JP2003030063A - System and method of oa management - Google Patents

Abstract

PROBLEM TO BE SOLVED: To obtain a system and method of OA management to enable a user to obtain authentication from a firewall without performing a troublesome operation. SOLUTION: This OA management system is constituted so that user information is acquired from an access information DB 5 by using terminal information of a user terminal 1 as a key when access to a corporate network 10 is performed from a user terminal 1, the user information is transmitted to the firewall 8 and execution of the authentication is requested. Thus, the user can request the execution of the authentication without performing the troublesome operation.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an OA management system and an OA management system for managing access to a company network.
A management method.

[0002]

2. Description of the Related Art Applications for outside OA-related services such as permission of outside users to use in-house systems and issuance of mobile cards are often accepted on paper. This is because, in general, a company largely does not allow free network access to the outside including affiliated companies due to security problems. Due to this limitation, it is not possible to freely access the in-house system and company home page from outside.

As described above, in general, applications for use of OA-related services for the outside are often accepted on paper. A firewall is installed at the entrance of the internal network, and the firewall manages access to the internal network. . That is, when the firewall receives an access to the in-house network from a user terminal outside the company, the firewall requests the user terminal to input the user ID and password, and carries out an authentication process based on the user ID and password.

Then, the firewall permits the authenticated user terminals to access the corporate network, and rejects the unauthenticated user terminals to the corporate network. This allows companies to grant access only to trusted users, but not to firewalls.
Pre-registration of the D code and password requires the system administrator to manually register.

[0005]

Since the conventional OA management system is configured as described above, each time the user terminal accesses the in-house network, the user must
Since it is necessary to input D or a password to obtain authentication from the firewall, there is a problem that the user operation is troublesome. Further, unless the system administrator registers the user ID and password in the firewall in advance, the firewall cannot carry out the authentication process, and if the number of pre-registration applications increases, the system administrator's work load becomes excessive. There were also challenges.

The present invention has been made in order to solve the above problems, and an OA that allows a user to obtain authentication from a firewall without performing a troublesome operation.
The purpose is to obtain a management system and an OA management method. Another object of the present invention is to provide an OA management system and an OA management method that can omit manual registration work by a system administrator.

[0007]

When an OA management system according to the present invention receives an access to an in-house network from a user terminal, the terminal information of the user terminal is used as a key to acquire information about the user from a database. It is provided with an authentication requesting means for transmitting information to the firewall and requesting authentication.

In the OA management system according to the present invention, when an internal network access is received from a user terminal of a user who is not permitted to access the internal network, the OA management system investigates whether or not the user is reliable, and the user can be trusted. In this case, information updating means for adding information about the user to the database is provided.

In the OA management system according to the present invention, when the user is reliable, the information updating means sets the firewall to permit the use of the user.

The OA management system according to the present invention is provided with notifying means for notifying the user terminal of the investigation result by the information updating means.

The OA management system according to the present invention is provided with status management means for managing the application processing status of the user terminal for the OA application system existing in the in-house network.

In the OA management system according to the present invention, the status management means manages the expiration date of the user terminal for the OA service existing in the in-house network.

The OA management system according to the present invention is an OA
The notification means is provided to notify the user terminal of the expiration date of the user terminal for the service.

According to the OA management method of the present invention, when an access to a company network is received from a user terminal,
Using the terminal information of the user terminal as a key, the information about the user is acquired from the database, and the information is transmitted to the firewall to request the execution of authentication.

In the OA management method according to the present invention, when an access to the company network is received from a user terminal of a user who is not permitted to access the company network,
It investigates whether or not the user is trustworthy, and when the user is trustworthy, information about the user is added to the database.

In the OA management method according to the present invention, when the user is reliable, the firewall is set to permit the use of the user.

In the OA management method according to the present invention, the user terminal is notified of the result of the investigation as to whether or not it is reliable.

The OA management method according to the present invention manages the application processing status of the user terminal for the OA application system existing in the in-house network.

The OA management method according to the present invention manages the expiration date of the user terminal for the OA service existing in the in-house network.

The OA management method according to the present invention notifies the user terminal of the expiration date of the user terminal for the OA service.

[0021]

BEST MODE FOR CARRYING OUT THE INVENTION An embodiment of the present invention will be described below. Embodiment 1. FIG. 1 shows the O according to the first embodiment of the present invention.
FIG. 2 is a configuration diagram showing an in-house network to which the A management system is applied. In the figure, 1 is a user terminal outside the company, 2 is the Internet, and 3 is a user who uses the user terminal 1. An OA management system for transmitting the authentication request to 8 and requesting the execution of authentication, 4 is an OA management device, and 5 is an access information DB that stores information (hereinafter referred to as user information) about users who are permitted to access the in-house network 10. (Database), 6 is a terminal address information DB that stores IP address allocation information for each organization (company, university, etc.) connected to the Internet 2, and by referring to this terminal address information DB 6, the user can It is possible to determine whether or not the user is an in-house user. A specific example is a database provided by the Japan Network Information Center (JPNIC).
Reference numeral 7 is a reliability information DB that stores information about groups and individuals such as company information and personal information. As a specific example,
There are commercially available corporate information databases and personal trust information provided by banks and credit companies.

Reference numeral 8 is a firewall for managing access to the in-house network 10, 9 is a user entry registered in the firewall 8, 10 is an in-house network, 11 is an OA for electronically performing a use application procedure for a service provided by the OA service 13. Application system, 12 is O
A application status management DB that manages the application status of the A application system 11, and 13 is an OA service such as an EDI system that a company permits external users to use.

FIG. 2 is a block diagram showing the details of the OA management system. In the figure, when the user terminal 1 receives an access from the user terminal 1 to the in-house network 10, it is judged whether or not the access is the first access. When the access count determination unit 22 is the first access, the reliability investigation unit that refers to the reliability information stored in the reliability information DB 7 and investigates whether or not the user of the user terminal 1 is reliable, When the user of the user terminal 1 is reliable, the information updating unit 23 adds the user information of the user to the access information DB 5 and sets the firewall 8 to permit the use of the user. An information updating unit is composed of the access count judging unit 21, the reliability investigating unit 22, and the information updating unit 23.

If 24 is not the first access, the access information DB 5 is created by using the terminal information of the user terminal 1 as a key.
An authentication requesting unit (authentication requesting means) for obtaining user information from the user and transmitting the user information to the firewall 8 and requesting authentication to be performed, and 25 notifies the user terminal 1 of the result of the investigation by the reliability investigating unit 22. It is a user notification unit (notification means). FIG. 3 is a flowchart showing the processing contents of the OA management system.

Next, the operation will be described. First, when the access count determination unit 21 receives an access to the corporate network 10 from the user terminal 1, the access count determination unit 21 determines whether or not the access is the first access. That is, it is determined whether the user of the user terminal 1 is a user who is already permitted to access the in-house network 10.

Specifically, it is determined as follows whether or not it is the first access. (1) Method of examining packet Acquire a sender address from the transmission packet of the user terminal 1 (see FIG. 6), and use the sender address as a key,
User information is retrieved from the access information DB 5. When the user information corresponding to the sender address exists, it is determined that the user has accessed in the past and access is already permitted.

(2) Method of checking environment variables This can be checked by acquiring CGI environment variables related to the user terminal environment such as the terminal address, host name, browser used, etc. Then, the user information is searched from the access information DB 5 using the environment variable as a key. When the user information corresponding to the environment variable exists, it is determined that the user has accessed in the past and is already permitted to access.

(3) Method of Obtaining Cookie Information Cookie information of the user terminal 1 that has accessed (information issued by the accessed Web server to the user terminal 1 when the user terminal 1 accesses the Web server) Yes, in addition to the URL of the Web server, information input by the user terminal 1 on the home page is included). If the cookie information cannot be acquired, the user is judged to be the first access. However, depending on the user terminal 1, there is a case where the Cookie incoming call is rejected, and such a case cannot be dealt with.

When the access number determination unit 21 determines that the access is the first access, the access number determination unit 21 transmits the terminal information of the user terminal 1 to the reliability investigation unit 22 and causes the reliability investigation of the user to be executed. On the other hand, when it is determined that the access is not the first access, the user information retrieved from the access information DB 5 (for example, user ID, password, URL of accessible system) is transmitted to the authentication requesting unit 24. Here, FIG. 4 is a flowchart showing the processing contents of the access count judging unit 21, and FIG. 5 is an explanatory diagram showing the user information stored in the access information DB 5.

When the access frequency determination unit 21 determines that the access is the first access, the reliability check unit 22 determines whether or not the user who has accessed may be permitted to access the in-house network 10. .

Specifically, it is determined whether or not to permit in the following manner. First, the terminal information of the user terminal 1 transmitted from the access number determination unit 21 and the terminal address information D
The terminal information stored in B6 is compared. That is, the terminal address information DB 6 stores information about addresses and address bands allocated to in-house terminals,
By comparing these with the terminal information of the user terminal 1,
It is determined whether the user is an in-house user.

In the above comparison process, the user judged to be an outside user is requested to input the following information by displaying the input screen as shown in FIG. 7 on the user terminal 1.・ Name, company name, Email address, contact information (TEL-No, etc.) ・ In-house system you want to use

Then, the above information input by the user and the reliability information stored in the reliability information DB 7 (for example,
Company information database available on the market).
The company information stores data indicating the management status of the company, such as the number of employees, stock price, sales, annual growth rate, founding, and industry. On the other hand, as the personal information, data indicating the social reliability of the user (credit card payment status, etc.) is stored. The reliability information DB 7 is
The commercially available company information DB may be diverted as it is, or may be added with its own additional information. Also, the commercially available company information DB is this D
You may make it download automatically from the company which provides B. The reliability of the company to which the user belongs is determined from the company information, and if it is OK, the user is permitted to access the in-house network 10 (OA application system 11) thereafter.

As the reliability judgment standard, for example, the number of employees of 1,000 or more and the annual sales amount or more, or the stock price or more and the annual growth rate being positive can be considered. These standards can be freely set by the system administrator. Further, although the case where the company information is used as the reliability information is shown here, the reliability information is not limited to this and may be personal information, for example.
9. Note that FIG. 9 is a flowchart showing the processing contents of the reliability research unit 22.

The reliability research section 22 is the internal network 1
When the access to 0 is not permitted, the fact is notified to the user notification unit 25. As a result, the user notification unit 25 sends a message indicating that access is not permitted to the user terminal 1 by e-mail. On the other hand, when permitting access to the in-house network 10, the fact is notified to the information updating unit 23.

When the information updating unit 23 receives a notification from the reliability research unit 22 that the access is permitted, the information updating unit 23 does not need to carry out a reliability research on the user at the time of the next and subsequent accesses. Add to access information DB5. Further, the user is added to the user entry 9 of the firewall 8 so that the firewall 8 can permit the access of the user. That is,
The user information of the user is registered in the user entry 9. FIG. 10 is an explanatory diagram showing the registered contents of the user entry 9.

When the entry for the user entry 9 is completed, the information updating section 23 sends the permission information as shown in FIG. 8 to the user terminal 1 by e-mail through the user notifying section 25. Here, FIG. 11 is a flowchart showing the processing contents of the information updating unit 23.

The authentication requesting unit 24 includes the access count determining unit 2
When it is determined that 1 is not the first access, the user information acquired by the access count determination unit 21 is transmitted to the firewall 8 and a request for authentication is requested. As a result, it is possible to cause the firewall 8 to perform an authentication process without the user having to input a user ID or password as in the conventional case. Here, FIG. 12 is a flowchart showing the processing contents of the authentication requesting unit 24.

When the firewall 8 receives an authentication execution request from the authentication request unit 24 together with the user information, the firewall 8 compares the user information with the registered content of the user entry 9. If the user information is registered in the user entry 9,
Access to the OA application system 11 of the in-house network 10 is permitted. Here, FIG. 13 is an explanatory diagram showing an outline of the operation of the authentication processing.

As a result, the user terminal 1 can access the OA application system 11 of the company network 10. Here, OA application system 11
Is an electronic application procedure for using services provided by the OA service 13 (for example, a material information management system, a sales information support system, a consolidated accounting settlement system). If accepted and the use permission of the service is obtained, the access of the user terminal 1 to the OA service 13 is permitted. When a user is applying for the use of the OA service 13 by the OA application system 11, information indicating that the process of the user is “applying” is stored in the application status management DB 12.

As is clear from the above, the first embodiment
According to the above, when the user terminal 1 receives access to the in-house network 10, the terminal information of the user terminal 1 is used as a key to acquire the user information from the access information DB 5, and the user information is transmitted to the firewall 8 for authentication. Since it is configured to request the execution of the above, there is an effect that the user can obtain the authentication from the firewall 8 without performing the input operation of the ID / password every access.

Embodiment 2. FIG. 14 is a block diagram showing the details of the OA management system. In the figure, the same reference numerals as those in FIG. Two
Reference numeral 6 denotes a status investigation unit (status management means) that manages the application processing status of the user terminal 1 for the OA application system 11 of the in-house network 10.

Next, the operation will be described. Situation Research Department 2
6 refers to the access information DB 5 and the application status management DB 12 at regular intervals and investigates whether or not the application processing of the OA application system 11 by the user terminal 1 is completed.
For example, the regular interval is once a day at midnight,
This means that execution is done in batch scheduling, and this interval is set by the system administrator.

When the application processing is completed, the situation investigation unit 26 deletes the user account on the OA application system 11 and permits the entry of the user on the firewall 8 to the OA application system 11. To the use permission for the OA service 13. Also, the item "current status" on the side of the access information DB5
Also updates “Application is in process → OA service is available”. Here, FIG. 15 is an explanatory diagram showing an outline of the investigation of the application processing.

Further, the situation investigation section 26 investigates the expiration date of the user terminal 1 for the OA service 13 of the in-house network 10. That is, the service expiration date of each user is investigated at regular intervals set by the system administrator,
Check if the service is about to expire.
The access information DB 5 and the user information database of the OA service include the OA service 13 being used by each user.
And the information about the usage authority and the usage deadline for it are recorded. The situation investigation unit 26 uses the user notification unit 2
The user is approaching the expiration date of the information via 5. Here, FIG. 16 is an explanatory view showing the outline of the investigation of the expiration date.

As is clear from the above, the second embodiment
According to the OA application system 1 of the company network 10
Since the application processing status of the user terminal 1 for 1 is managed, the effect that the application processing status can be confirmed is achieved. Further, according to the second embodiment, since the expiration date of the user terminal 1 for the OA service 13 of the in-house network 10 is configured to be managed, the expiration is notified in advance and the user cannot use the OA service. In addition to being able to prevent the situation, it is possible to quickly re-contract the OA service of the user.

[0047]

As described above, according to the present invention, when an access to an in-house network is received from a user terminal, the information about the user is acquired from the database using the terminal information of the user terminal as a key, and the information is stored. Since the authentication request means for sending to the firewall and requesting the authentication is provided, it is possible to obtain the authentication from the firewall without the user having to input the ID / password each time the user accesses. is there.

According to the present invention, when the user terminal of the user who is not authorized to access the in-house network receives the access to the in-house network, it is investigated whether or not the user can be trusted, and if the user is trusted. Since the information updating means for adding the information about the user to the database is provided, there is an effect that the application person in charge and the system administrator can save the trouble of manually setting and registering the user information in the system. .

According to the present invention, when the user is reliable, the information updating means is configured to allow the firewall to permit the use of the user.
This has the effect of allowing an unspecified number of external users to use various OA services within the company.

According to the present invention, since the notifying means for notifying the user terminal of the investigation result by the information updating means is provided, the user can confirm whether or not he / she can access the in-house network.

According to the present invention, since the status managing means for managing the application processing status of the user terminal for the OA application system existing in the in-house network is provided, it is possible to confirm the application processing status. is there.

According to the present invention, since the situation management means manages the expiration date of the user terminal for the OA service existing in the in-house network, the expiration is notified in advance and the user uses the OA service. It is possible to prevent a situation in which it becomes impossible and to quickly make a re-contract regarding the use of the OA service by the user.

According to the present invention, since the notifying means for notifying the user terminal of the expiration date of the user terminal for the OA service is provided, the user can confirm the expiration date of the user terminal. .

According to the present invention, when an access to an in-house network is received from a user terminal, the terminal information of the user terminal is used as a key to acquire the information on the user from the database, and the information is transmitted to the firewall for authentication. Since it is configured to request the implementation, there is an effect that the user can obtain the authentication from the firewall without performing the operation of inputting the ID / password each time the access is made.

According to the present invention, when a user terminal of a user who is not authorized to access the in-house network receives access to the in-house network, it is investigated whether or not the user can be trusted. Since the information about the user is added to the database, the number of users of the OA service inside the company can be expanded to the outside, and the outside users can be limited to only those who have a certain degree of reliability. .

According to the present invention, when the user is trusted, the firewall is configured to allow the use of the user, so that the system administrator does not have to manually maintain the firewall entry. There is an effect that can be.

According to the present invention, since the user terminal is notified of the result of the investigation as to whether or not it is reliable, there is an effect that the user can confirm whether or not the user can access the company network.

According to the present invention, the application processing status of the user terminal for the OA application system existing in the in-house network is managed, so that the application processing status can be confirmed.

According to the present invention, since the expiration date of the user terminal for the OA service existing in the in-house network is managed, it is possible to warn the expiration in advance and prevent the user from using the OA service. It is possible to prevent it and promptly
There is an effect that it is possible to re-contract regarding the use of service A.

According to the present invention, since the user terminal is notified of the expiration date of the user terminal for the OA service, the user can confirm the expiration date of the user terminal.

[Brief description of drawings]

FIG. 1 is a configuration diagram showing an in-house network to which an OA management system according to a first embodiment of the present invention is applied.

FIG. 2 is a configuration diagram showing details of an OA management system.

FIG. 3 is a flowchart showing the processing contents of an OA management system.

FIG. 4 is a flowchart showing the processing contents of an access count determination unit.

FIG. 5 is an explanatory diagram showing user information stored in an access information DB.

FIG. 6 is an explanatory diagram showing a transmission packet of a user terminal.

FIG. 7 is an explanatory diagram showing an input screen for personal information.

FIG. 8 is an explanatory diagram showing access permission information.

FIG. 9 is a flowchart showing the processing contents of the reliability check unit.

FIG. 10 is an explanatory diagram showing registration contents of a user entry.

FIG. 11 is a flowchart showing the processing contents of an information updating unit.

FIG. 12 is a flowchart showing the processing contents of an authentication request unit.

FIG. 13 is an explanatory diagram showing an operation outline of authentication processing.

FIG. 14 is a configuration diagram showing details of an OA management system.

FIG. 15 is an explanatory diagram showing a survey outline of application processing.

FIG. 16 is an explanatory diagram showing an outline of a usage deadline survey.

[Explanation of symbols]

1 user terminal, 2 internet, 3 OA management system, 4 OA management device, 5 access information DB (database), 6 terminal address information DB, 7 reliability information DB, 8 firewall, 9 user entry,
10 Internal network, 11 OA application system, 1
2 application status management DB, 13 OA service, 21 access count judging unit (information updating unit), 22 reliability investigation unit (information updating unit), 23 information updating unit (information updating unit), 24 authentication requesting unit (authentication requesting unit) ), 25 user notification section (notification means), 26 situation investigation section (status management means).

   ─────────────────────────────────────────────────── ─── Continued front page    (72) Inventor Shigehiko Takagi             2-3 2-3 Marunouchi, Chiyoda-ku, Tokyo             Inside Ryo Electric Co., Ltd. (72) Inventor Toshio Araki             2-3 2-3 Marunouchi, Chiyoda-ku, Tokyo             Inside Ryo Electric Co., Ltd. F term (reference) 5B075 ND20 NS01                 5B085 AA08 AE02 AE04 BA07 BG07                 5B089 GA11 GA21 GA31 GB02 JA21                       KA17 KB06 KC58                 5J104 AA07 KA01 KA07 PA07                 5K033 AA08 DB12 EC00

Claims (14)

[Claims] 1. A database in which information about users who are permitted to access the in-house network is stored, and when the user terminal receives access to the in-house network, the terminal information of the user terminal is used as a key to store the user in the database. An OA management system including: an authentication requesting unit that acquires information about the information, sends the information to a firewall, and requests authentication to be performed. 2. When an internal network access is received from a user terminal of a user who is not authorized to access the internal network, it is investigated whether or not the user can be trusted. The OA management system according to claim 1, further comprising an information updating means for adding information to the database. 3. The OA according to claim 2, wherein the information updating means sets a firewall to permit the use of the user when the user is trustworthy.
Management system. 4. The OA management system according to claim 2 or 3, further comprising notifying means for notifying a user terminal of a result of the investigation by the information updating means. 5. The condition management means for managing the application processing status of a user terminal for an OA application system existing in an in-house network is provided, and any one of claims 1 to 4 is provided. OA management system. 6. The OA management system according to claim 5, wherein the situation management means manages a use deadline of the user terminal for the OA service existing in the in-house network. 7. The OA management system according to claim 6, further comprising notifying means for notifying the user terminal of the expiration date of the user terminal for the OA service. 8. When a user terminal receives access to an in-house network, the terminal information of the user terminal is used as a key to obtain information on a user who is permitted to access the in-house network from a database, and the information is stored in a firewall. An OA management method for sending and requesting the execution of authentication. 9. When an internal network access is received from a user terminal of a user who is not authorized to access the internal network, it is investigated whether or not the user can be trusted. If the user is trusted, the user is related to the user. 9. The OA management method according to claim 8, wherein the information is added to the database. 10. The OA management method according to claim 9, wherein when the user is trusted, the firewall is set to permit the use of the user. 11. The OA management method according to claim 9, wherein the user terminal is notified of the result of the investigation as to whether or not it is reliable. 12. The OA management method according to claim 8, wherein the application processing status of the user terminal with respect to the OA application system existing in the in-house network is managed. 13. The OA management method according to claim 12, wherein the expiration date of the user terminal for the OA service existing in the company network is managed. 14. The OA management method according to claim 13, wherein the expiration date of the user terminal for the OA service is notified to the user terminal.