JP2008158746A - Authentication processor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To manage authentication object information without performing any complicate operation. <P>SOLUTION: An authentication processor is configured to apply authentication authority for permitting authentication by the authentication processor to authentication object information based on a predetermined rule, and to decide whether the authentication authority is applied to the information to be applied based on the predetermined rule, and to extract the authentication object information to which any authentication authority has not been applied based on the predetermined rule. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an authentication processing device that performs authentication processing based on authentication target information, and more particularly to an authentication processing device that facilitates management of authentication authority of authentication target information.

  In companies that frequently handle confidential information or specific departments within the company, leakage of confidential information can be prevented in advance by applying an entry / exit management system that manages entry / exit of workers who handle confidential information. I am doing so.

  In general, the entrance / exit management system is a user ID (IDentification) incorporated in an IC (Integrated Circuit) card given to the user and biometric information (fingerprint, iris, voiceprint, etc.) to be authenticated information that uniquely identifies the user. The personal computer is used to authenticate personal information by the host computer for entrance / exit management, and when it is verified that the user is a registered valid user, the locked door is unlocked to release confidential information. Management such as permitting entry into the high security level area handled.

In such an entrance / exit management system, since it is necessary to set each entrance / exit permission area for each user, the increase in the number of users and the increase in the number of management areas accompanying an increase in the scale of the system, There was a problem of requiring a large amount of setting work. Therefore, a technique has been devised that allows the user's passage conditions (entrance / exit authority) to be easily set (see, for example, Patent Document 1).
JP-A-6-185249

  However, according to the technique disclosed in Patent Document 1, since the user's traffic conditions are set using a category having a predefined hierarchical structure, the number of settings can be reduced. Since there is no function to check the traffic conditions, for example, when there is an error in the setting of traffic conditions, or when there are traffic condition settings that are no longer necessary, it is necessary to try to correct them by trial and error. There is a problem that complicated management work is forced.

  Accordingly, the present invention has been proposed to solve the above-described problems, and easily performs management such as granting, changing, or deleting authentication authority for authenticated information without performing complicated operations. It is an object of the present invention to provide an authentication processing apparatus that can perform the above processing.

  An authentication processing device according to the present invention is an authentication processing device that executes an authentication process based on authentication target information that uniquely identifies a user, and has authentication authority for permitting the authentication processing device to authenticate the authentication target information. An authentication authority granting means for granting based on a predetermined rule, a determination means for determining whether or not the information to be authenticated has been given an authentication authority based on the predetermined rule, and an authentication authority based on the predetermined rule by the determination means The above-mentioned problem is solved by providing an extraction unit that extracts authentication information that is determined not to be given.

  Further, the authentication processing apparatus of the present invention comprises the grouping means for grouping the authenticated information extracted by the extracting means based on the authentication authority given to the authenticated information, thereby Resolve.

  Further, the authentication processing apparatus of the present invention comprises an authentication authority changing / deleting unit that collectively changes or deletes the authentication authority assigned to the authentication target information grouped by the grouping unit, Solve the above problems.

  In addition, the authentication processing device of the present invention, when there are a plurality of pieces of authentication information grouped in the same group by the grouping means, adds a new rule based on the authentication authority given to the authentication information. The above-mentioned problem is solved by providing rule changing means for changing the predetermined rule so as to be added to the rule.

  The authentication processing apparatus of the present invention solves the above-described problem by including an authentication history information storage unit that stores authentication history information every time authentication information to which the authentication authority is granted is authenticated.

  Further, in the authentication processing device of the present invention, the authentication authority changing / deleting unit is attached to the authentication information corresponding to the authentication history information according to the authentication history information stored by the authentication history information storing unit. The above-mentioned problem is solved by deleting the authentication authority.

  In the authentication processing apparatus of the present invention, the authentication authority changing / deleting unit deletes the authentication authority of the authentication target information when the authentication information to which the same authentication authority is granted does not exist. Solve the problem.

  ADVANTAGE OF THE INVENTION According to this invention, only the to-be-authenticated information to which the authentication authority was provided can be exactly extracted among all the to-be-authenticated information to which the authentication authority was granted, without being based on a predetermined rule. Therefore, for example, authentication authority that has been set due to mistakes or authentication authority that is no longer necessary can be easily deleted or changed without complicated operations, and information to be authenticated can be easily obtained. It is possible to manage.

  In addition, according to the present invention, authentication information can be handled in groups by grouping authentication information individually set and extracted by grouping, so that authentication information given authentication authority can be easily managed. Is possible.

  Further, according to the present invention, it is possible to execute a grouped and individually set authentication authority change or deletion process by a very simple method. Therefore, it is possible to easily manage the authentication authority set individually without being based on a predetermined rule.

  Further, according to the present invention, when there are a plurality of pieces of authentication information grouped in the same group, a new rule based on the authentication authority assigned to the authentication information is added to the predetermined rule, The status of granting authentication authority can be easily reflected in a given rule, making it possible to implement more realistic authentication authority according to changes in system users over time with a simple method. To do.

  Further, according to the present invention, it is possible to easily grasp the possibility of deleting the authentication authority given to the authentication target information by referring to the authentication history information.

  In addition, according to the present invention, grouped individually set authentication authorities can be deleted by deleting the authentication authority based on the possibility of deleting the authentication authority given to the authenticated information by referring to the authentication history information. Can be deleted by a very simple method. Therefore, it is possible to easily manage the authentication authority set individually without being based on a predetermined rule.

  Further, according to the present invention, when the same setting cannot be detected, it is determined that there is a high possibility that the authentication authority is given to the authentication target information by mistake, and the deletion process is executed. Therefore, it is possible to easily manage the authentication authority set individually without being based on a predetermined rule.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  First, the entrance / exit management system 1 is demonstrated as embodiment of this invention using FIG. As shown in FIG. 1, the entrance / exit management system 1 includes an equipment system 10 and an authentication processing device 20.

  The facility system 10 of the entrance / exit management system 1 and the authentication processing device 20 manage the entry / exit of users from a low security level area (low security level area) to a high confidential information area (high security level area). To do.

  The entrance / exit management system 1 may be of any form as long as it manages the entry / exit from the low security level area to the high security level area, for example, the high security level area and the low security level area. The level area is separated by a door or the like, and movement to each area is permitted according to the authentication process.

  The entrance / exit management system 1 performs authentication processing for all users who wish to enter the advanced security level area, authenticates only legitimate users who have been registered in advance and have been granted authentication authority, and enter the advanced security level area. Allow admission to the room. Further, the entrance / exit management system 1 performs an authentication process on a user who wants to leave the high security level area as necessary, and permits the user to leave the high security level area. The low security level region and the high security level region are separated by a door 12 having an electric lock that can be locked and unlocked by an electrical action.

  Specifically, the facility system 10 is a semiconductor (not shown) of a non-contact IC card (Integrated Circuit) 5 owned by the user, for example, by a card reader 11 provided outside the room R1 which is a high security level region. Read information stored in memory. The authentication processing device 20 is an electric lock that is locked by an entrance / exit control unit (not shown) when it is authenticated as a valid user based on a card ID that is information to be authenticated among the information read by the card reader 11. Is allowed to enter the advanced security level area.

  The entrance / exit management system 1 uniquely identifies the IC card 5 among the information stored in the IC card 5 owned by the user when unlocking the locked electric lock by such an authentication process. The card ID, the door number unique to the locked door 12, and information indicating whether to enter or leave the room are transmitted to the authentication processing device 20. The information indicating whether to enter or leave the room may be indicated by, for example, a device ID that uniquely identifies the card reader 11.

  The authentication processing device 20 includes an authentication unit 21, an authority setting unit 22, an input unit 23, a storage unit 24, a search unit 25, a grouping processing unit 26, an authority information change unit 27, and a rule change unit 28. And.

  The authentication unit 21 performs authentication processing based on information read from the IC card 5 by the card reader 11 and permits entry / exit determination. At this time, the authentication unit 21 causes the storage unit 24 to store authentication history information in which an authentication history is recorded every time the authentication process is executed.

  The authority setting unit 22 sets an authentication authority for permitting authentication by the authentication process by the authentication unit 21 for the user registered for use of the entrance / exit management system 1. The authority setting unit 22 uniquely identifies a user such as a card ID of an IC card owned by the user based on a predetermined rule (for example, a rule determined according to the user's affiliation, job title, and other various information). An authentication authority is given to the authentication information and set in the storage unit 24.

  The input unit 23 grants the authentication authority to the card ID individually and sets it in the storage unit 24 based on the instruction of the system administrator, or changes the authentication authority once set, Requests such as deletion can be entered. The setting of the individual authentication authority via the input unit 23 is executed by the system administrator after the authentication authority based on a predetermined rule is set. That is, the latest (current) authentication authority information is a mixture of the relationship between the card ID and the authentication authority set based on a predetermined rule and the relationship between the individually set card ID and the authentication authority. .

  The storage unit 24 stores various information and applications used for authentication processing in the authentication processing device 20. The storage unit 24 is, for example, a group defined as a set of physical doors 12 that are targets of user information related to users registered for the purpose of using the entrance / exit management system 1 and authentication authority granted to the registered users. Group information related to the above, rule information defining a predetermined rule used when the authority setting unit 22 gives the authentication authority, and the like are stored.

  Specifically, as shown in FIG. 2, the user information is stored as a table in which a card ID that is authentication information for uniquely specifying the IC card 5 owned by the user and a user name are associated with each other. In addition, as shown in FIG. 3, the group information includes a table in which a group ID that uniquely identifies a group is associated with a group name (FIG. 3A), and a table in which a door number is associated with a door name. (FIG. 3B), which is stored as a table in which group IDs and door numbers are associated (FIG. 3C). As shown in FIG. 3C, each group is defined as a set of door numbers. Further, as shown in FIG. 4, the rule information includes a table (FIG. 4 (a)) that associates rule IDs that uniquely identify a rule with rule names, and a table that associates rule IDs with group IDs ( FIG. 4B) is stored. As shown in FIG. 4B, each rule is defined by a group that is a set of door numbers.

  The user information, group information, and rule information are information registered in advance in the storage unit 24 before operating the room entry / exit management system.

  The storage unit 24 authenticates authentication authority information (entrance / exit authority information set by the authority setting unit 22 by granting authentication authority to the information to be authenticated based on, for example, a predetermined rule as shown in FIG. ) Is memorized. The authentication authority information stored in the storage unit 24 is basically information in which a card ID and a rule ID are associated with each other. From the relationship between the rule ID and the group ID as shown in FIG. As shown in FIG. 5, it is set as a table in which card IDs, rule IDs, and group IDs are associated with each other.

  The search unit 25 individually receives the card IDs to which the authentication authority is given through the input unit 23 without being based on the predetermined rules, and the authentication authorities that have been given individually through the input unit 23 without being based on the predetermined rules. The card ID changed or deleted is searched and extracted.

  The grouping processing unit 26 authenticates the card ID that has been given, changed, or deleted individually without authorization based on the predetermined rule searched and extracted by the search unit 25. The grouping process is executed based on the above.

  The authority information changing unit 27 collectively changes or deletes the authentication authority given to the card IDs grouped by the grouping processing unit 26 by changing the authentication authority information stored in the storage unit 24. To do.

  For example, the authority information changing unit 27 changes the authentication authority information according to the authentication history information stored every time the authentication unit 21 executes the authentication process, and changes the authentication authority of the card ID corresponding to the authentication history information. delete. Further, the authority information changing unit 27 is stored in the storage unit 24 when a different card ID that is given the same authentication authority as the authentication authority assigned to the grouped card IDs does not exist in the same group. The authentication authority information is changed, and the authentication authority assigned to the card ID is deleted.

  When there are a plurality of card IDs grouped in the same group by the grouping processing unit 26, the rule changing unit 28 stores a new rule based on the authentication authority assigned to the card ID as a table in the storage unit 24. Change to add to a given rule.

[Processing of search unit 25]
Next, a process for searching for and extracting only the card IDs that have been given or deleted individually without being based on the predetermined rules executed by the search unit 25 will be described using the flowchart shown in FIG. To do.

  In step S1, the search unit 25 uses a certain card from the authentication authority information set by granting the authentication authority to the card ID (rule base) based on a predetermined rule stored in the storage unit 24, and the group information. The door number of the door 12 whose ID is permitted for authentication is obtained. Specifically, the search unit 25 uses the authentication authority information shown in FIG. 5 stored in the storage unit 24 and the rule information shown in FIG. By repeating this operation, the correspondence between the card ID and the door number as shown in FIG. 7 based on the authentication authority information in FIG. 5 is formed.

  For example, the search unit 25 selects the card ID “0001” in the first line of the authentication authority information shown in FIG. 5 as a certain card ID, and the group ID is “GG001”. The door number “1” is obtained using the rule information shown in FIG. Further, as shown in FIG. 3C, since the group ID “GG001” also corresponds to the door number “2”, the card ID “0001” and the door number “2” shown in the second row of FIG. Is also required. Similarly, as shown in FIG. 7, the correspondence relationship between the card ID “0001” and the door numbers “3” and “4” is also obtained.

  In step S2, the search unit 25 adds the relationship between the card ID and the door number obtained in step S1 to a predetermined rule stored in the storage unit 24 as shown in FIG. Is compared with the latest (current) authentication authority information indicating the relationship between the card ID and the door number, and it is determined whether or not the corresponding authentication authority information exists. The search unit 25 advances the process to step S3 when the corresponding authentication authority information exists, and advances the process to step S4 when the corresponding authentication authority information does not exist.

  In addition to the predetermined rule, when the authentication authority is deleted individually, the latest authentication authority information indicating the relationship between the card ID and the door number is as shown in FIG. The crosses shown in FIG. 11 are described for convenience so as to be easily understood visually, and are not actually described. In addition, since setting of individual authentication authority is freely performed by the system administrator, granting and deletion of authentication authority may be performed in a mixed manner.

  In step S3, the search unit 25 duplicates the latest authentication authority information as shown in FIG. 8 prepared in the storage unit 24 as a work table when the corresponding authentication authority information exists, as shown in FIG. A flag is set in the rule setting flag column of the table. This makes it possible to identify a card ID for which authentication authority is set based on a predetermined rule.

  In step S4, when the corresponding authentication authority information does not exist, the search unit 25 extracts the relationship between the card ID and the door number obtained in step S1 without setting a flag in the work table, and lists the individual settings. Is added to a table as shown in FIG. Thereby, the card ID for which the authentication authority is set can be identified based on the individual setting.

  In addition, when the latest authentication authority information is a table as shown in FIG. 11, a table as shown in FIG. 12 is separately prepared as an individual setting list, and the relationship between the card ID and the door number is added. To go. Thereby, the card ID for which the authentication authority is set can be identified based on the individual setting.

  In step S5, the search unit 25 determines whether or not the processing from step S2 to step S4 has been completed for all door numbers corresponding to the same card ID. The search unit 25 proceeds to step S7 when the processes for all the door numbers are completed, and proceeds to step S6 when it is not completed and proceeds to the next door number.

  In step S7, the search unit 25 performs the search processing from step S2 to step S7 for all card IDs for which authentication authority is set based on a predetermined rule, that is, for all card IDs shown in FIG. Determine whether has been executed. If there is a card ID for which the search process has not been executed, the search unit 25 proceeds to step S8 and proceeds to the next card ID, while the search process is executed for all card IDs. If so, the process ends.

  In this way, the search unit 25 can accurately extract only the card IDs to which the authentication authority has been granted out of all the card IDs to which the authentication authority has been granted without being based on a predetermined rule. Therefore, for example, it is possible to easily execute deletion or change of authentication authority that has been set due to mistakes or authentication authority that is no longer necessary without complicated operations, and a card ID that has been granted authentication authority can be easily obtained. Can be managed.

[Processing of Grouping Processing Unit 26]
Next, the grouping process executed by the grouping processing unit 26 will be described using the flowchart shown in FIG.

  In step S <b> 11, the grouping processing unit 26 sorts the individually set list of card IDs, to which the authentication authority is individually set, extracted by the search unit 25, by card ID and door number. For example, the individually set list as shown in FIG. 10 is sorted as shown in FIG.

  In step S12, the grouping processing unit 26 determines whether there is a card ID for which the group number is not set in the individually set list. The grouping processing unit 26 advances the process to step S13 when there is a card ID with no group number set, and ends the process when there is no card ID with a group number not set.

  In step S13, the grouping processing unit 26 sets the group number to the door number of the first card ID for which the group number is not set in the individually set list sorted in step S11. The group number at this time is a temporary number.

  For example, when sorting is performed as shown in FIG. 14A, the grouping processing unit 26 sets “1” as the temporary group number as shown in FIG. 14B for the first card ID “0001”. 1 ”is set.

  In step S14, the grouping processing unit 26 refers to the door number of the card ID in which the group number is not set in the individual setting list, and determines whether the door number is the same as the door number set in step S13. Judging. When the door numbers are the same, the grouping processing unit 26 proceeds to step S15. When the door numbers are different, the grouping processing unit 26 proceeds to step S16.

  In step S15, the grouping processing unit 26 sets the same group number as the group number set in step S13 for the subsequent card ID in which the group number is not set in response to the same door number.

  For example, as shown in FIG. 14B, when the temporary group number “1” is set for the card ID “0001”, the subsequent card ID “0002” is the same door as the card ID “0001”. Since it is associated with the number “6”, a temporary group number “1” is set.

  In step S <b> 16, the grouping processing unit 26 determines whether or not there is a next card ID in which the group number is not set in the individual setting list. When there is a card ID for which the group number is not set, the grouping processing unit 26 proceeds to step S17 and proceeds to processing for the next card ID, while a card ID for which the group number is not set is set. If it does not exist, the process proceeds to step S18 and returns to the top card ID in the individually set list.

  Thereafter, when the same processing is sequentially repeated for the individual setting list, the temporary group number as shown in FIG. 14C is displayed in the individual setting list sorted as shown in FIG. Will be set.

(Processing when multiple door numbers are assigned to one card ID)
In the individual setting list shown in FIG. 10 described above, one door number is assigned to one card ID. In the individually set list shown in FIG. 15, a plurality of different door numbers are assigned to one card ID. In such a case, when the grouping processing unit 26 sorts by card ID and door number, the result is as shown in FIG.

  In such a case, a temporary group number is set so that the same card ID is in the same group as shown in FIG. As shown in FIG. 16B, the card ID “0001” is associated with different door numbers “5” and “6”, but the same temporary group number “1” is set.

  Next, since the door numbers “5” and “6” are in the same group, the card ID “0002” associated with the door numbers “5” and “6” is also shown in FIG. As shown, the same temporary group number “1” is set.

  Thereafter, when the same processing is repeated sequentially for the individual setting list, the temporary group number as shown in FIG. 16C is displayed in the individual setting list sorted as shown in FIG. Will be set.

  Also, in the individual setting list shown in FIG. 12 as an example of deleting the authentication authority described above, since a plurality of different door numbers are assigned to one card ID, as shown in FIG. The same temporary number “3” is set for “3” and “4”, and the same door number “4” is set for the door numbers “1” and “2”.

  By such grouping by the grouping processing unit 26, the card IDs that are individually set with the authentication authority and extracted by the search unit 25 can be handled in units of groups. Can be managed.

[Processing of authority information changing unit 27]
(Authentication authority deletion process)
The authority information changing unit 27 collectively changes or deletes the authentication authority given to the card IDs grouped by the grouping processing unit 26 by changing the authentication authority information stored in the storage unit 24. To do. Specifically, authentication authority changes / deletions are dealt with by changing / deleting the group as a group when the number of card IDs belonging to the group is small, indicating that there is a high possibility of incorrect settings. It is.

  For example, as shown in FIG. 14C, when grouping is performed by the processing of the grouping processing unit 26, the authority information changing unit 27 counts the number of card IDs for each grouped group in FIG. A table as shown is stored in the storage unit 24. As shown in FIG. 18, the number of card IDs associated with the group number “1” is 2, and the number of card IDs associated with the group number “2” is 1. In such a case, it is assumed that the card ID associated with the group number “2”, that is, the card ID “0004” shown in FIG. This is subject to authentication authority deletion processing by the changing unit 27.

  Further, for example, when grouped as shown in FIG. 16C, the authority information changing unit 27 stores a table as shown in FIG. 19 in which the number of card IDs for each grouped group is tabulated. 24. In this case as well, the card ID “0004” shown in FIG. 16C is subject to authentication authority deletion processing by the authority information changing unit 27 on the assumption that there is a very high possibility that it has been set in error.

  The number of card IDs that are subject to deletion processing is determined in consideration of the total number of authentication authorities, etc., and there are not only one but also more than that as described above. Even in this case, it will be subject to deletion processing. If there is only one card ID, it may be automatically deleted, but if it is less than the number of authorizations given, there is a suspicion of misconfiguration. As a change process target, the process shifts to a process that asks the system administrator.

  As described above, the authority information changing unit 27 executes the process of changing or deleting individually set authentication authority extracted by the search unit 25 and grouped by the grouping processing unit 26 by a very simple method. Can do. Therefore, it is possible to easily manage the authentication authority set individually without being based on a predetermined rule.

(Processing based on authentication history information)
As described above, the authentication history information is stored in the storage unit 24 every time the authentication process by the authentication unit 21 is executed. FIG. 20 shows an example of authentication history information. As shown in FIG. 20, in the authentication history information, for each card ID to which authentication authority is given, the door number, the number of uses indicating the number of authentications, and the last use date and time indicating the most recently authenticated date and time information are included. It is stored in association. The authentication unit 21 updates the use count and the last use date and time of the authentication history information corresponding to the read card ID every time the authentication process using the IC card 5 is executed.

  The authority information changing unit 27 uses the authentication history information stored in the storage unit 24 and updated as needed according to the authentication process, and changes the authentication authority information to change the authentication authority of the card ID corresponding to the authentication history information. Is deleted. Specifically, the authority information changing unit 27 determines that the authentication authority given to the card ID is, for example, when the number of uses is less than a predetermined number or when the last use date is before a predetermined period. It is deleted because it is highly likely that it is unnecessary or misconfigured.

  For example, since the number of uses corresponding to the authentication authority information of the card ID “0002” and the door number “6” on the 10th line of the authentication history information shown in FIG. 20 is “0”, the authentication authority is unnecessary or misconfigured. It is expected that Therefore, the authority information changing unit 27 performs the deletion process with the authentication authority for the door number “6” set in the card ID “0002” as the deletion target.

  Further, for example, the last use date and time corresponding to the authentication authority information of the card ID “0001” and the door number “6” in the fifth line of the authentication history information shown in FIG. 20 is “2005/12/22 /. ing. Assuming that the current period is “2006/12/25 /...” And the predetermined period is 10 months, it can be seen that a predetermined period or more has elapsed since the last authentication process. Accordingly, it is expected that the authentication authority is unnecessary or has been set incorrectly, and the authority information changing unit 27 performs the deletion process with the authentication authority for the door number “6” set in the card ID “0001” as the deletion target. do.

  In this way, the authority information changing unit 27 can easily grasp the possibility of deletion of the authentication authority given to the card ID by referring to the authentication history information. Furthermore, the authority information changing unit 27 deletes the authentication authority based on the possibility of deletion, thereby deleting the individually set authentication authority extracted by the search unit 25 and grouped by the grouping processing unit 26. It can be executed by a simple method. Therefore, it is possible to easily manage the authentication authority set individually without being based on a predetermined rule.

(Same setting detection)
Further, the authority information changing unit 27 is stored in the storage unit 24 when a different card ID that is given the same authentication authority as the authentication authority assigned to the grouped card IDs does not exist in the same group. The authentication authority information is changed, and the authentication authority assigned to the card ID is deleted.

  For example, the authority information changing unit 27 determines one target card ID in the individual setting list as shown in FIG. 14C grouped by the grouping processing unit 26 and is associated with the group. Extract the number. The authority information changing unit 27 refers to the individually set list and searches for different card IDs given the same group number.

  At this time, the authority information changing unit 27 terminates the search process if there is a corresponding card ID and does not delete anything. On the other hand, if there is no corresponding card ID, the authority information changing unit 27 determines that there is no identical setting. The authentication authority given to this card ID is deleted.

  If the card ID “0001” is a search target in FIG. 14C, the authority information changing unit 27 ends the process when the card ID “0002” is searched. Therefore, the card ID “0004” is not searched. The authority information changing unit 27 maintains the authentication authority of the card ID “0001” as it is without being deleted by detecting the same setting.

  On the other hand, if the card ID “0004” is a search target in FIG. 14C, the authority information changing unit 27 cannot detect the same setting, so the authentication authority assigned to the card ID “0004” is changed. Will be deleted.

  As described above, when the same setting cannot be detected, the authority information changing unit 27 determines that there is a high possibility that the authentication authority is given to the card ID by mistake, and executes the deletion process. Therefore, it is possible to easily manage the authentication authority set individually without being based on a predetermined rule.

[Process of Rule Changing Unit 28]
When there are a plurality of card IDs grouped in the same group by the grouping processing unit 26, the rule changing unit 28 stores a new rule based on the authentication authority assigned to the card ID as a table in the storage unit 24. Change to add to a given rule.

  For example, the rule changing unit 28 is defined so that the group number (temporary group number) “1” shown in FIG. 14C includes a plurality of card IDs such as card IDs “0001” and “0002”. Therefore, all the door numbers included in the group number “1” are defined as a new group as they are, and added to the predetermined rule as a new rule.

  For example, using FIG. 18, the rule changing unit 28 recognizes that there are a plurality of card IDs classified into the group number “1”, and uses the door number “6” as a component from FIG. 14C. A group ID “GG004” is newly added as an additional group. FIG. 21A is a diagram in which group IDs and group names of newly added additional groups are associated with each other, and is added to FIG. 3A described above. FIG. 21B is a diagram in which a newly added group ID is associated with a door number, and is added to FIG. 3C described above.

  Then, the rule changing unit 28 newly adds a rule ID “R004” having the group ID “GG004” as a constituent element. FIG. 22 (a) associates the rule ID and rule name of a newly added rule, and is added to FIG. 4 (a) described above. FIG. 22B is a diagram in which a newly added rule ID and group ID are associated with each other, and is added to the above-described FIG. 4B.

  Further, for example, the rule changing unit 28 recognizes that there are a plurality of card IDs classified into the group number “1” using FIG. 19, and the door numbers “5”, “6” from FIG. A group ID “GG005” having “” as a constituent element is newly added as an additional group. FIG. 23A associates the group ID and group name of the newly added additional group, and is added to FIG. 3A described above. FIG. 23B is a diagram in which a newly added group ID and a door number are associated with each other, and is added to the above-described FIG. 3C.

  Then, the rule changing unit 28 newly adds a rule ID “R005” having the group ID “GG005” as a constituent element. FIG. 24A associates the rule ID and rule name of the newly added rule, and is added to FIG. 4A described above. FIG. 24B is a diagram in which a newly added rule ID and group ID are associated with each other, and is added to the above-described FIG. 4B.

  In this way, the rule changing unit 28 determines a new rule based on the authentication authority given to the card ID as a predetermined rule when there are a plurality of card IDs grouped into the same group by the grouping processing unit 26. By adding to, it is possible to easily reflect the current authorization authority grant status in a given rule, so it is a simpler method for granting more realistic authentication authority according to changes in system users over time Can be realized.

  The above-described embodiment is an example of the present invention. For this reason, the present invention is not limited to the above-described embodiment, and various modifications can be made depending on the design and the like as long as the technical idea according to the present invention is not deviated from this embodiment. Of course, it is possible to change.

It is a figure for demonstrating the structure of the entrance / exit management system shown as embodiment of this invention. It is the figure which showed an example of card information. It is the figure which showed an example of group information. It is a figure showing an example of rule information. It is the figure which showed an example which applied the predetermined rule to card ID. It is a flowchart for demonstrating the processing operation of a search part. It is the figure which showed the relationship between card ID set based on the predetermined rule, and the door number by which authentication is permitted. FIG. 7 is a diagram in which a relationship between the individually set card ID and the door number permitted for authentication is added. It is the figure which showed the work table. It is the figure which showed the relationship between the card ID set individually and the door number permitted for authentication. FIG. 8 is a diagram in which the relationship between the individually set card ID and the permitted door number is deleted from FIG. 7. It is the figure which showed the relationship between the card ID set individually and the door number permitted for authentication. It is a flowchart for demonstrating the processing operation of a grouping process part. It is the figure which showed the process of the grouping process part. It is the figure which showed the relationship between the card ID set individually and the door number permitted for authentication. It is the figure which showed the process of the grouping process part. It is the figure which showed the relationship between the card ID set individually, the door number by which authentication is permitted, and a group. It is the figure which showed the result of totaling the card ID number for every group. It is the figure which showed the result of totaling the card ID number for every group. It is the figure which showed the authentication history information for every card ID. It is the figure which showed the group added. It is the figure which showed the rule added. It is the figure which showed the group added. It is the figure which showed the rule added.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Entrance / exit management system 5 IC card 20 Authentication processing apparatus 21 Authentication part 22 Authority setting part 23 Input part 24 Storage part 25 Search part 26 Grouping process part 27 Authority information change part 28 Rule change part

Claims (7)

In an authentication processing device that executes authentication processing based on authenticated information that uniquely identifies a user,
Authentication authority granting means for granting authentication authority for permitting authentication in the authentication processing apparatus to the authentication information based on a predetermined rule;
A determination unit that determines whether the authentication information is granted authentication authority based on the predetermined rule;
An authentication processing apparatus comprising: extraction means for extracting information to be authenticated that has been determined by the determination means that no authentication authority has been granted based on the predetermined rule. The authentication processing apparatus according to claim 1, further comprising grouping means for grouping the authentication information extracted by the extraction means based on an authentication authority given to the authentication information. The authentication processing apparatus according to claim 2, further comprising: an authentication authority changing / deleting unit that collectively changes or deletes the authentication authority given to the authentication target information grouped by the grouping unit. . The predetermined rule to add a new rule based on the authentication authority given to the authenticated information to the predetermined rule when there are a plurality of authenticated information grouped into the same group by the grouping means The authentication processing device according to claim 2, further comprising: a rule changing unit that changes 5. The authentication history information storage unit that stores authentication history information each time authentication information to which the authentication authority is granted is authenticated. 5. Authentication processing device. The authentication authority changing / deleting means deletes the authentication authority given to the authentication information corresponding to the authentication history information according to the authentication history information stored by the authentication history information storage means. The authentication processing device according to claim 5. The authentication processing apparatus according to claim 3, wherein the authentication authority changing / deleting section deletes the authentication authority of the authentication information when there is no authentication information to which the same authentication authority is given.

Images