JP2006249802A - Entry control program, entry control method and entry control device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an entry control program, an entry control method and an entry control device capable of making reentry without dropping a security level even if a user leaves a room in a state to leave a user IC card in a security room in an entry control of the security room performing the authentication of the user by the IC card in the case of entry. <P>SOLUTION: When log-in indicating information is received from an information system terminal in the security room, user information including a user ID, a password and an MAC address is stored in a storage means as user information during the log-in, a room ID of the security room wherein a user terminal is existed is specified on the basis of the MAC address, and when unlocking request information aiming at designating the user ID and the password manually input by the user from an entry gate controller is received after the user authentication information including the user ID of the user to be authenticated in the outside of the security room and the password has been received, unlocking indicating information is transmitted to an entry gate controller only in the case of finished biological authentication, during the log-in and the coincidence of the room ID. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to entry management into a specific security room, and more particularly to authentication of the user when a user leaves the security room during business execution and then re-enters the security room.

  Security room entry / exit is managed by various methods based on the business form, business confidentiality, security room structure and scale, corporate security policy, and the like. For example, in a small stand-alone system that is not connected to a higher-level server, not only entering and leaving the security room, but also the management of logon to information terminals, etc., the “IC for room entry” The card reader / writer authenticates the identity by using the IC card registration number and fingerprint information, and if the identity is confirmed, the card reader / writer authorizes entry into the security room and records the entry information in the IC card. If the entry information is recorded on the IC card, the IC card reader connected to the terminal permits the logon to the information system terminal, records the logon information on the IC card when logging on, and deletes it when logging off. If there is no logon information in the IC card, the IC card reader permits the user to leave the room and deletes the room entry information. It has been disclosed (e.g., see Patent Document 1).

In addition, unauthorized access to information is made possible by linking physical security of entering and leaving the building and entering and leaving the room, and information security that controls access to information on the computer or on a computer connected to the computer. For the purpose of detecting the “entrance / exit history storage unit for storing the entrance / exit history information of the user who entered / exited from the entrance / exit of the structure in which the electronic device is arranged, and the inside of the structure. An electronic device history storage unit that stores access history information of a user who has accessed the electronic device, a receiving unit that receives an inquiry from the electronic device whether the user who has accessed the electronic device is a valid user, and Of the access history information stored in the electronic device history storage unit, the access history information corresponding to the inquiry received by the receiving unit and the entry / exit A management system including a determination unit that determines whether or not the user who has accessed the electronic device based on the entry / exit history information stored in the history storage unit is an unauthorized person is disclosed (for example, Patent Document 2). reference).
JP 2002-197500 A (page 1-3) JP 2004-246553 A (Page 2-5)

  However, in the entrance management system that links the security room entry / exit history management and access control to the information system terminal as described above, once the user enters the security room, all the information system terminals that use the information system terminal are used. There is a problem that impairs the convenience of not being able to leave the security room unless the work is completed or the work using the information system terminal is interrupted once at a work break and the user enters the management system.

  There are various types of security rooms. For example, if you have a structure that prevents multiple people from entering the room at the same time, such as a ticket gate at a station, all people who enter the security room can be a set of authenticated users. . As described above, in a security room that can strictly manage user entry, there are security systems that do not always authenticate the user when leaving the room in consideration of user convenience.

  Further, since highly confidential business requires user authentication for each job, the user needs to read the IC card into the IC card reader connected to the information system terminal each time. However, a job usually consists of a plurality of jobs, and the job flow differs depending on the end condition of each job. Therefore, a job network is configured in advance and the next job is automatically set according to the end condition of each job. It is common practice to keep it selected. For this reason, when performing such operations, personal authentication for each job is required at irregular times. Therefore, it is necessary to leave the IC card inserted in the IC card reader connected to the information system terminal. Is significantly reduced.

  The present invention lowers the security level even when the user is forced to leave the IC card in the security room in the security room entrance management in which the user is authenticated by the IC card when entering the room. The purpose is to allow re-entry without re-entry.

  FIG. 1 is an overall configuration diagram of the present invention. The room entry management program 10 of the present invention is executed on a computer that behaves as the room entry management apparatus 1. When the room entry management program 10 receives login instruction information from the information system terminal 61 in the security room 6, the login means 11 uses the user ID. , The user information including the password and the MAC address is stored in the storage unit as the logged-in user information, and the room specifying unit 12 specifies the room ID of the security room in which the user terminal exists based on the MAC address. .

  The authentication information acquisition means 13 receives the user authentication information including the user ID and password of the user who has been authenticated from the biometric authentication server 3 or the biometric authentication device 4 outside the security room, and stored it in the storage means. Later, from the entrance gate control device 5 provided at the entrance of the security room 6, the room ID of the security room 6 and the unlock request information indicating that the user has manually specified the user ID and password are received. Then, the user has been authenticated outside the security room based on the user authentication information, is a logged-in user based on the logged-in user information, and the room ID of the security room is the Based on user information during login, it was confirmed that the room identification means 12 matched the room ID identified The case constitutes the entry management program 10 to send the unlock instruction information to enter the gate control device 5.

  Reentry without lowering the security level even if the user is forced to leave the IC card in the security room in the security room entry management that uses the IC card to authenticate the user when entering the room. Is possible.

(Example)
FIG. 1 is an overall configuration diagram of an embodiment according to the present invention. The room entry management program 10 of the present invention is executed on a computer that behaves as the room entry management apparatus 1 and receives login instruction information from, for example, the information system terminal 61 in the security room, and includes a user ID, password, and MAC address. Based on the login unit 11 (which executes the login step in claim 1) and storing the information as login user information in the login management file 22 on the external storage device 2, the information system terminal Room identification means 12 for identifying the room ID of an existing security room (the room identification step in claim 1 is executed) and the biometric authentication server 3 or biometric authentication device 4 connected via the communication network 7 Identifies outside security room 6 Authentication information acquisition means 13 for receiving user authentication information including the user ID and password of the registered user and storing it in the authentication management file 23 on the external storage device 2 (execution of the authentication information acquisition step in claim 1) And an unlocking request indicating that the room ID of the security room 6 and the user ID and password have been manually input by the user from the entrance gate control device 5 provided at the entrance of the security room 6. When the information is received, the user has been authenticated outside the security room 6 with reference to the authentication management file 23, is a logged-in user with reference to the login management file 22, and is stored in the security room 6. When it is confirmed that the room ID matches the room ID specified by the room specifying means 12, the entrance gate control device 5 (In claim 1, executes unlock control step.) Unlocking control means 14 for transmitting the unlock instruction information for having.

  Although not shown in FIG. 1, an IC card reader (which may be a non-contact type) is connected to the information system terminal 61 and the information system terminal 62 (not limited to two) and used. When a person inserts (or approaches) an IC card, it is used for log-in processing for an entrance management system or for personal authentication of a job to be executed in business. In addition, an IC card reader (which may be a non-contact type) is also connected to the entrance gate control device, and when the user enters the security room 6 by inserting (or approaching) the IC card. Although this is used for personal authentication, this point is a prior art and is not an essential part of the present invention, so that the description thereof is omitted.

  The biometric authentication device 4 is assumed to be a palm vein authentication device with high authentication accuracy, non-contact type, clean, and less psychological resistance of the user. Such a biometric authentication device is suitable for managing security rooms with high authentication accuracy and high confidentiality, but it is costly to install in each security room that is used by a small number of people. In general, an IC card is used. In this embodiment, the user who once entered the security room leaves the IC card while leaving the security room, and is used for user authentication when the user reenters the room without the IC card. One is installed in the building or the minimum necessary number in a common space such as a cafeteria.

  In this embodiment, since the user does not have an IC card and performs biometric authentication by the biometric authentication device 4, biometric authentication information necessary for biometric authentication for the user cannot be registered in the biometric authentication device 4 due to the scale of the security facility. In this case, the biometric authentication server 3 that can store large-scale biometric authentication information is used. Since the biometric authentication process is a conventional technique and is not an essential part of the present invention, the description thereof will be omitted.

  FIG. 2 shows an example of a room ID management file. Each security room and the entrance management apparatus 1 are connected via a switching hub via a LAN (Local Area Network), and each security room can be identified in correspondence with the port number of the switching hub. For example, port number 1 is defined in advance when operating this room entry management system so as to correspond to a security room with room ID 1A and port number 2 with room ID 2A.

  FIG. 3 shows an example of a login management file. When the user enters the security room and logs in to the entrance management system by inserting (or moving closer) his / her IC card into the IC card reader connected to the information system terminal 61, the login of the entrance management program 10 is performed. The means 11 stores the logged-in user information (user ID, password, MAC address) in the user ID, password, MAC address column of the login management file 22. In this embodiment, an example is shown in which a user whose user ID is u001 and password ajksiof logs in from the information system terminal 61 whose MAC address is Fe: 80: 2.e1.

  Furthermore, the room identification means 12 of the room entry management program 10 inquires about the port number where the information system terminal 61 is connected to the switching hub using the user's MAC address Fe: 80: 2.e1 as a parameter, as shown in FIG. Based on the room ID management file, 1A, which is the room ID of the security room where the information system terminal 61 exists, is stored in the room ID column.

  FIG. 4 shows an example of an authentication management file. The biometric authentication device 4 or the biometric authentication server is used to authenticate the user who has left the IC card in the security room in order to continue the business and replaces the IC card when reentering the security room. 3 stores the user ID of the user who has been authenticated and the password transmitted from 3.

  FIG. 5 shows an example of a correspondence table of port numbers and MAC addresses possessed by the switching hub. For example, the port number 1 indicates that the information system terminal 61 with the MAC address Fe: 80: 2.e1 and the information system terminal 62 with the MAC address Fe: 70: 4.e1 are connected.

  FIG. 6 is a flowchart showing the flow of the login information registration process. When the room entry management program 10 receives the login instruction information from the information system terminal 61 (S601), the MAC address (Fe: 80: 2.e1) of the logged-in information system terminal 61 and the user ID of the user ( u001) and password (ajksiof) are stored in the login management file 22 (S602).

  Next, a command for inquiring about the port number to which the information system terminal 61 is connected is issued to the switching hub using the MAC address (Fe: 80: 2.e1) of the user's information system terminal 61 as a parameter (S603). The room ID (1A) of the security room in which the information system terminal 61 exists is identified by referring to the room ID management file 21 using the port number (1) connected to the information system terminal 61 received from the switching hub as a key. And stored in the login management file 22 (S604).

  FIG. 7 is a flowchart showing a flow of re-entry processing to the security room. Received from the biometric authentication device 4 or the biometric authentication server 3 is a user ID and password that have been authenticated as a user who satisfies the admission conditions to the security area (a set of security rooms) managed by the room entry management system. Then, the room entry management program 10 stores the user ID and password of the authenticated user in the authentication file 23 (S701).

  When the room ID of the security room, the user ID manually entered by the user, and the password are received from the entrance gate control device 5 (S702), the entrance management program 10 is stored in the authentication file 23. The user ID and password are compared (S703), and if they do not match, the process ends. If they match, the login management file is referenced to search for login information that matches the user ID and password (S704). If there is no matching login information The process ends. If there is matching login information, the room ID of the security room that the user is trying to enter is compared with the room ID of the login information stored in the login file 22 (S705). If not, the process ends. If they match, a gate unlock command for the security room 6 is issued to the entrance gate control device 5 (S706).

  FIG. 8 is a flowchart showing the flow of the login information deletion process. When logout instruction information is received from the information system terminal 61 (S801), the room management program 10 uses the MAC address (Fe: 80: 2.e1) of the information system terminal 61 that has transmitted the logout instruction information as a key to manage the login management file. 22, the login information related to the information system terminal 61 is deleted (S802).

Overall configuration diagram of the embodiment Room ID management file example Login management file example Authentication management file example Example of correspondence table of port number and MAC address Login information registration process flow Flow of re-entering the security room Login information deletion process flow

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Entrance management apparatus 2 External storage device 3 Biometric authentication server 4 Biometric authentication apparatus 5 Entrance gate control apparatus 6 Security room 10 Entrance management program 11 Login means 12 Room identification means 13 Authentication information acquisition means 14 Unlocking control means 21 Room ID management File 22 Login management file 23 Authentication management file 61 Information system terminal 62 Information system terminal

Claims (3)

On the computer,
When receiving login instruction information from the information system terminal in the security room, a login step for storing user information including a user ID, password, and MAC address in the storage means as user information during login;
A room specifying step of specifying a room ID of a security room in which the information system terminal exists based on the MAC address;
An authentication information acquisition step of receiving user authentication information including a user ID and a password of a user who has been authenticated outside the security room from a biometric authentication server or a biometric authentication device, and storing the user authentication information in a storage unit;
When receiving the room ID of the security room and the unlocking request information indicating that the user has manually specified the user ID and password from the entrance gate control device provided at the entrance of the security room, the use The user has been authenticated outside the security room based on the user authentication information, is a logged-in user based on the logged-in user information, and the room ID of the security room is the logged-in user. An entrance management program for executing an unlocking control step of transmitting unlocking instruction information to the entrance gate control device when it is confirmed that the room specifying means matches the room ID specified based on the information. Computer
When receiving login instruction information from the information system terminal in the security room, a login step for storing user information including a user ID, password, and MAC address in the storage means as user information during login;
A room specifying step of specifying a room ID of a security room in which the information system terminal exists based on the MAC address;
An authentication information acquisition step of receiving user authentication information including a user ID and a password of a user who has been authenticated outside the security room from a biometric authentication server or a biometric authentication device, and storing the user authentication information in a storage unit;
When receiving the room ID of the security room and the unlocking request information indicating that the user has manually specified the user ID and password from the entrance gate control device provided at the entrance of the security room, the use The user has been authenticated outside the security room based on the user authentication information, is a logged-in user based on the logged-in user information, and the room ID of the security room is the logged-in user. An unlocking control step of transmitting unlocking instruction information to the entrance gate control device when it is confirmed that the room identification means matches the room ID specified based on the information, How to enter the room. Upon receiving login instruction information from the information system terminal in the security room, login means for storing user information including a user ID, password, and MAC address in the storage means as user information during login;
Room identification means for identifying a room ID of a security room where the information system terminal exists based on the MAC address;
Authentication information acquisition means for receiving user authentication information including a user ID and password of a user who has been authenticated outside the security room from a biometric authentication server or a biometric authentication device, and storing the user authentication information in a storage means;
When receiving the room ID of the security room and the unlocking request information indicating that the user has manually specified the user ID and password from the entrance gate control device provided at the entrance of the security room, the use The user has been authenticated outside the security room based on the user authentication information, is a logged-in user based on the logged-in user information, and the room ID of the security room is the logged-in user. Unlocking control means for transmitting unlocking instruction information to the entrance gate control device when it is confirmed that the room specifying means matches the room ID specified based on the information. Entrance management device.

Images