JPH07219899A - Method for setting program execution authority - Google Patents

Abstract

PURPOSE:To judge the last 'propriety of work job execution by a work job executing computer which controls a program and a data set for executing a work job with the respectively independent at control of a client being the work job execution client at every computer center in a multiprocessing system having a communication means between respective computers, which is constituted of plural geographically decentralized computers. CONSTITUTION:A work job execution request source computer 1 is provided with a user register book T indicating the correspondence of a user ID and a group ID 8 to an authority kind 9 and ID of the computer itself and the obtained authority kind 9 are added to a work job at the time of requesting the execution of the work job. An execution computer 2 retrieves an execution authority descripting library 10 which controls an authority level 14 at every execution program name and at every data set name 1 1 by the added computer ID 12 and authority kind 13.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a composite computer system having a communication means among computers composed of a plurality of geographically distributed computers, and the execution program management computer makes the final judgment as to whether or not a business job can be executed. The present invention relates to a management method for centrally managing a job job execution computer, and more particularly to a method for managing whether or not to permit program execution without performing duplicate management of individual submitters in each computer.

[0002]

2. Description of the Related Art When the range of submitters who use a computer system is limited to the persons in charge in the computer center, for example, unfair work is performed by, for example, locking the room in which the computer system is installed. Job execution can be prevented. However, if the range of submitters expands from inside the computer center to outside the computer center, and it becomes possible to instruct execution of business jobs from a remote location via communication means, for example, a physical method such as a key for the installation location. Does not prevent the unjust execution of business jobs.

In order to prevent the improper execution of a business job, a system for identifying the business job execution requester and judging whether or not the job can be executed is required. Specifically, it has a list of submitter identifiers called user IDs that can be executed and accessed for each program executed in a business job and each data set used in a business job, and a list of authority levels for the corresponding program or data set. Prior to executing a business job, it is determined whether or not the submitter has the authority required to execute the business job. A known example of a method for preventing unfair job job execution by having a list of user IDs and authority levels for each program and data set is "VOS3 / AS".
TRUST E2 Description, Hitachi HITAC Manual, 6180-3-326 ”. The user ID, which is the identifier of the submitter, is generally protected by a password or the like to prevent the user ID from being used by another person.

User ID for each program and data set
The method of preventing unreasonable business job execution by having a list of authority levels can be applied if there are multiple computers that execute business jobs as long as there is a communication means or data sharing means between each computer. . In other words, the list of user IDs and authority levels for each program or data set is stored in the library, and if the library is shared by multiple computers or geographically separated, the contents of the library held by each computer can be changed. On the other hand, by synchronizing the computers via the communication means, it is possible to determine whether or not the business job can be executed by the business job execution computer and prevent the improper execution of the business job.

[0005]

However, even for computer jobs that have been operating independently at a plurality of computer centers, if a plurality of computer centers are connected by communication means and job jobs are requested to be mutually executed, In the above method of providing a library storing a list of user IDs and authority levels for each program or data set for each computer center, it is possible to prevent duplication of user IDs between computer centers and synchronize library updates. It becomes complicated and a lot of work.

An object of the present invention is to independently manage user IDs for each computer center, eliminate the need for synchronization with library updates, and determine the final approval / disapproval of execution of a business job. It is to provide a means to do with the computer which possesses.

[0007]

In order to achieve the above object, according to the program execution authority setting method of the present invention, a job job execution request source computer that manages an execution requester has a user ID, which is the ID of the execution requester. Alternatively, it has a user registry that stores a list of authorities classified by group ID, which is the ID of the group to which the submitter belongs, and allows the business job execution computer to execute each program or data set held by the business job execution computer. An execution right description library that stores a list of requesting computer IDs, authority types, and authority levels is provided.

When the business job execution request source computer receives a business job execution instruction from the submitter, after confirming the validity of the submitter, whether or not the business job instructed to execute is processed by its own computer. To judge. As a result, when it is determined that the processing is to be performed by another computer, the user is referred to the user registry to obtain the authority classification based on the user ID of the submitter or the group ID of the group to which the submitter belongs, and the job ID is assigned to the business job. A requesting computer ID and a privilege type are added and transmitted to the business job executing computer. Here, the authority classification is a code of the authority of the submitter.

When the business job execution computer receives from the requesting computer a business job to which a computer ID and authority classification have been added, the execution right description library for each program instructed to be executed by the business job and for each data set instructed to be accessed. Is searched based on the computer ID and the authority classification. By referring to the authority level obtained as a result, it is determined whether or not the business job can be executed. Here, the authority level indicates whether or not the program can be executed, whether or not the program can be changed, and indicates whether or not the data set can be referenced or updated.

If the computer ID in the execution right description library provided in the business job execution computer and the type of authority are combined and replaced with a user ID or a group ID, the own computer when the execution request source computer and the business job execution computer are the same. In the case of processing by, the business job execution availability can be determined by referring to the execution right description library.

[0011]

According to the program execution authority setting method of the present invention, when a business job execution request source computer, which is a management source of a submitter, requests a business job execution computer to execute a business job, a computer ID and authority classification are added. Since the business job execution computer determines whether or not the business job can be executed based on the computer ID and the type of authority, the management of each individual submitter is closed to the business job execution source computer. That is, since the user ID management for each computer center can be made independent, it is not necessary to synchronize the update of the user register among the computer centers. Further, the business job execution computer can make a final determination as to whether or not the business job can be executed by using the computer ID of the business job execution request source and the type of authority.

[0012]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS FIG. 1 is a block diagram of a compound computer system to which the program execution authority setting method of the present invention is applied. The composite computer system to which the program execution authority setting method of the present invention is applied is composed of a plurality of geographically dispersed computers,
The request source computer 1 that manages the job job requester and the program library 3 including the program to be executed and the job job execution computer 2 that holds and manages the data 4 to be used can be classified into the request source computer 1 and the request source computer 1. A communication means 5 such as a line is provided between the execution computers 2.

When the request source computer 1 receives a request for execution of a business job from an input device such as a TSS terminal, an electronic mail terminal, or a console, it identifies the execution requester, and the user ID or execution requester who is the execution requester's ID. Based on the group ID which is the ID of the group to which the user belongs, the user registration list 7 is searched for the authority classification, and then the ID of the own computer and the requested authority classification are added to the accepted job job, and the communication means 5 is added. To request the execution computer 2 to execute the business job. Here, the user registration list 7 is a registration list for managing user IDs, and includes correspondence information between user IDs or group IDs 8 and authority categories 9.

When the execution computer 2 receives a job job execution request from the requesting computer 1, the execution computer 2 asks for the name of the program or data set used in the job, determines whether the job can be executed, and if the job can be executed, the job is executed. Execute and return statistical information such as the result and execution time to the requesting computer 1.
The execution right description library 10 managed by the execution computer 2 is used to determine whether or not the execution is possible. The execution right description library 10 is provided with the correspondence information of the level 14 of the authorized authority corresponding to the combination of the computer ID 12 and the authority category 13 for each program name or data set name 11.

The authority level indicates the level of authority such as execution propriety or change possibility in the case of a program, and the level of authority such as input possibility or update in the case of a data set. In other words, the execution permission / inhibition determination is based on a list obtained by searching the execution right description library 10 based on the execution program name and the used data set name obtained from the requested business job, and the computer ID 12 and authority classification sent from the requesting computer. This is realized by obtaining the authority classification 14 by performing a search again using 13 and judging based on the content of the authority level.

FIG. 2 is a processing flowchart of the request-source computer 1 that requests the execution of a business job in the multi-functional computer system to which the program execution authority setting method of the present invention is applied. When the requesting computer 1 starts the system of the present invention, first, in a processing block 15, a request such as a job execution request to the system is awaited. When a request to the system occurs, processing blocks 16 to 18 identify the contents of the request,
Move on to the processing corresponding to the requested content. When it is determined in the processing block 18 that the job execution request has been received, the contents of the received job are confirmed in the processing block 19 to determine the computer that executes the job and to identify the job execution requester. Next, based on the user ID or group ID obtained in the processing block 19, the user register 7 is searched in the processing block 20 to obtain the authority classification 9. If the user ID or group ID is not in the user registry, it is determined that the job execution request is from an unauthorized user, and job execution is suppressed. When the authority classification 9 is requested in the processing block 20, the ID of the own computer and the requested authority classification 9 are added to the job accepted in the processing block 21, and the processing block 1
After sending to the execution computer 2 obtained in step 9, processing block 1
Return to 5 and wait for the next request. When it is determined that the job execution completion is accepted from the execution computer 2 in the processing block 17,
After the execution result and statistical information of the job sent from the execution computer 2 are recorded in the processing block 22, the processing block 2
In step 3, the job execution requester is notified of job completion, and the process returns to processing block 15. The processing block 16
When it is determined that the request received in step S3 is a system stop, the system is terminated.

FIG. 3 shows a processing flowchart of the execution computer 2 for executing the requested business job in the multi-function computer system to which the program execution authority setting method of the present invention is applied.

When the execution computer 2 starts the system of the present invention, a processing block 24 first waits for a request such as a job execution request from the requesting computer 1 to the system. When a request to the system occurs, the processing contents are identified in processing blocks 25 to 27, and the processing corresponding to the requested contents is performed. When it is determined in the processing block 27 that the job execution request from the requesting computer 1 has been received, the processing block 28 confirms the content of the received job and obtains the program name to be executed by the job and the data set name to be used.

Next, in processing block 29, the execution right description library 10 is searched by using the program name, the data set name obtained in processing block 28, and the computer ID and authority classification sent from the requesting computer, and the authority level is searched. After determining 14, the process block 30 determines whether or not it has the authority to execute. The processing of the processing blocks 29 and 30 is executed for all programs and data sets designated by the job.

When it is judged in the processing block 30 that all programs and data sets designated by the job can be executed, the requested job is transferred to the execution queue in the processing block 31, and then the processing returns to the processing block 24. , Wait for the next request to the system. If the processing block 30 determines that the job cannot be executed, the processing block 32 informs the requesting computer that the job cannot be executed, and then the process returns to the processing block 24. When it is determined in the processing block 26 that the execution completion of the job registered in the execution queue has been accepted, the processing block 33 transmits the statistical information such as the job execution result and the processing time to the requesting computer 1, and then the processing block Return to 24. When it is determined that the request received in processing block 25 is the system stop, the system is terminated.

Although the request source computer 1 and the executing computer 2 are described as different cases in this embodiment, the request source computer 1
When the execution computer 2 and the execution computer 2 are the same, it can be realized simply by eliminating the need for communication between the computers. In this case, it can be realized without once requesting the authority classification from the user ID or the group ID. That is, the computer ID 12 in the execution right description library 10
And the field of authority classification 13 may be combined to be a description field of a user ID or a group ID.

[0022]

As described above, according to the present invention, the management of each submitter closes to the job job request source computer, so that the management work of the submitter, that is, the maintenance of the user register, can be performed independently for each computer. It is not necessary to synchronize with the update of the user register of another computer center. In addition, the business job execution computer that manages the programs and data sets can make a final determination as to whether or not the business job can be executed without being aware of the individual requesters. It should be noted that in the business job execution computer, billing tasks such as invoicing bills can be performed for each computer center by totalizing the status of business job execution for each computer ID.

[Brief description of drawings]

FIG. 1 is a block diagram of a compound computer system to which a program execution right setting method of the present invention is applied.

FIG. 2 is a processing flowchart of a request source computer.

FIG. 3 is a processing flowchart of an execution computer.

[Explanation of symbols]

1 ... Request source computer, 2 ... Execution computer, 3 ... Program library, 4 ... Data, 5 ... Communication means, 6 ... Input device,
7 ... User directory, 8 ... User ID / Group ID, 9
... By authority type, 10 ... Execution right description library, 11 ... Program name / dataset name, 12 ... Computer ID, 13 ...
By authority type, 14 ... Authority level.

 ─────────────────────────────────────────────────── ─── Continuation of the front page (72) Inventor Toshio Hirosawa 1-280, Higashi Koikeku, Kokubunji, Tokyo, Central Research Laboratory, Hitachi, Ltd. (72) Inventor Tsutomu Ito 1-280, Higashi Koikeku, Kokubunji, Tokyo Hitachi, Ltd. Central Research Laboratory (72) Inventor Motohide Kunizai 1-280 Higashi Koigokubo, Kokubunji City, Tokyo Hitachi Ltd. Central Research Laboratory (72) Inventor Tadashi Yamagishi 5030 Totsuka-cho, Totsuka-ku, Yokohama-shi, Kanagawa Hitachi Ltd. Software Development Division

Claims (3)

[Claims] 1. Comprised of a plurality of geographically distributed computers,
In a complex computer system having a communication unit for exchanging business jobs to be executed between the computers,
A job job execution computer that has a program designated to be executed by a business job, with each computer equipped with a means for referring to and updating the list of authority types given to each computer center A program execution authority setting method comprising an execution authority description library for determining whether or not execution is possible for a requesting computer. 2. The claimant in claim 1, wherein the list of submitters and authority classifications provided for each computer is I of the submitter.
D or the ID of the group to which the submitter belongs and the correspondence of the authority type are provided to determine the authority type for the job job submitter, and the job job ID of the requesting computer
And the permission type are added and sent to the business job execution computer,
A program execution authority setting method for determining whether or not a business job can be executed by a business job execution computer that manages an execution program based on the requesting computer ID and authority type. 3. The execution right description library for determining whether or not the business job execution computer can execute the program according to claim 2, wherein the ID and authority classification of the request source computer for which execution is permitted for each program or data set. A program execution authority setting method having a list of authority levels.