JP2009230325A - Communication system and network connection management device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To permit only the network connection of an authenticated user only while the user exists in a permitted area. <P>SOLUTION: When a user 6 enters a room, an entry/leaving management device 1 authenticates the user 6 by using user ID information acquired through an authentication device 4, and when the user 6 is permitted to enter the room, transmits event information including the user ID information of the user for announcing the entry of the room. A network connection management server 3 receives event information, and specifies the terminal to be used by the user 6 at the room based on the user ID information, and specifies the port of a switch 8 in which the terminal is stored, and instructs the switch 8 to open the port. When the user leaves the room, the entry/leaving management device 1 transmits the event information including the user ID information acquired through the authentication device 4 for announcing the leaving of the room, and the network connection management server 3 specifies the terminal and the port based on the user ID information, and instructs the switch 8 to close the port. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a security system that performs entrance / exit management at an entrance of an office building or the like and a security system that restricts access to a network or the like.

  Conventional security systems include an entrance / exit management system for managing entrance / exit of people and an information security system for managing access to information on a network or a PC (Personal Computer), which are independent systems. Has been in operation.

In the entrance / exit management system, an authentication device is installed in the vicinity of an entrance / exit management door, and information for authenticating a person entering the room is held in advance in the authentication device.
The person who entered the room entered the information and compared it with the stored information.
As an authentication means here, a passcode, an IC (Integrated Circuit) card, biometric authentication, or the like is used.

  On the other hand, in the information security system, a method of allowing a user to input a password when accessing information, or a method of performing authentication using PKI (Public Key Infrastructure) using an X509 certificate is used.

As a system in which an entrance / exit management system and an information security system are linked, for example, there is a technique described in Patent Document 1.
JP 2006-318240 A

The technology of Patent Document 1 limits the use of domain computer resources and Web systems managed by a server by linking between an entrance / exit management device and a user authentication server of an information system. It is not something to control.
For this reason, if a third party who does not have the authority to enter the room enters the room (room), the terminal device in the room can be connected to the network, so there is a risk of being attacked through the network connection. There is a problem.

  One of the main objects of the present invention is to solve the above-mentioned problems. A user who is authenticated in the entrance / exit management system is permitted by linking the entrance / exit management system and the information security system. The main purpose is to realize a system that permits only the user's network connection only while in the same area.

A communication system according to the present invention includes:
An admission management device that restricts admission to restricted areas where admission is restricted;
A network connection management device that controls network connection of one or more communication devices arranged in the restricted area;
The admission management device is:
When acquiring identification information of a user who tries to enter the restricted area, authenticating the user using the obtained identification information, and permitting the user to enter the restricted area, Sending entrance event information that contains the user's identification information and notifies the entrance of the user,
The network connection management device includes:
The admission event information transmitted from the admission management device is received, and based on the user identification information included in the received admission event information, the communication device used by the user in the restricted area is specified and specified. Control is performed to enable network connection of the communication device.

  According to the present invention, the admission management device and the network connection management device are linked to control the network connection itself, so that the user authenticated by the admission management device is used only when the user is located in the restricted area. Only the network connection of the communication device to be performed can be permitted, an attack through the network connection by a third party can be avoided, and the security level can be improved.

Embodiment 1 FIG.
The security system according to the present embodiment is provided in the room only when the user is present in the room (room) to which the user is permitted by the network cooperation function of the entrance / exit management system and the information security system. It enables the use of installed business terminals.
When a user leaves the room, security is improved by disconnecting the connection between the business terminal for the user and the internal network.
In addition, the security system according to the present embodiment is for a business terminal installed in a room that is no longer used when there is no user in the room due to the linkage function of the entrance / exit management system and the information network system. The network device that accommodates the LAN line is automatically turned off to improve the security level and reduce the power consumption.

  First, an example of the overall configuration of the communication system according to the present embodiment will be described with reference to FIG.

Communication according to the present embodiment is roughly divided into an entrance / exit management system and an information system.
The entrance / exit management system 1 connects the entrance / exit management device 1, the entrance / exit management server device 2, the door 5 disposed at the entrance of the room 2000, the authentication device 4, the entrance / exit management server device 2, and the entrance / exit management device 1. Network device (switch 12) to be included.
The information system includes terminals 1 to 4 arranged in a room 2000, (business terminal) user authentication (permission) server device 14, various server devices 15, switch 8 and switch 13 as network devices, UPS (Uninterruptable Power Supply). : Uninterruptible power supply) 9 is included.
Note that the entrance / exit management system and the information system are usually a logically independent LAN (Local Area Network) by the firewall 11.
The network connection management server device 3 (hereinafter also referred to as the network connection management server 3) performs network control of the information system.

The network devices (switch 8, switch 12, switch 13) are, for example, Layer 2 or Layer 3 switches.
Each of the switch 8, the switch 12, and the switch 13 has a plurality of network ports (hereinafter also simply referred to as ports), and a terminal, a server, and the like are connected to each port.
The switch 12 is used for communication between the entrance / exit management device 1 and the entrance / exit management server 2, and the switch 8 and the switch 13 are a terminal, a (business terminal) user authentication (permission) server device 14, and various servers. Used for communication with the device 15.

  First, the entrance / exit management system will be described.

The entrance / exit management server device 2 (hereinafter also referred to as the entrance / exit management server 2) has functions of registering a user, setting a room (door) in which the user can enter, a time zone, and the like by a GUI (Graphical User Interface).
Among the set information, the user ID and access authority information necessary for door unlocking control are distributed to the entrance / exit management device 1 side.
FIG. 3 shows a configuration example of the entrance / exit management server 2.
For example, the entrance / exit management unit 201 reads information from the DBs 202 to 205 and transmits the read information to the entrance / exit management device 1.
Further, the entrance / exit management unit 201 receives information from the entrance / exit management device 1 and writes the received information in any of the DBs 202 to 205.
The information reception by the entry / exit management unit 201 may be replaced by a method in which the entry / exit management unit 201 periodically reads the entry / exit history information from the storage device 108 of the entry / exit management device in FIG.

The entrance / exit management device 1 restricts entry into a room 2000 (restricted area) where entry (entrance) is restricted.
The entrance / exit management device 1 is an example of an entrance management device.
The entrance / exit management device 1 is connected to an authentication device 4 such as a card reader installed at the entrance to the room 2000 and a door 5 (entrance restriction door).
The authentication device 4 reads the user ID information (identification information) of the user 6 who tries to enter the room 2000 that is the restricted area, and the entrance / exit management device 1 acquires the user ID information from the authentication device 4 and acquires it. The user 6 is authenticated by comparing the user ID information with the registered user ID information. The entrance / exit management device 1 performs control to unlock the door 5 when permitting the user 6 to enter the room.
Moreover, the entrance / exit management device 1 has a function of notifying an entrance / exit management server 2 and other servers on the network as events.
For example, when permitting the user 6 to enter the room 2000, the entrance / exit management device 1 transmits event information (entrance event information) that includes the user ID information of the user 6 and notifies the user's entry. To do.
As will be described in detail later, the event information includes event information for notifying the user 6 of leaving the room 2000 (exit event information), locking (locking) the door 5 (unlocking). Event information (lock event information, unlock event information).
Hereinafter, entering the user's room 2000 is also referred to as an entrance event, leaving the user's room 2000 is referred to as an exit event, and locking and unlocking the door 5 is also referred to as a security event.
In addition, the structural example of the entrance / exit management apparatus 1 is shown in FIG.
Since the structure shown in FIG. 4 is the same as the structure of the existing entrance / exit management apparatus, description of each element is omitted.

Next, an information system will be described.
As described above, the information system includes the terminals 1 to 4 arranged in the room 2000, the (business terminal) user authentication (permission) server device 14, the various server devices 15, the switch 8 and the switch 13, which are network devices, UPS9 is included. Terminals 1 to 4 are examples of communication devices.
In order to use various server resources on the network from each terminal, an integrated authentication operation at the start of terminal use, that is, a logon operation using means such as a user ID and a password is performed.
(Business terminal) User authentication (permission) Once authenticated by the server device 14, the computer resources allowed for the user can be used based on the server resource use control settings.
Each terminal arranged in the room 2000 is connected to the user authentication (permission) server device 14 and various server devices 15 via the switch 8 and the switch 13 (business terminal).

The network connection management server 3 has a function of monitoring the network port connection status of network devices, the operating status of each (business) terminal, switch, server, etc., and is arranged in the room 2000 according to the event notification from the entrance / exit management device 1. Control network connection of each connected terminal.
The network connection management server 3 is an example of a network connection management device.

  The network connection management server 3 has, for example, the configuration shown in FIG.

  The network state monitoring unit 301 monitors the state of each network port of the switch 8 to which the terminals 1 to 4 arranged in the room 2000 are connected. The state of the network port includes a state where communication is possible (Up), a failure (Down), a port blockage (down), and the like.

Based on the user ID information of the user 6 included in the event information for notifying the entry event transmitted from the entry / exit management device 1, the network device / port control unit 302 uses a terminal ( For example, the terminal 1) is specified, the network port (for example, port 1) of the switch 8 to which the specified terminal (terminal 1) is connected is specified, and the switch 8 is instructed to open the specified port. The terminal of user 6 permitted to enter the room can be connected to the network.
When the user 6 who is in the room 2000 leaves the room 2000, the network device / port control unit 302 also includes the user 6 included in the event information that notifies the leaving event transmitted from the entry / exit management device 1. Based on the user ID information, the terminal (terminal 1) used by the user 6 in the room 2000 is identified, the port (port 1) of the switch 8 to which the identified terminal is connected is identified, and the identified port is The switch 8 is instructed to be blocked, and the network connection of the terminal of the user leaving the room is blocked.
The network device / port control unit 302 is an example of a network connection control unit.

The power control unit 303 performs power supply control of the switch 8.
More specifically, when the door 5 is locked (locked), the power supply control unit 303 controls the switch 8 based on the event information notifying the security event (door lock) transmitted from the entrance / exit management device 1. On the other hand, when the door 5 is unlocked and unlocked, on the other hand, based on event information notifying a security event (door unlocking) transmitted from the entrance / exit management device 1 Then, control to start power supply to the switch 8 is performed.
The power supply control unit 303 counts up the number of users located in the room 2000 each time event information notifying an entry event is received, and whenever event information notifying an exit event is received. The number of users located in the room 2000 is counted down, and the power supply to the switch 8 is stopped when the number of users located in the room 2000 becomes less than a predetermined number (for example, less than one person). Take control.
The power supply control unit 303 is an example of a power supply control unit.

The entrance / exit management information reception / control unit 304 receives event information transmitted from the entrance / exit management device 1.
As described above, the events notified by the event information include a room entry event, a room exit event, and a security event (door lock, door unlock).

DBs 305 to 309 store the tables shown in FIGS.
A description of each of the DBs 305 to 309 will be described later along with a description of each table in FIGS.

  Next, the operation in the communication system according to the present embodiment will be described.

First, the cooperation between the entrance / exit management system and the information system will be described.
Basically, the cooperation is performed by transmitting event information from the entry / exit management device 1 to the network connection management server 3.
However, the entrance / exit management device 1 may send event information to the entrance / exit management server 2, and the entrance / exit management server 2 may retransmit the event information to the network connection management server 3.
In the following, an example in which event information is transmitted from the entry / exit management device 1 to the network connection management server 3 without going through the entrance / exit management server 2 will be described.

  The operation of entrance / exit management control by the entrance / exit management device 1 will be described with reference to FIGS. 11 and 4.

The user 6 holds the IC card over the authentication device 4 (IC card reader) when entering the room.
The authentication device 4 may be a biometric authentication device such as a fingerprint authentication device in addition to an IC card reader.
In the following, an example in which an IC card is held over an IC card reader will be described.
When the card reader 401 shown in FIG. 4 detects the IC card (YES in S1101), it reads the user ID information recorded on the IC card, and the entrance / exit management device 1 acquires the user ID information through the card reader interface 104. The CPU 101 uses the controller 103 to collate with the authentication information stored in the authentication DB of the nonvolatile storage device 108 (S1102).
If the user ID information is registered, the CPU 101 checks the inside of the authentication DB and checks whether the user has the right to pass through the door 5 associated with the authentication device 4 (S1103).
If there is a passage authority (YES in S1104), the CPU 101 unlocks the corresponding electric lock of the door 5 via the electric lock interface 106 (S1105).
The authentication device corresponding to the electric lock is associated with the electric lock.
The unlocking event at this time is recorded in an internal nonvolatile storage device, and event information for notifying the entrance / exit event is transmitted to the entrance / exit management server 2 and the network connection management server 3 of the cooperation destination as needed.
The event information includes at least an event type flag indicating an event type (entering, leaving, security), user ID information, and a door number.
Whether to notify the entrance / exit management server 2 of the entrance / exit event can be changed by the setting of the storage device in the entrance / exit management device 1.
On the other hand, even when the door unlocking operation fails due to the IC card operation, the authentication / authorization rejection event can be written in the log and the event transmitted.
The user 6 holds the IC card over the authentication device 4 even when leaving the room. In the case of leaving the room, the entrance / exit management device 1 may not perform the authentication process. However, event information including user ID information, door number, and event type flag (notification of leaving event) is transmitted.

  Next, the operation of user terminal identification and port opening control by the network connection management server 3 will be described with reference to FIGS. 12 and 2 to 10.

When event information is transmitted from the entrance / exit management device 1, the entrance / exit management information reception / control unit 304 of the network connection management server 3 receives the event information.
Next, the entrance / exit management information reception / control unit 304 checks the event type flag of the received event information to check whether the event is an entrance event (S1201).
If it is not a room entry event, the process proceeds to the flow of FIG. 13 ((2) start).

In the case of an entrance event, the entrance / exit management information reception / control unit 304 passes the event information to the network device / port control unit 302, and the network device / port control unit 302 extracts user ID information (card ID) from the event information. (S1202).
Further, the network device / port control unit 302 extracts the door number included in the event information (S1203).
Next, the network device / port control unit 302 identifies the room in which the user 6 has entered by using the door number (S1204). Here, for simplification of explanation, the room number and the door number are the same. The room number may be specified by a correspondence table (not shown) between the door number and the room number.
At this time, the power supply control unit 303 updates (counts up) the occupant information for the room specified by the network device / port control unit 302 (S1205). The occupant information is managed in the occupancy management DB 308.
Next, the network device / port control unit 302 extracts, from the terminal user management table (FIG. 5), the terminal used by the user 6 based on the user ID information extracted in S1202. The terminal user management table is managed in the configuration management DB 306.
Next, the network device / port control unit 302 extracts the terminal existing in the room entrance location from the terminal installation location management table (FIG. 6) based on the door number extracted in S1204. The terminal installation location management table is managed in the configuration management DB 306, for example.
Then, the terminals extracted by the above two steps are narrowed down according to the AND condition, and the terminals used by the user 6 existing in the room where the user 6 has entered (there may be a plurality of terminals) (S1206).
For example, in the example shown in FIGS. 5 and 6, if the room in which the user 1 enters the room 1 is the room 1, the terminal 1 is extracted.

Next, the network device / port control unit 302 identifies the business terminal accommodating switch 8 to which the terminal identified in S1206 is connected and the port of the switch 8 (S1207). This is specified by the terminal / switch connection management table (FIG. 7). The terminal / switch connection management table is managed in the configuration management DB 306, for example.
Next, the network device / port control unit 302 shifts to a control for enabling the terminal used by the room occupant to be connected to the network.
Specifically, the state of the port specified above is confirmed (S1208).

The state of the network port includes a state such as communication possible (Up), failure (Down), and port blockage (downdown), and this state can be confirmed by SNMP as a network management protocol. In this state confirmation, the network state monitoring unit 301 periodically updates the switch port state monitoring table of FIG. 10 through polling based on SNMP or another management protocol (or means such as SNMP TRAP). The switch port state monitoring table is managed in the failure / performance management DB 307.
The network device / port control unit 302 refers to the switch port state monitoring table and confirms that the port identified in S1207 is blocked.
If the port identified in S1207 is blocked, the network device / port control unit 302 issues a port open command to the switch 8 (S1209).
As a specific means of the port opening command, it is possible to perform the MIB value setting operation of the corresponding port instance of the Bridge MIB by SNMP. In addition, it can be performed by operating a switch control command using a protocol such as telnet.
Note that the network device / port control unit 302 refers to the address management table shown in FIG. 9B when obtaining the port opening command, and obtains the address of the switch to be commanded.
9A, the address management table may manage the communication address of each terminal, but the management of the communication address of the terminal is not essential.
The address management table is managed in the configuration management DB 306.

  As a result of the above operation, the port accommodating the terminal is opened, so that the terminal of the user who entered the room can be connected to the in-house network.

  Next, the operation of user terminal identification and port blocking control by the network connection management server 3 will be described with reference to FIGS. 13 and 2 to 10.

As a result of checking the event type flag of the event information in S1201 of FIG. 12, if it is not a room entry event, the room entrance / exit management information reception / control unit 304 checks whether it is a room exit event (S1301). If it is not an exit event, the flow proceeds to the flow of FIG. 14 ((3) start).
In the case of an exit event, the entrance / exit management information reception / control unit 304 passes the event information to the network device / port control unit 302, and the network device / port control unit 302 extracts the user ID information (card ID) from the event information. (S1302).
Further, the network device / port control unit 302 extracts the door number included in the event information (S1303).
Next, the network device / port control unit 302 identifies the room where the user has left the room using the door number (S1304). Here, for simplification of explanation, the room number and the door number are the same. The room number may be specified by a correspondence table (not shown) between the door number and the room number.
At this time, the power supply control unit 303 updates (counts down) the occupant information for the room specified by the network device / port control unit 302 (S1305).
Next, the network device / port control unit 302 extracts the terminal used by the user 6 from the terminal user management table (FIG. 5) based on the user ID information extracted in S1302.
Next, the network device / port control unit 302 extracts the terminals existing in the exit location from the terminal installation location management table (FIG. 6) based on the door number extracted in S1304.
Then, the terminals extracted by the above two steps are narrowed down according to the AND condition to the terminals used by the user 6 existing in the room where the user 6 has left (S1306).
For example, in the example shown in FIGS. 5 and 6, if the room from which the user 1 leaves is the room 1, the terminal 1 is extracted.

Next, the network device / port control unit 302 identifies the business terminal accommodating switch 8 to which the terminal identified in S1306 is connected and the port of the switch 8 (S1307). This is specified by the terminal / switch connection management table (FIG. 7).
Next, the network device / port control unit 302 shifts to a control for making the terminal used by the person leaving the room unable to connect to the network.
Specifically, the port status and blockage condition specified above are confirmed (S1308).
The port blocking condition is stored in the setting DB 305.
In the case of leaving the room, a port closing command is normally issued to the switch 8, but there may be a case where the port does not have to be closed each time, for example, in the case of a temporary leaving for about several minutes. For this reason, it is possible to store the port block command in a temporary queue and start the block processing if there is no re-entry within a certain grace period.
Such conditions for port blocking are stored in the setting DB 305 as blocking conditions.

If the network device / port control unit 302 confirms that the port identified in S1207 is communicable (up) as a result of referring to the switch port state monitoring table, the network device / port control unit 302 sets the port to the switch 8 according to the port blocking condition. A block command is issued, and control for blocking the network connection of the terminal is performed (S1310).
The output method of the port closing command is the same as the port opening command described above.
If the port blocking condition is such that a port blocking command is output after a predetermined grace period (NO in S1309), the network device / port control unit 302 waits until the grace period elapses (S1312). If event information notifying the entrance event including the user ID information of the user who left the room before the grace period elapses is received, the terminal is maintained in a state where the terminal can be connected to the network without closing the port, and the room is exited. If the grace period has passed without receiving event information for notifying the entrance event including the user ID information of the user, the port is opened again after confirming that the port is communicable (up) (S1308). An instruction is output (S1310).

In addition, after the port closing process in S1310, the power supply control unit 303 refers to the occupant information managed in the occupancy management DB 308 and confirms whether the number of occupants in the room where the leaving event has occurred is zero. (S1311).
If the number of people in the room is zero (YES in S1311), the process proceeds to the process of (4) in FIG.
If the number of people in the room is one or more (NO in S1311), the process returns to the start (1) in FIG.

  In the above description, the explanation is focused on the room entry event and the room exit event in order to simplify the explanation.

  In the above description, the case of a wired LAN has been mainly described, but the present invention can also be applied to a case of wireless LAN network control.

Since the entrance / exit management device 1 and the network connection management server 3 are linked as described above, the location and the user are specified and the network connection itself is controlled. The level of security control can be improved.
In addition, since this method can be used simultaneously with the existing PC authentication server-based PC logon control, the security level is not downgraded.

  Next, power management control of network devices and the like by the network connection management server 3 will be described with reference to FIGS. 14 and 2 to 10.

  When the flow shown in FIG. 14 is carried out, the event type of the event information is confirmed in S1301 of FIG. 13 and it is not an exit event (NO in S1301), and the number of people in the room is confirmed in S1311 of FIG. However, there are two cases when the number of people in the room is zero (YES in S1311).

If it is not an exit event in S1301 of FIG. 13, the entrance / exit management information reception / control unit 304 checks the event type flag of the received event information to check whether it is a security event (door lock event) (S1401). ).
The door lock operation is an operation performed by the last person leaving the room. That is, the user who finally leaves the room locks the door 5 so that the door 5 does not operate.

If it is not a security event (door lock event), other event processing is performed.
If it is a security event (door lock event), the entrance / exit management information reception / control unit 304 passes the event information to the power supply control unit 303, and the power supply control unit 303 extracts the door number from the event information (S1402).
Further, the power control unit 303 identifies the room number from the door number (S1403). Here, for simplification of explanation, the room number and the door number are the same. The room number may be specified by a correspondence table (not shown) between the door number and the room number.
If the number of people in the room is zero in S1311 of FIG. 13, the power supply control unit 303 acquires the room number extracted in S1304 of FIG. 13 from the network device / port control unit 302.

Next, the power control unit 303 extracts the switch 8 in which the terminal of the room is accommodated from the switch power management table of FIG. 8 (S1404). The switch power management table is managed in the configuration management DB 306, for example.
Further, the power control unit 303 confirms the device power-off condition (S1405).
The device power-off condition is information indicating whether the switch can be turned off by a remote operation such as SNMP or TELNET.
The device power-off condition is managed in the setting DB 305.

As a result of confirming the device power-off condition, if the switch 8 that is the target of power-off can be turned off by remote operation such as SNMP or TELNET (YES in S1406), the power-off command is sent to the switch 8 by these means. And the power supply of the switch 8 is shut down (S1407).
If the switch is receiving power from a backup power source such as a UPS, the UPS is instructed by an SNMP / TELNET command to stop power supply to the switch (S1407).
Further, a power-off command may be output after a predetermined grace period has elapsed since the detection of a security event (door lock event) or the absence of a person in the room.
On the other hand, if the power cannot be turned off by remote control (NO in S1406), the process returns to the start (1) in FIG.

In the above description, the operation at the time of a security event (door lock event) has been described. However, the case of a security event (door unlock event) operation can be processed in substantially the same manner.
The door unlocking operation is an operation performed by the user who first enters the room, and is an operation of unlocking the door 5 and operating the door 5.
The network connection management server 3 issues a power supply control command to the switch 8 or the UPS 9 contrary to the door lock.
More specifically, the entrance / exit management device 1 transmits event information notifying an unlock event when the door is unlocked and unlocked, and the network connection management server 3 enters / exits management. When the information reception / control unit 304 receives the event information, the process proceeds from S1201 in FIG. 12 to S1301 in FIG. 13 and S1401 in FIG. 14. In S1401, the value of the event type flag is a security event (door unlock event). In step S1407, a power supply start command is issued to the switch 8 or the UPS 9 instead of the device power-off processing.
As a result, the switch 8 is powered on.

In the above description, the power supply control of the network device has been described. However, it is possible to control the power supply of the terminal that does not require nighttime power supply by a similar method.
Further, if the power receiving panel has an interface capable of network control, it is possible to control the power receiving panel from the network connection management server 3 and perform more detailed power control.

  As described above, the entrance / exit management device 1 and the network connection management server 3 are linked to efficiently stop the power supply to the occupant information, the room information and the network device / PC associated therewith, and the power can be saved. is there.

As described above, in the present embodiment,
An entrance / exit management system comprising an entrance / exit management server for managing entrance / exit information to the room and an entrance / exit management device for controlling entrance / exit to the room;
In a security system that works with a network connection management server that manages network connections of terminals installed in the living room,
The entrance / exit management device transmits user event information such as entrance / exit to the network connection management server, the network connection management server receives the information, and the user who enters / exits based on the received entrance / exit information. Explained the security linkage system that controls the network connection of business terminals used by.

In the present embodiment,
In a security system that links an entrance / exit management system that manages occupants and a network connection management server that manages network connections of business terminals,
The entrance / exit management device transmits the number of people entering or leaving the room or the number of people in the room to the network connection management server, and the network connection management server receives this and uses it based on the received number of people in or out of the room or people in the room. We explained a security cooperation system that manages the switch ports of terminals that are no longer in use and controls the power consumption by turning off the power of switches that are no longer energized.

Finally, a hardware configuration example of the network connection management server 3 shown in the first embodiment will be described.
FIG. 15 is a diagram illustrating an example of hardware resources of the network connection management server 3 illustrated in the first embodiment.
Note that the configuration of FIG. 15 is merely an example of the hardware configuration of the network connection management server 3, and the hardware configuration of the network connection management server 3 is not limited to the configuration described in FIG. There may be.

In FIG. 15, the network connection management server 3 includes a CPU 911 (also referred to as a central processing unit, a central processing unit, a processing unit, a processing unit, a microprocessor, a microcomputer, and a processor) that executes a program.
The CPU 911 is connected to, for example, a ROM (Read Only Memory) 913, a RAM (Random Access Memory) 914, a communication board 915, a display device 901, a keyboard 902, a mouse 903, and a magnetic disk device 920 via a bus 912. Control hardware devices.
Further, the CPU 911 may be connected to an FDD 904 (Flexible Disk Drive), a compact disk device 905 (CDD), a printer device 906, and a scanner device 907. Further, instead of the magnetic disk device 920, a storage device such as an optical disk device or a memory card (registered trademark) read / write device may be used.
The RAM 914 is an example of a volatile memory. The storage media of the ROM 913, the FDD 904, the CDD 905, and the magnetic disk device 920 are an example of a nonvolatile memory. These are examples of the storage device.
A communication board 915, a keyboard 902, a mouse 903, a scanner device 907, an FDD 904, and the like are examples of input devices.
The communication board 915, the display device 901, the printer device 906, and the like are examples of output devices.

  As shown in FIG. 1, the communication board 915 is connected to a network. For example, the communication board 915 may be connected to the Internet, a WAN (wide area network), etc., in addition to the LAN.

The magnetic disk device 920 stores an operating system 921 (OS), a window system 922, a program group 923, and a file group 924.
The programs in the program group 923 are executed by the CPU 911 using the operating system 921 and the window system 922.

The RAM 914 temporarily stores at least part of the operating system 921 program and application programs to be executed by the CPU 911.
The RAM 914 stores various data necessary for processing by the CPU 911.

The ROM 913 stores a BIOS (Basic Input Output System) program, and the magnetic disk device 920 stores a boot program.
When the network connection management server 3 is activated, the BIOS program in the ROM 913 and the boot program for the magnetic disk device 920 are executed, and the operating system 921 is activated by the BIOS program and the boot program.

  The program group 923 stores a program for executing the function described as “˜unit” in the description of the first embodiment. The program is read and executed by the CPU 911.

In the description of the first embodiment, the file group 924 includes “determination of”, “calculation of”, “comparison of”, “extraction of”, “update of”, “setting of”, Information, data, signal values, variable values, and parameters indicating the results of the processing described as “registration of”, “specification of”, “selection of”, etc. are “˜file” or “˜database”. It is memorized as each item.
The “˜file” and “˜database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 911 via a read / write circuit, and extracted, searched, referenced, compared, and calculated. Used for CPU operations such as calculation, processing, editing, output, printing, and display.
Information, data, signal values, variable values, and parameters are stored in the main memory, registers, cache memory, and buffers during the CPU operations of extraction, search, reference, comparison, calculation, processing, editing, output, printing, and display. It is temporarily stored in a memory or the like.
In addition, the arrows in the flowchart described in the first embodiment mainly indicate input and output of data and signals. The data and signal values are the RAM 914 memory, the FDD 904 flexible disk, the CDD 905 compact disk, and the magnetic disk device. It is recorded on a recording medium such as a 920 magnetic disk, other optical disks, minidisks, and DVDs. Data and signals are transmitted online via a bus 912, signal lines, cables, or other transmission media.

  In addition, what is described as “˜unit” in the description of Embodiment 1 may be “˜circuit”, “˜device”, “˜device”, and “˜step”, “˜”. “Procedure” and “˜Process” may be used. That is, what is described as “˜unit” may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented only by software, only hardware such as elements, devices, substrates, wirings, etc., or a combination of software and hardware, and further a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU 911 and executed by the CPU 911. That is, the program causes the computer to function as the “˜unit” in the first embodiment. Alternatively, the computer executes the procedure and method of “˜unit” in the first embodiment.

  As described above, the network connection management server 3 according to the first embodiment includes a CPU as a processing device, a memory as a storage device, a magnetic disk, a keyboard as an input device, a mouse, a communication board, a display device as an output device, and a communication board. As described above, the function indicated as “to part” is realized by using these processing device, storage device, input device, and output device.

1 is a diagram illustrating a configuration example of a communication system according to Embodiment 1. FIG. FIG. 3 is a diagram illustrating a configuration example of a network connection management server device according to the first embodiment. The figure which shows the structural example of the entrance / exit management server apparatus which concerns on Embodiment 1. FIG. FIG. 3 is a diagram illustrating a configuration example of an entrance / exit management device according to Embodiment 1; The figure which shows the example of the terminal user management table | surface which concerns on Embodiment 1. FIG. The figure which shows the example of the terminal location management table which concerns on Embodiment 1. FIG. FIG. 4 is a diagram showing an example of a terminal / switch connection management table according to the first embodiment. FIG. 3 is a diagram showing an example of a switch power management table according to the first embodiment. FIG. 3 is a diagram showing an example of an address management table according to the first embodiment. FIG. 3 is a diagram showing an example of a switch port state monitoring table according to the first embodiment. The flowchart figure which shows the example of the entrance / exit management control flow which concerns on Embodiment 1. FIG. FIG. 3 is a flowchart showing an example of port opening processing according to the first embodiment. FIG. 3 is a flowchart showing an example of port closing processing according to the first embodiment. FIG. 3 is a flowchart showing an example of a power-off process according to the first embodiment. FIG. 3 is a diagram illustrating a hardware configuration example of a network connection management server device according to the first embodiment.

Explanation of symbols

  1 entrance / exit management device, 2 entrance / exit management server device, 3 network connection management server device, 4 authentication device, 5 door, 6 user, 8 switch, 9 UPS, 10 network, 11 firewall, 12 switch, 13 switch, 14 (Business terminal) User authentication (permission) server device, 15 Various server devices, 101 CPU, 102 Main memory, 103 Controller, 104 Card reader I / F, 105 Biometric authentication I / F, 106 Electric lock I / F, 107 LAN I / F, 108 nonvolatile storage device, 201 entrance / exit management unit, 202 authentication DB, 203 access control DB, 204 entrance / exit log DB, 205 occupancy / layout management DB, 301 network status monitoring unit, 302 network device / port Control unit, 303 Power supply control unit 304 entrance / exit management information reception / control unit, 305 setting DB, 306 configuration management DB, 307 failure / performance management DB, 308 occupancy management DB, 309 entrance / exit log DB, 401 card reader, 402 biometric authentication device, 501 electric lock 1000 floors, 2000 rooms.

Claims (21)

An admission management device that restricts admission to restricted areas where admission is restricted;
A network connection management device that controls network connection of one or more communication devices arranged in the restricted area;
The admission management device is:
When acquiring identification information of a user who tries to enter the restricted area, authenticating the user using the obtained identification information, and permitting the user to enter the restricted area, Sending entrance event information that contains the user's identification information and notifies the entrance of the user,
The network connection management device includes:
The admission event information transmitted from the admission management device is received, and based on the user identification information included in the received admission event information, the communication device used by the user in the restricted area is specified and specified. A communication system characterized by performing control to enable network connection of the communication apparatus. The network connection management device includes:
A plurality of ports, each of one or more communication devices arranged in the restricted area manage network devices connected to any one of the ports;
When the admission event information transmitted from the admission management device is received, the communication device used by the user in the restricted area is specified based on the user identification information included in the received admission event information. The communication system according to claim 1, further comprising: specifying a port of the network device to which the specified communication device is connected, and instructing the network device to open the specified port. The admission management device is:
Obtaining identification information of a user who tries to leave the restricted area, sending exit event information notifying the user of leaving, including the acquired identification information of the user,
The network connection management device includes:
The exit event information transmitted from the admission management device is received, and based on the user identification information included in the received exit event information, the communication device used by the user in the restricted area is specified and specified. The communication system according to claim 1, wherein control is performed to block network connection of the communication apparatus. The network connection management device includes:
A plurality of ports, each of one or more communication devices arranged in the restricted area manage network devices connected to any one of the ports;
When receiving the exit event information transmitted from the admission management device, the communication device used by the user in the restricted area is specified based on the user identification information included in the received exit event information. The communication system according to claim 3, further comprising: specifying a port of the network device to which the specified communication device is connected, and instructing the network device to close the specified port. The network connection management device includes:
When the exit event information transmitted from the entrance management device is received, if the entrance event information including the user identification information is received before a predetermined grace period elapses, the communication device is connected to the network. The communication device is controlled to block the network connection when the grace period elapses without receiving the entry event information including the user identification information. The communication system according to claim 3 or 4. An admission management device that manages admission restriction doors that restrict admission to restricted areas where admission is restricted;
A network connection management device that performs power supply control to a network device to which one or more communication devices arranged in the restricted area are connected;
The admission management device is:
Detecting that the entrance restriction door is locked, and sending lock event information notifying that the entrance restriction door is locked,
The network connection management device includes:
A communication system, wherein the lock event information transmitted from the admission management device is received, and control for stopping power supply to the network device is performed based on the received lock event information. The network connection management device includes:
Connected to a power supply for supplying power to the network device;
The communication system according to claim 6, wherein when the lock event information transmitted from the admission management device is received, the power supply device is instructed to stop the power supply to the network device. The network connection management device includes:
When the lock event information transmitted from the admission management device is received, control is performed to stop power supply to a communication device arranged in the restricted area via the network device. Item 8. The communication system according to Item 6 or 7. The admission management device is:
Detecting unlock to unlock the entrance restricted door, and sending unlock event information to notify the entrance restricted door unlock,
The network connection management device includes:
The control according to claim 6, wherein the unlock event information transmitted from the admission management device is received, and based on the received unlock event information, power supply to the network device is started. The communication system in any one. The network connection management device includes:
Connected to a power supply for supplying power to the network device;
The communication system according to claim 9, wherein when the unlock event information transmitted from the admission management device is received, the power supply device is instructed to start power supply to the network device. An admission management device that restricts admission to restricted areas where admission is restricted;
A network connection management device that performs power supply control to a network device to which one or more communication devices arranged in the restricted area are connected;
The admission management device is:
When the user who tries to enter the restricted area is authenticated and the entry of the user to the restricted area is permitted, the event information for notifying the user is transmitted, and the restricted area is transmitted. Detecting user exit from and sending exit event information to notify the user exit,
The network connection management device includes:
Every time the event information transmitted from the admission management device is received, the number of users located in the restricted area is counted up, and every time the event information transmitted from the admission management device is received, Counting down the number of users located in the restricted area, and performing control to stop power supply to the network device when the number of users located in the restricted area becomes less than a predetermined number. A featured communication system. The network connection management device includes:
Connected to a power supply for supplying power to the network device;
The communication according to claim 11, wherein when the number of users located in the restricted area becomes less than a predetermined number, the power supply apparatus is instructed to stop power supply to the network device. system. The network connection management device includes:
When the number of users located in the restricted area becomes less than a predetermined number, control is performed to stop power supply to the communication device arranged in the restricted area via the network device. The communication system according to claim 11 or 12. The network connection management device includes:
The control for starting power supply to the network device is performed when the number of users located in the restricted area exceeds the predetermined number. Communications system. The network connection management device includes:
Connected to a power supply for supplying power to the network device;
15. The power supply apparatus is instructed to start power supply to the network device when the number of users located in the restricted area exceeds the predetermined number. Communications system. A network capable of receiving information transmitted from an admission management device that restricts admission to a restricted area where admission is restricted, and controlling network connection of one or more communication devices arranged in the restricted area A connection management device,
An event information receiving unit that receives the entry event information that includes the identification information of the user who enters the restricted area transmitted from the admission management device and notifies the entry of the user;
A network connection control unit for performing control to identify a communication device used by the user in the restricted area based on user identification information included in the admission event information, and to enable network connection of the identified communication device; A network connection management device comprising: The event information receiver
Receiving exit event information for notifying the user of leaving, including identification information of the user leaving the restricted area transmitted from the admission management device;
The network connection control unit
The communication device according to claim 1, wherein the user specifies a communication device to be used in the restricted area based on user identification information included in the exit event information, and performs control to block network connection of the specified communication device. Item 17. The network connection management device according to Item 16. One or more communication devices that are capable of receiving information transmitted from an entrance management device that manages an entrance restricted door that restricts entry into a restricted area where entry is restricted, and that are arranged in the restricted area, A network connection management device that controls power supply to connected network devices,
An event information receiving unit for receiving lock event information for notifying that the entrance restriction door transmitted from the admission management device is locked;
A network connection management apparatus comprising: a power supply control unit that performs control to stop power supply to the network device based on the lock event information. The event information receiver
Receiving the unlock event information for notifying the unlock that unlocks the entrance restriction door transmitted from the admission management device,
The power supply control unit
19. The network connection management apparatus according to claim 18, wherein control for starting power supply to the network device is performed based on the unlock event information. A network device capable of receiving information transmitted from an admission management device that restricts admission to a restricted area where admission is restricted, and to which one or more communication devices arranged in the restricted area are connected A network connection management device for controlling power supply to
An exit event for receiving entrance event information for notifying a user entering the restricted area transmitted from the entrance management device and for notifying a user exiting from the restricted area transmitted from the entrance management device. An event information receiving unit for receiving information;
Each time the event information receiving unit receives entrance event information, the number of users located in the restricted area is counted up, and each time the event information receiving unit receives exit event information, the restriction A power supply control unit that counts down the number of users located in the area and performs control to stop power supply to the network device when the number of users located in the restricted area becomes less than a predetermined number; A network connection management device comprising: The power supply control unit
21. The network connection management apparatus according to claim 20, wherein when the number of users located in the restricted area becomes equal to or greater than the predetermined number, control to start power supply to the network device is performed.

Images