JP2004062241A - Controller and method for controlling user access right - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To dynamically change an access right in response to various conditions, even when the same user ID is used. <P>SOLUTION: At least the user ID and a password of a log-in user is received, information about a using condition of a user terminal used by the detected log-in user is received from the user terminal, whether the log-in user is a registered user or not is referred based the user ID and the password, a duty section is specified to specify a usable application, a processible condition pattern for specifying the processability is acquired in every conditional element for expressing the using condition, and information as to the using condition of the user terminal used by the log-in user is matched with the processible condition pattern to settle the presence of the access right to the application or the like. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a user access right control device and method capable of appropriately controlling an access right to an application or the like even if a user logs in from any terminal connected via a network environment.
[0002]
[Prior art]
With the rapid development of communication environments including the Internet, a plurality of users can easily access one computer through a network. In such a situation, it is indispensable to establish a strong information security with a consistent security policy.
[0003]
In particular, it is one of the most important management issues for companies to achieve the convenience of access to information and to ensure the security of information, which is a conflicting condition, while maintaining a high level of balance. Therefore, it is considered that the management of the access right to the applications and the like that can be used by the user is more and more important.
[0004]
Conventionally, in order to respond to such a demand, an application executable by the user by setting an authority file for each user ID and referencing the authority file stored in the security server every time the user logs in. And the files that can be viewed are limited.
[0005]
[Problems to be solved by the invention]
However, in the conventional access right control method as described above, since the access right depends on the user ID, if the user ID leaks to the outside, the security becomes completely meaningless. There was a problem. This can limit the occurrence of damage to a certain extent by limiting access from within the company or by specifying usable terminals. In general, security can be effectively secured by performing double / triple user confirmation for access from outside and dynamically changing access rights according to the access route to information. It is considered possible.
[0006]
In addition, when personnel changes or organizational reorganizations are performed in a company, the authority file must be recreated for each individual, which makes updating work very complicated.In particular, personnel changes and organizational reorganizations are performed frequently. In such companies, it takes a considerable amount of time to maintain the authority file, so that it is actually difficult to perform detailed authority setting itself.
[0007]
SUMMARY OF THE INVENTION In order to solve the above problems, the present invention provides a user access right control apparatus and method that can dynamically change an access right according to various conditions even when using the same user ID. The purpose is to provide.
[0008]
[Means for Solving the Problems]
In order to achieve the above object, a user access right control device according to the present invention comprises: a login information receiving unit that receives at least a user ID and password information of a logged-in user; and a user automatically detected by the logged-in user. A usage information receiving unit that receives information on the usage status of the terminal from the user terminal, a user information reference unit that determines whether the logged-in user is a registered user based on the user ID and the password information, An application information acquisition unit that specifies a duty category based on the ID and password information, and specifies an application that can be used based on the duty category, and whether or not it can be processed for each status element that indicates the usage status based on the duty category A processable status pattern obtaining unit for obtaining a processable status pattern for specifying An access right determination unit that determines whether or not the user has an access right to the application and the application-related file by matching information on the usage status of the user terminal used by the user who has used the application and the processable status pattern. And
[0009]
With this configuration, even for the same user, the access right can be dynamically changed according to the usage status, and security can be effectively secured.
[0010]
Also, even when personnel changes or organizational reorganizations are performed, there is no need to recreate the authority file for each individual, and access rights can be updated with a minimum number of man-hours, ensuring security. This can be easily performed.
[0011]
Further, in the user access right control device according to the present invention, in the access right determination unit, the items determined to be processable by the processable status pattern specified for each job category are used by the logged-in user. It is preferable to determine that the application defined in the duty category is usable when all the processes can be performed under the conditions determined based on the information on the usage status of the user terminal. This is because the usage status of the logged-in user can be reflected in the determination of the access right.
[0012]
Further, the present invention is characterized by software that executes the function of the user access right control device as a processing step of a computer as described above. Specifically, at least the user ID and password information of the logged-in user are stored. A step of receiving, from the user terminal, information on the use state of the user terminal used by the automatically logged-in user, and a step of receiving a user ID indicating whether the logged-in user is a registered user. A step of referring to the password information; a step of specifying a duty category based on the user ID and the password information; and a step of specifying an available application based on the duty category. Obtaining a processable status pattern that specifies whether or not the process can be performed for each element; User access right control method including a step of determining the presence or absence of an access right to an application and an application-related file by matching information on the use state of a user terminal used by the user and a processable state pattern, and It is a computer-executable program that implements such a process.
[0013]
With such a configuration, by loading and executing the program on a computer, even the same user can dynamically change the access right according to the usage status, and effectively secure security. In addition, even if personnel changes or organizational changes are made, there is no need to recreate the authority file for each individual, and access rights can be updated with a minimum number of man-hours. It is possible to realize a user access right control device that can easily secure the user access right.
[0014]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, a user access right control device according to an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a configuration diagram of a user access right control device according to an embodiment of the present invention.
[0015]
In FIG. 1, when a user logs in at a user terminal, a user access right control device 1 transmits login information and information about the location and use status of a terminal being used to a login information receiving unit 11 and a use status, respectively. The information is received by the information receiving unit 12.
[0016]
As the login information received by the login information receiving unit 11, at least password information corresponding to the user ID input by the user can be considered. Based on these pieces of information, the user information reference unit 13 refers to the user information storage unit 14 that stores whether the user is registered as a user. If the received user ID and the corresponding password information are not stored in the user information storage unit 14, the user is determined to be a user who does not have use authority, and the access by the user without executing the following processing is performed. Will be rejected.
[0017]
The information on the position of the terminal being used and the usage status received by the usage status information receiving unit 12 includes, for example, the location of the used terminal, the time of use, the model name of the used terminal, and the like. Information that can provide some kind of restriction. By linking these pieces of information with an AND condition or an OR condition, it is possible to set an access right to the application according to the usage status.
[0018]
Therefore, the user access right control device according to the present embodiment introduces the concept of “situation element” as information on the usage state of the user represented by the position of the terminal being used, etc. The feature is that, by controlling, the access right to the application or the like used in the application depending on the use situation is controlled.
[0019]
Specifically, first, in the user information storage unit 14, not only the user ID and the password are managed, but also the duties classified by each user for each user ID are registered. For example, as shown in FIG. 2, in the user information storage unit 14, what kind of job the user is in charge of is registered as a job category. It should be noted that one user does not necessarily have to have a single job division, and although it depends on the job classification method, one user may have a plurality of job divisions.
[0020]
Then, the application information acquiring unit 15 acquires usable application information as to what kind of processing can be performed as an application for each duty category. For example, FIG. 3 shows an exemplary diagram of a data configuration of the application information storage unit 16 in the user access right control device according to the embodiment of the present invention. Although an application is described in FIG. 3, files to be stored in the application information storage unit 16 include files used in the application.
[0021]
In FIG. 3, a circle indicates an application that can be used, and a cross indicates an application that cannot be used. In this way, by setting applications that can be used for each job category, even if the user has changed the job system due to personnel changes, applications that can be used according to job categories can be specified, and personnel changes can be made. Even if there is, the man-hour for updating the setting of the access right can be greatly reduced.
[0022]
Next, the processable status pattern acquisition unit 17 refers to the processable status pattern storage unit 18 that stores the logical combination pattern of the status elements, and determines which processable status pattern for each status element for each job category. Extract what is applicable.
[0023]
Further, the access right determination unit 19 collates the information on the current usage status received by the usage status information receiving unit 12 with a processable status pattern that can be extracted from the user ID, and determines an accessible application.
[0024]
Specifically, the processing is as follows. First, as shown in FIG. 4, a processable status pattern is specified for each status element. That is, in FIG. 4, a circle indicates that processing is possible, that is, the user has an access right, and a blank indicates that processing is not possible, that is, the user does not have an access right. Then, it is determined whether or not processing is possible for each component included in each status element.
[0025]
For example, the situation element "Site Machine", "floor A", "Machine room", "floor B", considering the case where four components of the "executive room" is defined, (2 ⁴ - 1) One processable situation pattern can be configured. That is, when there are n components, (2 ⁿ -1) processable situation patterns in the situation element are generated.
[0026]
Then, a pattern number is allocated to each pattern, and the processable status pattern storage unit 18 stores a processable pattern number for each status element for each job category, as shown in FIG.
[0027]
Further, the access right determination unit 19 collates the information on the current usage status received by the usage status information receiving unit 12 with the extracted processable status pattern, and determines an accessible application. That is, as shown in FIG. 6, by matching the processable status pattern selected for each job category with the information on the current usage status, it is determined whether or not the user has the access right in the current usage status. Become.
[0028]
For example, when the user A whose user ID is “X0001” attempts to log in from “Machine a in the machine room at night”, processing of each of the components “Machine room”, “Night time”, and “Machine a” in FIG. The possible situation is matched with the processable situation pattern in each job category. First, the processable situation patterns for the situation element “machine installation place” are 1, 4, and 2 for each duty category as shown in FIG. Among them, it can be determined that the component “machine room” can be used only when the processable status pattern is “2”, that is, when the job classification is “system administrator”.
[0029]
Next, the processable situation patterns for the situation element “machine use time zone” are 1, 1, and 2 for each duty category as shown in FIG. Among them, it can be determined that the component “night” can be used only when the processable status pattern is “2”, that is, when the job classification is “system administrator”.
[0030]
Further, the processable status patterns for the status element “machine model” are 3, 5, and 7 for each duty category as shown in FIG. Among them, it can be determined that the component “machine a” can be used when the processable situation pattern is all “3”, “5”, and “7”, that is, regardless of the job classification.
[0031]
From the above matching results, it can be seen that, in the current usage status, only the possessed job classification “system administrator” of the user A can have the access right and can execute the application. If the user B whose user ID is “X0002” logs in, since the user B does not have the job classification “system administrator”, the access by the user B is denied and the application is executed. Can not do.
[0032]
Next, a flow of processing of a program for realizing the user access right control device according to the embodiment of the present invention will be described. FIG. 7 shows a flowchart of processing of a program for realizing the user access right control device according to the embodiment of the present invention.
[0033]
7, first, the user ID and password of the logged-in user are received (step S701), and it is determined whether or not the user is a registered user based on the received user ID and password (step S702).
[0034]
When it is determined that the user is a registered user because the user ID and the password match (step S702: Yes), information on the use status of the user terminal used by the logged-in user is received (step S702). S703), and obtains the job classification of the user based on the user ID (step S704).
[0035]
Next, a processable status pattern that determines whether or not the process can be performed for each status element based on the job classification is acquired (step S705).
[0036]
Then, by matching the received information on the usage status of the user terminal used by the logged-in user with the acquired processable status pattern (step S706), the presence or absence of the access right to the application or the like according to the usage status is determined. A determination is made (step S707). If it is determined that the user has the access right (step S707: Yes), the user process is started by displaying a processable application on a menu (step S708).
[0037]
When it is determined that the user is not a registered user (Step S702: No), and when it is determined that the user has the access right (Step S707: No), the access by the user is rejected. (Step S709).
[0038]
As described above, according to the present embodiment, even for the same user, the access right can be dynamically changed according to the usage status, and security can be effectively secured. .
[0039]
Also, even when personnel changes or organizational reorganizations are performed, there is no need to recreate the authority file for each individual, and access rights can be updated with a minimum number of man-hours, ensuring security. This can be easily performed.
[0040]
As shown in FIG. 8, the program for realizing the user access right control device according to the embodiment of the present invention includes not only the portable recording medium 82 such as the CD-ROM 82-1 and the flexible disk 82-2, but also The program may be stored in any of another storage device 81 provided at the end of the communication line or a recording medium 84 such as a hard disk or a RAM of a computer 83. When the program is executed, the program is loaded and the main memory is stored. Run on
[0041]
Further, as shown in FIG. 8, processable status pattern data and the like used by the user access right control device according to the embodiment of the present invention are also portable, such as a CD-ROM 82-1 and a flexible disk 82-2. Not only the recording medium 82 but also any other storage device 81 provided at the end of the communication line or a recording medium 84 such as a hard disk or a RAM of a computer 83 may be used. It is read by the computer 83 when using such a user access right control device.
[0042]
【The invention's effect】
As described above, according to the user access right control device according to the present invention, even for the same user, the access right can be dynamically changed according to the usage status, and security is effectively ensured. It becomes possible.
[0043]
Also, even when personnel changes or organizational reorganizations are performed, there is no need to recreate the authority file for each individual, and access rights can be updated with a minimum number of man-hours, ensuring security. This can be easily performed.
[Brief description of the drawings]
FIG. 1 is a configuration diagram of a user access right control device according to an embodiment of the present invention; FIG. 2 is an exemplary data configuration diagram of a user information storage unit in the user access right control device according to the embodiment of the present invention; FIG. 4 is a diagram showing an example of a data structure of an application information storage unit in the user access right control device according to the embodiment of the present invention. FIG. 4 is a view showing an example of a processable status pattern in the user access right control device according to the embodiment of the present invention. FIG. 5 is a diagram illustrating an example of a data configuration in a processable status pattern storage unit in the user access right control device according to the embodiment of the present invention. FIG. 6 is a diagram illustrating a matching process in the user access right control device according to the embodiment of the present invention. FIG. 7 is a flowchart of processing in the user access right control device according to the embodiment of the present invention. Illustration of chromatography data environment [Description of symbols]
1 User Access Right Control Device 11 Login Information Receiving Unit 12 Usage Information Receiving Unit 13 User Information Reference Unit 14 User Information Storage Unit 15 Application Information Acquisition Unit 16 Application Information Storage Unit 17 Processable Status Pattern Acquisition Unit 18 Processable Status Pattern Storage Unit 19 Access Right Determining Unit 81 Line Destination Storage Device 82 Portable Recording Medium 82-1 CD-ROM such as CD-ROM or Flexible Disk
82-2 Flexible disk 83 Computer 84 Recording medium such as RAM / hard disk on computer

Claims (4)

A login information receiving unit that receives at least a user ID and password information of a logged-in user;
A usage status information receiving unit that receives information on the usage status of the user terminal used by the automatically detected logged-in user from the user terminal,
A user information reference unit that refers to whether the logged-in user is a registered user based on the user ID and the password information;
An application information acquisition unit that identifies a duty category based on the user ID and the password information, and identifies an application that can be used based on the duty category;
A processable status pattern acquisition unit that obtains a processable status pattern that specifies whether or not it can be processed for each status element that represents a usage status, based on the job classification,
An access right determination unit that determines whether or not there is access to the application and the application-related file by matching information on the usage status of the user terminal used by the logged-in user with the processable status pattern. A user access right control device characterized by including: In the access right determination unit, the items determined to be processable by the processable status pattern specified for each duty category are based on information on the usage status of the user terminal used by the logged-in user. 2. The user access right control device according to claim 1, wherein when all of the applications can be processed under predetermined conditions, it is determined that the application defined in the duty category is usable. Receiving at least the user ID and password information of the logged-in user;
A step of receiving from the user terminal information on the usage status of the user terminal used by the automatically logged-in user,
Referencing whether the logged-in user is a registered user based on the user ID and password information,
Specifying a job category based on the user ID and password information, and specifying an available application based on the job category;
A step of acquiring a processable status pattern that specifies whether or not the process can be performed for each status element representing the usage status, based on the job classification;
Determining the presence or absence of access to the application and the application-related file by matching information on the usage status of the user terminal used by the logged-in user with the processable status pattern. Characteristic user access right control method. Receiving at least the user ID and password information of the logged-in user;
Receiving from the user terminal information on the use status of the user terminal used by the automatically logged-in user,
Referencing whether the logged-in user is a registered user based on the user ID and password information;
Identifying a duty category based on the user ID and password information, and identifying an available application based on the duty category;
A step of acquiring a processable status pattern that specifies whether or not the process can be performed for each status element representing the usage status, based on the job classification;
Determining the presence or absence of access to the application and the application-related file by matching information on the usage status of the user terminal used by the logged-in user with the processable status pattern. A computer-executable program that embodies a user access right control method.

Images