JP2023105059A - Access management method - Google Patents

Abstract

To reduce security risk of an information processing apparatus.SOLUTION: An access management apparatus 16 causes a first storage area to store an operation condition, which is a condition for an operation to be performed on a device, permitted by an administrator and including a log-in ID for logging in to a device and corresponding to a predetermined account, in association with a user. On receipt of a log-in request including information on a device to be logged in, the access management apparatus 16 logs in to the device to be logged in with a log-in ID and a password corresponding to a log-in ID designated in the operation condition stored in the first storage area, the log-in ID and the password being used for logging in to the device to be logged in, stored in advance in a second storage area.SELECTED DRAWING: Figure 1

Description

The present invention relates to data processing technology, and more particularly to technology for managing user access to an information processing apparatus.

With the development of network technology, access to computer systems via networks has become widespread. Password authentication is widely used as authentication means when a user logs into a computer system. As a measure to increase the security of password authentication, passwords are forced to be changed after a certain period of time, or if passwords are entered unsuccessfully for a specified number of times in succession, subsequent logins are refused. ing.

The applicant of the present application has proposed a technique for easily discovering unauthorized access without degrading usability for legitimate users in Patent Document 1 below.

JP 2006-004333 A

In the conventional password authentication, it was necessary to disclose to the user the password of the information processing device on which the user should work (hereinafter also referred to as "work target device"). Therefore, a security risk may occur in the work target device. For example, there is a possibility that the password of the work target device is leaked from a legitimate user to a malicious third party.

The present invention has been made in view of these problems, and its main purpose is to provide a technique for reducing the security risks of information processing apparatuses.

In order to solve the above problems, an access management method according to an aspect of the present invention is such that an access management device sets a login ID that is a login ID for logging into a work target device and that corresponds to a predetermined account. a step of storing, in a first storage area, a work condition for a work target device, which is a work condition permitted by an administrator, in association with a user; an authentication step of determining that the user has been successfully authenticated when the user's account stored in the account storage area matches the user's account stored in advance in the account storage area; a step of providing the previous designation screen; a login request receiving step of receiving from the user's terminal a login request including information on the work target device to be logged in as designated on the designation screen; a login ID and a password for logging in to a work target device as a login destination stored in advance in the first storage area, the login ID corresponding to the login ID specified by the work conditions stored in the first storage area; and a password to log in to the login-destination work-target device, thereby enabling the user to work on the login-destination work-target device.

Any combination of the above constituent elements, and expressions of the present invention converted between a system, a program, a recording medium storing the program, and the like are also effective as aspects of the present invention.

According to the present invention, security risks of the information processing apparatus can be reduced.

1 illustrates a configuration of an information processing system according to an embodiment; FIG. 2 is a block diagram showing the functional configuration of the access management device of FIG. 1; FIG. It is a flow chart which shows operation of an access control device. It is a flow chart which shows operation of an access control device.

FIG. 1 shows the configuration of an information processing system according to an embodiment. The information processing system 100 is a system within a company, and includes an operator terminal 10, an administrator terminal 12, a work target device 14a, a work target device 14b, and a work target device 14c, which are collectively referred to as a work target device 14, and an access system. A management device 16 is included.

The operator terminal 10 is a PC operated by an operator or a developer of the information processing system 100 who is to perform work on the work target device 14 (hereafter referred to as the operator). The administrator PC 12 is a PC operated by an administrator of the information processing system 100 .

The work target device 14 is a server that is subject to work (for example, updating files, adjusting various setting values, etc.) by the operator of the information processing system 100 . For example, it may be a web server, an application server, a database server, or the like. Further, the software configuration of the work target device 14 is not limited, and the work target devices 14a to 14c may have different configurations. For example, the OS of the work target device 14a may be UNIX (registered trademark), the OS of the work target device 14b may be Linux (registered trademark), and the OS of the work target device 14c may be Windows (registered trademark). Also, the communication protocol for notifying commands from the operator PC 10 to the work target device 14 is not limited, and may be Telnet, SSH, FTP, RDP, or the like.

The access management device 16 collectively accepts login requests of operators to a plurality of work target devices 14 (work target devices 14a to 14c in FIG. 1) regardless of the type of the work target device 14, is approved by the administrator. If approved, the access management device 16 logs into the work target device 14 on behalf of the operator and relays the command transmitted from the operator PC 10 to the work target device 14 . That is, the access management device 16 mediates access from the operator's PC 10 to the work target device 14 , thereby increasing the security strength of the work target device 14 and enabling the operator to work on the work target device 14 .

FIG. 2 is a block diagram showing the functional configuration of the access management device 16 of FIG. 1. As shown in FIG. The access management device 16 includes an internal account holding unit 20, an external account holding unit 22, an account update unit 24, a work condition holding unit 26, an application information reception unit 28, an application information notification unit 30, and an approval information reception unit. A connection request reception unit 34 , an authentication processing unit 36 , a login request reception unit 38 , a determination unit 40 , a login processing unit 42 , a command reception unit 44 , and a command transfer unit 46 .

Each block shown in the block diagrams of this specification can be implemented by hardware such as a CPU of a computer or a mechanical device, and can be implemented by a computer program or the like in terms of software. The functional blocks realized by their cooperation are drawn. Therefore, those skilled in the art will understand that these functional blocks can be implemented in various ways by combining hardware and software. For example, each functional block in FIG. 2 may be stored in a recording medium as an access management program and installed in the storage of the access management device 16. FIG. Then, when the access management program is activated, the program corresponding to each functional block may be read into the main memory and executed by the CPU.

The internal account holding unit 20 stores a predetermined operator ID and password as an account (hereinafter also referred to as an “internal account”) for permitting the operator to connect from the operator PC 10 to the access management device 16. are stored in association with each other.

The external account holding unit 22 uses a predetermined account (specifically, a login ID) in the work target device 14 as an account for permitting connection to the work target device 14 (hereinafter also referred to as an “external account”). and password). For example, the external accounts determined for each of the work target devices 14a to 14c are collectively held. The external account holding unit 22 also holds an account of a privileged user of the work target device 14 as an external account, such as a root password and an administrator password.

When the login account is changed in the work target device 14 , the account updating unit 24 detects that fact and stores the changed account in the external account holding unit 22 . For example, the work target device 14 periodically changes the login account in its own device, notifies the access management device 16 of information indicating the account after the change, and the work target device 14 based on the notification May detect account changes. As a modification, the account updating unit 24 may periodically access the work target device 14 to change the login account, and store the changed account in the external account holding unit 22 .

The work condition holding unit 26 is a storage area that holds conditions for permitting the operator to log in to the work target device 14 (hereinafter also referred to as "work conditions"). The work conditions for each of the devices 14c are collectively held. The work conditions of this embodiment include the ID of the operator, the work start date and time and the work end date and time for the work target device 14, the host name of the work target device 14, the communication protocol to be used, and the log-in to the work target device 14. A login ID (for example, root, etc.) is included.

The application information receiving unit 28 receives information (hereinafter also referred to as “application information”) for applying to the administrator to log in to the work target device 14 from the operator's PC 10 . This application information includes the same contents as the work conditions described above. That is, the ID of the operator, the work start date and time and the work end date and time, the host name of the work target device 14, the communication protocol to be used, and the login ID used for logging in to the work target device 14 are included.

The application information notification unit 30 transmits the application information received from the operator PC 10 to the administrator PC 12, and allows the administrator to decide whether to approve or reject the operator's application. Approval information reception unit 32 receives information indicating whether or not the administrator has approved the content of the application from administrator PC 12 . When the administrator approves the content of the application, the approval information reception unit 32 stores the content of the application by the operator in the work condition holding unit 26 as the work condition.

The connection request reception unit 34 receives a connection request to the access management device 16 from the operator's PC 10 . In this connection request, an operator's account (that is, an internal account) defined in the access management device 16 is specified. The communication protocol between the operator PC 10 and the access management device 16 may be appropriately selected by the operator, and may be, for example, Telnet, SSH, FTP, RDP, or the like.

The authentication processing unit 36 authenticates the operator. Specifically, it is determined whether or not the account of the operator specified in the connection request matches the account of the operator held in the internal account holding unit 20 . If they match, the connection request receiving unit 34 is notified that the operator has been successfully authenticated. When the operator is successfully authenticated, the connection request accepting unit 34 establishes a communication session with the operator PC 10 and notifies the operator PC 10 of the success of the authentication. When the operator PC 10 is notified of the successful authentication, the operator PC 10 causes the display to display a screen for specifying the work target device 14 to be logged in (in other words, the work target device 14 on which the operator performs work). As a modification, the connection request accepting unit 34 may transmit data of a login destination designation screen to the operator PC 10 and display it on the operator PC 10 when the operator is successfully authenticated.

The login request reception unit 38 receives information ( hereinafter also referred to as a “login request”). This login request includes information indicating the work target device 14 (hereinafter also referred to as “designated device”) as the login destination specified by the operator on the login destination designation screen displayed on the operator PC 10 . On the other hand, the designated device's account (eg, password) is not included in the login request.

The determination unit 40 determines whether or not the login request satisfies the work conditions stored in the work condition holding unit 26 . Specifically, the ID of the operator who sent the login request matches the ID of the operator of the work conditions, and the reception date and time of the login request is within the range from the work start time to the work end date and time of the work conditions. And, if the specified device in the login request matches the connection destination device in the work condition, it is determined that the login request satisfies the work condition.

When it is determined that the login request satisfies the work conditions, the login processing unit 42 uses the account of the designated device held in the external account holding unit 22 even if the account of the designated device is not included in the login request. Login to the designated device to establish a communication session between the access management device 16 and the designated device. Specifically, an account (login ID and password, for example root and root password), which is a predetermined account in the designated device and corresponds to the login ID specified in the work conditions, is acquired from the external account holding unit 22. get. Then, using the communication protocol specified by the work conditions, a login request specifying the account obtained from the external account holding unit 22 is transmitted to the specified device.

The command accepting unit 44 accepts a command for the specified device from the operator PC 10 via the communication session established by the connection request accepting unit 34 between the operator PC 10 and the access management device 16 . The command transfer unit 46 transfers the command received by the command reception unit 44 to the designated device via the communication session established by the login processing unit 42 between the access management device 16 and the designated device.

The operation of the above configuration will be described below.
FIG. 3 is a flow chart showing the operation of the access management device 16. As shown in FIG. When the application information reception unit 28 receives the application information transmitted from the operator PC 10 (Y of S10), the application information notification unit 30 transmits the application information to the administrator PC 12 (S12). When the approval information receiving unit 32 receives information indicating that the application content has been approved from the administrator PC 12 (Y in S14), the application content is stored as a work condition in the work condition holding unit 26 (S16). If the information indicating that the content of the application has been approved is not received (N of S14), S16 is skipped. If the application information from the operator PC 10 is not received (N of S10), S12 to S16 are skipped. When the account updating unit 24 detects that the account has been changed in the work target device 14 (Y in S18), the account updating unit 24 acquires the changed account from the work target device 14 and stores it in the external account holding unit 22 (S20). . If the account change in the work target device 14 has not been detected (N of S18), S20 is skipped.

FIG. 4 is also a flowchart showing the operation of the access management device 16. As shown in FIG. This figure shows the continuation of the operation of FIG. When the connection request reception unit 34 receives the connection request transmitted from the operator PC 10 (Y in S30), the authentication processing unit 36 authenticates the operator based on the connection request. If the operator has been successfully authenticated (Y of S32), the connection request receiving unit 34 notifies the operator PC 10 of this fact and causes the operator PC 10 to display a login destination designation screen (S34). If the operator authentication fails (N of S32), S34 is skipped, and if the connection request from the operator PC 10 is not accepted (N of S30), S32 and S34 are skipped.

When the login request reception unit 38 receives the login request transmitted from the operator PC 10 (Y of S36), the determination unit 40 determines whether or not the login request satisfies the work conditions. If the login request satisfies the work conditions (Y of S38), the login processing unit 42 acquires the account of the specified device in the login request from the external account holding unit 22 (S40), and uses that account to log in to the specified device. (S42).

The command reception unit 44 waits until a command is received from the operator's PC 10 (N of S44). When the command reception unit 44 receives the command transmitted from the operator PC 10 (Y of S44), the command transfer unit 46 transmits the command to the work target device 14 (S46). If the command received from the operator PC 10 is an end command (eg, "exit" command) (Y of S48), the command reception unit 44 disconnects the communication session with the operator PC 10 and terminates the flow of this figure. If the command received from the operator's PC 10 is not an end command (N of S48), the process returns to the command waiting state of S44. If the login request does not satisfy the work conditions (N of S38) or if the login request is not accepted (N of S36), the subsequent processing is skipped and the flow of this figure is terminated.

According to the information processing system 100 of the present embodiment, the access management device 16 logs in to the work target device 14 on behalf of the operator or developer. Therefore, the account (especially the password) of the work target device 14 can be kept secret from the operator and the developer, and the security risk of the work target device 14 can be reduced. For example, it is possible to prevent an account from being leaked from an operator or developer to a malicious third party, or to prevent the operator or developer from accessing the work target device 14 beyond the scope approved by the administrator. . According to the information processing system 100, it is possible not only to detect whether or not there has been unauthorized access from the access log of the work target device 14 after the fact, but also to prevent the occurrence of unauthorized access in the first place.

Also, the login account for the work target device 14 is periodically changed and stored in the external account holding unit 22 of the access management device 16 . Thereby, the security risk of the work target device 14 can be further reduced. In addition, since the access management device 16 absorbs the influence of the login account change in the work target device 14, and the operator and the developer are not affected, convenience for the operator and the developer can be improved.

In addition, since the access management device 16 collectively controls access to the work target device 14, the work target device 14 does not need to predetermine individual accounts for each of a plurality of operators and developers. Also, there is no need to set various access rights for those individual accounts. Therefore, the security risk of the work target device 14 can be reduced without modifying the work target device 14 .

The present invention has been described above based on the embodiments. It should be understood by those skilled in the art that this embodiment is merely an example, and that various modifications can be made to combinations of each component and each treatment process, and that such modifications are within the scope of the present invention. be. Modifications are shown below.

A first modified example will be described. Although not mentioned in the above embodiment, the command reception unit 44 monitors whether or not the current date and time have passed the work end date and time defined by the work conditions, and if it has passed, the operator PC 10 and the operator PC 10 A communication session with the access management device 16 may be disconnected. Similarly, the command transfer unit 46 monitors whether or not the current date and time have passed the work end date and time of the work conditions, and if it has passed, disconnects the communication session between the access management device 16 and the work target device 14. may According to this aspect, after the work end date and time have passed, commands from the operator are no longer transferred to the work target device 14, so work by the operator can be permitted within the scope approved by the manager. .

As another modification, the command reception unit 44 may maintain the communication session between the operator PC 10 and the access management device 16 even when the current date and time have passed the work end date and time of the work conditions. Similarly, the command transfer unit 46 may maintain the communication session between the access management device 16 and the work target device 14 even if the current date and time have passed the work end date and time of the work conditions. Furthermore, when the current date and time have passed the work end date and time of the work conditions, the operator may be able to select whether to disconnect or maintain the communication session. conditions). In this case, the command reception unit 44 and the command transfer unit 46 may determine, according to the work conditions, whether to disconnect or maintain the communication session when the current date and time have passed the work end date and time of the work conditions. .

A second modification will be described. The access management device 16 may further include a log holding unit, a log output unit, and a log search unit. The log holding unit associates the internal account of the operator, the host name of the login destination work target device 14, the login account (external account) to the work target device 14, the command issued to the work target device 14, and the command issue date and time. log. When login to the work target device 14 is performed in response to the login request, the log output unit stores the operator's internal account, the host name of the work target device 14 as the login destination, and the login account to the work target device 14 as login information. keep it as Then, when a command is received from the operator's PC 10 in the command receiving unit 44, the command, login information, and current date and time (that is, command issue date and time) are associated with each other and stored in the log holding unit.

The log search unit receives a search request specifying a search keyword from administrator PC 12 . Then, based on the search keyword, the log stored in the log holding unit is searched, and the information of the log hit by the search is transmitted to the administrator PC 12 . According to the second modification, the access management device 16 collectively manages the access logs across the plurality of work target devices 14, so that the administrator can easily acquire the access logs across the plurality of work target devices 14. be able to. For example, by making a search request to the access management device 16 using the ID of a specific operator (specific internal account) as a search keyword, a specific operator can perform a plurality of tasks without inquiring each work target device 14. A history of accesses to the target device 14 can be efficiently acquired.

A third modification will be described. The access management device 16 may further include a prohibited command holding unit and a command determination unit. The prohibited command holding unit holds information indicating a predetermined prohibited command as a command that should be prohibited from being issued to the work target device 14 . Prohibited commands may include, for example, a command for changing a user's password (passwd command, etc.) and a command for switching a user's account (su command, etc.). The command determination unit determines whether or not the command received from the operator's PC 10 matches the prohibited command held in the prohibited command holding unit. If they do not match, the command determination unit passes the command received from the operator's PC 10 to the command transfer unit 46 . If they match, the command determination unit prevents the command received from the operator's PC 10 from being transferred to the command transfer unit 46 and discards it. In this case, the command determination unit may notify the operator PC 10 that the transfer to the work target device 14 is rejected because the command is a prohibited command.

Note that in the second and third modifications, when encrypted communication is performed between the operator PC 10 and the access management device 16 and between the access management device 16 and the work target device 14 (for example, SSH communication) I will add. In this case, the access management device 16 once decrypts the encrypted command received from the operator PC 10 , re-encrypts the decrypted plaintext command, and transmits it to the work target device 14 . Therefore, the log output unit of the second modification stores a log indicating the plaintext command in the log holding unit, and the command determination unit of the third modification compares the plaintext command and the prohibited command. In this way, while maintaining the security strength by encrypted communication on the communication path, the storage of the command and the comparison with the prohibited command can be realized using the plaintext command.

A fourth modification will be described. In the above embodiment, the access management device 16 is provided with the external account holder 22 and the account updater 24 . As a modification, an information processing device (here, also referred to as an "account management device") different from the access management device 16 has an external account holding unit 22 and an account updating unit 24 instead of the access management device 16, and further An external account providing unit may be provided. In this case, the login processing unit 42 of the access management device 16 transmits a password request designating the host name of the work target device 14 to be logged in and the login ID of the work target device 14 used for login to the account management device. . The external account providing unit of the account management device provides the access management device 16 with the password associated with the login ID specified in the password request.

Any combination of the above-described embodiments and modifications is also useful as an embodiment of the present invention. A new embodiment resulting from the combination has the effects of the combined embodiment and modifications.

Those skilled in the art should also understand that the functions to be fulfilled by the constituent elements described in the claims are realized by the individual constituent elements shown in the embodiments and modified examples or their linkage.

10 operator PC, 12 administrator PC, 14, 16 access control device, 20 internal account holding unit, 22 external account holding unit, 24 account update unit, 26 work condition holding unit, 34 connection request receiving unit, 36 authentication processing unit , 38 login request reception unit, 40 determination unit, 42 login processing unit, 44 command reception unit, 46 command transfer unit, 100 information processing system.

Claims (1)

the access control device
A first storage area in which work conditions for the work target device including a login ID for logging in to the work target device and work conditions applied from the user's terminal and approved by the administrator are associated with the user. storing in the
an authentication step for determining that user authentication has succeeded when the user account specified in the connection request to the apparatus received from the user terminal matches the user account pre-stored in the account storage area; ,
a step of providing a login destination designation screen to the terminal of the user who has successfully authenticated in the authentication step;
a login request receiving step of receiving, from a user terminal, a login request including information of a work target device to be logged in, which is specified on the specifying screen;
When the login request received in the login request receiving step satisfies the work conditions pre-stored in the first storage area, logging in to the login destination work target device pre-stored in the second storage area. and a login ID and a password corresponding to the login ID specified in the work condition that satisfies the login request is used to log in to the work target device of the login destination, thereby performing the login a login step enabling the user to work on a previous work target device;
and run
The work conditions can designate a login ID of a privileged user of the work target device,
the login ID for logging into the login destination work target device stored in the second storage area includes the login ID of the privileged user;
The password for logging into the login destination work target device stored in the second storage area includes the password of the privileged user and is kept secret from the user. Access control method.

Images