JP2009086811A - Information output permission device and system, and authentication method related to information bringing-out permission - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To make it unnecessary to provide any authentication management ledger or authentication management medium, and to achieve reinforcement in respect of a security aspect. <P>SOLUTION: An application terminal 14 having a portable external storage medium makes the electronic approval application of information output permission application data related to a bringing-out date or a bringing-out time zone (S201), and a third person who has browsed this by a work flow or the like operates an approval terminal 15 to perform approval processing (S202). An information output permission device 10 connected through a communication network to the application terminal 14 and an approval terminal 15 automatically outputs user account information which is made valid only in the bringing-out permission time zone to the application terminal 14 about a bringing-out subject whose approval processing has been performed by the approval terminal 15 (S203, S204). Then, when a log-in request based on the user account information previously output from the application terminal 14 is received, an information output to a portable external storage medium is made valid in a time zone equivalent to output permission time zone information (S205 to S208). <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an information output permission apparatus and system for performing take-out control from a client in consideration of information leakage to the outside due to theft or loss of media, and an authentication method relating to information take-out permission.

  According to the Personal Information Protection Law enforced in 2005, measures against information leakage have become an important issue related to the trust of organizations for companies. As a countermeasure, important information that should not be leaked outside the company is basically prohibited to be stored on removable media (portable external storage media) or portable PCs (Personal Computer) and taken outside the company. In the case where it is unavoidably necessary to take outside, a system for forcing encryption has been proposed (for example, see Patent Documents 1 and 2).

  Further, a system related to security policy distribution for distributing and updating security policies including access to a communication network such as an intranet, file access on a PC, and file export control to users in an organization has been proposed (for example, Furthermore, an information leakage prevention method is proposed that can be edited so that the confidential information that is taken out does not leak when it is necessary to take out and edit the confidential information in the organization. (For example, refer to Patent Document 4).

Japanese Patent Laying-Open No. 2006-343887 (paragraphs “0008” to “0016”, FIG. 1) JP 2007-188445 (paragraphs “0024” to “0040”, FIG. 1) Japanese Patent Laying-Open No. 2006-243791 (paragraphs “0008” to “0020”, FIG. 1) JP 2007-11511 (paragraph “0005”, FIG. 11)

  According to the conventional information leakage prevention measures described above, in order to strengthen security measures, information takeout control from the client is performed in consideration of information leakage to the outside due to theft or loss of media. Here, “information takeout control” means that, for example, authentication by the server is performed based on login account information such as a user ID or password issued from the administrator in response to an information takeout request from the applicant, and login is permitted. In this case, it means permission to take out the information, and prohibiting to take out the information if login fails.

  In the information take-out control described above, the login account information is conventionally manually performed using an authentication management ledger or a storage medium, so that the management burden on the administrator is large, and even if a third party checks it, Because it was not digitized, the security strength was weak.

  The present invention has been made in order to solve the above-described problems, and does not require an authentication management ledger or an authentication management medium, and is an information output permitting apparatus and system and security system strengthened in terms of security. The purpose is to provide an authentication method for permission to take out information.

  The information output permission system of the present invention is configured by connecting an application terminal having a portable external storage medium, an approval terminal, and an information output permission device via a communication network. With the configuration described above, the applicant operates the application terminal to apply for electronic approval of the information output permission application data regarding the take-out date and time and the take-out time zone, and a third party who refers to this through a workflow etc. operates the approval terminal. Perform approval process. The information output permission device automatically pays out user account information that is valid only during the time period described above to the application terminal for a take-out item that has been approved by the approval terminal. At this time, the information output permission device calculates output permission time zone information from the applicant's desired information output date and time, and generates user account information including the output permission time zone information.

  When the information output permission device receives a login request based on the user account information previously issued from the application terminal, the information output permission device validates the information output to the portable external storage medium in the time period corresponding to the output permission time period information. To. In addition, the information output permission device can grasp unauthorized take-out by managing the approval by a third party and the purpose of take-out by the applicant based on the update history of the information output permission application data described above, and avoid unauthorized authentication. Can do.

  According to the present invention, it is possible to provide an information output permission apparatus and system and an authentication method related to information take-out permission, which eliminates the need for an authentication management ledger and an authentication management medium and is enhanced in terms of security.

Embodiments of the present invention will be described below with reference to the drawings.
FIG. 1 is a diagram showing an example of a system configuration of an information output permission system according to an embodiment of the present invention. As shown in FIG. 1, an information output permission system 1 according to an embodiment of the present invention is an application terminal having an information output permission device 10 and a portable external storage medium 140 such as a USB (Universal Serial Bus) memory. An application PC 14 and an approval PC 15 as an approval terminal are connected and configured via a communication network 13 including an IP (Internet Protocol) network and an in-house LAN (Local Area Network).

  In the system configuration described above, the application PC 14 receives an operation input by an applicant who is an in-house user, generates information output permission application data including the desired date and time for information output to the portable external storage medium 140, and uses a workflow to create a communication network. 13 to the approval PC 15 and the information output permission device 10 via The approval PC 15 performs an approval process when a third person such as a senior manager browses and examines the information output permission application data transmitted from the application PC 14.

  The information output permission device 10 calculates output permission time zone information from the desired date and time of information output for the target file that has been approved by the approval PC 15, and generates user account information including the output permission time zone information and applies When the login request based on the user account information received from the application PC 14 is received, the information is output to the portable external storage medium 140 such as a USB memory only in the time zone corresponding to the output permission time zone. Enable Details will be described later.

  The information output permission device 10 stores an application DB 11 in which information output permission application data input by an applicant is stored, user account information to be paid out for a target file approved by the approval PC 15, and the like. And a take-out permission DB 20 (second storage means) in which a take-out permission file list which is a set of file names permitted to output information is registered. The application DB 11 and the user DB (first storage means) are updated at the regular update timing or when an event occurs, and are also referred to as a work history. Details will be described later.

  FIG. 2 is a diagram showing a schematic operation sequence of the information output permission system. It is an operation | movement sequence diagram of the information output permission system 1 shown in FIG. 1, and the flow of schematic operation | movement between the application PC14, the approval PC15, and the information output permission apparatus 10 is shown here. In FIG. 2, first, the application PC 14 generates information output permission application data including the desired date and time of information output to the portable external storage medium 140 by the applicant's operation input, and uses the information output permission application data as a workflow. And the like to the approval PC 15 and the information output permission device 10 (step S201: take-out application).

  The information output permission application data includes information such as application date, applicant name, output purpose, output medium format, output format (encryption), distribution destination, etc. in addition to the information output request date and time.

  In response to this, the affiliation superior refers to the information output permission application data received by operating the approval PC 15, and performs the approval process for the information output of the target file (step S202: take-out application permission). At this time, the approver DB 11 is updated by adding the approver information to the information output permission application data.

  Further, the information output permission device 10 calculates output permission time zone information from the desired file output date and time for the target file subjected to the approval process, and generates user account information including the output permission time zone information (step S203). : User account payout) and transmitted to the application terminal 14 (step S204: user account notification). At the same time, the information output permission device 10 generates a file for each user and stores it in the user DB 12 in order to manage the generated user account information.

  On the other hand, when the information output permission device 10 receives a login request based on the user account information previously issued from the application terminal 14 (step S205: login), a time corresponding to the output permission time zone information generated earlier. The user account authentication for enabling the file output to the portable external storage medium 140 is performed only for the band (step S206: user account authentication), and the authentication result is transmitted to the application PC 14 that has received the information output permission application input (step S206). S207: Authentication result output).

  Then, the user (application terminal 14) permitted to take out the information by the user account authentication outputs the information of the target file to the portable external storage medium 140 (step S208: information output).

  Although not shown in the sequence diagram of FIG. 2, the information output permission device 10 further displays the invalid user account information when the next day after the scheduled output date (the output permission time zone has passed). It is deleted and reflected in the application DB 11 and the user DB 12.

  According to the information output permission system 1 according to the above-described embodiment of the present invention, (1) the application PC 14 applies an electronic approval application for information output permission application data including the desired date and time of information output to the portable external storage medium 140. (2) A third person who refers to this through a workflow or the like operates the approval PC 15 to perform an approval process. (3) The information output permission device 10 receives information output permission application data transmitted from the application PC 14. Based on the information output desired date and time, output permission time zone information is calculated, and user account information including this output permission time zone information is automatically paid out. (4) The information output permission device 10 is paid out from the application PC 14 first. When the login request based on the user account information received is received, the portable external storage medium 140 is used in the time zone corresponding to the output permission time zone information described above. By enabling the file output, authentication management ledger and authentication management media are not required for paying out user account information, and security time can be enhanced by adding permission time zone information to information output. it can.

  In addition, according to the information output permission system 1 according to the embodiment of the present invention, by referring to the update history of the information output permission application data described above, the approval by the third party and the purpose of taking out by the applicant are managed. Therefore, it is possible to grasp fraudulent removal and avoid fraud authentication.

  FIG. 3 is a diagram in which the internal configuration of the information output permission device is expanded. As shown in FIG. 3, the information output permission device 10 according to the embodiment of the present invention functionally includes an application input data acquisition unit 101, an application input data management unit 102, and an approval input data acquisition unit 103. A DB (Data Base) reference / update control unit 104, a time monitoring unit 105, an account information generation unit 106, an account information transmission unit 107, an account information input acquisition unit 108, an information output authentication unit 109, The authentication result transmission unit 110 and the broadcast information transmission unit 111 are divided into blocks and configured.

  The application input data acquisition unit 101 (application input data acquisition means) has a function of taking in information output permission application data generated by the applicant operating the application PC 14 and supplying it to the application input data management unit 102. The application input data management unit 102 (application input data management means) stores the acquired information output permission application data in the application DB 11, and transmits the acquired information output permission application data to the approval PC 15 to request electronic approval. It has the function to perform.

  An example of the data format of the information output permission application data stored in the application DB 11 is shown in FIG. 4, and details thereof will be described later.

  The approval input data acquisition unit 103 has a function of taking in data such as an approver and an approval date inputted after the approval process of the information output by the approval PC 15 and reflecting the contents in the application DB 11 via the DB reference / update control unit 104. Have.

  Further, the DB reference / update control unit 104 refers to the information output permission application data and the user account information stored in the application DB 11 or the user DB 12 described later, respectively, a periodic update timing, an approval process, etc. Has a function of performing update processing such as addition and deletion when an event occurs. Here, the “event” means the information output permission application data input, the information output permission application data registration, the approval processing by the approval PC 15, the user account information transmission, the output date in the output permission time zone, the output The updated data may be referred to irregularly as a work history.

  For this reason, the DB reference / update control unit 104 determines that “at least one event among the approval process by the approval terminal, the transmission of the user account information, the recognition of the output date in the output permission time period, and the recognition of the next day of the output date”. It functions as “information updating means for updating the information output permission application data stored in the first storage means upon occurrence”.

The time monitoring unit 105 measures the time by a built-in timer and monitors the information output request date and time included in the information output permission application data, and also generates the above-described regular update timing.
Further, the account information generation unit 106 calculates output permission time zone information from the desired information output date and time based on the information output permission application data stored in the application DB 11, and generates user account information including the output permission time zone information. Thus, the account information transmitting unit 107 has a function of supplying the account information. The account information transmission unit 107 has a function of transmitting the user account information generated by the account information generation unit 106 to the application PC 14.

  For this reason, the account information generation unit 106 and the account information transmission unit 107 cooperate to generate “information output permission application data including the desired date and time of information output to the external storage medium transmitted from the application terminal (application PC 14)”. Based on the information output desired date and time, the output permission time zone information is calculated, and user account information including the output permission time zone information is generated and transmitted to the application terminal.

  On the other hand, the account information input acquisition unit 108 has a function of taking in user account information input when the application PC 14 logs in to the information output permission device 10 and supplying the user account information to the information output authentication unit 109.

  In addition, the information output authentication unit 109 compares the user account information stored in the user DB 12 with the input user account information, and in the time zone corresponding to the output permission time zone information indicated by the input user account information. As long as it has a function of enabling file output to the portable external storage medium 140 of the application PC 14, the authentication result is transmitted to the application PC 14 via the authentication result transmission unit 110.

  For this reason, the information output authentication unit 109 and the authentication result transmission unit 110 cooperate to “receive a login request based on the user account information from the application terminal and execute the external request in a time zone corresponding to the output permission time zone information. It functions as “information output authentication means for enabling file output to a storage medium”.

  The information output authentication unit 109 controls the notification information transmission unit 111 in addition to prohibiting information output to the portable external storage medium 140 when, for example, the first login request is made beyond the output permission time period. By referring to the update history stored in the application DB 11, if the first login fails, a warning will be issued to alert the applicant. When the third login failure occurs, notification is made such as posting on the applicant's WWW (World Wide Web), and if the login failure is attempted more than once, the source is transferred to the administrator.

  Further, the information output authentication unit 109 is registered in advance in the export file name included in the information output permission application data (output contents detailed memo) stored in the application DB 11 and the export permission DB 20 (second storage means). The file name for which information output is permitted is collated, and mail is transmitted to the manager terminal (not shown) via the notification information transmitting unit 111. The collation described above is performed irregularly based on an event (collation instruction) issued by the administrator operating the administrator terminal.

  For this reason, the information output authentication unit 109 and the notification information transmission unit 111 work together to output information to the portable external storage medium when a login request is received from the application terminal beyond the output permission time zone. In addition to prohibiting, and according to the updated information output permission application data stored in the first storage means, the information output authentication means for sending a warning e-mail to the application terminal or the approval terminal " , “Verify the file name stored in the second storage means and the file name included in the information output permission application data stored in the first storage means irregularly, It also functions as “information output authentication means for notifying the administrator when an external file is detected”.

  4A and 4B are diagrams illustrating an example of the data structure of the application DB. As shown in FIG. 4A and FIG. 4B, the application DB 11 includes “company code”, “application number”, “status classification”, “application date”, “applicant”, “applicant mail ID”, “ "Approval date", "Approver", "Output permission notification date", "Login setting completion notification date", "Login completion date", "Output purpose category", "Output purpose memo", "Output content detail memo" , “Output media format”, “Output media format memo”, “Encryption format category”, “Export category”, “Export memo”, “Distribution category”, “Distribution memo”, “Discard category”, “Output” Consists of data items of “Application Date”, “Output Application Time (minutes)”, “Output PC Asset Number”, “Group ID”, “User ID”, “Update Date / Time”, and “Updater”. .

  Among these, the “status classification” shown in FIG. 4A is managed before approval (1), after approval (2), notified (3), login permission set (4), and deleted (5). “Output purpose category” is customer delivery / submission (0), demo materials (1), meeting materials (2), and others (3). “Output media format” is CD / DVD (0), The application PC 14 is selected and input from the USB memory (1), FD (2), and others (3).

  In addition, in the “encryption format classification” shown in FIG. 4B, the applicant operates the application PC 14 to select and input from encryption (0) or non-encryption (1). "Export category" includes specific export status such as file names, etc., and is not taken out (0) (within the same base) or taken out (1) (including mail and Takkyubin (registered trademark)) The “Distribution Category” includes a description of the specific distribution destination, and is not distributed outside the company or distributed outside the company. The “Discard Category” distributes the information for each medium and does not need to be taken home and discarded ( 0), the information is deleted on the spot and the medium is brought back (1), the medium is brought back with the information held (2), and the “encryption format classification” is encrypted (0), encrypted No (1), the applicant is to select and input by operating the application PC 14.

  Furthermore, “output application date” and “output application time (minutes)” are the information output desired date and time of the applicant.

  It should be noted that some of the above-described data items include user account information when holding data to be entered, at the time of application for requesting approval from a third party after data entry is completed, after approval by the approval PC 15 After the e-mail transmission, the output date by the timer monitoring and the next output date are updated, and these will be used as work history by the information output permission device 10 at a later date.

  FIG. 5 is a diagram illustrating an example of the data structure of the user DB. As shown in FIG. 5, the user DB 12 includes “company code”, “group ID”, “user ID”, “password” as user account information, and “application number”, “output application year”. It consists of data items of “Month / Day”, “Output Application Time (minutes)”, “Update Date / Time”, and “Updater”.

  It should be noted that some of the data items described above are updated on the output date by the timer monitoring and on the next day after the output of the user account information by mail.

  FIG. 6 is a flowchart showing an operation when an information output permission application is made. Hereinafter, the operation of the information output permission apparatus according to the embodiment of the present invention shown in FIGS. 3 to 5 will be described in detail with reference to the flowchart shown in FIG.

  First, it is assumed that the applicant selects the “information output application input menu” from the main menu of the in-house information service displayed on the application PC 14 (step S601 “Yes”). When not selected, the main menu is displayed (step S601 “No”).

  At this time, the application PC 14 displays, for example, an “application input screen” whose example screen configuration is shown in FIG. 8, and the applicant inputs an operation for each data item. The data items here are the same as the information output permission application data shown in FIG. 4, but “approval date”, “approver”, “output permission notification date”, “login setting completion notification date”, “Login completion date”, “user ID”, “update date / time”, and “updater” are not yet reflected in the work history.

  The information output permission device 10 takes in the information output permission application data input by the application input data acquisition unit 101 and supplies it to the application input data management unit 102 (step S602). Then, the application input data management unit 102, when the “apply” button is pressed by a button operation assigned to the lower part of the “application input screen” by the applicant (step S603 “application”), is sent to the affiliation manager by e-mail according to the workflow. (To the approval PC 15) An approval request is made (step S604). When the “hold” button is pressed (step S603 “hold”), the information output permission application data being input is stored in the application DB 11 (step S605), and “cancel” When the “Yes” button is pressed (“Cancel” in step S603), the information output permission application data being input is discarded and the processing ends (step S606).

  The senior manager who has received the approval request by the workflow can operate the approval PC 15 to refer to the “application registration screen” shown in FIG. 9 as an example of the screen configuration. The information output permission application data that matches the “application number” received on the approval request previously displayed on the screen is scrutinized, and approval processing for permitting export of the target file is performed (steps S607 and S608). Here, the approval process means that the supervisor of the organization inputs “approval date”, “approver”, and “output permission notification date” and sends an application permission email to the applicant (to the application PC 14). To do.

  When the above-described approval process is executed (step S608 “Yes”), in the information output permission device 10, the approval input data acquisition unit 103 captures the approval input data and supplies it to the DB reference / update control unit 104. The DB reference / update control unit 104 waits for the arrival of the periodic update timing monitored by the time monitoring unit 105, and displays the “approval date” in the information output permission application data corresponding to the corresponding application number held in the application DB 11. “Date”, “Approver”, “Output permission notification date”, and “Update date / time” are written, and the contents of the application DB 11 are updated (step S609). Note that if the approval process is not performed due to the reason that the file is not subject to export permission (step S608 “No”), the process ends.

  After the approval process is executed by the approval PC 15 and the application DB 11 is updated, the account information generation unit 106 synchronizes with the regular update timing monitored by the time monitoring unit 105 (step S610 “Yes”), This information output request based on the “output application date” and “output application time” (information output desired date and time) of the information output permission application data having the corresponding application number read via the DB reference / update control unit 104 Output permission time zone information is calculated from the date and time, user account information including a user ID and a password including this output permission time zone information is automatically generated and output to the account information transmission unit 107 (step S611). If it is not the periodic update timing (step S610 “No”), the account information generation unit 106 continues to monitor the periodic update.

  Subsequently, the account information transmission unit 107 transmits the user account information generated by the account information generation unit 106 to the application PC 14 via the communication network 13. Here, it is assumed that the user account information is transmitted by mail, and FIG. 10 shows an example of the data format of the mail.

  As shown in FIG. 10, here, as the user account information (usable account information), information on “login ID”, “password”, and “output permission time” is notified to the applicant.

  The DB reference / update control unit 104 generates user account information in the account information generation unit 106 and generates user account information generated by the account information transmission unit 107 in parallel with the application PC 14. User account information (“user ID”) and “password”), “company code”, “group ID”, “application number”, “output application date”, “output application time (minutes)” ”,“ Update date / time ”, and“ Updater ”are generated for each user and stored in the user DB 12.

  Also, the DB reference / update control unit 104 updates the contents of the application DB 11 (writing of “login setting completion notification date” and “update date / time”) after waiting for the regular update timing due to the monitoring of the time monitoring unit 105. The user account information generated in this way is reflected (step S612).

  FIG. 7 is a flowchart showing the operation at the time of information output authentication. The operation of the information output permission apparatus according to the embodiment of the present invention shown in FIGS. 3 to 5 will be described in detail below with reference to the flowchart shown in FIG.

  The time monitoring unit 105 of the information output permission device 10 also monitors the scheduled output date (information output permission time zone) using an internal clock in addition to the above-described regular update timing. That is, on the scheduled output date (step S701 “scheduled output date”), if there is a login request based on the user account information previously notified by e-mail by the application PC 14 (step S702 “Yes”), the information output permission device 10, the account information input acquisition unit 108 takes in the account information, and starts log-in authentication by the information output authentication unit 109. When there is no login request (step S702 “No”), the information output permission device 10 continues monitoring the login request.

  Specifically, when the application PC 14 logs in to the information output permission device 10, the application PC 14 opens a “login screen” whose example screen configuration is shown in FIG. 11, and user account information (user ID and user ID) previously notified by e-mail. Password). Note that the user account information previously sent by e-mail can be confirmed by opening a “reference screen” that can be referred only to an applicant who is permitted to log in, as shown in FIG.

  The information output authentication unit 109 collates the user account information read by referring to the user DB 12 and the user account information (user ID and password) captured by the account information input acquisition unit 108 (step S703). Further, by collating the time monitored by the time monitoring unit 105 with the output permission time zone information (step S704), it is determined whether or not to permit the application PC 14 to output information to the portable external storage medium 140. .

  In other words, it is determined that the user who logged in by the information output authentication unit 109 is the applicant himself / herself, and the timer output by the time monitoring unit 105 is generated by the account information generation unit 106 and stored in the user DB. If it is determined that this is the case (step S704 “Yes”), the authentication result transmission unit 110 transmits an email permitting information output to the application PC 14 (step S705). Thus, the application PC 14 can output information on the target file to the portable external storage medium 140.

  Further, at this time, the DB reference / update control unit 104 waits for the time of the regular update timing by the time monitoring unit 105 and writes the “login setting completion notification date” to the application DB 11 to update the application DB 11 ( Step S706).

  In addition, when the information output authentication unit 109 receives a login request outside the above-described output permission time period (step S704 “No”), the authentication result transmission unit 110 prohibits the application PC 14 that requested the information from being output of information. And at the same time, the notification information transmitting unit 111 performs the following processing for alerting.

  That is, the information output authentication unit 109 refers to the application DB 11 updated via the DB reference / update control unit 104. For example, when the login fails for the first time, the notification information transmission unit 111 pays attention to the application PC 14. Sending an e-mail for warning (warning), sending an e-mail to the approval PC 15 (advanced supervisor) for the second login failure, and posting on the applicant's web for the third login failure If the user attempts to log in more times, a notification is sent to the administrator to transfer the source (step S707).

  On the other hand, in the time monitoring by the time monitoring unit 105, when it is notified that the next day of the scheduled output date is reached (step S701 “next day”), the DB reference / update control unit 104 corresponds to the application number from the user DB 12. In addition to the user account information to be deleted, all data items are deleted (step S708), and “login completion date” and “update date / time” are written in the application DB 11 to update the data (step S706).

  Although not shown in the flowchart of FIG. 7, the notification information transmission unit 111 is configured to apply the application DB 11 (information output permission application) referred to by the DB reference / update control unit 104 under the control of the information output authentication unit 109. Data “details of output contents”) may be collated with the export permission file list registered in the export permission DB 20, and notification may be made by e-mail to the administrator when the export of a file that is not permitted is detected. . Note that this collation is performed irregularly based on an instruction from the manager, whereby it is possible to accurately grasp illegal take-out and automatically notify the manager.

  According to the information output permission device 10 according to the embodiment of the present invention described above, the information output permission device 10 automatically pays out user account information including output permission time zone information, and the user account paid out from the application PC 14 An authentication management ledger or medium for managing user account information by enabling file output to the portable external storage medium 140 in a time zone corresponding to the output permission time zone information when a login request based on information is received Can be eliminated and security can be strengthened.

  Also, the information output permission device 10 is information input by the application PC after an approval process by the approval terminal 15, after transmission of user account information, and when an event such as an output date in the output permission time zone or a day after the output date occurs. By updating the output permission application data and referring to the update history regularly or irregularly, the approval by the third party and the purpose of taking out by the applicant can be managed. It is possible to grasp and avoid unauthorized authentication.

  In addition, according to above-mentioned embodiment of this invention, although the information output permission apparatus 10 demonstrated as a single server, it is not restricted to this. A Web server that interfaces with the application PC 14 and the approval PC 15 via the communication network 13, a DB server that manages the update of the application DB 11 and the user DB 12, generation of the user account information, and login at the time of login using the user account information It may be configured by a multi-computer in which the load is distributed by an application server that performs information output authentication.

  Further, the functions of the constituent blocks included in the information output permission device 10 shown in FIG. 3 may be realized entirely by software, or at least a part thereof may be realized by hardware.

  For example, application input data acquisition unit 101, application input data management unit 102, approval input data acquisition unit 103, DB reference / update control unit 104, time monitoring unit 105, account information generation unit 106, account information transmission unit 107, account information Data processing in the input acquisition unit 108, the information output authentication unit 109, the authentication result transmission unit 110, and the notification information transmission unit 111 may be realized on a computer by one or a plurality of programs, and at least a part thereof is an LSI. It may be realized by hardware such as.

  The authentication method in the information output permission system of the present invention includes, for example, an application terminal (application PC 14) having a portable external storage medium 140 and an approval terminal (approval PC 15) as shown in the system configuration diagram of FIG. And the information output permission device 10 is an authentication method in the information output permission system 1 connected via the communication network 13, for example, as shown in the sequence diagram of FIG. Generating information output permission application data including information output desired date and time to a portable external storage medium, and transmitting the data to the approval terminal and the information output permission device (S201); and the approval terminal, the information output permission application data The step of performing approval processing for information output of the target file by an operation by a third party with reference to (S202), and the information output permission device A step of calculating output permission time zone information from the desired information output date and time for the target file subjected to the recognition process, generating user count information including the output permission time zone information, and transmitting it to the application terminal (S203, S204), and when the information output permission device receives a login request based on the user account information from the application terminal, the file output to the external storage medium is valid in a time slot corresponding to the output permission time slot information. (S205 to S207), and the application terminal outputs (S208) information of the target file to the external storage medium.

  According to the authentication method in the information output permission system according to the above-described embodiment of the present invention, (1) the application PC 14 electronically approves the information output permission application data including the information output desired date and time to the portable external storage medium 140. (2) The approval PC 15 performs electronic approval processing, and (3) the information output permission device 10 outputs the output permission time zone information from the desired information output date and time based on the information output permission application data transmitted from the application PC 14. And (4) when the login request based on the user account information previously issued from the application PC 14 is received, the output permission time zone described above is calculated. By enabling file output to the portable external storage medium 140 during the time period corresponding to the information, the user account information can be paid. Teeth becomes unnecessary authentication management register and authentication management medium, is also possible to strengthen the in security by adding a permitted period information to the information output.

It is a figure which shows an example of the system configuration | structure of the information output permission system which concerns on embodiment of this invention. It is a figure which shows the schematic operation | movement sequence of an information output permission system. It is the figure which expanded and showed the function of the internal structure of the information output permission apparatus. It is a figure which shows an example of the data structure of application DB. It is a figure which shows an example of the data structure of application DB. It is a figure which shows an example of the data structure of user DB. It is a flowchart which shows the operation | movement at the time of an information output permission application. It is a flowchart which shows the operation | movement at the time of information output authentication. It is a figure which shows an example of a screen structure of an application input screen. It is a figure which shows an example of a screen structure of an application registration screen. It is a figure which shows the mail text format of an information output permission mail. It is a figure which shows an example of a screen structure of a login screen. It is a figure which shows an example of the screen structure of a reference screen.

Explanation of symbols

1 Information Output Permission System 10 Information Output Permission Device 11 Application DB
12 User DB
13 Communication network 14 Application PC
15 Approved PC
20 Export permission DB
DESCRIPTION OF SYMBOLS 101 Application input data acquisition part 102 Application input data management part 103 Approval input data acquisition part 104 DB reference / update control part 105 Time monitoring part 106 Account information generation part 107 Account information transmission part 108 Account information input acquisition part 109 Information output authentication part 110 Authentication Result Transmitter 111 Notification Information Transmitter 140 Portable External Storage Medium

Claims (7)

An application terminal having a portable external storage medium and an approval terminal performing electronic approval processing are information output permission devices connected via a communication network,
User account information including output permission time zone information based on information output permission application data including information output desired date and time to the portable external storage medium transmitted from the application terminal after obtaining an electronic approval process by the approval terminal Account information generation / transmission means for generating and transmitting to the application terminal,
An information output authentication means for receiving a login request based on the user account information from the application terminal and validating information output to the portable external storage medium in a time zone corresponding to the output permission time zone information; An information output permission device characterized by that. First storage means for storing each of the information output permission application data and the user account information;
In response to the occurrence of at least one event among electronic approval processing by the approval terminal, transmission of the user account information, recognition of an output date in the output permission time zone, and recognition of the next day of the output date, the first storage unit The information output permission device according to claim 1, further comprising: an information update unit that updates information output permission application data stored in the information output device. A second storage means in which file names permitting information output are stored in advance;
The information output authentication means includes
Checking the file name stored in the second storage means with the file name included in the information output permission application data stored in the first storage means at a predetermined timing, The information output permission device according to claim 1 or 2, wherein when an external file is detected, notification to an administrator is made. The information output authentication means includes
When a login request is received from the application terminal beyond the output permission time zone, the information output to the portable external storage medium is prohibited and the updated information output permission stored in the first storage means The information output permission device according to claim 1, wherein a warning mail is transmitted to the application terminal or an approval terminal further connected via the communication network according to application data. An application terminal having a portable external storage medium and an approval terminal performing electronic approval processing are information output permission devices connected via a communication network,
Application input data acquisition means for capturing information output permission application data including information output desired date and time to the portable external storage medium input by browsing the application input screen displayed on the application terminal;
Application data input management means for holding the captured information output permission application data in a storage means and transmitting to the approval terminal to make an electronic approval request;
Capture the electronic approval processing result by the approval terminal, calculate the output permission time zone information from the information output desired date and time included in the information output permission application data, and generate user account information including the output permission time zone information Account information generation / transmission means to be transmitted to the application terminal,
An information output authentication means for receiving a login request based on the user account information from the application terminal, and enabling information output to the portable external storage medium in a time zone corresponding to the output permission time zone information;
The occurrence of at least one event among electronic approval processing by the approval terminal, transmission of the user account information, and recognition of an information output date in the output permission time zone is detected, and the storage is performed when the occurrence of the event is detected An information output permission apparatus comprising: workflow management means for updating information output permission application data stored in the means and notifying the application terminal or the approval terminal of a message based on the event. An application terminal having a portable external storage medium;
Targeted by operation by a third party with reference to information output permission application data connected to the application terminal via a communication network and transmitted from the application terminal, including information output request date and time to the portable external storage medium An approval terminal for electronic approval processing of file information output;
The application terminal and the approval terminal are connected via the communication network, calculate output permission time zone information from the information output desired date and time for the target file that has been approved by the approval terminal, and output permission While generating user account information including time zone information and transmitting it to the application terminal, and receiving a login request based on the user account information from the application terminal, in the time zone corresponding to the output permission time zone information An information output permission system comprising: an information output permission device that enables information output to an external storage medium. An application terminal having a portable external storage medium, an approval terminal for performing electronic approval processing, and an information output permission device are authentication methods related to information export permission in an information output permission system connected via a communication network,
The application terminal generates information output permission application data including information output desired date and time to the portable external storage medium, and transmits to the approval terminal and the information output permission device;
The approval terminal performing electronic approval processing of information output of the target file by an operation by a third party with reference to the information output permission application data;
The information output permission apparatus calculates output permission time zone information from the information output desired date and time for the target file subjected to the approval process, generates user count information including the output permission time zone information, and Sending to the application terminal;
When the information output permission device receives a login request based on the user account information from the application terminal, the information output permission device enables information output to the portable external storage medium in a time zone corresponding to the output permission time zone information. Steps,
And a step of outputting the information of the target file to the external storage medium by the application terminal.

Images