JP2013114351A - Information processor, information processing system, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an information processor that changes the security level settings of equipment without requiring laborious work such as management of leaving and entering a room.SOLUTION: The information processor comprises: authentication information receiving means that receives authentication information of a user; and authenticating means that executes authentication processing in plural authentication modes, using the authentication information received by the authentication information receiving means. The information processor further comprises: use history holding means that holes use history of a user; security level determining means that determines an authentication mode to execute based on the use history of the user; and authentication mode changing means that changes an authentication mode to be executed by the authenticating means so that authentication processing is executed in an authentication mode that the security level determining means has determined.

Description

  The present invention relates to an information processing apparatus, an information processing system, and a program that are preferably applied to user authentication control.

  Conventionally, when using devices such as image processing devices, as a security measure, user authentication such as password authentication or user authentication using an IC card, or user authentication using fingerprints or other biometric information, such as raising the security level, has been confirmed. Technology to confirm has been developed. However, if the security level is increased when the device is used, unauthorized use of the device can be prevented at a high level, but the work efficiency is inconvenient because various authentication processes take time and effort.

  Therefore, as described in Patent Document 1, entrance / exit management is performed without reducing the work efficiency of the device user for the purpose of setting an appropriate security level, and the occupants in the room equipped with the device are managed. By making it possible to automatically change the authentication processing method when using the device according to the attribute status, it is possible to use the device without performing unnecessarily excessively advanced authentication processing, thereby improving work efficiency when using the device. There is already known a technique for changing the security level setting of a device so that an optimum security level can be maintained while maintaining the same.

  However, in the technology for changing the security level setting up to now, there is a problem that the system becomes large because it requires entrance / exit management as in the invention described in Patent Document 1. SUMMARY OF THE INVENTION An object of the present invention is to provide an information processing apparatus that changes the security level setting of a device that does not require a large-scale entry / exit management system.

  In order to solve the above-described problems, an information processing apparatus according to the present invention uses an authentication information receiving unit that receives user authentication information and an authentication process in a plurality of authentication methods using the authentication information received by the authentication information receiving unit. An information processing apparatus comprising: an authentication means for executing a usage history holding means for holding a user usage history; a security level determination means for determining an authentication method to be executed based on a user usage history; An authentication method changing unit that changes an authentication method executed by the authentication unit so as to execute an authentication process based on the authentication method determined by the security level determination unit is provided.

  According to the present invention, without using a large-scale entry / exit management system, the user's usage history is managed, and the security level setting according to the usage time is automatically changed based on the usage history information. can do.

It is a block diagram which shows schematic structure of the information processing apparatus of embodiment of this invention. It is a block diagram which shows schematic structure of the information processing system of embodiment of this invention. It is a figure which shows the specific example of the utilization log | history holding means of embodiment of this invention. It is a figure which shows the specific example of the security level determination method setting means of embodiment of this invention. It is a figure which shows the specific example of the security level determination means of embodiment of this invention. It is a figure explaining the forced setting of the security level in embodiment of this invention. It is a flowchart which shows the process sequence from the security level determination of embodiment of this invention to changing an authentication system.

  An embodiment of the present invention will be described. The present invention has the following characteristics when setting the security level at the time of user authentication in the information processing apparatus. Generally speaking, by managing the user's usage history, the security level is automatically changed to a lower level when it is estimated that there are many users, and the security level is automatically changed when it is estimated that there are few users. It is characterized by changing the level higher. The features of the present invention described above will be described with reference to the drawings.

  First, a schematic configuration of the information processing apparatus 1 according to the embodiment of the present invention will be described with reference to FIG. The information processing apparatus 1 referred to here includes a terminal device when processing each function alone and a management server and various terminal devices (for example, a personal computer, etc.) connected on the network and processing each function in cooperation. MFPs (Multifunction Peripherals), printers, facsimile machines, etc.) are included.

  An information processing apparatus 1 according to an embodiment of the present invention includes an authentication unit 11 that executes authentication processing in a plurality of authentication methods, a usage history holding unit 12 that holds a usage history of a user, and a security level determination unit 13 that determines a security level. , Security level determination method holding means 14 for holding the security level determination method in the security level determination means, security level determination method setting means 15 for setting the security level determination method, authentication method changing means 16 for changing the authentication method, user's Authentication information receiving means 17 for receiving authentication information and display means 18 for displaying authentication method information and other information on a display or the like are provided.

  For example, as the security level determination means 13, any one of arbitrary security levels (A, B, C, etc.) set in advance based on the user usage history (number of users) held in the usage history holding means 12 The security level is determined. Specifically, when it is determined from the usage history that the number of users is large, since it is assumed that the users perform mutual monitoring, it is determined that the security level may be low (C). In this case, since no authentication means is required, it is determined that there is no authentication.

On the other hand, when it is determined from the usage history that the number of users is small, it is assumed that mutual monitoring between users does not work, and therefore it is determined that a high security level is necessary (A). In this case, it is determined that fingerprint authentication is necessary as an authentication method.

  In addition to biometric authentication such as fingerprint authentication as described above, authentication methods include authentication using an IC card, authentication using a password, and other authentication methods. Further, as the authentication information receiving means 17, a fingerprint reading device for fingerprint authentication regardless of contact type / non-contact type (or wired / wireless), an IC card reader for authentication by IC card, and authentication for password Examples include a password input device and other receiving means. The term “reception” as used herein is a concept used in the sense of receiving a signal input (or transmitted) by a predetermined authentication method regardless of wired or wireless.

  Next, a security level determination procedure performed by the information processing apparatus 1 according to the embodiment of this invention will be described. As a premise, it is necessary that the usage history holding means 12 holds a usage history for a certain period. The usage history for a certain period is, for example, a history of the number of users aggregated by year or month.

  Based on the contents of the security level determination method holding unit 14, the security level determination unit 13 determines the security level using the usage history in the usage history holding unit 12. Depending on the determined security level, the authentication method changing unit 16 changes the authentication method, and displays an appropriate authentication information receiving unit from among a plurality of authentication information receiving units 17 on a display unit (not shown).

  When a plurality of authentication information receiving means 17 receives appropriate authentication information from the user in accordance with the contents displayed on the display means, authentication processing is executed by the authentication means 11 based on the received authentication information. At this time, the usage history of the user is newly held in the usage history holding means 12. On the other hand, the security level determination method set by the security level determination method setting unit 15 is held in the security level determination method holding unit 14.

  Separately, the schematic configuration of the information processing system according to the embodiment of the present invention will be described with reference to FIG. The information processing system of this embodiment includes a management server 50 and a plurality of terminal devices 100. It is assumed that the management server 50 and the plurality of terminal devices 100 are connected on a network such as a LAN. In the drawing, only the connection status with one terminal device 100 is shown.

  The management server 50 includes an authentication unit 51, a use history holding unit 52, a security level determination unit 53, a security level determination method holding unit 54, a security level determination method setting unit 55, and a second authentication that receives authentication information from the terminal device 100. Information receiving means 56, usage history receiving means 57 for receiving usage history from the terminal device 100, second authentication method changing means 58, authentication method change control means 59 for controlling the change of the authentication method in the terminal device 100, authentication method change An authentication method change information transmission unit 60 for transmitting information to the terminal device 100 is provided.

  The terminal device 100 includes an authentication method change information receiving unit 101 that receives authentication method change information from the management server 50, a use history transmission unit 102 that transmits a use history to the management server 50, and authentication information that transmits authentication information to the management server 50. A transmitting unit 103, a first authentication method changing unit 106, and a first authentication information receiving unit 107 are provided. The terminal device 100 is various terminal devices such as a personal computer, an MFP (Multifunction Peripheral), a printer, and a facsimile machine.

  In the information processing system according to the present embodiment, the management server 50 and the terminal device 100 cooperate to perform security level determination based on a user's usage history. Hereinafter, the procedure will be described. In the terminal device 100, when the user authentication information is received by the first authentication information receiving unit 107 and the use of the user is confirmed, the usage history is transmitted from the usage history transmitting unit 102 to the management server 50.

  In the management server 50, the usage history received by the usage history receiving unit 57 is held in the usage history holding unit 52. In the management server 50, the security level is determined in the same manner as the procedure in the information processing apparatus 1 of the present embodiment. The authentication method on the management server side (second) is changed by the second authentication method changing means 58 according to the determined security level.

  Further, the authentication method change control means 59 controls the terminal device to change the authentication method according to the determined security level. Authentication method change information as information on the controlled authentication method is transmitted to the terminal device 100 by the authentication method change information transmitting means 60. In the terminal device 100, the authentication method is changed by the first authentication method change unit 106 based on the authentication method change information received by the authentication method change information receiving unit 101.

  Separately, the authentication procedure will be described. In the terminal device 100, when the first authentication information receiving unit 107 receives the user authentication information corresponding to the authentication method changed as described above, the user authentication information is managed by the authentication information transmitting unit 103. It is transmitted to the server 50. In the management server 50, authentication processing is executed by the authentication means 51 based on the user authentication information received by the second authentication information receiving means 56. Needless to say, even if authentication information other than the authentication information by the changed authentication method is received, the authentication processing is not executed and error processing is performed.

  Specific means of the usage history holding unit 12 (52) of the information processing apparatus 1 (information processing system) according to the embodiment of the present invention will be described with reference to FIG. For example, if the user uses the device at 13:00 on September 2, 2011, the number of users in the row of the usage date “2011/09/02”, usage day “Friday”, usage time “12-18 o'clock” is set. Take measures to increase one person.

  Here, when the same user uses the device a plurality of times in the time zone of “2011/09/02”, usage day “Friday”, usage time “12-18 o'clock”, duplicate counting is performed. It may be. Whether or not to perform duplicate counting may be set by an administrator or the like. For example, if the device can be used without authentication in a specific time zone based on the security level determination, it is assumed that authentication information cannot be obtained based on the use of the device. This is because it is desirable to make settings so that duplicate counts are performed in order to align the definitions.

  On the other hand, if any type of authentication is performed at any time and user authentication information is required when using the device, a more strict setting can be made by avoiding duplicate counting. Usage history can be managed by the number of users.

  In order to avoid duplicate counting, the usage history managed in each time zone is managed in association with the authentication information of the user who actually used the device, and when counting the number of users It is determined whether or not the authentication information of the user who currently uses the device is included in the authentication information of the user managed in the usage time zone corresponding to the current time. If the number of users is increased, the number of users may be increased, and if it is determined to be included, the number of users may be increased without increasing the number of users.

  Note that the above method for counting the number of users is an example, and when authentication methods that cannot obtain authentication information and authentication methods that can obtain authentication information are mixed, there is a duplication when authentication information is obtained. If the authentication information is not obtained without performing the above-described count, a duplicate count may be performed. These may hold information on settings by an administrator or the like, and respond appropriately based on the settings.

  The security level determination method setting means 15 (55) of the information processing apparatus 1 (information processing system) according to the embodiment of the present invention will be specifically described with reference to FIG. As shown in the figure, as a security level determination method setting means 15 (55), a check box 201 for setting a totaling period of the number of users, which is a means for setting a period for holding a usage history, and a determination criterion for usage history are set. A determination criterion check box 202 as means, a means for setting a threshold for the number of users in the use history, and a security level setting check box 203 as means for setting an authentication method are provided.

  In addition, the security level determination method setting means 15 (55) includes an OK button 204 for confirming the setting and a cancel button 205 for canceling the setting. Specifically, as shown in the figure, a screen for setting a security level determination method is displayed on a display screen (display means) (not shown) installed on the management server side of the information processing apparatus 1 (if it is an information processing system). The

  By checking each of the check boxes 201 to 203 with an input means (not shown) according to the display content of the security level determination method setting screen displayed on the display screen (or inputting a numerical value such as the number of users). The administrator sets the security level determination method.

  A specific example in which the total period is set using the check box 201 will be described. For example, when the total period is set to “yearly”, the usage history is totaled for one year (those that have passed one year shall be discarded). Although it is possible to make the period infinite, the history management process becomes heavier when the counting period becomes longer and the number of usage histories increases, so it is desirable to divide the period by a certain period.

  By setting an appropriate usage history aggregation period according to the system, if the usage history aggregation period is set to a long period (for example, yearly), the usage status can be estimated more accurately. If the period is set to the short-term setting (for example, weekly), it is possible to avoid the problem that the amount of calculation required when the long-term setting is set increases.

  A specific example of setting a usage history determination criterion using the check box 202 will be described. Set the month, date, day of the week, etc. as the judgment criteria. For example, when “monthly” is set, the current usage status estimation material is based on the usage status of the same month last year. Since the pattern of the number of users varies depending on the business content and work style, it can be adapted to various patterns.

  Note that there is a relationship between the aggregation period and the judgment criteria. For example, if the criterion is “Monthly”, at least the usage status of the same month of the previous year is required, so the above aggregation period must be at least yearly, and the criterion is day of week. If so, at least the usage status of the previous week is sufficient, so the aggregation period may be more than a week unit.

  Also, for example, when “monthly” is set, the usage history for the last month is retained at least for the aggregation period based on the usage status of the previous month as a presumption material for the current usage status Is needed. That is, the usage history (how long the usage history is used) may be set as appropriate.

  A specific example of a means for setting a threshold for the number of users in the usage history and a means for setting an authentication method will be described using the check box 203. The means for setting the threshold value for the number of users is to set a security level for each number of users. For example, the threshold value for the number of users is set by inputting a predetermined numerical value in the number-of-users input box 206 in the figure. Since the scale of the number of users varies (for example, there are corporations with hundreds of employees and corporations with dozens of employees), it is possible to deal with various usage scales.

  Also, an authentication method required for each security level is set. For example, an authentication method using an IC card is set as an authentication method when the security level is determined to be B. By setting an authentication method corresponding to each security level, it is possible to perform authentication appropriate for the usage environment.

  As an authentication method, an appropriate method may be selected according to the system to be used. For example, from a high security level such as biometric authentication or one-time password to a low security level such as just entering a user name or selecting from a list of user names displayed What is necessary is just to be able to select various things.

  A specific example of the security level determination unit 13 (53) according to the embodiment of the present invention when the security level determination unit is set as shown in FIG. 4 will be described with reference to FIG. Since the judgment standard is in units of days of the week, the usage history is aggregated in units of weeks, and the average number of users is calculated for each day.

  For example, at 0-6 o'clock on Friday, the average number of users is one, so the security level is A, and at 12-18 o'clock on Friday, the average number of users is 70, so the security level is C. According to the determined security level (in the information processing system 50, further through the authentication method change control means 59, the authentication method change information transmission means 60, and the authentication method change information reception means 101), the authentication method change means 16 ( The first authentication method changing means 106) changes the authentication method.

  Means for forcibly setting the security level in the security level determination based on the usage history will be described with reference to FIG. Usually, even if there are many users, there are cases where the number of users is obviously small due to holidays or the like, and conversely, even if there are usually few users, there are cases where there are clearly many users due to temporary work.

  In such cases, such as when working in a form different from the usage history, even if the security level is being judged based on the usage history, the security level is forcibly set to prevent mismatch between the history and current status. be able to. For example, if it is determined that the number of users is small due to the remark “For Founding Day” even if September 2 is a weekday, the security level that is normally C is normally forced to A And set.

  A processing procedure from security level determination to setting method change according to the embodiment of the present invention will be described with reference to FIG. First, a check process for periodically changing the security level is performed (step S1). When the usage time is divided in units of 6 hours as in the examples of FIGS. 3 and 5, this check process may be performed once every 6 hours.

  Next, it is confirmed whether or not the security level forcible setting shown in FIG. 6 is set (step S2). As a result of the confirmation, if it is forcibly set (step S2, Yes), the security level is determined according to the security level forcible setting shown in FIG. 6 (step S3). If it is not forcibly set (step S2, No), the security level is determined by the security level determination means 13 (53) according to the setting in the security level determination method setting means 15 (55) shown in FIG. S4).

  The authentication method set in FIG. 4 is determined according to the determined security level (step S5). The authentication method changing means 16 (first authentication method changing means 106) changes the authentication method determined in accordance with the security level in step S5 (step S6). When the check process is performed every 6 hours, after the authentication method change process, the check process for changing the security level is performed again (step S6 → step S1).

  In the security level determination process based on the usage history according to the embodiment of the present invention, the processes corresponding to the various means described above are executed by an information processing apparatus such as a personal computer, an MFP (Multifunction Peripheral), a printer, or a facsimile machine. It may be a program.

  For example, a program according to an embodiment of the present invention includes an authentication information receiving unit that receives user authentication information and an authentication unit that performs authentication processing in a plurality of authentication methods using the authentication information received by the authentication information receiving unit. A usage history holding process for holding a user's usage history, a security level determination process for determining an authentication method to be executed based on the user's usage history, and a security The information processing apparatus may be configured to execute an authentication method change process for changing the authentication method executed by the authentication unit so as to execute the authentication process based on the authentication method determined by the level determination process.

  By the way, the information processing apparatus, management server, and terminal device of the present embodiment include a control device such as a CPU, a storage device such as a ROM (Read Only Memory) and a RAM, an external storage device such as an HDD and a CD drive device, A display device such as a display device and an input device such as a keyboard and a mouse are provided, and the hardware configuration uses a normal computer.

  A program executed by the information processing apparatus, management server, and terminal apparatus of the present embodiment is a file in an installable format or an executable format, and is a CD-ROM, flexible disk (FD), CD-R, DVD (Digital Versatile). The program is recorded on a computer-readable recording medium such as a disk.

  Further, the program executed by the information processing apparatus or the like of the present embodiment may be configured to be provided by being stored on a computer connected to a network such as the Internet and downloaded via the network. Further, the program executed by the information processing apparatus or the like according to the present embodiment may be configured to be provided or distributed via a network such as the Internet. Further, the program of this embodiment may be provided by being incorporated in advance in a ROM or the like.

  Each of the above-described embodiments is a preferred embodiment of the present invention, and various modifications can be made without departing from the scope of the present invention.

DESCRIPTION OF SYMBOLS 1 Information processing apparatus 11, 51 Authentication means 12, 52 Usage history holding means 13, 53 Security level determination means 14, 54 Security level determination method holding means 15, 55 Security level determination method setting means 16 Authentication method change means 17 Authentication information reception Means 50 Management server 56 Second authentication information reception means 57 Usage history reception means 58 Second authentication method change means 59 Authentication method change control means 60 Authentication method change information transmission means 100 Terminal device 101 Authentication method change information reception means 102 Use History transmitting means 103 Authentication information transmitting means 106 First authentication method changing means 107 First authentication information receiving means

JP 2008-158644 A

Claims (10)

Authentication information receiving means for receiving user authentication information;
An information processing apparatus comprising authentication means for executing authentication processing in a plurality of authentication methods using the authentication information received by the authentication information receiving means,
Usage history holding means for holding user usage history;
Security level determination means for determining an authentication method to be executed based on the usage history of the user;
An information processing apparatus comprising: an authentication method changing unit that changes the authentication method executed by the authentication unit so as to execute an authentication process based on the authentication method determined by the security level determination unit. Security level determination method setting means for setting a security level determination method in the security level determination means;
Security level determination method holding means for holding the security level determination method set by the security level determination method setting means,
The security level determination unit determines the authentication method according to a security level based on the security determination method held by a security level determination method holding unit and a usage history of the user. The information processing apparatus described in 1.   The information processing apparatus according to claim 2, wherein the security level determination method setting unit further includes a unit that sets a period for holding the usage history.   4. The information processing apparatus according to claim 2, wherein the security level determination method setting means further includes means for setting a determination criterion for the usage history.   5. The information processing apparatus according to claim 2, wherein the security level determination method setting unit further includes a unit that sets a threshold value of the number of users in the usage history.   The information processing apparatus according to any one of claims 2 to 5, wherein the security level determination method setting unit further includes a unit that sets the authentication method at each security level.   The information processing apparatus according to claim 1, further comprising means for forcibly setting a security level in an emergency. An information processing system comprising a management server for authenticating a user and at least one terminal device connected to the management server and used by the user,
The terminal device
First authentication information receiving means for receiving user authentication information corresponding to the authentication method;
Authentication information transmitting means for transmitting the authentication information received by the authentication information receiving means to the management server;
Usage history transmitting means for transmitting a user's usage history to the management server;
Authentication method information receiving means for receiving authentication method information;
First authentication method changing means for changing the authentication method based on the received authentication method information,
The management server
Usage history receiving means for receiving the usage history of the user transmitted from the usage history transmitting means;
Usage history holding means for holding the usage history of the user;
Security level determination means for determining an authentication method to be executed based on the usage history of the user;
Second authentication method changing means for changing the authentication method based on the authentication method determined by the security level determining means;
An authentication method change control means for controlling the change of the authentication method in the terminal device based on the authentication method determined by the security level determination means;
Authentication method information transmitting means for transmitting authentication method information as information of an authentication method controlled by the authentication method change control means to the terminal device;
Second authentication information receiving means for receiving user authentication information transmitted from the authentication information transmitting means;
An information processing system comprising: authentication means for executing authentication processing in a plurality of authentication methods using the user authentication information. Security level determination method setting means for setting a security level determination method in the security level determination means;
Security level determination method holding means for holding the security level determination method set by the security level determination method setting means,
The security level determination means determines the authentication method according to the security level based on the security determination method held by the security level determination method holding means and the user usage history held by the usage history holding means. The information processing system according to claim 8. An information processing apparatus comprising: authentication information receiving means for receiving user authentication information; and authentication means for executing authentication processing in a plurality of authentication methods using the authentication information received by the authentication information receiving means. A program,
Usage history retention processing to retain user usage history;
A security level determination process for determining an authentication method to be executed based on the usage history of the user;
The information processing apparatus is caused to execute an authentication method change process for changing the authentication method executed by the authentication unit so as to execute an authentication process based on the authentication method determined by the security level determination process. program.

Images