JP2001005727A - Access management device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an access management device which can easily manage access right by users and groups. SOLUTION: An access management system 1 does not manage the access right by users on each software system 5, but performs the centralized management of the access right by the software systems 5 by an access management software system 3. An access right management data storage part 7 records access right management data wherein the access right by the software systems 5 is described. An access right determining means 9 receives a request to use a software system 5 from a user and determines the contents of the access right for the software system according to the access right management data. Consequently, the centralized management of the access right becomes possible, thus each software system need not manages the access right and the access right can efficiently be managed.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to an access management device, and more particularly, to an access management device capable of easily managing an access right.

[0002]

2. Description of the Related Art Conventionally, access right management for a certain system is performed as follows. First, each user is managed by registering the user's personal information in the system and setting an access right for each registered user. Therefore, when there are a plurality of systems, a user is registered for each system, and an access right is set for each registered user.

[0003]

The above-mentioned method has the following problems. If there are multiple systems, user registration and access rights must be set for each system. For example, if there are five systems, personal information about one user must be registered five times for each system. In addition, access rights must be set, and there is a problem that user management and access right management are inefficient.

Accordingly, an object of the present invention is to provide an access management device which can easily manage access rights to users and groups and can easily manage access rights to a plurality of servers. .

[0005]

In the access management apparatus according to the first aspect, the recording medium according to the seventh aspect, and the access management method according to the tenth aspect, software users are hierarchically grouped. The access right management data that describes the access rights given to a group will only be transferred to the lower group if the access rights given to the upper group are inherited by the lower groups in principle and different access rights are granted to the lower group. The description giving the different access right is made, and in response to a use request from the user for the software based on the access right management data, the content of the access right to the software is described from the lower level of the hierarchy. The access right based on the description of the lowest-level access right. To determine the contents.

Accordingly, when the same access right as the upper group is given to the lower group, the contents of the access right of the group are determined without describing the access right to be given to the lower group in the access right management data. be able to. Therefore, the description of the access right management data can be simplified, and the access right of each group can be easily managed.

[0007] A system according to claim 2 and claim 1
In the access management method according to the first aspect, without managing the access right of the user in each software system,
Upon receiving a use request from a user for a software system based on access right management data describing an access right for each software system, the content of the access right to the software system is determined, thereby enabling access in each software system. Centralize rights.

[0008] Thus, access rights can be managed efficiently.

In the access management device according to the third aspect and the recording medium according to the eighth aspect, a use request from a user to the software system is received based on the access right management data describing the access right for each software system. Then, the contents of the access right to the software system are determined.

[0010] Thus, since the access right can be centrally managed, it is not necessary for each software system to manage the access right. Therefore, access rights can be managed efficiently.

In the system and the apparatus according to the fourth aspect, the access right management data recording section hierarchically groups the users of the software systems and describes the access right management data describing the access right for each software system given to the group. In addition, the access right management data is recorded in the access right management data, and the access right given to the upper group is basically succeeded to the lower group, and only when the lower group is given a different access right, the different access The access right determination means determines whether or not the access right is described from the lower level of the hierarchy, and determines the contents of the access right based on the description of the access right at the lowest level.

[0012] Thus, when the same access right as the upper group is given to the lower group, the contents of the access right of the group are determined without describing the access right to be given to the lower group in the access right management data. be able to. Therefore, the description of the access right management data can be simplified, and the access right of each group can be easily managed.

[0013] In the system and apparatus according to the fifth aspect, the confirmation means calculates and outputs the contents of the access right given to each user based on the access right management data. Thereby, it is possible to easily confirm the access right of each user.

According to a sixth aspect of the present invention, there is provided a system and apparatus wherein a group of users of the software system is hierarchically grouped and an access right given to each user is output on the same screen. This makes it possible to easily confirm the access right.

Here, each means according to the claims and FIG.
13 shows a correspondence relationship with each step in the flowcharts in FIGS. 11 and 12. The access right determination unit performs steps S1 to S9 in FIG. 10, steps S11 to S15 in FIG.
From step S333 and step S35, the confirmation means performs step S5 in FIG. 10 and step S11 in FIG.
To step S13, and steps S211 to S333 in FIG. 12, respectively.

The "access right management data storage unit" is a concept including specific means for storing the access right management data. For example, a fixed storage medium such as a hard disk, a floppy disk, a CD-R, a CD-R /
W, DVD-R @ M, a removable recording medium such as a memory card, and various drives for mounting the removable recording medium.

The "confirmation means" is a concept including specific means for outputting the contents of the access right given to each user. For example, a device that outputs on a screen such as a display or a device that outputs to a medium such as paper such as a printer may be used.

The "recording medium on which the program is recorded"
A recording medium such as a ROM, a ROM, a flexible disk, a CD-ROM, a memory card, a hard disk, or the like on which a program is recorded. This concept includes not only recording in a form such as a CD-ROM or a memory, but also transmission of recorded contents while changing its state, such as a communication line or a carrier wave. Further, not only a recording medium such as a hard disk which is connected to the CPU and in which the recorded program is directly executed, but also a recording medium such as a CD-ROM in which a program to be executed after being once installed on the hard disk or the like is recorded. It is a concept including Furthermore, the programs referred to here include not only programs that can be directly executed, but also programs in a source format, compressed programs, encrypted programs, and the like. The functions realized by the program are:
It may be realized by the program alone,
It may be realized in cooperation with another program (for example, an operating system).

"Software" provides a procedure for operating hardware for a certain purpose, and is a concept including a series of instruction words and a group of data. For example, it includes applications, databases, operating systems, and the like.

The term "group" is a concept including not only a plurality of users but also a single user.

[0021]

BEST MODE FOR CARRYING OUT THE INVENTION Overall Configuration of Access Management System FIG. 1 shows the overall configuration of an access management system 1 according to an embodiment of the present invention. The access management system 1 has an access management software system 3 and a plurality of software systems 5. Further, the access management system 1 does not manage the access right of the user in each software system 5 but centrally manages the access right in each software system 5 by the access management software system 3.

The access right management data storage unit 7 records access right management data describing the access right for each software system 5. The access right determining means 9 receives a use request from a user for the software system 5 and determines the contents of the access right to the software system based on the access right management data.
The confirmation unit 11 calculates and outputs the content of the access right given to each user based on the access right management data.

Thus, centralized management of access rights can be performed, so that it is not necessary for each software system to manage access rights. Therefore, access rights can be managed efficiently.

2. FIG. 2 shows an example of a hardware configuration of the access management system 1. The access management system 1 has an access management computer 23 as an access management software system 3, an application server 25 as a software system 5, a database server 27, and a print server 29. Each computer and server are connected via a network. The access management computer 23 is connected to a user terminal computer 21 via a network.

Next, an example of a hardware configuration of the access management computer 23 is shown in FIG. The access management computer 23 has a CPU 31, a memory 33, a hard disk 35, a display 37, a keyboard 39, a mouse 41, a printer 43, a CD-ROM drive 45, a floppy disk drive 47, and a communication control unit 49.

The CD-ROM 55 as a recording medium includes:
A program for access management (hereinafter referred to as an access management program) is stored. The access management personal computer 23 reads the access management program from the CD-ROM 55 via the CD-ROM drive 45 and stores it on the hard disk 35. CPU31
Controls each device according to the access management program recorded on the hard disk 35.

Here, the correspondence between the components according to the embodiment and the components according to the claims will be described. CPU 31 is access right determination means 9 and confirmation means 11, hard disk 35 is access right management data recording section 7, display 37 is confirmation means 11, and printer 43 is confirmation means 1.
1, the floppy disk drive 47 corresponds to the access right management data recording section 7, respectively.

3. Access Right Management Data Next, access right management data will be described. FIG. 4 shows an example of the access right management data. The access right management data is data describing a user's access right to each of the servers 25, 27, and 29, and includes a user information database, an organization information database, a post information database, and a group information database.

The user information is personal data generated for each user. In the present embodiment, the user information includes the user number of the user,
D, password, name (kana, kanji), affiliated organization, affiliated post, affiliated group, access right, address, device, etc. are set.

The organization information is data generated for each organization constituent unit (part, section, section, etc.) in an organization having a hierarchical structure as shown in FIG. In this embodiment, an organization code, an organization name, an upper organization, an access right, and the like are set. The description of the item of “superordinate organization” represents a tree structure as shown in FIG.

The post information is data generated for each post having a hierarchical structure, such as a manager and a section manager. In this embodiment, a post code, a post name, a higher rank, an access right, and the like are set.

The group information is data generated for each group having a hierarchical structure. In this embodiment, a group name, an upper group, an access right, and the like are set.

As shown in FIG. 7, the user information is associated so as to belong to any of the organizational constituent units of the organization information. That is, the description of the item of “organization” in the user information indicates which part, Whether it belongs to a section or a section is described.

Similarly, the user information includes “post”,
The description of the item “group” is associated with post information and group information.

The user information for each user, the organization information for each organizational unit, the position information for each position, and the group information for each group are converted into a database to form a user information database, an organization information database, a position information database, and group information. Stored as a database.

In this embodiment, each user is grouped from different viewpoints of "organization", "post", and "group", and the access right is described. Therefore, when designing the access right, the access right can be described for each of the viewpoints of “organization”, “post”, and “group”, and the design is easy.

The description of the higher-level organization and the access right will be described using the organization information as an example. Here, a case where organization information is described for an organization having a tree structure as shown in FIG. 5 will be considered. In the case of describing the organization information regarding the section X in this, “Α section” is described in the “upper organization” column. Regarding the “access right” column, nothing is described when inheriting the content of the access right of the superior organization, and when the access right is different from the content of the access right of the superior organization, the content is described. For example, the content of some access rights is
As shown in FIG. 6Α, the application server 25,
"None" for the database server 27,
It is assumed that the print server 29 is “usable”. If the access right of section X is the same as that of section 何, nothing is described in the “access right” column. On the other hand, when the access right of the section X is “reader” for the database server 27, “database / reader” is described in the “access right” column.

FIG. 6B shows a case where the section X has the same access right as that of the department #, which is a superior organization, and FIG. 6C shows a case where the section X has a different access right from the department #. As described above, when there are a plurality of servers that can be used by the user, the name and contents of the server to be used are described in the access right column.

In this manner, the organization information for each section, each section, and each section is described, and an organization information database is generated. Also, regarding the post information and the group information, the respective databases are generated in the same manner as the organization information.

FIG. 7 shows an example of a user configuration in an organization. Based on such a configuration, each data relating to the user information is input. For example, FIG. 9 shows an example of the description of the user information regarding the user 2. FIG. 9A shows a case where no special access right is given to the user for the server, and FIG. 9B shows a case where special access right is given to the user (access to the application server 25 as “editor”). Has been granted)
Is shown. Thus, in the user information,
Write access rights only if the user has special access rights for each server.

FIG. 8 schematically shows the relationship between the contents of the access right to the database server described in the organization information and the user information and the contents of the access right given to each user (the same applies to other servers). is there). In this example, the access right of “available” is described in part Α, the reader is described in section 係, the editor is edited in section 、, the access right of “none” is described in section B, and the access right of “editor” is described in user 3 Is described. The access rights granted to each user in this case are shown on the right. As is clear from the figure, the access right can be systematically grasped, and when the access right of the higher-level group is taken over, no description is required. Therefore, the design and change are easy.

4. Operation of Access Management Program The outline of the operation of the access management program installed in the access management computer 23 will be described with reference to the flowchart illustrated in FIG. Upon receiving a server use request from the user via the terminal personal computer 21, the user is authenticated (S1). This authentication is performed by obtaining a name, a password, and the like from the user. When the user authentication is completed, it is determined which server is to be accessed (that is, an access object is determined) (S3).

Then, from the user information database,
The user information of the user is obtained (S5). The access right of the user to the access object to be used is determined based on the acquired user information (organization, title, access right, etc.) (S7). The determination of the access right will be described later. The access to the server based on the determined access right is permitted (S9).

Next, regarding the above-mentioned determination of the access right,
This will be described with reference to the flowchart illustrated in FIG. Based on the user information acquired in step S5 in FIG. 10, it is determined whether an access right has been set (S11). If the access right is set, the access right of the user information is set as the access right of the user (S13). If the access right of the user information is not set, the access right is determined based on each information other than the user information (S15).

A case where the access right is determined based on information other than the user information will be described with reference to a flowchart shown in FIG. First, organization information, post information, and group information are obtained (S211, S212, S21
3). It is determined whether or not an access right is set for each of the acquired organization information, post information, and group information (S231, S232, S233). If an access right is set for each piece of information, the access right is acquired (S251, S252, S253).

If the access right is not set for each information, the information of the hierarchy located immediately above each information is obtained (S271, S272, S273). In the case of an organization having the tree structure shown in FIG. 5 as an example, the information of the immediately higher hierarchy is 上位 in the case of the X section. Therefore, the organization information about the part Α is X
It is the information of the hierarchy that is located immediately above the section.

It is determined whether or not an access right has been set for the acquired information of the immediately upper hierarchy level (S2).
91, S292, S293). If the access right is set, the access right is acquired (S251, S25
2, S253).

If the access right has not been set, it is determined whether or not the information of the immediately higher hierarchy is that of the highest hierarchy (S311, S312, S31).
3). If the information is at the highest level, a default access right is given to the information (S331, S33).
2, S333). If it does not belong to the highest hierarchy, the information of the hierarchy located at the nearest higher level is acquired.

In this way, the access right to each piece of information is determined, and each access right is compared. Then, among the access rights, the access right positioned at the highest level is determined as the access right of the user (S35). For example, for a user, if the access right for organization information is “editor”, the access right for job title information is “administrator”, and the access right for group information is “reader”, the access right for that user is Become an "administrator." This means that editors have higher access than readers,
This is because the administrator has set so as to be higher than the editor.

As described above, the access management computer 2
In 3, when the access right is set in the user information, the access right is set as the user's access right. If the access right of the user information is not set, the access right is obtained from each of the other information (organization information, job title information, group information), and the highest access right is set as the access right of the user. I do.

5. Display of access right In the access management computer 23, the access right of the user can be displayed on the display 37. Thereby, the access right of each user can be confirmed. FIG. 13 shows an example of the screen of the display 37 when the access right is displayed. In the present embodiment, a tree structure display area T1 indicating a tree structure of an organization, a post, and a user and an access right display area # 1 for displaying an access right of each organization, post, and a user are displayed on the same screen. . By displaying the tree structure and the access right on the same screen in this way, it is possible to easily confirm and change the access right of each organization, job title and user. The “same screen” includes an area displayed in a window by scrolling. Further, when a plurality of windows are displayed on the screen, an area which is displayed by being activated by a mouse click operation or the like, such as a window hidden by a previous window, is also included. However,
It is preferable that the tree structure and the access right be displayed on the same screen without the need for a scroll operation or window activation.

In the tree structure display area T1, a tree structure relating to an organization, a post, and a user is simultaneously displayed. Note that an item related to an organization is indicated by a round icon, an item related to a position is indicated by a triangular pyramid icon, and an item related to a user is indicated by a humanoid icon to the left of the corresponding item.

In the access right display area # 1, the contents of the access right relating to the organization, post and user selected in the tree structure display area T1 are displayed. In the access right display area # 1 in FIG. 13, groups / objects and total access rights are displayed. When the access right display area # 1 is scrolled to the left, categories are displayed. When the area is scrolled to the right, other access rights (for example, for a user, the access right of the organization to which the user belongs, the access right of the post of the user) , The access right granted to the user, etc.) (the same applies to FIGS. 15, 17, 19, 20, 21).

It should be noted that the access management computer corresponds to FIG.
Step S11 in FIG. 1, Step S in FIG.
The process from 211 to step S333 is performed, and the access right corresponding to each organization, position, and user is acquired.
Then, they are displayed in the access right display area # 1.
In addition, the access management computer 23 performs steps S11 and S13 in FIG. 11 and step S3 in FIG.
5 is performed to determine the access right. Then, the determined access right is displayed as an overall access right in access right display area # 1. In this way, by displaying not only the total access right but also other access rights in the access right display area # 1, it is possible to easily confirm the access right of each user when designing the access right.

"Matsuoka" in the tree structure display area T1
Takeshi's attention. For "Takeshi Matsuoka", the object "Α" in the category "NT Management"
The general access right “none” is given to “PPS” (see the lowest item of the access right display area # 1).
It is assumed that the default access right “none” is given to all members as the total access right to the object “$ PPS”.

Here, the assignment of the access right to the organization will be described. For example, assume that the access right for “Head Office Network Service Section 2” is changed. In this case, in the tree structure display area T1, “Headquarter Network Service Section 2” is selected, and the organization change dialog H1 is selected.
Is displayed. FIG. 14 shows a state in which the organization change dialog H1 is displayed. In the organization change dialog H1,
An organization name column D1 where an organization name is displayed, an access right column D3 where the contents of the access right are displayed, and the like are displayed.

Now, “Headquarters Network Service Section 2”
Is given an access right “change (write)” to the object “$ PPS”. In this case, “$ PP” of the group / object in the access right field D3
The access right “change (write)” is set for “S”. Then press the "OK" button at the bottom right of the screen,
All users belonging to the “Headquarters Network Service Section 2” are given access right “change (write)” to the object “$ PPS”. FIG. 15 shows the result of changing the access right. For "Takeshi Matsuoka",
The general access right “change (write)” for the object “@PPS” is given.

As described above, by changing the access right related to an organization, the access right of a user belonging to the organization can be changed at the same time. Therefore,
Access rights can be easily managed.

Next, the assignment of access rights to positions will be described. For example, assume that the access right for the “section manager” is changed. In this case, "section manager" is selected in the tree structure display area T1, and a position change dialog is displayed. FIG. 16 shows a state in which the post change dialog is displayed. In the post change dialog H3,
The title, access rights, etc. are displayed. In the post change dialog H3, a post title column D11 displaying the post title, an access right column D13 displaying the contents of the access right, a user column D15 indicating the user belonging to the post, and the like are displayed.

Now, the "section manager" is given the object "@P
Consider a case where an access right “full control” to “PS” is given. In this case, the access right “full control” is set for “$ PPS” of the group / object in the access right column D13. Then, when the “OK” button at the lower right of the screen is pressed, the access right “full control” for the object “@PPS” is given to all the users corresponding to the “section manager”. FIG. 17 shows the result of the change in the access right. “Water Abe”, who is the “Headquarters Network Service Section 2” and “section manager”, is given the general access right “full control” for the object “@PPS”.

As described above, by changing the access right related to the position, the access right of the user belonging to the position can be changed at the same time. Therefore, access rights can be easily managed.

Further, the assignment of the access right to the user will be described. For example, assume that the access right for “Takeshi Matsuoka” is changed. In this case, “Takeshi Matsuoka” is selected in the tree structure display area T1, and a user change dialog is displayed. FIG. 18 shows a state in which the user change dialog is displayed.

In the user change dialog H5, a personal information display section D3 for displaying a user number, a user ID, a password, a user name (alphabet, kanji) and the like.
1, a belonging organization column D33 for displaying a belonging organization, a position column D35 for displaying a position, an access right column D37 for displaying contents of an access right, and the like are displayed. An organization change check box B1 is provided at the lower left of the user change dialog H5. This organization change check box B1
Indicates whether or not the organization change has occurred for the user indicated in the user change dialogue H5. if,
If an organization change has occurred for the user, a check mark is entered in the organization change check box B1.

Now, "Takeshi Matsuoka" gives the access right "Full Control" to the object "@PPS".
Think about giving. In this case, the access right column D37
Access authority "full control" is set for the "@PPS" of the group / object of. Then, when the "OK" button at the lower right of the screen is pressed, "Takeshi Matsuoka" is given an access right "full control" to the object "@PPS". FIG. 19 shows the result of changing the access right. "Takeshi Matsuoka" has been given the general access right "full control" for the object "@PPS".

As described above, by changing the access right for a user, the access right for the user can also be changed. Therefore, access rights can be easily managed.

Next, a description will be given of a change in access right accompanying a user's organization movement. As users move from one organization to another, access rights to objects change accordingly. In the present embodiment, the change of the access right in accordance with the movement of the organization of the user can be performed by a simple operation such as drag and drop.

For example, “Head office network service 2”
Let's consider a case where "Shinsho Sakuragi" belonging to "Section" moves to "Headquarters Network Service Section 1". In this case, as shown in FIG. 20, “Shinsho Sakuragi” of “Headquarters Network Service Section 2” is selected and dragged.
Then, as shown in FIG. 21, the data is dropped to “Head Office Network Service Section 1”.

This completes the transfer of the organization of “Nobuaki Sakuragi” from “Headquarter Network Service Section 2” to “Headquarter Network Service Section 1”. As shown in FIG. 20, "Nobuaki Sakuragi" was the object "@PP" when he belonged to "Headquarters Network Service Section 2".
Although the general access right “change (write)” was given to “S”, after the organization was moved to “Headquarters Network Service Section 1”, as shown in FIG. The general access right "None" is given.

As described above, since the user can easily move the organization, there is a possibility that the organization may be moved erroneously. As an allowance in this case, the color of the icon of the user who has moved the organization is different from the color of the icons of other users. This makes it easy to determine which user has moved.

In the tree structure display area T1, the user who has moved the organization is selected, and a user change dialog H5 is displayed. The displayed user change dialog is the same as that shown in FIG. However, a check mark is shown in the organization change check box B1.

For a user whose organization has been changed, a check mark is automatically entered in the organization change check box B1 in the user change dialog for the user. As a result, it is possible to easily determine whether or not the user currently displaying the user change dialog is a user whose organization has been changed.

By removing the check mark from the organization change check box B1 and pressing the "OK" button, the user's organization change becomes effective for the first time. For the user who has made the organization change, the icon of a different color from that of the other users is displayed, but the icon color becomes the same as that of the other users by enabling the organization change.

As described above, in this embodiment, when the user's organization is changed, the check function for making the organization change effective is provided. Therefore, there is little possibility that the organization of the wrong user is changed. For the user who has changed the organization, an icon of a different color from that of the other users is displayed. Therefore, it is possible to easily determine which user has made the organization change.

[Other Embodiments] In the above embodiment, grouping is performed from a plurality of viewpoints.
Only grouping from three viewpoints (for example, only organization information) may be adopted.

In the above embodiment, user information, organization information, post information, and group information are shown as access right management data. However, the present invention is not limited to this as long as users can be grouped hierarchically.

Further, in the above-described embodiment, data in which users are hierarchically grouped is exemplified as the access right management data. However, non-hierarchical grouping may be adopted. For example, a group of system administrators may be used as the access right management data.
In this case, there is no vertical relationship between the system administrators,
Has equal status.

In the above-described embodiment, the highest access right among the access rights related to each information is determined as the user's access right, but the present invention is not limited to this. For example, the access right may not be determined unless it is determined to be the lowest access right or a specific access right is not set in the user information.
Further, the access right of the user may be a combination of the access right obtained by each information without providing the upper and lower levels in the content of the access right.

Further, in the above embodiment, the access right is displayed on the display 37, but may be output to an output device such as a printer.

Further, in the above-described embodiment, the tree structure of the organization, the position, and the user is simultaneously displayed in the tree structure display area T1, but any combination or only one tree structure is displayed. You may do so. In the access right display area # 1, access rights to all objects related to the item selected in the tree structure display area T1 are displayed. However, a specific object is selected and only the access right to the object is displayed. You may make it.

Further, in the above-described embodiment, the tree structure is displayed in the tree structure display area T1, and the access right is displayed in the access right display area # 1.
That is, although the tree structure and the access right are displayed in separate areas, both may be displayed in one area.

Further, in the above embodiment, the tree structure display area T1 and the access right display area # 1 are displayed on the screen of the display 37, but the tree structure and the access right are displayed on the same screen. Is not limited to this as long as it can be displayed on the screen. For example,
The tree structure and the access right may be displayed in three or more areas.

Further, in the embodiment, the tree structure display area T1 and the access right display area # 1 are displayed so as not to overlap each other, but they may be displayed in an overlapping manner. In this case, if a certain area is selected by input means such as a mouse, the area is displayed on the foreground, and all of the area is displayed. Further, even when the tree structure and the access right are displayed in three or more areas, the respective areas may be displayed in an overlapping manner.

Further, in the above-described embodiment, the access management personal computer 23 in which the access management program is recorded on the hard disk is shown, but the access management program may be recorded on a recording medium such as a CD-ROM or a floppy disk. . In this case, by installing the information management program recorded on each recording medium into a computer such as a personal computer, it can be used as an access management device.

In the above embodiment, the access right to different servers is targeted, but the access right to two or more different software in the same server may be targeted.

[Brief description of the drawings]

FIG. 1 is a functional block diagram of an embodiment of an access management system 1 according to the present invention.

FIG. 2 is a diagram showing a hardware configuration of the access management system 1.

FIG. 3 is a diagram illustrating a hardware configuration of an access management computer.

FIG. 4 is a diagram showing a configuration of access right management data.

FIG. 5 is a diagram illustrating an example of a tissue configuration.

FIG. 6 is a description example of organization information;
B shows the case where the X section has the same access right as the upper organization, which is the department X, and C shows the case where the X section has an access right different from that of the upper organization.

FIG. 7 is a diagram showing a user configuration.

FIG. 8 is a diagram showing a relationship between a user and an access right.

FIG. 9 is a diagram showing a description example of user information, where Δ indicates that no special access right regarding the server is given to the user, and B indicates that the special access right is given. Is shown.

FIG. 10 is a diagram illustrating an example of a first flowchart for determining an access right.

FIG. 11 is a diagram showing an example of a first flowchart for determining an access right.

FIG. 12 is a diagram illustrating an example of a first flowchart for determining an access right.

FIG. 13 shows a display 37 when displaying an access right.
FIG. 5 is a diagram showing an example of the screen of FIG.

FIG. 14 is a diagram showing an example of a screen when an organization change dialog H1 is displayed.

FIG. 15 is a diagram exemplifying a screen after an access right of an organization is changed.

FIG. 16 is a diagram illustrating an example of a screen when a post change dialog H3 is displayed.

FIG. 17 is a diagram exemplifying a screen after changing the access right of a position.

FIG. 18 is a diagram illustrating an example of a screen when a user change dialogue H5 is displayed.

FIG. 19 is a diagram exemplifying a screen after changing a user's access right.

FIG. 20 is a diagram exemplifying a screen display before a user's organization is changed.

FIG. 21 is a diagram illustrating a screen display after a user's organization is changed.

[Explanation of symbols]

 1 access management system 3 access management software system 5 software system 7 access right management data storage unit 9 access right determination means 11 ..... Check means

 ──────────────────────────────────────────────────続 き Continued on the front page (72) Inventor Wataru Abe 22 Kyocera Communication System Co., Ltd., 5-5, Higashino Kitanoue-cho, Yamashina-ku, Kyoto-shi, Kyoto (72) Inventor Takeshi Matsuoka Takeshi Kitano-Inogami, Yamashina-ku, Kyoto, Kyoto 5-2 Kyocera Communication System Co., Ltd. (72) Inventor Yoshio Ida 5-22 Kyocera Communication System Co., Ltd. (72) Inventor Masanobu Managa Kyoto-shi, Kyoto 5-22 22 Kyocera Communication System Co., Ltd., Higashino Kitanoue-cho, Yamashina-ku (72) Inventor Hiroshi Oki 1166-6 Haseno, Hachimizo-cho, Yokaichi, Shiga Prefecture Kyocera Communication System Co., Ltd. Shiga Works F-term (reference) 5B01 7 AA07 BA06 BB06 CA16 5B085 AE06

Claims (11)

[Claims] 1. An access management apparatus for managing access to software to be managed, wherein the users of the software are hierarchically grouped, and access right management data describing an access right to be given to the group is recorded. An access right management data recording unit; an access right determination unit that receives a use request from a user for the software and determines the content of an access right to the software based on the access right management data. The access right management data, only when the access right given to the upper group is inherited by the lower group and a different access right is given to the lower group,
A description for giving the different access right to the lower-level group is provided, and the access right determination means determines whether or not the access right is described from a lower level of the hierarchy, and performs access based on the description of the lowest-level access right. Determining the content of the right. 2. A system including a plurality of software systems, wherein access rights in each software system are centrally managed by an access management software system without managing access rights of a user in each software system. An access right management data recording unit that records access right management data describing an access right for each of the software systems; a management software system that receives a use request from a user for the software system and, based on the access right management data, Access right determining means for determining the contents of the access right to the software system. 3. An access management device for collectively managing a plurality of software systems, an access right management data recording unit for recording access right management data describing an access right for each software system, and use for the software system. Access right determining means for determining contents of an access right to the software system based on access right management data in response to a use request from a user. 4. The system according to claim 2, wherein the access right management data recording unit hierarchically groups users of the software system, and gives an access right for each software system to the group. Is recorded, and in the access right management data, only when the access right given to the upper group is succeeded by the lower group in principle and a different access right is given to the lower group, A description for giving the different access right to the lower-level group is provided, and the access right determination means determines whether or not the access right is described from a lower level of the hierarchy, and performs access based on the description of the lowest-level access right. Determining the content of the right. 5. The system or apparatus according to claim 2, further comprising: a confirmation unit for calculating and outputting the contents of the access right given to each user based on the access right management data. Characterized by having. 6. The system or apparatus according to claim 5, wherein a group in which the users of the software system are hierarchically grouped and an access right given to each user are output on the same screen. What to do. 7. A recording medium storing an access management program for managing access to software to be managed, wherein the access management program hierarchically groups users for the software and provides access to the group. Based on the access right management data describing the right, receiving a use request from the user and causing the computer to perform a process of determining the contents of the access right to the software, wherein the access right management data includes: Only if the access rights granted to the higher-level group are inherited by the lower-level groups and the lower-level groups are granted different access rights,
The access control program determines whether the access right is described from the lower level of the hierarchy, and determines the access right based on the description of the access right at the lowest level. The content is determined. 8. A recording medium on which an access management program for managing access to a plurality of software systems to be managed is recorded, wherein an access right recording data describing an access right for each software system is recorded. A recording medium recording an access management program for causing a computer to perform a process of determining the contents of an access right to a software system in response to a use request from a user for the software system based on the right management data. 9. A recording medium recording access right management data for managing a user's access right to software, wherein the access right management data is described by hierarchically grouping users of the software. A group description section, and an access right description section associated with the group description section. In the access right description section, when the contents of the access right given to the upper group are taken over, the access right description section is renewed. Is not described, and the content of the access right granted to the upper group is not taken over,
A recording medium recording access right management data, wherein the content of the access right is described. 10. An access management method for managing access to software to be managed, wherein the access management method includes grouping users of the software hierarchically and describing an access right given to the group. Receiving the use request from the user for the software based on the right management data, and determining the contents of the access right to the software, wherein the access right management data includes the access right given to the upper group. Is essentially inherited by a sub-group, and grants the sub-group different access,
The access control method determines whether the access right is described from the lower level of the hierarchy, and determines the access right based on the description of the access right at the lowest level. Determining the content of. 11. An access management method for managing access to a plurality of software systems to be managed, the access management method comprising: managing each software system without managing a user's access right in each software system; Upon receiving a use request from a user for the software system based on the access right management data describing the access right for each system, the contents of the access right to the software system are determined, whereby the access right for each software system is determined. Centralized management of an access control method.