JP2005165808A - Authentication device, authentication method, and program thereof - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication device which can realize a security system with high convenience. <P>SOLUTION: An authentication device 4 uses parallely a plurality of authentication methods by permitting or prohibiting access to a data file based on access permission information associating with authentication results by a plurality of authentication methods and the permitted range of access each other; and when the authentication succeeds by either authentication method, access according to characteristics (security intensity, and convenience etc. ) of the authentication method is permitted. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an authentication apparatus to which a plurality of authentication methods are applied.

For example, Patent Literature 1 discloses a personal authentication method using a biometric feature database that stores feature information of a plurality of types of biometric features and information indicating a relationship between a combination of biometric features and authentication accuracy. Patent Document 2 discloses a composite authentication system that determines an authentication procedure composed of these authentication means based on the authentication performance for each registrant in a plurality of types of authentication means.
JP 2003-030154 A JP 2003-186836 A

  The present invention has been made from the above-described background, and an object thereof is to provide an authentication device capable of realizing a highly convenient security system.

[Authentication device]
In order to achieve the above object, an authentication apparatus according to the present invention stores permission information that associates each of authentication results obtained by a plurality of types of authentication methods with a range of access permitted for a data file. Based on the authentication result acquired by the storage means, the authentication result acquisition means for acquiring at least one authentication result, and the authentication result acquired by the authentication result acquisition means. Selection means for selecting a range of access to be performed, and permission means for permitting access to the data file in accordance with the range of access selected by the selection means.

  Preferably, the scope of access defines a portion of the data file that is permitted to be accessed, and the permission means accesses the different portions in the data file according to the scope of access selected by the selection means. Allow.

  Preferably, the data file is a document file, and the access range defines a portion of the document file to which access is permitted, and the permission unit is responsive to the access range selected by the selection unit. Access to different parts of the document file.

  Preferably, the range of access defines an operation content permitted for the data file, and the permission unit permits different operations according to the range of access selected by the selection unit.

  Further, the authentication device according to the present invention is based on an authentication result acquisition unit that acquires at least one authentication result among authentication results by a plurality of types of authentication methods, and an authentication result acquired by the authentication result acquisition unit. Permission means for permitting access to the data file portion according to the authentication method.

[Access management device]
The access management apparatus according to the present invention includes an input unit that receives an operation for specifying an access range to be permitted according to an authentication result by each authentication method in association with an authentication result by a plurality of types of authentication methods; Based on the input operation received by the input means, permission information generating means for generating access permission information for associating the authentication result of each authentication method with the range of access to be permitted, and generated by the permission information generating means Attachment means for attaching the access permission information to the data file.

  Preferably, when access to the data file to which the access permission information is attached is requested, an authentication result acquisition unit that acquires an authentication result by at least one of a plurality of authentication methods, and the authentication result acquisition unit Based on the authentication result obtained by the above, the selection means for selecting the corresponding access range from the access permission information attached to the data file, and the access range selected by the selection means And permission means for permitting access to the data file.

[Authentication method]
The authentication method according to the present invention acquires an authentication result by at least one of a plurality of authentication methods, and is associated with each authentication result by the plurality of authentication methods based on the acquired authentication result. A corresponding access range is selected from the existing access ranges, and access to the data file is permitted according to the selected access range.

[program]
The program according to the present invention includes a step of acquiring an authentication result by at least one of a plurality of authentication methods in an access management apparatus including a computer, and a plurality of authentication methods based on the acquired authentication result. The access management device includes a step of selecting a corresponding access range from the access range associated with each of the authentication results by the authentication, and a step of permitting access to the data file according to the selected access range. To run on a computer.

  According to the encoding device of the present invention, the convenience of the security system can be improved.

[background]
First, in order to help understanding of the present invention, the background will be described with specific examples.
When a data file (for example, an electronic document) is shared and a document operation or editing is performed, it is necessary to set authority for the data file for each operator of the data file. For example, the authority set for an electronic document controls document operations such as viewing (display), printing, copying, modification, and deletion (hereinafter collectively referred to as “access”). Any operation is permitted according to the authentication result of the operator group.
In this way, whether or not to permit access to the data file for which authority is set is determined by password input or offline authentication using an IC card, online authentication using an authentication server or the like, or biometric authentication using biometric information (such as a fingerprint). It is determined. In addition, when high security strength is required, these multiple authentication methods may be used in combination in series.

As described above, when authentication is performed only with a specific authentication method, or when a plurality of authentication methods are applied in series, for example, forgetting a password, IC card not being carried, network failure, or biometrics. Access to the data file is completely blocked due to a failure of the authentication device.
In addition, it is possible to apply a plurality of authentication methods in parallel, calculate the authentication accuracy by integrating these authentication results, and allow access according to this authentication accuracy. If the authentication results obtained by the above are integrated into one authentication accuracy (parameter), the characteristics of each authentication method (for example, the updateability of authentication information in online authentication) are not reflected. In addition, since the authentication accuracy calculated based on each authentication result is used as a criterion for permission / prohibition of access, the causal relationship between each authentication result and access permission / prohibition becomes unclear, and the data file distributor It is difficult to reflect my intention.

  Therefore, the access management system according to the present embodiment applies a plurality of authentication methods in parallel, and determines the characteristics (security strength, convenience, etc.) of each authentication method based on the authentication result of any one of the authentication methods. Allow access accordingly. In this embodiment, for example, password authentications with different numbers of digits of passwords to be input are distinguished as different authentication methods. Similarly, biometric authentication using fingerprints and biometric authentication using voiceprints are distinguished from each other as different authentication methods, and online authentications with different authentication servers are distinguished from each other as different authentication methods.

[Embodiment]
Next, an embodiment of the present invention will be described.
FIG. 1 is a diagram for explaining an overview of an entire access management system 1 to which an authentication method according to the present invention is applied.
As shown in FIG. 1, the access management system 1 includes a distribution device 2, a document operation device 4, and an authentication server 6. The distribution device 2, the document operation device 4, and the authentication server 6 are connected to the network 3 and can communicate with each other via the network 3.
The distribution apparatus 2 is a computer terminal of an authority setting person who sets authority for a data file (electronic document), supports setting of authority, and transmits the document file with the authority set to the document operation apparatus 4.
The document operation device 4 is a computer terminal of an operator who operates the document file received from the distribution device 2, and accepts an operation on the document file according to the set authority.

  When an authentication request is transmitted from the document operation device 4, the authentication server 6 authenticates the operator of the document operation device 4 based on the authentication information set by the distribution device 2, and sends the authentication result to the document operation device 4. Send back. The authentication server 6 updates the authentication information in response to a request from the distribution device 2 and performs an authentication process based on the updated authentication information.

FIG. 2 is a diagram illustrating a hardware configuration of the document operation device 4 to which the authentication method according to the present invention is applied.
As shown in FIG. 2, the document operation device 4 includes a control device 20 including a CPU 202 and a memory 204, a communication device 22, a printer 23, a recording device 24 such as an HDD / CD device, a biometric authentication device 25, and an LCD display. A user interface device (UI device) 26 including a device or a CRT display device and a mouse / keyboard / touch panel. The biometric authentication device 25 is a device that authenticates an operator based on characteristics of a human body (for example, a fingerprint, an iris, a face, a voice print, or a handwriting). In this example, the biometric authentication device 25 authenticates the operator based on a fingerprint.
The distribution apparatus 2 (FIG. 1) has a hardware configuration substantially the same as that of the document operation apparatus 4.

[Authentication program 5]
FIG. 3 is a diagram showing the configuration of the authentication program 5 that is executed by the control device 20 (FIG. 2) and implements the authentication method according to the present invention.
As shown in FIG. 3, the authentication program 5 includes a communication unit 500, a file database (file DB) 510, a UI unit 520, a password authentication unit 530, a biometric authentication unit 540, an authentication result acquisition unit 550, a permission information selection unit 560, and The access permission unit 570 is configured.
The authentication program 5 is supplied to the control device 20 via, for example, the recording medium 240 (FIG. 2) or the network, loaded into the memory 204, and executed.

  In the authentication program 5, the communication unit 500 controls the communication device 22 (FIG. 2) to perform data communication via the network 3 (FIG. 1). For example, the communication unit 500 receives a document file from the distribution device 2 (FIG. 1) and outputs it to the file DB 510. Access permission information is attached to this document file. Here, the access permission information is information that specifies what operation is permitted or prohibited for which part of the document file in association with the authentication results of the plurality of authentication methods. The communication unit 500 requests online authentication from the authentication server 6 (FIG. 1), receives the authentication result from the authentication server 6, and outputs the received authentication result to the authentication result acquisition unit 550. . When the document file, access permission information, or the authentication result of online authentication is encrypted, the communication unit 500 decrypts the received information and sends it to the file DB 510 or the authentication result acquisition unit 550. Output.

  The file DB 510 stores a document file and access permission information attached thereto, and outputs the document file or access permission information to the permission information selection unit 560 in response to a request from the permission information selection unit 560. .

  The UI unit 520 controls the mouse or keyboard of the UI device 26 (FIG. 2) to perform operations (display operation, editing operation, etc.) on the document file and input authentication data including a user ID and a password. Accept and output to password authentication unit 530 and the like. The UI unit 520 controls the display device of the UI device 26 to display the document file.

The password authentication unit 530 authenticates the operator in accordance with the authentication data input from the UI unit 520, and sends an authentication result (result data indicating whether authentication has succeeded or failed) to the authentication result acquisition unit 550. Output. The password authentication unit 530 of this example can authenticate the operator offline using data stored in advance in the document operation device 4 and authentication data input from the operator.
The biometric authentication unit 540 controls the biometric authentication device 25 (FIG. 2), authenticates the operator based on the human body characteristics of the operator, and outputs the authentication result to the authentication result acquisition unit 550.

  The authentication result acquisition unit 550 includes an online authentication authentication result input via the communication unit 500, a password authentication authentication result input from the password authentication unit 530, and a biometric authentication input from the biometric authentication unit 540. The result is output to the permission information selection unit 560. When an authentication result (“success” or “failure”) is input for any of the authentication methods, the authentication result acquisition unit 550 sends result data indicating the content of the authentication result to the permission information selection unit 560. If the authentication result is not input within a predetermined period for any of the authentication methods, unknown data indicating that the authentication result is unknown is output to the permission information selection unit 560.

  The permission information selection unit 560 selects corresponding access permission information from the access permission information stored in the file DB 510 based on the result data and / or the unknown data input from the authentication result acquisition unit 550, and The selected access permission information is output to the access permission unit 570. The permission information selection unit 560 of the present example includes the authentication method and the access permission information corresponding to the authentication result when a plurality of result data are input (that is, when the authentication result is acquired by a plurality of authentication methods). The access permission information to which access is most permitted (that is, the information with the least restriction on the access method and the access allowable range) is selected and output to the access permission unit 570.

  The access permission unit 570 permits or prohibits access to the document file based on the access permission information input from the permission information selection unit 560. In other words, the access permission unit 570 determines whether the permitted access method (browsing operation or update operation) and the access prohibited range (confidential document part) differ depending on the acquired authentication result and the authentication method. A file is generated and displayed on the UI device 26.

FIG. 4 is a diagram illustrating access permission information 700 attached to a document file.
As illustrated in FIG. 4, the access permission information 700 associates a plurality of authentication methods with the permitted access contents when authentication is successful by these authentication methods. The contents of access in this example are the range (“part” or “all”) in which access is permitted in the secret area, and the operations (“read” operation and “write”) allowed in the secret area. Operation). These access contents are associated with the operator.
The distributor can set whether or not the document file itself can be accessed by superimposing the access restriction for each secret area, and the access permission information 700 is sent to the document file itself according to the request of the distributor. Correspondence of access is associated with any authentication method and its authentication result.

[Delivery processing]
FIG. 5 is a flowchart showing the distribution process (S10) of the distribution apparatus 2.
As shown in FIG. 5, in step 110 (S110), a distributor who distributes document data inputs a document file to be distributed to the distribution apparatus 2 using a recording medium or a UI device. The distribution apparatus 2 acquires the input document file.

In step 120 (S120), the distributor operates a UI device or the like and designates an area for restricting access (hereinafter, a secret area). The distribution device 2 generates area designation information of an area to be concealed according to the designation of the distributor.
In step 130 (S130), the distributor operates the UI device or the like, and information (operator ID, password, online authentication data, fingerprint registration ID, etc.) of the operator who permits access to the designated secret area, and Input allowable operation details (read operation, write operation, etc.). The distribution device 2 generates and generates authentication information and operation designation information (information for specifying an allowable operation) in each authentication method (password authentication, online authentication, and biometric authentication) in accordance with the input of the distributor. Correspond to the specified area specification information.

In step 140 (S140), the distribution apparatus 2 confirms with the distributor whether or not an operator who allows access to the secret area is added. When there is an operator addition, the distribution apparatus 2 returns to the process of S130 to generate authentication information related to the added operator. In other cases, the distribution apparatus 2 proceeds to the process of S150.
In step 150 (S150), the distribution apparatus 2 confirms with the distributor whether or not a secret area has been added to the document file. The distribution device 2 returns to the process of S120 when the secret area is added, generates area designation information of the added secret area, and moves to the process of S160 in other cases.

In step 160 (S160), the distribution apparatus 2 generates access permission information based on the area designation information, the authentication information, and the operation designation information.
In step 170 (S170), the distribution apparatus 2 encrypts the generated access permission information.
In step 180 (S180), the distribution apparatus 2 encrypts the portion designated as the secret area in the document file.
In step 190 (S190), the distribution apparatus 2 attaches the encrypted access permission information to the document file in which the secret area is encrypted, and transmits the document file to the document operation apparatus 4.

[Document Operation Processing]
FIG. 6 is a flowchart showing the document operation process (S20) of the document operation apparatus 4 (authentication program 5).
As shown in FIG. 6, in step 210 (S210), the communication unit 500 (FIG. 3) of the document operation device 4 receives a document file (attached with access permission information) from the distribution device 2.
In step 220 (S220), the communication unit 500 decrypts the received document file and the access permission information attached thereto, and writes it in the file DB 510.
In step 230 (S230), the operator selects a document file to be browsed from the document files stored in the file DB 510. When the UI unit 520 detects a document file selection operation by the operator via the UI device 26 (FIG. 2), the UI unit 520 instructs the permission information selection unit 560 to read the access permission information.
The permission information selection unit 560 reads access permission information corresponding to the selected document file from the file DB 510.

  In step 240 (S240), the authentication program 5 determines whether or not the entire document file is a hidden area based on the access permission information. If the entire document file is a hidden area, the process proceeds to S250. In other cases, the process proceeds to S290.

In step 250 (S250), the UI unit 520 controls the UI device 26 to display a message requesting the operator to input a user ID and password, online authentication, and biometric authentication.
In step 260 (S260), when the UI unit 520 receives the input of the user ID and password, the UI unit 520 outputs the input user ID and password to the communication unit 500, the password authentication unit 530, and the biometric authentication unit 540. Instruct to perform authentication process.
The password authentication unit 530 compares the input user ID and password with previously stored authentication information, performs offline authentication processing, and outputs the authentication result to the authentication result acquisition unit 550. If the password is not input, password authentication unit 530 outputs to password authentication result acquisition unit 550 that the password has not been input.
The communication unit 500 transmits the input user ID and unique information (such as a MAC address or an IP address) of the document operation device 4 to the authentication server 6 to request online authentication. The authentication result is received, and the received authentication result is output to the authentication result acquisition unit 550. When online authentication is not performed due to disconnection of the network 3 or failure of the authentication server 6, the communication unit 500 outputs to the authentication result acquisition unit 550 that online authentication has not been performed.
The biometric authentication unit 540 outputs fingerprint registration information corresponding to the input user ID to the biometric authentication device 25 (FIG. 3), requests biometric authentication using a fingerprint, and an authentication result input from the biometric authentication device 25. Is output to the authentication result acquisition unit 550. When biometric authentication is not performed because the biometric authentication device 25 is not connected, the biometric authentication unit 540 outputs to the authentication result acquisition unit 550 that biometric authentication has not been performed.
When an authentication result is input from at least one of the password authentication unit 530, the communication unit 500, and the biometric authentication unit 540, the authentication result acquisition unit 550 associates the input authentication result and the authentication method with each other. The data is output to the selection unit 560. Note that if the authentication result acquisition unit 550 receives an input from the password authentication unit 530, the communication unit 500, or the biometric authentication unit 540 that authentication processing has not been performed, the authentication result acquisition unit 550 permits unknown data in association with the authentication method. The information is output to the information selection unit 560.

In step 270 (S270), the permission information selection unit 560 selects access permission information based on the authentication result and unknown data input from the authentication result acquisition unit 550, and outputs the access permission information to the access permission unit 570.
In step 280 (S280), the access permission unit 570 determines whether or not access to the entire document file should be permitted based on the access permission information for the entire document file. If it is determined that access to the entire document file should be permitted, the authentication program 5 proceeds to the processing of S290, and in other cases, all operations on the document file are prohibited and the processing is terminated. To do.

  In step 290 (S290), the access permission unit 570 replaces the hidden area with an unreadable image such as a letter and displays it. When these unreadable images (that is, secret areas) are selected by the operator, the access permission unit 570 selects the access permission information by performing the processes from S250 to S270 again, and selects the selected access permission. Depending on the information, the unreadable image is replaced with actual content (such as a character string or image) and displayed.

  Note that the UI unit 520 selects one of the authentication methods according to the priority order of the authentication methods or the feasibility of the authentication processing (network state, presence / absence of connection of the biometric authentication device 25, etc.). You may request.

FIG. 7 is a flowchart for explaining the protection display (S290) in more detail.
As shown in FIG. 7, in step 292 (S292), the access permission unit 570 selects rows in order from the top of the document file.
In step 294 (S294), the access permission unit 570 refers to the access permission information and determines whether or not the selected row includes a secret area. The authentication program 5 proceeds to the process of S296 when the selected line includes the confidential area, and proceeds to the process of S298 when the selected line does not include the confidential area.
In step 296 (S296), the access permission unit 570 replaces the portion corresponding to the secret area in the selected line with a buff, and displays this line on the UI device 26.
In step 298 (S298), the access permission unit 570 displays the line that does not include the secret area on the UI device 26 as it is.
In step 299 (S299), the access permission unit 570 determines whether or not the next row exists. If the next line exists, the authentication program 5 returns to the process of S292, performs the process for the next line, and ends the protection display process otherwise.

FIG. 8 is a diagram illustrating a document file 800 generated by the distribution apparatus 2. FIG. 8A illustrates the document data 810 before the secret area is encrypted, and FIG. The document data 810 after the secret area is encrypted is illustrated, and FIG. 8C illustrates the access permission information 820 attached to the document file 800.
As illustrated in FIG. 8A, the distributor displays the document data 810 on the UI device 26, and selects an area (confidential area 812) whose access should be restricted. As illustrated in FIG. 8B, the distribution device 2 encrypts the character string (text data) in the selected area in response to the selection operation of the secret area 812 by the distributor.
Further, as illustrated in FIG. 8C, the distribution apparatus 2 creates access permission information 820 according to an input operation by the operator, and attaches the created access permission information 820 below the document data 810. Document file 800.
The access permission information 820 in this example includes area designation information () for designating a plurality of secret areas, and authentication information (user ID, password, operation designation information for permitted operations, etc.) regarding each authentication method.
In the access permission information of this example, the user ID, password, and operation designation information are expressed as “usr name =“ user ID ””, “password =“ password ””, and “opr =“ operation content ””, respectively. The type of method is expressed as “auth type =“ authentication method ””.

FIG. 9 is a diagram illustrating a document file displayed by the document operation device 4. FIG. 9A illustrates a display document 910 displayed in a state where access to the secret area is restricted by the protection display (S20). FIG. 9B illustrates a display document 910 displayed in a state where access to the secret area is permitted by the authentication of the operator.
As illustrated in FIG. 9A, the document manipulating device 4 replaces the character string of the secret area included in the document file with a prone character and displays it. The operator requests access to the secret area by selecting the portion of the concealment by clicking or the like.
The document operation device 4 selects the access permission information according to the authentication of the operator, and the case where the selected access permission information permits the browsing operation (display) with respect to the secret area is illustrated in FIG. 9B. In this way, the part of the character is replaced with the actual character string and displayed.

As described above, the access management system 1 according to the present embodiment manages each authentication result obtained by a plurality of authentication methods and the contents of permitted access (access allowable range, operation method, etc.) in association with each other. Thus, when an authentication result by any one of the authentication methods is acquired, access corresponding to the authentication method and the authentication result can be permitted. That is, the access management system 1 applies a plurality of types of authentication methods in parallel, and enables access restriction according to the characteristics of each authentication method.
Also, depending on the environment in which the operator accesses the document file (environment in which the password can be viewed, environment in which the network cannot be connected, environment in which the biometric authentication device cannot be used, etc.), password authentication, online authentication, or biometric authentication May not be possible. Even in such a case, since the access management system 1 can permit access according to the security strength of each authentication method, the access required by the operator in the environment is ensured. There is also.

[Modification]
Next, a modification of the above embodiment will be described.
In the above embodiment, the access permission information associates each authentication method with the access permitted when authentication is successful by the authentication method. However, a combination of a plurality of authentication methods and these authentication methods are associated with each other. The access permitted when the authentication is successful by the method may be associated with each other. In other words, the document operation device 4 in this modification permits access with different contents according to combinations of authentication results obtained by a plurality of authentication methods.
FIG. 10 is a diagram illustrating access permission information 702 that associates a combination of a plurality of authentication methods with access contents.
As illustrated in FIG. 10, the document operation device 4 according to the present modification manages a combination of authentication results (authentication success in this example) by a plurality of authentication methods in association with permitted access contents. Thus, access can be permitted or prohibited according to the authentication result when a plurality of authentication results are combined in series. By combining authentication methods in this way, the access management system 1 can raise the upper limit of the security strength and widen the range of security strengths that can be selected by the distributor.

It is a figure explaining the outline | summary of the access management system 1 whole with which the authentication method concerning this invention is applied. It is a figure which illustrates the hardware constitutions of the document operation apparatus 4 with which the authentication method concerning this invention is applied. It is a figure which shows the structure of the authentication program 5 which is performed by the control apparatus 20 (FIG. 2) and implement | achieves the authentication method concerning this invention. It is a figure which illustrates the access permission information 700 attached to a document file. It is a flowchart which shows the delivery process (S10) of the delivery apparatus 2. It is a flowchart which shows the document operation process (S20) of the document operation apparatus 4 (authentication program 5). It is a flowchart explaining a protection display (S290) in detail. It is a figure which illustrates the document file 800 produced | generated by the delivery apparatus 2, (A) illustrates the document data 810 before a confidential area is encrypted, (B) is the confidential area encrypted. The following document data 810 is illustrated, and (C) illustrates the access permission information 820 attached to the document file 800. It is a figure which illustrates the document file displayed by the document operation apparatus 4, (A) illustrates the display document 910 displayed in the state by which the access with respect to a secret area was restrict | limited by the protection display (S20), (B ) Exemplifies a display document 910 displayed in a state where access to the secret area is permitted by the authentication of the operator. It is a figure which illustrates the access permission information 702 which matches the combination of a some authentication method, and the content of access mutually.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Access management system 2 ... Distribution apparatus 4 ... Document operation apparatus 5 ... Authentication program 500 ... Communication part 510 ... File database 520 ... User interface part 530 ... Password Authentication unit 540 ... Biometric authentication unit 550 ... Authentication result acquisition unit 560 ... Permit information selection unit 570 ... Access permission unit

Claims (9)

Permission information storage means for storing access permission information for associating each of the authentication results by the plurality of types of authentication methods with the range of access permitted for the data file;
Authentication result acquisition means for acquiring at least one authentication result;
A selection unit that selects a corresponding access range from the access permission information stored by the permission information storage unit based on the authentication result acquired by the authentication result acquisition unit;
An authentication device comprising: permission means for permitting access to the data file in accordance with an access range selected by the selection means. The range of access defines the portion of the data file that is allowed access,
The authentication apparatus according to claim 1, wherein the permission unit permits access to a different part in the data file according to a range of access selected by the selection unit. The data file is a document file;
The scope of access defines the part of the document file that is allowed access,
The authentication apparatus according to claim 2, wherein the permission unit permits access to a different part of the document file according to a range of access selected by the selection unit. The scope of access defines the operation content allowed for the data file,
The authentication device according to claim 1, wherein the permission unit permits different operations according to a range of access selected by the selection unit. An authentication result acquisition means for acquiring at least one authentication result among the authentication results of a plurality of types of authentication methods;
An authentication apparatus comprising: permission means for permitting access to a data file portion according to an authentication method by an access method according to an authentication method based on an authentication result acquired by the authentication result acquisition means. An input means for accepting an operation for specifying an access range to be permitted according to an authentication result by each authentication method in association with an authentication result by a plurality of types of authentication methods;
Based on the input operation accepted by the input means, permission information generating means for generating access permission information for associating the authentication result of each authentication method with the range of access to be allowed;
An access management apparatus comprising: attachment means for attaching the access permission information generated by the permission information generation means to a data file. Authentication result acquisition means for acquiring an authentication result by at least one of a plurality of authentication methods when access to the data file to which the access permission information is attached is requested;
Selection means for selecting a corresponding access range from the access permission information attached to the data file based on the authentication result acquired by the authentication result acquisition means;
The access management apparatus according to claim 6, further comprising permission means for permitting access to the data file in accordance with an access range selected by the selection means. Obtaining an authentication result from at least one of a plurality of authentication methods;
Based on the acquired authentication result, select the corresponding access range from the access range associated with each authentication result by a plurality of authentication methods,
An authentication method that allows access to data files depending on the scope of access selected. In an access management device including a computer,
Obtaining an authentication result by at least one of a plurality of authentication methods;
A step of selecting a corresponding access range from a range of access associated with each authentication result by a plurality of authentication methods based on the acquired authentication result;
Allowing the computer of the access management device to execute the step of permitting access to the data file according to the selected range of access.

Images