JP2014006679A - Access control method and access control program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent illegal access by a user ejected from a project, in a file sharing function of a file sever etc.SOLUTION: An access control method performs the steps of: receiving user information and a MAC address to which a user terminal is connected from the user terminal and a network switch; retrieving an accessible MAC address management table storing MAC addresses for which access is permitted on the basis of the MAC address; retrieving an access right management table to acquire an access right corresponding to a user ID on the basis of the user ID when the MAC address is registered in the accessible MAC address management table and returning a file sharing screen corresponding to the access right to the user terminal; and determining that the access is from an illegal place when the MAC address is not registered in the accessible MAC address management table and returns an error screen to the user terminal.

Description

  The present invention relates to an access control method and an access control program in a file sharing function such as a file server.

  In recent years, file sharing functions such as a file server have been widely used for business. However, since an unspecified number of users can access, security incidents such as information leakage may occur. In order to prevent such an accident, access is controlled using access rights. As an access right control method, a technique is known in which an access right (reference or edit) is given and controlled in units such as a user ID of a user or an organization to which the user belongs (see Patent Document 1). In addition, in order to prevent unauthorized access due to omission of deletion of the access right to the file sharing function by the operator, a function of automatically deleting the access right according to the access frequency or the user organization change is known.

JP-A-7-64844

As described above, by automatically deleting the access right, it is possible to prevent unauthorized access from a user whose organization has been changed due to a change and a user whose access frequency has decreased. However, since recent projects often involve participation / exit in various projects without changing the organization to which the user belongs, the known technology cannot prevent unauthorized access from users who meet the following two conditions.
(Condition 1) A user who has changed only the project to participate without changing the organization to which he belongs.
(Condition 2) A user who regularly accesses the file sharing function and the access frequency does not decrease.

  An object of the present invention is to provide an access control method and an access control program for preventing unauthorized access from a user who has left a project in a file sharing function such as a file server.

  One means for solving the above problem will be described. The present invention relates to a method for controlling access to a file sharing function in a user terminal connected via a network, a file sharing server that provides a file sharing function, a personnel server that manages a user ID and an organization to which the user belongs, and a network switch. is there.

  In this method, focusing on the fact that a project is generally performed in a room called a project room, the MAC address of the network switch in the project room is used for access control to determine whether it is unauthorized access. .

  A series of flows of the access control method according to the present invention will be described. As an authentication process for accessing the file sharing function, the file sharing server receives the user ID, password and MAC address to which the user terminal is connected transmitted from the user terminal, and uses the received user ID as a key. The access right management table and user authentication information table possessed by the file server are searched for the personnel information table possessed by the personnel server, and if the corresponding user ID exists in all tables, the user authentication information table possessed by the file server. Compare the password registered in and the received password. If the result of the comparison is the same, it is assumed that the authentication is successful, and the organization ID of the corresponding user is obtained from the access right management information table of the previous file server using the user ID as a key, and the organization from the personnel information table of the personnel server The ID is acquired and compared with the organization ID acquired from the access right management information table. If they match, the access history management table for managing the user's last access date in the file sharing server is used to determine that a user who has accessed within a certain period is an access by a correct user, and the access is permitted. If it is outside the predetermined period, the location where the terminal exists is acquired from the MAC address of the network switch, and it is determined whether or not the terminal is accessed from the participating project room.

  As described above, the file sharing function cannot be accessed when the project room is moved even for a user who has changed only the project to which the organization belongs without being changed. Therefore, the above problem can be solved.

  According to the present invention, unauthorized access to the file sharing function can be prevented, and the risk of security accidents due to information leakage can be reduced.

1 is a diagram illustrating an example of the overall configuration of a computer network system 100 according to the present embodiment. 2 is a diagram illustrating a configuration example of a file sharing server 101. FIG. 2 is a diagram illustrating a configuration example of a personnel server 102. FIG. It is a figure which shows the structural example of the user terminal 103. FIG. 2 is a diagram illustrating a configuration example of a network switch 104. FIG. It is a figure which shows the data structural example of the personnel information table 312 which the personnel server 102 has. It is a figure which shows the data structural example of the access right management table 213 which the file sharing server 101 has. It is a figure which shows the example of a data structure of the access history management table 214 with which the file sharing server 101 is provided. 6 is a diagram illustrating a data configuration example of an accessible MAC address management table 215 included in the file sharing server 101. FIG. It is a figure which shows the example of a data structure of the user authentication information table 216 with which the file sharing server 101 is provided. 10 is a flowchart showing processing of an unnecessary access right automatic deletion function 212 provided in the file sharing server 101. Similarly, it is a flowchart showing the processing of the unnecessary access right automatic deletion function 212 provided in the file sharing server 101. 10 is a flowchart showing processing of an access control function 211 for a file sharing function provided in the file sharing server 101. Similarly, it is a flowchart showing the processing of the access control function 211 for the file sharing function of the file sharing server 101.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a diagram illustrating an example of the overall configuration of a computer network system 100 according to the present embodiment. The file sharing system 100 includes a file sharing server 101, a personnel server 102, a plurality of user terminals 103, and a network switch 104 connected to a network 105. The file sharing server 101 is a server that stores files used in business, manages user access rights, and determines access from users. The personnel server 102 manages personnel information such as the user ID and the organization to which the user belongs. The user terminal 103 is a terminal for using the file sharing function, and is connected to the file sharing server and the personnel server via the network switch 104 and the network 105. The network switch 104 connects the user terminal 103 to the network 105 and has a MAC address for each port.

  FIG. 2 is a diagram illustrating a hardware configuration example of the file sharing server 101. The file sharing server 101 includes an authentication control unit 202 that performs user authentication, a communication control unit 203 that performs communication control, a program 201 in the storage unit 201, an access control function 211 for a file sharing function, and unnecessary access rights. An automatic deletion function 212 and a user authentication function 217 are provided. The storage unit 201 includes an access right management table 213, an access history management table 214, an accessible MAC address management table 215, and a user authentication information table 216. Further, the access control function 211 for the file sharing function has a function of determining whether access is possible when an access request is received from the user terminal 103. The unnecessary access right automatic deletion function 212 has a function of periodically checking a record in the access right management table 213 of the file sharing server and deleting it when an unnecessary access right exists. The user authentication function 217 has a function of comparing the user ID and password transmitted from the user terminal 103 with the information in the user authentication information table 216 to authenticate whether a correct user is accessing.

  FIG. 3 is a diagram illustrating a hardware configuration example of the personnel server 102. The personnel server 102 includes a communication control unit 302 that performs communication control, and a personnel information transmission / reception function 311 as a program 310 in the storage unit 301. The storage unit 301 includes a personnel information table 312. The personnel information transmission / reception function 311 has a function of searching the personnel information table 312 based on the user ID received from the file sharing server 101 and transmitting the search result to the file sharing server 101.

  FIG. 4 is a diagram illustrating a hardware configuration example of the user terminal 103. The user terminal 103 includes a display unit 311 for displaying a screen, an input unit 312 for inputting characters, a communication control unit 313 for controlling communication, and a user ID / password transmission function 331 as a program 330 in the storage unit 320. Have The user ID / password transmission function 331 has a function of transmitting the user ID and password input from the input unit 312 to the file sharing server 101.

  FIG. 5 is a diagram illustrating a hardware configuration example of the network switch 104. The network switch 104 includes a communication control unit 314 that performs communication control, and a MAC address transmission function 351 as a program 3350 in the storage unit 340. Each communication control unit 314 has a MAC address and is connected to the user terminal 103. The MAC address transmission function has a function of transmitting the MAC address of the communication control unit 314 to which the terminal 103 that has transmitted the user ID and password by the user ID / password transmission function 331 is connected to the file sharing server 101.

  FIG. 6 is a diagram illustrating a data configuration example of the personnel information table 312 included in the personnel server 102. The personnel information table 312 stores a user ID assigned to each user and an organization to which the personnel information table 312 belongs, and is referenced by the personnel information transmission / reception function 311. As shown in FIG. 6, the personnel information table 312 stores a user ID 401, a name 402, an organization ID 403, and an organization name 404 in association with each other. Here, the user ID 401 stores the ID of the user, the name 402 stores the name of the user, the organization ID 403 stores the ID of the organization to which the user belongs, and the organization 404 stores the organization to which the user belongs. The name is stored.

  FIG. 7 is a diagram showing a data configuration example of the access right management table 213 provided in the file sharing server 101. The access right management table 213 is a table for storing user information accessible to the file sharing function. The access right management table 213 is referred to by the access control function 211 for the file sharing function and is referenced / updated by the automatic deletion function 212 for unnecessary access rights. The As illustrated in FIG. 7, the access right management table 213 stores a user ID 410, an organization ID 411, and an access right 412 in association with each other. Here, the user ID 410 stores a user ID accessible to the file sharing function, the organization ID 411 stores the organization ID to which the user accessible to the file sharing function belongs, and the access right 412 stores the file Stores access rights for shared functions.

  FIG. 8 is a diagram showing a data configuration example of the access history management table 214 provided in the file sharing server 101. The access history management table 214 is a table for managing the access frequency from the last day when the user accessed the file sharing function. The access history management table 214 is referenced / accessed by the access control function 211 for the file sharing function and the automatic deletion function 212 for unnecessary access rights. Updated. The access history management table 214 stores the user ID 420 and the last access date 421 in association with each other. Here, the user ID 420 stores a user ID that can access the file sharing function, and the last access date 421 stores the last date when the user accessed the file sharing function.

  FIG. 9 is a diagram illustrating a data configuration example of the accessible MAC address management table 215 included in the file server 101. The MAC address is a unique number assigned to each port for connecting the network switch to the terminal. (The same MAC address does not exist) The accessible MAC address management table 215 is a table managed by the MAC address of the port of the connection source network switch that may access the file sharing function, and the access control function 211 for the file sharing function. More referenced. The accessible MAC address table 215 stores the MAC address 430. Here, the MAC address of the network switch that is permitted to access the file sharing function is stored in the MAC address 430.

  FIG. 10 is a diagram illustrating a data configuration example of the user authentication information table 216 included in the file server 101. The user authentication information table 216 is a table for managing information for performing authentication using the user ID and password received from the user terminal 103, and is referred to by the user authentication function 217. The user authentication information table 216 stores a user ID 440 and a password 441 in association with each other. Here, a user ID accessible to the file sharing function is stored in the user ID, and a password set by the user is stored in the password 441.

  FIG. 11A and FIG. 11B are flowcharts showing processing of the automatic deletion function 212 for unnecessary access rights provided in the file sharing server 101. The unnecessary access right automatic deletion function 212 is started by periodic activation (step S700, 24 hours in this example), acquires the user ID 420 registered in the access right management table 213, and uses it as a key. The personnel information table 312 is searched (step S701), and it is determined whether the record of the corresponding user ID exists in the personnel information table 312 (step S702). As a result of the determination, if the record of the corresponding user ID does not exist in the personnel information table 312, it is determined that the corresponding user does not exist, and the access right management table 213 and access history management are deleted to delete information related to the file sharing function. The record of the corresponding user ID is deleted from the table 214 and the user authentication information table 216 (step S706). As a result of the determination, if the record of the corresponding user ID exists in the personnel information table 312, the organization ID 403 is obtained from the personnel information table 312 and the organization ID 411 is obtained from the access right management table 213 using the obtained user ID 420 as a key (step S703). Then, the acquired organization ID 403 and organization ID 411 are compared to determine whether they match (step S704). If the acquired organization ID 403 and organization ID 411 do not match, it is determined that the corresponding user has changed, and the access right management table 213, the access history management table 214, and the user authentication information table 216 are deleted in order to delete information related to the file sharing function. The record of the corresponding user ID is deleted (step S706), and it is determined whether or not the above processing is completed for all the user IDs 410 registered in the access right management table 213 (step S708). If completed, the process is completed (step S709), and nothing is done until the next periodic activation. If not completed, the process returns to step S701, and the process is executed again with the next user ID 410 registered in the access right management table 213. If the acquired organization ID 403 and organization ID 411 match, the access history management table 214 is searched using the acquired user ID as a key, the last access date 421 of the corresponding user is acquired, and the number of days from the last access date 421 is calculated (step In step S705, it is determined whether the calculated number of days has passed for a certain period (one week in this example) (step S707). If a certain period of time has elapsed, the access frequency of the corresponding user has decreased, so it is determined that it is no longer necessary to use the file sharing function, and the access right management table 213 is used to delete the information related to the file sharing function. Then, the record of the corresponding user ID is deleted from the access history management table 214 and the user authentication information table 216 (step S706), and it is determined whether the above processing is completed for all the user IDs 410 registered in the access right management table 213 ( Step S708). If completed, the process is completed (step S709), and nothing is done until the next periodic activation. If not completed, the process returns to step S701, and the process is executed again with the next user ID 410 registered in the access right management table 213. If the predetermined period has not elapsed, it is determined whether the above processing has been completed for all user IDs 410 registered in the access right management table 213 (step S708). If completed, the process is completed (step S709), and nothing is done until the next periodic activation. If not completed, the process returns to step S701, and the process is executed again with the next user ID 410 registered in the access right management table 213.

  FIGS. 12A and 12B are flowcharts showing the processing of the access control function 211 for the file sharing function of the file sharing server 101. The access control function 211 for the file sharing function is started when a user requests access to the file sharing server 101, receives a user ID and password from the user terminal 103, and the user terminal 103 is connected from the network switch 104. The MAC address of the communication control unit 314 (port) is received (step S801), and the access right management table 213, personnel information table 312 and user authentication information table 216 are searched using the received user ID as a key (step S802). Then, it is determined whether the record of the corresponding user ID exists in the access right management table 213, the personnel information table 312, and the user authentication information table 216 (step S803). If the received user ID does not exist in any of the access right management table 213, personnel information table 312, and user authentication information table 216, it is determined that the corresponding user does not exist, and the corresponding user exists in the user terminal 103. An error screen indicating not to be returned is returned (step S806), and the process is completed (step S816). If the received user ID exists in all of the access right management table 213, the personnel information table 312, and the user authentication information table 216, the password 441 of the corresponding user ID is obtained from the user authentication information table 216 using the received user ID as a key. A search (step S804) is performed to determine whether the received password matches the received password (step S805). If the passwords do not match, it is determined that the authentication has failed, an error screen indicating that the authentication has failed is returned to the user terminal 103 (S808), and the process is completed (step S818). If the passwords match, the organization ID is retrieved from the personnel information table 312 and the access right management information table 213 using the received user ID as a key (step S806), the organization ID 403 retrieved from the personnel information table 312 and the access right It is determined whether the organization IDs 411 retrieved from the management information table 213 match (step S807). If the organization ID 403 retrieved from the personnel information table 312 and the organization ID 411 retrieved from the access right management information table 213 do not match, an unauthorized access from the transferred user is determined and an error screen indicating that there is no access right is displayed on the user terminal. (Step S809) and the process is completed (Step S818). When the organization ID 403 retrieved from the personnel information table 312 matches the organization ID 411 retrieved from the access right management information table 213, the last access date 421 is retrieved from the access history management table 214 using the received user ID as a key. The number of days from the access date 421 is calculated (step S705), and it is determined whether the calculated number of days has passed for a certain period (one week in this example) (step S811). If the calculated number of days is within a certain period, the access right 412 is searched from the access right management table using the received user ID as a key (step S814), and the access screen of the file sharing function corresponding to the acquired access right 412 is displayed. It returns to the terminal 103 (step S815), searches the access history management table 214 for the last access date 421 using the received user ID as a key, updates the current date (step S816), and completes the processing (step S818). ) If the calculated number of days is greater than or equal to a certain period, the MAC address 430 is searched from the accessible MAC address management table 215 using the received MAC address as a key (step S812), and the presence or absence of the corresponding record is determined (step S813). If the corresponding record does not exist, it is determined that the user who has left the project is illegally accessing from outside the project room, and the screen for rejecting access to the file sharing function is returned to the user terminal 103 (step S817). It is completed (step S818). If the corresponding record exists, the access right 412 is searched from the access right management table using the received user ID as a key (step S814), and an access screen of the file sharing function corresponding to the acquired access right 412 is displayed on the user terminal 103. Return (step S815), search for the last access date 421 from the access history management table 214 using the received user ID as a key, update the current date (step S816), and the process is completed (step S818). .

DESCRIPTION OF SYMBOLS 101 ... File sharing server, 102 ... Human resources server, 103 ... User terminal, 104 ... Network switch, 105 ... Network, 201, 301, 320, 340 ... Storage part, 202 ..Authentication control unit, 203, 302, 313, 314 ... Communication control unit, 311 ... Display unit, 312 ... Input unit

Claims (2)

An access control method for a user terminal connected to a network switch and a file sharing server connected via a network, a personnel server,
Receiving a user ID and password from the user terminal, from the network switch, a MAC address to which the user terminal is connected, via the network;
Based on the received MAC address, search the accessible MAC address management table storing the MAC address to permit access,
If the received MAC address is registered in the accessible MAC address management table, the access right management table is searched based on the received user ID to obtain an access right corresponding to the received user ID, Return the file sharing screen according to the access right to the user terminal,
If the received MAC address is not registered in the accessible MAC address management table, it is determined that the access is from an unauthorized place, and an error screen is returned to the user terminal.
An access control method for the file sharing server.   An access control program for causing a computer to execute the access control method.

Images