JP2006065614A - Operation authority management system and operation authority management method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an operation authority management system and an operation authority management method capable of preventing registration of improper system management information by mistake or illicitness of a manager in various operations for system management information of an information processing system performed by the manager having an authority. <P>SOLUTION: An execution authority for operation of system management information is preliminarily set in an authority management table for every manager. In registering/updating the system management information, authentication of each manager's authority is managed based on the authority management table, and a predetermined business is executed by a plurality of managers of a manager who is authenticated for the authority of edit operation of system management information and a manager who is authenticated for the authority of registeration operation thereof. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an operation authority management system and an operation authority management method in an information processing system, and in particular, operation authority management for operating system management information such as a system user registration information database managed by a system administrator. The present invention relates to a system and an operation authority management method.

  In the information processing system, various information necessary for operating this information processing system, such as various resource setting statuses, information processing system usage statuses, and user information, is stored as system management information in the form of files and databases. It is held inside the information processing system. Since the contents of these system management information have a profound effect on the operation and operation of information processing systems, they are not only protected from unauthorized access, but are usually for general users who use information systems. In this case, access is not permitted, and maintenance is performed only by an administrator having management authority with access right.

  As described above, in order to properly operate the information processing system, it is necessary to arrange an administrator having management authority and perform maintenance work by this administrator. Here, as for the number of managers, for example, a plurality of persons may be arranged according to the scale and form of the information processing system to be operated. In this case, each administrator is responsible for sharing various management authority in a redundant manner, or management authority independent of each other, and the files to be protected in the system management information that are required for this management authority. Share the access authority to and perform predetermined maintenance work.

An example of a file protection system in an information processing system in which a plurality of managers are arranged is disclosed (for example, see Patent Document 1). This example relates to access right management for protected files. When there are multiple administrators with independent management rights and security policies, each administrator selects a protected file within the scope of management. , And protect against unauthorized access according to their own security policy.
JP 2004-126634 A (page 18, FIG. 1)

  By the way, the administrator can freely access various system management information within the range of the management authority given to the administrator. Then, it is permitted to perform registration update deletion of the contents.

  However, on the other hand, this means that the operation performed by one administrator is reflected in the system management information as it is. In addition, other administrators having different authority are not involved in the operation at this time. Therefore, for example, it is difficult to prevent the registration update / deletion of erroneous information due to the negligence of the manager himself, and the intentional fraud of the manager himself is also reflected in the system management information as it is. .

  The present invention has been made in consideration of the above-described circumstances. When various operations are performed on the system management information of the information processing system performed by an authorized administrator, erroneous system management information due to the administrator's negligence or fraud An object of the present invention is to provide an operation authority management system and an operation authority management method for preventing registration.

  In order to achieve the above object, an access right management system of the present invention is an operation right management system for system management information of an information processing system operated by a plurality of authorized administrators, and the system management in advance An authority management table in which execution authority for information operations is set for each administrator, and an editing authority authenticating means for authenticating the authority of editing operation of system management information for the first administrator based on the authority management table; Based on the authentication result from the editing authority authentication means, the system management information is edited by the first administrator to edit the system management information, and the editing result is temporarily stored and notified to the second administrator. And editing operation for registering system management information for the second administrator based on the authority management table. A registration authority authenticating means for authenticating the authority, and a system management information registration operation by the second administrator based on an authentication result from the registration authority authenticating means and temporarily stored in the first administrator. Registration means for issuing an approval notification by the second administrator for the edited result, registering the temporarily stored editing result in the system management information, and notifying the first administrator of the registration result. It is characterized by having.

  The access right management method of the present invention is an operation authority management method for system management information of an information processing system operated by a plurality of authorized administrators, and each of the managers for the operation of the system management information The authority for editing the system management information for the first administrator is authenticated based on the authority management table in which the execution authority for each is set in advance, and the system administrator information editing operation by the first administrator based on the authentication result The system management information is edited, the editing result is temporarily stored, the second administrator is notified, and the system management information registration authority for the second administrator is given based on the authority management table. Authentication, accepting a registration operation of the system management information by the second administrator based on the authentication result, and Issue a notification of approval by the second administrator to the temporarily stored editing result, register the temporarily stored editing result in the system management information, and register the registration result in the first management It is characterized by notifying a person.

  ADVANTAGE OF THE INVENTION According to this invention, registration of the incorrect system management information by the negligence or fraud of the manager of an information processing system can be prevented.

  The best mode for carrying out the operation authority management system and the operation authority management method according to the present invention will be described below with reference to FIGS.

  FIG. 1 is a block diagram showing an embodiment of an operation authority management system according to the present invention. In this embodiment, the registration / update work of the user of this information processing system is taken up as one of the management work of the administrator, and the target system management information is information related to the user of this information processing system. A user information database and a user management information database are provided. Further, it is assumed that this management operation is performed by a plurality of managers, that is, an operation manager as a first manager and a maintenance manager as a second manager.

  This operation authority management system includes an operation administrator authority acquisition function 1 as an editing authority authentication means, an operation / display function 2, a user editing function 3, a data management function 4, a notification function 5, and maintenance management as a registration authority authentication means. It comprises a user authority acquisition function 6, an approval function 7, and a user management function 8.

  The editing means includes an operation / display function 2, a user editing function 3, a data management function 4, a notification function 5, and a user management function 8. The registration means includes a data management function 4, a notification function 5, an approval function 7, and a user management function 8.

  In addition, an authorization management table 9 in which execution authority for various operations of system management information is set for each administrator in advance, and an approval as an area for temporarily storing editing results of user information edited by the user editing function 3 It has a waiting user information database 10, a user information database 11 as system management information, and a user management information database 12. FIG. 2 shows an example of the authority management table in this embodiment as a model. In FIG. 2, as various operations of the system management information, for example, browsing, editing, and registration operations are taken, and an example in which presence / absence of execution authority of the operation manager and the maintenance manager for these operations is set is shown. .

  Further, in the present embodiment, in the user information database 11, user information including the user name and ID number of the information processing system is registered as user information in units of users. . In the user management information database 12, as user management information, use of an information processing system such as a user name and ID number, and an access right and a usable time zone for various resources permitted by the user, for example. A list in which authority is associated is registered.

  Based on the authority management table 9, the operation manager authority management acquisition function 1 gives the operation administrator as the first administrator the user information database 11 as the system management information and the user management information database 12. Authenticates editing operations. The operation / display function 2 receives and echoes various input operations from the operation manager, and sends the received input to the user editing function 3 or the user management function 8.

  The user editing function 3 edits user information based on an editing operation performed by the operation manager, and sends the editing result to the user management function 8. Under the control of the user management function 8, the data management function 4 executes writing and reading of data with respect to the approval waiting user information database 10, the user information database 11, and the user management information database 12.

  The notification function 5 notifies the maintenance manager of the completion of the editing operation by the operation manager under the control of the user management function 8 and also notifies the operation manager of the editing result by the maintenance manager. Notify approval and registration completion. The maintenance manager authority acquisition function 6 registers the user information database 11 and the user management information database 12 as system management information for the maintenance manager as the second manager based on the authority management table 9. Authenticate the operation authority.

  The approval function 7 receives the approval operation of the maintenance manager for the result of editing the user information performed by the operation manager, and transfers that fact to the user management function 8. The user management function 8 controls the activation of the above-described functions and the exchange of various data between the functions, and the registration / update work of the user of this information processing system, which is one of the management work of the administrator. Manage execution.

  Next, the operation of the operation authority management system according to the present invention configured as described above will be described with reference to the above-described FIGS. 1 and 2 and the flowchart of FIG. FIG. 3 is a flowchart showing a new user registration business as a representative example of the administrator business, and modeling its operation along the business flow.

  First, when a password or the like is input from the operation manager to the operation administrator authority acquisition function 1, the operation administrator authority acquisition function 1 authenticates that this input is from the operation administrator, and further The execution authority for the operation is authenticated based on the authority management table 9. For example, in the case of the authority management table 9 shown in FIG. 2, the authority of the browsing operation and the editing operation is authenticated to the operation manager (ST1).

  Next, the operation administrator who has been authorized for the editing operation inputs data regarding user information to be newly registered through the operation / display function 2. The input data is sent to the user editing function 3, and the user information for new registration is edited (ST2). When the editing operation is completed, the editing result is temporarily stored in the approval-waiting user information database 10 by the data management function 4 under the control of the user management function 8 (ST3). At the same time, the notification function 5 notifies the maintenance manager that the editing of the user information for new registration by the operation manager has been completed (ST4).

  The maintenance manager who has received the notification inputs a password or the like to the maintenance manager authority acquisition function 6 in order to authenticate his execution authority. The maintenance manager authority acquisition function 6 authenticates that this input is from the maintenance manager, and further authenticates the execution authority for the operation based on the authority management table 9. For example, in the case of the authority management table shown in FIG. 2, the authority of the browsing operation and the registration operation is authenticated to the maintenance manager (ST5).

  When the registration operation is started by the maintenance manager, the approval function 7 first accepts this operation, and under the control of the user management function 8, the data management function 4 temporarily stores it in the user information database 10 waiting for approval. Calls the edited result of the stored user information for new registration and displays the contents. Based on this display content, an approval operation for the editing result input from the maintenance manager is accepted and the fact is transferred to the user management function 8. In response to this approval operation, the user management function 8 issues an approval notification to the operation manager. This notification is sent from the notification function 5 to the operation manager (ST6).

  At the same time, based on the approval operation in ST6, the user management function 8 sends the user information for new registration temporarily stored in the approval-waiting user information database 10 to the user information database 11 by the data management function 4. Write to. Then, new user information is registered in the user information database 11 (ST7). Thereafter, the user management function 8 sends a notification to the notification function 5 that the registration operation by the maintenance manager has been completed. This notification is sent from the notification function 5 to the operation manager (ST8).

  Next, operations in typical scenes in the flow of user registration / update work will be described in more detail with reference to FIGS.

  FIG. 4 is a block diagram for explaining the operation when the operation manager browses the user management information database. 4 that are the same as those in the block diagram shown in FIG. 1 are denoted by the same reference numerals, and description thereof is omitted.

  In FIG. 4, the operation manager inputs a password or the like to the operation manager authority acquisition function 1 (S41). The operation manager authority acquisition function 1 refers to the authority management table 9 and authenticates the operation manager's authority for the browsing operation (S42). When the operation manager performs an input operation as a browsing operation of the user management information to the operation / display function 2, the operation / display function 2 accepts this and sends it to the user management function 8 (S43).

  The user management function 8 sends an acquisition request for user management information to the data management function 4 (S44). The data management function 4 acquires user management information from the user management information database 12 and sends it to the user management function 8 (S45). The user management function 8 sends the received user management information to the operation / display function 2, and the operation / display function 2 displays it (S46).

  FIG. 5 is a block diagram for explaining an operation in a case where an operation administrator who has been authorized for the editing operation edits new user information. 4 that are the same as those in the block diagram shown in FIG. 1 are denoted by the same reference numerals, and description thereof is omitted.

  In FIG. 5, the operations manager operates the user editing function 3 through the operation / display function 2 to edit new user information (S51). The user editing function 3 sends the edited user information to the user management function 8 (S52). The user management function 8 sends the user information to the data management function 4 and requests writing to the approval-waiting user information database 10 for temporary storage (S53). The data management function 4 writes the user information sent from the user management function 8 to the approval-waiting user information database 10 and notifies the user management function 8 of the completion of the writing (S54). The user management function 8 receives the notification of the completion of writing, and requests the notification function 5 to issue a notification of completion of editing to the maintenance manager (S55). In response to this, the notification function 5 notifies the maintenance manager of the completion of editing (S56).

  FIG. 6 is a block diagram for explaining an operation in a case where an operation administrator who has been authorized for the browsing operation browses user information. 6, the same parts as those in the block diagram shown in FIG. 1 are denoted by the same reference numerals, and the description thereof is omitted.

  In FIG. 6, the operation manager inputs the name of the user to be browsed to the operation / display function 2 (S61). The operation / display function 2 accepts this input operation and transfers the input contents to the user management function 8 (S62). The user management function 8 sends an acquisition request for user information corresponding to the specified name or the like to the data management function 4 (S63). The data management function 4 acquires the target user information from the user information database 11 and sends it to the user management function 8 (S64). The user management function 8 sends the received user information to the operation / display function 2, and the operation / display function 2 displays it (S65).

  FIG. 7 is a block diagram for explaining an operation in a case where the operation administrator who has been authorized for the editing operation changes the registered user information. 7 that are the same as those in the block diagram shown in FIG. 1 are denoted by the same reference numerals, and description thereof is omitted.

  In FIG. 7, the operation manager operates the user editing function 3 through the operation / display function 2 to edit the user information to be changed (S71). The user editing function 3 sends the changed user information to the user management function 8 (S72). The user management function 8 sends the changed user information to the data management function 4 and requests writing to the approval-waiting user information database 10 for temporary storage (S73). The data management function 4 writes the user information sent from the user management function 8 to the approval-waiting user information database 10, and notifies the user management function 8 of the completion of the writing (S74). The user management function 8 receives this write completion notification, and requests the notification function 5 to issue a change completion notification to the maintenance manager (S75). In response, the notification function notifies the maintenance manager of the completion of the change (S76).

  FIG. 8 is a block diagram for explaining the operation when the maintenance manager registers the user information that has been edited in the user information database. 8 that are the same as those in the block diagram shown in FIG. 1 are denoted by the same reference numerals, and description thereof is omitted.

  In FIG. 8, the maintenance manager inputs a password or the like to the maintenance manager authority acquisition function 6 (S81). The maintenance manager authority acquisition function 6 refers to the authority management table 9 and authenticates the authority of the maintenance manager registration operation (S82). When the maintenance manager performs an input operation as a registration operation on the approval function 7, the approval function 7 accepts this and transfers it to the user management function 8 (S83). The user management function 8 sends an acquisition request for registration target user information temporarily stored in the approval-waiting user information database 10 to the data management function 4 (S84). The data management function 4 acquires the target user information from the approval-waiting user information database 10 and sends it to the user management function 8 (S85). The user management function 8 sends the received user information to the approval function 7, and the approval function 7 displays this (S86).

  When the maintenance manager performs an approval operation based on this display content, the approval function 7 accepts this operation and transfers it to the user management function 8 (S87). Based on this approval operation, the user management function 8 sends the user information to be registered acquired in S85 to the data management function 8, and requests writing to the user information database 11 and the user management information database 12. At the same time, the approval of the editing result is notified to the operation manager via the notification function 5 (S88). The data management function 4 writes this user management information into the user information database 11 and the user management information database 12, and notifies the user management function 8 of the completion of the writing (S89). The user management function 8 receives this write completion notification and requests the notification function 5 to issue a registration completion notification to the operation manager (S810). In response to this, the notification function 5 notifies the operation manager of the completion of registration (S811).

  As described above, in this embodiment, the execution authority for the operation of the system management information is set in advance in the authority management table for each administrator, and this authority is used when registering / updating the system management information. Management of authority of each administrator based on the management table, and by multiple administrators, the administrator who is authorized to edit system management information and the administrator who is authorized to register A predetermined job is executed. As a result, an operation performed by one administrator is not reflected in the system management information as it is, and it is possible to prevent erroneous registration / update of the system management information due to the negligence or fraud of the administrator.

The block diagram which shows one Example of the operation authority management system which concerns on this invention. The figure which models and shows an example of an authority management table. The flowchart for demonstrating operation | movement of the operation authority management system which concerns on this invention. The block diagram for demonstrating operation | movement when an operation manager browses a user management information database. The block diagram for demonstrating operation | movement when the operation administrator who authenticated the authority of edit operation edits new user information. The block diagram for demonstrating operation | movement in case the operation administrator who authenticated the authority of browsing operation browses user information. The block diagram for demonstrating operation | movement when the operation administrator who authenticated the authority of edit operation changes the registered user information. The block diagram for demonstrating operation | movement in case a maintenance manager registers the user information which editing completed in the user information database.

Explanation of symbols

1 Operation administrator authority acquisition function 2 Operation / display function 3 User edit function 4 Data management function 5 Notification function 6 Maintenance administrator authority acquisition function 7 Approval function 8 User management function 9 Authority management table 10 User information database waiting for approval 11 User Information Database 12 User Management Information Database

Claims (4)

An operation authority management system for system management information of an information processing system operated by a plurality of authorized administrators,
An authority management table in which execution authority for the operation of the system management information is set for each administrator in advance,
Editing authority authenticating means for authenticating the authority of the system management information editing operation for the first administrator based on the authority management table;
Based on the authentication result from the editing authority authentication means, the system management information is edited by the first administrator to edit the system management information, and the editing result is temporarily stored and notified to the second administrator. Editing means to
Registration authority authenticating means for authenticating registration operation authority of system management information for the second administrator based on the authority management table;
Based on the authentication result from the registration authority authentication means, the second administrator accepts the registration operation of the system management information by the second administrator, and the second administrator with respect to the editing result temporarily stored for the first administrator. And a registration means for registering the temporarily stored editing result in the system management information and notifying the first administrator of the registration result. system.   2. The operation authority management according to claim 1, wherein the system management information is user management information in a database including at least a user name and a user ID number that use the information processing system. system. An operation authority management method for system management information of an information processing system operated by a plurality of authorized administrators,
Authenticate the authority of the system management information editing operation for the first administrator based on the authority management table in which the execution authority for each administrator for the operation of the system management information is set in advance;
Based on the authentication result, the system management information is edited by the first administrator, and the system management information is edited.
Temporarily store the edited result and notify the second administrator,
Authenticating the registration operation authority of the system management information for the second administrator based on the authority management table;
Based on the authentication result, the second manager accepts an operation for registering system management information, and issues an approval notice by the second manager to the temporarily stored editing result to the first manager. ,
An operation authority management method comprising: registering the temporarily stored editing result in the system management information and notifying the first administrator of the registration result.   4. The operation authority management according to claim 3, wherein the system management information is user management information in a database including at least a user name and a user ID number that use the information processing system. Method.

Images