JP4814130B2 - Business information protection device - Google Patents

Description

  The present invention relates to a business information system for managing organizational work, and more particularly, to a technique for improving information security of the business information system.

  Business information systems that support the operation of companies and public facilities, so-called enterprise systems, are now the foundation of organizations of various sizes. The business information system supports complicated organization management by outputting higher value-added information after totaling, accumulating, analyzing and processing data obtained from client terminals and databases.

Information handled by the business information system (hereinafter referred to as “organization information”) can be roughly divided into the following three types.
1. Externally disclosed information: Organization information that can be disclosed not only within the organization but also outside the organization. For example, IR (Investor Relations) information and press release information are applicable.
2. Internally disclosed information: Organization information that is disclosed inside the organization but is not disclosed outside the organization. For example, in-house bulletin board information is applicable.
3. Limited public information: Special internal public information that is open to only some members of the organization. For example, supplier risk evaluation information is limited public information that is usually accessible only to the accounting department or employees of a predetermined position or higher.

A general business information system often restricts access to limited public information by user authentication such as a password. For example, a “department password” common to the accounting department is set for the accounting information database storing the limited public information for the accounting department. According to such an operation, only employees who know the department password, in other words, only employees who belong to the accounting department can access the limited public information in the accounting information database.
JP 2004-213475 A

  However, in the case of the above operation, if a certain accounting member is reassigned to another department, there is a high possibility that the department password will be leaked to other than the accounting department. If this accounting member is not a full-time employee but a contract employee, there is a high possibility that the department password will be leaked outside the organization. Changing the department password frequently can address this problem to some extent, but it is a burden on other accounting staff.

  In addition, employees who belong to other than the accounting department may want to access the accounting information database. If this employee's access range and access time can be controlled, temporary and limited access to the accounting information database may be permitted. However, if this employee is informed of the department password itself, the department password may be leaked to anyone other than those involved.

  In recent years, the SOX (Sarbanes-Oxley) law, which was enacted in the United States, urges corporate managers and accounting auditors to ensure the validity of public information. Following this, the Japanese version of the SOX method is scheduled to be introduced in Japan, and there is an urgent need to establish a system that can handle the Japanese version of the SOX method.

  In view of such a social background, the inventor focuses on access to a business information system, in particular, access from a member of an organization to limited public information, and strengthens access restrictions on the business information system inside the organization. Recognized that it was necessary. Patent Document 1 discloses an access rule that is subject to access approval by an administrator in addition to user authentication using an ID and a password. Such an access rule is an effective technique for preventing unauthorized access to the business information system, but it is burdensome because the administrator needs to respond to the work application immediately. In order to control access to the limited public information from within the organization, the present inventor is of course important to control the outflow of the limited public information, but it is also important to suppress the user load associated with the access to the limited public information. I believe that.

  The present invention is an invention that has been completed based on the recognition of the above problems of the present inventor, and its main object is to provide a technique for improving information security in a business information system.

One embodiment of the present invention relates to a business information protection apparatus for controlling remote access from a client terminal to a server apparatus in a business information system for managing organizational work by cooperation of a plurality of server apparatuses.
This apparatus receives access application information indicating a server apparatus to be executed by remote access and a user scheduled to execute remote access, and manages the remote access schedule for each server apparatus. When performing remote access from any client terminal to any server device, it is determined whether an access application has been made in advance. Furthermore, it is determined whether this user is registered as a regular user. Remote access to the server device is permitted on the condition that both of these two-stage determinations are affirmative determinations (corresponding to “application determination initiative type” described later).

  It should be noted that any combination of the above-described components, and the present invention expressed by a method, system, recording medium, and computer program are also effective as an aspect of the present invention.

  According to the present invention, information security in a business information system can be improved.

  In this embodiment, two methods of “user authentication initiative type” and “application determination initiative type” will be described. The description will be based on the user authentication initiative type, but the application determination initiative type will be described with supplemental explanation as appropriate. In the user authentication initiative type, there is a possibility that the limited public information can be accessed without applying for access. However, in the application determination initiative type, the access application is an essential condition. Either the user authentication initiative type or the application determination initiative type may be employed, or any one of the server devices or folders to be accessed may be employed.

FIG. 1 is a hardware configuration diagram showing the relationship between the business information protection device 100 and the business information system 300.
The business information system 300 is a system that manages the organizational work of the company A. The business information system 300 integrates two types of systems, a personnel system 310 and an accounting system 312. In addition to this, the business information system 300 may include various systems such as inventory management and product development.
The personnel system 310 includes a server device 320a and a server device 320b as personnel information databases. Data of the server device 320a is hierarchized by folders (directories) 324a, 324b, and 324c. Data of the server device 320b is hierarchized by folders 324d, 324e, 324f, and 324g. The folder 324c of the server device 320a is mapped to the folder 324d of the server device 320b.
The accounting system 312 includes a server device 320c and a server device 320d as accounting information databases. Data of the server device 320c and the server device 320d is also hierarchized by a folder 324. The business information system 300 includes a server device 320e as an in-house bulletin board web server.

  A plurality of client terminals 200 such as the business information system 300, the business information protection device 100, and the client terminals 200a, 200b, and 200c are connected to each other via an intra-company network such as an intranet. The client terminal 200 is a general PC (Personal Computer) terminal equipped with a web browser. An employee (hereinafter also referred to as “regular user”) remotely accesses the business information system 300 from the client terminal 200. One or more approval terminals 322 are also connected to the business information system 300 and the business information protection device 100. The approval terminal 322 is also a general PC terminal equipped with a web browser. The role of the approval terminal 322 will be described later.

  Regular users are classified into a plurality of “user groups”. The “user group” is, for example, a classification of users from the viewpoints of affiliation such as the personnel department and accounting department, contract form such as full-time employees and contract employees, and positions such as section managers and general managers and directors. For example, a regular user α belongs to the user group “HR department”, “contract employee”, and “office work”, and another regular user β belongs to the user groups “sales department”, “regular employee”, and “department manager”. May belong.

  In the personnel system 310 and the accounting system 312, the data held by each server device 320 is limited public information. Only authorized users who belong to the “HR department” may access the limited public information of the server device 320a. In addition, only the authorized user who is “director or higher” and belongs to the “HR department” may access the limited public information held in the folder 324e of the server device 320b. In each system, each server device 320, and each folder 324, a user group (hereinafter, referred to as “authority group”) that can access the private information is set in advance. In the above example, the authority group for the limited public information of the folder 324e is “over manager” and “HR”.

On the other hand, data held by the server device 320e is internal public information. Therefore, if it is an employee of the company A, that is, even a regular user can access the internal public information of the server device 320e. Some folders 324 of the server device 320e also hold complete public information. In this case, even a non-regular user can access the complete public information of the server device 320e.
The business information protection apparatus 100 is an apparatus for determining whether or not remote access from the client terminal 200 to internal public information or limited public information is possible. In the following, description will be made centering on remote access to limited public information.

  The business information protection device 100 includes a user authentication device 120 and an application management device 140. The business information protection device 100 may be a single device that integrally includes the functions of the user authentication device 120 and the application management device 140. In the present embodiment, the business information protection device 100 is described as an aggregate of these two devices. To do.

The user first logs into the client terminal 200 when accessing the internal public information or the limited public information. At this time, a user ID and a password are input to the client terminal 200. Hereinafter, data for identifying a user, such as a user ID or password, is referred to as “user identification information”. The client terminal 200 passes the user identification information to the user authentication device 120. The client terminal 200 may pass the user identification information to the user authentication device 120 via the application management device 140 or the server device 320, or may directly transfer the user identification information to the user authentication device 120.
Instead of the client terminal 200, the user authentication device 120 determines whether the login requesting user is an authorized user (hereinafter referred to as “user authentication”).

Only users who belong to the privileged group of limited public information can access the limited public information. The server device 320a of the personnel system 310 can be accessed by users of the “HR department”. When a user designates the server device 320a as an access destination, if the user belongs to the personnel department, access to the server device 320a is permitted. On the other hand, even when the user does not belong to the human resources department, access is permitted if the user has applied for a remote access to the server device 320a in advance (correctly). It is determined whether or not the application management apparatus 140 has applied (hereinafter referred to as “application determination”). However, in the case of the application determination initiative type, even if the user belongs to the personnel department, prior application is essential.
In the following, a regular user belonging to the authority group for the limited public information A is referred to as “authority user” of the limited public information A. Further, a regular user other than the authorized user for the limited public information A is referred to as “non-authorized user”.
The user accesses an arbitrary server device 320 of the business information system 300 and thus an arbitrary folder 324 from the client terminal 200.

  After the connection between the client terminal 200 and the server device 320 is established, the login user can change the folder 324 to be accessed. At this time, a “folder change request” is transmitted from the client terminal 200 to the corresponding server device 320. If the information held in the change destination folder 324 is limited disclosure information, the server apparatus 320 determines whether the login user is an authorized user for the limited disclosure information. If it is an authorized user, a folder change request is permitted. Originally, even a non-authorized user can make a folder change request if he / she has applied correctly to the application management apparatus 140 in advance. However, in the case of the application determination initiative type, prior application is essential even for an authorized user.

In summary,
1. For the internal public information, the access right is determined by user authentication.
2. For private information,
2-1. In the case of the user authentication initiative type, if it is an authorized user, it is accessible regardless of the determination result of the application determination. Normally, the application determination itself is not executed. On the other hand, even if the user is originally a non-authorized user, the user can temporarily access to the limited public information as an authorized user by applying in advance.
2-2. In the case of the application determination-driven type, even if it is an authorized user, access is impossible unless an advance application is made.

  The internal public information and the limited public information can be managed in units of the server device 320 and the folder 324. The server device 320 and the folder 324 that hold the limited public information hold information about the authority group. The server device 320a holds authority group information about the personnel system 310 and authority group information about the server device 320a. Further, the folder 324b of the server device 320a holds the authority group information of the folder 324b. Similarly, the server device 320b holds authority group information of the server device 320b.

Note that an authority group may not be set for the predetermined limited public information. For example, no authority group is set in the limited public information B of the folder 324g of the server device 320b. No matter what user group the regular user belongs to, an access application must be made in order to access this limited public information B. That is, for the limited public information B, all regular users are non-authorized users. Such a setting method is also effective especially for limited public information with high confidentiality. This effectively has the same effect as the security management by the application determination initiative type.
The flow of the remote access procedure based on the user authentication initiative will be described in detail with reference to FIG. In addition, the flow of the remote access procedure by the application determination initiative type will be described in detail with reference to FIG.

FIG. 2 is a functional block diagram of the business information protection apparatus 100.
Each block shown here can be realized in hardware by an element such as a CPU of a computer or a mechanical device, and in software it is realized by a computer program or the like. Draw functional blocks. Therefore, those skilled in the art will understand that these functional blocks can be realized in various forms by a combination of hardware and software. Here, the function of each unit will be mainly described, and their cooperation, data structure, and operation will be described in detail with reference to FIG.

  The business information protection apparatus 100 in this embodiment includes a user authentication apparatus 120 and an application management apparatus 140 that are connected to each other via a communication line.

  The user first logs into the client terminal 200 before accessing the business information system 300. At this time, a user ID and a password are input to the client terminal 200. In this embodiment, the user ID and password are transferred for user authentication by the user authentication device 120 and application determination by the application management device 140.

A: User authentication device 120
The user authentication device 120 includes a user authentication unit 122 and a regular user information holding unit 124. The regular user information holding unit 124 holds regular user information in which a user ID, a password, and a user group are associated with each other. A user registered in the regular user information is a “regular user”. When the user logs in to the client terminal 200, the client terminal 200 transmits user identification information to the user authentication unit 122. The user authentication unit 122 performs user authentication by comparing the user identification information with the regular user information. The user authentication unit 122 performs user authentication not only for the user of the client terminal 200 but also for the user of the approval terminal 322.

  The user authentication device 120 in this embodiment is a single device, and manages regular user information in an integrated manner. By executing user authentication for a plurality of systems with a single user authentication device 120, a user authentication policy (policy) can be managed centrally.

B: Application management device 140
The application management apparatus 140 includes an application state management unit 142, an application state determination unit 144, an access interface processing unit 146, a user group change unit 182, an execution condition holding unit 150, and an access schedule holding unit 152.

  The execution condition holding unit 150 holds execution condition information indicating an access rule for an unauthorized user. The purpose of remote access is classified into a plurality of types (hereinafter simply referred to as “access types”). Access types include “data reference” for simply browsing data, “data addition” for registering new data, “data change” for rewriting existing data, and “release work” such as software installation. Can be mentioned. In the case of user authentication initiative type, authorized users can access privately disclosed information without applying for access in advance, but non-authorized users can access “access application information” that specifies access date and time, access type, etc. By sending to 100, the access schedule must be applied in advance. The registration determination unit 162 described later checks the suitability of the access application information with reference to the execution condition information.

  For example, when the authority group of the server device 320a is “HR”, the user of the information technology department wants to install new software on the server device 320a. This user is an unauthorized user with respect to the server device 320a. Here, it is assumed that the manager of the server apparatus 320a has registered in the execution condition information that “release work” to the server apparatus 320a can be executed only on February 1st.

Even if a non-authorized user applies for a “release work” to the server device 320a with January 30 as the scheduled date, the request is automatically rejected because it does not conform to the access rules. As described above, the person in charge of management of the server device 320a can register in advance the access rules of the non-authorized user for the server device 320a as execution condition information.
Furthermore, it is possible to register in the execution condition information that the application must be approved by a special user with approval authority (hereinafter simply referred to as “approver”). The data structure of the execution condition information will be further described in detail with reference to FIG.

  The application status management unit 142 is generally in charge of processing related to the access application. The application status management unit 142 includes an access application unit 156, an access approval unit 158, an application notification unit 160, and a registration determination unit 162.

  The access application unit 156 receives access application information. The access application information is a set of data input on the application screen 220 shown in FIG. 4 later. In FIG. 4 later, the purpose of access, the date and time, the subject, the name of the server to be accessed, and the like are shown as input data. . Furthermore, incidental information other than the input data, such as the application date and time and the IP address of the applicant, may be included. The registration determination unit 162 determines whether the access application information matches the execution condition information. In the previous example, when a release operation for the server device 320a is requested for a date other than February 1, the registration determination unit 162 rejects this application and notifies the unauthorized user to that effect. If the application content matches the execution condition information, the registration determination unit 162 registers the application in the access schedule information of the access schedule holding unit 152. The access application registered in the access schedule information is called “valid access application”. The contents of the access schedule information may be substantially equivalent to the contents of the access application information. That is, of the received access application information, only the access application information that satisfies the requirements as a valid access application is formally registered as access schedule information. When a valid access application is made, the registration determination unit 162 assigns an access ID for uniquely identifying a remote access schedule. In the access schedule information, an access ID, an access scheduled date and time, access contents, a user name, an approval status, and the like are associated.

  When the access application information is registered, the application notification unit 160 determines whether or not the application content requires approval with reference to the execution condition information. The application notifying unit 160 notifies the approver of the access ID of access application information that needs to be approved. The application notification unit 160 in this embodiment transmits an e-mail indicating the access ID to the approval terminal 322. The approver accesses the application management apparatus 140 based on the access ID and inputs approval approval / disapproval. The access approval unit 158 receives approval approval from the approval terminal 322. The user interface at this time will be described later with reference to FIG.

  When approved, the access approval unit 158 changes the approval state in the access schedule information from “unapproved” to “approved”. In the case of rejection, the access approval unit 158 notifies the user that the application is rejected and deletes the corresponding application from the access schedule information. In addition, the registration determination unit 162 appropriately deletes the application that has passed the scheduled access date and the already completed application from the access schedule information.

  The application state determination unit 144 executes application determination. Here, the user authentication initiative type and the application determination initiative type will be briefly described.

1: User authentication initiative type In remote login, the client terminal 200 transmits user identification information to the server device 320. The server device 320 transmits user identification information to the user authentication device 120, and the user authentication device 120 performs user authentication. If the login requesting user is a regular user, the server group 320 is notified of the user group to which the user belongs. If the user is an authorized user for the server device 320, the server device 320 permits access and establishes a communication path with the client terminal 200.

The user group changing unit 182 of the application management apparatus 140 updates the authorized user information of the user authentication apparatus 120 as appropriate based on the access schedule information. For example, it is assumed that the user A of the information technology department effectively applies for an access schedule to the personnel system 310 for “February 1 to February 2”. Originally, the user A is not an authorized user related to the server device 320a of the personnel system 310, but is temporarily granted access authority only for the application “February 1st to February 2nd”.
When the user group changing unit 182 arrives on February 1, the user group changing unit 182 temporarily registers as the user group of the user A as “HR”. Then, when February 2 ends, the “personnel department” is deleted from the user group of user A. In other words, the user A temporarily belongs to the personnel department only during the application period.

  In this way, the application management apparatus 140 updates the authorized user information holding unit 124 as appropriate. For this reason, at the time of remote access execution, the user authentication device 120 can effectively execute user authentication and application determination collectively based on the user identification information. Not only remote login but also folder change requests, user authentication-driven access control can be performed with the same algorithm.

2: Application determination initiative type In this application decision initiative type, access to the business information system 300 is not permitted unless a valid access application is made. For this reason, it is a preferable processing model especially when importance is attached to information security.
At the time of remote login, the client terminal 200 transmits user identification information to the server device 320. The server device 320 transmits user identification information to the application management device 140. Here, the application management apparatus 140 acquires the user ID included in the user identification information, and determines whether or not the user has been effectively applied for access. If a valid access application has not been made, access is denied without executing user authentication.

  If the access application is valid, the application management device 140 transfers the user identification information to the user authentication device 120. Here, the user authentication device 120 checks the user ID and password and executes user authentication. If the login requesting user is a regular user, the user authentication device 120 notifies the server device 320 of an access permission notification. The server device 320 establishes a communication path with the client terminal 200 on the condition that the access permission notification is received.

  That is, the application management apparatus 140 eliminates the access of the user who has not applied for an effective access at the previous stage of user authentication based on the access schedule information. Not only remote login but also folder change requests can be controlled by the application determination initiative type with the same algorithm. Details will be described later with reference to FIG.

1. In the case of the user authentication initiative type, the application state determination unit 144 periodically refers to the user identification information and the access schedule information to determine whether access has been applied and, if necessary, further approved. .
2. In the case of the application determination initiative type, the application state determination unit 144 also determines whether or not the remote access request date and time is within the requested access scheduled time. For example, when a certain non-authorized user α has applied for access to the server device 320a by specifying the scheduled access date and time of “February 1”, the server device 320a before January 31st or after February 2nd. Even if a remote access request is made, the result of the application determination is “No” and remote access is not permitted. On the other hand, when the non-authoritative user A makes a remote access request to the server device 320a at the scheduled access date “February 1”, the result of the application determination is “Yes”, and the access interface processing unit 146 permits the access.
Of course, when access requiring approval is applied, access is not permitted unless approved. The access interface processing unit 146 comprehensively controls whether access to the server device 320 and the folder 324 is permitted.

  The application management apparatus 140 in the present embodiment is a single apparatus, and performs application determination centrally. By executing application determination for multiple systems with a single application management device 140, execution condition information and access schedule information can be managed centrally.

FIG. 3 is a data structure diagram of execution condition information in the execution condition holding unit 150.
The execution condition information indicates an access rule defined by the person in charge of managing each server device 320 or folder 324. The rule ID column 164 indicates an ID (hereinafter referred to as “rule ID”) for uniquely identifying an access rule. When an access rule is registered, a rule ID is assigned. The target area column 166 shows the server device 320 and the folder 324 to which the access rule is applied. The date / time column 168 indicates the application date / time of the access rule. The access type column 170 indicates the access type to which the access rule is applied. The approval necessity column 172 indicates whether or not approval is required to execute the corresponding access. For example, an access rule with a rule ID “1” is a folder 324 (hereinafter, referred to as “folder ID: 24”) in a server device 320 (hereinafter referred to as “server device 320 (06)”) as “server ID: 06”. With respect to the limited public information held in “Folder 324 (24)”, it is applied to the time zone of “6:00 to 16:00”.

  That is, when a non-privileged user accesses the folder 324 (24) of the server device 320 (06), the access “data reference” or “data addition” is limited to the time zone “6:00 to 16:00”. Access is permitted if you have applied in advance by type. Approval is not required, as long as the application is correct. However, even if an application is made for the purpose of "data change", it will be rejected. Also, access outside this time period is not permitted.

  On the other hand, when a non-privileged user accesses the server device 320 (08), a prior application is made with an access type of “data change” or “release work” only during the time period “6:00 to 16:00”. If access is approved, access is permitted.

FIG. 4 is a screen diagram showing the application screen 220.
When the user accesses the application management apparatus 140 for an access application, the access application unit 156 displays the application screen 220 shown in FIG. The application screen 220 is a screen displayed as a web page on the client terminal 200.

  In the applicant name area 222, an applicant name is input. When an applicant other than himself / herself works, the applicant inputs the name of the user who will actually perform the work. In the subject area 224, the subject of the work to be applied is input. From the system classification area 226, the type of the target system is selected. Here, the accounting system 312 is selected. The server designation area 227 indicates the server ID of the server device 320 to be accessed, and the folder designation area 228 indicates the folder ID of the folder 324 to be accessed. In the server designation area 227 and the folder designation area 228, a plurality of server devices 320 and a plurality of folders 324 may be designated.

  The access type area 230 indicates the access type. The content input area 232 is an area for freely describing work contents and the like. The scheduled access date / time area 234 indicates the scheduled access date / time. The applicant clicks the application button 236 after inputting data in each item shown on the application screen 220. Then, the input data is transmitted to the application management apparatus 140 as access application information.

FIG. 5 is a screen diagram showing the approval screen 260.
When an access application that requires approval is made, the application notification unit 160 notifies the access terminal 322 of the access ID. When the approver specifies the access ID and accesses the application management apparatus 140, the access approval unit 158 causes the approval terminal 322 to display the approval screen 260 shown in FIG. The approval screen 260 is also displayed on the approval terminal 322 as a web page.

  The application information area 262 indicates the application content input on the application screen 220. The approver name area 264 is an area for inputting an approver name. The approval requester name area 266 is an area for inputting the name of the user who requested the approval. For example, when the user B having the authorization authority requests the user C to approve, the user C makes an approval judgment on behalf of the user B. This is a measure for dealing with a special situation such as when the user B is on vacation. The communication column 268 is a column describing a message for the applicant. When the reason for rejecting the application is described, or when the application is approved, a description for adding conditions and orders to the work content may be made. The approval button 270 is a button for approval, and the rejection button 272 is a button for rejection. When any of the approval button 270 and the reject button 272 is clicked, the input content and data indicating approval / disapproval are transmitted to the application management apparatus 140. The access approval unit 158 transmits this data to the client terminal 200 by e-mail, for example.

FIG. 6 shows an access screen 294 when accessing the personnel system 310 from the client terminal 200 after successful remote login.
When the connection from the client terminal 200 to the personnel system 310 is established, an access screen 294 indicating the folder structure of the personnel system 310 is displayed on the client terminal 200. As shown in the figure, the folders 324 of the server device 320a and the server device 320b are hierarchized and displayed on the screen. The user selects a folder 324 to be accessed. At this time, a folder change request is transmitted from the client terminal 200 to the corresponding server device 320. In the case of user authentication initiative type, the server apparatus 320 determines whether the user is an authorized user for the change destination folder 324.

FIG. 7 is a sequence diagram showing a process of access application processing.
At the time of the access application, the user of the client terminal 200 transmits the user identification information and directly accesses the application management device 140 (S10). The application management device 140 transfers the user identification information to the user authentication device 120 (S12). The user authentication unit 122 of the user authentication device 120 performs user authentication (S14). If user authentication fails, the subsequent processing is not executed. Here, the description will be continued assuming that the user authentication is successful.

  The user authentication device 120 notifies the application management device 140 of the result of user authentication, that is, the success of authentication (S16). The access application unit 156 of the application management apparatus 140 transmits HTML (Hyper Text Markup Language) data for the application screen 220 (S18), and the client terminal 200 displays the application screen 220 (S20). When the user inputs data to the application screen 220 and clicks the application button 236 (S22), the input data is transmitted to the application management apparatus 140 as access application information (S24).

The registration determination unit 162 of the application management apparatus 140 compares the application content with the execution condition information and determines whether registration is possible (S26). If it is not a valid access application, the registration determination unit 162 rejects the application, notifies the client terminal 200 of the rejection, and the subsequent processing is not executed. Here, the description will be continued assuming that the access application is valid.
The registration determination unit 162 registers the application in the access schedule information of the access schedule holding unit 152 (S28). At this time, an access ID is given. If approval is required, the application notifying unit 160 transmits an e-mail requesting approval to the approval terminal 322 (S30).

FIG. 8 is a sequence diagram showing the process of access approval processing.
After the approval terminal 322 receives the e-mail in S30 of FIG. 7, the approver accesses the application management apparatus 140 together with his / her user identification information at an arbitrary timing (S32). The approver also specifies an access ID.

  The application management device 140 transfers the user identification information of the approver to the user authentication device 120 (S34). The user authentication unit 122 of the user authentication device 120 performs user authentication with reference to the regular user information (S36). In this user authentication, not only a regular user but also whether it is registered as an “authorization authority” is determined. If user authentication fails, the subsequent processing is not executed. Here, the description will be continued assuming that the user authentication is successful.

  The user authentication device 120 notifies the application management device 140 of data indicating the result of user authentication, here, data indicating success of authentication (S38). The access approval unit 158 of the application management apparatus 140 transmits HTML data for the approval screen 260 (S40), and the approval terminal 322 displays the approval screen 260 (S42). When the user inputs data to the approval screen 260 and clicks the approval button 270 or the reject button 272 (S44), the input data is transmitted to the application management device 140 (S46).

The access approval unit 158 of the application management apparatus 140 updates the access schedule information in the access schedule holding unit 152 in accordance with approval / disapproval (S48). The access approval unit 158 notifies the client terminal 200 of approval / disapproval (S50).
With the above processing, the access that has been effectively applied is approved. When the approver accesses the application management apparatus 140, the application management apparatus 140 displays a list of access applications awaiting approval, and the approver selects an access application to be approved from among the user applications. Also good.

FIG. 9 is a sequence diagram showing a remote access execution process from the client terminal 200 to the server device 320 in the user authentication initiative type.
A case where the user accesses the personnel system 310 will be described. At this time, a remote access request is transmitted from the client terminal 200 to the server device 320a that is the entrance of the personnel system 310 (S100). At this time, the user identification information is also transmitted to the server device 320a. The server apparatus 320a inquires of the user authentication apparatus 120 about the authority group of this user (S102). The application management device 140 periodically updates the authorized user information holding unit 124 of the user authentication device 120 based on the access schedule information. The user authentication device 120 first performs user authentication based on the user identification information before determining the authority group (S104). If the user authentication fails, access to the personnel system 310 is not permitted, but the description is continued here assuming that the user authentication is successful. Next, the user authentication device 120 identifies the authority group of the login user with reference to the regular user information holding unit 124 (S106), and notifies the server device 320 (S108). The authority group here may be the original authority group of the user who is the access source, or may be an authority group that temporarily belongs to the application. The server device 320a refers to this authority group, and if the user is an authorized user who can access the server device 320a (Y in S110), the screen data of the access screen 294 is transmitted to the client terminal 200 (S112). If it is not an authorized user (N of S110), access is not permitted.

  The same applies when the user changes the folder 324 to be accessed on the access screen 294. For example, assume that the folder 324 to be accessed is changed from the folder 324a of the server device 320a to the folder 324f of the server device 320b. When the user changes the access destination folder on the access screen 294, the client terminal 200 transmits a folder change request to the server apparatus 320b. The server device 320 determines whether this user is an authorized user for the folder 324f. If the user is an authorized user, the client terminal 200 permits access to the folder 324f.

FIG. 10 is a sequence diagram illustrating a remote access execution process from the client terminal 200 to the server device 320 in the application determination initiative type.
Again, a case where the user accesses the personnel system 310 will be described. A remote access request is transmitted from the client terminal 200 to the server apparatus 320a that is the entrance of the personnel system 310 (S120). User identification information is also transmitted to the server device 320a. The server apparatus 320a inquires of the application management apparatus 140 whether the user has made a valid application in advance (S122). If the application has not been completed (N in S124), the application management device 140 transmits an access rejection notice to the server device 320 (S126), and the access fails. If the application is valid for the time period (Y in S124), the application management apparatus 140 requests the user authentication apparatus 120 for user authentication (S124). The user authentication device 120 performs user authentication based on the user identification information (S126). That is, it is determined whether the user ID and the password match. The user authentication device 120 transmits the result of user authentication to the server device 320 (S128). If the user authentication is successful, the server device 320 transmits the screen data of the access screen 294 to the client terminal 200 (S130).
As a modified example, if the application has not been applied (N in S124), the application management apparatus 140 may not explicitly send an access denial notification to the server apparatus 320, and may not request user authentication to the user authentication apparatus 120. Good. That is, if the application has not been completed, a series of processes are interrupted in the application management apparatus 140. After the inquiry to the application management device 140 (S122), the server device 320 determines that the remote access is denied if the user authentication result is not returned from the user authentication device 120 even after a predetermined time has elapsed. May be.

FIG. 11 is a sequence diagram illustrating a process of user group change processing.
In any case of the user authentication initiative type and the application determination initiative type, the business information protection apparatus 100 can periodically change the user group of each regular user. For example, in the case of a contract employee dispatched to the personnel department with a contract period of 2007, only 2007 is accessible to the limited public information of the personnel system 310. In addition, in the case of an employee who belongs to the accounting department until March 31, 2007 and is determined to be assigned to the human resources department from April 1, the user group will be changed from April 1. As described above, the user group change of the regular user is often confirmed as an organization schedule. The user group changing unit 182 holds a “group changing condition” as a condition for changing the user group of such a regular user.
The user group changing unit 182 of the application management apparatus 140 periodically repeats the processes of S80, S82, and S84 shown in FIG. The start timing of this loop processing is set to a predetermined time, for example, 6:00 am every day.

  When the loop processing start timing is reached, the user group changing unit 182 of the application management apparatus 140 reads the group change condition (S80) and determines whether there is a regular user whose user group should be changed (S82). If there is a user whose user group should be changed (Y in S82), the user group changing unit 182 notifies the user authentication apparatus 120 of the user identification information of the regular user and the changed user group (S84). The user authentication device 120 updates the regular user information (S86). By such a loop process, the regular user information is periodically updated.

As described above, according to the business information protection apparatus 100 shown in the present embodiment, since the access right to the limited public information is determined by the user authentication and the application determination, the unauthorized access can be easily prevented. The authorized user can access the limited public information simply by logging into the client terminal 200. For this reason, the troublesomeness associated with setting the department password is avoided. On the other hand, even a non-privileged user can access the limited public information by applying for an access schedule in advance. In the case of the application determination-led type, since the limited access is not possible unless the access schedule is applied in advance, the security becomes stronger.
Furthermore, it is easy to temporarily and limitedly control the access rights of the unprivileged user to the limited public information by setting the execution condition information and determining whether to approve. Since access rights can be controlled not only in units of systems and server devices 320 but also in units of folders 324, security can be precisely and easily controlled according to the importance of the limited public information. By automatically managing user groups according to group change conditions, information security can be maintained without burdening the user even when the organization is changed.
With such characteristics, the business information protection apparatus 100 contributes to “intensification of internal control” required by the SOX method.

  Usually, the execution schedule of remote access work is often determined in advance. According to the business information protection apparatus 100 of the present embodiment, security management of the business information system 300 can be performed in a manner that does not place an excessive psychological burden on the user and the approver by the operation of prior access application and approval at an arbitrary timing. Can be realized.

  Each server device 320 of the business information system 300 may notify the business information protection device 100 of the access content from the client terminal 200 to the own device. The business information protection apparatus 100 may record an access log indicating actual access contents. According to such an aspect, the business information protection apparatus 100 can check whether a flaw has occurred between the requested access content and the actual access content. Therefore, it is possible to check whether unauthorized access has occurred after the fact even after the access is permitted.

  Further, the business information protection apparatus 100 can centrally manage access to a plurality of systems. This makes it easy to apply a uniform access policy to a plurality of systems. Furthermore, there is an advantage that it can be realized only by adding the business information protection device 100 to the business information system 300 that has already been operated.

  In the above, this invention was demonstrated based on the Example. The embodiments are exemplifications, and it will be understood by those skilled in the art that various modifications can be made to combinations of the respective constituent elements and processing processes, and such modifications are within the scope of the present invention. .

The function of the access application receiving unit described in the claims is mainly realized by the access application unit 156 in this embodiment. Further, the function of the access request acquisition unit described in the claims is realized mainly by the access interface processing unit 146 in this embodiment.
In addition, it should be understood by those skilled in the art that the functions to be fulfilled by the constituent elements described in the claims are realized by the individual functional blocks shown in the present embodiment or their linkage. .

  Various aspects of the invention ascertained from the above embodiments and modifications will be exemplified below, including those already described in the claims. The following A group inventions are recognized for user authentication driven features.

A1. A device for controlling remote access from a client terminal to a server device in a business information system for managing organizational work by cooperation of a plurality of server devices,
A regular user information holding unit for holding regular user information indicating correspondence between a regular user capable of performing remote access and any of a plurality of user groups;
An access application receiving unit for receiving access application information indicating a server device to be executed for remote access and a user scheduled to execute remote access from a client terminal;
Based on the received access application information, an access schedule holding unit that holds access schedule information indicating a remote access schedule for each server device;
A user group changing unit for temporarily registering a user scheduled to perform remote access to a predetermined user group set in advance for a server device to be executed for remote access with reference to the access schedule information;
An access request acquisition unit for acquiring user identification information for specifying a user and server identification information for specifying a server device to be remotely accessed in remote access to any server device from a client terminal;
A user authentication unit that determines whether a user who requests remote access is registered as a regular user with reference to the user identification information and the regular user information;
In order to determine on the server device side whether the user requesting remote access belongs to the user group set for the server device, the remote access is requested with reference to the user identification information and the regular user information. A user group notification unit for notifying the server device of the user group to which the user belongs;
A business information protection device characterized by comprising:

A2. A user condition setting unit for receiving a group change condition setting input indicating a condition for changing a user group to which a regular user belongs;
When the group change condition is satisfied, a user group change unit that changes a user group to which the target regular user belongs,
The business information protection device according to A1, comprising:

It is a hardware block diagram which shows the relationship between a business information protection apparatus and a business information system. It is a functional block diagram of a business information protection device. It is a data structure figure of the execution condition information in an execution condition holding part. It is a screen figure which shows an application screen. It is a screen figure which shows an approval screen. It is a figure which shows the access screen when accessing a personnel system from a client terminal after remote login is successful. It is a sequence diagram which shows the process of an access application process. It is a sequence diagram which shows the process of an access approval process. FIG. 10 is a sequence diagram showing a remote access execution process from a client terminal to a server device in a user authentication initiative type. FIG. 10 is a sequence diagram illustrating a remote access execution process from a client terminal to a server device in an application determination initiative type. It is a sequence diagram which shows the process of a user group change process.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 100 Business information protection apparatus, 120 User authentication apparatus, 122 User authentication part, 124 Regular user information holding part, 140 Application management apparatus, 142 Application state management part, 144 Application state determination part, 146 Access interface processing part, 150 Execution condition holding Department, 152 access schedule holding section, 156 access application section, 158 access approval section, 160 application notification section, 162 registration determination section, 182 user group change section, 200 client terminal, 300 business information system, 310 personnel system, 312 accounting system 320 server device, 322 terminal for approval, 324 folder.

Claims (4)

A device for controlling remote access from a client terminal to a server device in a business information system for managing organizational work by cooperation of a plurality of server devices,
An authorized user information holding unit for holding authorized user information indicating authorized users capable of remote access;
An access application receiving unit for receiving access application information indicating a server device to be executed for remote access and a user scheduled to execute remote access from a client terminal;
Based on the received access application information, an access schedule holding unit that holds access schedule information indicating a remote access schedule for each server device;
An access request acquisition unit that acquires user identification information for specifying a user and server identification information for specifying a server device that is a remote access target in remote access to any server device from a client terminal;
With reference to the access schedule information, an application state determination unit that determines whether or not an access from a user requesting the remote access has been applied for the server device to be remotely accessed;
On the condition that the determination result of the application status determination unit is affirmative, it is determined whether or not a user who requests remote access is registered as a regular user with reference to the user identification information and the regular user information A user authentication unit to
On condition that the determination result of the user authentication unit is an affirmative determination, an access control unit that permits remote access to the server device,
A business information protection device characterized by comprising: The server device classifies and holds data in multiple folder areas,
The access application receiving unit receives the access application information as information indicating a folder area to be executed by remote access,
The access schedule holding unit holds the access schedule information as information indicating a remote access schedule for each folder area in the server device based on the received access application information,
The access request acquisition unit receives a new access destination when a folder change request for changing a folder area to be executed for remote access is transmitted from the client terminal to the server apparatus to be remote accessed. Folder identification information indicating the folder area
The application state determination unit refers to the access schedule information, determines whether or not an application from the user has been applied for the folder area to be the new access destination,
The business according to claim 1, wherein the access control unit permits access to the folder area as the new access destination on condition that the determination of the application state determination unit is affirmative. Information protection device. An access application notifying unit that notifies access application information to the terminal for approval,
An access approval acquisition unit for accepting approval / disapproval for the access application information from the approval terminal;
The access schedule holding unit holds, as the access schedule information, a remote access schedule for each server device and its approval state in association with each other,
2. The business according to claim 1, wherein the application state determination unit further determines whether or not an access application from a user requesting the remote access is approved for the server device to be remotely accessed. Information protection device. An execution condition holding unit for holding execution condition information in which remote access execution conditions are defined;
An application registration determination unit that regularly registers the execution schedule of the applied remote access as the access schedule information on condition that the received access application information is consistent with the execution condition information;
The business information protection apparatus according to claim 1, further comprising:

Images