JP2003202930A - Implementation authority management system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an implementation authority management system 1 for automatically notifying a user of an implementable application based on authority information, and for automatically installing the application to a client 4. <P>SOLUTION: Install information 16 of each user is prepared based on authority information 11 set by a manager, and each of user is automatically notified of an available application based on the install information 16, and the available application is automatically installed from an application distributing server 2 to a client 4 based on the install information 16. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an execution authority management system for centrally managing execution authority of applications and notifying a user of information regarding the execution authority in a client / server system.

[0002]

2. Description of the Related Art Generally, in a client / server system, an application used by a client is often prepared in a server. Normally, the system administrator sets the execution authority of the application for each user according to the operation policy, and instructs each user to install, set, or update the application. Also, the user is given a specific client,
The user individually downloads the application from the server according to instructions from the administrator, and installs, sets, or updates the specific client.

As described above, currently, the application execution authority can be set for each user, and
It is also possible to register a plurality of users as a group and set the execution authority for each group.

[0004]

However, various problems occur when installing an application from a server to a client.

First, the user has to install, set and update the application one by one according to an instruction from the administrator, which is very time-consuming and requires the user to individually set and update the entire system. It is also difficult to achieve consistency.

Further, since the application to which the execution authority is given is different for each user, the application actually installed in the client is different for each client. Therefore, there is a constraint that the user must use a specific client set for the user in order to use the application to which the execution right is given.

Further, the administrator needs to monitor whether the user has carried out the installation, setting, and updating work according to the instruction, which causes troublesome client management such as issuing an instruction again to the user who does not follow the instruction. Will end up.
Further, this effort tends to increase in proportion to the number of users and the number of applications, and nowadays, the burden on the administrator increases as the applications diversify.

The present invention has been made in view of the above circumstances, and automatically notifies the user of available applications based on the information on the execution authority set by the administrator, and automatically The purpose is to provide an execution permission management system to be installed on the client.

[0009]

In order to achieve the above object, the execution authority management system according to the present invention is an execution authority of an application used by a user on a client on a client / server system. Is an execution authority management system that manages an application and distributes an application from a server to a client, wherein the server includes an information saving unit that saves execution authority information that sets usage rights of the application for each user,
The client includes a reading unit that reads the execution authority information from the server, and a notification unit that creates a list of the applications that can be used by the user based on the read execution authority information and notifies the user. Is characterized by.

According to the first aspect of the present invention, the list of applications to which execution authority is automatically given is notified to each user based on the execution authority information set by the administrator. Can easily find out which applications are available. In addition, the consistency of the entire system can be achieved.

An execution authority management system according to a second aspect of the present invention is the execution authority management system according to the first aspect, in which the user notifies an application that the user has notified from the notification means. When the application is not installed on the specific client when it is executed on the specific client that is always used, the specific client imports the application from the server and installs the application in a usable state. It is characterized by comprising an installation means.

According to the second aspect of the invention, since the installation work is automatically performed when the application is used, the user does not need to perform the installation work, and the administrator does not have to install the application to the user. Not only is it unnecessary to instruct installation, but it is also possible to save the trouble of managing the client after instructing.

An execution authority management system according to a third aspect of the present invention is the execution authority management system according to the first aspect, wherein an application notified by the notification means that the user can use is executed by the user. When the application is not installed on any client when it is executed on any client that is permitted to use, the any client can fetch the application from the server and temporarily use the application. It is characterized in that it is provided with an installation means for installing in a proper state.

According to the third aspect of the present invention, the user can use the application to which the user has the execution right from any client, so that the work efficiency can be improved.

[0015]

BEST MODE FOR CARRYING OUT THE INVENTION First, the configuration of an embodiment of the present invention will be described with reference to FIGS.

FIG. 1 shows the configuration of the execution authority management system 1. The execution authority management system 1 includes an application distribution server 2 and a database server 3 as servers,
A plurality of clients 4 are provided as clients, each of which is connected by a LAN 5. The servers 2, 3 and the client 4 perform data communication such as file transfer using a predetermined protocol.

The application distribution server 2 comprises an application distribution section 6 and an application information management section 7. The application distribution unit 6 stores various applications in a compressed state, and has a function of transferring an application to the client 4 instructed by an instruction from the client 4. Further, in the application information management unit 7, information about various applications compressed and stored in the application distribution unit 6 is managed as the application information 8, and the application I transmitted from the client 4 is managed.
It has a function of searching the file name of the application from D and instructing the application distribution unit 6 to transmit the application having the searched file name to the client 4.

FIG. 2 is a data table of the application information 8. The application information 8 is a data table having items of [application ID] and [file name], and stores an ID number and a file name for each application. All applications are registered in this application information 8.

The database server 3 includes an authorization unit 10
And a user information management unit 13, both of which are managed by the authority maintenance system 9. The authority maintenance system 9 has a function of distributing various kinds of information set by the administrator to the authority giving section 10 and the user information managing section 13, and displaying information of each database on the screen. Further, it has a function of receiving information from the client 4 and the application distribution server 2 and collating the received information with the information of each database.

The authority granting section 10 has two kinds of databases of authority information 11 and hierarchical structure information 12, and the user information managing section 13 has three kinds of information: login information 14, affiliation information 15 and installation information 16. Both databases have a function of managing input / output of information to / from each database.

FIG. 3 is a data table of hierarchical structure information 12 showing the hierarchical structure of applications and folders.
The applications managed by the execution authority management system 1 are managed for each predetermined division, and the hierarchical structure information 12 has a tree structure of the folder and information indicating the location of the application in the tree structure. There is.

The hierarchical structure information 12 has four items of [hierarchical depth], [hierarchical ID], [name], and [application ID]. The tree structure of the folder and the location of the application are [hierarchical level]. It is managed by two items of "depth" and "layer ID", and each is given a name. Furthermore, the application I managed in the application information 8 is included in the [application ID].
D is registered and both data tables are associated.

In FIG. 3, the layer ID assigned to each application is a number indicating the location (folder) of the application. However, an item [pointer] is further provided, and a folder for each application is provided in the pointer. A tree structure may be represented by having information indicating.

FIG. 4 is a data table of the authority information 11. The authority information 11 stores application execution authority set for each application or for each folder. The authority information 11 includes [tier ID], [personal I
It has six items, D], [Department], [Department], [Department], and [Title], and the authority set for the application or folder indicated by the hierarchy ID ,
It is saved in units of sections, staff, and positions. When the execution authority is specified for the folder, the authority is given to all applications placed in the folder. Further, when the execution authority is designated for each group such as department or section, the execution authority is given to all the users belonging to the group.

For example, in FIG. 4, the folder "initial design" indicated by the hierarchy ID "F001" is authorized by the user having the personal ID "f0016508", so that the application IDs "AP0001" to "AP0001". You have been given the authority to execute the five applications up to AP0005 ". In addition, the application having the layer ID “A004F001” is authorized to the user having the personal ID “f0016509”, the user corresponding to the manager of the general affairs department, and the user belonging to the accounting department of the general affairs department. become.

FIG. 5 is a data table of the login information 14. The personal ID and password are stored for each user, and the personal ID and password that the user inputs when using the execution authority management system 1 are collated with this data table.

FIG. 6 is a data table showing belonging information 15 of all users managed by the execution authority management system 1. For each user, the personal ID, the information of the department to which the user belongs, and the job title are stored.

FIG. 7 is a data table of the application to which execution authority is given and the installation information 16 showing the installation status. This installation information 1
6 is created for each user, and the authority confirmation unit 19 of the client 4 and the user information management unit 13 of the database server 3
Will be saved in both. The menu system 17, which will be described later, refers to this installation information 16 and creates a menu screen (business support system menu).

The [Application ID] item stores the ID number of the application to which the execution authority is given, and the [Install] item stores the application ID.
When the application indicated by is installed in the client 4, “◯” is saved. Further, in the item of “last access”, information on the date and time when the application was last executed is stored.

The client 4 comprises an application installation section 18, an authority confirmation section 19 and an application execution section 20, and is managed by the menu system 17. The menu system 17 includes both servers 2 and 3.
It has a function of distributing files and various information transmitted from the application to the application installation unit 18 and the authority confirmation unit 19 and creating a menu screen.

The application installation section 18 is
It has a function of receiving a compressed file of an application sent from the application distribution server 2 and decompressing and saving it. The authority confirmation unit 19 has the above-described installation information 16, and refers to the installation information 16 or the installation information 16 in the database server 3 to refer to the menu unique to the user who has logged in to the menu system 17 (task support system menu). ) Has a function to create. The application execution unit 20 has a function of executing the application decompressed and saved by the application installation unit 18.

Next, the operation of the embodiment of the present invention will be described.

<Regarding Procedure for Granting Execution Authority> A procedure for the administrator to grant execution authority using the authority maintenance system 9 will be described with reference to FIGS. 1 and 8 to 11.

By using the authority maintenance system 9, the administrator can set the execution authority of the user for each application. It should be noted that the use of the authority maintenance system 9 is a privilege of the administrator, and general users cannot use the authority maintenance system 9.

FIG. 8 is a flow chart showing a processing procedure when the administrator gives the execution authority to the user. First, when the administrator starts the authority maintenance system 9, the authority maintenance system 9 firstly determines the authority granting unit 1
The hierarchical structure information 12 is read from 0 (step S0
1). The hierarchical structure information 12 stores registered applications and folders and information on their hierarchical structure. Therefore, a tree display of the folders and applications is performed based on them, and the administrator selects the displayed folders and applications from the displayed folders and applications. A folder or application for which the authority is set is selected (step S02).

FIG. 9 is a display example of folders and applications of the authority maintenance system 9. The left frame (a) in the figure is a tree display of folders and applications read from the hierarchical structure information 12. When a folder or application for which execution authority is set is selected from this tree, it is displayed in the right frame (b) in the figure. To be done.

Next, the user who gives the execution authority to the selected folder or application is set.
When one target to which execution authority is given is selected from the folders or applications displayed in the right frame (b) in FIG. 9, the authority maintenance system 9 sets the folder or application already selected from the authority granting unit 10. The authority information 11 that has been read is read (step S0
3) Based on the read authority information 11, a table of authority information 11 as shown in FIG. 10 is displayed (step S04).
The administrator inputs the user information to be further added to the information displayed in the table (c) in FIG.

When the administrator inputs user information, affiliation information 15 is prepared as input support information. Figure 1
When the 0 search button is selected, the authority maintenance system 9 reads the affiliation information 15 from the user information management unit 13 (step S05). Affiliation information read 15
Changes the display form according to the selected category, and the administrator designates the user or the affiliation to which the authority is given based on the displayed information (step S06).

FIG. 11 is a display example in which the affiliation information 15 is displayed as a tree in the category of organization. The left frame (d) in the figure is a tree display of all organizations, and the right frame (e) in the figure
Is a target for granting the selected authority. In this example, since the section is selected as a unit, the application execution authority is given to all the users who belong to the section.

After the target to which the execution authority is given is designated,
When the selection button on the upper right of FIG. 11 is selected, the screen returns to the screen of FIG. 10, and the information of the target selected in FIG. 11 is added to the table (c) of FIG. By selecting the registration button at the upper right, the authority maintenance system 9 adds the newly added target information for the folder or application selected in FIG. 9 to the authority information 11 (step S07). Further added / changed authority information 11
Based on the above, the application ID is additionally updated in the installation information 16 of each user prepared in the user information management unit 13 (step S08), and the system is terminated (step S09).

Through the above processing procedure, the administrator sets the execution authority using the authority maintenance system 9. The administrator can centrally perform authority management by using the authority maintenance system 9, so that system management work can be efficiently performed.

Further, when the execution authority is deleted, the procedure similar to the above can be carried out.
With reference to [Final access], the execution authority of an application that has not been accessed for a certain period of time may be automatically deleted.

Although the authority maintenance system 9 is provided in the database server 3 in this embodiment, only the administrator can use the authority maintenance system 9, and the administrator is, by its nature, the client 4
Since it is in a position to control all of the server systems, the authority maintenance system 9 is especially the database server 3
It doesn't have to be inside. It is provided in an arbitrary client 4, and the administrator can access the authority maintenance system 9 and the authorization unit 1 in the database server 3 from the arbitrary client 4.
If 0 and the user information management unit 13 can be controlled, the embodiment of the present invention can be satisfied.

<Business Support System Menu> Next, the procedure for automatically creating the “business support system menu” displayed when the user logs in to the menu system 17 will be described with reference to FIGS. 1 and 12 to 14. To do.

The menu system 17 creates a work support system menu in order to support the work of the user.
Applications that can be used by the user are registered and displayed in the task support system menu based on the execution authority set by the administrator.

FIG. 12 is a flow chart showing a series of processing procedures when a user uses an application to which execution authority is given. First, when the user activates the menu system 17, the menu system 17 logs in I
Waiting for input of D and password (step S2
1), a login screen including buttons for login and temporary login as shown in FIG. 13 is displayed. When the user logs in to the menu system 17, the button selected depends on the client used, and if the user is a login from another client 4, the user logs in to the menu system 17 by selecting the temporary login button. be able to.

When the user inputs the login ID and the password from the login screen, the menu system 17 first determines whether the login is a temporary login. When the user selects the temporary login button and determines that the login is performed (step S22), the temporary login flag is set (flag O).
N), recording that the application is temporarily used (step S23). If the login button is selected and the login is determined, the process proceeds to step S24.

Next, the menu system 17 transfers the input login ID and password to the database server 3 (step S24) and collates them with the login information 14 of the user information management section 13 (step S25). As a result of the collation, if the user is not registered in the login information 14 or if the relationship between the login ID and the password does not match, the menu system 17 ends (step S2).
6), the user cannot log in. If it is confirmed as a result of the collation that the user is registered in the login information 14, the user has logged in to the menu system 17.

Next, the menu system 17 confirms whether the installation information 16 exists in the client 4 (step S27). Naturally, the installation information 16 does not exist if the login is temporary, but the installation information 16 does not exist in the client 4 when the menu system 17 is logged in for the first time. Therefore, the existence of the installation information 16 is confirmed here.

First, when the installation information 16 exists in the client 4, the menu system 17 reads the installation information 16 (step S28). Next, the installation information 16 of the user prepared in the database server 3 is read (step S29).
It is checked whether the application IDs registered in the read installation information 16 match (step S
30). This is because the administrator may have updated the installation information 16. If the collation results do not match, it means that the execution authority of the application has increased or decreased, so the installation information 16 in the client 4 is updated to the latest information in the database server 3 (step S31).

On the contrary, if the installation information 16 does not exist in the client 4, the menu system 17 reads the installation information 16 in the database server 3 (step S32), and stores the read installation information 16 in the client 4 ( Step S3
3).

Installation information 16 in the client 4
After the above is created, the menu system 17 creates a work support system menu based on the installation information 16 (step S34). The menu system 17 refers to the hierarchical structure information 12 in the database server 3 and reads the folder and application hierarchical structure necessary for the user from the application ID registered in the installation information 16. Based on the read hierarchical structure, a business support system menu having a menu screen as shown in FIG. 14 is created. In the figure, "01 Design document
Data input ”(h) and“ 02 design document general output ”
(I) is an application that is given execution authority and is registered in the installation information 16.
Basic data input ”(f),“ 01 initial design ”(g),
"02 change design" (j) and "02 structure design"
(K) is a folder.

When the application displayed on the work support system menu is executed (step S35, details will be described later) and the user logs out of the menu system 17 (step S36), the installation information 16 is updated. Here, it is determined whether or not the temporary login flag is set (step S37), and if the result of the determination is that the login is not temporary login, the [final access] and [installation] of both installation information 16 in the database server 3 and the client 4 ] Item is updated (step S38), and the process ends (step S40).

If the result of the determination is that the user is a temporary login, the installation information 16 of the user who has made a temporary login and exists in the client 4 is deleted, and the installation information 16 of the database server 3 is set to "final access". The items are updated (step S39), the temporary login flag is cleared, and the process ends (step S40).

The work support system menu is created by the above processing procedure. The user can log in to the menu system 17 not only from his / her own client 4 but also from the client 4 of another person, and in any of the clients 4, the job support system menu based on the execution authority information 11 of each user is automatically generated. Since the application is created and displayed, it is possible to know the application to which the authority is given, so that the convenience of the user can be improved.

Although the installation information 16 is prepared for both the client 4 and the server in this embodiment, the present invention is not limited to this. The installation information 16 is prepared only for the client 4, and the menu system 17
May be collated with the authority information 11 of the database server 3 each time. Alternatively, the installation information 16 may be prepared only in the database server 3 and the authority information 11 of the database server 3 may be referred to each time the menu system 17 is activated. Further, the menu screen may be created by referring to the authority information 11 every time the business support system menu is created without preparing the installation information 16. Further, the collation of the installation information 16 can be simplified by collating the creation date and time of the installation information 16 instead of using the application ID.

<Regarding the processing when the application is executed> Next, the menu system 17 when the application is executed
The process will be described. FIG. 15 is a flowchart showing the processing procedure of the installation work when the application is executed, which is a subroutine from step S35 of FIG.

When the user selects an application displayed on the work support system menu, the menu system 17 first determines from the temporary login flag whether the user is a temporary login (step S5).
1). If the temporary login is not flagged,
Since the user has logged in from his / her own client 4 and the installation information 16 of the user himself / herself exists in the client 4, the installation information 16 in the client 4 is read (step S52). It is determined from the [Install] item whether the application to be executed is already installed in the read installation information 16 (step S53).

If the application to be executed is not installed, the menu system 17 sends the application ID to the application distribution server 2 and requests the application distribution server 2 to transfer the compressed file of the application corresponding to the application ID.

Upon receiving the transfer request for the compressed file, the application distribution server 2 searches the application information 8 for a compressed file corresponding to the simultaneously received application ID, and sends the file name to the application distribution unit 6. The application distribution unit 6 that has received the file name transfers the compressed file having that file name to the client 4, and the application installation unit 18 receives the compressed file (step S54).

Next, the application installation section 1
The decompressor 8 decompresses the received compressed file and stores it in a predetermined storage area in an executable state (step S55). When the installation work is completed successfully, the menu system 17
Updates the items “install” and “final access” in the installation information 16. Further, the authority maintenance system 9 is instructed to update the installation information 16 included in the user information management unit 13.

When the user executes the application and ends it (step S57), the subroutine is ended and the process returns to the main routine (step S58).

If the user is temporarily logged in, the compressed file is received from the application distribution server 2 as in the above case (step S59). Application installation unit 1 that received the compressed file
The step 8 decompresses the compressed file and stores it in a predetermined temporary storage area in an executable state (step S60). When the installation work is completed successfully, the menu system 17 causes the authority maintenance system 9 to display the user information management unit 13
An instruction is issued to update the item of “final access” of the installation information 16 included in (step S61). In this case, the [Install] item is not updated because it is a temporary installation.

When the user executes the application and ends it (step S62), the menu system 17 deletes all the applications stored in the temporary storage area (step S63), ends the subroutine, and returns to the main routine (step S63). S58). It is the client 4 that deletes the application in the temporary storage area.
This is to prevent duplicate installation on the application and prevent unauthorized access to the application to users who are not given execution authority.

As described above, since the user can use the application to which the user is authorized to execute, not only from the client 4 of the user, but also from the client 4 of another person, the work efficiency of the user can be improved.

In this embodiment, when the user logs in from the client 4 owned by another person, the application is temporarily installed. However, it is searched whether the application to be used is already installed in the client 4 and the existence of the application is detected. If you do, you may use it.

[0067]

As described above, in the execution authority management system of the present invention, the user who has logged in from any client can automatically use the execution authority information of the application set by the administrator. The list of applications is displayed and the applications are installed. Therefore, in order to use the application to which the execution right is given, it is possible to eliminate the restriction that the specific client set for the user must be used.

Further, since it is not necessary for the user to install, set, or update the application by himself, it is possible to reduce the time and effort of the user regarding maintenance of the application and the client management work of the administrator. further,
Since it is always based on the latest execution authority information, the administrator does not need to monitor whether the user has installed or set / updated the application as instructed, so even if the number of users and the number of applications increase, it is easy. Therefore, the consistency of the entire system can be achieved.

[Brief description of drawings]

FIG. 1 is a configuration diagram of an execution authority management system.

FIG. 2 is a data table of application information.

FIG. 3 is a data table of hierarchical structure information of applications and folders.

FIG. 4 is a data table of authority information.

FIG. 5 is a data table of login information.

FIG. 6 is a data table of user affiliation information.

FIG. 7 is a data table of installation information.

FIG. 8 is a flowchart showing a processing procedure of the authority maintenance system.

FIG. 9 is a display example of an authority maintenance system (display of folders and applications).

FIG. 10 is a display example of an authority maintenance system (display of authorization object).

FIG. 11 is a display example of an organization search (tree display).

FIG. 12 is a flowchart showing a processing procedure of a menu system.

FIG. 13 is a display example of a login screen of a business support system menu.

FIG. 14 is a display example of a business support system menu notified to a user after authorization.

FIG. 15 is a flowchart showing a procedure of installation work when an application is executed.

[Explanation of symbols]

1 Execution authority management system 2 Application distribution server 3 database server 4 clients 5 LAN 6 Application distribution section 7 Application Information Management Department 8 application information 9 Authority maintenance system 10 Authorization Department 11 authority information 12 Hierarchical structure information 13 User Information Management Department 14 Login information 15 Affiliation information 16 Installation information 17 Menu system 18 Application Installation Department 19 Authority Confirmation Department 20 Application Execution Unit

Claims (3)

[Claims] 1. An execution authority management system for managing execution authority of an application used by a user on a client / server system and distributing the application from the server to the client, wherein the server is each user. An information storage unit for storing execution authority information in which the usage right of the application is set, wherein the client reads the execution authority information from the server, and based on the read execution authority information, An execution authority management system comprising: a notification unit that creates a list of the applications that the user can use and notifies the user. 2. The execution authority management system according to claim 1, wherein when the application notified by the notification unit that the user is available is executed on a specific client that the user always uses, When the application is not installed in the specific client, the specific client includes an installation unit that acquires the application from the server and installs the application in a usable state. . 3. The execution authority management system according to claim 1, wherein the application notified by the notification means that the user is available is executed on an arbitrary client permitted to be used by the user. In addition, when the application is not installed in the arbitrary client, the arbitrary client includes an installation unit that acquires the application from the server and temporarily installs the application in a usable state. Execution authority management system.