JP2020112908A - Information processing apparatus and access limiting method for information processing apparatus - Google Patents

Abstract

To protect a peripheral device connected to a terminal of a local user against illegal access by a remote user logging in on the terminal of the local user without relying on a function of the peripheral device.SOLUTION: A terminal device 200 logging in on a server device 100 makes a request for remote access to a peripheral device (file storage unit 107 etc.) of the server device 100, and then authentication processing is performed on the user of the terminal device 200. This authentication processing is performed by referring to an access authority table 123 in the file storage unit 107. If the user of the terminal device 200 logging in on the server device 100 is not authenticated, a setting of access propriety to the peripheral device in BIOS setting information in an on-board RAM 105 of the server device 100 is changed by an OS 117 to access denial.SELECTED DRAWING: Figure 1

Description

The present disclosure relates to an information processing device that can be remotely accessed from an external terminal.

In a network environment in which the remote desktop technology is introduced, an information processing device can be remotely accessed from another terminal. In that case, the information processing device needs to protect the data from unauthorized use by a remote user of another terminal that remotely accessed the information processing device.

At this time, the data of the information processing device to be protected is, for example, the data of the storage unit built in the information processing device or the data of the external data storage device locally connected to the information processing device. If these data are freely rewritten by the remote user of the information processing apparatus, the reliability and accuracy of the data will be affected.

Therefore, in the past, it has been proposed to protect the data in the flash memory of the USB storage device connected to the terminal device from unauthorized use by the remote user of the terminal device.

In this proposal, the flash memory is divided into three areas, the first area stores the security software and its automatic installer, the second area stores the user files used by the user, and the third area The user registration information for authentication is stored in.

Then, when the USB storage device is connected, the CPU of the terminal device installs the security software of the flash memory in the hard disk drive (HDD) and executes it.

By executing the security software, the CPU confirms that the terminal device is registered in the user registration information of the flash memory, and then transfers the remote user authentication information input to the CPU to the controller of the USB storage device. To do. Then, the CPU receives the collation result with the user registration information from the controller of the USB storage device.

If the remote user is not registered in the user registration information as a result of collation, the CPU of the terminal device uninstalls the HDD security software after a specified number of registration confirmation errors. As a result, the local user and the remote user cannot remotely access the user use file of the USB storage device through the terminal device (for example, Patent Document 1).

In addition, there has been a proposal in the past to lock the data of a terminal device (computer) in a read-disabled state by remote control from a server device connected to a computer by a network. In this proposal, when the computer receives a remote control command from the server device, the BIOS interface section virtually constructed by the CPU of the computer executes a process related to the BIOS setting according to the received remote control command.

For example, when the remote operation command received from the server device by the computer is a remote operation disable fixed command, the interface unit of the BIOS sets the remote operation setting state to OFF in the BIOS setting information stored in the non-volatile memory of the computer. To execute the process. At the same time, the interface unit of the BIOS sets the fixed flag of the BIOS setting information of the non-volatile memory to ON.

As a result, the communication control unit of the computer is fixed in the stopped state, the CPU of the computer cannot receive the remote operation command from the network via the communication control unit, and the computer is locked in the remote access prohibited state (above, For example, Patent Document 2).

Japanese Patent No. 5676145 Japanese Patent No. 5672313

According to the first proposal of the above-mentioned two proposals, data of the USB storage device is blocked by blocking access from the terminal device to access from a remote user who is not registered in the user registration information of the USB storage device. Can be protected.

However, it is necessary to use a special USB storage device provided with a storage area for security software and remote user authentication information.

The second proposal merely stops the remote control command reception function of the computer by the remote control command from the remote user, and the computer protects the data from unauthorized access by the remote user. is not.

The present disclosure has been made in view of the above circumstances, and an object of the present disclosure is to allow a peripheral device connected to a terminal of a local user to illegally log in to a terminal of a local user without relying on the function of the peripheral device. Protecting against unauthorized access.

In order to achieve the above object, the information processing apparatus according to the first aspect of the present disclosure is
An access authority table part that holds an access authority table defined for each user has access authority to peripheral devices connected to a terminal of a local user who indirectly logs in via a network.
An authentication unit that performs authentication processing of the remote user who has logged in to the terminal and requested access to the peripheral device based on the definition content of the access authority table;
A storage unit for storing the setting content of access permission to the peripheral device in a BIOS (Basic Input Output System) of the terminal;
A control unit that switches the setting content of the storage unit from accessible to inaccessible when the authenticating unit fails to authenticate the logged-in remote user;
Equipped with.

According to the information processing apparatus according to the first aspect of the present disclosure, when a remote user who indirectly logs in to a terminal of a local user via a network requests access to a peripheral device connected to the terminal of the local user, The authentication unit performs remote user authentication processing. The authentication process of the remote user is performed by the authentication unit based on the definition contents of the access authority table of the table unit.

Then, when the remote user who has logged in to the terminal of the local user is authenticated by the authentication unit, the setting of whether or not the peripheral device is accessible in the BIOS of the terminal of the local user remains accessible. Therefore, the remote user is permitted to access the peripheral device.

On the other hand, when the authentication unit fails to authenticate the remote user who has logged in to the terminal of the local user, the setting of whether or not the peripheral device is accessible in the BIOS of the terminal of the local user is switched from accessible to inaccessible. The remote user is then denied access to the peripheral device.

Therefore, the peripheral device connected to the terminal of the local user can be protected from unauthorized access by the remote user who has logged in to the terminal of the local user without depending on the function of the peripheral device.

The information processing apparatus according to the second aspect of the present disclosure is the information processing apparatus according to the first aspect of the present disclosure, further including an execution history list generation unit that generates an execution history list of the authentication processing by the authentication unit. The table unit further holds an execution history browsing authority table in which the browsing authority of the execution history list is defined for each user, and the control unit further browses the execution history list of the logged-in remote user. Whether to execute or abandon the request is determined based on the browsing authority defined in the execution history browsing authority table.

According to the information processing apparatus according to the second aspect of the present disclosure, in the information processing apparatus according to the first aspect of the present disclosure, when the authentication unit executes the authentication processing of the remote user who has logged in to the terminal of the local user, the execution history list The history is recorded in the execution history list generated by the generation unit.

Then, when a remote user who has logged in to the terminal of the local user requests to browse the execution history list, whether to execute or discard the request is controlled based on the browsing authority defined in the execution history browsing authority table. Judged by the department.

Here, when it is determined to execute the browsing request, the remote user who logs in to the terminal of the local user is permitted to browse the execution history list. Further, when the browsing request is discarded, browsing of the execution history list by the remote user who has logged in to the terminal of the local user is rejected.

Whether the execution request for browsing the execution history list is executed or discarded can be realized by the information processing apparatus holding an execution history browsing authority table in which the authority to browse the execution history list is defined for each user. ..

Therefore, it is possible to limit the remote user who has the viewing authority to execute the viewing request of the remote user and allow the remote user to view the execution history list. Further, the remote user who is permitted to browse can use the content of the browsed execution history list as information for managing the operational state of the information processing apparatus.

Furthermore, the information processing apparatus according to the third aspect of the present disclosure is the information processing apparatus according to the first or second aspect of the present disclosure, wherein the authentication unit generates a failure history list in which the authentication processing has failed. The table unit further includes a failure history browsing authority table in which the browsing authority of the failure history list is defined for each user, and the control unit further includes the failure history browsing authority table of the logged-in remote user. Whether the browsing request for the failure history list is executed or discarded is determined based on the browsing authority defined in the failure history browsing authority table.

The information processing apparatus according to the third aspect of the present disclosure is the information processing apparatus according to the first or second aspect of the present disclosure, where the authentication unit fails in the authentication processing of the remote user who has logged in to the terminal of the local user, the failure history. The history is recorded in the failure history list generated by the list generation unit.

Then, when a remote user who has logged in to the terminal of the local user requests to view the failure history list, whether to execute or discard the request is controlled based on the viewing authority defined in the failure history viewing authority table. Judged by the department.

Here, when it is determined to execute the browsing request, the remote user who logs in to the terminal of the local user is permitted to browse the failure history list. Further, when the browsing request is discarded, browsing of the failure history list by the remote user who has logged in to the terminal of the local user is rejected.

Whether the failure request of the failure history list is executed or discarded can be realized by the information processing apparatus holding the failure history viewing authority table in which the viewing authority of the failure history list is defined for each user. ..

Therefore, it is possible to execute a browsing request of the remote user and allow the remote user to browse the failure history list only for the remote user who has the browsing authority. Further, the remote user who is permitted to browse can use the content of the browsed failure history list as information for managing the operational state of the information processing apparatus.

Further, in order to achieve the above object, an access restriction method for an information processing apparatus according to the fourth aspect of the present disclosure is
An access request step in which a remote user who has indirectly logged in to the terminal of the local user via the network outputs an access request to a peripheral device connected to the terminal of the local user,
An access request acquisition step in which the terminal captures the access request from the network,
An authentication step of performing authentication processing of the remote user who is the request source of the access request in accordance with the result of collation of the authority given to the remote user who is the request source of the access request and the authority required to access the peripheral device. When,
When the authentication of the remote user who is the source of the access request fails in the authentication step, the setting contents of whether or not the peripheral device can be accessed in the BIOS (Basic Input Output System) of the terminal is accessed from the accessible state. Switching step to switch to impossible,
including.

According to the access restriction method for the information processing apparatus according to the fourth aspect of the present disclosure, when the remote user outputs an access request to the peripheral device connected to the terminal of the local user who is the login destination, the access request is transmitted from the network to the terminal. Is taken into.

Then, if the remote user who is the request source of the access request has the authority required to access the peripheral device, the setting contents of the BIOS of the terminal remain accessible and the remote user's access to the peripheral device is maintained. Access is allowed. On the other hand, if the remote user who is the request source of the access request does not have the authority required to access the peripheral device, the setting contents of the BIOS of the terminal are switched from accessible to inaccessible, and the peripheral device of the remote user is changed. Access is denied.

Therefore, the peripheral device connected to the terminal of the local user can be protected from unauthorized access by the remote user who has logged in to the terminal of the local user without depending on the function of the peripheral device.

According to the present disclosure, it is possible to protect a peripheral device connected to a terminal of a local user from unauthorized access by a remote user who has logged in to the terminal of the local user without depending on the function of the peripheral device.

FIG. 3 is a block diagram showing a server device and a terminal device remotely connected to the server device according to an embodiment of the present disclosure. 1 shows a table or list stored in a file storage unit of the server device of FIG. 1, (a) is an explanatory diagram of an access authority table, (b) is an explanatory diagram of an execution history list of authentication processing, and (c) is an authentication processing. FIG. 8 is an explanatory diagram of a failure history list of FIG. It is explanatory drawing of the log|history browsing authority table memorize|stored in the file storage part of the server apparatus of FIG. 6 is a flowchart showing a procedure of an access restriction method executed between the server device of FIG. 1 and a terminal device remotely connected to the server device. 6 is a flowchart showing a procedure of processing for an access request from a terminal device to a peripheral device, which is executed by a CPU of the server device shown in FIG. 6 is a flowchart showing a procedure of processing for an access request from a terminal device to a peripheral device, which is executed by a CPU of the server device shown in FIG.

Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. FIG. 1 is a block diagram showing a server device and a terminal device remotely connected to the server device according to an embodiment of the present disclosure.

The server apparatus 100 (information processing apparatus, local user terminal) of the embodiment illustrated in FIG. 1 includes a CPU 101, an onboard ROM 103, an onboard RAM 105, a file storage unit 107, and a communication unit 109. The onboard ROM 103, the onboard RAM 105, the file storage unit 107, and the communication unit 109 are connected to the CPU 101.

The CPU 101 virtually builds the BIOS 111 on the CPU 101 by executing the BIOS (Basic Input Output System) program of the onboard ROM 103. When executing the BIOS program, the CPU 101 reads the BIOS setting information corresponding to the BIOS program from the onboard RAM 105 (storage unit).

The on-board ROM 103 can be composed of, for example, a flash ROM on a motherboard on which the CPU 101 is mounted. The on-board RAM 105 can be composed of, for example, a flash memory (CMOS) on the motherboard.

The BIOS 111 includes an initialization unit 113 and a setup unit 115. The initialization unit 113 initializes the peripheral devices of the server apparatus 100 connected to the CPU 101 according to the BIOS setting information read from the onboard RAM 105. The peripheral device of the server device 100 includes a file storage unit 107 and a communication unit 109.

The setup unit 115 executes processing related to changing the BIOS setting information of the onboard RAM 105. The process executed by the setup unit 115 includes, for example, a process of displaying a change screen of the BIOS setting information, a process of accepting an input of the changed contents of the BIOS setting information, and a process of updating the BIOS setting information of the onboard RAM 105 with the accepted change contents. You can leave.

Further, the CPU 101 virtually builds the OS 117 on the CPU 101 by executing the OS (Operating System) program of the file storage unit 107 after building the BIOS. The file storage unit 107 can be configured by, for example, a hard disk drive (HDD) or a solid state drive (SSD) including a semiconductor memory.

The OS 117 includes an access management unit 119 and a control unit 121. The access management unit 119 executes an authentication process of the terminal device 200, which will be described later, for logging in to the server device 100 via the communication unit 109 and requesting remote access to the file storage unit 107. When executing the authentication process of the terminal device 200, the access management unit 119 refers to the access authority table of the file storage unit 107.

As shown in the explanatory diagram of FIG. 2A, in the access right table 123, the access right to the peripheral device of the server device 100, which is given to the user of the terminal device 200 who has logged in to the server device 100, is shown for each user. Is defined in.

In the access authority table 123, the access authority to the peripheral device can be defined by, for example, “Y (present)” and “N (none)”. The contents of the authority defined in the access authority table 123 can be updated by, for example, a user having the authority of the administrator.

It should be noted that the access management unit 119 of FIG. 1 generates a list of the history of the authentication processing of the terminal device 200 and stores it in the file storage unit 107.

As shown in the explanatory view of FIG. 2B, in the execution history list 125 of the authentication processing, the terminal device 200 that has logged in to the server device 100 and requested remote access to the file storage unit 107, and the access management unit 119. The history of authentication processing by is recorded. The history of the authentication processing execution history list 125 is updated each time the access management unit 119 executes the authentication processing of the terminal device 200.

Further, when the authentication process of the terminal device 200 fails, the access management unit 119 of FIG. 1 generates a list of the history of the authentication process failure of the terminal device 200 and stores the list in the file storage unit 107.

As shown in the explanatory diagram of FIG. 2C, the history of failure of the authentication processing by the access management unit 119 is recorded in the failure history list 127 of the authentication processing. The history of the authentication process failure history list 127 is updated every time the access management unit 119 fails in the authentication of the terminal device 200 in the authentication process.

Further, the access management unit 119 of FIG. 1 executes a determination process of determining whether or not a browsing request for the execution history list 125 or the failure history list 127 from the terminal device 200 logged in to the server device 100 via the communication unit 109 is possible. .. When executing the browse request determination process, the access management unit 119 refers to the history browsing authority table of the file storage unit 107.

As shown in the explanatory diagram of FIG. 3, in the history browsing authority table 129, the browsing authority of the execution history list 125 and the failure history list 127, which is given to the user of the terminal device 200 who has logged in to the server device 100, is set for each user. And defined for each list.

Similarly to the access authority table 123, the history viewing authority table 129 may define the viewing authority of the execution history list 125 and the failure history list 127 as, for example, “Y (present)” or “N (none)”. it can. The content of the authority defined in the history browsing authority table 129 can be updated by, for example, a user having the authority of the administrator.

When the authentication processing of the terminal device 200 fails, the access management unit 119 of FIG. 1 generates an access prohibition command for prohibiting access to peripheral devices on the BIOS and outputs the command to the control unit 121.

Upon receiving the access prohibition command from the access management unit 119, the control unit 121 changes the setting information, which defines whether or not the peripheral device can be accessed, in the BIOS setting information of the onboard RAM 105 from “accessible” to “inaccessible”. Let me update.

The communication unit 201 of the terminal device 200 can be connected to the communication unit 109 via a wired or wireless network 131. The communication units 109 and 201 of the server device 100 and the terminal device 200 are communication interfaces that control communication between the server device 100 and the terminal device 200.

The terminal device 200 connected to the server device 100 can function as a terminal of a remote user who indirectly logs in to the server device 100 via the network 131 by performing a login operation. The login operation of the terminal device 200 with respect to the server device 100 can be performed by a conventionally known general operation by inputting a user ID and a password, for example.

The terminal device 200 has a CPU 203, a storage unit 205, an IC card reader 207, an input unit 209, a display unit 211, and the like, in addition to the communication unit 201 described above.

The CPU 203 executes a program in the storage unit 205 after logging in to the server apparatus 100 to generate a command having contents corresponding to the input operation of the input unit 209, and outputs the command to the CPU 101 of the server apparatus 100 via the network 131. be able to. The command generated by the CPU 203 is a command requesting remote access to a peripheral device (file storage unit 107 or the like) of the server apparatus 100.

The storage unit 205 can be configured by, for example, a non-volatile memory (flash memory), a hard disk drive, or a combination thereof.

The IC card reader 207 reads the authentication information of the user from the ID card possessed by the user of the terminal device 200, for example. The user authentication information read by the IC card reader 207 can be attached, for example, to a request command for remote access to a peripheral device of the server apparatus 100 generated by the CPU 203 as identification information of a request source.

The input unit 209 can be configured by, for example, a keyboard, a mouse, a touch panel provided on the screen of the display unit 211, or the like. Further, the input content of the input unit 209 can be confirmed, for example, on a UI (user interface) screen displayed on the display unit 211. The display unit 211 can be composed of, for example, a liquid crystal display.

When the terminal device 200 described above requests the server device 100 having no access authority for remote access to a peripheral device of the server device 100, the terminal device 200 and the server device 100 are connected to each other as shown in FIG. The access restriction method shown in the flowchart is executed.

The access restriction method shown in FIG. 4 includes respective steps (step S1, step S3, step S5, and step S7) of access request, request acquisition, authentication, and switching.

Of these, the access request step of step S1 is a step in which the terminal device 200 connected to the server device 100 via the network 131 and logged in outputs a remote access request command to the server device 100. The terminal device 200 attaches and outputs the authentication information of the user of the terminal device 200 to the remote access request command.

Further, the request acquisition step of step S3 is a step in which the server device 100 receives from the network 131 the remote access request command output by the terminal device 200 in the access request step of step S1.

Further, the authentication step of step S5 is a step in which the server device 100 authenticates the remote access request of the terminal device 200 based on the user authentication information received from the terminal device 200 together with the remote access request command.

In addition, the switching step of step S7 makes the setting information indicating whether or not the peripheral device of the server device 100 is accessible in the BIOS setting information inaccessible when the user authentication of the terminal device 200 fails in the authentication step of step S5. This is the step of updating.

Next, according to the method shown in FIG. 4, a process performed by the CPU 101 of the server apparatus 100 according to a program in the file storage unit 107 in order to restrict access to peripheral devices of the server apparatus 100 from the terminal apparatus 200 without access authority. An example of the procedure will be described.

FIG. 5 and FIG. 6 are flowcharts showing an example of a procedure of processing for an access request from the terminal device 200 to the peripheral device, which is performed by the CPU 101 of the server device 100 according to the program of the file storage unit 107.

First, as shown in FIG. 5, the CPU 101 of the server device 100 confirms whether or not the terminal device 200 connected to the communication unit 109 has logged in (step S11). If there is no login (NO in step S11), step S11 is repeated.

Further, when there is a login (YES in step S11), the CPU 101 confirms whether or not a remote access request command has been input from the logged-in terminal device 200 (step S13).

If the remote access request command has not been input (NO in step S13), the process proceeds to step S29 described later. If a remote access request command is input (YES in step S13), the CPU 101 identifies the logged-in user of the terminal device 200 from the user authentication information attached to the request command (step S15).

Further, the CPU 101 confirms whether or not the user of the terminal device 200 identified in step S15 has the access right to the peripheral device (file storage unit 107 or the like) of the server device 100 (step S17).

The CPU 101 confirms the presence/absence of access authority of the user of the terminal device 200 identified in step S15 by referring to the access authority table 123 of the file storage unit 107.

When the user of the terminal device 200 has the access right to the peripheral device (YES in step S17), the CPU 101 permits remote access to the peripheral device of the terminal device 200 (step S19). Then, the process proceeds to step S27 described later.

If the user of the terminal device 200 does not have the access right to the peripheral device (NO in step S17), the CPU 101 discards the remote access request command whose input is confirmed in step S13 (step S21). .. Then, in the BIOS setting information of the onboard RAM 105, the setting information that defines whether or not the peripheral device can be accessed is updated from "accessible" to "inaccessible" (step S23).

The update of the setting information in step S23 can be executed as follows, for example. First, the access management unit 119 of the OS 117 confirms the setting content of the setting information that defines the accessibility of the peripheral device in the BIOS setting information of the onboard RAM 105.

If the setting information confirmed by the access management unit 119 is “access inaccessible”, it is not necessary to update the setting information, and therefore, it is assumed that the setting information updating process in step S23 is completed as it is.

On the other hand, when the setting information confirmed by the access management unit 119 is “accessible”, the access management unit 119 generates an access prohibition command and outputs it to the control unit 121 of the OS 117.

Then, according to the access prohibition command input from the access management unit 119, the control unit 121 updates the setting information, which defines whether or not the peripheral device can be accessed, in the BIOS setting information of the onboard RAM 105 to “access prohibited”. Let Now, it is assumed that the setting information update process in step S23 is completed.

Subsequently, the CPU 101 notifies the logged-in terminal device 200, which is the request source of the access to the peripheral device, that the remote access request command has been discarded (step S25), and shifts the processing to step S27.

In step S27, the CPU 101 updates the execution history list 125 and the failure history list 127 of the file storage unit 107.

Specifically, in step S17, the CPU 101 adds a history of whether or not the user of the terminal device 200 has the access right to the peripheral device to the execution history list 125 of the file storage unit 107.

Further, when it is confirmed in step S17 that the user of the terminal device 200 does not have the access right to the peripheral device, the CPU 101 stores the history of the authentication failure of the user of the terminal device 200 in the file storage unit 107. Add to the failure history list 127.

Then, after updating the execution history list 125 and the failure history list 127 in step S27, the process proceeds to step S41 of FIG.

Further, in step S13, when the remote access request command is not input from the logged-in terminal device 200 (NO), the CPU 101 executes the processing of step S29 and subsequent steps shown in FIG.

Specifically, the CPU 101 first confirms whether or not a command for requesting browsing of the execution history list 125 or the failure history list 127 is input from the terminal device 200 which has confirmed login in step S11 of FIG. 5 ( Step S29).

When the browse request command has not been input (NO in step S29), the process proceeds to step S41 in FIG. Further, when the browse request command is input (YES in step S29), the CPU 101 identifies the logged-in user of the terminal device 200 from the user authentication information attached to the browse request command (step S31). ..

Then, the CPU 101 confirms whether or not the user of the terminal device 200 identified in step S31 has the authority to browse the execution history list 125 or the failure history list 127 of the request target (step S33).

The CPU 101 confirms the presence/absence of browsing authority of the user of the terminal device 200 identified in step S31 by referring to the history browsing authority table 129 of the file storage unit 107.

When the user of the terminal device 200 has the authority to browse the execution history list 125 or the failure history list 127 of the request target (YES in step S33), the CPU 101 permits the browsing of the request target lists 125 and 127. (Step S35). Then, the process proceeds to step S41 in FIG.

In addition, in the terminal device 200 permitted to browse the lists 125 and 127, the execution history list 125 or the failure history list 127 for which browsing is requested can be displayed and browsed on the display unit 211, for example.

In addition, when the user of the terminal device 200 does not have the browsing authority of the request target lists 125 and 127 (NO in step S35), the CPU 101 discards the browsing request command whose input is confirmed in step S29 ( Step S37).

Subsequently, the CPU 101 notifies the logged-in terminal device 200, which is the request source of the browsing of the execution history list 125 or the failure history list 127, that the command of the browsing request has been discarded (step S39), and step S41 of FIG. Move the processing to.

In step S41 of FIG. 5, the CPU 101 confirms whether or not the terminal device 200 whose login has been confirmed in step S11 has logged out. If the user has not logged out (NO in step S41), the process returns to step S13. If the user has logged out (YES in step S41), the series of processes ends.

As is clear from the above description, in the present embodiment, step S17 in the flowchart of FIG. 5 performed by the CPU 101 of the server apparatus 100 corresponds to the authentication unit. Further, in the present embodiment, step S23 in FIG. 5 and step S33 in the flowchart of FIG. 6 performed by the CPU 101 are processes corresponding to the control unit. Further, in the present embodiment, step S27 in FIG. 5 performed by the CPU 101 is processing corresponding to the execution history list generation unit and the failure history list generation unit.

In the present embodiment, the history browsing authority table 129 also serves as the execution history browsing authority table and the failure history browsing authority table. The file storage unit 107 of the server device 100 that stores the history browsing authority table 129 and the access authority table 123 constitutes a table unit.

According to the server device 100 of the present embodiment described above, when the terminal device 200 logged in to the server device 100 requests remote access to a peripheral device (file storage unit 107 or the like) of the server device 100, the terminal device 200 User authentication processing is performed. This authentication processing is performed by referring to the access authority table 123 of the file storage unit 107.

Then, when the user of the terminal device 200 who has logged in to the server device 100 is authenticated, the setting as to whether or not the peripheral device is accessible in the BIOS setting information of the onboard RAM 105 of the server device 100 remains accessible by the OS 117. It Therefore, the terminal device 200 is permitted to access the peripheral devices of the server device 100.

On the other hand, if the user of the terminal device 200 who has logged in to the server device 100 is not authenticated, the OS 117 switches the setting of whether or not the peripheral device can be accessed in the BIOS setting information of the onboard RAM 105 of the server device 100 to be inaccessible. Then, the access of the terminal device 200 to the peripheral devices of the server device 100 is denied.

Therefore, the peripheral device of the server device 100 (for example, the data of the file storage unit 107) is protected from the unauthorized access of the terminal device 200 having no access right who has logged in to the server device 100 without depending on the function of the peripheral device. You can

In this embodiment, the execution history list 125 of the history of the authentication processing of the user of the terminal device 200 who has logged in to the server device 100 is generated and stored in the file storage unit 107. Then, when a browsing request from the terminal device 200 that has logged in to the server device 100 is input to the server device 100, the execution history list 125 is browsed on the display unit 211 of the terminal device 200 of the user who has the authority to browse. I was allowed to.

In addition, in the present embodiment, the failure history list 127 of the history of failed authentication processing of the user of the terminal device 200 who has logged in to the server device 100 is generated and stored in the file storage unit 107. Then, when a browsing request from the terminal device 200 that has logged in to the server device 100 is input to the server device 100, the failure history list 127 is browsed on the display unit 211 of the terminal device 200 of the user who has the authority to browse. I was allowed to.

Therefore, the user of the terminal device 200 having the viewing authority is allowed to view the execution history list 125 and the failure history list 127, and the management information of the operating state of the server device 100 relating to the access request of the terminal device 200 to the peripheral devices and the like. Can be used as.

In addition, in order to allow the user of the terminal device 200 who has the viewing authority to log in to the server device 100 to view the execution history list 125 of the user authentication process or the failure history list 127 in which the authentication process has failed in the above-described embodiment. The configuration of may be omitted.

Further, an information processing apparatus according to the present disclosure and a method of restricting access of a terminal apparatus to the information processing apparatus are provided in a system in which a remote user indirectly logs in to an information processing apparatus that is a terminal of a local user, Widely applicable.

100 server device (local user terminal, information processing device)
101 CPU (authentication unit, control unit, execution history list generation unit, failure history list generation unit)
103 On-board ROM
105 On-board RAM (storage unit)
107 file storage section (table section)
109, 201 Communication unit 111 BIOS
113 initialization unit 115 setup unit 117 OS
119 access management unit 121 control unit 123 access authority table 125 execution history list 127 failure history list 129 history browsing authority table (execution history browsing authority table, failure history browsing authority table)
131 network 200 terminal device 201 communication unit 203 CPU
205 storage unit 207 IC card reader 209 input unit 211 display unit

Claims (4)

A table part that holds an access privilege table defined for each user, with access privileges to peripheral devices connected to a terminal of a local user who indirectly logs in via a network,
An authentication unit that performs authentication processing of the remote user who has logged in to the terminal and requested access to the peripheral device based on the definition content of the access authority table;
A storage unit for storing the setting content of access permission to the peripheral device in a BIOS (Basic Input Output System) of the terminal;
A control unit that switches the setting content of the storage unit from accessible to inaccessible when the authenticating unit fails to authenticate the logged-in remote user;
An information processing apparatus including. The authentication unit further includes an execution history list generation unit that generates an execution history list of the authentication process, and the table unit further holds an execution history browsing authority table in which the authority to browse the execution history list is defined for each user. Therefore, the control unit further determines whether to execute or cancel the browsing request of the execution history list of the logged-in remote user based on the browsing authority defined in the execution history browsing authority table. The information processing apparatus according to claim 1. The authentication unit further includes a failure history list generation unit that generates a failure history list in which the authentication processing has failed, and the table unit includes a failure history browsing authority table in which the browsing authority of the failure history list is defined for each user. Furthermore, the control unit further holds, based on the browsing authority defined in the failure history browsing authority table, whether to execute or discard the browsing request of the failure history list of the logged-in remote user. The information processing apparatus according to claim 1, wherein the determination is performed. An access request step in which a remote user who has indirectly logged in to the terminal of the local user via the network outputs an access request to a peripheral device connected to the terminal of the local user,
A request acquisition step in which the terminal fetches the access request from the network,
An authentication step of performing authentication processing of the remote user who is the request source of the access request in accordance with the result of collation of the authority given to the remote user who is the request source of the access request and the authority required to access the peripheral device. When,
When the authentication of the remote user who is the source of the access request fails in the authentication step, the setting contents of whether or not the peripheral device can be accessed in the BIOS (Basic Input Output System) of the terminal is accessed from the accessible state. Switching step to switch to impossible,
A method for restricting access to an information processing apparatus including:

Images