JP6257823B1 - Information security system and information security method - Google Patents

Abstract

An unauthorized use of information equipment used in a security area is limited. An information security system having a management server for managing an information processing apparatus, wherein the information processing apparatus accepts an operation and stops processing performed by the information processing apparatus based on the received operation. An account authentication request for determining whether or not the user has entered the security area is transmitted to the management server, and if the authentication result is authentication permission, the aborted process is permitted, and the authentication result is authentication unapproved. In some cases, a use control unit that maintains the suspension of the process is provided. The management server performs account authentication for determining whether the user has entered the security area based on the account authentication request received from the information processing apparatus, transmits the authentication result to the information processing apparatus, and An account authentication unit for transmitting notification information to the outside that an unauthorized operation has been performed. [Selection] Figure 1

Description

The present invention relates to an information security system and an information security method.

  The leakage of trade secrets and personal information will have a significant impact on corporate activities and trust. For this reason, companies tend to tighten security management. Security management measures include, for example, management of people entering and leaving the office, user authentication when using information equipment, and the like.

  For example, in Patent Document 1, when there is a request for access to a file, access permission is determined based on information included in the access request and a user ID, password, permission time zone, and terminal ID. An access control device that accesses a corresponding file when it is determined is disclosed.

  Further, Patent Document 2 discloses an electronic device management system that links an entrance / exit management system with an electronic device use permission determination and refuses to use an electronic device for a person who is determined not to enter the room. Has been.

JP 2000-259567 A JP 2002-41469 A

  The access control device described in Patent Document 1 controls access to a file in the access control device, but does not describe controlling operation on the access terminal side. In addition, in the electronic device management system described in Patent Document 2, the electronic device can be used if a regular occupant satisfies the login condition of the electronic device. However, when the non-regular occupant operates the electronic device. Security measures are not considered.

  SUMMARY OF THE INVENTION An object of the present invention is to manage people entering and exiting a security area and limit unauthorized use of information devices used in the security area.

  An information security system according to the present invention is an information security system having a management server that manages an information processing device used by a user in a security area, wherein the information processing device includes a reception unit that receives an operation on the information processing device. Suspending the processing performed by the information processing apparatus based on the operation received by the reception unit to suppress the operation, and entering the security area based on the user entry / exit information in the security area Transmitting an account authentication request for determining whether or not the information processing apparatus has been authenticated, and permitting the processing performed by the information processing apparatus to be stopped when the authentication result for the account authentication request is authentication permission, If the authentication result for the account authentication request is unauthorized A use control unit that maintains the suspension of processing performed by the stopped information processing apparatus, and the management server receives the account authentication request received from the information processing apparatus and the entry / exit of the user with respect to the security area. And performing account authentication for determining whether or not the user has entered the security area based on the information, transmitting the authentication result to the information processing apparatus, and the authentication result is not permitted. In some cases, the information security system includes an account authentication unit that transmits to the outside report information indicating that an unauthorized operation has been performed via a network.

  The present invention also manages an entry / exit management server that manages entry / exit information indicating an entry / exit status for a security area, an information processing device used by a user in the security area, and a usage status of the information processing device. An information security system including a management server, wherein the information processing apparatus cancels processing performed by the information processing apparatus based on an accepting unit that accepts an operation on the information processing apparatus and an operation accepted by the accepting part And suppressing the operation, and transmitting an account authentication request for determining whether or not the user has entered the security area based on the user entry / exit information in the security area to the management server, When the authentication result for the account authentication request is authentication permission, the information processing apparatus performs And a use control unit that maintains the suspension of processing performed by the information processing apparatus when the authentication result for the account authentication request is not permitted. Based on the account authentication request received from the processing device and the user's entry / exit information with respect to the security area, an account authentication is performed to determine whether the user has entered the security area, and the information An account authentication unit for transmitting the authentication result to a processing device, and transmitting notification information to the outside that an unauthorized operation has occurred via the network if the authentication result is not permitted; and The account authentication unit determines whether or not the entrance / exit information is exit information, and when determining that the entrance / exit information is exit information, Based on the attendance table in which the user's attendance information is stored, it is determined whether or not the user is within working hours. When the user is determined not to be within working hours, the notification information is transmitted to the outside, and the input The exit management server has an entrance / exit management table for registering user entrance / exit information, user information for identifying a user acquired by a reader installed in the security area, registered user information registered in advance, Information indicating entry of the user into the security area is recorded in the entrance / exit management table, and the usage control unit of the information processing device accepts a shutdown operation by the accepting unit of the information processing device. Detection information indicating that the shutdown has been executed and based on the detection information including the time of the shutdown. Is recorded in the management table as exit information, and the account authentication unit of the management server identifies the user based on the exit information recorded in the entrance / exit management server and the attendance information of the user. It is configured as an information security system characterized by authentication.

The present invention is also grasped as an information security method used in the security control system.

  ADVANTAGE OF THE INVENTION According to this invention, while managing the person who goes in and out of a security area, the unauthorized use with respect to the information equipment used in a security area can be restrict | limited.

It is a figure which shows the structural example of an information security system. It is a figure which shows the example of an entrance / exit log table. It is a figure which shows the example of a room master table. It is a figure which shows the example of a card master table. It is a figure which shows the example of a card location table. It is a figure which shows the example of a user account table. It is a figure which shows the example of an attendance master table. It is a figure which shows the example of a time table. It is a figure which shows the example of a wireless connection apparatus master table. It is a figure which shows the example of a terminal location table. It is a sequence diagram of security control processing (when a reader for entering and leaving a room is provided, and a user enters a security area and uses an information processing terminal). It is a sequence diagram of security control processing (when a reader for entering and leaving a room is provided, a user enters the security area, shuts down the information processing terminal, and leaves the room). FIG. 11 is a sequence diagram of security control processing (when a reader for entering and leaving a room is provided, and a user leaves the room while entering the security area and starting the information processing terminal). It is a sequence diagram of a security control process (when a reader for entering a room is provided, the user shuts down, leaves the room, checks attendance information, and executes it). It is a sequence diagram of a security control process (when a reader for entering a room is provided, the user leaves the room without shutting down, checks attendance information, and executes it). It is a sequence diagram of a security control process (when confirming entry into a security area by a user by wireless communication). It is a sequence diagram of a security control process (when confirming the user leaving the security area by wireless communication).

  Exemplary embodiments of a security management system, a method thereof, and a program thereof according to the present invention will be described below in detail with reference to the accompanying drawings.

  FIG. 1 is a diagram showing a configuration example of an information security system 1000 to which the information security system, the method, and the program according to the present invention are applied. This system is an information processing device such as a PC (Personal Computer) used in a security target area (hereinafter referred to as a security area) including buildings such as buildings and houses, or areas such as living rooms and hallways in buildings. This is a system that manages security for operations on various apparatuses and devices including output devices such as copiers, facsimiles, and MFPs (Multifunction Peripherals).

  As shown in FIG. 1, the information security system 1000 can wirelessly connect to an entry / exit management server 100, a terminal management server 200, an in-house information asset 300, and a plurality of information processing terminals 400 to which a reader 500 is connected. A wireless connection device 600 for wireless connection to the mobile device 700 is connected via the network N1. The network N1 is connected to the security center 800 via a general public line network X and a network N3. The networks N1 and N3 are general communication line networks such as an in-house LAN (Local Area Network) and a WAN (Wide Area Network). In the following, a case where a security center is connected to the network N3 is illustrated, but the network N3 is not limited to this and can be connected to various communication destinations.

  The entrance / exit management server 100 is a server that manages entering / exiting the security area. The entrance / exit management server 100 is physically composed of a general server.

  As shown in FIG. 1, the entrance / exit management server 100 includes a storage unit 101, an entrance / exit authentication unit 102, a communication unit 103, and a control unit 104. The entrance / exit management server 100 is connected to the reader 500 via the network N2. The network N2 is a general network and mediates communication between the reader 500 and the entrance / exit management server 100. The network N1 and the network N2 may be configured by one network.

  The reader 500 is installed, for example, in the vicinity of the entrance / exit for each place defined as a security area. The reader 500 uses identification information (for example, a user ID or the like) recorded on an information recording medium (for example, an IC card) that serves as a user ID such as an employee ID card when the user enters or exits the place. Information). When the user brings the IC card close to or in contact with the reader 500, the reader 500 reads the user ID recorded on the IC card. In the following, an example in which the reader 500 reads the IC card to authenticate the user is shown, but the user may be authenticated by biometric authentication such as a fingerprint, vein, or iris.

  The storage unit 101 includes a general storage device such as an HDD (Hard Disk Drive), and stores an entry / exit log table 1011, a room master table 1012, a card master table 1013, and a card location table 1014. The entry / exit log table 1011 is information indicating an entry / exit history for each user and each place defined as a security area. The room master table 1012 is information in which a place to be a security area is registered. The card master table 1013 is information in which IC cards used in this system are registered. The card location table 1014 is information indicating the current location of the IC card. Although not specifically shown below, it is assumed that registered user information such as a user ID, which is identification information for authenticating a user, is registered in the storage unit 101 in advance.

  FIG. 2 is a diagram illustrating an example of the entry / exit log table 1011. As shown in FIG. 2, the entry / exit log table 1011 includes a user ID for identifying a user, an entry date and time indicating the date and time when the user entered a place designated as a security area, and the entry / exit log table 1011. An outgoing date and time indicating the date and time and a room name indicating a place where such access has been made are stored in association with each other.

  In FIG. 2, for example, a user identified by a user ID A0001 enters a room, which is one of the places defined as the security area, at 8:30 am on October 2, 2015, and is still in the room. Indicates that it is not out of. Further, the user identified by the user ID B0001 enters the conference room, which is one of the places defined as the security area, at 8:50 am on October 2, 2015, and at 10:20 am on the same day. Shows that the minute.

  FIG. 3 is a diagram illustrating an example of the room master table 1012. As shown in FIG. 3, the room master table 1012 stores a room ID for identifying a security area and a security area identified by the room ID in association with each other.

  In FIG. 3, for example, the security area identified by the room ID R001 is a living room, the security area identified by the room ID R002 is a conference room, and the security area identified by the room ID R003 is a server room. It is shown that.

  FIG. 4 is a diagram illustrating an example of the card master table 1013. As shown in FIG. 3, the card master table 1013 stores a card ID for identifying an IC card used by a user and the user ID in association with each other.

  In FIG. 4, for example, card IDs identified by card IDs C001 to C003 are stored, and the IC cards are used by users identified by U001 to U003, respectively.

  FIG. 5 is a diagram illustrating an example of the card location table 1014. As shown in FIG. 5, the card location table 1014 stores the card ID and the room ID in association with each other.

  In FIG. 5, for example, the IC card identified by the card ID C001 is currently in R001, that is, the user U001 is present in the room identified by the room ID R001.

  Next, returning to FIG. 1, the entrance / exit authentication unit 102 will be described. The entrance / exit authentication unit 102 compares the user ID registered in advance in the storage unit 101 with the user ID read by the reader 500 when the user enters a place defined as a security area. It is a processing unit that authenticates whether or not the user is a valid user. The communication unit 103 is a processing unit that controls transmission / reception of various information via the network N1 and the network N2. The control unit 104 is a processing unit that controls each unit constituting the entrance / exit management server 100. Specific operations of each unit included in the entrance / exit management server 100 will be described later with reference to a sequence diagram. Next, the terminal management server 200 will be described.

  The terminal management server 200 is a server that manages operations on the information processing terminal 400 and access to the in-house information asset 300. Similar to the entrance / exit management server 100, the terminal management server 200 is physically composed of a general server. In the following, a PC is described as a representative example of a device or device to be operated or accessed, but various devices and devices can be similarly considered as described above.

  As illustrated in FIG. 1, the terminal management server 200 includes a storage unit 201, an account authentication unit 202, a communication unit 203, and a control unit 204.

  The storage unit 201 includes a general storage device such as an HDD, and stores a user account table 2011, an attendance master table 2012, a time table 2013, a wireless connection device master table 2014, and a terminal location table 2015. .

  The user account table 2011 is information for storing information related to user accounts managed by this system.

  FIG. 6 is a diagram illustrating an example of the user account table 2011. As shown in FIG. 6, the user account table 2011 includes a user account in the present system, the user ID and password, the card ID, a mobile ID for identifying the mobile terminal 700 used by the user, and information. A terminal ID for identifying the processing terminal 400 is stored in association with each other.

  In FIG. 6, for example, the user and password identified by the account Q001 are U001 and P001, respectively, and the IC card identified by the card ID C001 and the user U001 using the portable terminal 700 identified by the portable IDK001. This indicates that the user uses the information processing terminal 400 identified by the PC001.

  The attendance master table 2012 is information for managing attendance for each account.

  FIG. 7 is a diagram illustrating an example of the attendance master table 2012. As shown in FIG. 7, the attendance master table 2012 includes the above account, the day of the week indicating the scheduled attendance date of the user corresponding to the account, the start date and time indicating the start of the task on the scheduled attendance date, and the end of the task on the scheduled attendance date. Are stored in association with each other.

  In FIG. 7, for example, the user (U001) whose account corresponds to Q001 is Sunday (S), Monday (M), Tuesday (T), Wednesday (W), Thursday (TH), Friday (F) in one week. ), And the start and end of work on each day of the week are 9:00 and 17:30, respectively.

  The time table 2013 is information that defines the type of restriction of operations on the information processing terminal 400 according to the elapsed time since the information processing terminal 400 is not operated.

  FIG. 8 is a diagram illustrating an example of the time table 2013. As illustrated in FIG. 8, the time table 2013 stores the type of operation restriction described above and an elapsed time that is a threshold value until the type of operation restriction is generated in association with each other. In FIG. 8, for example, when 30 minutes have passed since the information processing terminal 400 is not operated within the user's working hours, the information processing terminal 400 is locked, and the information processing terminal 400 is operated within the user's working hours. This indicates that the information processing terminal 400 is forcibly shut down when 60 minutes have passed since the stop. Similarly, when 15 minutes have passed since the information processing terminal 400 is not operated outside the user's working hours, the information processing terminal 400 is locked and the information processing terminal 400 is not operated outside the user's working hours. When 30 minutes have passed, the information processing terminal 400 is forcibly shut down. Thus, the elapsed time can be determined according to whether or not it is within the user's working hours. FIG. 8 illustrates a case where the type of restriction of the operation is lock or shutdown, but is not limited thereto, and various restrictions can be defined as the type.

  The wireless connection device master table 2014 is information in which devices that mediate wireless communication with the mobile terminal 700 used by the user are registered. In the following, a case where wireless communication is performed using Wi-Fi has been described. However, a case where wireless communication is performed using another wireless communication standard can be considered in the same manner.

  FIG. 9 is a diagram illustrating an example of the wireless connection device master table 2014. As shown in FIG. 9, in the wireless connection device master table 2014, a connection device ID for identifying a wireless connection device (for example, a Wi-Fi router) and a room ID indicating the installation location of the connection device are associated with each other. It is remembered. In FIG. 9, for example, the wireless connection device identified by W001 indicates that the room ID is installed in the room identified by R001.

  FIG. 10 is a diagram illustrating an example of the terminal location table 2015. As illustrated in FIG. 10, the terminal location table 2015 stores a computer ID for identifying the information processing terminal 400 used by the user and the room ID in association with each other. In FIG. 10, for example, the information processing terminal 400 identified by the PC001 indicates that the room ID is in the security area identified by R001 (that is, the user using the information processing terminal is in the security area). ing.

  Subsequently, returning to FIG. 1, the account authentication unit 202 will be described. The account authentication unit 202 is a processing unit that authenticates a user account. The communication unit 203 is a processing unit that controls transmission / reception of various information via a network. The control unit 204 is a processing unit that controls each unit configuring the terminal management server 200. Specific operations of each unit included in the terminal management server 200 will be described later with reference to a sequence diagram. Next, returning to FIG. 1, the in-house information asset 300 will be described.

  The in-house information asset 300 is an asset managed by an organization such as a company or an organization that uses this system, and is information to be security-targeted.

  As shown in FIG. 1, the in-house information asset 300 includes a directory service 3001, a file server 3002, a DB (Data Base) server 3003, and a backbone system 3004. The directory service 3001 is, for example, a service that collects, records, and searches information such as resources of this system and their locations, attributes, and settings. The file server 3002 is a server that stores files used in the directory service 3001, for example. The DB server 3003 is a server that stores a database used in the directory service 3001, for example. The core system 3004 is, for example, a system that executes processing related to core business in cooperation with this system. In the present embodiment, these are exemplified as the in-house information asset 300, but various in-house information assets that require security can be considered in the same manner. In the present system, as shown below, unauthorized access to the in-house information asset 300 can be prevented by suppressing the operation of the information processing terminal 400 by an unauthorized intruder.

  Next, returning to FIG. 1, the information processing terminal 400 will be described. The information processing terminal 400 is a terminal used by a user. The information processing terminal 400 is physically composed of a computer such as a general PC. In FIG. 1, the information processing terminal 400 is exemplified as a PC. However, as described above, the information processing terminal 400 can also be applied to various apparatuses and devices including output devices such as a copier, a facsimile, and an MFP. In the present embodiment, a login operation is cited as an example of an operation on the information processing terminal 400. However, the present invention is not limited to this, and various operations on the information processing terminal 400 (for example, a power ON operation, a keyboard touch operation, etc. Electrical or mechanical action).

  As illustrated in FIG. 1, the information processing terminal 400 includes a storage unit 401, a display unit 402, an input unit 403, an input / output processing unit 404, a communication unit 405, a control unit 406, and a terminal usage control unit 407. And is configured.

  The storage unit 401 is composed of a general storage device such as an HDD, and stores various types of information including the computer ID shown in FIG. In order to avoid repeated input of a user ID or authentication information, the user ID may be stored as necessary.

  The display unit 402 is a general display device such as an LCD (Liquid Crystal Display), and displays various types of information such as information input from the input unit 403 and information received from the terminal management server 200. The input unit 403 is a general input device such as a keyboard, and receives input of various information including a user ID from the user.

  The input / output processing unit 404 is a processing unit that processes information received by the input unit 403, information output to the display unit 402, and various types of information transmitted to or received from the network.

  The communication unit 405 is a processing unit that controls transmission / reception of various information via the network N1. The control unit 406 is a processing unit that controls each unit configuring the information processing terminal 400.

  The terminal usage control unit 407 confirms the user's entry / exit status into the security area, and suppresses or cancels the operation of the information processing terminal 400, thereby operating the information processing terminal 400 or in-house via the information processing terminal 400. It is a processing unit that controls access to resources such as the information asset 300. Specific operations of each unit included in the information processing terminal 400 will be described later with reference to a sequence diagram.

  The wireless connection device 600 is a device (for example, a Wi-Fi router) that connects communication between the mobile terminal 700 and the network N1. The mobile terminal 700 is a terminal that can be carried by a user such as a mobile phone, a smartphone, or a tablet terminal. The wireless connection device 600 and the portable terminal 700 have a general configuration as hardware. The wireless terminal 700 includes a wireless connection unit 701 that performs wireless communication with the wireless connection device 600 in order to access the network N1. Actually, it has a configuration that a general portable terminal should have, such as a touch panel that receives and displays various operations from the user.

  The security center 800 is a center that guards the security area. When the security center 800 receives the report information indicating that the unauthorized operation has been performed from the terminal management server 200, the security center 800 urges the security guard S to the security area where the report information is issued. Actually, when the server of the security center 800 receives the notification information, the server sends an emergency command indicating an instruction to prompt the terminal carried by the security guard S to the site and the security area where the unauthorized operation has been performed. Send detailed information such as the location and the time of unauthorized operation. For example, the detailed information may be received by being included in the notification information.

  Next, security control processing performed in this system will be described. The security control process is a process for suppressing or canceling the suppression of operations on the information processing terminal 400 and access to resources such as the in-house asset information 300. Assuming that different control is required depending on the situation where the information processing terminal 400 is placed, the sequence in the case where the reader 500 for entering and leaving the room is provided (FIGS. 11 to 13), A sequence when the reader 500 is not provided (FIGS. 14 and 15) and a sequence when the entrance / exit management server 100 is not provided (FIGS. 16 and 17) will be described. The sequence from FIGS. 11 to 13 will be described as a first embodiment, the sequence from FIGS. 14 to 15 will be described as a second embodiment, and the sequence from FIGS. 16 to 17 will be described as a third embodiment.

Example 1
FIG. 11 is a sequence diagram of a security control process in which a reader 500 for entering and leaving a room is provided, and a user enters the security area and starts using the information processing terminal 400. As illustrated in FIG. 11, the entrance / exit management server 100 acquires information on the presence of the user in the security area (S1101). Actually, the user ID and card ID recorded on the IC card that is approached or touched by the user are read from the reader 500, the read user ID and card ID, the date and time of entry, and the room in which the reader 500 is installed Get occupancy information including name.

  In the entrance / exit management server 100, the entrance / exit authentication unit 102 records the user ID, the entrance date / time, and the room name included in the occupancy information received from the reader 500 in the entrance / exit log table 1011 (S1102). Further, the entrance / exit authentication unit 102 refers to the room master table 1012 and records the card ID and the room ID included in the occupancy information in the card location table 1014 (S1103).

  Here, when the user (or a third party other than the user) presses the power button of the information processing terminal 400 and the control unit 406 receives the power ON signal (S1104), the control unit 406 causes the terminal usage control unit 407 to operate. The terminal usage control unit 407 is made resident in the memory (S1106).

  Thereafter, the input / output processing unit 404 sends, to the terminal usage control unit 407, login detection information indicating that login information (for example, a user ID or password for logging in to an OS (Operating System)) has been received from the input unit 403. Output (S1107, S1108). In the present embodiment, a login operation is given as an example of an operation on the information processing terminal 400. However, as described above, the present invention is not limited to this and includes various electrical or mechanical actions. In this case, the location related to the login operation may be read as a power ON operation, a touch operation, or the like.

  Upon receiving the login detection information from the information processing terminal 400, the terminal usage control unit 407 outputs suppression information for suppressing the operation of the information processing terminal 400 (S1109), and the control unit 406 displays the suppression instruction and the suppression information. (S1110). For example, there is a command to wait for the OS login process as an instruction for suppression, and for example, the information of the information processing terminal 400 such as “Please wait for a while because the operation cannot be performed until the user entry / exit status can be confirmed”. There is a message that prompts suppression of an operation to be displayed on the display unit 402.

  When the control unit 406 of the information processing terminal 400 receives the inhibition instruction and the inhibition information from the terminal usage control unit 407, the control unit 406 temporarily stops the process and displays the inhibition information on the display unit 402 (S1111).

  When the process of S1109 ends, the terminal usage control unit 407 of the information processing terminal 400 transmits an account authentication request to the terminal management server 200 (S1112). The account authentication request is a request for authenticating whether the information processing terminal 400 is operated by a user having a correct account, and includes the computer ID of the information processing terminal 400.

  The account authentication unit 202 of the terminal management server 200 refers to the user account table 2011 using the computer ID included in the account authentication request received from the information processing terminal 400 as a key, and the user ID and card ID corresponding to the computer ID. And the presence check request is transmitted to the entrance / exit management server 100 (S1113).

  The entrance / exit authentication unit 102 of the entrance / exit management server 100 refers to the entrance / exit log table 1011 and the card location table 1014 using the user ID and card ID included in the occupancy check request received from the terminal management server 200 as keys. The occupancy information is transmitted to the entrance / exit management server 100 (S1114), and the account authentication unit 202 of the terminal management server 200 refers to the occupancy information received from the entrance / exit management server 100 to check the presence of the user. It performs (S1115).

  For example, the account authentication unit 202 reads the entry / exit record of the user recorded in the entry / exit log table 1011 included in the occupancy information received from the entry / exit management server 100, and enters which security area at that time It is checked whether the user has left the security area and, as a result of the above check, occupancy information, which is a check result including the room ID, room name, entry or occupancy, is output. Actually, as shown in FIG. 10, the computer ID and the room ID are associated with each other, and which information processing terminal 400 is installed in which security area is associated.

  The account authentication unit 202 of the terminal management server 200 authenticates the user's account by determining whether or not the corresponding user has entered the room, and notifies the information processing terminal 400 of the result (S1116, S1117). ). For example, if it is determined that the occupancy information has been received, the account authentication unit 202 permits (OK) the authentication of the user's account and notifies the information processing terminal 400 to that effect.

  In the processing of S1116 and S1117, when the user is in the room entry state, the information processing terminal 400 is notified that the authentication of the user's account is permitted. However, even when the user is in the room entry state, for example, the user's information processing terminal 400 may be operated by a third party while he / she is away and temporarily absent. Therefore, in preparation for such a case, when it is determined that the user is present in the portable terminal 700 and it is determined that the user is in the room leaving state and temporarily left, As shown in FIG. 1A, the information processing terminal 400 may be notified that the account authentication is permitted.

  For example, if the account authentication unit 202 of the terminal management server 200 determines that the above-mentioned occupancy information has been received, the occupancy confirmation information for confirming the occupancy of the user is transmitted to the mobile terminal 700 of the user (S1130). ). The destination of the occupancy confirmation information may be, for example, a mail address registered in advance in association with the portable ID of the portable terminal 700.

  When the wireless connection unit 701 of the portable terminal 700 receives the occupancy confirmation information from the terminal management server 200, the wireless connection unit 701 requests the input display unit of the portable terminal 700 configured by a touch panel or the like to input authentication information, and displays the input display. The unit accepts input of authentication information from the user and authenticates that the user is a valid user. As the authentication information, for example, various kinds of information for authenticating the user such as a password, a PIN code, a pattern, a fingerprint, etc. may be used.

  When the wireless connection unit 701 authenticates that the user is a valid user, the wireless connection unit 701 transmits a message to that effect to the terminal management server 200 (S1132), and the account authentication unit 202 of the terminal management server 200 receives the right from the portable terminal 700. When the fact that the user is authenticated is received, it is determined that the user is in the temporary away state, and in step S1117, the authentication of the user's account is permitted (OK). Notify

  When the terminal usage control unit 407 of the information processing terminal 400 receives the account authentication result (OK) from the terminal management server 200, the terminal usage control unit 407 outputs to the control unit 406 an instruction to cancel the inhibition instruction performed in S1110. (S1118) Upon receiving the release instruction from the terminal usage control unit 407, the control unit 406 allows the suspended processing to be resumed, continues, and deletes the suppression information displayed on the display unit 402 (S1119). ).

  Thereafter, the input unit 403 receives various operations (for example, activation and editing of software, access to files, etc.) from the user, and the control unit 406 controls the execution of these processes.

  The terminal usage control unit 407 measures the elapsed time after the operation on the information processing apparatus 400 is not accepted by a timer (not shown), and determines whether the elapsed time that is a threshold stored in the time table 2013 has elapsed. (S1121, S1122).

  When the terminal usage control unit 407 determines that the elapsed time has elapsed, the terminal usage control unit 407 instructs the control unit 406 to execute the operation suppression according to the elapsed time (S1123). For example, the terminal usage control unit 407 instructs to lock the screen displayed on the display unit 402 (for example, to apply a screen saver) when it is determined that 30 minutes have elapsed since the operation on the information processing apparatus 400 is not accepted. Is output and an instruction to shut down the information processing apparatus 400 is output when it is determined that 60 minutes have passed since the operation on the information processing apparatus 400 was not accepted.

  Thereafter, when the user who has left the seat is seated and the input unit 403 accepts an operation on the information processing terminal 400 (S1124), the control unit 406 controls the operation detection information indicating that the operation is accepted to the terminal. The data is output to the unit 407 (S1125). Upon receiving the operation detection information from the control unit 406, the terminal usage control unit 407 outputs suppression release information (S1126). The deterrence cancellation information includes, for example, an authentication information input screen (user ID / password input screen) for executing an account authentication request.

  The terminal usage control unit 407 outputs an instruction to display the user ID / password input screen to the control unit 406 (S1127), and the control unit 406 displays the user ID / password input screen on the display unit 402 (S1128). . Thereafter, when the input unit 403 receives an input of a user ID / password from the user, the terminal usage control unit 407 stores the user ID / password input by accessing the terminal management server 200 in the user account table 2011. It is determined whether it is information (S1129). If it is determined that the input information is information stored in the user account table 2011, the process returns to S1112, and the subsequent processing is continued.

  In the above example, the operation of the information processing terminal 400 is locked in S1123. However, when the information processing terminal 400 is shut down, the user presses the power button of the information processing terminal 400 in S1124. Is done. Therefore, in this case, the process returns to S1104 and the subsequent processing is continued.

  FIG. 12 is a sequence diagram of security control processing in the case where a reader 500 for entering and leaving a room is provided, and the user enters the security area and shuts down the information processing terminal 400 to leave the room. As illustrated in FIG. 12, the entrance / exit management server 100 acquires the exit information from the user's security area (S1201). Actually, the user ID and the card ID recorded on the IC card that is approached or touched by the user are read from the reader 500, the read user ID and the card ID, the date and time of departure, the room in which the reader 500 is installed Get the exit information including name.

  In the entrance / exit management server 100, the entrance / exit authentication unit 102 records the user ID, exit date / time, and room name included in the exit information received from the reader 500 in the entrance / exit log table 1011 (S1202). Further, the entrance / exit authentication unit 102 refers to the room master table 1012 and clears the room ID corresponding to the card ID included in the exit information from the card location table 1014 (S1203). Since each process of S1204 to S1213 is the same as each process of S1104 to S1113 shown in FIG. 11, a description thereof will be omitted, and the process after S1214 will be described below.

  In step S <b> 1213, the entrance / exit authentication unit 102 of the entrance / exit management server 100 receives the occupancy check request from the terminal management server 200, transmits the occupancy information to the terminal management server 200, and the account authentication unit of the terminal management server 200. 202 refers to the above-mentioned occupancy information and checks the occupancy of the user (S1214, S1215). For example, the entrance / exit authentication unit 102 reads the entry / exit record of the user recorded in the entry / exit log table 1011, checks which security area at that time has entered or exited from the security area, and As a result of the check, the exit information which is a check result including the room ID, the room name, the exit or absence is output. Actually, as in the case of FIG. 11, the computer ID and the room ID are associated with each other, and which information processing terminal 400 is associated with which security area is associated. The exit information is transmitted to the terminal management server 200, and the account authentication unit 202 of the terminal management server 200 refers to the exit information received from the entrance / exit management server 100 and enters at which security area at that time or exits from the security area. Check if you are doing.

  The account authentication unit 202 of the terminal management server 200 authenticates the user's account by receiving the above-mentioned exit information received from the entrance / exit management server 100 and determining whether the user has exited. The result is notified to the information processing terminal 400 (S1216, S1217). For example, if it is determined that the exit information has been received, the account authentication unit 202 denies authentication (NG) of the user's account and notifies the information processing terminal 400 to that effect.

  When the terminal usage control unit 407 of the information processing terminal 400 receives the account authentication result (NG) from the terminal management server 200, the terminal usage control unit 407 outputs to the control unit 406 an instruction to maintain the inhibition instruction performed in S1210. When the control unit 406 receives the maintenance instruction from the terminal usage control unit 407, the operator of the information processing terminal 400 is in an illegal operation by a third party who is not a valid user. In step S1219, a process of collecting evidence indicating that the operation is illegally performed by a third party is performed.

  As the process of collecting evidence, for example, when the information processing terminal 400 is equipped with a camera, the camera is activated to capture the operator of the information processing terminal 400 and acquire still image data or moving image data. Or a process of collecting voice of the operator and acquiring voice data when a microphone is provided. In the above example, the process of collecting evidence is executed, but the process of forcibly shutting down the information processing terminal 400 may be executed.

  If the account authentication unit 202 of the terminal management server 200 determines that the authentication of the user's account is not permitted (NG) in S1216, the security center 800 is notified that there has been an unauthorized operation via the networks N1 and N3. Information is transmitted (S1220). When the security center 800 receives the notification information, the security center 800 issues an emergency command indicating an instruction to urgently bring the terminal carried by the security guard S to the site, the location of the security area where the unauthorized operation has been performed, and the unauthorized operation. The detailed information such as the time when is performed is transmitted (S1221).

  FIG. 13 is a sequence diagram of the security control process in the case where the reader 500 for entering and leaving the room is provided, and the user leaves the room while entering the security area and starting the information processing terminal 400. Since each process of S1301 to S1303 in FIG. 13 is the same as each process of S1201 to S1203 in FIG. 12, the description thereof is omitted here, and the processes after S1304 will be described.

  If the user leaves the room while the information processing terminal 400 is activated, the same processes as S1121 to S1129 shown in FIG. 11 are executed (S1304 to S1311), and the process proceeds to S1312. In S1312, the terminal use control unit 407 of the information processing terminal 400 transmits an account authentication request to the terminal management server 200 and executes the same processing as the processing from S1213 to S1219, as in S1212 illustrated in FIG. Evidence is collected (S1313 to S1319).

  On the other hand, the account authentication unit 202 of the terminal management server 200 transmits notification information indicating that an unauthorized operation has been performed to the security center 800 via the networks N1 and N3, as in S1220 and S1221, and the security center 800 The emergency command and detailed information are transmitted to the terminal carried by the guard S registered in advance (S1320, S1321).

  As described above, in the first embodiment, when an operation is performed on the information processing terminal used by the user, the user's entry / exit status in the security area is confirmed, and the information processing terminal of the information processing terminal is checked until the user's entry confirmation is obtained. Control is performed to inhibit the operation itself (for example, the login to the OS of the information processing terminal is temporarily suspended and waited). Therefore, even if a third party tries to operate the information processing terminal illegally when the user is not entering the room, the operation is suppressed and resources such as the operation on the information processing terminal 400 and the in-house asset information 300 are included. Can be prevented in advance.

  If the user's entry confirmation cannot be obtained, control is performed to maintain the suspended state in which the operation is suppressed by operation lock or shutdown, and in that case, evidence such as the operator's face image or sound is obtained. Collect and report to the Security Center. Therefore, it is possible to prevent unauthorized operations and unauthorized access as described above, provide information for identifying the operator, and dispatch guards.

  In addition, if a certain period of time has elapsed after the user enters the security area, there is a risk that an unauthorized operation or unauthorized access by a third party may occur. Accordingly, the operation on the information processing terminal 400 is locked or shut down, and at the time of the re-operation, the information processing terminal 400 inputs deterrence release information different from the login information when using the normal information processing terminal 400, As described above, the user's entry / exit status is confirmed. Therefore, even when the user leaves for a long time, it is possible to prevent an unauthorized access to resources such as an operation on the information processing terminal 400 and the in-house asset information 300 by a third party.

(Example 2)
In FIGS. 11 to 13, the case has been described in which both the case where the user enters the security area and the case where the user leaves the security area are recorded in the entry / exit log table using the reader 500 for entering and leaving the room. However, depending on the usage environment of this system, for example, the reader 500 for leaving the room is not provided, and when leaving the security area, the IC card is not placed in the reader 500 and the room leaving information is stored in the entry / exit log table. It may not be recorded. Accordingly, processing in the case where the reader 500 for leaving the room is not provided will be described below.

  FIG. 14 is a sequence diagram of security control processing when a user enters a security area and shuts down the information processing terminal 400 in an environment in which a reader for leaving the room is not provided.

  As shown in FIG. 14, when the user leaves the room, the input unit 403 of the information processing terminal 400 manually receives a shutdown operation from the user (S1401), and executes the shutdown process when the control unit 406 executes the shutdown process. At the same time, detection information indicating shutdown is output to the terminal usage control unit 407 (S1402).

  When the terminal usage control unit 407 receives the detection information from the control unit 400, the terminal usage control unit 407 reads the current time from a timer (not shown) and sets it as the time when the shutdown process is executed. The table 1011 is updated (S1403). For example, the terminal usage control unit 407 regards the time when the shutdown process is executed as the time when the user leaves the room, and records the time when the user exits the entry / exit log table 1011 corresponding to the user ID of the user.

  Since each process of S1404 to S1415 in FIG. 14 is the same as each process of S1201 to S1215 in FIG. 12, the description thereof is omitted here, and the processes after S1416 will be described.

  The account authentication unit 202 of the terminal management server 200 receives the occupancy information received from the entrance / exit management server 100 and determines whether or not the corresponding user has left the room. In this example, the entry / exit log table 1011 stores the exit information updated in S1413. Therefore, the account authentication unit 202 receives the exit information from the entrance / exit management server 100, and the user exits the room. It is determined that The account authentication unit 202 further authenticates the user's account by referring to the attendance master table 2012 in order to confirm whether or not the user's actual entry / exit is consistent, and the result is processed into the information processing terminal 400. (S1416, S1417, S1422).

  For example, if the account authentication unit 202 determines that the above-mentioned leaving information has been received, the account authentication unit 202 further refers to the attendance master table 2012 to determine whether the date and time included in the leaving information indicates that the user is within working hours. judge. If the account authentication unit 202 determines that the user is not within working hours, the account authentication unit 202 determines that the operator of the information processing terminal 400 is being illegally operated by a third party who is not a valid user, and the user The authentication of the account is not permitted (NG), and that is notified to the information processing terminal 400 (S1417). Thereafter, in the information processing terminal 400, processing similar to S1218 and S1219 is executed, and evidence is collected. In this case, similarly to S1220 and S1221, the notification information is transmitted to the security center 800, and the emergency command and detailed information are transmitted from the security center 800 to the terminal carried by the security guard S registered in advance (S1420). , S1421).

  On the other hand, if the account authentication unit 202 determines that the departure date / time included in the leaving information is within the above time, the account authentication unit 202 executes the same processing as S1417 to S1419 (S1422 to S1424).

  FIG. 15 is a sequence diagram of security control processing when a user enters a security area and leaves the information processing terminal 400 while the information processing terminal 400 is activated in an environment in which a reader for leaving the room is not provided. Since each process of S1501 to S1515 in FIG. 15 is the same as each process of S1301 to S1315 in FIG. 13, the description thereof is omitted here, and the processes after S1516 will be described.

  In S1516, as in S1416 shown in FIG. 14, the account authentication unit 202 of the terminal management server 200 receives the occupancy information received from the entry / exit management server 100 and determines whether or not the corresponding user has left the room. Further, the user's account is authenticated by referring to the attendance master table 2012 (S1516). Thereafter, processing is executed according to the authentication result. For example, when the account authentication unit 202 determines that the occupancy information has been received, the account authentication unit 202 further refers to the attendance master table 2012, and whether the entry date and time included in the occupancy information is within the working hours. Determine whether. If the account authentication unit 202 determines that the user is not within working hours, the account authentication unit 202 determines that the operator of the information processing terminal 400 is being illegally operated by a third party who is not a valid user. The same processing as each processing from S1417 to S1421 is executed (S1517 to S1521).

  On the other hand, if it is determined that the user is within working hours, the account authentication unit 202 determines that the operator of the information processing terminal 400 is a valid user, authenticates (OK) the user's account, and The result is notified to the information processing terminal 400 (S1522). Thereafter, processing similar to that after S1119 in FIG. 11 is executed (S1523, S1524). In this case, considering the residual risk, each process of S1522 to S1524 may be executed after each process of S1130 to S1132 of FIG. 11 is executed as in the case of FIG.

  As described above, in the second embodiment, the time when the user manually shuts down the information processing terminal himself / herself is left even when the user in the environment where the reader for leaving the room does not perform the leaving process. It is regarded as the time and written in the entry / exit log table, and the attendance information is confirmed by checking the attendance information. Therefore, it is possible to reliably grasp the user's entry / exit status and prevent an unauthorized operation of the information processing terminal by a third party. Further, erroneous reporting to the security center can be suppressed as compared with the case where the user's attendance status is not confirmed.

  In this embodiment, the terminal usage control unit 407 of the information processing terminal 400 accesses the entry / exit management server 100 to update the entry / exit log table 1011. However, as another example, the entry / exit log table 1011 is provided in the terminal management server 200, or is provided in a device other than the entry / exit management server 100 or the terminal management server 200, and the terminal usage control unit 407 is stored in these. The entry / exit log table 1011 may be updated. With this configuration, the present system can be configured more flexibly according to the environment to which the present system is applied.

(Example 3)
In each sequence described so far, the entrance / exit management server 100 manages the entrance / exit status of the user. However, it is possible to obtain a similar effect at a low cost by adopting a simple configuration using a portable terminal without providing the entrance / exit management server 100. Hereinafter, processing in such a case will be described.

  FIG. 16 is a sequence diagram of the security control process when the user enters the security area through wireless communication and starts using the information processing terminal 400. As illustrated in FIG. 16, when a wireless communication connection is established between the mobile terminal 700 and the wireless connection device 600 (S1601), the control unit (not illustrated) of the mobile terminal 700 establishes the wireless connection unit 701 of the mobile terminal 700. Then, a connection check request for wireless communication with the wireless connection device 600 is output to the control unit of the portable terminal 700 (S1602). Actually, for example, the wireless communication function by Wi-Fi is turned on, and a request for confirming whether or not a predetermined radio wave intensity is detected is output.

  The control unit of the portable terminal 700 outputs to the wireless connection unit 701 that the connection between the portable terminal 700 and the wireless connection device 600 has been detected (S1603). The wireless connection unit 701 has its own mobile ID, the connection device ID of the wireless connection device 600 obtained from the wireless connection device 600 by the connection, and the wireless connection obtained from the timer (not shown) of the control unit. The connection time with the device 600 and the user identification information registered in the portable terminal 700 are transmitted to the entrance / exit management server 100 as room entry information (S1604).

  When the entry / exit authentication unit 102 of the entry / exit management server 100 receives the entry information from the portable terminal 700, the entry / exit log table 1011 corresponding to the user ID of the portable terminal 700 connected to the connected device with the connected device ID is entered. Information is updated (S1605). For example, the entry / exit authentication unit 102 records the connection time at the entry date / time of the entry / exit log table 1011 corresponding to the same user ID as the user ID included in the entry information.

  After that, when processing similar to each processing from S1104 to S1112 in FIG. 11 is executed (S1606 to S1614), the account authentication unit 202 of the terminal management server 200 is similar to the processing from S1513 to S1515 in FIG. The process is executed and the user's account is authenticated (S1615).

  Since the account authentication unit 202 receives the occupancy information from the entry / exit management server 100, the account authentication unit 202 regards the user as having entered the room, authenticates (OK) the user's account, and processes the result as information processing. The terminal 400 is notified (S1616, S1617). Thereafter, the same processing as that after S1119 in FIG. 11 is executed.

  FIG. 17 is a sequence diagram of the security control process when the user leaves the room in the security control process shown in FIG. As illustrated in FIG. 17, the wireless connection unit 701 of the mobile terminal 700 performs the same processes as S1601 to S1603 illustrated in FIG. 16, and the mobile terminal 700 and the wireless connection device 600 perform wireless communication with each other. It is determined whether or not connection is possible (S1701 to S1703).

  When the wireless communication connection cannot be established between the portable terminal 700 and the wireless connection device 600 in S1701, the control unit of the portable terminal 700 indicates that the connection between the two is disconnected in S1703. To 701. The wireless connection unit 701 disconnects its own mobile ID, the connection device ID of the wireless connection device 600 that has been disconnected, and the wireless connection device 600 that is obtained from a timer (not shown) of the control unit. The time and the user identification information registered in the portable terminal 700 are transmitted to the entrance / exit management server 100 as exit information (S1704).

  When the entrance / exit authentication unit 102 of the entrance / exit management server 100 receives the exit information from the mobile terminal 700, the entrance / exit authentication unit 102 of the entrance / exit log table 1011 corresponding to the user ID of the mobile terminal 700 disconnected from the connected device of the connected device ID. The leaving information is updated (S1705). For example, the entrance / exit authentication unit 102 records the disconnection time as the exit date / time of the entrance / exit log table 1011 corresponding to the same user ID as the user ID included in the exit information.

  Thereafter, when processing similar to each processing from S1204 to S1212 in FIG. 12 is executed (S1706 to S1714), the account authentication unit 202 of the terminal management server 200 is similar to the processing from S1413 to S1415 in FIG. The process is executed and the user's account is authenticated (S1715).

  Since the account authentication unit 202 has received the exit information from the entrance / exit management server 100, the account authentication unit 202 regards the user as having left the room, authenticates the user's account (NG), and displays the result as the information processing terminal 400. (S1716, S1717). Thereafter, processing similar to that after S1219 in FIG. 12 is executed.

  As described above, in the third embodiment, when confirming the user entry / exit status in the security area, even when a computer such as an entry / exit management server is not provided, between the mobile terminal used by the user and the wireless connection device, It is determined whether the connection state is connected or disconnected, and the time is regarded as a room entry time or a room exit time, written in the entry / exit log table, and the user entry / exit status is confirmed. Therefore, the same effects as described above can be obtained with a simple configuration as compared with the case where the computer is provided. Further, the same effect as in the second embodiment can be obtained even in a situation where a user in an environment in which no reader for leaving the room is provided leaves the room without performing the leaving process.

  In this embodiment, the terminal usage control unit 407 of the information processing terminal 400 accesses the entry / exit management server 100 to update the entry / exit log table 1011. However, the entrance / exit log table 1011 is provided on the terminal management server 200 side, or provided in other devices other than the entrance / exit management server 100 and the terminal management server 200, and the terminal usage control unit 407 stores the entrance / exit log stored therein. The table 1011 may be updated. By adopting such a configuration, the same effect as in the second embodiment can be obtained.

  Each process executed by each of the above servers and terminals is actually realized by executing a program installed in these servers and terminals. The program is provided by being pre-installed in a ROM or the like, or a computer-readable recording medium such as a CD-ROM, CD-R, or DVD (Digital Versatile Disk) in an installable or executable format file. It may be recorded and provided or distributed. Furthermore, the program may be provided or distributed by storing it on a computer connected to a network such as the Internet and downloading it via the network.

  Although the present embodiment has been specifically described above, the present invention is not limited to this embodiment, and can be appropriately combined and executed without departing from the gist thereof. For example, the entrance / exit management server 100, the terminal management server 200, and the in-house information asset 300 are configured as one server according to the scale of the system, or a user who uses the attendance master table shown in FIG. 14 and FIG. The attendance determination and the account authentication may be applied to the sequences shown in FIGS. 16 and 17 and executed.

  In each of the above-described embodiments, a room such as an office has been described as an example of a security area. However, the present invention is not limited to this, and the present invention can be applied to managing entry / exit to an outdoor security area. Further, the names of the tables shown in the above embodiments are merely examples, and other names may be given. For example, instead of the entrance / exit log table 1011, the entrance / exit management table 1011 or the out-of-room management table may be referred to.

1000 Information security system 100 Entrance / exit management server 101 Storage unit 1011 Entrance / exit log table 1012 Card location table 1013 Card master table 1014 Card location table 102 Entrance / exit authentication unit 103 Communication unit 104 Control unit 200 Terminal management server 201 Storage unit 2011 User account Table 2012 Time attendance table 2013 Time table 2014 Wireless connection device master table 2015 Terminal location table 202 Account authentication unit 203 Communication unit 204 Control unit 300 Internal information asset 3001 Directory service 3002 File server 3003 DB (Data Base) server 3004 Core system 400 Information Processing terminal 401 Storage unit 402 Display unit 403 Input unit 404 Input / output processing unit 405 Communication unit 406 Control unit 407 End Use controller N1~N3, X network.

Claims (14)

An information security system having a management server for managing an information processing device used by a user in a security area,
The information processing apparatus includes:
A receiving unit that receives an operation on the information processing apparatus;
The processing performed by the information processing apparatus is stopped based on the operation received by the reception unit to suppress the operation, and the user enters the security area based on the user entry / exit information in the security area. An account authentication request for determining whether or not the account authentication request is sent to the management server, and if the authentication result in response to the account authentication request is authentication permission, the processing performed by the information processing apparatus is permitted, A use control unit that maintains the suspension of the processing performed by the information processing apparatus that has been suspended when the authentication result for the authentication request is authentication disapproval,
The management server
Based on the account authentication request received from the information processing apparatus and the user's entry / exit information with respect to the security area, account authentication is performed to determine whether or not the user has entered the security area. and, it transmits the authentication result to the information processing apparatus, if the authentication result is not permitted met account authentication unit transmits the report information to the effect that there was a manipulation through a network to an external And determining whether or not the entry / exit information is exit information, and determining that the entrance / exit information is exit information, the user works based on an attendance table storing the attendance information of the user. The account authentication that determines whether it is within time and transmits the notification information to the outside when it is determined that the user is not within working hours And,
An information security system comprising: The usage control unit of the information processing apparatus determines whether or not a certain period of time has passed since an operation on the information processing apparatus is not accepted, and suppresses the operation when it is determined that the certain period of time has elapsed. Then, the user is authenticated based on the suppression cancellation information for canceling the suppression of the operation, and when the user can be authenticated, the account authentication request is transmitted to the management server.
The information security system according to claim 1. The usage control unit of the information processing apparatus executes a process of collecting evidence indicating that a third party is illegally accessing when the authentication result is an authentication non-permission,
The information security system according to claim 1. The usage control unit of the information processing apparatus stops access to information to be a security target connected to the information processing apparatus via a network by canceling the operation performed by the information processing apparatus and suppressing the operation. Restrict,
The information security system according to claim 1. The usage control unit of the information processing apparatus determines whether the entry / exit information is presence information. If the use control unit determines that the entry / exit information is presence information, the usage control unit further includes the presence / absence information in the mobile terminal of the user. Processing to be performed by the canceled information processing apparatus when transmitting presence confirmation information for confirming the state and receiving an authentication result indicating that the user is authenticated from the portable terminal Tolerate,
The information security system according to claim 1. When it is determined that the user is within working hours, the usage control unit of the information processing apparatus further transmits presence confirmation information for confirming the presence state to the user's portable terminal, from the portable terminal When the authentication result indicating that the user is authenticated as a valid user is received, the processing performed by the stopped information processing apparatus is permitted.
The information security system according to claim 1 . An entry / exit management server having an entry / exit management table for managing entry / exit information for the security area, wherein the entry / exit management server includes user information for identifying a user read by a reader provided in the security area; Based on registered user information, information on entry / exit of the user into the security area is stored in the entry / exit management table,
The account authentication unit of the management server determines whether or not the user has entered the security area based on the entrance / exit information stored in the entrance / exit management table.
The information security system according to claim 1. An entry / exit management server that manages entry / exit information indicating the entry / exit status of the security area, an information processing device used by a user in the security area, and a management server that manages the use status of the information processing device An information security system,
The information processing apparatus includes:
A receiving unit that receives an operation on the information processing apparatus;
Whether processing by the information processing apparatus is stopped based on the operation received by the reception unit to suppress the operation, and whether the user has entered the security area based on user entry / exit information in the security area An account authentication request for determining whether or not is sent to the management server, and if the authentication result for the account authentication request is authentication permission, the processing performed by the information processing apparatus is permitted, and authentication for the account authentication request is performed. A use control unit that maintains the suspension of the processing performed by the information processing apparatus when the result is authentication non-permission,
The management server
Based on the account authentication request received from the information processing apparatus and the user's entry / exit information with respect to the security area, execute account authentication for determining whether the user has entered the security area, The account authentication unit that transmits the authentication result to the information processing apparatus and transmits notification information indicating that an unauthorized operation has occurred via the network when the authentication result is not permitted, And when the said account authentication part determines whether the said entrance / exit information is exit information, and when it determines with the said entrance / exit information being exit information, it is further in the attendance table where the user's attendance information was memorize | stored. If it is determined whether the user is within working hours based on the determination that the user is not within working hours, the notification information is transmitted to the outside,
The entrance / exit management server has an entrance / exit management table for registering user entrance / exit information,
Based on user information for identifying a user acquired by a reader installed in the security area and registered user information registered in advance, information indicating entry of the user into the security area is managed in the entrance / exit management. Record on the table,
The usage control unit of the information processing apparatus is detection information indicating that the reception unit of the information processing apparatus has received a shutdown operation and executed shutdown, and is based on the detection information including the time of the shutdown , Record the shutdown time in the management table as exit information,
The account authentication unit of the management server authenticates the user based on the exit information recorded in the entrance / exit management server and the attendance information of the user.
An information security system characterized by this. An entry / exit management server having an entry / exit management table for managing entry / exit information for the security area, a portable terminal capable of wireless communication used by the user, and a wireless connection provided corresponding to the security area With equipment,
When the connection between the mobile terminal and the wireless connection device is established or disconnected, the mobile terminal is configured to identify the wireless connection device, the mobile terminal, and the mobile terminal user. A wireless connection unit for transmitting information and the time of connection or disconnection to the entrance / exit management server as entrance information or exit information;
The entry / exit management server is configured to input information about entry / exit of the user into the security area based on user information for identifying a user read by a reader installed in the security area and registered user information. Store in the exit management table, record the entrance information or the exit information received from the mobile terminal in the entrance / exit management table, and notify the management server of the record,
The account authentication unit of the management server determines whether the user has entered the security area based on the entrance information or the exit information received from the entrance / exit management server,
The information security system according to claim 1. The entry / exit management server includes, as the entry / exit information, user identification information for identifying the user, entry / exit time indicating entry / exit time to / from the security area, and room identification information for identifying the security area. And an entry / exit management server storage unit that stores an entry / exit management table in association with
The management server includes a management server storage unit that stores account information for storing the user account, the user identification information, and information processing apparatus identification information for identifying the information processing apparatus in association with each other. Prepared,
The account authentication unit of the management server stores the account authentication request received from the information processing apparatus, the entry / exit information of the entry / exit management table received from the entry / exit management server, and the management server storage unit Performing account authentication to determine whether or not the user has entered the security area based on the account information
The information security system according to claim 7 . The management server associates the user account, the user identification information, the portable terminal identification information for identifying the portable terminal, and the information processing apparatus identification information for identifying the information processing apparatus. Account information to be stored, wireless device identification information for identifying the wireless connection device, and wireless connection device master table that stores room identification information for identifying the security area in association with each other, and the mobile terminal identification information And a management server storage unit that stores a terminal location table that stores and stores room identification information for identifying the security area,
The account authentication unit of the management server is based on the mobile terminal identification information received from the mobile terminal, the account information stored in the management server storage unit, the wireless connection device master table, and the terminal location table. Determining whether the user is entering the security area;
The information security system according to claim 9 . An accepting step for accepting an operation on an information processing device used by a user in a security area;
A suppression step of stopping the operation by stopping the processing performed by the information processing apparatus based on the accepted operation;
A first transmission step of transmitting to the management server an account authentication request for determining whether or not the user has entered the security area based on the user entry / exit information in the security area;
Based on the account authentication request received from the information processing apparatus and the user's entry / exit information with respect to the security area, account authentication is performed to determine whether or not the user has entered the security area. In the execution step , it is determined whether or not the entrance / exit information is exit information, and when it is determined that the entrance / exit information is exit information, the user is based on the attendance table in which the attendance information of the user is stored. Performing the account authentication by determining whether is within working hours,
A second transmission step of transmitting an authentication result for the account authentication request to the information processing apparatus;
When the authentication result is authentication permission, the process performed by the stopped information processing apparatus is allowed, and when the authentication result is authentication not permitted, the process performed by the stopped information processing apparatus is maintained. Use control steps to
A third transmission step of transmitting, to the outside, report information indicating that an unauthorized operation has occurred via the network when the authentication result is not permitted;
An information security method comprising: Based on user information for identifying a user read by a reader provided in the security area and registered user information, information on entry / exit of the user into the security area is input / output information for managing the entry / exit information. Including a recording step of storing in the exit management table;
In the execution step, based on the entrance / exit information stored in the entrance / exit management table, it is determined whether the user has entered the security area,
The information security method according to claim 12 . A connection establishment step for establishing a connection between a mobile terminal capable of wireless communication used by the user and a wireless connection device provided in the security area;
When the connection is established or the connection is disconnected, the identification information of the wireless connection device, the identification information of the portable terminal, the identification information of the user of the portable terminal, and the connection time or the disconnection time are entered information or A fourth transmission step of transmitting to the entrance / exit management server that manages entrance / exit information for the security area as exit information;
Based on user information for identifying a user read by a reader provided in the security area and registered user information, the entry / exit management table storing information on entry / exit of the user into the security area, A recording step of recording the entrance information or the exit information received from the mobile terminal;
Notifying the management server of the record,
In the execution step, based on the entrance information or the exit information received from the entrance / exit management server, it is determined whether or not the user has entered the security area.
The information security method according to claim 12 .

Images