JP2007094548A - Access control system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform access control appropriate for the occasion according to the position information of a user terminal. <P>SOLUTION: An access control system has an authentication server 1 which transmits an authentication log to a user terminal surveillance server 2 while performing user authentication and transmitting an authentication token to the user terminal 16; the user terminal surveillance server 2 which receives the authentication log and transmits position information attribute of authenticated user terminal 16 to a policy server 3, the policy server 3 which receives this position information attribute and make a directory server 26 execute setting of group attribute based on position information of the user terminal 16; and the directory server 26 which transmits the group attribute of the user to an application server 27 based on authentication token from the user terminal 16; and the application server 27 provides a function based on the group attribute to the user terminal 16 when the server receives the group attribute of the user terminal 16. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an access control system that performs authorization and access management based on physical and logical location information of a user terminal.

  Applications such as a shared file service, Web application, remote access VPN, and IEEE802.1x dynamic VLAN have a user authentication function, a user authorization function, and an accounting function for each application. However, these have problems such as a heavy load for creating an application, requiring a lot of labor for maintenance, and requiring the user to log in for each application. In view of these problems related to conventional applications, today, it includes a single sign-on such as NET Passport that reduces the burden of user authentication, and a function that collectively controls user access rights without stopping at just a yellow page. In fact, technologies related to integrated directories such as Windows (registered trademark) Active Directory and LDAP servers have been developed.

  On the other hand, the ubiquitous environment provides an environment in which network resources can be accessed regardless of time and place. In parallel with this environmental improvement, information security laws such as the Personal Information Protection Law are being developed today, but the pursuit of convenience and the pursuit of safety are in a trade-off relationship in a sense. . For example, in a ubiquitous environment, it is possible to access internal personal information etc. from coffee shops in the city, but in view of the risk of being stolen by a third party, it is necessary to take some measures against it There is. In view of such a situation, a technique for performing access management in accordance with the location information of the user terminal has been developed today. In this technology, the user access authority is managed in a unified manner by the user authorization unit.

  However, in the above-described access management according to the location information of the user terminal, the access authority of the user is determined as static and cannot be changed dynamically according to the location information of the user. This is the actual situation. In addition, in the LDAP server and Active Directory described above, the access authority of a user is controlled using the concept of “group”. However, the access authority is determined as static, and the physical authority of the user is determined. Dynamic, logical position information, etc. cannot be handled dynamically. In other words, authorization and access management are not performed assuming the environment where the user is placed.

  An object of the present invention is to manage physical and logical location information of a user terminal, grant an authority appropriate to the place according to the information, and perform access management.

  In order to achieve the above object, in the first aspect of the present invention, an authentication server that performs user authentication of a user terminal, transmits an authentication token to the user terminal, and transmits an authentication log to the user terminal monitoring server; A user terminal monitoring server that receives the authentication log and transmits the location information attribute of the authenticated user terminal to the policy server, and receives the location information attribute and sets a group attribute based on the location information of the user terminal in the directory server. A policy server to be implemented; an application server that receives the authentication token from the user terminal and transmits the authentication token to the directory server; and a directory server that transmits the group attribute of the user to the application server based on the authentication token. The application server has a user end Upon receiving the group attributes, provides the functions based on the group attribute to the user terminal, there is provided an access control system, characterized in that.

  In the second aspect of the present invention, the user authentication of the user terminal is performed, the authentication token is transmitted to the user terminal, the authentication log is transmitted to the user terminal monitoring server, and the authentication log is received and authenticated. A user terminal monitoring server for transmitting the location information attribute of the user terminal to the policy server, and setting of the group attribute having the optimum printer IP address for the location information of the user terminal in the directory server in response to the location information attribute A policy server that implements the above, a printer server that receives the authentication token from the user terminal and transmits the authentication token to the directory server, a directory server that transmits the group attribute of the user to the printer server based on the authentication token, And the printer server includes a group of user terminals. When receiving the to identify the printer based on the group attribute, an access control system characterized by being provided.

  In the third aspect of the present invention, user authentication of a user terminal is performed, an authentication token is transmitted to the user terminal, an authentication log is transmitted to the user terminal monitoring server, and the authentication log is received. A user terminal monitoring server that transmits the location information attribute of the authenticated user terminal to the policy server; a policy server that receives the location information attribute and causes the directory server to set the group attribute based on the location information of the user terminal; A directory server that returns a group to which the user terminal belongs to the single sign-on server, and an application server that grants the user terminal access permission based on an application usage token. Application usage on server When a request for creating a token is made, the single sign-on server receives the group to which the user belongs from the directory server, creates an application usage token, distributes it to the user terminal, and accesses the user terminal based on the application usage token. An access control system characterized by granting permission is provided.

  In the fourth aspect of the present invention, user authentication of a user terminal is performed, an authentication token is transmitted to the user terminal, an authentication log is transmitted to the user terminal monitoring server, and the authentication log is received and authenticated. A user terminal monitoring server that transmits the location information attribute of the user terminal to the policy server; a policy server that receives the location information attribute and causes the directory server to set a group attribute based on the location information of the user terminal; A directory server that receives the authentication token from the server and returns a group attribute of the user to the user terminal based on the authentication token. When the application is started on the user terminal, the application sends the authentication token to the directory server. The directory server sends an authentication token Sending a group attribute of the user to the user terminal based, so as to provide a function based on the group attribute an application receives the user terminal, there is provided an access control system, characterized in that.

  According to a fifth aspect of the present invention, there is provided an access control system according to any one of the first to fourth aspects, wherein the authentication token includes at least a user ID or an IP address of a user terminal that has passed authentication.

  In a sixth aspect of the present invention, in the first to fifth aspects, the policy server holds a table in which static users and groups are associated with each location information, and the directory server There is further provided an access control system characterized by holding a table in which dynamic users and groups are associated with each other based on user position information.

  According to a seventh aspect of the present invention, there is provided the access control system according to the sixth aspect, wherein the directory server dynamically changes a group to which the user belongs in the table.

  According to the present invention, it is possible to provide a communication control device and an access control system that manage physical and logical location information of a user terminal, grant authority appropriate to the location according to the information, and perform access management. it can.

  Embodiments of the present invention will be described below with reference to the accompanying drawings.

  FIG. 1 shows and describes the configuration of an access control system according to an embodiment of the present invention.

  As shown in the figure, this access control system includes an authentication server 1 such as a Radius (Remote authentication dial-in user service) server compatible with IEEE802.1x, a user terminal monitoring server 2, a policy server 3, a DHCP server 4 and the like. A server (hereinafter referred to as an application server) 5 such as a file server (hereinafter referred to as an application server) 5, a VPN termination device 6, and a directory server 26 are arranged in a corporate intranet 7, and each server in the intranet 7 is, for example, It is connected to user terminals 10a to 10c (hereinafter collectively referred to as reference numeral 10) through the IEEE802.1x compatible access switches 9a and 9b, and is connected to the user terminals 12a and 12b (hereinafter referred to as “terminal terminals”) through the access switch 11. Connected to the reference numeral 12). The user terminal 16 is at home, the user terminal 17 is away from home, and the user terminals 14a and 14b (hereinafter collectively referred to by reference numeral 14) are connected from the public SOHO spot to the intranet 7 side via the public network 8 and the VPN termination device 6. Connected to be accessible. When accessing from a public SOHO spot, access is made through the access switch 13, but authentication by the authentication proxy server 15 must be performed.

  In such a configuration, the authentication server 1 authenticates the user terminals 14, 16, and 17 that have been remotely accessed. Alternatively, the use permission / non-permission of the ports of the access switches 9 and 11 by the accessing user terminals 10 and 12 is determined. Then, VLAN number assignment, IP address assignment, and other various information are appropriately assigned to the user terminal 6.

  The user terminal monitoring server 2 receives the log of the authentication server 1, port information obtained from the IEEE802.1x compatible access switches 9 and 11 via SNMP (Simple Network Management Protocol), and SNMP and Telnet from the user terminals 10 and 12 etc. A table is created according to the user terminal information obtained through the communication. The user terminal monitoring server 2 has an API (Application Programming Interface) for dynamically controlling the VLAN of the user terminal.

  The user terminal monitoring server 2 has a user terminal information table as shown in FIGS. That is, in the access switch position information table of FIG. 3, the address, floor, room number, and area ID where the access switches 9 and 11 are arranged are associated. In the user terminal information table of FIG. 4, the user ID, the terminal ID of the user terminal, the network ID (IP address), the VLAN ID, the IDs and port IDs of the access switches 9 and 11, and the access form are associated with each other. Further, in the user terminal information table of FIG. 5, the user ID and the terminal ID (MAC address), the network ID (IP address) of the user terminal 6, the VLAN ID, the IP address of the access switch 5, the port ID of the access switch 5, and the access form , Access start time, access end time, entry / exit information, entry time, exit time, entrance / exit information, entrance time, exit time are stored in association with each other.

  For example, for the user terminals 9 and 11 infected with a virus or the user terminals 9 and 11 with insufficient security measures, the application server 5 changes the belonging VLAN of the user terminals 9 and 11 via the API. The policy server 3 determines a predetermined policy based on information on the physical positions of the user terminals 10, 12, 14, 16, and 17. The policy includes various types such as an access list for determining file access, an access list for determining browsing possibility, and user configuration information. The directory server 26 collectively manages user access authority.

  In this system, the physical position of the user terminal 6 is specified with reference to the access switch position information table and the user terminal information table. One of the features of this embodiment is that access management is performed based on such logical information (which VLAN belongs) and physical location information (which floor, etc.). It is.

  Here, a data collection method by the user terminal monitoring server 2 will be described.

  First, in the case of connection from the head office or branch office, the user terminal monitoring server 2 receives the 802.1x authentication log and account log from the authentication server 1, receives the log of the DHCP server 4, or accesses Data is collected by the method of receiving the session status from the switches 9 and 11 and a wireless access point (not shown) via SNMP or the like.

  On the other hand, in the case of connection from home or away from home (user terminals 16 and 17), the user terminal monitoring server 2 receives the remote access authentication log and account log from the VPN termination device 6 or performs remote access. Data is collected by the method of receiving the IP address assigned to the user terminals 16 and 17 from the VPN terminating device 6 or the DHCP server 4 or receiving the status of the remote access session from the VPN terminating device 6.

  In the case of connection from a public SOHO spot (a company that rents a SOHO space), the user terminal monitoring server 2 obtains the network usage permission of the SOHO space using 802.1x or the like, and authentication is performed by an authentication proxy. The authentication server 1 on the intranet 7 is used. For example, if it is an employee of company A, the authentication server 1 of company A is used. Then, after connecting to the network, a remote access session is established.

  In the example shown in FIG. 2, an entrance / exit / exit management server 18 is provided, and an entrance / exit management terminal 23 is arranged in the building X, and entrance / exit management terminals 24, 25,. Is placed, and entry / exit and entry / exit of employees are managed.

  Hereinafter, the flow of processing in which the application server 5 dynamically manages the access authority of the user by the access control system according to the embodiment of the present invention will be described in detail with reference to FIG. First, the user terminal 16 requests the authentication server 1 for user authentication (IEEE802.1x, remote access VPN authentication, login to the Windows domain) (step S1). Upon receiving this request, the authentication server 1 transmits an authentication token to the user terminal (step S2). Information included in the authentication token includes a user ID, a user IP address, an authentication server ID, an authentication time (time stamp), and an expiration date.

  Subsequently, the authentication server 1 transmits an authentication log and an account log to the user terminal monitoring server 2 (step S3). The user terminal monitoring server 2 manages the NAS ID and the physical location information in association with each other. Therefore, when receiving this, the user terminal monitoring server 2 transmits the location information attribute of the authenticated user to the policy server 3 (step S4).

  Upon receiving this location information attribute, the policy server 3 causes the directory server 26 to set a group attribute based on the user location information (step S5). Subsequently, the user terminal 16 accesses the application server 27. At the same time, an authentication token is transmitted (step S6). Upon receiving this, the application server 27 transmits an authentication token to the directory server 26 (step S7), and the directory server 26 transmits a user group attribute to the application server 27 based on the authentication token (step S8). Upon receiving this, the application server 27 provides the user terminal 16 with a function based on this group attribute (step S9).

  Hereinafter, the flow of processing in which the application server 5 designates an appropriate printer 30 according to the user position information by the access control system according to the embodiment of the present invention will be described in detail with reference to FIG. .

  First, the user terminal 16 requests the authentication server 1 for user authentication (IEEE802.1x, remote access VPN authentication, login to the Windows domain) (step S201). Upon receiving this request, the authentication server 1 transmits an authentication token to the user terminal 16 (step S202). Information included in the authentication token includes a user ID, a user IP address, an authentication server ID, an authentication time (time stamp), and an expiration date.

  Subsequently, the authentication server 1 transmits an authentication log and an account log to the user terminal monitoring server 2 (step S203). The user terminal monitoring server 2 manages the NAS ID and the physical location information in association with each other. Therefore, when receiving this, the user terminal monitoring server 2 transmits the location information attribute of the authenticated user to the policy server 3 (step S204).

  Upon receiving this position information attribute, the policy server 3 causes the directory server 26 to set a group attribute having the IP address of the printer 30 that is optimal for the user position information (step S205). Subsequently, the user terminal 16 accesses the printer server 31, and at the same time, transmits an authentication token (step S206). Upon receiving this, the printer server 31 transmits an authentication token to the directory server 26 (step S207), and the directory server 26 transmits the group attribute of the user to the printer server 31 based on this authentication token (step S8). The printer server 31 identifies the printer 30 based on the received group attribute (printer IP address, etc.), transmits information (step S209), and notifies the user terminal 16 of the identified printer (step S210).

  Next, referring to FIG. 8, the flow of processing in which the single sign-on server 28 replacing the authentication server 1 dynamically manages the access authority of the user by the access control system according to the embodiment of the present invention. Will be described in detail. The user terminal 16 requests the single sign-on server 28 for user authentication (IEEE802.1x, remote access VPN authentication, login to the Windows domain) (step S11). Upon receiving this request, the single sign-on server 28 transmits an authentication token to the user terminal 16 (step S12). Information included in the authentication token includes a user ID, a user IP address, an authentication server ID, an authentication time (time stamp), and an expiration date. Subsequently, the single sign-on server 28 transmits an authentication log and an account log to the user terminal monitoring server 2 (step S13). Then, the user terminal monitoring server 2 transmits the authenticated location information attribute of the user to the policy server 3 (step S14). Upon receiving this location information attribute, the policy server 3 sets a group attribute based on the user location information in the directory server 26 (step S15).

  When the user terminal 16 requests the single sign-on server 28 to create an application use token (step S16), the single sign-on server 28 requests the group information of the user from the directory server 26 (step S17). Upon receiving this request, the directory server 26 returns the group to which the user belongs to the single sign-on server 28 (step S18). Then, the single sign-on server 28 creates an application use token and distributes it to the user terminal 16 (step S19). Upon receiving this application usage token, the user terminal 16 transmits the application usage token to the application server 27 (step S20). The application server 27 authenticates this usage token and gives access permission based on the usage token to the user terminal 16 (step S21).

  Next, with reference to FIG. 9, the flow of processing in which the application of the user terminal dynamically manages the user access authority by the access control system according to the embodiment of the present invention will be described in detail. The user terminal 16 requests the authentication server 1 for user authentication (IEEE802.1x, remote access VPN authentication, login to the Windows domain) (step S31). Upon receiving this request, the authentication server 1 transmits an authentication token to the user terminal 16 (step S32). Information included in the authentication token includes a user ID, a user IP address, an authentication server ID, an authentication time (time stamp), and an expiration date.

  The authentication server 1 transmits an authentication log and an account log to the user terminal monitoring server 2 (step S33). In response to this, the user terminal monitoring server 2 transmits the authenticated location information attribute of the user to the policy server 3 (step S34). Receiving this position information attribute, the policy server 3 causes the directory server 26 to set the group attribute based on the user position information (step S35). Thereafter, when the application is started on the user terminal (step S36), the application transmits an authentication token to the directory server 26 (step S37), and the directory server 26 sets the group attribute of the user to the user terminal 16 based on the authentication token. Then, the application provides a function based on the received group attribute (step S39).

  Next, the relationship between the policy server 3 and the directory server 26 in the access control system according to the embodiment of the present invention will be described in detail with reference to FIG.

  The policy server 3 holds a table in which static users and groups are associated with each other for each piece of position information. On the other hand, the directory server 26 holds a table in which dynamic users and groups are associated with each other based on the user position information. When the user ID and the position information (Position ID) are notified from the user terminal monitoring server 2 to the policy server 3 (step S41), the policy server 3 should belong to the User ID notified from the user terminal monitoring server 2 The group is notified to the directory server 26 (step S42). Next, with reference to FIG. 11, the relationship between the policy server 3 and the directory server 26 in the access control system according to the embodiment of the present invention (especially when the position of the user is changed by a trigger) will be described in detail. . The difference from FIG. 10 described above is that when the user terminal monitoring server 2 notifies the policy server 3 of the User ID and the position information (Position ID) (step S51), the policy server 3 The group to which the user ID notified from 2 belongs should be notified to the directory server 26 (step S52), and the belonging group is changed on the directory server. In this example, the group to which UserA belongs is dynamically changed from PositionX to PositionY.

  Next, with reference to FIG. 12, an application example of the application in the access control system according to the embodiment of the present invention (when location information is used for access management of a file server) will be described in detail. When the user terminal 16 transmits an authentication token including a User ID to the file server 5 (step S61), the file server 5 confirms the authentication token and uses the User ID as a key to belong group information to which the user belongs. Is inquired of the directory server 26 (step S62). Upon receiving this inquiry, the directory server 26 returns the belonging group information to the file server 5 (step S63). The file server 5 returns a state accessible by the user terminal 16 to the user terminal 16 based on the group information (step S64). The authentication token may be confirmed by the file server 5 or the directory server 26. The RWCPrS shown in the table held by the file server means authority specific to the file system such as Readable, Writeable, Copyable, Printable, and Saveable. For example, in the case of only RW, it represents “Readable”, “Writeable”, “Copyable”, “Printable”, “Save”. The file server 5 performs the authority management for each directory or each file.

  Next, with reference to FIG. 13, an application example of the access control system according to the embodiment of the present invention (when the location information is used in the DRM server) will be described in detail.

  When the user terminal 16 requests download of a file in the DRM server 29 by transmitting an authentication token including a User ID (step S71), the DRM server 29 confirms the authentication token, and the user is identified by the User ID. The directory server 26 is inquired about belonging group information to which it belongs (step S72). The directory server 26 returns the belonging group information to the DRM server 29 (step S73). If the user can access the file, the DRM server 29 makes a request to the file server 5 (step S74). Upon receiving this request, the file server 5 transmits the corresponding file to the DRM server 29 (step S75). The DRM server 29 sets this file so that the authority permitted by the user can be executed. More specifically, the file is wrapped according to the authority (step S76). In this way, the DRM server 29 returns a file to which authority management is given to the user terminal 16 (step S77).

  Next, with reference to FIG. 14, an application example of the access control system according to the embodiment of the present invention (when the location information is used for the DRM client application) will be described in detail. When the user terminal 16 issues a file acquisition request to the file server 5 (step S81), the file server 5 requests the DRM server 29 to wrap the corresponding file (step S82). Upon receiving this request, the DRM server 29 wraps the file in accordance with the authority such as PWCPRS (step S83), and returns the wrapped file to the file server 5 (step S84). The file server 5 returns the wrapped file to the user terminal 16, and the user terminal 16 obtains the wrapped file (step S85). In the user terminal 16, an application that uses this file is started (step S86), and the application inquires of the user terminal monitoring server 2 for location information (step S87).

  Upon receiving this inquiry, the user terminal monitoring server 2 returns position information to the user terminal 16 (step S88). Thus, the application of the user terminal selects a policy corresponding to the position information and starts using the file (step S89). The user terminal 16 holds a table as shown in FIGS. Then, the application of the user terminal 16 grasps the group to which the user belongs, which is defined based on the position information with reference to the table of FIG. 16, and refers to the table of FIG. 15 to determine the authority given to the group. To grasp.

  Next, with reference to FIG. 17, an application example of the application in the access control system according to the embodiment of the present invention (when the location information is used for the DRM client application) will be described in detail. When the user terminal 16 issues a file acquisition request to the file server 5 (step S101), the file server 5 requests the DRM server 29 to wrap the corresponding file (step S102). Upon receiving this request, the DRM server 29 wraps the file in accordance with the authority such as PWCPRS (step S103), and returns the wrapped file to the file server 5 (step S104).

  The file server 5 returns the wrapped file to the user terminal 16, and the user terminal 16 obtains the wrapped file (step S105). The user terminal 16 activates an application that uses this file (step S106), and makes a policy creation request to the DRM server 29 (step S107). Upon receiving this policy creation request, the DRM server 29 returns the policy to the user terminal 16 after creating the policy (step S108). Thus, the user terminal 16 uses the policy dynamically created by the DRM server 29 and starts using the file (step S109).

  The embodiment of the present invention has been described above, but the present invention is not limited to this, and various improvements and modifications can be made without departing from the spirit of the present invention.

  For example, even when the entrance / exit / exit information is not used as shown in FIG. 2, the access authority is divided according to the location information in the free address space using the physical location information. Is also possible. In this case, for example, it is a space where a large number of people go in and out so that highly confidential work should be restricted, and since it is an individually partitioned space, a certain degree of confidentiality is maintained and the confidentiality is high. It is also possible to segment the space into areas such as areas where work may be permitted, etc., and to classify access authority based on physical location information of each area.

It is a figure which shows the structure of the access control system which concerns on one embodiment of this invention. It is a figure which shows the structure of the example of an improvement of the access control system which concerns on one embodiment of this invention. It is a figure which shows an example of an access switch position information table. It is a figure which shows an example of a user terminal information table. It is a figure which shows an example of a user terminal information table. It is a figure which shows the flow of a process in which the application server 5 manages a user's access authority dynamically by the access control system which concerns on one embodiment of this invention. 4 is a flowchart for explaining in detail a flow of processing in which the application server 5 designates an appropriate printer 30 according to user position information by the access control system according to the embodiment of the present invention. It is a figure which shows the flow of a process in which the single sign-on server 28 instead of the authentication server 1 manages a user's access authority dynamically by the access control system which concerns on one embodiment of this invention. It is a figure which shows the flow of a process in which the application of a user terminal dynamically manages a user's access authority by the access control system which concerns on one embodiment of this invention. It is a figure explaining the relationship between the policy server 3 and the directory server 26 in the access control system which concerns on one embodiment of this invention in detail. It is a figure which shows in detail the relationship between the policy server 3 and the directory server 26 in the access control system which concerns on one embodiment of this invention. It is a figure which shows the application example (when using positional information for access management of a file server) of the application in the access control system which concerns on one embodiment of this invention. It is a figure which shows the application example (when using location information for a DRM server) of the application in the access control system which concerns on one embodiment of this invention. It is a figure which shows the application example (when using positional information for a DRM client application) of the application in the access control system which concerns on one embodiment of this invention. It is a figure which shows the table which the user terminal 16 hold | maintains. It is a figure which shows the table which the user terminal 16 hold | maintains. It is a figure which shows the application example (when using positional information for a DRM client application) of the application in the access control system which concerns on one embodiment of this invention.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Authentication server, 2 ... User terminal monitoring server, 3 ... Policy server, 4 ... DHCP server, 5 ... Application server, 6 ... VPN termination device, 7 ... Intranet, 8 ... Public network, 9 ... Access switch, 10 ... User Terminal 11 11 Access switch 12 User terminal 13 Access switch 14 User terminal 15 Authentication proxy server 16 User terminal 17 User terminal 18 Entrance / exit management server 19 ... access switch, 20 ... user terminal, 21 ... access switch, 22 ... user terminal, 23 ... entry / exit management terminal, 24 ... entry / exit management terminal, 25 ... entry / exit management terminal, 26 ... directory server, 27 ... application server 28 ... Single sign-on server, 29 ... DRM server, 30 ... Printer, 31 ... Print Server.

Claims (7)

An authentication server that performs user authentication of the user terminal, transmits an authentication token to the user terminal, and transmits an authentication log to the user terminal monitoring server;
A user terminal monitoring server that receives the authentication log and transmits the location information attribute of the authenticated user terminal to the policy server;
A policy server that receives the location information attribute and causes the directory server to set a group attribute based on the location information of the user terminal;
An application server that receives the authentication token from the user terminal and transmits the authentication token to the directory server;
A directory server that sends the group attribute of the user to the application server based on the authentication token;
When the application server receives the group attribute of the user terminal, the application server provides the user terminal with a function based on the group attribute.
An access control system characterized by that. An authentication server that performs user authentication of the user terminal, transmits an authentication token to the user terminal, and transmits an authentication log to the user terminal monitoring server;
A user terminal monitoring server that receives the authentication log and transmits the location information attribute of the authenticated user terminal to the policy server;
A policy server that receives the position information attribute and causes the directory server to set a group attribute having an optimal printer IP address for the position information of the user terminal;
A printer server that receives the authentication token from the user terminal and transmits the authentication token to the directory server;
A directory server that transmits the group attribute of the user to the printer server based on the authentication token;
And the printer server specifies a printer based on the group attribute when the group attribute of the user terminal is received. A single sign-on server that performs user authentication of the user terminal, transmits an authentication token to the user terminal, and transmits an authentication log to the user terminal monitoring server;
A user terminal monitoring server that receives the authentication log and transmits the location information attribute of the authenticated user terminal to the policy server;
A policy server that receives the location information attribute and causes the directory server to set a group attribute based on the location information of the user terminal;
A directory server that returns the group to which the user terminal belongs to the single sign-on server;
An application server that grants access permission based on the application usage token to the user terminal;
And when the user terminal requests the single sign-on server to create an application use token, the single sign-on server receives the group to which the user belongs from the directory server, creates an application use token, An access control system that distributes to a user terminal and gives the user terminal access permission based on an application use token. An authentication server that performs user authentication of the user terminal, transmits an authentication token to the user terminal, and transmits an authentication log to the user terminal monitoring server;
A user terminal monitoring server that receives the authentication log and transmits the location information attribute of the authenticated user terminal to the policy server;
A policy server that receives the location information attribute and causes the directory server to set a group attribute based on the location information of the user terminal;
A directory server that receives the authentication token from the user terminal and returns the group attribute of the user to the user terminal based on the authentication token;
When the application is started on the user terminal, the application transmits an authentication token to the directory server, and the directory server transmits a group attribute of the user to the user terminal based on the authentication token. To provide functionality based on received group attributes,
An access control system characterized by that.   The access control system according to claim 1, wherein the authentication token includes at least a user ID or an IP address of a user terminal that has passed authentication.   The policy server holds a table in which static users and groups are associated with each position information, and the directory server associates dynamic users and groups on the basis of user position information. The access control system according to claim 1, further comprising:   The access control system according to claim 6, wherein the directory server dynamically changes a group to which the user belongs in the table.

Images