JP2004019339A - Device and method for management entrance and exit - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To facilitate the correction work of a user registration work or passage condition setting and to easily detect even a mistaken setting case. <P>SOLUTION: Based on a user attribute table 114 in which a user ID and attributes are recorded and a zone attributes table 115 in which the conditions of passage permission for the user ID and the user attributes are recorded, in order to make the passage permission decision of a passage propriety table 112 in which the passage permission setting against the combination of the arbitrary user ID and the zone ID are recorded, the setting can be more easily done in comparison with the conventional management device for entrance and exit, and the working volume of registration and correction is less. As compared with 114, 115, since a table management means 113 deciding whether an inconsistent establishment exists in the passage propriety table 112 is provided, it can be easily corrected for the inconsistent establishment. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an access control device that manages the entry and exit of people and goods.
[0002]
[Prior art]
In recent years, buildings and building doors are equipped with card readers and electronic locks, and the information recorded on the cards is used to judge whether people or objects possessing the cards are allowed to pass, and then use the electronic locks on the doors. An access control device (security system) for controlling is becoming widespread. However, in the conventional access control device, it is necessary to set each access permitted area for each user. Therefore, when the number of users and the number of areas are large, there is a problem that a large amount of setting work is required and a setting error easily occurs. Was. In order to solve such a problem, for example, an access control device described in JP-A-6-185249 performs access control with the configuration shown in FIG. The configuration is briefly described below.
[0003]
In FIG. 9, reference numeral 100 'denotes a card reader terminal installed for each door in each area, and card data reading means 101' for reading an ID (IDentifier) as identification information for individually identifying a user from a card on which the ID is recorded, and a door. And an electronic lock control means 102 'for controlling the electronic lock installed in the electronic device. Reference numeral 110 'denotes a central processing unit for setting the traffic conditions of the user. The central processing unit 110' is a card ID matching means 111 'for checking whether or not the input ID is permitted to pass, and is defined in (a) to (d) of FIG. Means 901, 902, 904, and 903 for setting personal information, access class (AC), access group (AG), and access interval (ATI) respectively; card issuing means 906; And automatic switching means 905.
[0004]
In this access control device, since the traffic conditions of the user are set using categories having a predefined hierarchical structure of AG, ATI, and AC, the number of access permission conditions set is smaller than in the conventional access control device. I have.
[0005]
[Problems to be solved by the invention]
In the access control device described above, the setting work becomes more difficult as the number of users and the traffic control area become larger. First, when a user is registered, there is a problem that it is difficult to set an AC that matches the traffic conditions of the user. The administrator needs to search for an AC that meets the traffic conditions of the user to be registered. However, since the definition of the AC itself is described in ATI and AG as shown in FIG. Cannot be directly compared with the user's traffic condition specified by A. In order to specifically compare the condition, the contents of ATI and AG must be expanded in FIGS. 10C and 10D. There is no defined effect. If no matching AC exists as a result of the search, it is necessary to additionally define a new AC using AG and ATI. Furthermore, when defining an AC, a combination of an existing AG and ATI may not be able to express the traffic conditions of a registered user. In such a case, it is necessary to additionally define a new AG and ATI.
[0006]
As described above, in the access control device described above, the work that occurs with the registration of the user is very complicated. On the other hand, since there is no mechanism to check the traffic conditions once set, there is also a problem that if there is an error in the setting, it must be corrected by trial and error.
[0007]
The present invention has been made in order to solve such a problem, and an object of the present invention is to provide an access control device that can easily set and change a passage permission / prohibition table and can easily detect a setting error. is there.
[0008]
[Means for Solving the Problems]
An access control device according to the present invention includes: a terminal connected to a network having identification information input means for inputting user identification information; and an electronic lock control means for controlling access to an area;
Collation means for judging whether or not the user can pass in the area from the identifier of the user and the identifier of the area output from the terminal, and passing through any combination of the identifier of the user and the identifier of the area A permission setting is recorded, a passage permission / prohibition table referred to by the collating means, a user attribute table recording the identifiers and attributes of the users, a traffic identifier indicating the area identifiers, and traffic permission conditions for the attributes of the users. An area attribute table recording conditions for granting permission attributes,
Based on the user attribute of the user attribute table and the traffic permission attribute granting condition of the area attribute table, a traffic permission attribute representing an initial value of the traffic permission of the user is displayed on the traffic permission table, and the traffic permission setting A central processing unit connected to a network having a setting interface for receiving setting and correction information;
It is provided with.
[0009]
Further, the area attribute table of the access control device according to the present invention records a traffic prohibition attribute granting condition indicating a traffic prohibition condition for the attribute of the user,
The setting interface displays a traffic prohibition attribute provision condition in the traffic permission table based on a traffic prohibition attribute provision condition in the area attribute table.
[0010]
Further, the access control device according to the present invention refers to the user attribute of the user attribute table, the traffic permission attribute grant condition and the traffic prohibition attribute grant condition of the area attribute table, and determines whether or not the traffic permission setting in the traffic permission / prohibition table. A table management means for determining whether there is a consistent setting,
The terminal or the setting interface displays the inconsistent settings when the table management means determines that there is an inconsistency.
[0011]
Further, the table management means of the access control device according to the present invention, when the passage permission setting of the passage permission table includes a setting inconsistent with the setting contents of the user attribute table and the area attribute table, Is stored.
[0012]
Further, the access control device according to the present invention, when the user inputs a request to change the setting contents of the passage permission table from the terminal,
The contents of the passage permission setting of the passage permission / prohibition table are changed within a range in which there is no inconsistency between the contents of the user attribute table and the contents of the area attribute table.
[0013]
Also, the access control method according to the present invention is based on a user attribute table in which identification information and attributes of a plurality of users are stored, and an area attribute table in which identifiers of a plurality of areas and conditions for granting a traffic permission attribute are stored, Setting a traffic permission attribute representing an initial value of the traffic permission of the user;
For the combination of the area and the user, displaying the initial value on the setting interface,
For the passage permission / prohibition table in which the initial value is displayed, an input of a passage permission setting indicating whether or not the actual passage is permitted, and storing the passage permission setting,
Controlling the electronic lock for controlling access to the area based on the traffic permission setting;
It is provided with.
[0014]
BEST MODE FOR CARRYING OUT THE INVENTION
Embodiment 1 FIG.
Hereinafter, Embodiment 1 of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram showing a first embodiment of an access control device according to the present invention.
[0015]
In FIG. 1, reference numeral 103 denotes identification information input means such as a card reader or a fingerprint reader for inputting and reading user identification information. Reference numeral 101 denotes an identification information input means in addition to a standard interface device such as a keyboard and a display. A user interface having 103, an electronic lock control means 102 for controlling access to an individual area, and a terminal 100 having a user interface 101 and an electronic lock control means 102. Here, it is assumed that the identification information is represented by an identifier: ID.
Reference numeral 111 denotes a matching unit that determines whether or not the user can pass in the area based on the user ID (hereinafter, user ID) output from the terminal 100 and the ID of the area (hereinafter, area ID). Reference is made to a passage permission / inhibition table, 113 is a table management means for managing the passage permission / inhibition table, 114 is a user attribute table in which user attributes are recorded, 115 is an area attribute table in which area attributes are recorded, and 116 is various settings by a system administrator. Is a central processing unit that includes a matching unit 111, a traffic permission table 112, a table management unit 113, a user attribute table 114, a zone attribute table 115, and a setting interface 116.
Reference numeral 150 denotes a network in an area where access control is performed, and the terminal 100 and the central processing unit 110 are connected to the network 150 to configure an access control device.
[0016]
Next, the operation of the access control device shown in FIG. 1 will be described with reference to FIG. In the following description, it is assumed that the user uses a card for personal authentication.
The terminal 100 is installed in an area where access control is performed, and the electronic lock control means 102 locks the door of the area in normal times. First, in S201, a user who wants to enter or leave this area inputs a card to the identification information input means 103 (here, a card reader) provided in the user interface 101. Next, in step S202, the terminal determines whether the user ID has been read from the card. If the reading has failed, the process returns to step S201. The data is transmitted to the central processing unit 110 via 150. Next, in S204, the collation unit 111 determines whether or not the passage is permitted based on the received user ID and the area ID with reference to the passage permission / prohibition table 112. If the passage is permitted, the central processing unit 110 determines in S205. Sends a signal to permit unlocking to the terminal. Then, the electronic lock control means unlocks the door in this area, locks the door after opening / closing is confirmed in S206, or after a predetermined time has elapsed without opening / closing, and ends the processing. . On the other hand, if the access is not permitted in S204, the user is notified in S207 through the user interface 101 that entry / exit is not permitted, and the process ends.
[0017]
Next, examples of the user attribute table 114, the area attribute table 115, and the passage permission / prohibition table 112 assuming that the access control device is used in a company will be described with reference to FIGS.
FIG. 3A shows a user attribute table 114 in which the first column is assigned a user ID, and the second and subsequent columns are assigned attributes of an arbitrary number of users. In the example of (a), the second column is assigned to the department to which the user belongs, and the third column is assigned to the position of the user. For example, the user with the user ID: A belongs to the technical department, and the position is registered as the person in charge. I have. These attribute data are input by the administrator from the setting interface 116.
[0018]
FIG. 3B shows the area attribute table 115. The first column is an area ID uniquely assigned to each area, 301 is a column representing the attribute of the place, and 302 is the user attribute shown in FIG. A column 303 indicates a condition in which traffic is permitted by default, and a column 303 indicates a condition in which traffic is prohibited by default in the area using the user attribute (a). These settings are set when permission or prohibition is clear. In the example of (b), the place name to which the area belongs is assigned to 301, and in 302 and 303, the affiliation and the post are used for the condition designation from the user attribute of (a). For example, in (b), the area ID: 0005 is under the jurisdiction of the branch office, and in that area, traffic is permitted by the section manager of the general affairs department or the general manager of all departments, and traffic is prohibited by all departments. However, no clear criteria were set for section managers other than the general affairs department, so neither permission nor prohibition was set. These attribute data are input by the administrator from the setting interface 116. At this time, when inputting 302 or 303 of (b), the attribute of 301 is used.
(1) Select the location = factory area (0002, 0003) and assign permission to pass = enter the technical department
(2) Enter the permitted positions for 0002 and 0003 respectively
If the same contents are collectively input to a plurality of selected squares as in the above, the number of input operations is reduced as compared with the case of sequentially inputting the individual squares.
[0019]
FIG. 3C is a table showing whether or not the user ID registered in FIG. 3A is a row and all the area IDs registered in FIG. 3B are columns. The traffic condition for a certain area is recorded in the square where the corresponding user ID and area ID intersect. Initial setting of the passage permission / prohibition table 112 is performed by the table management unit 113 with reference to the user attribute table 114 and the area attribute table 115. The procedure of the initial setting is shown below with a specific example.
First, the table management unit 113 refers to the traffic permission condition in the area attribute table 115 for all areas. For example, in FIG. 3B, the traffic permission condition 302 of the area ID: 0001 is “affiliation = all, post title = all”. Therefore, the column of the area ID: 0001 in the traffic permission table 112 is set to all cells. A traffic permission attribute is given. Next, the traffic permission condition 302 of the area ID: 0002 is “affiliation = technical department, post = all”. Since the user attribute table 114 matches the condition, the user IDs are A and B, so In the column of the area ID: 0002 of the passage permission / prohibition table 112, the passage permission attribute is given to the cells of the user IDs A and B. In the order described above, the cells to which the initial settings are given from the traffic permission conditions 302 for the zone IDs: 0001 to 0005 in FIG. 3B are hatched with the pattern of the legend {1} in the traffic permission table 112 in FIG. it's shown.
The table management unit 113 refers to the traffic prohibition conditions of the area attribute table 115 for all the areas and assigns the traffic prohibition attribute to the traffic permission / prohibition table 112 in exactly the same procedure as the traffic permission attribute. The cells to which the initial settings are given by the traffic prohibition conditions 302 for the area IDs: 0001 to 0005 in FIG. 3B are hatched in the traffic permission table 112 in FIG.
In FIG. 3 (c), a cell without a pattern display, for example, in FIG. 3 (c), a cell where the user ID: C and the area ID: 0002 intersect does not have the pass permission attribute or the pass prohibition attribute assigned by default. Become.
[0020]
The administrator refers to the traffic permission attribute and the traffic prohibition attribute, and sets traffic permission to determine whether or not to actually pass. The place where the traffic permission setting is performed is indicated by the symbol (3) in (c). For example, the administrator sets (3) in the following order (1) to (3).
(1) In the initial setting, all the parts of the traffic permission attribute (1) are set to the traffic permission setting (3).
(2) In the column of area ID: 0004 where there is no default attribute, the attributes of (1) and (2) are not assigned because the operation standard has not been determined. There was a request that "we would like to allow all employees to pass for the time being."
(3) Since the General Affairs Department has applied for permission for the area ID: 0002 and the consent of the person in charge of 0002 has been obtained, the user IDs in the column of the area ID: 0002, which has no default attributes, have rows C to E. (Affiliation of General Affairs Department) Passing permission setting (3)
In the processing of FIG. 2 described above, the collation means 111 uses the traffic permission setting {circle around (3)} in S <b> 204 as a criterion for collation. If ▼ is set, traffic is allowed, otherwise it is not allowed. As described above, the traffic permission attribute, the traffic prohibition attribute, and the traffic permission setting are recorded in the traffic permission table 112 so that the traffic permission can be set in a hierarchical manner. A traffic permission setting can be made more easily.
[0021]
First, in the access control device of FIG. 9, it is difficult to set access permission when the traffic conditions are complicated and there is no regularity. However, in the access control device of FIG. (2) is given, and (3) is set according to the actual situation without setting (1) or (2) in areas where the traffic conditions are complicated and difficult to define in the area attribute table 115, or where the traffic conditions are not clear. The setting operation can be simplified since the setting can be made. The descriptions (2) and (3) of the setting method of the area attribute table 115 are examples in which the administrator sets (3) according to the actual situation.
In addition, in the access control device of FIG. 9, when an error is found in the traffic condition, correction work such as the necessity of newly defining AG, ATI, and AC may be complicated, but the access control device of FIG. Then, only the traffic permission setting (3) is changed for the problem part, so that the amount of work is reduced.
[0022]
Further, in the access control device of FIG. 9, traffic permission settings are given in units of users, whereas in the access control device of FIG. 1, traffic permission settings are given in units of zones, so that new registration work is easy. It is.
For example, when registering a new user, the access control device of FIG. 9 must determine and determine the user's AC after referring to and comparing the definitions of AG, ATI, and AC, but the access control device of FIG. When predetermined information is input to the table 114, the initial setting of the additional portion of the passage permission / prohibition table 112 is automatically generated.
Also, when adding a new area, the access control device of FIG. 9 must determine the AC if the definition of AG and AC needs to be reviewed, but the access control device of FIG. When the information and the entry / exit conditions are input, the initial setting of the additional portion of the passage availability table 112 is automatically generated.
[0023]
Embodiment 2 FIG.
Hereinafter, a second embodiment of the present invention will be described with reference to the drawings.
When the management area of the access control device shown in FIG. 1 is expanded and the number of users is increased, the information to be set by the administrator in the three types of tables of FIGS. 3A, 3B and 3C also increases. Therefore, the risk of inconvenience in user traffic due to an input error also increases. However, since the conventional access control device did not have a mechanism for checking for setting inconsistency, in order to prevent a problem from occurring when the user actually performed the access operation, the administrator carefully considered the settings. There was no other way but to review it.
[0024]
Generally, in the access control device, it is important that the setting of the passage permission / prohibition table for determining whether the passage is permitted is consistent. In the access control device of FIG. 1, (1) to (3) shown in FIG. 3 may be set for each cell in the passage availability table 112, but the combination of settings 8 = 2 ³ In the case of inconsistency, the following three types are collected.
(Inconsistency 1) In the case of having the attributes of (1) and (2) simultaneously (both setting and non-setting of (3))
(Inconsistency 2) When the attribute of (1) is set but (3) is not set
(Inconsistency 3) When (3) is set while having (2) attribute
The access control device of FIG. 1 can find (inconsistency 1) to (inconsistency 3) by referring to the passage availability table 112 from the table management means 113.
[0025]
FIG. 4 shows an operation in which the table management means 113 searches the traffic permission table 112 for (inconsistency 1) to (inconsistency 3) and notifies the setting interface 116 when it is found.
In step S401, (inconsistency 1) is searched, and if not found, the process proceeds to step S403. If found, the setting interface 116 is notified in step S402, and presented to the administrator on a display or the like on the setting interface 116. . The administrator makes corrections in some cases and then proceeds to S403.
In step S403, (inconsistency 2) is searched. If not found, the process proceeds to step S405. If found, the setting interface 116 is notified in step S404, and is presented to the administrator through a display or the like on the setting interface 116. . The administrator makes corrections in some cases, and then proceeds to S405.
In step S405, (inconsistency 3) is searched, and if not found, the process ends. If found, the setting interface 116 is notified in step S402, and is presented to the administrator on a display or the like on the setting interface 116. The administrator may make corrections before exiting.
[0026]
FIG. 5 shows an example of the mismatch setting. The squares in which inconsistencies were found are indicated by bold lines as in (4).
Since (1), (2) and (3) are all set in 501, it corresponds to (inconsistency 1). Therefore, for example, corresponding to the prohibition of passage in the area attribute table 115 so as to exclude the attribute of (2). Modifying the line resolves the inconsistency.
Since only (1) is set in 502, it corresponds to (inconsistency 2). Therefore, the inconsistency can be resolved by correcting the corresponding cell in the passage availability table 112 so as to add the setting of (3), for example.
Since (2) and (3) are set in 503 (inconsistency 3), this corresponds to (unmatched 3). Disappears.
[0027]
However, (mismatch 2) and (mismatch 3) may be intentionally set in the mismatch setting as shown in FIG. For example, there is a case where some traffic is prohibited during the stay of a special guest even in an area where it can be normally used, or a case where a detour is set due to construction work which is not an original traffic place. In this way, if the setting is temporary and it is decided to return to the original setting, the setting / non-setting of (3) can be performed without modifying (1) to (3) to maintain consistency. It is better to respond only by changing. Therefore, a method of temporarily changing the traffic permission setting in the access control device of FIG. 1 will be described below.
[0028]
First, when an inconsistency setting is performed, the administrator inputs the reason for the corresponding cell from the setting interface 116, and the table management unit 113 stores the input data in a format as shown in FIG. 6, for example.
On the other hand, if the administrator finds inconsistency in the order shown in FIG. 4, the inconsistent cell (4) in the passage permission / prohibition table 112 presented on the setting interface 116 is not immediately corrected. The user ID and the area ID corresponding to the cell are transmitted to the table management means 113 by mouse click or the like, and if a row having the user ID and the area ID as a heading is stored, the reason is referred to from the setting interface 116. I do. The administrator determines whether to correct the inconsistent square {circle around (4)} or leave it as it is, according to the content of the reason.
[0029]
According to the above method, the reason why the administrator has intentionally made an inconsistent setting is referred to, so even if an administrator who does not know the reason discovers the inconsistency, the inconsistent setting is corrected. Can be prevented.
For example, the cell 502 shown in FIG. 5 corresponds to (mismatch 2). However, referring to Table 6, there is a reason that the setting (3) has not been performed, so that the cell is not corrected. Also, the cell 503 corresponds to (mismatch 3), but referring to Table 6, it is possible to flexibly set and change, for example, there is a reason for setting (3) and no correction is made.
[0030]
Embodiment 3 FIG.
In the first and second embodiments described above, the traffic permission setting (3) in the traffic permission table 112 is performed only by the administrator by operating the setting interface 116. However, as long as the administrator has made the initial settings of the user attribute table 114 and the area attribute table 115, the user can set the traffic permission setting (3) by himself. However, since the access control device is intended to maintain security, the conditions and range in which the user can make settings also need to be restricted according to the security level required for the control area. Therefore, a method in which the user sets the traffic permission setting (3) while maintaining security by the access control device shown in FIG. 1 will be described below.
[0031]
Hereinafter, an operation in which the user performs the traffic permission setting (3) at the terminal 100 of the access control device of FIG. 1 will be described. Here, the following three items are given as restrictions for maintaining security.
(Α) Range that can be set by the user on the passability table
(Β) Attributes of the passability table before setting
(Γ) Authentication for validating the setting in the passage permission table
[0032]
(Α) is a condition for determining a settable portion of the passage availability table 112. For example, if the condition is “the same affiliation as the user and the job class of the post is lower than the user”, taking the user attribute table 114 in FIG. 3A as an example,
User ID: C can be set for User ID: C,
User ID: D can be set for user IDs: C and D,
User ID: E can be set for user IDs: C, D, E
It becomes. In the following, it is simply assumed that “only oneself can be set (all areas)”.
(Β) is a condition relating to the attributes (1) and (2) given to the passage permission / prohibition table 112 before setting by the user. In the following, it is assumed that the traffic is permitted unless the traffic prohibition is specified, and the condition is that "(2) is not given".
(Γ) is security for preventing setting with a stolen card, for example, and becomes unnecessary when a fingerprint is used for personal authentication. In the following, “password authentication” is a condition.
[0033]
Now, in the initial state, the password of each user is registered as one attribute of the user attribute table as shown in FIG. 7A, and ▲ is shown in the passability table 112 as shown in FIG. 7B. It is assumed that the attributes 1) and 2) are assigned, but 3) is not set.
[0034]
Hereinafter, an operation in which the user sets the passage permission in the passage permission / prohibition table 112 of the access control apparatus of FIG. 1 will be described with reference to FIG. 8, the same reference numerals as those in FIG. 2 denote the same or corresponding parts, and a description thereof will be omitted.
[0035]
First, it is assumed that the user with the user ID: D has authenticated the terminal 100 in the area with the area ID: 0001. In the initial state, only (1) is set for the corresponding cell as shown in FIG. 7B, so that the process proceeds from S204 to S801, and then to S802. If the personal authentication using the password is successful in step S802 with reference to FIG. 7A, (3) is set in the passage permission / prohibition table 112 in step S803. If the personal authentication fails in S802, a non-permission is notified in S207, and the process ends. After the next time, when the user of the user ID: D performs authentication at the terminal 100 in the area of the area ID: 0001, (3) is set in the corresponding cell, so that the authentication succeeds in S204 and the area is changed in S205 and thereafter. pass.
[0036]
Next, it is assumed that the user of the user ID: D has authenticated the terminal 100 in the area of the area ID: 0002. In the initial state, there is no setting for the corresponding cell as shown in FIG. 7B, so that the process proceeds from S204 to S801, and then to S802. If personal authentication using a password is successful in step S802 with reference to FIG. 7A, (3) is set in the passability table in step S803, and the vehicle passes through the area in step S205 and subsequent steps. If the personal authentication fails in S802, a non-permission is notified in S207, and the process ends. After the next time, when the user of the user ID: D performs authentication with the terminal 100 in the area of the area ID: 0002, (3) is set in the corresponding cell, so that the authentication is successful in S204 and the area is changed in S205 and thereafter. pass.
[0037]
Next, it is assumed that the user with the user ID: D has authenticated the terminal 100 in the area with the area ID: 0003. In the initial state, only (2) is set for the corresponding cell as shown in FIG. 7 (b), so that the process proceeds from S204 to S801, then to S207, notifies the non-permission, and ends. After the next time, when the user with the user ID: D authenticates with the terminal 100 in the area with the area ID: 0003, the user is notified of the non-permission in the same order and ends.
[0038]
Here, S801 in FIG. 8 corresponds to the above condition (β), and S802 corresponds to the condition (γ). Further, the range in which the setting in S803 is possible is determined by setting (α). That is, when it is desired to change the security items (α) to (γ), a desired security level can be realized by changing the corresponding step among S801 to S803.
[0039]
As described above, according to the present invention, in the conventional access control device, the setting of the traffic permission / prohibition conditions, which was performed only by the administrator, can now be performed by the user. Can maintain a certain level of security. In the example shown above, the administrator performs only the initial settings of (1) and (2), and after that, while maintaining the security, the access control device is operated while updating the traffic conditions according to the user settings. I have.
[0040]
【The invention's effect】
As described above, the access control device according to the present invention includes a terminal connected to a network having identification information input means for inputting user identification information, and an electronic lock control means for controlling access to an area,
Verification means for determining whether or not the user can pass in the area from the identifier of the user and the identifier of the area output from the terminal, and for any combination of the identifier of the user and the identifier of the area, A traffic permission / prohibition table in which a traffic permission setting is recorded and referred to by the collating means, a user attribute table in which the user identifiers and attributes are recorded, a traffic identifier indicating the area identifier, and traffic permission conditions for the user attributes An area attribute table recording conditions for granting permission attributes,
Based on the user attribute of the user attribute table and the traffic permission attribute granting condition of the area attribute table, a traffic permission attribute representing an initial value of the traffic permission of the user is displayed on the traffic permission table, and the traffic permission setting A central processing unit connected to a network having a setting interface for receiving setting and correction information;
To provide
Even if the setting contents of the traffic conditions are mixed with regularity and irregularity, or the initial setting has ambiguity, the setting can be easily performed even in the case where the setting was difficult with the conventional access control device, and new registration and correction In this case, the amount of work is smaller than before.
[0041]
Further, the area attribute table further records a traffic prohibition attribute granting condition indicating a traffic prohibition condition for the attribute of the user,
The setting interface further displays a traffic prohibition attribute provision condition in the traffic permission table based on the traffic prohibition attribute provision condition of the area attribute table, so that even if the traffic permission condition is unknown, the traffic prohibition condition As a result, the setting of traffic conditions can be performed, so that the setting work can be further reduced.
[0042]
Further, referring to the user attribute of the user attribute table and the traffic permission attribute granting condition and the traffic prohibition attribute granting condition of the area attribute table,
A table management unit that determines whether there is a setting that is inconsistent with the traffic permission setting of the traffic permission table,
When the terminal or the setting interface is determined to have an inconsistency in the table management means, to display the inconsistent settings,
The administrator can easily find even if there is an inconsistency in the settings, and can also indicate an inconsistency in the passage permission / inhibition table, so that it is easy to make corrections.
[0043]
Further, the table management means, when the passage permission setting of the passage permission / prohibition table includes a setting inconsistent with the setting contents of the user attribute table and the area attribute table, stores the reason.
Even if you intentionally make an inconsistent setting with the initial setting, you can refer to the reason, so there is no danger of a third party changing the inconsistent setting, and the traffic conditions can be set flexibly as necessary it can.
[0044]
Further, the table management means, when the user inputs a request to change the setting contents of the passage permission table from the terminal,
To change the traffic permission setting contents of the traffic permission table within a range where the contents of the user attribute table and the contents of the area attribute table do not become inconsistent,
Even if the administrator does not change the setting, the access control device can be operated while maintaining a certain level of security.
[0045]
Also, the access control method according to the present invention is based on a user attribute table in which identification information and attributes of a plurality of users are stored, and an area attribute table in which identifiers of a plurality of areas and conditions for granting a traffic permission attribute are stored, Setting a traffic permission attribute representing an initial value of the traffic permission of the user;
For the combination of the area and the user, displaying the initial value on the setting interface,
For the passage permission / prohibition table in which the initial value is displayed, an input of a passage permission setting indicating whether or not the actual passage is permitted, and storing the passage permission setting,
Controlling the electronic lock for controlling access to the area based on the traffic permission setting;
To provide
Even if the setting contents of the traffic conditions are mixed with regularity and irregularity, or the initial setting has ambiguity, the setting can be easily performed even in the case where the setting was difficult with the conventional access control device, and new registration and correction In this case, the amount of work is smaller than before.
[Brief description of the drawings]
FIG. 1 is a block diagram illustrating a configuration of an access control device according to a first embodiment of the present invention.
FIG. 2 is a flowchart according to the first embodiment of the present invention.
FIG. 3 is a table used for collation in the access control device according to the first embodiment of the present invention, which is (a) a user attribute table, (b) an area attribute table, and (c) a passability table.
FIG. 4 is a flowchart according to a second embodiment of the present invention.
FIG. 5 is an example of a passage permission / prohibition table when there is inconsistency in entry / exit condition settings according to the second embodiment of the present invention.
FIG. 6 is an example of reason registration when there is an inconsistency in entry / exit condition settings according to the second embodiment of the present invention.
FIGS. 7A and 7B are tables used for collation in the access control device according to the third embodiment of the present invention, and are respectively: (a) a user attribute table; (b) a traffic permission table (initial setting); After)
FIG. 8 is a flowchart according to a third embodiment of the present invention.
FIG. 9 is a block diagram showing a configuration of a conventional access control device.
FIGS. 10A and 10B show examples of tables used for collation in a conventional access control device, respectively: (a) a personal information table, (b) an access class information table, (c) an access group information table, (d) an access interval information table, Is
[Explanation of symbols]
REFERENCE SIGNS LIST 100 terminal, 101 user interface, 102 electronic lock control means, 103 identification information input means, 110 central processing unit, 111 collation means, 112 traffic permission table, 113 table management means, 114 user attribute table, 115 area attribute table, 116 Configuration interface, 150 networks

Claims (6)

A terminal connected to a network having identification information input means for inputting user identification information, and an electronic lock control means for controlling entry and exit of the area, and a user identifier output from the terminal and A matching unit that determines whether or not the user can pass in the area from the identifier; and a traffic permission setting in which a traffic permission setting is recorded for any combination of the identifier of the user and the identifier of the area, and which is referred to by the matching unit. Permission / non-permission table, a user attribute table that records the identifier and attribute of the user, an identifier of the area, and an area attribute table that records a traffic permission attribute granting condition indicating a condition of traffic permission for the attribute of the user,
Based on the user attribute of the user attribute table and the traffic permission attribute granting condition of the area attribute table, a traffic permission attribute representing an initial value of the traffic permission of the user is displayed on the traffic permission table, and the traffic permission setting A setting interface for receiving setting and correction information, and a central processing unit connected to a network having:
Access control device characterized by comprising: The zone attribute table further records a no-pass attribute providing condition indicating a no-pass condition for the attribute of the user,
The entry / exit management device according to claim 1, wherein the setting interface further displays a traffic prohibition attribute provision condition in the traffic permission table based on the traffic prohibition attribute provision condition of the area attribute table. With reference to the user attribute of the user attribute table and the traffic permission attribute grant condition and the traffic prohibition attribute grant condition of the zone attribute table,
A table management unit that determines whether there is a setting that is inconsistent with the traffic permission setting of the traffic permission table,
The entry / exit management device according to claim 2, wherein the terminal or the setting interface displays the inconsistent setting when the table management unit determines that there is inconsistency. The table management means, when the passage permission setting of the passage permission / prohibition table includes a setting inconsistent with the setting contents of the user attribute table and the area attribute table, stores the reason. An access control device according to any one of claims 1 to 3. The table management means, when the user inputs a change request of the setting contents of the passage permission table from the terminal,
The access control according to any one of claims 1 to 4, wherein the traffic permission setting contents of the traffic permission table are changed within a range where the contents of the user attribute table and the contents of the area attribute table do not become inconsistent. apparatus Based on a user attribute table in which identification information and attributes of a plurality of users are stored, and an area attribute table in which identifiers of a plurality of areas and a condition for granting a traffic permission attribute are stored, a traffic representing an initial value of whether or not the user can pass is provided. Setting permissions;
For the combination of the area and the user, displaying the initial value on the setting interface,
For the passage permission / prohibition table in which the initial value is displayed, an input of a passage permission setting indicating whether or not the actual passage is permitted, and storing the passage permission setting,
Controlling the electronic lock for controlling access to the area based on the traffic permission setting;
Access control method characterized by comprising:

Images