 520, and a service node path (first route) 530.
The user ID 510 is the same as the user ID 210 recorded in the user authentication information table 201. Service ID 520 is the same as service ID 310 recorded in service information table 301. The service node path (first route) 530 records facility devices that can be accessed by the user indicated by the user ID when using the service indicated by the service ID.

The service node path (first route) 530 records a character string representation of the path to each node of the service node tree 1001. In the character string expression, “*” can be written, and all nodes below the node where “*” is written can be shown.
Further, a list of users and services specified from the node permission table (access authority information) 501 is an accessible equipment list (accessible equipment information).

The node association table (route correspondence information) 601 is a table that associates a service node path (first route) 610 and a device node path (second route) 620 as shown in FIG.
A service node path (first route) 610 records a character string representation of a path to each node of the service node tree 1001. A device node path (second route) 620 records a character string representation of a path to each node in the device node tree 901. The control request for the equipment corresponding to the node of the service node tree 1001 is converted into a control request for the equipment corresponding to the node of the device node tree 901 associated with the node correspondence table (route correspondence information) 601. .

The device node information table (node type information) 701 is a table for managing information necessary for accessing the equipment devices 41 to 47 as shown in FIG. The device node information table (node type information) 701 includes a device node path (second route) 710, a node type 720, and node information 730.
A device node path (second route) 710 records a character string representation of a path to each node in the device node tree 901.

The node type 720 indicates the type of acquisition method of the control results of the equipment devices 41 to 47. The node type 720 is “0”, “1”, and “2”. “0” indicates that the equipment devices 41 to 47 are always accessed to acquire data. This is used, for example, when it is desired to acquire the current state of the equipment devices 41 to 47. “1” indicates that data is acquired by accessing the equipment devices 41 to 47 only when the latest status data of the equipment devices 41 to 47 is not registered in the device status data 17. This is used in consideration of communication load and the like, and if relatively new status data is allowed even if it is not current status data, it is used. “2” indicates that data is always acquired from the device status data 17. This is used when it is desired to obtain statistical data of the state of the equipment devices 41 to 47.
The node information 730 is information necessary for accessing the equipment devices 41 to 47 indicated by the device node path (second route) 710. In the node information 730, for example, a set of an IP (Internet Protocol) address and a port number is recorded.

The device node state history table (facility device state history information) 801 is a table for managing the states of the facility devices 41 to 47 and the history thereof, as shown in FIG. The device node state history table (facility equipment state history information) 801 includes a device node path (second route) 810, a date and time 820, and contents 830.
A device node path (second route) 810 records a character string representation of a path to each node in the device node tree 901. The date and time 820 records the date and time (“year-month-day hour: minute: second.millisecond”) when the state of the equipment indicated by the device node path (second route) 810 was changed. The content 830 records the content of the state change in the equipment indicated by the device node path (second route) 810. The content 830 records, for example, the open / closed state of the door, the total daily power consumption of the packaged air conditioner, and the like.

As shown in FIG. 10, the device node tree 901 is a tree showing the management state of the equipment devices 41 to 47 in the system configuration. That is, “server1” is the server device (access right management device) 1, “gw1” is the gateway (GW) device 3, “cont1” is the control device 31, and “cont2” is the control device 32. , “Cont3” corresponds to the control device 33, respectively. “Dev1” to “dev7” correspond to the equipment devices 41 to 47, respectively.
The device node tree 901 is a tree configured to be easily managed by the data access control unit 12 and the device access control unit 13. In the present embodiment, the tree is a model of the network configuration. By configuring the tree so as to be easily managed by the data access control unit 12 and the device access control unit 13, data acquisition from the equipment devices 41 to 47 is facilitated.

As shown in FIG. 11, the service node tree 1001 is a tree that shows the management status of the equipment devices 41 to 47 in the service configuration. That is, “buil1” is “building”, “1f” is “first floor of building”, “2f” is “second floor of building”, “room1” to “room3” are “room” 1 "to" Room 3 ". “Pac1”, “door1”, and “door2” correspond to “package air conditioner 1”, “door 1”, and “door 2” in room 1, respectively. “Pac2” and “door3” correspond to “package air conditioner 2” and “door 3” in room 2, respectively. “Pac3” and “door4” correspond to “package air conditioner 3” and “door 4” in room 3, respectively.
This service node tree 1001 is a tree created separately for each service and for each user, separately from the device node tree 901. The service node tree 1001 is a tree configured to be easily managed by the service access control unit 11. In this embodiment, it is a tree that imitates the structure of a building. By configuring the tree so that it can be easily understood by the human eye and easily managed by the service access control unit 11, it becomes easy to display the service contents when providing the service.
The nodes of the service node tree 1001 are linked to the nodes of the device node tree 901 by the node association table (route correspondence information) 601. When the equipment devices 41 to 47 are controlled, they are in a format that is easy to access in the system configuration. Converted.

  The server device (access right management apparatus) 1 can be realized by a general computer having a CPU and a memory (not shown). At this time, the server device (access right management apparatus) 1 is operated by an access right management program that causes the computer to function as each of the means described above.

[Operation of Access Rights Management System 100]
Next, the operation of the access right management system 100 will be described with reference to FIGS. 12 to 16 (the configuration is appropriately shown in FIG. 1).

(Login process)
The flowchart in FIG. 12 shows the operation of the login process. Prior to step S <b> 11, the user inputs the biometric information from the client device 2 by operating the user ID and password or the biometric device on the form on the login screen constructed with HTML.
In step S11, the service access control unit 11 acquires the user ID and user authentication information transmitted from the client device 2, and stores them in a storage unit (not shown).

  In step S12, the service access control unit 11 checks whether or not the set of the acquired user ID and password or biometric authentication information is correct. The service access control unit 11 acquires user authentication information corresponding to the user ID transmitted from the client device 2 from the user authentication information table 201, and this user authentication information is obtained from the password or biometric authentication transmitted from the client device 2. Check if it is equal to the information.

In step S <b> 13, the service access control unit 11 determines whether the user authentication is successful. If the user authentication has failed (No in step S13), the login has failed and the login process is terminated.
On the other hand, when the user authentication is successful (step S13 / Yes), in step S14, the service access control unit 11 acquires a service ID and service information from the service information table 301, and lists services to be provided to the user. To get.

In step S15, the service access control unit 11 constructs a list of service information in a link format using HTML, and the client device 2 displays a list of service information.
In step S16, the service access control unit 11 stores the service ID of the service instructed by the user clicking on the link in a storage unit (not shown). The user can start using the service by this click.

(Service access processing)
The flowchart of FIG. 13 shows an operation of accessing the equipment that is permitted when the service is used.
In step S21, the service access control unit 11 stores the user ID stored in step S11, the service ID stored in step S16, the information “read” or “write” that is the access right type specified by the user, and the user Acquires the contents of data change specified by.
In step S <b> 22, the service access control unit 11 acquires the service permission (access right type) of the row including the set of the user ID and the service ID from the service permission table (use authority information) 401.

In step S23, the service access control unit 11 determines whether or not the user is authorized to use the service. When the service permission (access right type) cannot be acquired, that is, when the service permission table (usage authority information) 401 does not include a row corresponding to the set of the user ID and the service ID (No in step S23), The service access process is terminated because the service cannot be used.
On the other hand, when the service permission (access right type) can be acquired (step S23 / Yes), in step S24, the service access control unit 11 reads the user ID and the service ID from the node permission table (access authority information) 501. The service node path (first route) of the row including the pair is acquired. The list of service node paths (first route) acquired here is an accessible equipment list (accessible equipment information).

In step S25, the service access control unit 11 performs a loop process on the equipment in the accessible equipment list (accessible equipment information). Note that the user selects the equipment that is the target of the loop processing.
In step S26, the service access control unit 11 determines the access right type acquired in step S21. When the access right type is “read” (step S26 / read), in step S27, the service access control unit 11 passes the service node path (first route) to the data access control unit 12, and the data access control unit 12 performs a data acquisition process. The data acquisition process will be described in detail later.
On the other hand, when the access right type is “write” (step S26 / write), in step S28, the service access control unit 11 passes the service node path (first route) to the data access control unit 12 to perform data access. The control unit 12 performs data registration processing. The data registration process will be described in detail later.

In step S29, the service access control unit 11 edits the control result acquired from the data access control unit 12 and constructs it as HTML format screen data. Here, the control result is a concept including the acquisition result of the state data of the equipment acquired in step S27, the change result of the data stored in the equipment acquired in step S28, or the operation instruction result of the equipment. It is.
Note that the screen data has a configuration corresponding to the service node tree 1001 so that it can be easily understood by human eyes.

  In step S30, the service access control unit 11 transmits the screen data to the client device 2, the client device 2 displays the control result that is the acquired screen data, and the access right management system ends the service access process. .

(Data acquisition process)
The flowchart of FIG. 14 shows the operation of the process for acquiring the status data of the equipment.
In step S271, the data access control unit 12 sets the device node path (second route) including the service node path (first route) passed from the service access control unit 11 to the node association table (route). Correspondence information) 601.
In step S272, the data access control unit 12 acquires the node type of the row including the acquired device node path (second route) from the device node information table (node type information) 701.

In step S273, the data access control unit 12 branches the process according to the acquired node type. That is, when the node type is “0”, the data access control unit 12 determines that access to the equipment devices 41 to 47 is necessary (Yes in step S273). When the node type is “1”, the data access control unit 12 displays the date and time of the row including the device node path (second route) acquired in step S271 in the device node state history table (facility equipment state history). Information) If acquired from 801 and a certain time has elapsed from the latest date and time, it is determined that access to the equipment 41 to 47 is necessary (Yes in step S273).
On the other hand, when the latest date and time is within a predetermined time, the data access control unit 12 determines that data acquisition from the storage unit 14 is necessary (No in step S273). When the node type is “2”, the data access control unit 12 determines that data acquisition from the storage unit 14 is necessary (No in step S273).

If it is determined that access to the equipment 41 to 47 is necessary (step S273 / Yes), in step S274, the data access control unit 12 uses the device node path (second route) acquired in step S271 as the device access. It passes to the control part 13 and requests | requires acquisition of the status data of the equipment 41-47. The device access control unit 13 acquires from the device node information table (node type information) 701 the node information of the row including the passed device node path (second route).
In step S275, the device access control unit 13 performs a process of acquiring the state data of the equipment device. That is, the device access control unit 13 establishes a communication path for the IP address and port number included in the acquired node information. Note that the IP address in the present embodiment is the IP address of the gateway (GW) device 3 or the control device 33.

  The device access control unit 13 transmits the device node path (second route) acquired in step S271 to the gateway (GW) device 3 and the control device 33 with respect to the established communication path, and the state data of the equipment device Make a request. The gateway (GW) device 3 or the control device 33 that has received the device node path (second route) returns the status data of the facility device corresponding to the device node path (second route) to the device access control unit 13. To do.

  In step S276, the device access control unit 13 returns the received state data to the data access control unit 12 and registers it in the device node state history table (facility equipment state history information) 801.

  On the other hand, when it is determined that data acquisition from the storage unit 14 is necessary (No in step S273), in step S277, the data access control unit 12 includes the device node path (second route) acquired in step S271. The date / time and contents of the row are acquired from the device node state history table (facility device state history information) 801.

  After step S276 or step S277, the data access control unit 12 returns the acquisition result of the equipment device state data to the service access control unit 11.

(Data registration process)
The flowchart of FIG. 15 shows the operation of a process for registering data of equipment.
Here, the process of registering equipment device data includes a process of changing the equipment device data, a process of giving an operation instruction to the equipment device, and the like.

Steps S281 and S282 are the same as steps S271 and S272, and thus the description thereof is omitted.
In step S283, the data access control unit 12 branches the process according to the acquired node type. That is, when the node type is “0” or “1”, the data access control unit 12 determines that access to the equipment devices 41 to 47 is necessary (Yes in step S283).
On the other hand, when the node type is “2”, the data access control unit 12 determines that data registration in the storage unit 14 is necessary (No in step S283).

  If it is determined that access to the equipment 41 to 47 is necessary (step S283 / Yes), in step S284, the data access control unit 12 uses the device node path (second route) acquired in step S281 as the device access. It passes to the control part 13 and requests | requires the data registration of the equipment 41-47. The device access control unit 13 acquires from the device node information table (node type information) 701 the node information of the row including the passed device node path (second route). Here, the data registration is a concept including changing the data stored in the storage areas of the equipment devices 41 to 47 to designated data and giving an operation instruction to the equipment devices 41 to 47. .

In step S285, the device access control unit 13 establishes a communication path for the IP address and port number included in the acquired node information. Note that the IP address in the present embodiment is the IP address of the gateway (GW) device 3 or the control device 33 as in step S275.
The device access control unit 13 transmits the device node path (second route) acquired in step S281 to the gateway (GW) device 3 and the control device 33 for the established communication path, and registers the data of the facility device. Make a request. As a result, for example, it is possible to change setting parameters such as the temperature setting of an air conditioner and to instruct operation of equipment such as door opening and closing. The gateway (GW) device 3 or the control device 33 that has received the device node path (second route) sends the registration result of the data of the equipment corresponding to the device node path (second route) to the device access control unit 13. Reply to The device access control unit 13 returns the received registration result to the data access control unit 12. Here, the registration result is a concept including a data change result of the equipment devices 41 to 47 and an operation instruction result to the equipment devices 41 to 47.

  In step S286, the device access control unit 13 registers the received state data in the device node state history table (facility device state history information) 801, and then returns the data to the data access control unit 12.

  On the other hand, if it is determined that data registration in the storage unit 14 is necessary (No in step S283), in step S287, the data access control unit 12 includes the device node path (second route) acquired in step S281, and The date and time and the change contents of the data designated by the user in step S21 are registered in the device node state history table (facility device state history information) 801. As a result, for example, it is possible to change the contents recorded in the database, or to rewrite parameters such as calculation formulas and conversion coefficients for calculating energy consumption, for example.

  After step S286 or step S287, the data access control unit 12 returns the registration result of the equipment to the service access control unit 11.

  With the above operation, the access right can be managed using the access right information associated with the accessible equipment for each set of the user ID for specifying the user and the service ID for specifying the service. In this way, it is not necessary to set access rights by creating a list of users who can use it for each piece of equipment, so flexible access to a large number of pieces of equipment and combinations of many users and services It is possible to grant rights, reduce the load on equipment, and reduce network traffic, improving the availability of user services.

Second Embodiment
Next, a second embodiment of the present invention will be described with reference to FIG.
[Configuration of Access Rights Management System 100A]
The configuration of the access right management system 100A is a configuration in which the gateway (GW) device 3 is removed from the first embodiment, and the control device 31 and the control device 32 are connected via the global network 4 to the server device (access right management). Device 1) is mutually connected.

Further, the node association table (path correspondence information) 601, the device node information table (node type information) 701, and the device node tree 901 are configured as follows.
A configuration in which “/ gw1” is deleted from the device node path in each row of the node association table (route correspondence information) 601 is adopted. It is assumed that “/ gw1” is deleted from the device node path in each row of the device node information table (node type information) 701. The “gw1” node in the device node tree 901 is deleted, and the “cont1” and “cont2” nodes are connected to “server1”.

  Others are the same as those in the first embodiment, and the same components as those in the first embodiment are denoted by the same reference numerals and the description thereof is omitted.

<Modification>
As mentioned above, although one Embodiment of this invention was described, this invention is not limited to this, For example, it can change as follows in the range which does not deviate from the meaning of this invention.

In step S275, the gateway (GW) device 3 or the control device 33 can hold the state data of each facility device notified from the control devices 31, 32 or the facility device 47 as a history.
Then, the equipment device status data returned from the gateway (GW) equipment 3 or the control equipment 33 is sent to the control equipment 31, 32 or equipment equipment 47 again after receiving the equipment data status data request. It may be the status data obtained by the control, or may be status data that is already notified from the control devices 31 and 32 or the equipment device 47 and held as a history.

Further, the gateway (GW) device 3 or the control device 33 may return all of the stored state data history when receiving the acquisition request for the state data.
However, in this case, when the device access control unit 13 returns the status data to the data access control unit 12, the gateway (GW) device 3 or the control device 33 returns the device node path (requested from the data access control unit 12 ( Only the status data of the equipment corresponding to the second route) is returned.
At this time, the gateway (GW) device 3 or the control device 33 sends the state data of the facility device corresponding to the device node path (second route) requested from the device access control unit 13 to the device access control unit 13. It can be placed at the beginning of the data to be returned. Then, the device access control unit 13 immediately returns only the top state data of the state data of the facility device returned from the gateway (GW) device 3 or the control device 33 to the data access control unit 12, and then the gateway (GW) ) The state data of all the equipment devices returned from the device 3 or the control device 33 may be registered in the device node state history table (facility device state history information) 801.

  In the case of the second embodiment, since there is no gateway (GW) device 3, the control devices 31 and 32 have the same functions as the control device 33 described above.

Similarly, in step S285, when receiving the data registration request, the gateway (GW) device 3 or the control device 33 may return all the history data of the facility devices held together with the registration result.
However, in this case, when the device access control unit 13 returns the status data to the data access control unit 12, the gateway (GW) device 3 or the control device 33 returns the device node path (requested from the data access control unit 12 ( Only the registration result of the equipment corresponding to the second route) is returned.
At this time, the gateway (GW) device 3 or the control device 33 sends the registration result of the facility device corresponding to the device node path (second route) requested from the device access control unit 13 to the device access control unit 13. It can be placed at the beginning of the data to be returned. The device access control unit 13 immediately returns only the top registration result to the data access control unit 12 among the state data and the registration result of the equipment device returned from the gateway (GW) device 3 or the control device 33. Thereafter, the state data and registration results of all the equipment devices returned from the gateway (GW) device 3 or the control device 33 may be registered in the device node state history table (facility device state history information) 801.

  In the case of the second embodiment, since there is no gateway (GW) device 3, the control devices 31 and 32 have the same functions as the control device 33 described above.

1 Server device (access right management device)
2 Client device 3 Gateway (GW) device 4 Global network 5 Local network 10 Access control unit 11 Service access control unit 12 Data access control unit 13 Device access control unit 14 Storage unit 15 Service management data 16 Device management data 17 Device status data 31 33 Control equipment 41-47 Equipment 100 Access right management system 100A Access right management system 201 User authentication information table 301 Service information table 401 Service permission table (use authority information)
501 Node permission table (access authority information)
601 Node association table (route correspondence information)
610 service node path (first route)
620 Device node path (second route)
701 Device node information table (node type information)
720 Node type 730 Node information 801 Device node state history table (facility equipment state history information)
820 Date and time 830 Contents 901 Device node tree 1001 Service node tree

Claims (11)

An access right management device that manages an access right that is a right to access a facility device when a user uses a service,
For each set of a user ID that identifies the user and a service ID that identifies the service,
A storage unit storing access authority information in association with the accessible equipment;
Based on the user ID and the service ID acquired by the input from the client device that exchanges information with the user, the access authority information is used to access the facility device that the user can access in the service. Obtains accessible equipment information that is information, requests the control equipment that controls the equipment to request control of the equipment present in the accessible equipment information, and sends the control to the client equipment An access control unit for displaying a control result of the facility device acquired from the device;
A storage unit storing facility device state history information that associates the state of the facility device with the state of the facility device and a history of the state;
A node type that is information indicating whether to access the facility equipment state history information in which the equipment device is accessed or the equipment device state is recorded is associated with the equipment device. A storage unit storing node type information,
The access control unit includes a data access control unit that acquires the node type using the node type information and selects a location to access, for each equipment device existing in the accessible equipment information. Access right management device.   An access right management device that manages an access right that is a right to access a facility device when a user uses a service,
  For each set of a user ID that identifies the user and a service ID that identifies the service,
A storage unit storing access authority information in association with the accessible equipment;
  Based on the user ID and the service ID acquired by the input from the client device that exchanges information with the user, the access authority information is used to access the facility device that the user can access in the service. Obtains accessible equipment information that is information, requests the control equipment that controls the equipment to request control of the equipment present in the accessible equipment information, and sends the control to the client equipment An access control unit for displaying a control result of the facility device acquired from the device;
  In order to show the route to the equipment, a first route based on a tree structure indicating a management state of the equipment in service configuration and a second structure based on a tree structure showing a management state of the equipment in system configuration A storage unit storing route correspondence information in which the first route and the second route are associated with each facility device, and
  The access control unit indicates the equipment device using the first route for the client device, and indicates the first route based on the route correspondence information for the control device. Replace the second route to indicate the equipment
  An access right management device.   An access right management device that manages an access right that is a right to access a facility device when a user uses a service,
  For each set of a user ID that identifies the user and a service ID that identifies the service,
A storage unit storing access authority information in association with the accessible equipment;
  Based on the user ID and the service ID acquired by the input from the client device that exchanges information with the user, the access authority information is used to access the facility device that the user can access in the service. Obtains accessible equipment information that is information, requests the control equipment that controls the equipment to request control of the equipment present in the accessible equipment information, and sends the control to the client equipment An access control unit for displaying a control result of the facility device acquired from the device;
  A storage unit storing facility device state history information that associates the state of the facility device with the state of the facility device and a history of the state;
  A node type that is information indicating whether to access the facility equipment state history information in which the equipment device is accessed or the equipment device state is recorded is associated with the equipment device. A storage unit storing node type information;
  In order to show the route to the equipment, a first route based on a tree structure indicating a management state of the equipment in service configuration and a second structure based on a tree structure showing a management state of the equipment in system configuration A storage unit storing route correspondence information in which the first route and the second route are associated with each facility device, and
  The access control unit includes a data access control unit that acquires the node type using the node type information and selects a location to access, for each equipment device present in the accessible equipment information.
  The access control unit indicates the equipment device using the first route for the client device, and indicates the first route based on the route correspondence information for the control device. Replace the second route to indicate the equipment
  An access right management device. A storage unit that stores use authority information in association with an access right type, which is information indicating a usable form of the service for the user, for each set of the user ID and the service ID;
The said access control part determines whether the said user has the use authority of the said service using the said use authority information. The Claim 1 characterized by the above-mentioned. Access right management device. In response to a request from the access right management device, an access right management device that manages an access right that is a right to access the equipment when the user uses the service, a client device that exchanges information with the user, and the access right management device An access right management system in which a control device for controlling equipment is mutually connected via a network,
The access right management device includes:
For each set of a user ID that identifies the user and a service ID that identifies the service,
A storage unit that stores access authority information associated with first path information that is path information in a tree structure that indicates a management state on a service configuration to the equipment that can be accessed;
In order to indicate a route to the facility device, the first route information and second route information that is route information based on a tree structure indicating a management state in the system configuration of the facility device are provided for each facility device. A storage unit that stores route correspondence information associated with
Based on the user ID and the service ID acquired from the client device,
Using the access authority information, the user acquires first route information that is information on the equipment that can be accessed in the service, and based on the route correspondence information, the first route information is obtained as a second route. An access control unit that replaces the information, requests the control device to control the facility device indicated by the second route information, and causes the client device to display the control result of the facility device acquired from the control device And comprising
The access right management system, wherein the control device controls the equipment requested by the access right management device and returns a control result to the access right management device. The control device holds a history of state data of the equipment to be controlled, and when the control of the equipment is requested from the access right management device, the state held with the control result of the equipment 6. The access right management system according to claim 5, wherein a history of data is returned to the access right management apparatus.   7. The access right management system according to claim 5, further comprising a gateway device that is a communication device that mediates between the access right management device and the control device, connected via the network. The gateway device holds a history of the state data of the facility device held by the control device, and when the control of the facility device is requested from the access right management device, retains the history of the state of the facility device. The access right management system according to claim 7, wherein a history of the status data is returned to the access right management device. An access right management method in an access right management device for managing access authority, which is a right to access equipment when a user uses a service,
Access is possible for each set of a user ID that identifies the user and a service ID that identifies the service based on a user ID and a service ID acquired by input from a client device that exchanges information with the user Using the access authority information associated with the equipment, the user obtains accessible equipment information that is information on the equipment that can be accessed in the service, and the control equipment that controls the equipment An access control step for requesting control of the equipment present in the accessible equipment information, and displaying the control result of the equipment acquired from the control equipment on the client equipment ;
The equipment status history information stored in association with the equipment and accessing the equipment via the network, or storing the equipment and the state of the equipment and the history of the state in association with each other. Node type, which is information indicating whether to access the device, and for each equipment device existing in the accessible equipment information, obtain the node type using the node type information and select a location to access Steps,
An access right management method comprising:   An access right management method in an access right management device for managing access authority, which is a right to access equipment when a user uses a service,
  For each set of a user ID that identifies the user and a service ID that identifies the service, access authority information that associates the accessible equipment is stored,
  Based on the user ID and the service ID acquired by the input from the client device that exchanges information with the user, the access authority information is used to access the facility device that the user can access in the service. Obtains accessible equipment information that is information, requests the control equipment that controls the equipment to request control of the equipment present in the accessible equipment information, and sends the control to the client equipment An access control step for displaying a control result of the facility device acquired from the device;
  In order to show the route to the equipment, a first route based on a tree structure indicating a management state of the equipment in service configuration and a second structure based on a tree structure showing a management state of the equipment in system configuration Storing route correspondence information in which the first route and the second route are associated with each facility device,
  The access control unit indicates the equipment device using the first route for the client device, and indicates the first route for the control device based on the route correspondence information. Replacing the second route with the facility equipment;
  An access right management method comprising: An access right management program for causing a computer to execute the method according to claim 9 or 10 .

Images