JP2000163149A - Execution managing system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To limit illegal use and to reduce the work of a system manager by transferring execution indication data to an execution means only when the execution of an application is permitted based on reference data. SOLUTION: A permission condition input means 102 inputs permission condition data 107 on a condition permitting the execution of an application. An execution instruction reception means 104 receives execution instruction data instructing the execution of the application. A permission condition reference means 103 executes reference based on execution instruction data and permission condition data 107 and generates collating data showing whether the execution of the application is permitted or not. An execution indication transfer means 105 transfers the application or execution indication data to the execution means only when the application is permitted based on collating data. A non-permission display means 106 displays that the execution of the application is not permitted on a screen in the case.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention belongs to the technical field of computer systems. In particular, it belongs to a technical field in which a predetermined restriction is imposed on the operation of a computer system in order to prevent unauthorized use.

[0002]

2. Description of the Related Art In computer systems, in particular,
2. Description of the Related Art In a computer system that allows a user to connect to a network and use a logon, in order to prevent destruction of environment settings, restrictions are imposed on file use. For example, in Windows, which is an operating system (OS) of Microsoft Corporation, attributes such as “read only”, “hidden file”, “archive”, and “system” are set for a file. In addition, the attribute of “share” or “not share” is set for the holder or the file. In the case of sharing, attributes such as "read only", "full access", "distinguish by password" and the like are set as types of access rights, and a password is set. .

[0003]

However, in such a conventional system, the use of each user is restricted only within a very limited range for existing files. For this reason, it is possible to restrict the use of conscientious users, but it is not possible to prevent the contents of the file from being tampered with by a user impersonating a system administrator or the like. In addition, there is a possibility that an application having a problem such as a computer virus that has not been authorized by a system administrator may be installed. In general, unauthorized use is likely to occur easily on holidays or at night when the system administrator is absent and monitoring is not perfect. However, the user can be restricted in use, but not the time period. Therefore, it is impossible to prevent the destruction of the environment settings of the computer system and the invasion of computer viruses due to unauthorized use.

Accordingly, an object of the present invention is to limit the use of applications that may have a problem, such as on holidays or at night when the system administrator is absent and monitoring is not possible. It is an object of the present invention to provide an execution management system which can perform the management of the environment of a computer system and can reduce the work of a system administrator.

[0005]

The above objects are achieved by the present invention described below. That is, the execution management system according to claim 1 of the present invention comprises: permission condition input means for inputting permission condition data relating to a condition for permitting execution of an application; and execution instruction receiving means for receiving execution instruction data for instructing execution of the application. Permission condition collating means for performing collation based on the execution instruction data and the permission condition data to generate collation data as to whether execution of the application is permitted, and executing the application based on the collation data And execution instruction delivery means for delivering the execution instruction data to the application or the execution means thereof only when is permitted.

According to the present invention, permission condition data relating to a condition for permitting execution of an application is input by the permission condition input means, execution instruction data for instructing execution of the application is received by the execution instruction receiving means, and permission condition collation is performed. Means for performing collation based on the execution instruction data and the permission condition data to generate collation data indicating whether or not execution of the application is permitted, and execution instruction delivery means for executing the application based on the collation data. The execution instruction data is delivered to the application or its execution means only when the execution is permitted. That is, the execution of the application can be restricted by the description of the permission condition data. Therefore, there is provided an execution management system which can provide restrictions on unauthorized use and can reduce the work of the system administrator.

According to a second aspect of the present invention, in the execution management system according to the first aspect, the permission condition data includes time limit data relating to a time zone in which execution of the application is permitted. It is. According to the present invention, the execution of an application can be restricted by the time restriction data. Therefore, it is possible to restrict use on holidays, nights, and the like where the system administrator is absent and monitoring is not perfect.

According to a third aspect of the present invention, there is provided the execution management system according to the first or second aspect, wherein the permission condition data includes registration data in which an application whose execution is permitted is registered. It is. According to the present invention, execution of an application can be restricted by registration data. Therefore, it is possible to restrict installation or activation of an application that may have a problem.

According to a fourth aspect of the present invention, there is provided the execution management system according to any one of the first to third aspects, wherein execution of the application is not permitted based on the collation data. This is provided with a non-permission display means for displaying the fact on the screen. According to the present invention, when the execution of the application is not permitted based on the collation data by the non-permission display means, the fact is displayed on the screen.

The execution management system according to a fifth aspect of the present invention is the execution management system according to any one of the first to fourth aspects, wherein the execution of the application is performed by activating the installed application and executing the application.
And installation of the application. According to the present invention, it is possible to restrict both the installation of an application and the activation of an installed application.

According to a sixth aspect of the present invention, there is provided an execution management system, comprising: permission condition input means for inputting permission condition data relating to a condition for permitting execution of an application; An instruction input unit, a permission condition collating unit that performs collation based on the execution instruction data and the permission condition data, and generates collation data as to whether execution of the application is permitted or not, based on the collation data; And forced termination output means for generating forced termination data for forcibly terminating the execution of the application when the execution of the application is not permitted.

According to the present invention, permission condition data relating to a condition for permitting execution of an application is input by the permission condition input means, and execution instruction data for instructing execution of the application is input by the execution instruction input means.
Based on the execution instruction data and the permission condition data, verification is performed by permission condition verification means, verification data indicating whether execution of the application is permitted is generated, and forced termination output means is performed based on the verification data. If the execution of the application is not permitted, forced termination data for forcibly terminating the execution of the application is generated. That is, the execution of the application can be restricted by the description of the permission condition data. Therefore, there is provided an execution management system which can provide restrictions on unauthorized use and can reduce the work of the system administrator.

[0013]

Next, the present invention will be described with reference to embodiments. The execution management system of the present invention operates on a computer system. Usually, the execution management system is started at the same time when the computer system is started. The execution management system operates in parallel with an operating system (OS) or as a part of the OS incorporated in the OS. When a system or an application operates, monitoring is always performed.

FIG. 1 is a block diagram showing an example of the configuration of the execution management system according to the present invention. The execution management system shown in FIG. 1 is configured to be incorporated in an OS and operate as a part of the OS. In FIG. 1, 101 is an execution management system, 102 is permission condition input means, 103 is permission condition collation means, 104 is execution instruction reception means, 105 is execution instruction output means, 106 is non-permission display means, and 107 is permission condition data. It is.

In the configuration shown in FIG. 1, permission condition input means 102 inputs permission condition data 107 relating to a condition for permitting execution of an application. Further, the execution instruction receiving means 104 receives execution instruction data for instructing execution of the application. Then, the permission condition collation unit 103 performs collation based on the execution instruction data and the permission condition data, and generates collation data indicating whether the execution of the application is permitted. The execution instruction transfer unit 105 transfers the execution instruction data to the application or the execution unit only when the execution of the application is permitted based on the collation data. When the execution of the application is not permitted, the non-permission display unit 106 displays the fact on the screen.

FIG. 2 is a block diagram showing another example of the configuration of the execution management system of the present invention. The execution management system shown in FIG. 2 shows a configuration that operates in parallel with the OS. In FIG. 2, reference numeral 201 denotes an execution management system;
Is permission condition input means, 203 is permission condition matching means, 20
4 is an execution instruction input means, 205 is a forced end output means, 2
Reference numeral 06 denotes non-permission display means, and reference numeral 207 denotes permission condition data.

In the configuration shown in FIG. 2, the permission condition input means 202 inputs permission condition data 207 relating to a condition for permitting the execution of the application. The execution instruction receiving unit 204 receives execution instruction data for instructing execution of an application. Then, the permission condition collating unit 203 performs collation based on the execution instruction data and the permission condition data, and generates collation data indicating whether the execution of the application is permitted. If the execution of the application is not permitted based on the collation data, the forced termination output unit 205 outputs the forced termination data. When the execution of the application is not permitted, the non-permission display unit 206 displays the fact on the screen.

Next, a data processing process in the execution management system of the present invention will be described. FIG. 3 is a flowchart showing an example of a data processing process in the execution management system of the present invention. First, in step S1 of FIG. 3, the user logs on to the computer system and operates a keyboard, a mouse, and the like to input an instruction to execute an application. For example, place the mouse pointer on the icon of a document file being created on the desktop and double-click the mouse button. For example, when installing an application, the user points the mouse at the icon for setting up the application and double-clicks the mouse button. Here, there are two cases of execution of the application: execution of the installed application and execution of the application.
By the input for instructing the execution, execution instruction data is generated in the computer system.

Next, in step S2, it is determined whether the generated execution instruction data is for executing the application or for installing the application. If the installation is to be executed, the process proceeds to step S3, where the registration with the registration data of the permission condition data is performed. In the registration data, data that specifies an application that is permitted to execute the installation is registered. That is, the collation in step S3 is a process of collating the data to determine whether data specifying the application included in the execution instruction data is registered in the registration data. This process is
This is performed by the permission condition matching means 103 and 203 shown in FIGS.

If data specifying the application is registered, that is, if the execution of the application is permitted, the process proceeds to step S4, and the application is executed. This process is performed when the execution instruction output unit 105 shown in FIG. 1 outputs execution instruction data or when the forced instruction output unit 105 shown in FIG. 2 does not output forced end data.

On the other hand, if the data specifying the application is not registered, that is, if the execution of the application is not permitted, the process proceeds to step S5, where an error / warning is displayed and whether the application is executed. , Will be terminated. The error / warning display in this process is performed by the non-permission display means 106 and 206 shown in FIGS. The non-execution of the application in this process is performed by the execution instruction output unit 105 shown in FIG. 1 not outputting the execution instruction data. The forced termination of the application in this process is performed by the forced instruction output unit 105 shown in FIG. 2 outputting forced termination data.

In the above-mentioned step S2, it is determined whether the generated execution instruction data is the execution of the application or the installation of the application. If the execution instruction data is the execution of the application, the process proceeds to step S2. Proceed to S6. Then, in step S6, collation with the registered data of the permission condition data is performed.
In the registration data, data for specifying an application that is permitted to be activated is registered. That is,
The collation in step S6 is a process of collating the data to determine whether the data specifying the application included in the execution instruction data is registered in the registration data. This process is performed by the permission condition matching means 103 and 203 shown in FIGS.

If the execution of the activation is permitted based on the registration data and the collation in step S6, step S7
To collate with the time limit data of the permission condition data. In the time limit data, data indicating a time zone in which the execution of the activation is permitted is registered. That is, the collation in step S7 is based on the time data included in the execution instruction data or the time data indicated by the clock of the computer system at the time when the execution instruction data is generated. This is a process of making a determination by comparing the time limit data.
This process is performed by the permission condition matching means 10 shown in FIGS.
3,203. Here, it is assumed that “hour” includes the concept of year, month, day, day of the week, hour, minute, and second. Therefore, the time limit includes a limit on the date, a limit on the day of the week, a limit on the hour, minute, and second, a combination thereof, and the like.

If the execution of the start is permitted by collation with the time limit data in step S7, the process proceeds to step S8, and collation with the peripheral device connection data is performed. Peripheral device connection data is data relating to the connection state (usability or the like) of the peripheral device connected to the computer system. The collation in step S8 is a process of determining by collating whether a peripheral device necessary for executing the application is connected.

If the connection state allows the execution of the application to be executed by collating with the peripheral device connection data in step S8, the process proceeds to step S9, and the application is executed. This process is performed by the execution instruction output unit 105 shown in FIG. 1 outputting the execution instruction data or by the forced instruction output unit 105 shown in FIG.
Does not output forced termination data.

On the other hand, if it is determined in step S6 or S7 that the execution of the application is not permitted, or if it is determined in step S8 that the execution of the application cannot be performed, the process proceeds to step S10. And an error / warning is displayed, and the application is not executed or is forcibly terminated. The error / warning display in this process is performed by the non-permission display means 106, 20 shown in FIGS.
6. The non-execution of the application in this process is performed by the execution instruction output unit 10 shown in FIG.
5 is performed by not outputting the execution instruction data. The forced termination of the application in this process is performed by the forced instruction output unit 105 shown in FIG. 2 outputting forced termination data.

[0027]

As described above, according to the execution management system according to the first aspect of the present invention, it is possible to provide restrictions on unauthorized use and to reduce the work of the system administrator. A system is provided.
Further, according to the execution management system according to the second aspect of the present invention, it is possible to limit the use of the system on holidays, nights, and the like when the system administrator is absent and monitoring is not performed. According to the execution management system of claim 3 of the present invention,
It is possible to restrict installation or launch of an application that may have a problem. Further, according to the execution management system of the present invention, when the execution of the application is not permitted, the fact is displayed on the screen. Further, according to the execution management system of the fifth aspect of the present invention, it is possible to restrict both the installation of the application and the activation of the installed application. Claim 5 of the present invention
According to the execution management system according to the first aspect, there is provided an execution management system that can provide restrictions on unauthorized use and can reduce the work of the system administrator.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating an example of a configuration of an execution management system according to the present invention.

FIG. 2 is a block diagram showing another example of the configuration of the execution management system of the present invention.

FIG. 3 is a flowchart showing an example of a data processing process in the execution management system of the present invention.

[Explanation of symbols]

 101, 201 execution management system 102, 202 permission condition input means 103, 203 permission condition collation means 104 execution instruction receiving means 105 execution instruction output means 106, 206 non-permission display means 107, 207 permission condition data 204 execution instruction input means 205 compulsory End output means

Claims (6)

[Claims] A permission condition input means for inputting permission condition data relating to a condition for permitting execution of an application; an execution instruction receiving means for receiving execution instruction data for instructing execution of the application; and the execution instruction data and the permission condition. Permission condition collating means for performing collation based on data and generating collation data as to whether or not the execution of the application is permitted; and the application only when the execution of the application is permitted based on the collation data. Or an execution instruction transfer means for transferring the execution instruction data to the execution means. 2. The execution management system according to claim 1, wherein said permission condition data includes time limit data relating to a time zone in which execution of the application is permitted. 3. The execution management system according to claim 1, wherein said permission condition data includes registration data in which an application whose execution is permitted is registered. 4. The execution management system according to claim 1, further comprising a non-permission display unit for displaying, on the screen, when the execution of the application is not permitted based on the collation data. An execution management system, characterized in that: 5. The execution management system according to claim 1, wherein the execution of the application includes two cases: execution of the installed application and execution of the application. An execution management system characterized by the following. 6. Permission condition input means for inputting permission condition data relating to a condition for permitting execution of an application, execution instruction input means for inputting execution instruction data for instructing execution of an application, said execution instruction data and said permission Permission condition collating means for performing collation based on condition data and generating collation data as to whether execution of the application is permitted, and when the execution of the application is not authorized based on the collation data, An execution management system comprising: forced termination output means for generating forced termination data for forcibly terminating the execution of an application.